6eeedbc96170c609837c90c838e2432684e6fefe769389cbfdd4b7fdc48de4d9

Analysis

user interaction
yes
max time kernel
273s
max time network
256s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
24/09/2026, 01:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NL-X.exe
Size 3.4MB
Sample260924-bvabfsbb39
SHA256 6eeedbc96170c609837c90c838e2432684e6fefe769389cbfdd4b7fdc48de4d9
MD5 e89b78bd7e50d3aa6ee7608b09d02131
SHA1 dc7ae24a5ecd5fa990e6d9d4606e1094d728c83a
SHA512 b713af0c8136a4c758a638f68cc65a2b545d0d8ca24f52b1d897752d51ef625fa6bbc705f07e8274dd9cd24a43cb63ecbe16bf9aa09a0d18adcf08b95f8adcd8
SSDEEP 98304:fr6YOoQySCUHrOlaaONF36nSo+/PBR2egJnQjwr6l:fr6l/HK2NFKSo+/PCecQsr6l
TLSH
T134F5E11752A64E87C17167FC94279749467277C47A33E39EAA307024EEE1BD34E2A3E0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery persistence

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
81	4280	msedge.exe

Executes dropped EXE 6 IoCs

pid	Process
3280	windowsdesktop-runtime-9.0.20-win-x64 (1).exe
712	windowsdesktop-runtime-9.0.20-win-x64 (1).exe
2472	windowsdesktop-runtime-9.0.20-win-x64.exe
1888	windowsdesktop-runtime-9.0.20-win-x64.exe
504	windowsdesktop-runtime-9.0.20-win-x64.exe
4884	windowsdesktop-runtime-9.0.20-win-x64.exe

Loads dropped DLL 64 IoCs

pid	Process
712	windowsdesktop-runtime-9.0.20-win-x64 (1).exe
1128	MsiExec.exe
1128	MsiExec.exe
1016	MsiExec.exe
1016	MsiExec.exe
1184	MsiExec.exe
4884	windowsdesktop-runtime-9.0.20-win-x64.exe
1184	MsiExec.exe
1408	MsiExec.exe
1408	MsiExec.exe
4048	NL-X.exe
4048	NL-X.exe
4048	NL-X.exe
4048	NL-X.exe
4048	NL-X.exe
4048	NL-X.exe
4048	NL-X.exe
4048	NL-X.exe
4048	NL-X.exe
4048	NL-X.exe
4048	NL-X.exe
4048	NL-X.exe
4048	NL-X.exe
4048	NL-X.exe
4048	NL-X.exe
4048	NL-X.exe
4048	NL-X.exe
4048	NL-X.exe
4048	NL-X.exe
4048	NL-X.exe
4048	NL-X.exe
4048	NL-X.exe
4048	NL-X.exe
4048	NL-X.exe
4048	NL-X.exe
4048	NL-X.exe
4048	NL-X.exe
4048	NL-X.exe
4048	NL-X.exe
4048	NL-X.exe
4048	NL-X.exe
4048	NL-X.exe
4048	NL-X.exe
4048	NL-X.exe
4048	NL-X.exe
4048	NL-X.exe
4048	NL-X.exe
4048	NL-X.exe
4048	NL-X.exe
4048	NL-X.exe
4048	NL-X.exe
4048	NL-X.exe
4048	NL-X.exe
4048	NL-X.exe
4048	NL-X.exe
4048	NL-X.exe
4048	NL-X.exe
4048	NL-X.exe
4048	NL-X.exe
4048	NL-X.exe
4048	NL-X.exe
4048	NL-X.exe
4048	NL-X.exe
4048	NL-X.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{606b692c-f1ce-431c-a36b-8904b772ffc0} = "\"C:\\ProgramData\\Package Cache\\{606b692c-f1ce-431c-a36b-8904b772ffc0}\\windowsdesktop-runtime-9.0.20-win-x64.exe\" /burn.runonce"	windowsdesktop-runtime-9.0.20-win-x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.20\System.Security.Cryptography.Encoding.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.20\ru\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.20\it\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.20\ko\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.20\ja\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.20\System.Text.Encodings.Web.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.20\Microsoft.Win32.SystemEvents.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.20\wpfgfx_cor3.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.20\System.IO.Compression.Brotli.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.20\System.IO.IsolatedStorage.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.20\System.Data.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.20\System.Diagnostics.Contracts.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.20\System.Windows.Forms.Primitives.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.20\PresentationFramework.Royale.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.20\System.Xml.XmlDocument.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.20\it\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.20\tr\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.20\de\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.20\System.Net.ServicePoint.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.20\System.Security.Cryptography.Primitives.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.20\ru\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.20\System.Windows.Forms.Design.Editors.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.20\it\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.20\zh-Hans\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.20\pt-BR\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.20\System.Diagnostics.Tracing.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.20\it\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.20\System.Reflection.DispatchProxy.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.20\it\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.20\System.IO.FileSystem.AccessControl.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.20\de\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.20\WindowsFormsIntegration.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.20\de\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.20\pl\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.20\System.ComponentModel.Primitives.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.20\System.Diagnostics.TextWriterTraceListener.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.20\PresentationFramework-SystemDrawing.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.20\System.IO.Packaging.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.20\System.Buffers.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.20\pt-BR\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.20\System.Collections.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.20\fr\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.20\UIAutomationProvider.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.20\ko\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.20\System.Diagnostics.EventLog.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.20\ko\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.20\System.Reflection.Metadata.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.20\cs\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.20\es\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.20\es\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.20\it\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.20\PresentationFramework.Aero2.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.20\zh-Hant\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.20\System.Net.WebHeaderCollection.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.20\it\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.20\es\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.20\zh-Hant\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.20\System.Private.Uri.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.20\System.Net.WebSockets.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.20\System.Reflection.Emit.ILGeneration.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.20\ko\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.20\pt-BR\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.20\System.Numerics.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.20\de\UIAutomationClient.resources.dll	msiexec.exe

Drops file in Windows directory 51 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\~DFFEB01A79C7DDD15F.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{68465FE8-CD12-4644-9207-321177B3FCD5}	msiexec.exe
File created	C:\Windows\SystemTemp\~DF79CC8CD34E1FBAD4.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\~DFDB78F2AFB0DFEAE0.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF2073AB25FEF5A5CD.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBEA9.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFE8ED8BF3C3AA7F00.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFABA8D6B785F41FDB.TMP	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149\fileCoreHostExe	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149\fileCoreHostExe	msiexec.exe
File created	C:\Windows\Installer\e59a89e.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC060.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e59a8ab.msi	msiexec.exe
File created	C:\Windows\Installer\e59a8af.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFFD734DB144DA0660.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF3E09BA43F17E09D6.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF53396C0C8814F22D.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBD8F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e59a8a4.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF724B431DFCD0FE03.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB80D.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF95408ACB2DAED0E4.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBA12.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFDB4E4B6A851BAAF6.TMP	msiexec.exe
File created	C:\Windows\Installer\e59a8aa.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBBE8.tmp	msiexec.exe
File created	C:\Windows\Installer\e59a8a3.msi	msiexec.exe
File created	C:\Windows\Installer\e59a8ab.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC265.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF54B2B34A21B85BD6.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF00E9D0A9AFA4ECA7.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{7D71D984-8113-4B95-A849-BB8DC4354512}	msiexec.exe
File created	C:\Windows\Installer\SourceHash{D7738E59-52E4-488F-A463-65637A0EBDB2}	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC43B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID330.tmp	msiexec.exe
File created	C:\Windows\Installer\e59a8a4.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e59a89a.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAB0B.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAC74.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e59a89f.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFF07214F38908304E.TMP	msiexec.exe
File created	C:\Windows\Installer\e59a89a.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF180C9654E9F6F48C.TMP	msiexec.exe
File created	C:\Windows\Installer\e59a89f.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{652EA44D-4731-4B4B-9B5E-8ED01243CB29}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBF36.tmp	msiexec.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 2 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\windowsdesktop-runtime-9.0.20-win-x64.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\windowsdesktop-runtime-9.0.20-win-x64 (1).exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-9.0.20-win-x64 (1).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-9.0.20-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-9.0.20-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-9.0.20-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-9.0.20-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-9.0.20-win-x64 (1).exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4280	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000340eaa2ac44bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bad2542cc44bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b7bd2130c44bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fc89242ac44bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e43b162ac44bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\95E8377D4E25F8844A365636A7E0DB2B\SourceList\PackageName = "dotnet-hostfxr-9.0.20-win-x64.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D44AE2561374B4B4B9E5E80D2134BC92\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{652EA44D-4731-4B4B-9B5E-8ED01243CB29}v72.80.58335\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8EF5648621DC446429702311773BCF5D\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{606b692c-f1ce-431c-a36b-8904b772ffc0}\Version = "9.0.20.36421"	windowsdesktop-runtime-9.0.20-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\95E8377D4E25F8844A365636A7E0DB2B\PackageCode = "052A159B3969C5A43ACE986D19017C07"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_72.80.58335_x64	windowsdesktop-runtime-9.0.20-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D44AE2561374B4B4B9E5E80D2134BC92\Provider	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D44AE2561374B4B4B9E5E80D2134BC92	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D44AE2561374B4B4B9E5E80D2134BC92\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8EF5648621DC446429702311773BCF5D\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{606b692c-f1ce-431c-a36b-8904b772ffc0}\ = "{606b692c-f1ce-431c-a36b-8904b772ffc0}"	windowsdesktop-runtime-9.0.20-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\489D17D7311859B48A94BBD84C535421\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\95E8377D4E25F8844A365636A7E0DB2B\Provider	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\95E8377D4E25F8844A365636A7E0DB2B\MainFeature	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\95E8377D4E25F8844A365636A7E0DB2B\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\95E8377D4E25F8844A365636A7E0DB2B\DeploymentFlags = "3"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D44AE2561374B4B4B9E5E80D2134BC92\AdvertiseFlags = "388"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8EF5648621DC446429702311773BCF5D\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_72.80.58335_x64\ = "{7D71D984-8113-4B95-A849-BB8DC4354512}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_72.80.58453_x64\DisplayName = "Microsoft Windows Desktop Runtime - 9.0.20 (x64)"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8EF5648621DC446429702311773BCF5D\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8EF5648621DC446429702311773BCF5D\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_72.80.58453_x64\Dependents	windowsdesktop-runtime-9.0.20-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\95E8377D4E25F8844A365636A7E0DB2B\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\F71950C1A6A51F479A1ED20855BD5918\D44AE2561374B4B4B9E5E80D2134BC92	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_72.80.58335_x64\Version = "72.80.58335"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\489D17D7311859B48A94BBD84C535421\MainFeature	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\95E8377D4E25F8844A365636A7E0DB2B\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8EF5648621DC446429702311773BCF5D\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8EF5648621DC446429702311773BCF5D\ProductName = "Microsoft Windows Desktop Runtime - 9.0.20 (x64)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8EF5648621DC446429702311773BCF5D\PackageCode = "125E82A83AFFB0A43A3E356BFE06BF4B"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\489D17D7311859B48A94BBD84C535421\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\489D17D7311859B48A94BBD84C535421\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{7D71D984-8113-4B95-A849-BB8DC4354512}v72.80.58335\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_72.80.58335_x64	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_72.80.58335_x64\Dependents\{606b692c-f1ce-431c-a36b-8904b772ffc0}	windowsdesktop-runtime-9.0.20-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8EF5648621DC446429702311773BCF5D\Provider	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\489D17D7311859B48A94BBD84C535421	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\489D17D7311859B48A94BBD84C535421\PackageCode = "E369DC004B4B1A847ABEA10B0B84CDF8"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\95E8377D4E25F8844A365636A7E0DB2B\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\489D17D7311859B48A94BBD84C535421\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8EF5648621DC446429702311773BCF5D	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\42100E7A31857345F3F42E30BE84B4CE\489D17D7311859B48A94BBD84C535421	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\95E8377D4E25F8844A365636A7E0DB2B	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\95E8377D4E25F8844A365636A7E0DB2B\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D44AE2561374B4B4B9E5E80D2134BC92\PackageCode = "C0EC16E8DB846B84D88AE0C49DAB26F1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8EF5648621DC446429702311773BCF5D	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8EF5648621DC446429702311773BCF5D\SourceList\PackageName = "windowsdesktop-runtime-9.0.20-win-x64.msi"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\489D17D7311859B48A94BBD84C535421\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\85EF14E01B55284494358356B97089C8\95E8377D4E25F8844A365636A7E0DB2B	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D44AE2561374B4B4B9E5E80D2134BC92\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D44AE2561374B4B4B9E5E80D2134BC92\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_9.0_x64\Dependents\{606b692c-f1ce-431c-a36b-8904b772ffc0}	windowsdesktop-runtime-9.0.20-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\95E8377D4E25F8844A365636A7E0DB2B	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_9.0_x64\Version = "72.80.58335"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D44AE2561374B4B4B9E5E80D2134BC92\SourceList\PackageName = "dotnet-host-9.0.20-win-x64.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_72.80.58453_x64\ = "{68465FE8-CD12-4644-9207-321177B3FCD5}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\0ABD6EF11FA5BFF760DCCB90C86A208B\8EF5648621DC446429702311773BCF5D	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_72.80.58453_x64\Dependents\{606b692c-f1ce-431c-a36b-8904b772ffc0}	windowsdesktop-runtime-9.0.20-win-x64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\dotnet_runtime_72.80.58335_x64	windowsdesktop-runtime-9.0.20-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_72.80.58335_x64\Dependents	windowsdesktop-runtime-9.0.20-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\95E8377D4E25F8844A365636A7E0DB2B\ProductName = "Microsoft .NET Host FX Resolver - 9.0.20 (x64)"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\F71950C1A6A51F479A1ED20855BD5918	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D44AE2561374B4B4B9E5E80D2134BC92\SourceList	msiexec.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\windowsdesktop-runtime-9.0.20-win-x64.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\windowsdesktop-runtime-9.0.20-win-x64 (1).exe:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1884	msiexec.exe
1884	msiexec.exe
1884	msiexec.exe
1884	msiexec.exe
1884	msiexec.exe
1884	msiexec.exe
1884	msiexec.exe
1884	msiexec.exe
4048	NL-X.exe
4048	NL-X.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2472	windowsdesktop-runtime-9.0.20-win-x64.exe
Token: SeIncreaseQuotaPrivilege	2472	windowsdesktop-runtime-9.0.20-win-x64.exe
Token: SeSecurityPrivilege	1884	msiexec.exe
Token: SeCreateTokenPrivilege	2472	windowsdesktop-runtime-9.0.20-win-x64.exe
Token: SeAssignPrimaryTokenPrivilege	2472	windowsdesktop-runtime-9.0.20-win-x64.exe
Token: SeLockMemoryPrivilege	2472	windowsdesktop-runtime-9.0.20-win-x64.exe
Token: SeIncreaseQuotaPrivilege	2472	windowsdesktop-runtime-9.0.20-win-x64.exe
Token: SeMachineAccountPrivilege	2472	windowsdesktop-runtime-9.0.20-win-x64.exe
Token: SeTcbPrivilege	2472	windowsdesktop-runtime-9.0.20-win-x64.exe
Token: SeSecurityPrivilege	2472	windowsdesktop-runtime-9.0.20-win-x64.exe
Token: SeTakeOwnershipPrivilege	2472	windowsdesktop-runtime-9.0.20-win-x64.exe
Token: SeLoadDriverPrivilege	2472	windowsdesktop-runtime-9.0.20-win-x64.exe
Token: SeSystemProfilePrivilege	2472	windowsdesktop-runtime-9.0.20-win-x64.exe
Token: SeSystemtimePrivilege	2472	windowsdesktop-runtime-9.0.20-win-x64.exe
Token: SeProfSingleProcessPrivilege	2472	windowsdesktop-runtime-9.0.20-win-x64.exe
Token: SeIncBasePriorityPrivilege	2472	windowsdesktop-runtime-9.0.20-win-x64.exe
Token: SeCreatePagefilePrivilege	2472	windowsdesktop-runtime-9.0.20-win-x64.exe
Token: SeCreatePermanentPrivilege	2472	windowsdesktop-runtime-9.0.20-win-x64.exe
Token: SeBackupPrivilege	2472	windowsdesktop-runtime-9.0.20-win-x64.exe
Token: SeRestorePrivilege	2472	windowsdesktop-runtime-9.0.20-win-x64.exe
Token: SeShutdownPrivilege	2472	windowsdesktop-runtime-9.0.20-win-x64.exe
Token: SeDebugPrivilege	2472	windowsdesktop-runtime-9.0.20-win-x64.exe
Token: SeAuditPrivilege	2472	windowsdesktop-runtime-9.0.20-win-x64.exe
Token: SeSystemEnvironmentPrivilege	2472	windowsdesktop-runtime-9.0.20-win-x64.exe
Token: SeChangeNotifyPrivilege	2472	windowsdesktop-runtime-9.0.20-win-x64.exe
Token: SeRemoteShutdownPrivilege	2472	windowsdesktop-runtime-9.0.20-win-x64.exe
Token: SeUndockPrivilege	2472	windowsdesktop-runtime-9.0.20-win-x64.exe
Token: SeSyncAgentPrivilege	2472	windowsdesktop-runtime-9.0.20-win-x64.exe
Token: SeEnableDelegationPrivilege	2472	windowsdesktop-runtime-9.0.20-win-x64.exe
Token: SeManageVolumePrivilege	2472	windowsdesktop-runtime-9.0.20-win-x64.exe
Token: SeImpersonatePrivilege	2472	windowsdesktop-runtime-9.0.20-win-x64.exe
Token: SeCreateGlobalPrivilege	2472	windowsdesktop-runtime-9.0.20-win-x64.exe
Token: SeRestorePrivilege	1884	msiexec.exe
Token: SeTakeOwnershipPrivilege	1884	msiexec.exe
Token: SeRestorePrivilege	1884	msiexec.exe
Token: SeTakeOwnershipPrivilege	1884	msiexec.exe
Token: SeRestorePrivilege	1884	msiexec.exe
Token: SeTakeOwnershipPrivilege	1884	msiexec.exe
Token: SeRestorePrivilege	1884	msiexec.exe
Token: SeTakeOwnershipPrivilege	1884	msiexec.exe
Token: SeRestorePrivilege	1884	msiexec.exe
Token: SeTakeOwnershipPrivilege	1884	msiexec.exe
Token: SeRestorePrivilege	1884	msiexec.exe
Token: SeTakeOwnershipPrivilege	1884	msiexec.exe
Token: SeRestorePrivilege	1884	msiexec.exe
Token: SeTakeOwnershipPrivilege	1884	msiexec.exe
Token: SeRestorePrivilege	1884	msiexec.exe
Token: SeTakeOwnershipPrivilege	1884	msiexec.exe
Token: SeRestorePrivilege	1884	msiexec.exe
Token: SeTakeOwnershipPrivilege	1884	msiexec.exe
Token: SeRestorePrivilege	1884	msiexec.exe
Token: SeTakeOwnershipPrivilege	1884	msiexec.exe
Token: SeRestorePrivilege	1884	msiexec.exe
Token: SeTakeOwnershipPrivilege	1884	msiexec.exe
Token: SeRestorePrivilege	1884	msiexec.exe
Token: SeTakeOwnershipPrivilege	1884	msiexec.exe
Token: SeRestorePrivilege	1884	msiexec.exe
Token: SeTakeOwnershipPrivilege	1884	msiexec.exe
Token: SeRestorePrivilege	1884	msiexec.exe
Token: SeTakeOwnershipPrivilege	1884	msiexec.exe
Token: SeRestorePrivilege	1884	msiexec.exe
Token: SeTakeOwnershipPrivilege	1884	msiexec.exe
Token: SeRestorePrivilege	1884	msiexec.exe
Token: SeTakeOwnershipPrivilege	1884	msiexec.exe

Suspicious use of FindShellTrayWindow 23 IoCs

pid	Process
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
712	windowsdesktop-runtime-9.0.20-win-x64 (1).exe
4572	msedge.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
4572	msedge.exe
4572	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4784 wrote to memory of 4572	4784	NL-X.exe	79
PID 4572 wrote to memory of 568	4572	msedge.exe	80
PID 4572 wrote to memory of 4280	4572	msedge.exe	81
PID 4572 wrote to memory of 3248	4572	msedge.exe	82
PID 4572 wrote to memory of 3248	4572	msedge.exe	82
PID 4572 wrote to memory of 3248	4572	msedge.exe	82
PID 4572 wrote to memory of 1924	4572	msedge.exe	84
PID 4572 wrote to memory of 1924	4572	msedge.exe	84
PID 4572 wrote to memory of 2672	4572	msedge.exe	85
PID 4572 wrote to memory of 4328	4572	msedge.exe	86
PID 4572 wrote to memory of 2672	4572	msedge.exe	85
PID 4572 wrote to memory of 2672	4572	msedge.exe	85
PID 4572 wrote to memory of 4328	4572	msedge.exe	86
PID 4572 wrote to memory of 4328	4572	msedge.exe	86
PID 4572 wrote to memory of 224	4572	msedge.exe	87
PID 4572 wrote to memory of 224	4572	msedge.exe	87
PID 4572 wrote to memory of 224	4572	msedge.exe	87
PID 4572 wrote to memory of 1160	4572	msedge.exe	88
PID 4572 wrote to memory of 4044	4572	msedge.exe	89
PID 4572 wrote to memory of 3384	4572	msedge.exe	90
PID 4572 wrote to memory of 1160	4572	msedge.exe	88
PID 4572 wrote to memory of 1160	4572	msedge.exe	88
PID 4572 wrote to memory of 4044	4572	msedge.exe	89
PID 4572 wrote to memory of 4044	4572	msedge.exe	89
PID 4572 wrote to memory of 3384	4572	msedge.exe	90
PID 4572 wrote to memory of 3384	4572	msedge.exe	90
PID 4572 wrote to memory of 3652	4572	msedge.exe	92
PID 4572 wrote to memory of 3652	4572	msedge.exe	92
PID 4572 wrote to memory of 3860	4572	msedge.exe	93
PID 4572 wrote to memory of 3860	4572	msedge.exe	93
PID 4572 wrote to memory of 1092	4572	msedge.exe	95
PID 4572 wrote to memory of 1092	4572	msedge.exe	95
PID 4572 wrote to memory of 1444	4572	msedge.exe	96
PID 4572 wrote to memory of 1444	4572	msedge.exe	96
PID 4572 wrote to memory of 1664	4572	msedge.exe	97
PID 4572 wrote to memory of 4944	4572	msedge.exe	99
PID 1664 wrote to memory of 4204	1664	msedge.exe	100
PID 4572 wrote to memory of 5048	4572	msedge.exe	101
PID 4572 wrote to memory of 5048	4572	msedge.exe	101
PID 4572 wrote to memory of 5048	4572	msedge.exe	101
PID 4572 wrote to memory of 3520	4572	msedge.exe	102
PID 4572 wrote to memory of 3520	4572	msedge.exe	102
PID 4572 wrote to memory of 924	4572	msedge.exe	103
PID 4572 wrote to memory of 924	4572	msedge.exe	103
PID 4572 wrote to memory of 1560	4572	msedge.exe	104
PID 4572 wrote to memory of 1560	4572	msedge.exe	104
PID 4572 wrote to memory of 5032	4572	msedge.exe	105
PID 4572 wrote to memory of 5032	4572	msedge.exe	105
PID 4572 wrote to memory of 1568	4572	msedge.exe	106
PID 4572 wrote to memory of 1568	4572	msedge.exe	106
PID 4572 wrote to memory of 5060	4572	msedge.exe	107
PID 4572 wrote to memory of 2348	4572	msedge.exe	108
PID 4572 wrote to memory of 5060	4572	msedge.exe	107
PID 4572 wrote to memory of 5060	4572	msedge.exe	107
PID 4572 wrote to memory of 2348	4572	msedge.exe	108
PID 4572 wrote to memory of 1408	4572	msedge.exe	109
PID 4572 wrote to memory of 5016	4572	msedge.exe	110
PID 4572 wrote to memory of 5016	4572	msedge.exe	110
PID 4572 wrote to memory of 5016	4572	msedge.exe	110
PID 4572 wrote to memory of 3380	4572	msedge.exe	111
PID 4572 wrote to memory of 3380	4572	msedge.exe	111
PID 4572 wrote to memory of 3380	4572	msedge.exe	111
PID 4572 wrote to memory of 1872	4572	msedge.exe	112
PID 4572 wrote to memory of 4428	4572	msedge.exe	113

C:\Users\Admin\AppData\Local\Temp\NL-X.exe
"C:\Users\Admin\AppData\Local\Temp\NL-X.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.NETCore.App&framework_version=9.0.0&arch=x64&rid=win-x64&os=win10&gui=true
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x350,0x7ffc59aac188,0x7ffc59aac194,0x7ffc59aac1a0
    3⤵
    PID:568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1840,i,6783425895787802627,9716243998110420718,524288 --field-trial-handle=2080,i,5017152728844543798,12064563798610773682,262144 --variations-seed-version --mojo-platform-channel-handle=2108 /prefetch:11
    3⤵
    - Downloads MZ/PE file
    - System Time Discovery
    PID:4280
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1604,i,2879047106321602857,16872617367707718412,262144 --field-trial-handle=2080,i,5017152728844543798,12064563798610773682,262144 --variations-seed-version --mojo-platform-channel-handle=2076 /prefetch:2
    3⤵
    PID:3248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2452,i,17975161245156345209,11339115454995251902,524288 --field-trial-handle=2080,i,5017152728844543798,12064563798610773682,262144 --variations-seed-version --mojo-platform-channel-handle=2596 /prefetch:13
    3⤵
    PID:1924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,8790663086876228084,12794929559489351517,2097152 --field-trial-handle=2080,i,5017152728844543798,12064563798610773682,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
    3⤵
    PID:2672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,14420758802538582570,7872780309431039105,2097152 --field-trial-handle=2080,i,5017152728844543798,12064563798610773682,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
    3⤵
    PID:4328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4140,i,15547047359615162236,5030026827142704120,2097152 --field-trial-handle=2080,i,5017152728844543798,12064563798610773682,262144 --variations-seed-version --mojo-platform-channel-handle=4152 /prefetch:1
    3⤵
    PID:224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4148,i,11460270776800840598,1838821778824352476,2097152 --field-trial-handle=2080,i,5017152728844543798,12064563798610773682,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:9
    3⤵
    PID:1160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4176,i,18212637864872487346,13076590289962030656,2097152 --field-trial-handle=2080,i,5017152728844543798,12064563798610773682,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:1
    3⤵
    PID:4044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4224,i,11988504971622109447,7016669865076919972,2097152 --field-trial-handle=2080,i,5017152728844543798,12064563798610773682,262144 --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:9
    3⤵
    PID:3384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3632,i,9188974097880350312,14309574088382987064,524288 --field-trial-handle=2080,i,5017152728844543798,12064563798610773682,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:14
    3⤵
    PID:3652
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3440,i,5040169771693049472,11754637916706473366,524288 --field-trial-handle=2080,i,5017152728844543798,12064563798610773682,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:14
    3⤵
    PID:3860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4276,i,8463314880820847239,15295788412153306163,524288 --field-trial-handle=2080,i,5017152728844543798,12064563798610773682,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:14
    3⤵
    PID:1092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4340,i,6970872132387237681,11388870609512118380,524288 --field-trial-handle=2080,i,5017152728844543798,12064563798610773682,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:14
    3⤵
    PID:1444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4128,i,11974268571574358400,6766583462816041391,524288 --field-trial-handle=2080,i,5017152728844543798,12064563798610773682,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1116
      4⤵
      PID:4204
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6156,i,10819316107746419421,1905374901206935646,524288 --field-trial-handle=2080,i,5017152728844543798,12064563798610773682,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:14
    3⤵
    PID:3212
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6156,i,10819316107746419421,1905374901206935646,524288 --field-trial-handle=2080,i,5017152728844543798,12064563798610773682,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:14
    3⤵
    PID:4944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6336,i,10149630930561615831,5662742790998746655,2097152 --field-trial-handle=2080,i,5017152728844543798,12064563798610773682,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:1
    3⤵
    PID:5048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3460,i,11378246617769984392,2712993818879344820,524288 --field-trial-handle=2080,i,5017152728844543798,12064563798610773682,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:14
    3⤵
    PID:3520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4496,i,18053284206089660512,13101225148992184932,524288 --field-trial-handle=2080,i,5017152728844543798,12064563798610773682,262144 --variations-seed-version --mojo-platform-channel-handle=4072 /prefetch:14
    3⤵
    PID:924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4508,i,17165076171691909558,9124117965047840444,524288 --field-trial-handle=2080,i,5017152728844543798,12064563798610773682,262144 --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:14
    3⤵
    PID:1560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6632,i,2620927980052649730,12653909716263467258,524288 --field-trial-handle=2080,i,5017152728844543798,12064563798610773682,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:14
    3⤵
    PID:5032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6176,i,17163401115071098826,11056224838191045200,524288 --field-trial-handle=2080,i,5017152728844543798,12064563798610773682,262144 --variations-seed-version --mojo-platform-channel-handle=4072 /prefetch:14
    3⤵
    PID:1568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=6984,i,927273989949021888,6112434359565035333,2097152 --field-trial-handle=2080,i,5017152728844543798,12064563798610773682,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:1
    3⤵
    PID:5060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6936,i,4294956213476379667,16244912148299236859,524288 --field-trial-handle=2080,i,5017152728844543798,12064563798610773682,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:14
    3⤵
    PID:2348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6996,i,867767883817267070,12291702398930119026,524288 --field-trial-handle=2080,i,5017152728844543798,12064563798610773682,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:14
    3⤵
    - Subvert Trust Controls: Mark-of-the-Web Bypass
    - NTFS ADS
    PID:1408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=6320,i,3523922470909990998,11092295875109550242,2097152 --field-trial-handle=2080,i,5017152728844543798,12064563798610773682,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:1
    3⤵
    PID:5016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=4292,i,4621852425930083168,16787426694618032255,2097152 --field-trial-handle=2080,i,5017152728844543798,12064563798610773682,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:1
    3⤵
    PID:3380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4880,i,9637315402248469019,7052112148812747797,524288 --field-trial-handle=2080,i,5017152728844543798,12064563798610773682,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:14
    3⤵
    - Subvert Trust Controls: Mark-of-the-Web Bypass
    - NTFS ADS
    PID:1872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4516,i,16004191276615893036,12442221262414520161,524288 --field-trial-handle=2080,i,5017152728844543798,12064563798610773682,262144 --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:14
    3⤵
    PID:4428
- - C:\Users\Admin\Downloads\windowsdesktop-runtime-9.0.20-win-x64 (1).exe
    "C:\Users\Admin\Downloads\windowsdesktop-runtime-9.0.20-win-x64 (1).exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3280
  - - C:\Windows\Temp\{CA6E5E55-3D89-40FA-B930-CD132562EE40}\.cr\windowsdesktop-runtime-9.0.20-win-x64 (1).exe
      "C:\Windows\Temp\{CA6E5E55-3D89-40FA-B930-CD132562EE40}\.cr\windowsdesktop-runtime-9.0.20-win-x64 (1).exe" -burn.clean.room="C:\Users\Admin\Downloads\windowsdesktop-runtime-9.0.20-win-x64 (1).exe" -burn.filehandle.attached=696 -burn.filehandle.self=724
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      PID:712
    - - C:\Windows\Temp\{6436A195-AAF2-4563-BD68-5C6C4E3A2059}\.be\windowsdesktop-runtime-9.0.20-win-x64.exe
        
        "C:\Windows\Temp\{6436A195-AAF2-4563-BD68-5C6C4E3A2059}\.be\windowsdesktop-runtime-9.0.20-win-x64.exe" -q -burn.elevated BurnPipe.{7ECAA1CF-0104-4460-AEA2-0AB954F7E8E7} {9E449613-3658-4ACA-89A2-757DFBBF8CD1} 712
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:2472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7648,i,4866366331769656963,7842126620601138887,524288 --field-trial-handle=2080,i,5017152728844543798,12064563798610773682,262144 --variations-seed-version --mojo-platform-channel-handle=7316 /prefetch:14
    3⤵
    PID:3504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7872,i,1290228493494363839,12624130673229262342,524288 --field-trial-handle=2080,i,5017152728844543798,12064563798610773682,262144 --variations-seed-version --mojo-platform-channel-handle=7300 /prefetch:14
    3⤵
    PID:3904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7632,i,13335539968644052929,29303307718661523,524288 --field-trial-handle=2080,i,5017152728844543798,12064563798610773682,262144 --variations-seed-version --mojo-platform-channel-handle=7684 /prefetch:14
    3⤵
    PID:4008

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2588

C:\ProgramData\Package Cache\{606b692c-f1ce-431c-a36b-8904b772ffc0}\windowsdesktop-runtime-9.0.20-win-x64.exe
"C:\ProgramData\Package Cache\{606b692c-f1ce-431c-a36b-8904b772ffc0}\windowsdesktop-runtime-9.0.20-win-x64.exe" /burn.runonce
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1888
- C:\ProgramData\Package Cache\{606b692c-f1ce-431c-a36b-8904b772ffc0}\windowsdesktop-runtime-9.0.20-win-x64.exe
  "C:\ProgramData\Package Cache\{606b692c-f1ce-431c-a36b-8904b772ffc0}\windowsdesktop-runtime-9.0.20-win-x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_9.0.20_(x64)_20260924022817.log"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:504
- - C:\ProgramData\Package Cache\{606b692c-f1ce-431c-a36b-8904b772ffc0}\windowsdesktop-runtime-9.0.20-win-x64.exe
    "C:\ProgramData\Package Cache\{606b692c-f1ce-431c-a36b-8904b772ffc0}\windowsdesktop-runtime-9.0.20-win-x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{606b692c-f1ce-431c-a36b-8904b772ffc0}\windowsdesktop-runtime-9.0.20-win-x64.exe" -burn.filehandle.attached=552 -burn.filehandle.self=568 /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_9.0.20_(x64)_20260924022817.log"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:4884

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1884
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 97AF137DEB90C58F1D17D4FB5B34C976
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1128
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding D1E5E56CA3525F3B3B8822A8BA9BA3A5
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1016
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 7DE46106EEA5C73190F172B619F5AF4B
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1184
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding FC8FC47F485F40D0ACBD968CA6FA215F
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1408

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4548

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Enumerates connected drives
- Modifies data under HKEY_USERS
PID:5052
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3956
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 832 2504 920 816 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2472
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 832 2788 2776 816 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2696

C:\Users\Admin\AppData\Local\Temp\NL-X.exe
"C:\Users\Admin\AppData\Local\Temp\NL-X.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:4048

C:\Windows\System32\DataExchangeHost.exe
C:\Windows\System32\DataExchangeHost.exe -Embedding
1⤵
PID:8160

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e59a89d.rbs

Path C:\Config.Msi\e59a89d.rbs
Size 48KB
SHA256 55977a56dbd4b93113e497b43eaeb05712caf517a06c268da6e6be559c676818
MD5 a3032fc795b0b2de1bdd3676325a2963
SHA1 b2830bdef584945ee5af08bbf1b8d54c29c9c963
SHA512 7e7664ad43a52350d4dbda04bfe43cc11c05f50875c13cc16008ffe088ed8356d0d9e878187d30d0a0daa56c8d31b34d843221b2e1ee0e3e1d4e7f89c1e09606
SSDEEP 1536:kBJERjMQKkgtDMTJu/0T0ZtwF4oP6o+5EimccWN6JgY5LSQrhYFMuRAWM5vUac8g:bKdx8r4
TLSH
T19023D054DF05C1D3F2363E6063D2FA0933B98F8D160896AD57CEC2149B92DEE5E598C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59a8a2.rbs

Path C:\Config.Msi\e59a8a2.rbs
Size 9KB
SHA256 e58b7924142cac4273bf22d0ea930c0135b736c5ceec2e427fe5115048713a99
MD5 68f854735c41c092433eec6e0a89798d
SHA1 0d6ed9def0af20058d31be33a0ead5f3da0e1422
SHA512 4e6701f18789360d2df8296bd0847d62f92e9bdcf16032509777a1729376cee75e4695487f1684ff953b4a70f0ba7b3ab360794ea68287eb15644f6d99ba1451
SSDEEP 96:3mze91tOaMLnrXzuC+ElujIuMRUYeD2edjCsTl4UYeD2edjC6jfbudu/Y9TlGY5E:WSNOaMraCjKLd+IhLd+dnEpxMphyikp9
TLSH
T18812FC43B64085E2E9A22B70C7071B203773E3DA9200979B08DE85305F6FB9E1E6D6DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59a8a7.rbs

Path C:\Config.Msi\e59a8a7.rbs
Size 10KB
SHA256 bb1ded12333bfde431a30eeb1341060aa2fd1a04557a02997dcd6d8fe9edb200
MD5 f9eefbb2c9d73fa3771c813a89d1b1e7
SHA1 7b5934b2b87a40517e9d1c4d69a78d12b1626e17
SHA512 d5825bfa4410ef8766b59b4a6945a3c8ac4f5d80675f7bb9a16dd0ef3c4567772cf1a340bebfa985c0441044c0eba61bba37a2e5ca3be43d48642056c8a0b3b7
SSDEEP 192:bCRs6v6jge6C6lr5HLeae9CPqEKchACqd+IP2chACqd+tL9wPXbEx+71xPuneYlh:bCRs6v6jge6C6lr5HCaOchACqdF2chAA
TLSH
T1B822FE47778091F3EDA21B78D7472B213B67D3EB4641974B08BDD1209F4738A8AA829D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59a8ae.rbs

Path C:\Config.Msi\e59a8ae.rbs
Size 88KB
SHA256 8abe94b5ff20299729fb8acdff696a057a52ac40b12704f2cd5a4682362e2c76
MD5 c28caaaa7b75b3c2cf98d5db926115b6
SHA1 d5b8e02c4bec3c3ddf59a63303eeaa9a88525646
SHA512 f89b9e46268a48ad55a90521362a02f74086f3a384a7e10c7b97eade0c6fcddb858177448744318d691f42ff71fbd66e51cbe1e73eabd6e04fba7bc5fe6172d3
SSDEEP 1536:XkIXEDxoWpWCuVCb1MHTC/WkZev64iQbdvTutsN3XKj1YdlSXHNYtws3JrRVL15Z:Hodekf0DMi+ejSHXKACtj5XuSCTEY1SF
TLSH
T1B593ED5A9B00C3DA9C333944872FE64C6E054D6B538959BE17C69237DB92BA71FBC0C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ThirdPartyNotices.txt

Path C:\Program Files\dotnet\ThirdPartyNotices.txt
Size 77KB
SHA256 e8ddd95ac905467e4e519b446ca023fa00c31732bebd9b66e65101c712092ee7
MD5 406d07d20e58568365df0557629fadc6
SHA1 9ab5ba1ef3866afa75b8cf3c392b7dd3d7f52026
SHA512 c6025a947faa5dc2b41a14d75e228ca2bd0df094e8cef914c58a6d2f5854424972a647b2c8ca8173345e40ba7557843d03efa85c5098c6e0e6726377efc8a38f
SSDEEP 1536:HA9jHwsGfgg39/zwgAVkguQxrDjugtSEGepkWvrpX7anuqdLSVnfiStPq+3Lefrb:HA97w/ogz1AVxuMjHtSFULryLOgrGWwa
TLSH
T1F573A45F7E45077319E2C3916569A8C5F22FA02E3B6B2A44346EF248133B42DD6FF858
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

state.rsm

Path C:\ProgramData\Package Cache\{606b692c-f1ce-431c-a36b-8904b772ffc0}\state.rsm
Size 940B
SHA256 b1e96ea3a73ab97a8ba3625860a1bcb24b751d24a40cc5e0506472ab992b56bd
MD5 d5e27f15fde2da490316a4806cfae52f
SHA1 2315886c77df49684736861df86c12bb8c68f5fa
SHA512 6b13b1f9c6a4e2f5f93cb4805c070eb68e19776758d14e6807f61522fb8b002d90ea683e36f499cc98ddbe0fa99d17bc2f277b2408fadfdcfb9cc829eede3824
TLSH
T17A119A515FFA0529E3F6AB3469F42752643ABC120D32C16C0041328A8F31BA0C874F77
MD5 SHA1 SHA512 TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 1024KB
SHA256 72d46989a95bf72ba8dd6bd7c103ed98f260bc4cd752291ffe0fe22ebe19ab9f
MD5 60b4b0010bde0a90da634b59e1cb3907
SHA1 cc222b898cc2c0a26787374e6d4beb3f730138c1
SHA512 fd728fee89e141a7515870d1f29e536b5420651941b86a563f1295b15306d28e8bce82285f7940c352d628f7ed9d42f20d2edad22cbf26376d8f5602ca287a88
SSDEEP 12:sf9iXhV0xosfxCe+JKlkQuMRxCb8TXuYJ0IJpPK6BsyW1inPiz:U9iRqxosfxWMk8xVTeYWI31BtXP
TLSH
T136254C85B34494FFC8835E7189BD27903774F6DF1F02966B6A77760E2E271C84B44224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c159157b0e79e7b46a891e8afe68807c4e711f82964d04b80dcddf1d39eda259
MD5 94dc53892052e6d2db9f8b5550a4b43b
SHA1 29ebe8501640ce4b863ac0649c205fa162e24128
SHA512 5e174dd65b7b3514eefe1aeddfedb95e15f93bea92c1841942e97f8d717b896b0064539e74f7bb947e9e6a169d4427e3dfb7aea428ac47f5f7ef07fce464f22e
TLSH
T16DD08014C9FABAF6D03B257D02354705719C955365431305E0810D550D562C706E1EF1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f03ecd3ece98ae7c02c56807236cba972a913fbc4f1f463843e7e76a213a3b58
MD5 5b2770fb705fb9354d56e7d4924fb963
SHA1 afdc0e48033c22fbe5ec8f6a29aa8902fa61fffc
SHA512 777e7259c18bc9b92f1e9b9c8f134aa7ed24e29741601440ad38833e0b30ed2c5d6b5ece22a8be103d4847ae1884d7294147a081993a150bf5cc2ab67a045353
TLSH
T128D02228E3F3B0A3C03F2BB220AE8B0C8228C02320C30B00E0020C802C8322E02C32E0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 69b9be3038d31cc05ddb5cc15fd12662ac61da03c3c565072f834b6bf6b17ce3
MD5 28e76c95a0cceb6357ec3c375dcfe534
SHA1 3ba5e37074e1d7f34d7601c04e7904e1a43221c7
SHA512 2f8f1d4f670d66fe9c731ba9d9c26a9ae78e70468b08912f957b2f38020b7a951b6b75dd3a5201f8cc072715c8e540dc1890687ac8f3bee837184b2768c63272
TLSH
T1FDD02414D3F37453C43F1771105C470C4114C01310C34700D0010C400C4315D01C31D0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a65f49809eebcda07c799c4192312fc04596db5eab7e50d679525c49cd91d256
MD5 e1366ba11d6d35c5a0464732ae17a68e
SHA1 466dbc1228628208cd3ada8774270a9bcb97caca
SHA512 ab3186f66807d4fc52a9fd4f11af03eb83d1a25221f741ebe93c377f79a195573a037f77c83c959b2dccd6c11d68911624f3f4876cd219e52c892b487d2fd2bd
TLSH
T149717FC074E0D2BCEFB0697CA4F130A7BB347A8537931F91C698D73964A638425CC288
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59b7dc.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59b7dc.TMP
Size 3KB
SHA256 5ac1e795d2f3aa43c9c6b0dbb9d3d3f760de31cac06d09c53f3c522e6c88ace9
MD5 c9ef70f44055e18f7e69d3ddfe209830
SHA1 aa7d421a5a47494026b8668e2bd0d4347867db61
SHA512 28d723abca36ebc62004b4dc17949887dec112827af827e64d61361a42f16723ccc6c76848ecca5acc4619e17b044edc637d03ff35acaad4412f35e73a3035f3
TLSH
T13A616EC035E0D2BCDBB0687C95F17067BB34BA9136835F91C6D8D73A64A639575DC280
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 405913a18036eafe5dae18b96660df3cb25e8f136f3f15e6c74b3bd7d6e27a86
MD5 2143628b23a681003558974d0c13aa7f
SHA1 0df85bd2662b1006f1124156f81c35536e4a8aa7
SHA512 5fe96c6f7b12e877b278463644210d91419c0629da2439aecab162a661ec91d53da75fdafca96ae0f6db7dd9b36545576157d11e81ec0614240500271f29dd14
SSDEEP 3:MsEllllkEthXllkl2zEkl9:/M/xT02zn
TLSH
T1D5440404FFC00405C7C134347111C7501370F41C0511574374530513DCD7DC40C10004
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\Temp\scoped_dir4572_2016522344\CRX_INSTALL\_metadata\verified_contents.json
Size 1KB
SHA256 d23b2ba94ba22bbb681e6362ae5870acd8a3280fa9e7241b86a9e12982968947
MD5 738e757b92939b24cdbbd0efc2601315
SHA1 77058cbafa625aafbea867052136c11ad3332143
SHA512 dca3e12dd5a9f1802db6d11b009fce2b787e79b9f730094367c9f26d1d87af1ea072ff5b10888648fb1231dd83475cf45594bb0c9915b655ee363a3127a5ffc2
TLSH
T12B317466C8683D56267A63348E2D0602EB57C2BB0050640EB5AC558D4F7115FE242FAF
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\Temp\scoped_dir4572_2016522344\CRX_INSTALL\manifest.json
Size 962B
SHA256 5694c91f7d165c6f25daf0825c18b373b0a81ea122c89da60438cd487455fd6a
MD5 e805e9e69fd6ecdca65136957b1fb3be
SHA1 2356f60884130c86a45d4b232a26062c7830e622
SHA512 049662ef470d2b9e030a06006894041ae6f787449e4ab1fbf4959adcb88c6bb87a957490212697815bb3627763c01b7b243cf4e3c4620173a95795884d998a75
TLSH
T1661121366E2FC4260AE00698DC51308AF92453ADD380850E35BCE42E5B744FA430631E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 530ebeb32c11d7c5e61567345c972719ec2f69b25b974df15fb490123ca040bd
MD5 8bd35ecb0ed1393ed9e28eb3a908bf87
SHA1 d36e8803a8a22194d8495df931974e311688163c
SHA512 f57a3c3fdf9fc867670b59830fabcac5d60481858ff89df928cff75f52fa4a6acfd0e01e07cced6d472c4efc77b010a5f55f742b8ee4be7ea2f6850b96c97a08
TLSH
T184719CF787B4856E8A1196F0AA18EE2FDF2C0215431C3C6989D4EE27D3E3472E00265B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 4e1e38907d64e97065721bb9b3d55a3f202a158fc9a55c490b4c81a4f8eadc31
MD5 1de336ee6bca7a277f466b4451e0a24a
SHA1 542aaee6fcaaedcc18f9d3f48631327c02e2ffdc
SHA512 b7e02d779b06b7c083c4ef96c381739a7e814e2f0b43861cbf1fb61180a55dcd57826342d994d16b2f74f4696dab83f5f083f8a9c5581157420841b6bbd712d4
SSDEEP 192:sxZzVR9T//fUs1auAEIdpfn/W6+WNrKE/ADrA0tRWimAIg4J:sxZzVf//fUsUbf/bH/4thc
TLSH
T13232C9567E34AD3B4CC7E219BA25BF13E6F91032A5D15E48AAFCC61C04E76DD220781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 73409aec28f1e0d958d9ff351e8011b6bfdb3690deb3e9016f70b58ad9fe81e9
MD5 c6eb759ae2278ca297c543756cf96524
SHA1 e20bd2d446b30213baa79464c8f897ece4dab05b
SHA512 66698528432020c0f811a9b7e07273393d5d2470c8a3807289444f4e732c75010f05dfdb8d215de20ec12213b14a8b1663d89c44a4318679a90733cdc5b4bb85
SSDEEP 192:sxZzVRpT//fUsQtWpVXCuA+dpfn/W6+WN12KE/a6eDrA0RRTiUrWIgbSJ:sxZzVT//fUsQWvysf/ba/sGUyK
TLSH
T10D42D956BD346D7B8CC7D619BA25BF13E2F91032A5D11E44AAFCCA1C11E76DD220381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 9afb2a8e8855fb3e3ad0afe61cc0a322852c41db37f2f806a76482a29017ddb1
MD5 a3b3f31934fcf774d30839b12137151e
SHA1 08515b7d010c7037f25021991b5320dcd201dc9f
SHA512 463035d3dcf3ab4e463c4c179f7147d0943f82699c534d423339796c54657b70577c1249d6f1cbaafcf099c8fcf922c82402b82b0b92ee5c0a83aac2a113ea43
SSDEEP 192:sxZzVR9T//fUsQSCuAXdpfn/W6+WNrKE/a6eDrA0tRsimAIg5SJ:sxZzVf//fUsMlf/bH/sHhk
TLSH
T11132C956BD346D3B4CCBE519BA25BF13E2F91032A5D11E48AAFCCA1C11E76DD620381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 473ab9cac014120f26596b23cd8e47e91262f315f29be8173533724595d4ded1
MD5 e9496b8d5a7eb31a7fe823c6c08ed398
SHA1 104ada87e22e3c16c4d06fad81b5a93b6c75347b
SHA512 d0e0a1092da5838a74cc4618382b6237e7084f280a74774bb15a3b7149a1afc49431c132f13296136aacf306cc106dd4a384fdba5db736061d8d63a4487dc24e
SSDEEP 192:sxZzVR9T//fUsQauAXdpfn/W6+WNrKE/a6eDrA0tRWimAIg58J:sxZzVf//fUszlf/bH/sthq
TLSH
T1CE32C856BE346D7B4CCBD219BA25BF13E6F91032A5D11E48AAFCC61C10E76DD220781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 33KB
SHA256 2f1b6195e1c1d20f17644a941dfc7a9825fdccbfd5d922e9d613b487f2bd39e9
MD5 16884e7af74970686a70880d432c60d6
SHA1 4f7b9736adee0fdd0d05dab4f18c42638007d7aa
SHA512 ca1d3bb712a2494a21914264031993e40de24ac1344321b971c6da6beb0487573f29a8fad4b34d38cb68a52aa422187eae6a7b2aa99e512495f398948535e682
SSDEEP 768:cvWwy89q2nk7pLuLbJdWRm1rQ/78F1+UoAYDCx9Tuqh0VfUC9xbog/OV3/wNQLle:cvWwy89q2noEbJdWRm1rQ/7u1jaK/wNJ
TLSH
T195F2EA3B780CCA7E4FC04A9DDD167F9B6EA802CB95988D4087F9845C02D77EA51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 87424b8554c7aa83be0d84e31a22fa07ed52dfbf7300d359f3caf22523730b77
MD5 dbcaf98258d0d55e2ea954886514d5e1
SHA1 79d0a52c90d2b3584c34684d816b390ee2bf4c4a
SHA512 b86643ef232dc460c62e56eaafbe73b66565380fbc09901e68190a1bc9e25f41a183495f0ea0faaddb84742b1e42614949d215e58769d12770fa5c74ce2db502
SSDEEP 384:nJZcI28NeOl8VpsH7RFfs1tx/O0/upa7dLKkeaok:B2Tok1tFO0Sa7dLKkean
TLSH
T1C3828DB15CB99C764CFBE505F4063A53EFF45073AAC45F88D5EAAB1E01C62C8270782A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 4c6c74d4305535d9b716f0eef66abc8e0c013ae7bcd28c0c81483cb385c6efa6
MD5 f2ae5e6206086e89b96c091e5adc10aa
SHA1 96eaa4edd12027cc0cae84ab921fbf048a7d5b69
SHA512 da2922171eb021a6aa3a2e6bc445f415d3cadbb7927209a243242ff3384ff591f26f39257e024e995cd209e0c2898c6d075a86df1c53c3cf2edc54b80ddb14b0
SSDEEP 384:nJZcI18NeOl8VpsH7aFfs1tx/O0/upa7dLKkeaok:B1Tpk1tFO0Sa7dLKkean
TLSH
T1A5828DB15CB99C764CFBE505F4063A53EFF85063AAC45F88D5E9AB1E01D62C8270782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 8c67f3498226c1c2c7f1ebe205b28cfae8c9ad6b7ddd2c7f82f9b0cf775279ce
MD5 dc8d86f8e4b63c47033490d43db6d9e5
SHA1 52a3a5390169d5730a2542a2e18baa3053c702a5
SHA512 a256761a0b7a607bb129b67122b23ae670fca3fb72f7907cdb57ab8d943031c180f60f12629cf4f708cb99389a0d43d55bb7156d72a5d025e4d2df1a5c22eb8f
SSDEEP 384:nNMZcIh8Nnll8VpsH7xVUfs1txUy3/Ot6F9fqR0/upa7dLKkeaok:EhLqUk1tWymtA9fqR0Sa7dLKkean
TLSH
T1CFB23ABD4C649C3E48FFB704B50E3923AEB84137E6B45A98C3E96B0EC175598F702816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f27fe388c5997b50d742f3930105d4085ce07258dffc3ba250c92c084a830bf8
MD5 7c59ae80fea257a5a55f8497625b207d
SHA1 b261494c6c25efcf48469806cad4d3ac48c519ac
SHA512 733ea3cd9e758b6789fc466d151649556fb7afb5310d56e7bb7aabb549ac758485e2bd2f566a5ffaeb724903f29a803901d4ec6ed9fb8d344d80c0e02c531a30
SSDEEP 96:DqGNk/Qsjpf4eEE325ih/cIPURHl8h4otop5cu1iDBmB3PnvQixdZuP7inyib3tA:GGNf6GeLQmiUyZEc/9e78f0/T3RU6
TLSH
T1E302EB34A8B86C7B8EE3DE55B5463613AFE01027D6942F44DAF41F1C01D769C2303836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 74f7cb644d05ebcd8835884e5e5c072da83dbd4a64b5c964e9dbd0542baf1c61
MD5 8f363ce83797ecf37356896502827e5b
SHA1 7518292546650c28b4d8a72d397d3b7c9885ad3f
SHA512 d618af9ca4c1c481245bf3d26081e18fd33528d4703c03e2f39addfc0a148eb347520f42e3c3a5a1f278dd239ddc30d92bb3fb5c70c5166242a91dab23908f53
SSDEEP 384:nNdZcIJ8Nell8VpsH7EFfs1txUO0/upa7dLKkeaok:nJc7k1tSO0Sa7dLKkean
TLSH
T1E4828CB15CB99C764CFBE505F4063A53EFF85063AAC45F88D5F9AB1E01C62C8270782A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7890ac31d653529e3fe5a6d1f64fc5437463f616cb5386af2dbe1db184024d3c
MD5 29ee45545a6f927a9fdcbe3902e06d93
SHA1 c5d261ed5cae621462d4e4b1c7c6e5446ea29bdc
SHA512 f10f1d9eaa7a7f93f79935877f0c0a17d3a7047db6e558787395a6ea8d8d1d23ff7a8b5ed36f069505ba324f445e45fa6dcd11e32cb0aaef2637a225dca4107a
SSDEEP 96:DqGNkPQsjpf4eEEQ25ih/cIPURHl8h4otop5cuqDBmBdPnvQixdZuP7inyib3txb:GGNn6Ge8QmiUyYc99e78tx0wET1/bQU6
TLSH
T1FA122A74A8A9AC3B4DD7E855F08736A3EEA01077EE846F44D6F56B1C00DB28C2707427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 5932dbb74640524ac89aa8fee0ca0064c9fabf91e8c73b6a5526ad701bed1094
MD5 4cc5f487602a87779105e860fd6387f9
SHA1 a3e441a13159f5acba752db8915688c7eea041a0
SHA512 ff8782845e1ec282c2e3bc7a5afa9d76a48ed2807029753f905db41478dc2abf53f5e8d9ffcee02ad0433249cac66290a1d58aa58366ae4b1a232f502801e8e6
SSDEEP 384:nNpZcIJ8Nell8VpsH7EFfs1txUO0/upa7dLKkeaok:XJc7k1tSO0Sa7dLKkean
TLSH
T11D828CB15CB99C764CFBE505F4063A53EFF85067AAC45F88D5F9AB1E01C62C8270782A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bec26cbd-f820-4204-a115-c6c89e69f1fa.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\bec26cbd-f820-4204-a115-c6c89e69f1fa.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

494d7bae-4272-42ee-9aed-6bdec2576fb0.tmp

Path C:\Users\Admin\AppData\Local\Temp\494d7bae-4272-42ee-9aed-6bdec2576fb0.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

58591bf5-e752-46b8-8f0c-392920889d84.tmp

Path C:\Users\Admin\AppData\Local\Temp\58591bf5-e752-46b8-8f0c-392920889d84.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

Microsoft_Windows_Desktop_Runtime_-_9.0.20_(x64)_20260924022817_000_dotnet_runtime_9.0.20_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_9.0.20_(x64)_20260924022817_000_dotnet_runtime_9.0.20_win_x64.msi.log
Size 3KB
SHA256 a3c4e4290d2c91d0b9ff89627129edeae897f94869045d057e4c447e587f7289
MD5 3a6eba236859841a3d6a2ba500d912e1
SHA1 497683650af13afdbef426fe5de6baf3d8b9f747
SHA512 db203f5ddd4714c9dd221c4f7966e7bf47fcc0e206de820af0d241229e57bff2c4ffb5d71c5d336cdfb5bd973465471b27eb3d8121e4b3d65443979c05c92c04
TLSH
T15E81FF1E1AD90D4BB2B39747DEF3C4126633FDD66870CB0D12C5861A4667C01686CBFA
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_9.0.20_(x64)_20260924022817_001_dotnet_hostfxr_9.0.20_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_9.0.20_(x64)_20260924022817_001_dotnet_hostfxr_9.0.20_win_x64.msi.log
Size 4KB
SHA256 8fd0dde6597b6f22df3b478d5055fc528a6c0d3e446b850eb617cc8d8a53d520
MD5 95cf20b49de5edaa539dbb464d482702
SHA1 59142c3c3b4a993ac1f0c26aad1867eac7fa759b
SHA512 4689a3fcaba51d3d1f4008eb491bd3b8cc4403104355e5ae60de909d93224fbbfcf1a4f0a3740dda357a5231ce6f575941cc8ccadeb1b2803ae4d457097dffa0
SSDEEP 96:YD+R52KyadpZpOOlKt1oUfHP0ipZTPiI4sIDpZfsCHrfKFMGu:GOBeO27j9qtKFK
TLSH
T14D81FC6A1EE50905F1B39607DEF3C4525A33FDD2A9748F0C23C9831A42A7806787CBB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_9.0.20_(x64)_20260924022817_002_dotnet_host_9.0.20_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_9.0.20_(x64)_20260924022817_002_dotnet_host_9.0.20_win_x64.msi.log
Size 2KB
SHA256 6d3c8f62840813415bdb585c9719bfbcc46ce707f23074bc9d4a6615b4b1422a
MD5 85aae38b5fb7e60fa011a935e500fe3f
SHA1 ebb0c37528d335c8efc439075febe31f9da9b92e
SHA512 68c7f58165930a098d9bb1fca64c89de22ec609ec320bf1e30560e83a204c38b9dfbeafa36dcc5dfa02ec65df399e2b2cd8e34a70765c8df16ccc774196dc2f5
TLSH
T19C41DF1A1AE50849B1F69747DAF3C0631A33BDCB6974DF0C62C843590667902787CBB6
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4572_1619600657\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a2533595-c594-4a9d-b37a-c95bbb6acbdc.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4572_1851432729\a2533595-c594-4a9d-b37a-c95bbb6acbdc.tmp
Size 157KB
SHA256 e03138d37406c2bedec93e5a7c44a457a6b19cf4fee5dfe5a46450fcea1bf85e
MD5 088d09e1a5cd1db2f55a4f5131b75b3b
SHA1 4e017079555c92f2f9419a53ab89aae7c5425550
SHA512 f8e7a1652d20778af9e0aefef0f24bb477260eefd5c6cecd3b4e17276b7d6c8d79554e850b9a9fdd9c65095ae16dad8868df304ee7a057ec7cea5a35b9e526ad
SSDEEP 3072:sA30KAb7L7nAnBPxnb8b4HpQgHY15vClaH4d6r1tx:sAkKAb7L0Qb4HpQgoq8tx
TLSH
T182F3E1AD2FEE891ACD0B50BD3B04B38BC90A8F07820A655F735F8015997475D17A2DFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windowsdesktop-runtime-9.0.20-win-x64 (1).exe.crdownload

Path C:\Users\Admin\Downloads\windowsdesktop-runtime-9.0.20-win-x64 (1).exe.crdownload
Size 58.0MB
SHA256 56ca2926e797c3d124e13766f84d4f3b75a0d86b0d877e384cda52fdd027e431
MD5 e594016de49dd340824dd6eb8b846b70
SHA1 56e219c7fdbd441194e833401341dec3a3ff4a15
SHA512 5c7caacef8bd65a7631ff0be6cd1059b523eb9ab4e1021078921926da0bdc05b468bcbdf1f95fc12cb984bc4e97df9fbc40f942a618c716902c7c99150c4de7e
SSDEEP 786432:G9+FbeXmnoP7qpJvbbo9G7dWeOPumiMh4U10tKzvOQLOzjsIGeCj6BO4QL8:++Fbe2A7YomWeWutMh4UuKrOsz1r4G8
TLSH
T1B3D733F194444766F1F52233AC50BA242D58B2301B618C77D3D8EDE91FBA18727FBA62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windowsdesktop-runtime-9.0.20-win-x64.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\windowsdesktop-runtime-9.0.20-win-x64.exe:Zone.Identifier
Size 185B
SHA256 649c0f8951261b6426a7c008f5e8c02ab05816504326b8f87b44fbb0df0d4b06
MD5 17c827f97b35b1dc7b4a120b7069e6c3
SHA1 54432424c88c849c079bcdb596e51dbf51e12f93
SHA512 1c3d3405dc8016b0556c61d017f896786ec3c5d095418117535318f43f419d7e0bfc0ba9bd3d6a74a324c2c96aaa8c8631201ae5fcb8b9bd08c2febb1116f31e
TLSH
T1D0C0125BC40045420E3022864B6ED668EA0F1D524D81D3DC8CC5C092EA53DDAC191891
MD5 SHA1 SHA512 TLSH

Submit Download

MSIAB0B.tmp

Path C:\Windows\Installer\MSIAB0B.tmp
Size 219KB
SHA256 2bf33a9b9980e44d21d48f04cc6ac4eed4c68f207bd5990b7d3254a310b944ae
MD5 928f4b0fc68501395f93ad524a36148c
SHA1 084590b18957ca45b4a0d4576d1cc72966c3ea10
SHA512 7f2163f651693f9b73a67e90b5c820af060a23502667a5c32c3beb2d6b043f5459f22d61072a744089d622c05502d80f7485e0f86eb6d565ff711d5680512372
SSDEEP 3072:FVzl3qiEZybztEwiUx6D02cWVsV1v2vZR3X6j7zo6k2FkngTLrOrORT9flQnS6lg:FVIMEgXmEAR3oHon2VaFuG0eEp
TLSH
T1AF248D217494947EEAFA0832A57EDA71BF3DF2241760C8AEC3409D1E6D604C167B7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bg.png

Path C:\Windows\Temp\{6436A195-AAF2-4563-BD68-5C6C4E3A2059}\.ba\bg.png
Size 4KB
SHA256 9095bf7b6baa0107b40a4a6d727215be077133a190f4ca9bd89a176842141e79
MD5 9eb0320dfbf2bd541e6a55c01ddc9f20
SHA1 eb282a66d29594346531b1ff886d455e1dcd6d99
SHA512 9ada3a1757a493fbb004bd767fab8f77430af69d71479f340b8b8ede904cc94cd733700db593a4a2d2e1184c0081fd0648318d867128e1cb461021314990931d
SSDEEP 48:u+Xg+NXWbdlIr33lx9W5OstaDIy3r5XpPyvZKmXYTDeiByNxcaaaaaaaaaaaaaaE:AaXWPIrHT932JsdpPyjqDeioatEn
TLSH
T19891B4D8FCF95322C6002BF255F4C0735A0215B713ABFEC82F496BD90E6878E25058B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixstdba.dll

Path C:\Windows\Temp\{6436A195-AAF2-4563-BD68-5C6C4E3A2059}\.ba\wixstdba.dll
Size 190KB
SHA256 dcea15f3710822ffc262e62ec04cc7bbbf0f33f5d1a853609fbfb65cb6a45640
MD5 f1919c6bd85d7a78a70c228a5b227fbe
SHA1 71647ebf4e7bed3bc1663d520419ac550fe630ff
SHA512 c7ff9b19c9bf320454a240c6abbc382950176a6befce05ea73150eeb0085d0b6ed5b65b2dcb4b04621ef9cca1d5c4e59c6682b9c85d1d5845e5ce3e5eedfd2eb
SSDEEP 3072:sjEoXsLW9OLG8Qp51ySdjDXY33b+Av7O5IkI+/AYkPAEc527uu3k/gLtxavf0ir2:sjEo8LW9553hXWy15I2YrAW7FUVEihs3
TLSH
T1FF14AF1176D0A07AEBFB16307A39A5216E7DBA200FA0C9DF63449D2B1D715C19B36B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet_host_9.0.20_win_x64.msi

Path C:\Windows\Temp\{6436A195-AAF2-4563-BD68-5C6C4E3A2059}\dotnet_host_9.0.20_win_x64.msi
Size 704KB
SHA256 88ec16f3fb6a45b3e82e36795e35bb9c89644fb46b9c1e95d335951357142b09
MD5 4aa1694477eb8fe2cb9fec208fa4146e
SHA1 a729613b7ddf6deecacec0b3e05beec1e3fe1769
SHA512 390cb584a539eb4177c37307e373cb6de23286dcdaa8b3302d8ca5006e5a07bbcb157e0fb3833861c857ee5a6781685bd714589650c6d25d8b5cc669d42b0f27
SSDEEP 12288:e7kV1EgXmEI3os2Qx7E4D4Rxbp4K+1uiq:lXdc3/7Rin+s
TLSH
T15DE49D137D80803AD9AA0D71853ED7B16F3DBD204A64889B6380B91DDDF15C0AF76BE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet_hostfxr_9.0.20_win_x64.msi

Path C:\Windows\Temp\{6436A195-AAF2-4563-BD68-5C6C4E3A2059}\dotnet_hostfxr_9.0.20_win_x64.msi
Size 776KB
SHA256 b61540c1f1e49ced56f47f04b9e8c9baf75f33ed4800340fe77143cb85e52f7d
MD5 f24190f4983154614831138462bd7d2c
SHA1 1c17bac7eb4eede6d751ed8afaabec9ec0679694
SHA512 ad28550add48cd8b4bb26f258aa2ca6e390093b1ffeeee04e7b78cf788b3de29a34fbd5bbaa024c8f400cab6514c6124006944ff1d0592cb0be0312acbb0f31d
SSDEEP 12288:6MIGmZ9agmn6xdOnV1EgXmEI3os2Qx7E4D4Rxbp4K+1uiqw:6M4agmu0Xdc3/7Rin+s
TLSH
T176F4AE137D80803AD9BA1D719539D7B16F3EBD204A64889B6380B91DDDF11C0AF36BE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet_runtime_9.0.20_win_x64.msi

Path C:\Windows\Temp\{6436A195-AAF2-4563-BD68-5C6C4E3A2059}\dotnet_runtime_9.0.20_win_x64.msi
Size 27.5MB
SHA256 7b8dbda6cebf72180551a99dfd37ef1a562b79b2b7762cb0adbc4e8ef95db311
MD5 f8d1445be4087f67929abd7df46f330f
SHA1 811b89b59d46281fdac039f4f90a3beb3f3efbaf
SHA512 9e35254ae19d3e331e1d1a7f4bdd45670413810f8a8f1c350c92cfd9e6b80f528aa27b4671d7bc03530f5df019488fd64ae10c4add9bf04198db4b189f001a1f
SSDEEP 393216:DMh+WuYMtdeJ3bqvgg+RBaxP0oqoq1KLTWuVY3bv4duSux4eYh9r6BpYIPjVfH/e:DMFumuauJaC+tWeYh9rCjHRvM
TLSH
T1265733977CC28A76D0791E309175DB620F7DAE208A20C91773687D8DDEF11D08B786EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windowsdesktop_runtime_9.0.20_win_x64.msi

Path C:\Windows\Temp\{6436A195-AAF2-4563-BD68-5C6C4E3A2059}\windowsdesktop_runtime_9.0.20_win_x64.msi
Size 30.1MB
SHA256 2cabcced6e99d237ba50244bc0ec94fe8075caef12675eb1dc8ebb61617e8265
MD5 42cb5737173781b183a7aa3a85e3d518
SHA1 afa97ced9f3956c858f6daee3e8af99f37805d41
SHA512 4d1a4293f1fc7e452dcf9552a023485a5cc49843021f8670d8016bfd0497e772223070bc5bd5aee3e64f06cac193aaa5e5c2f78eb634202f6c11b67333f9e030
SSDEEP 393216:+j5xQGdrvF6kjt0PvwOe+pDyp3UBT1vGXO/2TevJfegMMa5DPyBksnoEFm+jcuJ6:+sGLDEvvyBYT1e+++QomPEntA1
TLSH
T1806733A37D83DA79E4EB1C7241B743251B3D6C244B55896B2322F97DCDF22C02E652E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{B17A4A7A-FD89-46A1-A41D-EF636839BD45}\.ba\1033\thm.wxl
Size 5KB
SHA256 81a68046b06e09385be8449373e7ceb9e79f7724c3cf11f0b18a4489a8d4926a
MD5 d5070cb3387a0a22b7046ae5ab53f371
SHA1 bc9da146a42bbf9496de059ac576869004702a97
SHA512 8fcf621fb9ce74725c3712e06e5b37b619145078491e828c6069e153359de3bd5486663b1fa6f3bcf1c994d5c556b9964ea1a1355100a634a6c700ef37d381e3
SSDEEP 96:MT0abTxmup/vrCKATQdYQHdYCwgoVOBq9LjP5dbSE7:OQNkdYQHdYCYXt7
TLSH
T1F1C1DBA778CF53C128731255EA925AAA5911C19C537F2DF4FC8B454B838A827A373F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windowsdesktop-runtime-9.0.20-win-x64 (1).exe

Path C:\Windows\Temp\{CA6E5E55-3D89-40FA-B930-CD132562EE40}\.cr\windowsdesktop-runtime-9.0.20-win-x64 (1).exe
Size 607KB
SHA256 76690f0347542d6cef5c43a7b4b08df8a9c8302a7df83887e828e0712d3a95de
MD5 2aa25cbaefc162dbaefd5382f5c8f56d
SHA1 fc4c0d4fd39c8cc16e3385ac0509c56f985145ab
SHA512 daba049a41b3a3c3764d93f99075d1c8c6bdb87ac52c5f2730e59df3172c855386c8f70bea52e9c4bba0a42b5a3febcc451b69912b48f55e6fb647938946dd16
SSDEEP 12288:kmEsd9PZfePv3xl7ft7V+6uC+zd5qLlu83wWDiy7nlEM0Dnmnf:km39PZfePv3r7fm6t+jqpV3bzCM0qf
TLSH
T1B2D47C32A5614032E7F106B3BD2896303E7CE328175488AAE7D4AD1D7EB84D667F7253
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2472-1498-0x0000028F6BB40000-0x0000028F6BB50000-memory.dmp

Download

memory/2472-1524-0x0000028F6BB40000-0x0000028F6BB50000-memory.dmp

Download

memory/2472-1555-0x0000028F6BB40000-0x0000028F6BB50000-memory.dmp

Download

memory/2472-1496-0x0000028F6BB40000-0x0000028F6BB50000-memory.dmp

Download

memory/2472-1497-0x0000028F6BB40000-0x0000028F6BB50000-memory.dmp

Download

memory/2472-1556-0x0000028F6BB40000-0x0000028F6BB50000-memory.dmp

Download

memory/2472-1500-0x0000028F6BB40000-0x0000028F6BB50000-memory.dmp

Download

memory/2472-1501-0x0000028F6BB40000-0x0000028F6BB50000-memory.dmp

Download

memory/2472-1499-0x0000028F6BB40000-0x0000028F6BB50000-memory.dmp

Download

memory/2472-1502-0x0000028F6BB40000-0x0000028F6BB50000-memory.dmp

Download

memory/2472-1505-0x0000028F6BB40000-0x0000028F6BB50000-memory.dmp

Download

memory/2472-1508-0x0000028F6BB40000-0x0000028F6BB50000-memory.dmp

Download

memory/2472-1509-0x0000028F6BB40000-0x0000028F6BB50000-memory.dmp

Download

memory/2472-1511-0x0000028F6BB40000-0x0000028F6BB50000-memory.dmp

Download

memory/2472-1510-0x0000028F6BB40000-0x0000028F6BB50000-memory.dmp

Download

memory/2472-1507-0x0000028F6BB40000-0x0000028F6BB50000-memory.dmp

Download

memory/2472-1506-0x0000028F6BB40000-0x0000028F6BB50000-memory.dmp

Download

memory/2472-1504-0x0000028F6BB40000-0x0000028F6BB50000-memory.dmp

Download

memory/2472-1503-0x0000028F6BB40000-0x0000028F6BB50000-memory.dmp

Download

memory/2472-1512-0x0000028F6BB40000-0x0000028F6BB50000-memory.dmp

Download

memory/2472-1513-0x0000028F6BB40000-0x0000028F6BB50000-memory.dmp

Download

memory/2472-1514-0x0000028F6BB40000-0x0000028F6BB50000-memory.dmp

Download

memory/2472-1517-0x0000028F6BB40000-0x0000028F6BB50000-memory.dmp

Download

memory/2472-1516-0x0000028F6BB40000-0x0000028F6BB50000-memory.dmp

Download

memory/2472-1515-0x0000028F6BB40000-0x0000028F6BB50000-memory.dmp

Download

memory/2472-1518-0x0000028F6BB40000-0x0000028F6BB50000-memory.dmp

Download

memory/2472-1519-0x0000028F6BB40000-0x0000028F6BB50000-memory.dmp

Download

memory/2472-1520-0x0000028F6BB40000-0x0000028F6BB50000-memory.dmp

Download

memory/2472-1521-0x0000028F6BB40000-0x0000028F6BB50000-memory.dmp

Download

memory/2472-1522-0x0000028F6BB40000-0x0000028F6BB50000-memory.dmp

Download

memory/2472-1523-0x0000028F6BB40000-0x0000028F6BB50000-memory.dmp

Download

memory/2472-1557-0x0000028F6BB40000-0x0000028F6BB50000-memory.dmp

Download

memory/2472-1525-0x0000028F6BB40000-0x0000028F6BB50000-memory.dmp

Download

memory/2472-1526-0x0000028F6BB40000-0x0000028F6BB50000-memory.dmp

Download

memory/2472-1527-0x0000028F6BB40000-0x0000028F6BB50000-memory.dmp

Download

memory/2472-1528-0x0000028F6BB40000-0x0000028F6BB50000-memory.dmp

Download

memory/2472-1529-0x0000028F6BB40000-0x0000028F6BB50000-memory.dmp

Download

memory/2472-1530-0x0000028F6BB40000-0x0000028F6BB50000-memory.dmp

Download

memory/2472-1533-0x0000028F6BB40000-0x0000028F6BB50000-memory.dmp

Download

memory/2472-1532-0x0000028F6BB40000-0x0000028F6BB50000-memory.dmp

Download

memory/2472-1531-0x0000028F6BB40000-0x0000028F6BB50000-memory.dmp

Download

memory/2472-1543-0x0000028F6BB40000-0x0000028F6BB50000-memory.dmp

Download

memory/2472-1541-0x0000028F6BB40000-0x0000028F6BB50000-memory.dmp

Download

memory/2472-1542-0x0000028F6BB40000-0x0000028F6BB50000-memory.dmp

Download

memory/2472-1540-0x0000028F6BB40000-0x0000028F6BB50000-memory.dmp

Download

memory/2472-1539-0x0000028F6BB40000-0x0000028F6BB50000-memory.dmp

Download

memory/2472-1554-0x0000028F6BB40000-0x0000028F6BB50000-memory.dmp

Download

memory/2472-1538-0x0000028F6BB40000-0x0000028F6BB50000-memory.dmp

Download

memory/2472-1537-0x0000028F6BB40000-0x0000028F6BB50000-memory.dmp

Download

memory/2472-1536-0x0000028F6BB40000-0x0000028F6BB50000-memory.dmp

Download

memory/2472-1535-0x0000028F6BB40000-0x0000028F6BB50000-memory.dmp

Download

memory/2472-1534-0x0000028F6BB40000-0x0000028F6BB50000-memory.dmp

Download

memory/2472-1546-0x0000028F6BB40000-0x0000028F6BB50000-memory.dmp

Download

memory/2472-1547-0x0000028F6BB40000-0x0000028F6BB50000-memory.dmp

Download

memory/2472-1548-0x0000028F6BB40000-0x0000028F6BB50000-memory.dmp

Download

memory/2472-1549-0x0000028F6BB40000-0x0000028F6BB50000-memory.dmp

Download

memory/2472-1550-0x0000028F6BB40000-0x0000028F6BB50000-memory.dmp

Download

memory/2472-1551-0x0000028F6BB40000-0x0000028F6BB50000-memory.dmp

Download

memory/2472-1552-0x0000028F6BB40000-0x0000028F6BB50000-memory.dmp

Download

memory/2472-1553-0x0000028F6BB40000-0x0000028F6BB50000-memory.dmp

Download

memory/5052-1544-0x00000230A6D70000-0x00000230A6D78000-memory.dmp

Download

memory/5052-1475-0x000002309D5A0000-0x000002309D5B0000-memory.dmp

Download

memory/5052-1459-0x000002309D370000-0x000002309D380000-memory.dmp

Download

memory/5052-1491-0x00000230A5960000-0x00000230A5968000-memory.dmp

Download