7abedb7bd160a5b1ef7467dd58dd70b6aa50b2983f54c7dab0cd100adb645dcc

Analysis

user interaction
yes
max time kernel
150s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/09/2026, 15:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
rans0m.exe
Size 52.3MB
Sample260916-s1stessdma
SHA256 7abedb7bd160a5b1ef7467dd58dd70b6aa50b2983f54c7dab0cd100adb645dcc
MD5 f63b3544d5007af53976c71516612f3a
SHA1 cb9bbf84ba519aa4d8cdbf5da9d56e00eaf966f4
SHA512 367fe627db7a17e05dbefd8106c7a1b3a4128987d7d5ceff8acb17983f1f6da4547a5bf40b287a8507819cc5e2ec1a52fa0f6a5d9246a808f4763337568267d0
SSDEEP 786432:3i3/CStoACa66Z7lZrZzFY1NdjgJ/LxOjHyqsaWCuyYjV0XshJWcoZ0causDoXq1:it3ZBZjqxaJCusshkbZnmYNeRRd+UH
TLSH
T180C71215E263E700C1ED9536DD42C99447217D469F029AEB2078FB8B7A723C3BD3269E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence ransomware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
78	1188	msedge.exe

Executes dropped EXE 8 IoCs

pid	Process
2644	windowsdesktop-runtime-10.0.12-win-x64.exe
4208	wixstdba.exe
5360	windowsdesktop-runtime-10.0.12-win-x64.exe
4648	wixstdba.exe
672	windowsdesktop-runtime-10.0.12-win-x64.exe
5352	windowsdesktop-runtime-10.0.12-win-x64.exe
3296	windowsdesktop-runtime-10.0.12-win-x64.exe
3744	wixstdba.exe

Loads dropped DLL 8 IoCs

pid	Process
6024	MsiExec.exe
6024	MsiExec.exe
1456	MsiExec.exe
1456	MsiExec.exe
2664	MsiExec.exe
2664	MsiExec.exe
4016	MsiExec.exe
4016	MsiExec.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2} = "\"C:\\ProgramData\\Package Cache\\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}\\windowsdesktop-runtime-10.0.12-win-x64.exe\" /burn.runonce"	windowsdesktop-runtime-10.0.12-win-x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Console.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\ko\UIAutomationTypes.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\swidtag\Microsoft Windows Desktop Runtime 10.0.12 (x64).swidtag	windowsdesktop-runtime-10.0.12-win-x64.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\System.Private.Windows.GdiPlus.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\de\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\it\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\pl\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Diagnostics.Tracing.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\pl\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Formats.Tar.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\clrgc.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\Accessibility.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\cs\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\ja\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Transactions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\zh-Hans\WindowsFormsIntegration.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Data.DataSetExtensions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Private.Uri.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\Microsoft.WindowsDesktop.App.runtimeconfig.json	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\cs\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\es\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\fr\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\it\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.IO.IsolatedStorage.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\pt-BR\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Drawing.Primitives.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Threading.AccessControl.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Collections.NonGeneric.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\fr\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\.version	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Diagnostics.Debug.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Runtime.Serialization.Primitives.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Security.Cryptography.Algorithms.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\pt-BR\WindowsBase.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\ru\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Security.Principal.Windows.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\tr\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Net.Requests.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\UIAutomationTypes.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\de\UIAutomationTypes.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\it\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\ja\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\zh-Hans\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Runtime.Intrinsics.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Xml.Linq.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\System.Private.Windows.Core.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\WindowsBase.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\zh-Hans\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\PresentationFramework.AeroLite.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\PresentationFramework.Fluent.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Reflection.Primitives.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Web.HttpUtility.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\pt-BR\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\pt-BR\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\de\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\fr\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\ko\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\tr\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\es\WindowsBase.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\Microsoft.NETCore.App.deps.json	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.IO.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\clrjit.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\PresentationFramework.Royale.dll	msiexec.exe

Drops file in Windows directory 54 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSIE716.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149	msiexec.exe
File created	C:\Windows\SystemTemp\~DFE7A08C4495D4EA05.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{902710DF-F5E0-42EB-8959-ECC10CC368DF}	msiexec.exe
File opened for modification	C:\Windows\Installer\e5ade3d.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{8C704AC7-A0DB-44DD-A1F3-F0FBDF1FF693}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID55.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFFA180FDCC13FC957.TMP	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFB21C64F0A9A4C191.TMP	msiexec.exe
File created	C:\Windows\Installer\e5ade32.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF88BA99300CB6167D.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF8BF4E8CB5BFD54B3.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5812_218200362\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\~DFDF69711AC0E10E68.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF080.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFD7A81A363E97586E.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5812_1906927033\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\~DFDF095C4E5E83D950.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF30D7CA4B7E8E9F72.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF97C.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF015D458149B6180F.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIED80.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFE28596C6749F30A0.TMP	msiexec.exe
File created	C:\Windows\Installer\e5ade37.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5ade38.msi	msiexec.exe
File created	C:\Windows\Installer\e5ade3c.msi	msiexec.exe
File created	C:\Windows\Installer\e5ade3d.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1DF0.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5812_1906927033\manifest.json	msedge.exe
File created	C:\Windows\Installer\e5ade2c.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{17D94539-A423-48D9-BD4A-69A9186C5B66}	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1	msiexec.exe
File created	C:\Windows\SystemTemp\~DF176EE3961F40EAE1.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e5ade33.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5F0.tmp	msiexec.exe
File created	C:\Windows\Installer\e5ade41.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149\fileCoreHostExe	msiexec.exe
File created	C:\Windows\SystemTemp\~DFD99B600F38C2D8C8.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{E358F0F7-0226-419D-85E6-D45A08BF195F}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF16B.tmp	msiexec.exe
File created	C:\Windows\Installer\e5ade38.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF583.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF5CE5F39C450DC0AC.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e5ade2c.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE31E.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFD96DA236F21BB984.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149\fileCoreHostExe	msiexec.exe
File created	C:\Windows\Installer\e5ade33.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEFB4.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF9D2FEF9CC53EF2A0.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9BA.tmp	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.12-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.12-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.12-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wixstdba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wixstdba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wixstdba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.12-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.12-win-x64.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1188	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 11 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134340465852609481"	msedge.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7F0F853E6220D914586E4DA580FB91F5\Version = "1345381484"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD0172090E5FBE249895CE1CC03C86FD\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\93549D71324A9D84DBA4969A81C6B566\ProductName = "Microsoft .NET Host - 10.0.12 (x64)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7F0F853E6220D914586E4DA580FB91F5\PackageCode = "A67E422DCB5A6B244B1F3508AB24FAC5"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7F0F853E6220D914586E4DA580FB91F5\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7CA407C8BD0ADD441A3F0FBFFDF16F39\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.48.58476_x64	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7F0F853E6220D914586E4DA580FB91F5\SourceList\PackageName = "dotnet-hostfxr-10.0.12-win-x64.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD0172090E5FBE249895CE1CC03C86FD\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_80.48.58476_x64\Version = "80.48.58476"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\7CA407C8BD0ADD441A3F0FBFFDF16F39	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7CA407C8BD0ADD441A3F0FBFFDF16F39\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.48.58476_x64\Dependents\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}	windowsdesktop-runtime-10.0.12-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7CA407C8BD0ADD441A3F0FBFFDF16F39	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7F0F853E6220D914586E4DA580FB91F5\ProductName = "Microsoft .NET Host FX Resolver - 10.0.12 (x64)"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7F0F853E6220D914586E4DA580FB91F5\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}\ = "{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}"	windowsdesktop-runtime-10.0.12-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD0172090E5FBE249895CE1CC03C86FD\SourceList\PackageName = "dotnet-runtime-10.0.12-win-x64.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7CA407C8BD0ADD441A3F0FBFFDF16F39\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{8C704AC7-A0DB-44DD-A1F3-F0FBDF1FF693}v80.48.58476\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\93549D71324A9D84DBA4969A81C6B566\DeploymentFlags = "3"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7F0F853E6220D914586E4DA580FB91F5\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7CA407C8BD0ADD441A3F0FBFFDF16F39\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\245448558535FDC5C8905F329F49898C	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\245448558535FDC5C8905F329F49898C\7F0F853E6220D914586E4DA580FB91F5	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD0172090E5FBE249895CE1CC03C86FD\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{902710DF-F5E0-42EB-8959-ECC10CC368DF}v80.48.58476\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7CA407C8BD0ADD441A3F0FBFFDF16F39\PackageCode = "42D1166D1B8486B4FB84F5D703BB4E53"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\windowsdesktop_runtime_80.48.58476_x64	windowsdesktop-runtime-10.0.12-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\93549D71324A9D84DBA4969A81C6B566\MainFeature	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A8A84F1AA6E5EFD5BE00C8237B84D6D4	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7F0F853E6220D914586E4DA580FB91F5\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7F0F853E6220D914586E4DA580FB91F5\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.48.58476_x64\Dependents	windowsdesktop-runtime-10.0.12-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7CA407C8BD0ADD441A3F0FBFFDF16F39\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7CA407C8BD0ADD441A3F0FBFFDF16F39\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_80.48.58476_x64\Dependents\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}	windowsdesktop-runtime-10.0.12-win-x64.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\93549D71324A9D84DBA4969A81C6B566\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x64\Dependents	windowsdesktop-runtime-10.0.12-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.48.58476_x64\ = "{E358F0F7-0226-419D-85E6-D45A08BF195F}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7CA407C8BD0ADD441A3F0FBFFDF16F39\ProductName = "Microsoft Windows Desktop Runtime - 10.0.12 (x64)"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7CA407C8BD0ADD441A3F0FBFFDF16F39\Version = "1345381484"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}\Dependents	windowsdesktop-runtime-10.0.12-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\93549D71324A9D84DBA4969A81C6B566\PackageCode = "F51312C54E22CEC4182D8D57784720B0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\93549D71324A9D84DBA4969A81C6B566\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD0172090E5FBE249895CE1CC03C86FD\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD0172090E5FBE249895CE1CC03C86FD\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{902710DF-F5E0-42EB-8959-ECC10CC368DF}v80.48.58476\\"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD0172090E5FBE249895CE1CC03C86FD\Clients = 3a0000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\93549D71324A9D84DBA4969A81C6B566\Version = "1345381484"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\FD0172090E5FBE249895CE1CC03C86FD	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7CA407C8BD0ADD441A3F0FBFFDF16F39\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7CA407C8BD0ADD441A3F0FBFFDF16F39\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_80.48.58476_x64\Dependents	windowsdesktop-runtime-10.0.12-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\93549D71324A9D84DBA4969A81C6B566\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\93549D71324A9D84DBA4969A81C6B566\SourceList\Net	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD0172090E5FBE249895CE1CC03C86FD\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}	windowsdesktop-runtime-10.0.12-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\93549D71324A9D84DBA4969A81C6B566	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7F0F853E6220D914586E4DA580FB91F5	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7F0F853E6220D914586E4DA580FB91F5\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\93549D71324A9D84DBA4969A81C6B566\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\FD0172090E5FBE249895CE1CC03C86FD\MainFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\7F0F853E6220D914586E4DA580FB91F5\MainFeature	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7F0F853E6220D914586E4DA580FB91F5\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7F0F853E6220D914586E4DA580FB91F5\InstanceType = "0"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3256	msiexec.exe
3256	msiexec.exe
3256	msiexec.exe
3256	msiexec.exe
3256	msiexec.exe
3256	msiexec.exe
3256	msiexec.exe
3256	msiexec.exe
6432	msedge.exe
6432	msedge.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
5812	msedge.exe
5812	msedge.exe
5812	msedge.exe
5812	msedge.exe
5812	msedge.exe
5812	msedge.exe
5812	msedge.exe
5812	msedge.exe
5812	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	672	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeIncreaseQuotaPrivilege	672	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeSecurityPrivilege	3256	msiexec.exe
Token: SeCreateTokenPrivilege	672	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeAssignPrimaryTokenPrivilege	672	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeLockMemoryPrivilege	672	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeIncreaseQuotaPrivilege	672	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeMachineAccountPrivilege	672	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeTcbPrivilege	672	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeSecurityPrivilege	672	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeTakeOwnershipPrivilege	672	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeLoadDriverPrivilege	672	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeSystemProfilePrivilege	672	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeSystemtimePrivilege	672	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeProfSingleProcessPrivilege	672	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeIncBasePriorityPrivilege	672	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeCreatePagefilePrivilege	672	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeCreatePermanentPrivilege	672	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeBackupPrivilege	672	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeRestorePrivilege	672	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeShutdownPrivilege	672	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeDebugPrivilege	672	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeAuditPrivilege	672	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeSystemEnvironmentPrivilege	672	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeChangeNotifyPrivilege	672	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeRemoteShutdownPrivilege	672	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeUndockPrivilege	672	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeSyncAgentPrivilege	672	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeEnableDelegationPrivilege	672	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeManageVolumePrivilege	672	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeImpersonatePrivilege	672	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeCreateGlobalPrivilege	672	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeRestorePrivilege	3256	msiexec.exe
Token: SeTakeOwnershipPrivilege	3256	msiexec.exe
Token: SeRestorePrivilege	3256	msiexec.exe
Token: SeTakeOwnershipPrivilege	3256	msiexec.exe
Token: SeRestorePrivilege	3256	msiexec.exe
Token: SeTakeOwnershipPrivilege	3256	msiexec.exe
Token: SeRestorePrivilege	3256	msiexec.exe
Token: SeTakeOwnershipPrivilege	3256	msiexec.exe
Token: SeRestorePrivilege	3256	msiexec.exe
Token: SeTakeOwnershipPrivilege	3256	msiexec.exe
Token: SeRestorePrivilege	3256	msiexec.exe
Token: SeTakeOwnershipPrivilege	3256	msiexec.exe
Token: SeRestorePrivilege	3256	msiexec.exe
Token: SeTakeOwnershipPrivilege	3256	msiexec.exe
Token: SeRestorePrivilege	3256	msiexec.exe
Token: SeTakeOwnershipPrivilege	3256	msiexec.exe
Token: SeRestorePrivilege	3256	msiexec.exe
Token: SeTakeOwnershipPrivilege	3256	msiexec.exe
Token: SeRestorePrivilege	3256	msiexec.exe
Token: SeTakeOwnershipPrivilege	3256	msiexec.exe
Token: SeRestorePrivilege	3256	msiexec.exe
Token: SeTakeOwnershipPrivilege	3256	msiexec.exe
Token: SeRestorePrivilege	3256	msiexec.exe
Token: SeTakeOwnershipPrivilege	3256	msiexec.exe
Token: SeRestorePrivilege	3256	msiexec.exe
Token: SeTakeOwnershipPrivilege	3256	msiexec.exe
Token: SeRestorePrivilege	3256	msiexec.exe
Token: SeTakeOwnershipPrivilege	3256	msiexec.exe
Token: SeRestorePrivilege	3256	msiexec.exe
Token: SeTakeOwnershipPrivilege	3256	msiexec.exe
Token: SeRestorePrivilege	3256	msiexec.exe
Token: SeTakeOwnershipPrivilege	3256	msiexec.exe

Suspicious use of FindShellTrayWindow 11 IoCs

pid	Process
5812	msedge.exe
5812	msedge.exe
5812	msedge.exe
5812	msedge.exe
5812	msedge.exe
5812	msedge.exe
5812	msedge.exe
5812	msedge.exe
5812	msedge.exe
5812	msedge.exe
4648	wixstdba.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3256	msiexec.exe
6024	MsiExec.exe
1456	MsiExec.exe
2664	MsiExec.exe
4016	MsiExec.exe
5876	ShellHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5312 wrote to memory of 5812	5312	rans0m.exe	86
PID 5812 wrote to memory of 1628	5812	msedge.exe	87
PID 5812 wrote to memory of 1188	5812	msedge.exe	88
PID 5812 wrote to memory of 4552	5812	msedge.exe	90
PID 5812 wrote to memory of 4552	5812	msedge.exe	90
PID 5812 wrote to memory of 5412	5812	msedge.exe	92
PID 5812 wrote to memory of 5412	5812	msedge.exe	92
PID 5812 wrote to memory of 5412	5812	msedge.exe	92
PID 5812 wrote to memory of 2232	5812	msedge.exe	93
PID 5812 wrote to memory of 2232	5812	msedge.exe	93
PID 5812 wrote to memory of 2232	5812	msedge.exe	93
PID 5812 wrote to memory of 5096	5812	msedge.exe	89
PID 5812 wrote to memory of 5096	5812	msedge.exe	89
PID 5812 wrote to memory of 5096	5812	msedge.exe	89
PID 5812 wrote to memory of 4872	5812	msedge.exe	94
PID 5812 wrote to memory of 4872	5812	msedge.exe	94
PID 5812 wrote to memory of 4872	5812	msedge.exe	94
PID 5812 wrote to memory of 4448	5812	msedge.exe	95
PID 5812 wrote to memory of 4448	5812	msedge.exe	95
PID 5812 wrote to memory of 4448	5812	msedge.exe	95
PID 5812 wrote to memory of 1428	5812	msedge.exe	96
PID 5812 wrote to memory of 1428	5812	msedge.exe	96
PID 5812 wrote to memory of 1120	5812	msedge.exe	98
PID 5812 wrote to memory of 1292	5812	msedge.exe	99
PID 5812 wrote to memory of 1120	5812	msedge.exe	98
PID 5812 wrote to memory of 1292	5812	msedge.exe	99
PID 5812 wrote to memory of 4744	5812	msedge.exe	100
PID 5812 wrote to memory of 4744	5812	msedge.exe	100
PID 5812 wrote to memory of 4744	5812	msedge.exe	100
PID 5812 wrote to memory of 2608	5812	msedge.exe	102
PID 5812 wrote to memory of 5924	5812	msedge.exe	105
PID 5812 wrote to memory of 5924	5812	msedge.exe	105
PID 5812 wrote to memory of 4196	5812	msedge.exe	106
PID 5812 wrote to memory of 4196	5812	msedge.exe	106
PID 5812 wrote to memory of 972	5812	msedge.exe	109
PID 5812 wrote to memory of 2356	5812	msedge.exe	108
PID 5812 wrote to memory of 972	5812	msedge.exe	109
PID 5812 wrote to memory of 972	5812	msedge.exe	109
PID 5812 wrote to memory of 2356	5812	msedge.exe	108
PID 5812 wrote to memory of 4372	5812	msedge.exe	110
PID 5812 wrote to memory of 4928	5812	msedge.exe	111
PID 5812 wrote to memory of 4928	5812	msedge.exe	111
PID 5812 wrote to memory of 4928	5812	msedge.exe	111
PID 5812 wrote to memory of 3524	5812	msedge.exe	112
PID 5812 wrote to memory of 3524	5812	msedge.exe	112
PID 5812 wrote to memory of 2644	5812	msedge.exe	113
PID 2644 wrote to memory of 4208	2644	windowsdesktop-runtime-10.0.12-win-x64.exe	114
PID 5812 wrote to memory of 5360	5812	msedge.exe	115
PID 5360 wrote to memory of 4648	5360	windowsdesktop-runtime-10.0.12-win-x64.exe	116
PID 5360 wrote to memory of 672	5360	windowsdesktop-runtime-10.0.12-win-x64.exe	146
PID 5352 wrote to memory of 3296	5352	windowsdesktop-runtime-10.0.12-win-x64.exe	122
PID 5812 wrote to memory of 3016	5812	msedge.exe	123
PID 5812 wrote to memory of 4264	5812	msedge.exe	124
PID 5812 wrote to memory of 5616	5812	msedge.exe	125
PID 3256 wrote to memory of 6024	3256	msiexec.exe	126
PID 3256 wrote to memory of 1456	3256	msiexec.exe	127
PID 3256 wrote to memory of 2664	3256	msiexec.exe	128
PID 3296 wrote to memory of 3744	3296	windowsdesktop-runtime-10.0.12-win-x64.exe	129
PID 3256 wrote to memory of 4016	3256	msiexec.exe	130
PID 5812 wrote to memory of 4632	5812	msedge.exe	131
PID 5812 wrote to memory of 4632	5812	msedge.exe	131
PID 5812 wrote to memory of 4556	5812	msedge.exe	137
PID 5812 wrote to memory of 4556	5812	msedge.exe	137
PID 5812 wrote to memory of 4556	5812	msedge.exe	137

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\rans0m.exe
"C:\Users\Admin\AppData\Local\Temp\rans0m.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.NETCore.App&framework_version=10.0.0&arch=x64&rid=win-x64&os=win10&gui=true
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffb5d6cc188,0x7ffb5d6cc194,0x7ffb5d6cc1a0
    3⤵
    PID:1628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1836,i,1766701166347218909,2522886699566998214,524288 --field-trial-handle=2200,i,2264418502255368382,15920513936258499187,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:11
    3⤵
    - Downloads MZ/PE file
    - System Time Discovery
    PID:1188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1564,i,5252909197843478048,15893178222005879631,262144 --field-trial-handle=2200,i,2264418502255368382,15920513936258499187,262144 --variations-seed-version --mojo-platform-channel-handle=2196 /prefetch:2
    3⤵
    PID:5096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2520,i,16734224390221492368,2875654491359117654,524288 --field-trial-handle=2200,i,2264418502255368382,15920513936258499187,262144 --variations-seed-version --mojo-platform-channel-handle=3192 /prefetch:13
    3⤵
    PID:4552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3496,i,7694437634438503177,12751597850993350803,2097152 --field-trial-handle=2200,i,2264418502255368382,15920513936258499187,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
    3⤵
    PID:5412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3476,i,17694287691552906991,10702691074537190109,2097152 --field-trial-handle=2200,i,2264418502255368382,15920513936258499187,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
    3⤵
    PID:2232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4144,i,9154703067084507555,7113663918044119050,2097152 --field-trial-handle=2200,i,2264418502255368382,15920513936258499187,262144 --variations-seed-version --mojo-platform-channel-handle=4720 /prefetch:1
    3⤵
    PID:4872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4156,i,9327630343519065766,11168457888562905969,2097152 --field-trial-handle=2200,i,2264418502255368382,15920513936258499187,262144 --variations-seed-version --mojo-platform-channel-handle=4724 /prefetch:9
    3⤵
    PID:4448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5268,i,6644247161626382311,12301145316852834287,524288 --field-trial-handle=2200,i,2264418502255368382,15920513936258499187,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:14
    3⤵
    PID:1428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5384,i,6344581678718971391,15068813037232845019,524288 --field-trial-handle=2200,i,2264418502255368382,15920513936258499187,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:14
    3⤵
    PID:1120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5364,i,13668449873414011517,12857589742546792440,524288 --field-trial-handle=2200,i,2264418502255368382,15920513936258499187,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:14
    3⤵
    PID:1292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5260,i,3072506560184289520,7734849773865041357,2097152 --field-trial-handle=2200,i,2264418502255368382,15920513936258499187,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:1
    3⤵
    PID:4744
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3544,i,6483661144020249097,18262101579935084470,524288 --field-trial-handle=2200,i,2264418502255368382,15920513936258499187,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:14
    3⤵
    PID:2336
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3544,i,6483661144020249097,18262101579935084470,524288 --field-trial-handle=2200,i,2264418502255368382,15920513936258499187,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:14
    3⤵
    PID:2608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6312,i,10600692416612006803,13158977633499622911,524288 --field-trial-handle=2200,i,2264418502255368382,15920513936258499187,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:14
    3⤵
    PID:5924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6396,i,6600927623904094784,2259560841655788376,524288 --field-trial-handle=2200,i,2264418502255368382,15920513936258499187,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:14
    3⤵
    PID:4196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6756,i,3912817211014264369,8292293823095370835,524288 --field-trial-handle=2200,i,2264418502255368382,15920513936258499187,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:14
    3⤵
    PID:2356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6836,i,18104884899914731508,18345561842522147541,2097152 --field-trial-handle=2200,i,2264418502255368382,15920513936258499187,262144 --variations-seed-version --mojo-platform-channel-handle=6900 /prefetch:1
    3⤵
    PID:972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6420,i,9701415223474379646,2273931854198269589,524288 --field-trial-handle=2200,i,2264418502255368382,15920513936258499187,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:14
    3⤵
    PID:4372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=4716,i,4490991122351194279,11276728663957295576,2097152 --field-trial-handle=2200,i,2264418502255368382,15920513936258499187,262144 --variations-seed-version --mojo-platform-channel-handle=4784 /prefetch:1
    3⤵
    PID:4928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7472,i,16246320809983023969,5188261819361753626,524288 --field-trial-handle=2200,i,2264418502255368382,15920513936258499187,262144 --variations-seed-version --mojo-platform-channel-handle=7476 /prefetch:14
    3⤵
    PID:3524
- - C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.12-win-x64.exe
    "C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.12-win-x64.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2644
  - - C:\Windows\TEMP\{D1666528-6847-4875-89F7-1C77DA25998D}\.ba\wixstdba.exe
      "C:\Windows\TEMP\{D1666528-6847-4875-89F7-1C77DA25998D}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{F9412000-2AF1-45E6-9A1E-7CED2CB2F7CB} {42506109-4171-4431-B5AE-A23312E72DC1}
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4208
- - C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.12-win-x64.exe
    "C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.12-win-x64.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5360
  - - C:\Windows\TEMP\{5B667E79-B290-47E2-92C1-8BF4783A6027}\.ba\wixstdba.exe
      "C:\Windows\TEMP\{5B667E79-B290-47E2-92C1-8BF4783A6027}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{5741F09C-6C9D-4779-8A59-A5985E6185A2} {12B7D341-7D6C-4871-9373-0A2F9E7FB5EF}
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      PID:4648
  - - C:\Windows\TEMP\{5B667E79-B290-47E2-92C1-8BF4783A6027}\.be\windowsdesktop-runtime-10.0.12-win-x64.exe
      "C:\Windows\TEMP\{5B667E79-B290-47E2-92C1-8BF4783A6027}\.be\windowsdesktop-runtime-10.0.12-win-x64.exe" -q -burn.elevated BurnPipe.{076ABCFC-9158-4512-93EE-B94AD893D9BF} {6AB2CB2A-DB49-478A-8144-6A57280F2F9C} 5360
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      PID:672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5980,i,8113312339456688513,15301831466581907512,524288 --field-trial-handle=2200,i,2264418502255368382,15920513936258499187,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:14
    3⤵
    PID:3016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3620,i,12233166378039953609,14231931035938632513,524288 --field-trial-handle=2200,i,2264418502255368382,15920513936258499187,262144 --variations-seed-version --mojo-platform-channel-handle=7620 /prefetch:14
    3⤵
    PID:4264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7492,i,12314486802997354713,2596663218574675321,524288 --field-trial-handle=2200,i,2264418502255368382,15920513936258499187,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:14
    3⤵
    PID:5616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7520,i,10079719062880336438,6113377336159829214,524288 --field-trial-handle=2200,i,2264418502255368382,15920513936258499187,262144 --variations-seed-version --mojo-platform-channel-handle=4076 /prefetch:14
    3⤵
    PID:4632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=5420,i,7914801649659701180,2653856435587232110,2097152 --field-trial-handle=2200,i,2264418502255368382,15920513936258499187,262144 --variations-seed-version --mojo-platform-channel-handle=3732 /prefetch:1
    3⤵
    PID:4556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6912,i,16631617137927396436,9401403649899457539,524288 --field-trial-handle=2200,i,2264418502255368382,15920513936258499187,262144 --variations-seed-version --mojo-platform-channel-handle=6968 /prefetch:14
    3⤵
    PID:5332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7000,i,944178321886365813,14728664798344906498,524288 --field-trial-handle=2200,i,2264418502255368382,15920513936258499187,262144 --variations-seed-version --mojo-platform-channel-handle=6976 /prefetch:14
    3⤵
    PID:3348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6756,i,18373268173845440108,8401552148896020560,262144 --field-trial-handle=2200,i,2264418502255368382,15920513936258499187,262144 --variations-seed-version --mojo-platform-channel-handle=6904 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:6432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7204,i,13339590176972812291,3987220229832615539,524288 --field-trial-handle=2200,i,2264418502255368382,15920513936258499187,262144 --variations-seed-version --mojo-platform-channel-handle=7192 /prefetch:14
    3⤵
    PID:2948

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4924

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2164

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3256
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding DFD98FBE8694E837948E9F18F1D2129A
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:6024
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding CB28AF4289BDAB1990919155F8211C2D
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:1456
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding FB53B1FC9EDA2C5E091C0BF8B9447F15
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2664
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding CBBAC96C45A6911E82A414E13E42C5CD
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:4016

C:\ProgramData\Package Cache\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}\windowsdesktop-runtime-10.0.12-win-x64.exe
"C:\ProgramData\Package Cache\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}\windowsdesktop-runtime-10.0.12-win-x64.exe" /burn.runonce
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5352
- C:\ProgramData\Package Cache\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}\windowsdesktop-runtime-10.0.12-win-x64.exe
  "C:\ProgramData\Package Cache\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}\windowsdesktop-runtime-10.0.12-win-x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.12_(x64)_20260916163644.log"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3296
- - C:\Windows\TEMP\{B2073E11-DC6E-4927-B5F0-D8ED263518E5}\.ba\wixstdba.exe
    "C:\Windows\TEMP\{B2073E11-DC6E-4927-B5F0-D8ED263518E5}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{374F00E7-67C2-46E9-A29C-E61E34BAA57F} {35C9E21E-771E-43AE-AC87-5C0700E1ABD6}
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3744

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5508

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:2580

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DevicesFlow -s DevicesFlowUserSvc
1⤵
PID:5544

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x0000000000000500 0x00000000000004FC
1⤵
PID:792

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
PID:672

C:\Windows\System32\ShellHost.exe
"C:\Windows\System32\ShellHost.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:5876

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5ade2f.rbs

Path C:\Config.Msi\e5ade2f.rbs
Size 11KB
SHA256 bfd0dca0a62c8a27f7959c06bc63bd56e897cecd71f63ac4eaae9b507fec0ad6
MD5 57369ab00137615a59e2c54e8c795440
SHA1 98b3ca7cb9b224e6f9cb71109602d23dbf1670d2
SHA512 9c7556d46c5476e3a64ceacc23b84e3150740e2d39aae6bffe8eabfca7f81e74f94ea14e768413752d52ad2b1a4e0ed13934957194b61bc6d311a2e7863d5f0b
SSDEEP 192:iKv1TCNyaCtN5HRSO9C45xKnIlxKn7lEy8FCPePp/K:ic1TCNyaCtN5HUQxKuxKVW8
TLSH
T139325192A60182D3E9962B74C70F1B357B73D2DA9348A79F09CDC1245F273CA0F6819A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5ade36.rbs

Path C:\Config.Msi\e5ade36.rbs
Size 9KB
SHA256 4eca337096d3b9f1b2715cae8a2c576b18ccea3b68a136c968dbe6ccce2f8099
MD5 e4e6eaaa01edcaa0ebbf19b5e69fa0cc
SHA1 019150180b7936d46c31254527aec506d251d900
SHA512 d28d9115f0b60e680d3437f6c3b8feda5843e550694839bd486fb49782d573bb2fc584378ec52e6691aff8782b8bd51b15aba601099147ffe7d48b609b7c6253
SSDEEP 96:Yrm0B0y/ALrE0MC7VVGUXUeD2KPKACsTlHUXUeD2KPKAC6jfsQnUTl+nMLE5t7J1:YCYJ+KC75vKnI6vKnjZEHRvaePpx
TLSH
T19A12210166048BD3F9626B38D71727343F76E3DA9214179B089D93348F0B7892F6A19B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5ade3b.rbs

Path C:\Config.Msi\e5ade3b.rbs
Size 49KB
SHA256 3fde411082cc9d129fa5456abc843a189d12831fe5d34e8fbc6071ad86d20fa7
MD5 74f93731be89688e875de2a1d1a833e4
SHA1 3eb9fb4003fcadc1f9cb45bde649ed894d23c2a5
SHA512 6a2318a2acdce2cd0d278a551f46d69c25af32f1270b7ace5ef7c4fd0262ed1e30d8bf3fa6a951673266213ee226e2f4c3fe7d2dd35e89fdfd4f07906c8a116d
SSDEEP 1536:r4OMFA4VnTxhBGGNpC14R9poCUv/X9u7DwzqWQn6XnbrFZeEB3tve9wN1E6sLYe9:X6/X
TLSH
T128331E38FB80C1E6F633B9A9B330D9447349CB8597198D9917CE0509CE8679D6FA83D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5ade40.rbs

Path C:\Config.Msi\e5ade40.rbs
Size 71KB
SHA256 5375822aa40d2c55e0335ea45fb654d1cad8c9809a644a67edf12e686cc02b2a
MD5 da3cf771de580e08615bd2e888142370
SHA1 05f826f30a355b5e2959e581a2d83a9b9d605a17
SHA512 becd8532e89c492e8f04daa1ff2735f51f49cf86b6e846648a096f71cb1fa281f12f93f40b9c4965190a1b31f822278bb7ba549551881a8e2ce21448650a1f02
SSDEEP 1536:T+0pVuVCQUF3YJvOOfcVvQHNxaeeskGWcgayskAKwVxNbTO8E2fu/ocV4qBgpdWU:+h0Z7Aj6s4Se9eIOm0i6f
TLSH
T14D63DEEB5610C5C1E8322A5813FBFE48AAD9CD67B344463D00C5332ADEB79C6DF68991
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ThirdPartyNotices.txt

Path C:\Program Files\dotnet\ThirdPartyNotices.txt
Size 77KB
SHA256 deb4427a295e1ed474b0d81c5a0d972c1b550b9a715cda939cdfa9236b1b418f
MD5 0d8867a25ba926e6e40cd52ab3536b5c
SHA1 89390dc8b8318d0bfef1c6a2fb4783537e28a465
SHA512 317ca335405274f4f91b173651ca2826760acb5ba5cf41aff51adc55c2cda9059fb268333665f13f62fa48119e55a303720a780dd58d28dd9967db4c88407d61
SSDEEP 1536:HA9jHwsGfgg39/zwgAVkguQxrDjugtSEGepkWvrpX7anuqdLSVnfiStPq+3LefrL:HA97w/ogz1AVxuMjHtSFULryLOgrGWm+
TLSH
T17773A45F7E45077319E2C3916569A8C5F22FA02E3B6B2A44346EF248133B42DD6FF858
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 163KB
SHA256 21a46f1e5235cf4e844b9de5429f0e198b9c97a41f0503a66442f1d639ca3ee6
MD5 522dca4be4f99d21ad35ebc3bb24a066
SHA1 5fa4dba916a6bc846eb6001e7f6a468d04c2be04
SHA512 3d65cd300176d21c95c2ff5a75cea9b478c505dd42bf95d45a0b2486d544096791eafb04aaf3d42bfc4e731ec4320b47cd2ae3b57c5a760f6a89645ce11ef98b
SSDEEP 3072:nGgPR9lIuvTSBbQ/09n4SbDqIG/Tk7l55wKjpFF:nGalIubgbQoDvqIrthr
TLSH
T19FF3071AD65811AAD16E9575CB528941BB337C668BE0E3CB13C0F8BE0F726905EF9703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

state.rsm

Path C:\ProgramData\Package Cache\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}\state.rsm
Size 1KB
SHA256 24c268e18fe2fa61b9bfbbec2d225fd38e22f293041cb50f40dd503a0d1b8828
MD5 04262cac692c70373b5c576a90c78848
SHA1 f7033084aebcabed10adc9ae1009d7b9518e8353
SHA512 7e67a7d1bc66b427f121fda5840e5938a40c7f3b99a03842a3041aaae213fba6e17b824d8ea2312c9fab1c8f554d206faa38eb1b3298352e8827dbd847a12627
TLSH
T14921D1515BF6092CF3F6AB3469F96625443BBC121C20C16E0001318A9E32BD0CCB0B37
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a201096456be1e380b7687844e70aa8e2d987a06740acf66db0d56e000a3b50d
MD5 36c9bdf74494657a1636bbc59af48eb0
SHA1 aea8177ffde7e43fa1b4cc5ce6c7cf68c2431306
SHA512 2cf6da34ccb1c58e4f6d50681952d27ffc828c4ede6f38ca0a5e429a4f520e426913b04469e4272eed54102a541263bbb54c2628f542fbe357a4afac921bb49e
TLSH
T143D02B79E7DC8512C0C2207C015811A231B37E00EB0802C00905400C18001C20323F0D
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4123fa2cc2e73053b7602d1d53a57b01f3a6cd8872729fcd7ed66886082b1b99
MD5 5100dc5469c5151f9ac793573116a7fa
SHA1 a8ffca7210c348bef0d710a66e334809b7f58988
SHA512 ead3d81382dc13f1d89e928af9189e5eec6cf3fabfb91ed18d73f1fe38b5e9f76e77fae594633baf6da19747d70fbb17eb97a8a36df60510a930f6006986acfc
TLSH
T1F4D02B75E7EC8412C0C2207C015911A231A37E00D70802C00A05801C18001C20322F09
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 9a0a3b23ea735b765a055c02cfc6268a2d0ca3a7d6e89739b6ec54bc7ecf001c
MD5 60694d649746ed556d29355a06fe0eab
SHA1 a8f600b7ab18fd726486306b824970144f85bf5c
SHA512 1e614117b6bca3a94ddc5e29163cd85286703aa4b768c6e65ac8409644df10aec9c8e709ba078710935fbbab38d1f5aef10d3d3c47b1280f7b87a9189753f554
TLSH
T15951E80ABDF8C371C764687C83D523433A73C9BA5AB31D021967F839AB6EB959044F14
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 0286218f98dec739b437879623d4978fa76cbd32a12d6086f59b413f3ac24a05
MD5 81959aaa44aaa8490647a8790b3e7aff
SHA1 13d1daf37cd3c4a1e58f843bca5f916608545936
SHA512 5ac3eec5b675f3827124fcf649be406fe374eb6eeeb6c352d210da459701302bea4e5a26d42f6d0ebfa84d433cc625cef824067ac2c82b83db260784680a496d
TLSH
T155611EC8DCF89632CB327C3882571B45246A957CC5D72A022113E96627BFED7C8C1C0C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5afaec.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5afaec.TMP
Size 2KB
SHA256 827fab148e3763802ce02c44655c2161d9451f57c0505f3a08f88d05e444c531
MD5 3d870a1d9498af542d4c07aef2b8188d
SHA1 6d55fb336c5d0b0eea4b602645799a899d2d133c
SHA512 d2b233046be058aba8aa4cb8d74f3df8c81a4eddca767ba05a8870aff1a008005c08200af156512130ceaf73ecaa192ecd8d32f8277c6e4d520cf75c01180f25
TLSH
T1AA41EA0B79B8C3B6C754487C83D623873A77D8B296B31C0204A7F879877EBA65045F18
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 4692c254dec921bc39c468a1fea6f82ce88bced69075da2ac18a701d12de0af5
MD5 3d82d3dfe82f9a3e0a9af5c8caadc273
SHA1 1cfcb361196b869533890cfb4e686f4408b2c85a
SHA512 487c0e1f35a1c4f0860c8653d38b28768f5fbfaf0817f247dd615654f49df6b47b9d9214bbe3e6f8ca25ac860d62cfe80aea5f026a1281b3d485403d922e7dcd
TLSH
T1AB818EF787B4856E8A0196F0AA18AE1FDF2D0515431C786A89D4EE27D3E3472E10265B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 d23da456dccf5a91df41191c8cdad1068c666f03184f5807a5a976c213e33e90
MD5 dd416a6f02b3aadce237607555ac75f6
SHA1 90dc7a6a8c59090726c19b7d80db80673ad890a9
SHA512 6673f65dce6433614be3548f19bb9e39dc70ee4812dc8de5f3f0293dcf199daed494ea600e00282531fea09dd855408f01bf800115ffe615f4f4b90094403160
SSDEEP 192:sxRCRBT3/fbsmvpZBrnzoA8p9nl/g6+WNZJopdJ/AH3Dj1viGWIgtJ:sxRCr3/fbsynBaT/5G/o83
TLSH
T13C32C815AD28A93B4CC7E219BB59BF53D3F91032A1D51E48A6FC8A2C15E76DD130780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 70ccb5c7bd80264cea8981827ec339579fb9bc2a58cb9c7b3a25776e3d71c1e4
MD5 3e7ad41217612422d45214a5559f79a7
SHA1 8c44f48b7338731e80214a5abeaf122b7cfde2c3
SHA512 cc7b100939afbb8f078abb99eac0c9f7b8fcdfd59d2645f1c4667b7347202a97b9f5435daa4eee2bf5c20879b86379b41f66c8981546dd088e2ea404290289f6
SSDEEP 192:sxRCRBE3/fbs3SpZBrYUbMRoA8pXNnl/g6+WNZvcSrb4/AH3DEviGWIgD898mkyF:sxRCc3/fbsinBMYz/5GY4/t888mkVw
TLSH
T19572E756A914993B8CC7D519FA357F52D7FC1023A9915E8CA6FCCA1C14EB2ED220381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 85f0aa0f7ac7514fea924fa3ebb073024ad5243225470ac3fdf01fa6e00582fe
MD5 b2da6feb84a820e1019fd1f113b6c286
SHA1 b00d2226520d0db2fb0af018104c71d9941cc316
SHA512 28cca74b7b7aa52aa9508c9af43ea97f535157c6dca02625bdd86bfa7d0750589fbb1fadd21a4f1813563370210edb8f65f2a73dd1d05550f821d6f4c6ad9645
SSDEEP 192:sxRhRBT3/fbs3SpZBrnzoA8p9nl/g6+WNZvcXAH3D1viGWIgD8J:sxRhr3/fbsinBaT/5GXq8k
TLSH
T13F42C719AD28A93B9CCBE219BA55BF53E3F91033A0D11F44A6FC862C15E76DD530380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 d96d089f82181e90ca43e1937775be19c4cdd35f0d45e67b94b487bbd56e03f9
MD5 1679a5c35e37e32d8862174fa2397177
SHA1 f646157f965038a66a4d19db7d0912510f4f876e
SHA512 57731cbdb73dbccdd1a1028e1d7b4dff3c7d560147463bcb3d2f0be1020e9015f209f72db4d6fab5a3591edc9aa30abc40ae8b4f19a316c42fdc1d687256fd6c
SSDEEP 192:sxRhRBT3/fbs3vpZBrnzoA8p9nl/g6+WNZvcXAH3DQviGWIgDaJ:sxRhr3/fbs/nBaT/5GXP8a
TLSH
T18E42D719AD28A93B4CCBE219BA55BF53D3F91032A1D15E44B6FC862C15E76DD130780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 56dbd60ad1c11b63df5442e03c47a1be740b5e712763be3975b012d138c06585
MD5 0a05b12d2ccc63d7e63cb1da072e87db
SHA1 e8a832a6675517fce34b4b364d2680e7f928d2d1
SHA512 a679b1b1f870810970afcfc76aebe4fe3af317a57ea4208e5561f36bae86fed833995f4ab64a91288db7541e52d3c0d39e7c41e5e6ebc2e050f21edaee80d29e
SSDEEP 768:SzYbhR7pLuLbxUWgasfA68F1+UoAYDCx9Tuqh0VfUC9xbog/OVuEw8WSmroGQxOh:SzYbhHEbxUWgasfA6u1jaJEwtSd902k
TLSH
T1BAD2DA7B640CCB7E4F804ADDA81A7A9A6D6802CB96D8CD8047FA941D02C67EF511A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\14badf84-9e29-418e-9f54-fa2c870c3e8c\index-dir\the-real-index
Size 72B
SHA256 c31ecc602f1bc0adc8283f734b967b18f3a2cca9c9d99b6233ecae0a8085b812
MD5 716cdc6dd60e625c9c25036fb292ff8e
SHA1 af4bcc1bfe9f8ae3aa36c1ccdd3634a2789d8d10
SHA512 09b17af3bd0d603fff7b54baf4d0b430b62e98d3a3fa883757557fea186f302e5b5d5b5e6409f3f49e9e8df02d19a99e875de2463f81f2448f165677338b8624
TLSH
T179A002B89A995B47C06E46F771F10580762E593E6322065B52914CD488A1D93C21305B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5c72b7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\14badf84-9e29-418e-9f54-fa2c870c3e8c\index-dir\the-real-index~RFe5c72b7.TMP
Size 48B
SHA256 8547f90cd3e63f762d389033baa9788390ac14b60bff959abfe7466189eb08bb
MD5 52fa4e415d0ff628bfbb62142dd75a88
SHA1 dc1b922626cb5035e04303883ee0e30cdf1762b5
SHA512 b7608283316c679cf18627c7a6f3000f2ade668526ad6451e7b4d12ad8acadd1a43b042b6ea8bfdc50c4c12b912a508c54b0a6b3fab9939eac6b59642f1a27df
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8a9345d6-0dfa-4a27-9eee-400ed52463a4\index-dir\the-real-index
Size 3KB
SHA256 282c650cbbacfe6ed063d798619a7ab42be1b6952d87075936e505c67e6c7db4
MD5 e81ecdcc9beb4582335ba1384532be6e
SHA1 2efa8d8147480f398e56c723059fb742584b5e02
SHA512 4af7732e553a9869b739bc8ac798ec7841d1b4b41c5d984d5313e5aa9a852d7aea6a6072fbd1e85719366ae95617e811410388fd3c4937fbedade4c35c6dc319
TLSH
T17F51D74E5D0B4B62EDA8267108B5088A333524DC47881A1FF8FC9536B8C33681D69EA8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8a9345d6-0dfa-4a27-9eee-400ed52463a4\index-dir\the-real-index
Size 96B
SHA256 fe85f8b571d9249b1d43c259c78394f137e1ec1da76c8a1c5480142a7d62dac1
MD5 2313879a59c2759e8231a96998c06799
SHA1 112cc0e68e67eb5f3323dd113363d2c7fa90087f
SHA512 15d5d2a817b598d0414e7c5ba61fc049e88baf893169d3d01871a4112c3ae36e4e5bb1a1bc006065e349b22e4595db62c575a815f71216c7000ccd272e441efb
TLSH
T10BB024110C043103D451037500D3037111104CFD311303C101FC44445C155C74300504
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5bd677.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8a9345d6-0dfa-4a27-9eee-400ed52463a4\index-dir\the-real-index~RFe5bd677.TMP
Size 96B
SHA256 28377ea67f4238c0c1d12779eaf027b38c07a6554ecfe2ae3963ef3dd1e67132
MD5 1ec7ec1f565fa3c836a12e82f7b6be89
SHA1 564ead3fa60814031c56f75c20b36354251b5db3
SHA512 37b0867a3050ba525518adabdf552ded76f10f609a11013b9e319ff8d64ad35b5d86ef4c782d381364142a46c2097f0f7866cc83ce38b397c55ca491d7a8f252
TLSH
T1BDB02220028000C2C0320330008302B33A208C32B02203F308FE3280AE8BE888380A80
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ad720378-3157-4ca5-920b-a853e74af7cb\index-dir\the-real-index
Size 72B
SHA256 55227d5d5ac5c7773fabbaae71af85d034556d1911f9011f0cf596a5e7f81f49
MD5 5703b23601b926cfb30d65287761156a
SHA1 3ca9cbcbcb9ce77c040049d6d35ed40e62b26605
SHA512 76f4b1fbfc9eade320b80917f23290dd6f4cf510312edef3c834dfc0523f53033bba99b0447fcd38424374bb825f618617942e82bf5d516998ffe00526c81141
TLSH
T1DAA002684A8A0041C04312B12FD766A13312DE386281174749A20644CCB6E958D8141D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5c2cf3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ad720378-3157-4ca5-920b-a853e74af7cb\index-dir\the-real-index~RFe5c2cf3.TMP
Size 72B
SHA256 91b816ac31b7ef7cf08d4cb4853f33311478c49cc46de3ef1d8e07257b9f3436
MD5 cb4226d21c879e1a8d9ec1ab71d559d5
SHA1 c4178a625be2b5809a99b94f23dfecf349583804
SHA512 468f4d3cfbc9e7b3fa10865e5e6db276ed631804c2cfd48a1f11a64e1f08bed11a6118ff6eafca5279e533df1773da566aa57f9648a986c72f84fc4795464475
TLSH
T1F3A0021643C0401DC05296B15E6313619703E9232100134741914445ED554414F6101C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ddc35808-522c-42f4-b661-620994b57666\index-dir\the-real-index
Size 72B
SHA256 f5a127754a45993c6676122a1ef6122632fce03cdd6d00a65c3c3524837e8c57
MD5 9d8122e92a214043abf067d8a89ad86f
SHA1 6063025721608caa566a1c11cd57862a1e63f7a8
SHA512 d0efaa6744bde01394ff0721ec841a1113ac751849f0c2c0c5a155479fbe6e0aa9cef2fdf3e6c8d89a626712444051eafd7cbf4a5d5cd76ff8e067f4a99d4572
TLSH
T181A002A105585481D4170FF6975147523F54DF5F5301570762DB8469BD5319E8921240
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\f35985b1-efbf-4b7d-a8bf-e672a97038a0\index-dir\the-real-index
Size 96B
SHA256 fcc8adf23052204e9396568c278856eb9e864a4e5892a6a764a34a8910d1b1aa
MD5 266108bfd0b06b773466505951fd85e1
SHA1 0505aef61c5c8c28c6979337bd0ac9cc2c91e9e3
SHA512 091efb020b1ea951dc6d17e3d254c27cd62cd308c43a0695064064f54fd74daa84049374d1d40ead910b8afa816b4abdc3ffd3df93e05db947dbea3958185540
TLSH
T195B0112AE8038A0EC80B8AB000C808A023A888A08A0B332320C028AEAA00382E303000
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5c72b7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\f35985b1-efbf-4b7d-a8bf-e672a97038a0\index-dir\the-real-index~RFe5c72b7.TMP
Size 48B
SHA256 938b0190ae2b555add78a46c01d38d23b8ef95a694875f7ad81c9e84fa123f92
MD5 0826b0aa205243ce727178f258b119f7
SHA1 e259011bbb694f435dc807baf51d60e3a2f3b802
SHA512 573d8296f820c866dd946c36e5686b16cca625c40d261ce2a0568cc34bad026a136e99c71469f451243e915bd936cb554cf75a185ffd15b4028c7110c66de3ab
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 519B
SHA256 e1a04f70723eab8d5a1e3735ba486165a04aec4f7a6aca946d6ee793c2b1235d
MD5 fc9a315715781a1db9802903f7390eef
SHA1 9daf24c48643c7c36a72d148dcd87cfff972a5aa
SHA512 74ee8b87d1e3da08fb10626f55af35640418ed92ecbe56888e03af9551740230ed83866a011944f13efbf1789bdb26598ed77ae2acb9a903eb0a608efc94d67c
TLSH
T10DF0E9FA7FFB1C24ACAE87D5A07110A54125BD18CC48BD4E5157B18B10737457855D71
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 624B
SHA256 30cdaca226d983682606dac6b47520550e8033944e712b226086e2ef2b34d0cb
MD5 d4a72b3d2f5564f00a9db2cdeada78dd
SHA1 31c5ebe3a564f3f7d755052e739bb06ea5e5bac3
SHA512 75a3226272618704ec59fb5ef249af4569c19b4a19eae2cf0dde1727c1fb6a556b7a7dd515bd0fbe8e2114e339de08c5b9ba1f9e1bd3999f93d34b55b3e60d58
TLSH
T11DF028BB7FFB1C24B8EE83E5607100644115BD488858FE0E5017B15B90B36042459D72
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 619B
SHA256 e5c15b179a59be812a78a461d5360ceba4721ecbeb478740518bccd41095da75
MD5 aea8e09bcb731d1957f4fa3ed654d41b
SHA1 6e6c70e0b2697f46db2014a94abf10a076fd60fe
SHA512 74b790a81c9670c0b3a1a6b876b70b4d2b984a74a3b97b68e60296680b2e1fc402bb117c64edb5867461f90089115c051e0deebd936d1af86b7420d62660e2c2
TLSH
T122F028BA7FFB1C24B8EEC7D5607100744156BD488864BD0E5116A25F50B36083459D72
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 faec6738d0f58ba8b0f2a11c9756015109cc04d3ebb0b68277dc0cbbfaae9236
MD5 b1f0f218bd3046bd3f96ca529591b190
SHA1 7338da11280536edc3f41404a76643f5a3359505
SHA512 41e8c473130912cc9575ee2625f28d5879daa7477ecc49b06b0c21b0a6a3361862083e5616a3f705c9fc922354e91472cdf0e2427d2375ee7c58bdee6f9346bf
TLSH
T11CA00278894D9005C40007B01CF65E6073704CED05052B0948A9A0AA8DD124495C5203
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5c2b2e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5c2b2e.TMP
Size 48B
SHA256 b575d6b4bb022b4f4fa006d1007302c7522d5f7daf134ff6c35b21b087e2264a
MD5 822c1a695783bc5e86c5f06043a2aec8
SHA1 bf90a0fce02666a4c3c7c1b22c723d3e91d0eed4
SHA512 bfd00c7f43f40ccb6114f6f8779a8899d13581ba2b353df2a9aa5be9a3263a04e659ebec89edf904bf24d097dd95524980b66da4fff6b8dfdf1f403c6015cbbd
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5b5bb9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5b5bb9.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 c5823fb3e84ea382621e4eab3ead1ecd182faed4db79e697c3e8c59f2918c29d
MD5 c7b6981d398bb64573dd7a12d561833a
SHA1 a6438bf5a309bd010890afef35dc81b83abe3e37
SHA512 f26d61847a9f4d676e0edf911480499c2bfa5917a5b42ee771a2568512796e12992c7c8ac8e6ba6fe25880c20fa2fe8998b90587cfd4bb1890c3231a5f03ff69
SSDEEP 768:XFDX3UwgyokShamt8yOeRFZD1fTos7RjpMgFN:9X39FY1fT/RdMgFN
TLSH
T1341339F5A8D38937D8AE9383A33D6E429EBCD16375885884B7C45D0DCC866BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 f03d6603076f50545418f2706471e295c05a471c51e27e6969d1d0d38366901a
MD5 bfefe3b46c265736ec14654819d1aa02
SHA1 54dd46faf9c0c78b826a4496837c239a43a19287
SHA512 947f8f3de2caa6201afd492895dfe4d0b180d6b26252744ac32edc175bc7e840e98777843e2e8d0e394e17170965b8335524802f9473f4ac1308c429908aa35c
SSDEEP 768:4d3gBwybNbhamt83OeRFZD1fTos7RjpMgFN:4d3g6gY1fT/RdMgFN
TLSH
T1DCF2AE35BC949D738CFAE285B2467A837FF411B389C9498885D89F0F0487B9D170BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 a338a2dfecb67993b68126a3caa82ffa122e127c396a8653265d2023aea98c36
MD5 d1a7c24e1f615b0fe4137f8918123e33
SHA1 28db0e3ceb957edacec78b37ae8cd2932869dd4c
SHA512 5b9f85f0b110b44aeb10f3c8f7254110ab125e06f29c16111b8fb299a66fcb114d205c599f5fbeeb0cf2ce3a2d6067d0500926c8efbb8f91cb7828ddf1072270
SSDEEP 768:XFHc3Hwgj7sGShamt8EOeRFZD1fTos7RjpMgFN:5c3NRY1fT/RdMgFN
TLSH
T12F1339F5A8D38937D8AE9383A33D6E469EBCD16375885884B7C44E0DCC866BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 e6d02668fd7d9cc0e0385edf6ce2fd854b8b8b758e62dfb3df16eba1ae342842
MD5 5e6aaa851db075d6aaf9f2dcb80c6722
SHA1 a17b9d0a8bb737ea9fc0c47b0819e4d8ba0664a2
SHA512 10554c5eb75b328bd12daa0382c91fa5852a060aede8f053971900e6088744ab4dc682bd8e65bd765144b962f3b5c5a35d61adbc78f14bb27c2413469f4b153f
SSDEEP 768:I/UxvxjgC+k3g1wybNbhamt8BOeRFZD1fTos7RjpI1a:VZj3+k3gWGY1fT/Rd6a
TLSH
T17303BF39B8A49C338CF6F244724A7A87BFF415B389C9199849D95F0F0587B9D170B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 bd42b1b8d9503456ce312b789b4eb5a9091d620ab23f2c2620f1526cb1c38d79
MD5 508e9fbec70d416e71fbe0e178ab4ea9
SHA1 269a24b9344dee2cb59431c29e333360342c3d7d
SHA512 7f9f5302bb1160f6dae798a6f8d811e341a32af179cb7e8d54a548d0adee8cb362dbb1ad133e37b22275d70cdca9dd81d475f5e0cbbc0a6589063eb796488ac2
SSDEEP 768:Qg3bHwybNbhamt83OeRFZD1fTos7RjpMgFN:Qg3bQgY1fT/RdMgFN
TLSH
T1CDF2AE35B8949D738CFAE285B2467A837FF451B389C9499885D89F0F0487B9D170BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 585dd271e248aa5ed25c181f63696ff6a45b7a28c396a86aa54df5b64b711654
MD5 b1691b5ab18f3fba18784720d7c099c6
SHA1 f5ca97b7f1ac10f3dee984242bc058c94235de1c
SHA512 fba6ca405c1897b0cc674c746e581f9d75b35a7c9561d0712c9f088d89d7cc5163ae22037afc094fbb59cc76fc1db745c32b1c8bbba746b5defa8e86a9f77a04
SSDEEP 768:z/UxvxjgC+k3hGWybNbhamtKOeRFZD1fTos7Rzk/+Pu:GZj3+k3hX+Y1fT/RAKu
TLSH
T18003BF3AF8D46C338CF6E244B24A764BBFF415B396C91A9809ED2F0E159B79C1307856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 4049dedbd194a442dcb78709fd68d4b76d5d5d016530ab29fa0c9d565cb372c8
MD5 75a776c0a86accc8143da8f59a2526cb
SHA1 652a6bf8157072711f25f9155e54b18a16c11f68
SHA512 d9560aef9502142049909b97973b00ac6322af3bf0fe4c7bbe7ebf07f751dc958caa05261907f9031709bbc333b0bd6bc153d2b84c8de681ad9e9defa34b0238
SSDEEP 768:s53bxwybNbhamt8XOeRFZD1fTos7RjpMgFN:s53bKsY1fT/RdMgFN
TLSH
T146F2AE35BC949D738CFAE285B2467A877FF411B389C9499885D89F0F0487B9D170BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 0aa602f2ff32e92c381693049afdd4752ef7cee8b5562e8dc89cc23d0c6f513e
MD5 341d89a9abbf261e743423dbd6c371f6
SHA1 c56436923f826f76c73848b0a0dea2011daa5366
SHA512 e1e0672b1aaac1491b26aa8e92693aaea4e873c2a439351cbd7d47376607ff5169c4069f002d3206da848679e08a3e980b1b9b18c6f02555ffb9b0b477a89a6c
SSDEEP 768:XFGE3Uwgy6kShamt8DOeRFZD1fTos7RjpMgFN:4E39cY1fT/RdMgFN
TLSH
T1AE1339F5A8D38937D8AE9383A33D6D469EBCD16375895884B7C44E0DCC866BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f45f31e7-4073-43b0-a124-8859bf7f3009.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\f45f31e7-4073-43b0-a124-8859bf7f3009.tmp
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

b5f698a1-a49b-4a5a-9202-3ca23efff9e3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\b5f698a1-a49b-4a5a-9202-3ca23efff9e3.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.12_(x64)_20260916163644_000_DotNetHost.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.12_(x64)_20260916163644_000_DotNetHost.log
Size 3KB
SHA256 078861d65123f62d63aee50338e9026c9af68234c52168698337d602f71bd8aa
MD5 c11e7df013312e5dbb61886e5fd92450
SHA1 35718c8658ebaed93361c61f704e071239a8cc34
SHA512 c300726c6c2c87ab666b3b0ac1914498d8712dd5fb7d9ebe73066006ec66591b300f3b408f0b3884592f5519d56ba5c068b16173af8ae9dc50a0ef450854bd8f
TLSH
T1ED71CA991AD90916B5B35747DEF3D0217A33BDC27934CF4C2788831D47AB80698ACB6A
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.12_(x64)_20260916163644_001_DotNetHostFxr.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.12_(x64)_20260916163644_001_DotNetHostFxr.log
Size 3KB
SHA256 5841ca781d6835f69d4b3c103b9c6ad0aff34a90d23ee3b27f226cf3e80c0995
MD5 c1f85fdaa8a5f253a7dfa8cc31815020
SHA1 df33e69b4ff0c3ca884fe93eb1e503ed84554979
SHA512 5fd721317b4b15e51f058b147d97c1c5ccc07405a9311b573b3def41bdb185ae1515633bf2d00b695e7cec68f0ce783f70aa45e73738094a0a5b43eaa1783dab
TLSH
T1A27106581AE50945B5B75707DAF3C4226A33BCC76935CF0D2749831E07AF805A8ACB7E
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.12_(x64)_20260916163644_002_DotNetRuntime.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.12_(x64)_20260916163644_002_DotNetRuntime.log
Size 2KB
SHA256 0e05704c340784150e621bde317bb22a636a0f07b8fbfd4b47da8cb1a99d7a8e
MD5 392bb421ea3601b95594a8d1490db080
SHA1 4d9a3dc98f4ff9a1852ae97b4477981ba8a71aed
SHA512 f7effbb05335ff6a6e94ff926041e7b5ef8697952fe9ba9856944bfd29188fe1b8de0316915fbe2faffb7df1e6297246ab5e426f80a972ad3a030ac90787293a
TLSH
T1164123941AE40909B5B75707DAF3C0136A33FC8BB935CF4C2249831E466B905A8ADB7E
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5812_1704380261\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetHost

Path C:\Users\Admin\AppData\Local\Temp\{5B667E79-B290-47E2-92C1-8BF4783A6027}\DotNetHost
Size 848KB
SHA256 f59a0c4177cd57a71c99b22009131a3bdf898ee6db62ef0415f056c4b26bb53c
MD5 57a71197c3da73f5088600fe1315f870
SHA1 5ee2d560c4d70756e29cd7d065cb38fd8a750ac3
SHA512 df44b6deb6c72b0bf8de820767041a378e97e4994e95ce00b675676b3892803620d94373492a04a598dfef334f135152b267b175ca3148af10f8341a88024927
SSDEEP 12288:LBGQ4cABdUb/aVo/2WCsT7pXJS5qgBwhYA3hy6J:dGyASwoO2T7RgZMY0hy2
TLSH
T119055A1BBF9414A9D8A24EB1C5B78321FE357C082320959F46A4B12DDEFB6E0647B7C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetHostFxr

Path C:\Users\Admin\AppData\Local\Temp\{5B667E79-B290-47E2-92C1-8BF4783A6027}\DotNetHostFxr
Size 920KB
SHA256 ff33e8f0a6f4624f8c160f96aa8066eeb86bcc6e608fe258deeea13bbd18e82f
MD5 0dbebff80e13ff5ab5de800e763e5b37
SHA1 e044e032e89bbdededce81d655ae84e3123d367d
SHA512 6a4d2f9d8c713aa4abb3281904a61a0be2241d1bd419d97b8650d2398925f169a85dbcf2467653fcd624127df74cc2c8f4025c70a222f47bd91cc0e3e2cab8f9
SSDEEP 12288:CBGQ4cABdUb/aVo/2WCsT7pXJS5qgBwhYY1a3rHLf:GGyASwoO2T7RgZMYF7
TLSH
T171157B1B7F9014A9D8A24EB5C5BB8321EE357C082320959F47A4B12DDEFB6E0647B7C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetRuntime

Path C:\Users\Admin\AppData\Local\Temp\{5B667E79-B290-47E2-92C1-8BF4783A6027}\DotNetRuntime
Size 28.1MB
SHA256 22319614080d76c82a33b196c5765ca70ff1f38041e907c7d5ed8775f6c5f3f6
MD5 4d24332e3f8bc0e2b708e5ef1a77c7bc
SHA1 c5719df9a461dbe3fcdc98fa124233c2ab9c40d7
SHA512 40b135e2e289067cbfb90f7f26cde73342411faa028533fb969effe688734c88ba19e2083040e62309011f81eb964c18b6017929a3a04b145c7677160163173b
SSDEEP 393216:H4lM4oYejHXelWkVUhg75WNLimpDkyBKuy75k9PX17foSjUQaoMU+//+tFwA/T/g:N487t5DkD+VJnixU+nuFP/mP1QgRvx
TLSH
T1C95733637FC419B9D8625FB6C0FB8751AE353C44236055AB42947269EEFA3E024BB3C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsDesktopRuntime

Path C:\Users\Admin\AppData\Local\Temp\{5B667E79-B290-47E2-92C1-8BF4783A6027}\WindowsDesktopRuntime
Size 28.7MB
SHA256 1a20c13d8103d83ada5db2f9b380f69273cb17766c6e5ca954ecb93230f218e2
MD5 6712931c838d7173b4fe90e26cf3b44a
SHA1 f84ec5355723e6ec63fbae066c1279c343da0450
SHA512 a52a9a6f8a93fad3b2bab1abab55cec643b1b5f32a40ac11a89c36fc79a7fc1603c58de7883adad7730a6790eaae831a8c4a556cf5f09f4588f1be0a4e116c43
SSDEEP 786432:6BL3xuy6hjEjqDpD2dSNcZojdjc6uAkCt/BDmR+Wbv:6BL3xuysjRV2dSqGlMAkApDKb
TLSH
T1FC6733577E8209FAD8264E71C4FB9364EA393C4C6310659F02A4741AEEFB7D0627A3C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIE31E.tmp

Path C:\Windows\Installer\MSIE31E.tmp
Size 411KB
SHA256 ac54078e0387d2a8ddcdbee3967da6ea6ec6508172505aca3d27a75fa43ce34f
MD5 1981cd407f5b5e81c70ba2729c56b381
SHA1 e0b6d311930ab3557d5a0a8769edefb49c32aa3f
SHA512 3b7c18ca780cf05a01062661156d71e0a4626469f28040e46f07c7deb8f9a643b838bbc88eda515362c5895171a337a3f5d9b8e321e539408fc1ae47e6ae4181
SSDEEP 6144:GDvoaVoIMrKAzCsTI+q6JL9eZYr1JJS5qZ47BwhYjzmHim:QvoaVo/2WCsT7pXJS5qgBwhYg
TLSH
T135947B29B3E418EDD4B682B6C5A78430FF75744D332095AF8BA4916D1F3BAA470BB701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BootstrapperApplicationData.xml

Path C:\Windows\TEMP\{D1666528-6847-4875-89F7-1C77DA25998D}\.ba\BootstrapperApplicationData.xml
Size 9KB
SHA256 0da13bd67e88529919a3d066aa6767188b7b2b97e5dd1df2e3e1a83970c25111
MD5 6134cde82dee63b5cdfc38e7686622f9
SHA1 fcb0ab62a70f76f8ac704027ad1676080055edde
SHA512 f365db6d84c137b2257996bab84a923f7d90464416cb7605a80539fbc446e72511c7946fcb0eb496e790ce505c29d8ac5469fa6f047acf786149f07315b6fb85
SSDEEP 192:iFzanZTl6/wvRSn9Xta+ai2fZ8SsCsysz:3nFptsCsysz
TLSH
T10812E5512BFD0219F0F3AF48EFF6A4155A3ABD152E39C92D01211D0F49B2E819962FB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetLogo_256x.png

Path C:\Windows\TEMP\{D1666528-6847-4875-89F7-1C77DA25998D}\.ba\DotNetLogo_256x.png
Size 2KB
SHA256 0f571f95d8eab48dbc81b0ec5e9f7225e349e26ef50868bfaab556f3c2443b01
MD5 39aa52615723b782c92dec710caaec7f
SHA1 760b49e256a7979fe50a56a2b1be3688a474b886
SHA512 89d1baa3820154667747b25e9e2fd321bfb2ec71dc309915b0a28dacdc80822a4943b639ebb37c37bd2559d5a4306d2096119cd970c84a0d331f6c68b0456dc9
TLSH
T1534195CF1BFD78D7E6E557918E1A8DD232738483B4B3A42CCE7B10B8274A5642B87940
MD5 SHA1 SHA512 TLSH

Submit Download

dotnet.ico

Path C:\Windows\TEMP\{D1666528-6847-4875-89F7-1C77DA25998D}\.ba\dotnet.ico
Size 44KB
SHA256 61a2cbd12868cb9b359e0c78961d409b7875f072eb8e53ea88d3e6bfe2961a18
MD5 b8096652d9ec286709a2c863b244b110
SHA1 b3b7f0f4d608fad7cb59ba499d4d17c2b873a7af
SHA512 492a5aa83220bb77c178b7c5b50bf44968c0427e9e45bb97a33df14d7fb4c667ca7adde0ebb3874c7b6011057b01144e4e6651fbad62c6bcf5e0b93586c4bc7a
SSDEEP 96:r+gfbzo+wHK9NbwOY4tIWQeVlV1W9+H+guapUjFamINUItzf1dBNaIZ:ro5HuNcH4tIzeVlV1WEOFDgUWzf1PIm
TLSH
T1E913EF6DE68547C1C10C2032DB4AC792B5233C72E4DAE0C4F9D4FA7E177906965C6E6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\TEMP\{D1666528-6847-4875-89F7-1C77DA25998D}\.ba\thm.wxl
Size 7KB
SHA256 b00edd703dd8a475119d0e4dd70a3aaa47f0e95361af290e76d367a8edef3432
MD5 8b2c667a8bbad3153068c0ed90df7ec4
SHA1 c9e04a3a37e5e6262ab9bfecf78280171b8f7b74
SHA512 5269f00d474acccb4c48cb7bcfdf19e63557a388572d3a6335aa39191319691d924e27f70da3f3495387c319396476c63a8fd7b35835cca0901220e39783847b
SSDEEP 96:HiTgM1+XSNEzA0HtYQstYCpCwZQpCeyk5HQJM9ouvj9urz8:Ew9EmtYQstYCPC9e8
TLSH
T191E1026F68DFDEE03A732651B2B3698D6919C29A136F1CF0F869084B47635016377A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.xml

Path C:\Windows\TEMP\{D1666528-6847-4875-89F7-1C77DA25998D}\.ba\thm.xml
Size 11KB
SHA256 dfee8e2d075087227f19c835c145c5bb8e72a46880ea24080bb2472fd3a521be
MD5 4329e418dc56b1386d7ea29a0dcfab5b
SHA1 58387f92e89ca21b4179fb697c7de9675c59142f
SHA512 6934873d27e6efbb94da4f13ee8369b29995490051016fdf82800256b924902306d328bf1d4ebbf266d1a53eb24adb6478d1a67de4ecc3e3bcbe561968f24922
SSDEEP 96:HgvPkoeWEH3IWTaQfSJgHzth5mFahbuB8pR5+Vpwe+UIJLg1gEp+6F5pQnxc:AvoWydmQfVHMyyj5Z
TLSH
T14B42FC6851DC7811C532D702AB9371D3FF12BDA6C6C85A58B48E256B1FF262028B739C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windowsdesktop-runtime-10.0.12-win-x64.exe

Path C:\Windows\Temp\{5B667E79-B290-47E2-92C1-8BF4783A6027}\.be\windowsdesktop-runtime-10.0.12-win-x64.exe
Size 968KB
SHA256 08a7e2db64e2ed8f0c0476d4463af75e691d1db571a05de6e161ce0178fbce90
MD5 95f7a028a67ce1c82bc647d02e1f2d0d
SHA1 6facfe6e1234168184b3ffb62189e608040fd65b
SHA512 07c388e66f7c6d9e9c257fc595c6eb9da5f9b1647a52fa10c81e72a49ce2b714eaeae9b7a604fbda61ca7f1aa1ae6a9781c50d8ce5259164ce27b81281cea773
SSDEEP 12288://hzPsOEX5eZbWC1I0iqm+4/Pm0zykD7xd5DWs2DuHxXQPE4Z8ob:/ZzPRq5eZbpTh47zykJnDWs5NQ84Zl
TLSH
T1CA256D31A566242BE6F40973F914D6307E28E7082B1C45B6C6D0DD0C79A89FA6FF724B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{D1666528-6847-4875-89F7-1C77DA25998D}\.ba\1028\thm.wxl
Size 7KB
SHA256 43e1e134d0591532323dfcd138ac8f5e99096cb6cb0213a486bbb3ecc5c47aad
MD5 2d7b0d29deaa836b538baaae8378ba48
SHA1 85d86c566f601ad6e22301183771b9cc7e5062e9
SHA512 ecc84dafe21bf858eb4693fd7c0802cf28dc5fcaf43eccc4ded3c4a83bd550e3dbf58012be695cf267917c39f6047eac89fd0cdec090e253c283783d01d8a916
SSDEEP 96:E5TrTfb5joKvyvOj8USd4sZij7N4WoWKWvsNMNizchn/hD2Rd0E/aQpSK1nuQKbm:4r5owj7NgwsNMNSiK1gd6r
TLSH
T1ECE10F5F7CEFCED46A332A0176B32989191DD28A13AE6CF4F5580C478B634216B73A07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{D1666528-6847-4875-89F7-1C77DA25998D}\.ba\1029\thm.wxl
Size 7KB
SHA256 2f174b5eed2a84e43396f3cae2e6521c9247bb0deccb16e7f9b461233c363534
MD5 f483510f350ad116c5c81468ad609bdf
SHA1 5343a3a695e6149c7a7ba831be75a91138763e44
SHA512 a39f3ebedb06361d95c39e4b7c5020d70be0e1e4654d5d5dfe254b44a7fa3a9c9c02659a28acc7ea8294620aa77818fb53609d7a2f6c9b6ae8d9adf9f2ac844c
SSDEEP 192:qxwpVLBj5iGRxrFe+4Lzv3zLfqRBxOTyv354+F:qxwNj5RxrF2PbLfWBETyv354S
TLSH
T17AF1FF1F58DFEED07B33194572B36A88681AC292035FACF5F8AE085787235059677E03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{D1666528-6847-4875-89F7-1C77DA25998D}\.ba\1031\thm.wxl
Size 7KB
SHA256 2589887424dd4b0b27d36f7aa36d07fb6fa8d1c4dbe50059248a24823c742f92
MD5 4e98d12cfce46c393dcdf2736a2bda95
SHA1 aaf6a00e50cdf19f1c4fc6256ac040a750ca97af
SHA512 314d712f8fcb2a44abe1920aa9f44d2fef626732397d3d77e4ad0ea6a003b0ea38e361c96515c8e6f8cf7d61ab96de9a349a228522a9f4b81d82c8a8f1962662
SSDEEP 96:jgl95EIQ8+nPQP6Zc0y7jOROgYmwitzvzB5xz2kSl+ACIw052Q/LKtkCGpUvgd/q:jEpcoPWc0y7jGhYmdtzvzr8/oa/Lt/hQ
TLSH
T134F1425BA8EFDAD077332611B3736989791AD2C6136F1DF4F8A9480B8763501537BA03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{D1666528-6847-4875-89F7-1C77DA25998D}\.ba\1036\thm.wxl
Size 8KB
SHA256 ecdd5f7b7ed65bef8e3eec00537da44939b8e8f8f604e9b39329b45ec210efde
MD5 7673a053117454b94ff8155b9f06da1e
SHA1 2143896f16e8ec6d52eecb773e99d9a2f9daa4b9
SHA512 0d20a4d6819fc64e36cfcd9c029542d6ef834faa3c74dd636bc1b6697f92d8822cd19c1692c500956fdfe69a3278a84c0545c799878107d0d56520053b9ae266
SSDEEP 96:lsZt1vwZI+XNHwt/o5HezMxzMEy0vBW4eAQf49QcyhZpuWcK61xrG32gUgGv:o1wPWto5+zwzvWhvgYUgg
TLSH
T1E202105F58DBCFE06BB31717B6639589A839C286235F58E4F86B08078763914D337A43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{D1666528-6847-4875-89F7-1C77DA25998D}\.ba\1040\thm.wxl
Size 7KB
SHA256 c536f3f85936f6b38782df30a7bf88c7e7e66fa1e3257b20b75f9a4f0112b184
MD5 21fe14f06f2e38ca565581045a67eaba
SHA1 fe56b260ea7986f6234aeaa9f3adb010b01a0ff5
SHA512 a87e53dbcab33b95d78f67c7e62f0c3fa50711f54b11efee890b749dd21f42e68db185dc5a99160dd37403612abb9609d311dea1254c126b1e96ecf7aab67051
SSDEEP 96:p0NpgwGrmKmuaXo+Hnxy7McLi4vgjzH9euz3KLrQTNRREhZDWDIQ0gwZKWakCRos:wNBoJvUzH9euz3tTDCnZKWzDU+c
TLSH
T1BFF1EF7B68DFDDD0BA332748B2B3B589B51ED586235F19E0F4AA094B4753500A27BA03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{D1666528-6847-4875-89F7-1C77DA25998D}\.ba\1041\thm.wxl
Size 8KB
SHA256 000e1508d9bacb7156951988ba1d6dc36165facd2163352a93b9a66e8c642089
MD5 e29c1d15cf0eeb5fb10a6f0e92b041fc
SHA1 68cd096f0135524d5d07a9ec1fbcb69e1a1084de
SHA512 47d3acdafbc3dc960d569976fe3c635613608f08102a6cd0c246f8ebe0f3343e73fc9d87a673035a46fbc4de21c59b97054dfd596dde2f5f6eea25f6ff7b7d96
SSDEEP 96:/x55EeSXkI6+QsPIVLYitzzus2iK5EmV26W/0zYe9YQfNpYjruBzUYwvdCz1Q:/BQFPIVLYszzutz8yzYUO/CxQ
TLSH
T1B702102EA5DB89E06A331611756776C8680BCC85DBAB1CF0B07DC817977341DE237A32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{D1666528-6847-4875-89F7-1C77DA25998D}\.ba\1042\thm.wxl
Size 7KB
SHA256 09c51c910f7142ab7f73db8e826f3daff1525eea765d03bcd934cba53bc689d3
MD5 095c8d4db15a85c0c62842d0192202ad
SHA1 d703ab6b95a8190a3187a65ba1b779d856eff7b8
SHA512 86860b18e9101c2d27359e53e21c7f2fe939031850387a6a55c12d23b7dbe4133722b5fdf4364dc896d5aac5744b470b45198a47da6912a4827b88f433a79796
SSDEEP 96:YWnvHZWx805aEfLW344uU5OsW+yvuE4uU5J+jpD2kUcdkAdiY10IHDWw/fPb8Qhk:kjcuYhu5jx2kP1/3bmk9d4
TLSH
T1E8F1429B78EFDED026732C413AF36A95591AC2DA235B08F0F9254C878B738114637E27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{D1666528-6847-4875-89F7-1C77DA25998D}\.ba\1045\thm.wxl
Size 7KB
SHA256 209911674536ad5976dad21ae1e96a9fdfa61270120a94bbe0e8ae32a67239a2
MD5 4e407f5d7e06084cb9ec7b41b1f4b992
SHA1 0aa44f39e522935de900449937af13df18a6ef44
SHA512 926daa3c9d92b7f0e910101d6482ce6e153af13dd3f59236d3418df4a158857f00ea565869312f35c0bf6e689b6f1a0bead71f54e77783d65311838dc980c996
SSDEEP 96:vz5E6U+A8fOIZcvYqUC/W5TqUbFaOa0Q9zSzfmZ5AKgY1ou5DQ7JPy+u1/8X3vCH:ln9BmNUCqeUJaOaHNCPA/zGYP
TLSH
T1D5F1005FA4EFCED127331A45B6B369C9680AC5CA136F1CE4F8AE081B87675019337A43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{D1666528-6847-4875-89F7-1C77DA25998D}\.ba\1046\thm.wxl
Size 7KB
SHA256 7b095c32d1fbdd924d710d18d51a88a710bc152c8b30c6051524583bfabe38c0
MD5 13d65c9d4996d93edafb2696cc2a90b3
SHA1 80047984b6cee842764b24ef33a5c67eaabab2f3
SHA512 14ceaf26e16cfd039e18614d40148c44e09cc2e7130b19a3024aabb46bac77c1445cd7de84ef46577ae1ab4cf15cd0152a3ccd6fe070ee0a34b06f8f29ba0af0
SSDEEP 96:TD5ED4lH+wLwdBc7tlqIz5Vv0gpK0rD45g5q8MSQ7EugTuo6RADvAbK:Z1kvg7xlVv0gpXMfgLGK
TLSH
T1D9F1121F68DFDED037331A42B2B36A8A6509C2C5135F5DF4F8AA494B87A3500A637A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{D1666528-6847-4875-89F7-1C77DA25998D}\.ba\1049\thm.wxl
Size 9KB
SHA256 3c911848f83d269fa2cd64bbfd7b5e88eb3a621bdd42c564c69100a8e8a40494
MD5 7904c2832b3cedabcdf0ec49dd8040ba
SHA1 2a7f428568ab6ea5fd54bb80376c552d80a0e7a3
SHA512 3c881efc2b611bda02b290bc79948818ce6e6a495dcf2dc938047875f301f18f9eae37ba109fd9b453504173cb9209192e0d2cd4603c7bf105042bc9775829e0
SSDEEP 96:C7lv+VxxVUC7bqFdwkd/XQF+L++qFQEemLq9OJRgcnZKQ8VXoshXuOxMvlmV3p/n:zVPVU//y+L++9wpZ/oRZ1
TLSH
T1A022FD2615EFA8D81222B117E9626E0E3C5B81FF3B6B5BF174641C6F76B3000833B606
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{D1666528-6847-4875-89F7-1C77DA25998D}\.ba\1055\thm.wxl
Size 7KB
SHA256 56d76adc63b71879e3291f0f306e54081e9e80f463fcb41dc6896ecd2298deae
MD5 e2fabe4eb312645c1231029191458f7e
SHA1 f9f143535ba48d9aeb791c62e79ed687911927b1
SHA512 ddf60df1ee2f00561bc806e384478b105182a4bec673b5eb26b1db7f88adb297af80b7bdfeecd5e0aefc3579bf20a84bc9bacdcfb727b9d1af2865cdcdc48a37
SSDEEP 96:YMANNFTFhC4h4bNReiNxfufGzzzSkbAS37lsu+wzPwQT8gpwMu7kVS0uuM/r+9Hc:YlFJydNxfu+zzzgoZ7Twh/6H/0
TLSH
T1DCF1231F78DFEDD467332A56B2B3268CB84EC382132A9CE0F52944479BA351152B7B07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{D1666528-6847-4875-89F7-1C77DA25998D}\.ba\2052\thm.wxl
Size 7KB
SHA256 340154c87016bd6af740e6a91ea86d722817f6dc2bc675c33133901443658179
MD5 e89b4290f9255b428cc21e217dc8e5e7
SHA1 84f78df432e53426412e2123c1990acfb743f6c9
SHA512 b313de643859aca6b9b2f05f88efd130c900065c08d2279af6f7d8dd0301a7a762ee0e051ccc76c737c68c86e51decd48287529e7fc9a25c0cb1228151447105
SSDEEP 96:dLf2DllNpoNWZd9rCfE4d57afwUtn93K248RYCPr/I5Qqj9BQru0iCiBkz6/3PPx:d0Np6fHGwMn93MRoL+u0x
TLSH
T11EE1119F78EFCEE02A332A5132B325CC2819D28957AB5DF0F4641C4B8B634205777A07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{D1666528-6847-4875-89F7-1C77DA25998D}\.ba\3082\thm.wxl
Size 7KB
SHA256 2416f9a3daa6767f418c5ab94edb8a83dc9326fcaf13de1186e61b5248349edc
MD5 65b3aa6dd10a5b8db1b7f7faa4c4c7e1
SHA1 ca32c8b853681960c86d19d533dff4ff1137a1c6
SHA512 d7fce89011c24d0c3928807293d42a3f694ef4357d3c42a84d9294de000b291279671e2059e063ac58806b8e718654260ce5c9ae8c748d3a0a8c9ce0e23ac55a
SSDEEP 96:oEBx4+Ck8rL6j+zTnnq6LuSznTUzO1GKW+gepaU5/QxANuRypklEDhmh8asuBtz:aX6qfxLzznAzO1G0ERdiu/z
TLSH
T132F1412F68CFDEE27B73194472F3958DA808C295235ECDE0F468085B8793905D637A83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BootstrapperExtensionData.xml

Path C:\Windows\Temp\{D1666528-6847-4875-89F7-1C77DA25998D}\.ba\BootstrapperExtensionData.xml
Size 276B
SHA256 258fac237622533e7f9ec3f95bcec8abcc31ae87e2017e5717af0841c61e9df4
MD5 240bac991e5860465ce0dfd580ea7cb3
SHA1 a352934cbb14ab877883ac219ceb78c92e27f495
SHA512 67ff8063a071436ae7dca8ee12ad1991bb70752dcc63f00f129f38dffa1aaf9299fff591fc67dbf4d2fdc57a9242831b149d575181b84857cd4f22463076f315
TLSH
T1DAD05E432FBE2304F1B30F49A6BA94102475BE009D78CC6D0228080C0573D92C8B2F77
MD5 SHA1 SHA512 TLSH

Submit Download

license.rtf

Path C:\Windows\Temp\{D1666528-6847-4875-89F7-1C77DA25998D}\.ba\license.rtf
Size 215B
SHA256 75cf03762aea3f3ef6ae0dc0290c4426052549a0b4335bcc3ba9ca30391e0751
MD5 5f5db41d3f86258e4b6f8b08ef870d0a
SHA1 3c02aea43c2bc7dff281ec8e5ad01abf058c1ed6
SHA512 26344831d563e95a26126f2d99ce9b773017596001fbf3d7f56b9a84c77a69240640b7bb191ec8ec7fa66d424134805113be8b9503adae19554aaba6c98223ee
TLSH
T19BD022EA15CC11AA3FB80A8CEB04D029ED7E419DBC41D682B1313A90F81192DB2C76A2
MD5 SHA1 SHA512 TLSH

Submit Download

logo.png

Path C:\Windows\Temp\{D1666528-6847-4875-89F7-1C77DA25998D}\.ba\logo.png
Size 852B
SHA256 cd2e8ed1fbb308d9d166f49794d323a9b22efba1033cdf906d1f4b030319e01b
MD5 8346e21859a269dccf1e408dc7593cca
SHA1 239f10674bf6022854c1f1bf7c91955bde34d3e4
SHA512 de9a54e7067fe4feade10f48d7c2bb4169f50efa0b06d3310421376690712af4d55dbc24dc5accc5013379b11abb59cc8c85896fe9f2a7c6a7ea2e28f6feac9f
TLSH
T16B0152E8C16455ACA24E76BA91F32450B653B46010C5CD8EBE00DF3442F4522AB976A6
MD5 SHA1 SHA512 TLSH

Submit Download

wixstdba.exe

Path C:\Windows\Temp\{D1666528-6847-4875-89F7-1C77DA25998D}\.ba\wixstdba.exe
Size 431KB
SHA256 e9aad13949cd910523bf9547fc5c23bd2c26595e024809a9f8fa866c8d8e555b
MD5 14e0c606e68508fa618bd5c514015577
SHA1 f8c28db9d2810e872f6ffe7607019851f250c5f9
SHA512 c29fedca692ca2f9c5e63f360aeb95399f2f15f1576a0d06fcf9f0919f6b658329973803bc870b0b1e954b0105757630ca3f4b3ac64f4b80e91742d612fd5b73
SSDEEP 6144:N7lQcp03E0PKVMP/PwMFJ3zdoZmb8LSQsCjzYkffTTp6EoNXJrprSU0e:Np6mM/wML3/QsJDLXJrow
TLSH
T16D942A3165F04023D6F94572E915FA30AF39F208670085EBA3C0DD297968AE6A7FB357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download