hxxps://www[.]mediafire[.]com/file/xmtadg1wy2zkn17/grim[.]zip/file

Analysis

user interaction
yes
max time kernel
181s
max time network
182s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/09/2026, 16:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.mediafire.com/file/xmtadg1wy2zkn17/grim.zip/file
Sample260925-ttcdjafe88

Score

8^/10

defense_evasion discovery persistence ransomware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
480	2076	msedge.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\Geo\Nation	vc_redist.x64.exe
Key value queried	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\Geo\Nation	VC_redist.x64.exe
Key value queried	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\Geo\Nation	prismlauncher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\Geo\Nation	prismlauncher_updater.exe

Executes dropped EXE 11 IoCs

pid	Process
5596	PrismLauncher-Windows-MSVC-Setup-11.1.0.exe
6104	vc_redist.x64.exe
3096	vc_redist.x64.exe
4652	VC_redist.x64.exe
212	VC_redist.x64.exe
4696	VC_redist.x64.exe
4196	VC_redist.x64.exe
5356	VC_redist.x64.exe
1780	prismlauncher.exe
2080	prismlauncher_updater.exe
3300	prismlauncher.exe

Loads dropped DLL 64 IoCs

pid	Process
5596	PrismLauncher-Windows-MSVC-Setup-11.1.0.exe
5596	PrismLauncher-Windows-MSVC-Setup-11.1.0.exe
5596	PrismLauncher-Windows-MSVC-Setup-11.1.0.exe
5596	PrismLauncher-Windows-MSVC-Setup-11.1.0.exe
3096	vc_redist.x64.exe
3648	VC_redist.x64.exe
4196	VC_redist.x64.exe
1780	prismlauncher.exe
1780	prismlauncher.exe
1780	prismlauncher.exe
1780	prismlauncher.exe
1780	prismlauncher.exe
1780	prismlauncher.exe
1780	prismlauncher.exe
1780	prismlauncher.exe
1780	prismlauncher.exe
1780	prismlauncher.exe
1780	prismlauncher.exe
1780	prismlauncher.exe
1780	prismlauncher.exe
1780	prismlauncher.exe
1780	prismlauncher.exe
1780	prismlauncher.exe
1780	prismlauncher.exe
1780	prismlauncher.exe
1780	prismlauncher.exe
1780	prismlauncher.exe
1780	prismlauncher.exe
1780	prismlauncher.exe
1780	prismlauncher.exe
1780	prismlauncher.exe
1780	prismlauncher.exe
1780	prismlauncher.exe
1780	prismlauncher.exe
1780	prismlauncher.exe
1780	prismlauncher.exe
1780	prismlauncher.exe
1780	prismlauncher.exe
1780	prismlauncher.exe
1780	prismlauncher.exe
1780	prismlauncher.exe
1780	prismlauncher.exe
1780	prismlauncher.exe
1780	prismlauncher.exe
1780	prismlauncher.exe
1780	prismlauncher.exe
2080	prismlauncher_updater.exe
2080	prismlauncher_updater.exe
2080	prismlauncher_updater.exe
2080	prismlauncher_updater.exe
2080	prismlauncher_updater.exe
2080	prismlauncher_updater.exe
2080	prismlauncher_updater.exe
2080	prismlauncher_updater.exe
2080	prismlauncher_updater.exe
2080	prismlauncher_updater.exe
2080	prismlauncher_updater.exe
2080	prismlauncher_updater.exe
2080	prismlauncher_updater.exe
2080	prismlauncher_updater.exe
2080	prismlauncher_updater.exe
2080	prismlauncher_updater.exe
2080	prismlauncher_updater.exe
2080	prismlauncher_updater.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515} = "\"C:\\ProgramData\\Package Cache\\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\\VC_redist.x64.exe\" /burn.runonce"	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515} = "\"C:\\ProgramData\\Package Cache\\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\\VC_redist.x64.exe\" /burn.runonce"	VC_redist.x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
	\??\F:\	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe

Drops file in System32 directory 51 IoCs

description	ioc	Process
File created	C:\Windows\system32\mfc140esn.dll	msiexec.exe
File created	C:\Windows\system32\mfc140ita.dll	msiexec.exe
File created	C:\Windows\system32\mfc140rus.dll	msiexec.exe
File created	C:\Windows\system32\mfc140u.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_1.dll	msiexec.exe
File created	C:\Windows\system32\vccorlib140.dll	msiexec.exe
File created	C:\Windows\system32\mfc140chs.dll	msiexec.exe
File created	C:\Windows\system32\mfc140deu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_2.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcomp140.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_2.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140u.dll	msiexec.exe
File created	C:\Windows\system32\mfc140cht.dll	msiexec.exe
File created	C:\Windows\system32\mfc140enu.dll	msiexec.exe
File created	C:\Windows\system32\mfcm140.dll	msiexec.exe
File created	C:\Windows\system32\concrt140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140deu.dll	msiexec.exe
File created	C:\Windows\system32\mfc140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_codecvt_ids.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vccorlib140.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_atomic_wait.dll	msiexec.exe
File created	C:\Windows\system32\vcomp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140chs.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140enu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140esn.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140rus.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_1.dll	msiexec.exe
File opened for modification	C:\Windows\system32\concrt140.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140cht.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140ita.dll	msiexec.exe
File created	C:\Windows\system32\mfc140fra.dll	msiexec.exe
File created	C:\Windows\system32\mfc140jpn.dll	msiexec.exe
File created	C:\Windows\system32\mfc140kor.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcruntime140_1.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcamp140.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140fra.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140jpn.dll	msiexec.exe
File created	C:\Windows\system32\mfcm140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_atomic_wait.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_codecvt_ids.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140_1.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140_threads.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140kor.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcruntime140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140.dll	msiexec.exe
File created	C:\Windows\system32\vcamp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm140u.dll	msiexec.exe

Drops file in Windows directory 15 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e59ab3c.msi	msiexec.exe
File created	C:\Windows\Installer\e59ab3d.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBD9C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e59ab2a.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB2DC.tmp	msiexec.exe
File created	C:\Windows\Installer\e59ab2a.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{43B0D101-A022-48F4-9D04-BA404CEB1D53}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB955.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{86AB2CC9-08BD-4643-B0F9-F82D006D72FF}	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAEE4.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e59ab3d.msi	msiexec.exe
File created	C:\Windows\Installer\e59ab52.msi	msiexec.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Programs\PrismLauncher\vc_redist\vc_redist.x64.exe:Zone.Identifier	PrismLauncher-Windows-MSVC-Setup-11.1.0.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	PrismLauncher-Windows-MSVC-Setup-11.1.0.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	PrismLauncher-Windows-MSVC-Setup-11.1.0.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	prismlauncher.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	prismlauncher.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	prismlauncher_updater.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	prismlauncher_updater.exe

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vc_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PrismLauncher-Windows-MSVC-Setup-11.1.0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TaskKill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vc_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2076	msedge.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000c311d2c4ba4812b50000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000c311d2c40000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900c311d2c4000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1ac311d2c4000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dc311d2c4000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
3976	TaskKill.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.44,bundle	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9CC2BA68DB8034640B9F8FD200D627FF\Provider	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.44,bundle	VC_redist.x64.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\curseforge\shell\open\command	PrismLauncher-Windows-MSVC-Setup-11.1.0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.44,bundle\Dependents\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}	VC_redist.x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\101D0B34220A4F84D940AB04C4BED135\Provider	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\101D0B34220A4F84D940AB04C4BED135\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9CC2BA68DB8034640B9F8FD200D627FF\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.44,bundle\Version = "14.44.35211.0"	VC_redist.x64.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\curseforge\shell\open	PrismLauncher-Windows-MSVC-Setup-11.1.0.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\09A86F63C932FD435BC8463B1035EC53	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\101D0B34220A4F84D940AB04C4BED135	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\101D0B34220A4F84D940AB04C4BED135\VC_Runtime_Minimum	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\101D0B34220A4F84D940AB04C4BED135\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{43B0D101-A022-48F4-9D04-BA404CEB1D53}v14.44.35211\\packages\\vcRuntimeMinimum_amd64\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14	VC_redist.x64.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\101D0B34220A4F84D940AB04C4BED135\Servicing_Key	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\101D0B34220A4F84D940AB04C4BED135\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\101D0B34220A4F84D940AB04C4BED135\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\Dependents\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}	VC_redist.x64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\Version = "14.44.35211"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9CC2BA68DB8034640B9F8FD200D627FF\Servicing_Key	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\101D0B34220A4F84D940AB04C4BED135\Version = "237799819"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\09A86F63C932FD435BC8463B1035EC53\101D0B34220A4F84D940AB04C4BED135	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\curseforge\shell	PrismLauncher-Windows-MSVC-Setup-11.1.0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\curseforge\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\PrismLauncher\\prismlauncher.exe\" \"%1\""	PrismLauncher-Windows-MSVC-Setup-11.1.0.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\prismlauncher\shell\open\command	PrismLauncher-Windows-MSVC-Setup-11.1.0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.44,bundle\ = "{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}"	VC_redist.x64.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9CC2BA68DB8034640B9F8FD200D627FF\Clients = 3a0000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\101D0B34220A4F84D940AB04C4BED135\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\88AAB0B9F51EF1A3CA0C2B609EDD7FC1\9CC2BA68DB8034640B9F8FD200D627FF	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9CC2BA68DB8034640B9F8FD200D627FF\SourceList\PackageName = "vc_runtimeAdditional_x64.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9CC2BA68DB8034640B9F8FD200D627FF\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\Dependents\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}	VC_redist.x64.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-895009113-1202185046-1686627690-1000\{51389D72-EE54-43BE-9FFD-84D44BEB7FE5}	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.44,bundle\DisplayName = "Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.44.35211"	VC_redist.x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8800A266DCF6DD54E97A86760485EA5D	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\101D0B34220A4F84D940AB04C4BED135	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\101D0B34220A4F84D940AB04C4BED135\SourceList\PackageName = "vc_runtimeMinimum_x64.msi"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\DisplayName = "Microsoft Visual C++ 2022 X64 Additional Runtime - 14.44.35211"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9CC2BA68DB8034640B9F8FD200D627FF\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\curseforge\URL Protocol	PrismLauncher-Windows-MSVC-Setup-11.1.0.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\prismlauncher	PrismLauncher-Windows-MSVC-Setup-11.1.0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\101D0B34220A4F84D940AB04C4BED135\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{43B0D101-A022-48F4-9D04-BA404CEB1D53}v14.44.35211\\packages\\vcRuntimeMinimum_amd64\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\88AAB0B9F51EF1A3CA0C2B609EDD7FC1	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9CC2BA68DB8034640B9F8FD200D627FF\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{86AB2CC9-08BD-4643-B0F9-F82D006D72FF}v14.44.35211\\packages\\vcRuntimeAdditional_amd64\\"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.30,bundle\Dependents	VC_redist.x64.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\curseforge	PrismLauncher-Windows-MSVC-Setup-11.1.0.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8A567BD6FA501A947AD1F646E53EEC14	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9CC2BA68DB8034640B9F8FD200D627FF\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9CC2BA68DB8034640B9F8FD200D627FF\SourceList	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.30,bundle	VC_redist.x64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\prismlauncher\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\PrismLauncher\\prismlauncher.exe\" \"%1\""	PrismLauncher-Windows-MSVC-Setup-11.1.0.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14	VC_redist.x64.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Programs\PrismLauncher\vc_redist\vc_redist.x64.exe:Zone.Identifier	PrismLauncher-Windows-MSVC-Setup-11.1.0.exe

Suspicious behavior: AddClipboardFormatListener 3 IoCs

pid	Process
1780	prismlauncher.exe
2080	prismlauncher_updater.exe
3300	prismlauncher.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5348	msiexec.exe
5348	msiexec.exe
5348	msiexec.exe
5348	msiexec.exe
5348	msiexec.exe
5348	msiexec.exe
5348	msiexec.exe
5348	msiexec.exe
2908	msedge.exe
2908	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1780	prismlauncher.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 25 IoCs

pid	Process
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3976	TaskKill.exe
Token: SeBackupPrivilege	4572	vssvc.exe
Token: SeRestorePrivilege	4572	vssvc.exe
Token: SeAuditPrivilege	4572	vssvc.exe
Token: SeShutdownPrivilege	4652	VC_redist.x64.exe
Token: SeIncreaseQuotaPrivilege	4652	VC_redist.x64.exe
Token: SeSecurityPrivilege	5348	msiexec.exe
Token: SeCreateTokenPrivilege	4652	VC_redist.x64.exe
Token: SeAssignPrimaryTokenPrivilege	4652	VC_redist.x64.exe
Token: SeLockMemoryPrivilege	4652	VC_redist.x64.exe
Token: SeIncreaseQuotaPrivilege	4652	VC_redist.x64.exe
Token: SeMachineAccountPrivilege	4652	VC_redist.x64.exe
Token: SeTcbPrivilege	4652	VC_redist.x64.exe
Token: SeSecurityPrivilege	4652	VC_redist.x64.exe
Token: SeTakeOwnershipPrivilege	4652	VC_redist.x64.exe
Token: SeLoadDriverPrivilege	4652	VC_redist.x64.exe
Token: SeSystemProfilePrivilege	4652	VC_redist.x64.exe
Token: SeSystemtimePrivilege	4652	VC_redist.x64.exe
Token: SeProfSingleProcessPrivilege	4652	VC_redist.x64.exe
Token: SeIncBasePriorityPrivilege	4652	VC_redist.x64.exe
Token: SeCreatePagefilePrivilege	4652	VC_redist.x64.exe
Token: SeCreatePermanentPrivilege	4652	VC_redist.x64.exe
Token: SeBackupPrivilege	4652	VC_redist.x64.exe
Token: SeRestorePrivilege	4652	VC_redist.x64.exe
Token: SeShutdownPrivilege	4652	VC_redist.x64.exe
Token: SeDebugPrivilege	4652	VC_redist.x64.exe
Token: SeAuditPrivilege	4652	VC_redist.x64.exe
Token: SeSystemEnvironmentPrivilege	4652	VC_redist.x64.exe
Token: SeChangeNotifyPrivilege	4652	VC_redist.x64.exe
Token: SeRemoteShutdownPrivilege	4652	VC_redist.x64.exe
Token: SeUndockPrivilege	4652	VC_redist.x64.exe
Token: SeSyncAgentPrivilege	4652	VC_redist.x64.exe
Token: SeEnableDelegationPrivilege	4652	VC_redist.x64.exe
Token: SeManageVolumePrivilege	4652	VC_redist.x64.exe
Token: SeImpersonatePrivilege	4652	VC_redist.x64.exe
Token: SeCreateGlobalPrivilege	4652	VC_redist.x64.exe
Token: SeRestorePrivilege	5348	msiexec.exe
Token: SeTakeOwnershipPrivilege	5348	msiexec.exe
Token: SeRestorePrivilege	5348	msiexec.exe
Token: SeTakeOwnershipPrivilege	5348	msiexec.exe
Token: SeRestorePrivilege	5348	msiexec.exe
Token: SeTakeOwnershipPrivilege	5348	msiexec.exe
Token: SeRestorePrivilege	5348	msiexec.exe
Token: SeTakeOwnershipPrivilege	5348	msiexec.exe
Token: SeRestorePrivilege	5348	msiexec.exe
Token: SeTakeOwnershipPrivilege	5348	msiexec.exe
Token: SeRestorePrivilege	5348	msiexec.exe
Token: SeTakeOwnershipPrivilege	5348	msiexec.exe
Token: SeRestorePrivilege	5348	msiexec.exe
Token: SeTakeOwnershipPrivilege	5348	msiexec.exe
Token: SeRestorePrivilege	5348	msiexec.exe
Token: SeTakeOwnershipPrivilege	5348	msiexec.exe
Token: SeRestorePrivilege	5348	msiexec.exe
Token: SeTakeOwnershipPrivilege	5348	msiexec.exe
Token: SeRestorePrivilege	5348	msiexec.exe
Token: SeTakeOwnershipPrivilege	5348	msiexec.exe
Token: SeRestorePrivilege	5348	msiexec.exe
Token: SeTakeOwnershipPrivilege	5348	msiexec.exe
Token: SeRestorePrivilege	5348	msiexec.exe
Token: SeTakeOwnershipPrivilege	5348	msiexec.exe
Token: SeRestorePrivilege	5348	msiexec.exe
Token: SeTakeOwnershipPrivilege	5348	msiexec.exe
Token: SeRestorePrivilege	5348	msiexec.exe
Token: SeTakeOwnershipPrivilege	5348	msiexec.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
5596	PrismLauncher-Windows-MSVC-Setup-11.1.0.exe
3096	vc_redist.x64.exe
4196	VC_redist.x64.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2652 wrote to memory of 2840	2652	msedge.exe	85
PID 2652 wrote to memory of 2076	2652	msedge.exe	86
PID 2652 wrote to memory of 4236	2652	msedge.exe	87
PID 2652 wrote to memory of 4236	2652	msedge.exe	87
PID 2652 wrote to memory of 4236	2652	msedge.exe	87
PID 2652 wrote to memory of 2332	2652	msedge.exe	88
PID 2652 wrote to memory of 2332	2652	msedge.exe	88
PID 2652 wrote to memory of 2296	2652	msedge.exe	89
PID 2652 wrote to memory of 2864	2652	msedge.exe	90
PID 2652 wrote to memory of 2864	2652	msedge.exe	90
PID 2652 wrote to memory of 2864	2652	msedge.exe	90
PID 2652 wrote to memory of 2296	2652	msedge.exe	89
PID 2652 wrote to memory of 2296	2652	msedge.exe	89
PID 2652 wrote to memory of 1028	2652	msedge.exe	91
PID 2652 wrote to memory of 1028	2652	msedge.exe	91
PID 2652 wrote to memory of 1028	2652	msedge.exe	91
PID 2652 wrote to memory of 3820	2652	msedge.exe	92
PID 2652 wrote to memory of 3820	2652	msedge.exe	92
PID 2652 wrote to memory of 3820	2652	msedge.exe	92
PID 2652 wrote to memory of 4924	2652	msedge.exe	97
PID 2652 wrote to memory of 4924	2652	msedge.exe	97
PID 2652 wrote to memory of 4924	2652	msedge.exe	97
PID 2652 wrote to memory of 2428	2652	msedge.exe	98
PID 2652 wrote to memory of 2428	2652	msedge.exe	98
PID 2652 wrote to memory of 2428	2652	msedge.exe	98
PID 2652 wrote to memory of 2052	2652	msedge.exe	99
PID 2652 wrote to memory of 2640	2652	msedge.exe	100
PID 2652 wrote to memory of 2640	2652	msedge.exe	100
PID 2652 wrote to memory of 2052	2652	msedge.exe	99
PID 2652 wrote to memory of 4200	2652	msedge.exe	101
PID 2652 wrote to memory of 4200	2652	msedge.exe	101
PID 2652 wrote to memory of 4200	2652	msedge.exe	101
PID 2652 wrote to memory of 724	2652	msedge.exe	107
PID 2652 wrote to memory of 680	2652	msedge.exe	112
PID 2652 wrote to memory of 680	2652	msedge.exe	112
PID 2652 wrote to memory of 680	2652	msedge.exe	112
PID 2652 wrote to memory of 1152	2652	msedge.exe	113
PID 2652 wrote to memory of 1152	2652	msedge.exe	113
PID 2652 wrote to memory of 1152	2652	msedge.exe	113
PID 2652 wrote to memory of 1496	2652	msedge.exe	114
PID 2652 wrote to memory of 1496	2652	msedge.exe	114
PID 2652 wrote to memory of 1496	2652	msedge.exe	114
PID 2652 wrote to memory of 5072	2652	msedge.exe	115
PID 2652 wrote to memory of 5072	2652	msedge.exe	115
PID 2652 wrote to memory of 5072	2652	msedge.exe	115
PID 2652 wrote to memory of 3932	2652	msedge.exe	116
PID 2652 wrote to memory of 3932	2652	msedge.exe	116
PID 2652 wrote to memory of 3932	2652	msedge.exe	116
PID 2652 wrote to memory of 4724	2652	msedge.exe	117
PID 2652 wrote to memory of 4724	2652	msedge.exe	117
PID 2652 wrote to memory of 4724	2652	msedge.exe	117
PID 2652 wrote to memory of 5920	2652	msedge.exe	125
PID 2652 wrote to memory of 5920	2652	msedge.exe	125
PID 2652 wrote to memory of 5920	2652	msedge.exe	125
PID 2652 wrote to memory of 4708	2652	msedge.exe	127
PID 2652 wrote to memory of 4708	2652	msedge.exe	127
PID 2652 wrote to memory of 6036	2652	msedge.exe	132
PID 2652 wrote to memory of 5860	2652	msedge.exe	133
PID 2652 wrote to memory of 3592	2652	msedge.exe	134
PID 2652 wrote to memory of 732	2652	msedge.exe	135
PID 2652 wrote to memory of 732	2652	msedge.exe	135
PID 2652 wrote to memory of 732	2652	msedge.exe	135
PID 2652 wrote to memory of 3012	2652	msedge.exe	137
PID 2652 wrote to memory of 3012	2652	msedge.exe	137

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.mediafire.com/file/xmtadg1wy2zkn17/grim.zip/file
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffbc690c188,0x7ffbc690c194,0x7ffbc690c1a0
  2⤵
  PID:2840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1868,i,5752112328257331764,2144789432013195537,524288 --field-trial-handle=2196,i,11108148755632943863,18435308117336194001,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1660,i,10763193836562746446,8168293753199794076,262144 --field-trial-handle=2196,i,11108148755632943863,18435308117336194001,262144 --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:2
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2620,i,10588799985525575543,16303184383141874015,524288 --field-trial-handle=2196,i,11108148755632943863,18435308117336194001,262144 --variations-seed-version --mojo-platform-channel-handle=2764 /prefetch:8
  2⤵
  PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,4126366132051002616,5767963752520626802,2097152 --field-trial-handle=2196,i,11108148755632943863,18435308117336194001,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,7467386555775292103,15391750331000071424,2097152 --field-trial-handle=2196,i,11108148755632943863,18435308117336194001,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4220,i,12883658076029385177,10381210791702049600,2097152 --field-trial-handle=2196,i,11108148755632943863,18435308117336194001,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:1
  2⤵
  PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4248,i,9098072300391423975,17079532560881131586,2097152 --field-trial-handle=2196,i,11108148755632943863,18435308117336194001,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:2
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5040,i,8289449682228616931,1845613232934563842,2097152 --field-trial-handle=2196,i,11108148755632943863,18435308117336194001,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:1
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5352,i,658186795481107021,7325031453825787432,2097152 --field-trial-handle=2196,i,11108148755632943863,18435308117336194001,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:1
  2⤵
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5676,i,524651102495628324,2566990153880727507,524288 --field-trial-handle=2196,i,11108148755632943863,18435308117336194001,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:8
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5660,i,17601809540427044190,4630855118385554344,524288 --field-trial-handle=2196,i,11108148755632943863,18435308117336194001,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:8
  2⤵
  PID:2640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6016,i,2566382018631410903,7065718021401194003,2097152 --field-trial-handle=2196,i,11108148755632943863,18435308117336194001,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:1
  2⤵
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3524,i,7374771458849956327,12133834392359500568,524288 --field-trial-handle=2196,i,11108148755632943863,18435308117336194001,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:892
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3524,i,7374771458849956327,12133834392359500568,524288 --field-trial-handle=2196,i,11108148755632943863,18435308117336194001,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5472,i,376475951121529612,56728861510768018,2097152 --field-trial-handle=2196,i,11108148755632943863,18435308117336194001,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:1
  2⤵
  PID:680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5440,i,7800977545426899356,5914145552901675447,2097152 --field-trial-handle=2196,i,11108148755632943863,18435308117336194001,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:1
  2⤵
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6856,i,7419999364548712481,4907762269659045885,2097152 --field-trial-handle=2196,i,11108148755632943863,18435308117336194001,262144 --variations-seed-version --mojo-platform-channel-handle=6900 /prefetch:1
  2⤵
  PID:1496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=7064,i,3748495079771127260,13488277746812270796,2097152 --field-trial-handle=2196,i,11108148755632943863,18435308117336194001,262144 --variations-seed-version --mojo-platform-channel-handle=6920 /prefetch:1
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=7192,i,14139382232369534135,2998115350264454994,2097152 --field-trial-handle=2196,i,11108148755632943863,18435308117336194001,262144 --variations-seed-version --mojo-platform-channel-handle=7208 /prefetch:1
  2⤵
  PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7336,i,4298342787242316040,14878478546082506058,2097152 --field-trial-handle=2196,i,11108148755632943863,18435308117336194001,262144 --variations-seed-version --mojo-platform-channel-handle=7344 /prefetch:1
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7560,i,8746918586421590285,11884993321094329868,2097152 --field-trial-handle=2196,i,11108148755632943863,18435308117336194001,262144 --variations-seed-version --mojo-platform-channel-handle=7588 /prefetch:1
  2⤵
  PID:5920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7088,i,14111299963281780119,15439355605855536899,524288 --field-trial-handle=2196,i,11108148755632943863,18435308117336194001,262144 --variations-seed-version --mojo-platform-channel-handle=7096 /prefetch:8
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4500,i,391440830005853540,9773470229852466837,524288 --field-trial-handle=2196,i,11108148755632943863,18435308117336194001,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:8
  2⤵
  PID:6036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7744,i,2938145144251529510,4735125428984324807,524288 --field-trial-handle=2196,i,11108148755632943863,18435308117336194001,262144 --variations-seed-version --mojo-platform-channel-handle=7736 /prefetch:8
  2⤵
  PID:5860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7752,i,12538799476201173297,18055761404642373179,524288 --field-trial-handle=2196,i,11108148755632943863,18435308117336194001,262144 --variations-seed-version --mojo-platform-channel-handle=7788 /prefetch:8
  2⤵
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7756,i,9976531230087292540,5757344829968993124,2097152 --field-trial-handle=2196,i,11108148755632943863,18435308117336194001,262144 --variations-seed-version --mojo-platform-channel-handle=7784 /prefetch:1
  2⤵
  PID:732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=4264,i,8704164774520587385,15919958703608633224,2097152 --field-trial-handle=2196,i,11108148755632943863,18435308117336194001,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:1
  2⤵
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7752,i,2891023691802581384,2727433318465982252,2097152 --field-trial-handle=2196,i,11108148755632943863,18435308117336194001,262144 --variations-seed-version --mojo-platform-channel-handle=7748 /prefetch:1
  2⤵
  PID:6056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=3904,i,983270175590375290,14081527022074022303,2097152 --field-trial-handle=2196,i,11108148755632943863,18435308117336194001,262144 --variations-seed-version --mojo-platform-channel-handle=7684 /prefetch:1
  2⤵
  PID:6048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=8196,i,17507996219401994285,1976214071360054143,2097152 --field-trial-handle=2196,i,11108148755632943863,18435308117336194001,262144 --variations-seed-version --mojo-platform-channel-handle=8200 /prefetch:1
  2⤵
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6752,i,2858676299320160665,2550277634444252296,524288 --field-trial-handle=2196,i,11108148755632943863,18435308117336194001,262144 --variations-seed-version --mojo-platform-channel-handle=8144 /prefetch:8
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=7876,i,6387958616403008832,370452681771964440,2097152 --field-trial-handle=2196,i,11108148755632943863,18435308117336194001,262144 --variations-seed-version --mojo-platform-channel-handle=6764 /prefetch:1
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8508,i,4964078380804449137,11651984448314625985,524288 --field-trial-handle=2196,i,11108148755632943863,18435308117336194001,262144 --variations-seed-version --mojo-platform-channel-handle=8544 /prefetch:8
  2⤵
  PID:5784
- C:\Users\Admin\Downloads\PrismLauncher-Windows-MSVC-Setup-11.1.0.exe
  "C:\Users\Admin\Downloads\PrismLauncher-Windows-MSVC-Setup-11.1.0.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of FindShellTrayWindow
  PID:5596
- - C:\Windows\SysWOW64\TaskKill.exe
    TaskKill /IM prismlauncher.exe /F
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3976
- - C:\Users\Admin\AppData\Local\Programs\PrismLauncher\vc_redist\vc_redist.x64.exe
    C:\Users\Admin\AppData\Local\Programs\PrismLauncher\vc_redist\vc_redist.x64.exe /install /passive /norestart
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:6104
  - - C:\Windows\Temp\{7DB781BA-1DF9-4B73-AD92-1F9A8E53FAC1}\.cr\vc_redist.x64.exe
      "C:\Windows\Temp\{7DB781BA-1DF9-4B73-AD92-1F9A8E53FAC1}\.cr\vc_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Programs\PrismLauncher\vc_redist\vc_redist.x64.exe" -burn.filehandle.attached=792 -burn.filehandle.self=800 /install /passive /norestart
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      PID:3096
    - - C:\Windows\Temp\{D965D8C1-4AC4-4C56-ADB0-80C5F9C17C2F}\.be\VC_redist.x64.exe
        
        "C:\Windows\Temp\{D965D8C1-4AC4-4C56-ADB0-80C5F9C17C2F}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{2029DFCB-ECE0-42EF-8A1A-BA516D1FC950} {7DC4C69C-BE43-43ED-99D0-626DD2161A14} 3096
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4652
      - C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={d8bbe9f9-7c5b-42c6-b715-9ee898a2e515} -burn.filehandle.self=1136 -burn.embedded BurnPipe.{35BEE7DE-17CF-426A-9367-38381E610EFA} {E714377C-B935-4113-9782-2E7E96BC998A} 4652
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5372
        
        C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=652 -burn.filehandle.self=672 -uninstall -quiet -burn.related.upgrade -burn.ancestors={d8bbe9f9-7c5b-42c6-b715-9ee898a2e515} -burn.filehandle.self=1136 -burn.embedded BurnPipe.{35BEE7DE-17CF-426A-9367-38381E610EFA} {E714377C-B935-4113-9782-2E7E96BC998A} 4652
        7⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:3648
        
        C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{10F8DACB-87A0-44C5-94AE-04103F743A1C} {18F7A45E-8715-44C1-81F8-078291EEB0EE} 3648
        8⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5864
- - C:\Users\Admin\AppData\Local\Programs\PrismLauncher\prismlauncher.exe
    "C:\Users\Admin\AppData\Local\Programs\PrismLauncher\prismlauncher.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious behavior: GetForegroundWindowSpam
    PID:1780
  - - C:\Users\Admin\AppData\Local\Programs\PrismLauncher\prismlauncher_updater.exe
      C:\Users\Admin\AppData\Local\Programs\PrismLauncher\prismlauncher_updater.exe --check-only --dir C:/Users/Admin/AppData/Roaming/PrismLauncher --debug
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: AddClipboardFormatListener
      PID:2080
    - - C:\Users\Admin\AppData\Local\Programs\PrismLauncher\prismlauncher.exe
        
        C:\Users\Admin\AppData\Local\Programs\PrismLauncher\prismlauncher.exe --version
        5⤵
        Executes dropped EXE
        Suspicious behavior: AddClipboardFormatListener
        
        PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8508,i,6835612385577824409,16142193373914198093,524288 --field-trial-handle=2196,i,11108148755632943863,18435308117336194001,262144 --variations-seed-version --mojo-platform-channel-handle=8536 /prefetch:8
  2⤵
  PID:5448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=8060,i,6349977895666616776,12520900217654573567,2097152 --field-trial-handle=2196,i,11108148755632943863,18435308117336194001,262144 --variations-seed-version --mojo-platform-channel-handle=8036 /prefetch:1
  2⤵
  PID:5364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=8140,i,6327110305044258594,17785262923134763121,2097152 --field-trial-handle=2196,i,11108148755632943863,18435308117336194001,262144 --variations-seed-version --mojo-platform-channel-handle=8180 /prefetch:1
  2⤵
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=5528,i,639651782597467835,11048800589818605226,2097152 --field-trial-handle=2196,i,11108148755632943863,18435308117336194001,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:5740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=7984,i,14374033107909463584,9393426899058528643,2097152 --field-trial-handle=2196,i,11108148755632943863,18435308117336194001,262144 --variations-seed-version --mojo-platform-channel-handle=8204 /prefetch:1
  2⤵
  PID:5320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5472,i,7033109776244392977,12331911625991204080,524288 --field-trial-handle=2196,i,11108148755632943863,18435308117336194001,262144 --variations-seed-version --mojo-platform-channel-handle=7776 /prefetch:8
  2⤵
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=8156,i,2264665565752251888,14063692021178601080,262144 --field-trial-handle=2196,i,11108148755632943863,18435308117336194001,262144 --variations-seed-version --mojo-platform-channel-handle=8336 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8252,i,17517974076140568190,11650760693269138293,524288 --field-trial-handle=2196,i,11108148755632943863,18435308117336194001,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:8
  2⤵
  PID:3732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3580,i,10095628121114641827,17436618410805783186,524288 --field-trial-handle=2196,i,11108148755632943863,18435308117336194001,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  PID:1612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,10627447165721993124,10875180798998821536,524288 --field-trial-handle=2196,i,11108148755632943863,18435308117336194001,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:8
  2⤵
  PID:5584

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3740

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4572

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
PID:5512

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5348

C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe
"C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" /burn.runonce
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:212
- C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe
  "C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" /passive /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260925172145.log" /install
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4696
- - C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe
    "C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" -burn.filehandle.attached=528 -burn.filehandle.self=548 /passive /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260925172145.log" /install
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:4196
  - - C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe
      "C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{045B1BCA-41E1-419D-BA6F-745FD7FB59AF} {3949CB6E-74D4-402B-9F8F-F92BADBFE093} 4196
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:5356

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x314 0x300
1⤵
PID:5340

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e59ab2f.rbs

Path C:\Config.Msi\e59ab2f.rbs
Size 19KB
SHA256 514c382693bf1494a17a9a91fd5ecd9b477d40ffe73e174e02494eea0f50b829
MD5 7e6b0df93b5093070c83cd94058e862b
SHA1 f0a36339f1d7960b4b351d988e31004bb4e0da74
SHA512 b81a243f9d30f4b7f02d88346c9dfc9b1ab67053ea958729664e21b38a3c1ad8f8b16c5cb2c5f1a69eab8add908ec854fc3859cf3705c8a6a0b592f5ac73f994
SSDEEP 192:m7RV1kRa15dXcFUADIc1L+W+y4+agPuOsinFT7:m7RV6RaTeC81L/cqZ7
TLSH
T10E92FC426680C9D3E8766B30CD675BA53B76DBD5A350438B50DC90308F93BCA2F9D68E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59ab3b.rbs

Path C:\Config.Msi\e59ab3b.rbs
Size 19KB
SHA256 5e7b91fc93132d6d753320eda0378752cfab8b460b3e193aaa39e6ee6034d325
MD5 bc5098ccbb939e0e4a2103e1ec9ee637
SHA1 77e194b7197355f277396357ce3dbda7d71b5548
SHA512 48c8b022962e35e5ac1eea2c6a0d3c75cd1f6c40b1a610e93cf99dcfaee72d93bb5fff64758cd5f3d7aa5bbbfd83a6a449e0fc8d32bd787e6e79d476685333a3
SSDEEP 384:mvOGnJXMjZ7Up+BFqiO6d9gJ+0uJ+0Goa2D8Lfv/8c3zMZxq+nNwzQ6R:mvOGnJXMjZ7Up+BFIH+F+R
TLSH
T12592CB026640C5E3D8A62B70DD4B67243BB5D7CAA355A38B41DCC1708FA77CA7F8D24A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59ab42.rbs

Path C:\Config.Msi\e59ab42.rbs
Size 21KB
SHA256 e57ed577ff5edd8b28d2855eb6066cd3bd9e54d20e082504c4981a53810aa778
MD5 63abb8ef3b537b245980a69651ab627e
SHA1 b933ea73a8495eb9ab2c95cb606db8f08169d049
SHA512 b25b1e8a423e22bd21ff284ca0925df76888b22696cab665c32ca15c12a9c2b7e4e2dff3afb0a051a18aaabb1d426fb1af582b00fe3c828478c26f85b16781fa
SSDEEP 384:H/RoGRrnAKxNAUhUC7xJjrMNYPVIbS/KgonCUrgVeTxkP:HZxTAKhCsp
TLSH
T135A21D43768089E3D86227B1DD671BA83B72D7D99350434B10ACD1388F633C76E5AA9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59ab51.rbs

Path C:\Config.Msi\e59ab51.rbs
Size 21KB
SHA256 84cca5c7df3822f0f9110f750b8a956c0294f3bef349cb7acb6422c1cfd9b851
MD5 855459a3206910845e27a9297bd3811a
SHA1 004f84075ff8081f7bb734c39c2ae73c9ec354bc
SHA512 ad41110696636e7fe8a10dfe22cd27cde222108018957d11a6140cacf5e7426282a62514194314666abf5b06241f81046e76ac40eebaab179b968c2f86f03d1d
SSDEEP 384:VlMrNvDIAZxEth/phSYjK4WbJGwaZsalckU72eC67JkE5KvJ5UJ5srr6c+0dWg:VlMdDIAZxEth/phSYujbJBTIUarr6/05
TLSH
T145A20D42BA40D2D3D8A62B70CD97672437B5D3DAA755434B10CC90348F937DA2F9AACB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

state.rsm

Path C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\state.rsm
Size 1KB
SHA256 be1aff074126f5bd6b7656055b047fab90828fda7cb89d9f0957e7e7a119b04a
MD5 4d66a2dd88fdabcae2defde734769f27
SHA1 c617ee84b274044a1121260a324f07f1a40f852a
SHA512 c3bd21e3c4bad26c10b3e6c42d759df6d3079ea5f8f04da1375b580d246dc1f2e69e0d6fc3a63fc43f0a751f72a7f1be421400cc5c1820eb3dc03e67118bd15c
TLSH
T1011186619FE6501AF3FBAA3129F516251D7BF8110E31911D0182618ACF32F50DD7477A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f7e901ff3df2d769334a9a6d3d1825c832dead150655a1e08b1ef005d0292c1c
MD5 54b5c89d12a534155a20824f377fc719
SHA1 633c3f7842f6f8f5fca6889975166d8beceab229
SHA512 232113d19f85e9404efda63cedba3028a48c801cab50f01744982526b2603d87acb2c9b209ffaa2266ed46e4496bd525b77408f425a951d529554a9790832746
TLSH
T118D0C06096B83ED9E131203F03700311348C01D351136100D85000490BE808381C1CE0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 928eda824fe964cd23927cf06086d7d24e20a3a5092daf1acee5b632c76c962a
MD5 4ac43ee6512ba8635b7ba6bd015c291b
SHA1 5f9e2474b00ec0e2a9472c049fbea550e26309aa
SHA512 e5ebf9e92458f66e31e080121135313e828b8ebade0bc0e085221ae0d4f5afe0d2035c566590cbfb5902d96f17befe7b24310b4fb9e647b999113175af800ebc
TLSH
T17BD022B2B3A038CFE300083302A083BA2C0A80F300FAE2208C30E08C0BCC02AC283880
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 93c2ca3ce74eca17f27aa90cc3323bb8d6aea5c365862a01a512ce14b9f825b4
MD5 e8a3239e6b22580d77fb537c7bea1fab
SHA1 a99ffe9234c27e560f1c607d3b6c6507928368a3
SHA512 17b0e6f99943a02540148a685b91c62eafca3ef65d9a628bfb59d3b69a93b27c7d3ac42bdc808c52b5b1eac9bf4466a1099df17cd3f5df0bbd5b5282ca8b904e
TLSH
T170D0247133D03CCFD7000433015043751C0540F300F5D3104C30D04C07CD055C143440
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

f_0000d1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000d1
Size 22.9MB
SHA256 fa3e726aacdb530e8305c65a081338e470773e5c163d1e424e2f8741a75c696e
MD5 789615fa8e3e4c6d6961042398603a38
SHA1 91661f26566717313935aff3eb86ccf6ec247811
SHA512 5526d0b80d609a7061fde144453640290c84ee4ccba84a142908e20f0dca2726a44d62d8f20325487a0f5b833e437eae8ac10d919dff3a8e8ec9f530926b8303
SSDEEP 393216:/4Vr903YYxsHMr7Sc733UoUnOfg21N3RYTUyQwACcspokbGaCunFRdd0GoPOtOoc:/Mri3YYxssr7Z3VUnOfdhgUrpCcsaaCt
TLSH
T1403723CE67744004C58E0F34969AA0C07A1AAD1712F0E8BBEA37F1C9ADB5DD946DEC5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 f105828c5b1b2f93516eff9b2b3ab22ab24264835c14bc81aa06b4cbec061282
MD5 f14a496c4d7e3dc000e9672e14067352
SHA1 9d3bff5f748c0b3cd7f691e0a8b520a6412d7b85
SHA512 281b32eca13baf07bf4e7a33b394704e97cd06210ab531724f1279952c6fe0ee4daf3680aa2d5c38aee60ecc1b63ac01aa755a0feed260eaead5821b87e6674c
SSDEEP 96:AexCSJB4cVo0I32hqOw6hSuCN/P6WgibmHRNbnLyGaqNQynuC/v+dMR:ACP+0IWlwaSbdq7HRVnmLmVnuC/z
TLSH
T13DE1ED42B48CB592FF9A76B05CD1A8863B34824CAF531F2B53A7DCF57B03BA0A045D59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe595edf.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe595edf.TMP
Size 3KB
SHA256 9e9d8599786f16b11b39744ee49bcf343dedc426973bb51c2d618874353efef0
MD5 9b57755bffa2f634718f97f855baf9eb
SHA1 1ce9d6d79e8620827ae0573ae0811d34c409fcd2
SHA512 711c748beed0bc7615a481446eb93c9f3e22ddb774f985aca0f4fa95041b0458719919cb578251f436dae17cb3c5e688610304ef8e6172888aebd8c9a86a75a9
TLSH
T1A66121469012F3D3FBD6DAF24DC27547BB38919486831D379964D87A7446FB0B0201AD
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 25KB
SHA256 d96283f85d696288c7661fa2a86de8c9268e0eab8dd0414e5cb837e0d9a4baf2
MD5 384648bd7cbb20b85ee83c09875d4323
SHA1 13122b08761f75d4e08156a892d71fde6bc6e096
SHA512 55b3897ead9109fe5a96d4e47becf68df2ed7d73f59002a89496c0cc214d7d567d24a732da27c671db25fb615593c750ab51b0b6a5480207a28d488237f73c58
SSDEEP 384:DkeflHEaNdaJeZeGK2AoCZUOiM0evCJbrJ4h3ywOLyYte114DPVyKYrnb457QpWw:bVP/zy4d0hgvirbwydAHTrG
TLSH
T117C2CBF383E5D56E891156F49A106E1BCF1D0659432C3C26C8D9EE8BE3F2072E16A64F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 631d121a4771cec6a5008ba192c5fd08aa25eb31376541a54c02740c73a875c4
MD5 a602ec400222ec3c239c3a29a0faca89
SHA1 e586f2ab5040072afbbdba41dae701fd294a05a2
SHA512 199338df19dba4f136b5f38080e7c3c6988368d754e45ba636315331597b8c4ddf23cbeb342c92c2747c855f60574dc90e89b66d7590cbb31028497b943f1785
TLSH
T156D02223130DB0B5A96D6E8AD06BAC8FC367202408C6DDD451D0DCDC253946C4697280
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe592fd0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe592fd0.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 30efe00c93c03faa944ff84549dd00439b0ab5bf91c9d0f896af4b14dccea38f
MD5 930bd479c3494a7160e90a8593da78b4
SHA1 176997c1da595bf3667b49f892597d78e5bd3e40
SHA512 3255c30e4aaa32a033476c64dd0720d83fbba31aef2bf9ed2af3892da7b93a726a9e63ecd795addfc5910243d3d5afee460081015cacbeed6e9ada37846729b4
SSDEEP 192:sxZrR8Wf/fuIs+XIdp8nHW6+WNmTI/Y36J09IgrJ:sxZrJf/ffs+4iHbZ/X69
TLSH
T10522C6166E28A97B8CCBD209FA25BF53D6F9503291D51E48AAFC861C04E66CD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 92af2fa7432f7e66f530980a59f10cd271094dd1841bc24966ab31e4321b4a3b
MD5 df29543779c39e5178b5789552578a4c
SHA1 8d564062cc65cd95c32601ac9c691f9126cdba48
SHA512 71338e1ffaf2a5cd62c13488f322fe7575b5e79b1cb2ee37bceeb4b2687714b638b15667b7583fd2512ef0c36ed24ca94f81b85b93d01c3e1c5b83b0781d55c9
SSDEEP 384:sxZ61mzf/ffsAeHseHbsjgC/XffofrI94ofrl:si1mzf/f3ehHb+IfEffZ
TLSH
T12882B6562A14C9778CCBD919EE357F52D7F910628C921E8CAAFCCA1C04EE6FD2217817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 d08e61d78c9b00d518ced787982225082bfa18941aa0359fe87dc34d733faef6
MD5 8f47d1fc699d8cc11a0a38cedd99262c
SHA1 36e8c1ba5426fba3d1b81e564b4245161ed7874b
SHA512 1b1fc2dbb76cbbd173a42b56c7d604ae8ddb39378c7f60a5c6cd041c94acee585323bdc720338b2b7a312c8f9854eb320fb572599a312b548ae167ebf2223bd0
SSDEEP 192:sxZ6R8MOf/fuIsAnYbCJdpmxSnHW6+WNBnIA9TI/Y36i09Ig5f5oMmrI:sxZ6LOf/ffsAPtqUHbFjC/X/fofrI
TLSH
T10952E6566A24D9778CC7D519FE347F52D6FC20729C911E8CAAFCCA1C04EA6ED220781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 ffd4051c16205d6a77f2681d57e61fb8e8179ee32a31fbae10fd7f38484d0db8
MD5 d896e36b2a0a29cfc14affef0e39738b
SHA1 38222c398e26a6033be9cba8f5a5a66682d1f66b
SHA512 46789759cc5d9bcb22b77e164b56f012c7f6f8dbdb51c13a9151eb56c473431d352a26b9c7fa00a9740e51ee67dac674765b6e3790c0c363299a73d37184bf65
SSDEEP 384:sxZ61mWf/ffsAeHseHbsjgC/XffofrI94ofrl:si1mWf/f3ehHb+IfEffZ
TLSH
T10282C6562A14C9778CCBD919EE357F52D7F910628C921E8CAAFCCA1C04EE6FD2217817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 96b682ef8b65801232d20e455f181ad51203a0d9142f8e25d9a48af51260a551
MD5 0cb045635b2c15757ec077b60a242790
SHA1 b92988302cd5c0e79801d5a385bf84ebb29d65b9
SHA512 f4081faf55e28f26b48e28b0ac6915175ab63f8a784400bb491d920620cb7222ba26728ddfe446cd9acaa3b5f4ce621d9d1f1ee2d0e96f1e18b3110a56f5781d
SSDEEP 192:sxZrR8MOf/fuIsXX+qdpmxSnHW6+WNBnIA9TI/Y36Y09Ig51J:sxZrLOf/ffsX/qUHbFjC/XFV
TLSH
T14032D8566E38AA7B4CCBD219FA25BF53D6FD507290D51E48AAFC871C04E66CD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 05236e3a17c210de3451cb452d5bd0361b93e58c1c3e862918159e1ed8e33056
MD5 173ac40c6319ef6007bac81cf15633b3
SHA1 98616a6356bda62807f516fba2b1d62240097f52
SHA512 445bf314e3be10f0cbee6ac86865f58f4e2c48ac59629860955e6d2c115fbf68a4fa9e32fa956c0ccc9e04667181ac333b4f158ecb2f83fb8aad37aae895611f
SSDEEP 384:sxZ6jmWf/ffsA1Hs8Hb4jgC/XffofrI94ofrl:sijmWf/f31dHbKofEffZ
TLSH
T18B82B5576A24C5778CCBC919EE35BF52D6F920628C911D8CAAFCCA1C04EE6FD2217817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 b685a155864394473a2d45be85d66b6d4473e0a103a75d388f501bbd805fb5de
MD5 9b37640e27f3d2ac4ef578eb34b58b74
SHA1 0699ab09085de50a316d22ec7456ccba6408388e
SHA512 13829f06a68e943689e56475e7fab19710de3e762d955dbb7a0452f5a7a7ffc38065f5d33a3c3a47f82c3d89ea9952f957695079cb90b087e6aba8e361862503
SSDEEP 768:c2Klm7QWvUYm08F1+UoAYDCx9Tuqh0VfUC9xbog/OVh/LlpPs/QroVd:c2Klm7QWvUYm0u1ja8/L/E/7Vd
TLSH
T1D8C2FA3B640CCB7E4FC04E9DDC5A6F976EA802C7A6588D404BFA994C02C77EA51264DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\16ab426a-132e-4002-8b2c-015bc0a100d8\index-dir\the-real-index
Size 72B
SHA256 5f1f80ddaeef74820bc4bf63031bc98445312cd4530b2f937b02b86bae8ecbf4
MD5 840d78384589f923a3fa5cfe1e607792
SHA1 8c59913d773439ad5a19f971701cadf3028cc410
SHA512 9d17fd06160ae9b2f550e1a177d3a63700341e965479fa196a409fd20ca255b23e8dea041b57b69a36271478d1dda08902baaf6c9259380fb93c588ba35ccaf2
TLSH
T1B3A002580A830C01D407B2F0A5D635753330CE390341231747E2148CDDB25895D8100C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59140b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\16ab426a-132e-4002-8b2c-015bc0a100d8\index-dir\the-real-index~RFe59140b.TMP
Size 72B
SHA256 dfd137473801874f518462bf6b669e2fcc8dfe937bd3329dfbe922bdd0518136
MD5 f6ca672afc249de14ac0b015cf54a746
SHA1 ff406679be224480a15a386b85f4c3e546725352
SHA512 195410422540baa09dfb725eab66522354bea865a9d0e4e478ae63b372378ef51e7a41a058dbee486abccf328c9944c5d39e1dcf4d95fd952b4605e6f9e8797b
TLSH
T100A002130380150DD212A1F1296202651353E9A21154532B4093504BCC504485FA138C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8cb62016-7ab1-4b68-9f75-0b250262aa2a\index-dir\the-real-index
Size 168B
SHA256 ed8443d0f0deaf7488c9e88cf42fb71b620e2b9a6be0aa1965d6efeb6f42595d
MD5 059bfea06a2c2ef94c9a75e0bd112014
SHA1 df612a9a276a6860f235767e5d710580c84d86c7
SHA512 e66f410dab5f38710172d64e4bc46e513356dfb2530bf5282a408675ad5b773241d30456a71250420d4e27946564026af38cb2ce3b433855c360630756c22b8e
TLSH
T127C09264CDA561C2F8F98BB459BF10716D6028FD5568025640FDE048DD966E4E949228
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8cb62016-7ab1-4b68-9f75-0b250262aa2a\index-dir\the-real-index
Size 3KB
SHA256 043e03fd52a3e5d3e9b3b5cdf2709693916403e56f92832374c3005851fdf1c9
MD5 b11d09b0c0c41d1c8ee90affcda441b1
SHA1 4430190cb5b4e163a61d7eb78301d27497c68cf6
SHA512 b969e40468e70bebca3b4496b9fead9a022192d71c15bb08af00696fa86bafd6d4e54c8f32e61d02dd0963503e9bbac7f71353589636b423e66759c25021793b
TLSH
T16751D80E0D476F1AE8ACA6B104B204053B787AEC63981E2764FE9535FCC77795D8C66C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58be88.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8cb62016-7ab1-4b68-9f75-0b250262aa2a\index-dir\the-real-index~RFe58be88.TMP
Size 168B
SHA256 7709bfca2e1376ff8993c32c67b804299ddffe434f4296d16636bf80dcbfbd52
MD5 a14bf2536cf63fbbd59c1aceea56f65f
SHA1 2d19618ea1485917a229696284e3d496e0a46217
SHA512 0cf9df37378aaeb08e2a19621caee931660d370de866a8df80aa5f2319d716fa8e26b64477bda954dbdcc823dafcc5275bc2ff1c7a3f6350b4610bd99ecc16c7
TLSH
T1CDC01224CEE66645F57987B05CFB11722D106C3CD42017B340FEE044DD23AA4DE85715
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\a176a39a-f950-43f5-9fe0-8391e92ffbcd\index-dir\the-real-index
Size 72B
SHA256 88ffd1cab6562d6ef51321950ffc2ebd6eb1572e444c0e7577464896641d3cbd
MD5 7492f6abfccc2933e1d73c4c442e9268
SHA1 ef46e46f535bfa2edc2a0d551fba82b8945eb32d
SHA512 89d0ec0e488d62336f39dffbd500926b3cc3d28061f078ca82fb34975825818d01325755ae3294775a06896bfe916f538029b1faa39edea48b765dca000d75a9
TLSH
T1CEA0026C019C2163D1490BF09A9101587354DE390705471F70D15A69ECD515F5981352
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\a8edd7ca-6c08-4da4-ab0d-ae64c7e88c71\index-dir\the-real-index
Size 96B
SHA256 e4a33214b5aa27b22fe4f8418bdb720fcdf07815defe10282cee385187a3c242
MD5 f8ce48b1b82fd0b291dc682df89e3b01
SHA1 fe375ff31f07e50c84ababde90b4e3b7f22682c3
SHA512 3b8827bbf814961af671e280ee72af9a0898b61257a64ed6968757121e75b01b928bca20e8e22857fe17852a29ff22bfab18dce5e680a37d86e5166341876db5
TLSH
T1F3B0112EB322003AE00283B8A08288A83220882823023222A0B220BEEC003AA880200C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe595431.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\a8edd7ca-6c08-4da4-ab0d-ae64c7e88c71\index-dir\the-real-index~RFe595431.TMP
Size 48B
SHA256 2fac180489ca874d11621d91877a68d3d12ff4835f198d029cedcbe46b0747c6
MD5 25a67a24b14dc611e683336aafcd8962
SHA1 87682ef91f38d1aedb062cbf85bb45e7262df637
SHA512 17f6bc800212373949f1a6a1af48acdd23e659f4c84c7250216a3c3dc06bc53ca418c6672cc2b0a985bf7d9f5fd70db3d344913bf8f7f73938c871b28fbca961
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\fa2a69d0-ee36-4adb-995e-55759f51cc92\index-dir\the-real-index
Size 72B
SHA256 49046166b6646a1926d8e3daff3070805b80bffd80f28ad738d7d8d3900aa94c
MD5 97a224e176cca2f223f4ec5f32d4a07c
SHA1 135d85a2f9c1e0c74ae8ee934a1150f9ba167654
SHA512 128aa227e2bcc2e7aac0c784984a660808d85e47891f26541759a276272c37d6b2ca0f248325bcdbd27f9e9968d983ef171602371bc84c89d3cb9fcdf5cde1f9
TLSH
T116A0023041C90049C889627828FF4DC826186E949655021547D5BD659C905877302884
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe595440.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\fa2a69d0-ee36-4adb-995e-55759f51cc92\index-dir\the-real-index~RFe595440.TMP
Size 48B
SHA256 938aabb0643b608859ec95a0146788727bbfe280183ec2bed202d2ddb21a3f47
MD5 3c17c93200bfd8635e8afc6f6c9de7ad
SHA1 d64830aef3d0d753e50ac86e08043c56e52a3109
SHA512 4304bffaf9493dda8d2f30c603de240fa57939e565b01d08940782c0b0b3d75a6cbd8e49db4d96115e078d02ccad182d3a867e0c5576f47fbce8143cb4699baa
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 624B
SHA256 68790dc7ac3f65d64d05e2c8290bef1244a1f3cc772067502e3c7e01c54c0825
MD5 06c4c7979b82a752f721d2ed88cdc259
SHA1 cd7c1894f991da32c3e1371e0219514adf4d4811
SHA512 6f6d973bd71090eb3fec2236558540ae1a282a56aaf61b7c8576a6212711f8d9481a8c993513609cf0a318d00d1e25bef370be323bd0cc41d1a3115ba3a4c085
TLSH
T178F0F4B36EF72811FCAFA3DA203104B400147C89C415ED0F552669965477755956CD62
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 519B
SHA256 521e8ece122e1c28598ad824fa431232f0a34c4daebc3d13092025e8f1669c7b
MD5 80cc6dd8c818daaef2d47450fac3ba31
SHA1 a1d461ae4247c72cc65f2fa2cdb40a79c031b744
SHA512 b96c7810d9dd90d0d5cac11e2abe72d4871770924ef3383eca583c00a144e36b9c670c1996982465f9b2bb538535cfc75bcdd2eecf9f328608a432a3cee2f5e2
TLSH
T1A7F09EB23FFB3800FC6FA7D6303148B44064BC44D809ED0F152BA4862477B41A058E73
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 619B
SHA256 2dfa3b354e25e00a72600bde805a07f1a36ff75ecd11e829592cea354ecaed53
MD5 d40df2ee68ca0c0e537969f6a3d43ce9
SHA1 2272befbbab3d30f60a602f60acf685fa308544b
SHA512 2bd0803a86f96e2599777793a6d22dd110adaf6f0ea6a5ef0f1f983e5457d0beadcbbe7c5997e9770a2eb0d6b2b5f13e497115fa9b6120e50336711417206a36
TLSH
T1CAF028B37EF72811FCAFE3D6203144B400147889C564ED0F552659965477B5494A8DB3
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 fd47b70df93754b9d2d38389b5bc3898ac02d371e2a7e5fe8345c5e59328051f
MD5 9eaa7721cd5de3b94bab6addf6470595
SHA1 873b7045247c1bbac92c8874930cd6fb74363658
SHA512 0ddd4e6d594e33b8ef53ac0108e4cdbc1743a9765654effff7bd38d6d67030375cc106eb3aa87a4025ded56174e7e59039b5cd656e6e5ac30fe669f127c30f42
TLSH
T130A002269F7980C5C101477490A606D7631C999D0715221290EDD1548C7114A6193145
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe591563.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe591563.TMP
Size 48B
SHA256 64804dfa83e2a0724b19dfb8b8835af1f42840a4244cb86392f131924a6e4889
MD5 dcabd051ed50035ea51317bb5c736f85
SHA1 d81097ebdeb431c3ac0f244e8bc6b1e05810a1d8
SHA512 f08b00fa4015ac63ebc8697edf8c25c1b221e2fbae67056ee2180e7d5ec5891ef7299400ec6e8197aade2bfb9730df3898516a4194ee2bcbd275d500b4979b5b
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 0656ba07648356f82f83cb7750dd47ef393dbdaefefdf472e99960311b4851d0
MD5 a06511f2c9bd7f90431e272b00066039
SHA1 0aa2931d9a1fb839822a327c5422fbab69aa9e60
SHA512 ddc4a7ab66591ca63a619b32355165093e43891a7168c4f607e21927e50d12df8173a569b9fccd7391becec4eb45b53b945106648a6b634bc7c9ea879a5c7084
TLSH
T1B4A002311F552286C40F0E70149D03422F25D9654255076358E351C68E615C05E65005
MD5 SHA1 SHA512 TLSH

Submit Download

684d9546-e543-45a5-9ece-49d7e0618560.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\684d9546-e543-45a5-9ece-49d7e0618560.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 e1ff02002eb80ecc2239b9e0cb1cb834589f61eb9d9cf483777c74d3b27781f9
MD5 1d872a4efbc1647043ec75f1d6931057
SHA1 e7bf1c0767cc8933157f1e4679c69e302b7d452a
SHA512 7836e2b74bf1d0082bd98b951a71a404c5f5484fa31c07d75b5e28a13114caac3df721f0bb22f4da63f81c593fa2dc60d475e67172c97b7a59e519ad3356d777
SSDEEP 384:HZcIhsNZ+LboqCh//S1uNtgOIwZOyPioH:vhFq/VNXsrQ
TLSH
T17A827C366C789C776CEBA144F18736039FB89067D7C45F90D5EDAB2D02EA5A8030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 59f2494668d41ecb711deb4a4d1271ece5ed063b7e33f52992846794f5343a6e
MD5 e3ce1c2477c66eaa09d62942c6559bb9
SHA1 3f090806505b92c21ac93183c1c45d36c94b28ed
SHA512 d8f9cce1f94e7103d12131dd6b009be93f0cb59c13f9eba7d5852accec296b0309fbd46e89ae7fd55cbad1ca3de304a4a78415d9fece83628e8a94329127da34
SSDEEP 384:wZcIhsNZrT+b43Gh//S1uNtgOIwZOyPioH:OhEW/VNXsrQ
TLSH
T1C8827C366C789C776CEBA144F18736039FB89067D7C45F9095EDAB1D02E65A8030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 37e8750dbf2e8a08859fcd43c7db17c886eed60feb7385f5b9fa99cd87d3895c
MD5 679006e78e32e6611d6132a9b3682de4
SHA1 ac29adc89e1e879cbdc8bcab7123f4e6c7d668e3
SHA512 a0352c7066be48fc31af5282061fb77c22aa392928769c31b80c7c10604cc727726404fe9f65a0bbe0f63220b88b86439a0fa59e21e62267bac666b82137bec5
SSDEEP 384:IiFPZcIBTsNw8TUNTUlIlbT+bpUlIh//S1NNtgOIwZOyPioH:TFHlTwgLlU/yNXsrQ
TLSH
T140C208F658D78876D8AE8743B37E2D028EBCD063B5849A90B3985A1DCD960BFC307C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ff3d8d96e9a3d8d4e3f4c70e4937c6c2039ced581a0012bc697ae62f95e8bc5a
MD5 c5ee89ce208603c656678cfcdf6ee6dd
SHA1 440b88a148c614fb8a02ed413ee672c45dab9a6c
SHA512 0bde4bb84c9f85124a158f2e2b585935407d4c031b4d9a9e55681b5325224c828cb46e012b07fd9e93fde4aa01199f6321ddb2d5d0352ab707c4be897362771d
SSDEEP 96:KqONkTtQsjpfbUmjH5ih/cIPURHl8h4otop51aD1BKP4v+Y1xf//ojdNxIYiCywX:BONa26JUm0QmiUy2Lso//2ywTBCRwU6
TLSH
T16F02B839BC24AC7B8EE3AE45F4477B239FA4107BA6951F40DAE91F1D01D715C1346C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 38f86df9f9b043c51e695e6e3ed7e05198128b3f53fa6a7bc3dbd8d5d5cd2108
MD5 6a20452e0d2e826d6924cadfb1bd7be1
SHA1 7884386a132ce91a92c1ef3066cf923731099c67
SHA512 01106b9dd9a284bcc16d90a52cdb7f24dad7471691bfc6e7c3ad62e414d5ea31643393f1b8eeab605923b502d31a4e766b9d02a46753baedaa86e5f04d2e82d8
SSDEEP 384:IiFsZcIB6sN78TUNTUlIlnT+bb3Gh//S1WVNtgOIwZOyPioH:TF6Y2wgsW/jVNXsrQ
TLSH
T1ABA26C375CA8C97B6DFB9A44F54A3203CFB450A7CAC59E90E6EDAB1D01D61D8030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c8404032a98668143528e7cd1d6bb7be6e4b7b9057af1ee50651ce2599a15071
MD5 1f7eaf1ef4779c4048d7ef758eb654b6
SHA1 f567085d2db99f9190654b2ab4f5396f3f68a5b9
SHA512 42d1b616d977cf27a25681a6d980cc25714f1c4b22a0de58cd8f4eb42d0363af284bde582ee5166f14aa66cc2902f651382c5c8808cef34738913f8cea94814f
SSDEEP 96:KqONk8QsjpfbU7TH5ih/cIPURHl8h4otop514D1BQdP4v+Y1xf//ojdNxIYiCywj:BON86JUIQmiUyALeo//2yw1JNxur/SU6
TLSH
T1931208357868AC775DE3A890F08736239FA44067DB896F90D6ED2F2C06EB158534BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 635f69e715eda0a9da475f1c359ba9300fabecbf92491251a328598b656c5645
MD5 97aa60357c61d3e4616ed57e6c4b0efa
SHA1 953d27fac773f307c2c9a3298fe12a0755760e30
SHA512 8756dbb81fff99844810e3b61dcbe866f6810682adb9a7da7a3717038ee7c66658290bfbeb6871dc9408dd4d5f6c07186230b144a2ae2b1cd79db63b0baa0f7a
SSDEEP 384:IiFEZcIBHsNw8TUNTUlIlbT+b1UlIh//S1fNtgOIwZOyPioH:TFi5TwgHlU/cNXsrQ
TLSH
T16EC2F8F658D78876D8AE8743B37E2D028EBCD063B5849A90B3985A1DCD960BFC307C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 74cb9ea2c8b5ee13ae2321006339aca75aa424207f26f5d31fe4930ed604cb90
MD5 cb3d4e2e2884a629590162658af2d758
SHA1 0fe409e5e79c3c3838ee1f20a338b548d4f9d159
SHA512 1774a1691a49410662a211940781c81bffc360833730f25b7aa56eb5108de9920ca4eca2905bb76d706420268bc5aff5e8e904e8458c869dafa4fea225428570
TLSH
T1E5E00906930280B9C07D4375114B2F645BC3D42000B013AA9A28229D1C633112E31F50
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 9f78f1df8a5bf05e2c55db02bf6e2f535fcee15ddfda770d82bda59618266a7e
MD5 af1cb8e962fb74bc6a149528762c0f72
SHA1 d5046158fef90a53ed1db946e990e704a76fe8f2
SHA512 7e359d0d6e92ec92f6113a787e8741016c514a6e43af98ada2fe82016b5ebb6163f6123a92d1b46c77ce05c27b53badb8b08a8bde7b879fa680cc63542a517dc
TLSH
T116E00207930080BCC039433111032F700BC3D42000F0139F9B24234E2C233012F31F40
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 631e71973691f96636e4a87142fdc01b1b06ce4eb0bc4b10270a1590f08bf490
MD5 97d7a8fe169681ef23967a1f2520389d
SHA1 b1c6a7c464f35e9c88306e6720ba6670f0ce3235
SHA512 b79fac55cf1ae377bbad118b451ca437cb1d33784c12fd1364faf27d970ddf525353b58c043095f9ead458bef3af7d7fa7044f0e1fc403074bfab52173bf04ed
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe58fbdf.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58fbdf.TMP
Size 392B
SHA256 e7d0988a5b15f2c30446bdcbe177a9c4bb1aa6a547678285a9339953bce13e20
MD5 9cf5a0bcad938226df2c76212f8c5f54
SHA1 7ecf81500c1a1f29b50db57d055232a34a2f9fd9
SHA512 8aea283627919e105188941866f9ced5efbd7b72ef8339b565f474a7e3e7727cb308bfeebbcc95a89c34f0297826bed1ba42038acd6070a813132ec9ad0fd405
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 4976cbaaab25f296a8df520116db060bb61db40b159aafa2464e3071c10d7f44
MD5 1d24ef073e893162e466cfccb70ce1df
SHA1 397955903113439406a18d9552e6c843ce6f8ae4
SHA512 754ef6596cc3ed8c6475e1c8216de482b07ef684a13dc923a8876382e691388148e0a7ae00f095f34cb2af75ef44f939e0bd75707eb526c644e42fd4cfa912eb
TLSH
T113410958BAEA1148B3B76F46ABF6A86D487FB9372E06D46D10110E4F4763B40C971B33
MD5 SHA1 SHA512 TLSH

Submit Download

prismlauncher.exe

Path C:\Users\Admin\AppData\Local\Programs\PrismLauncher\prismlauncher.exe
Size 9.2MB
SHA256 db0dc06563ddb716c22cbeccb89052a990c3698c50ce9aae25352cbb97f36d2c
MD5 60efa4cffd8122d4c85d32a396810c79
SHA1 537d7a560a5ded8bce38b7f20d8337dc53531b51
SHA512 a6d758c460740ab412605b3089c49b210a862e017dd6df13ba265ea33c2fc3fdb9b041b7d1dcf7bacf3bf31646a39a8f2a2a3333a26877ca86517fda5e586c51
SSDEEP 49152:PVg+NMukaNORX7cdPpuDRObKDuF9zj9wZoiNp+RtkhGCy3wJvK6buix96M1RXVnK:8UMvnyEE2c3l6cn+HPinklsUytX
TLSH
T1AEA6AF9F63A902E0D179C27CDB4A1546E5317823432099EB711DFEA65F336E22E7DB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vc_redist.x64.exe

Path C:\Users\Admin\AppData\Local\Programs\PrismLauncher\vc_redist\vc_redist.x64.exe
Size 24.4MB
SHA256 cc0ff0eb1dc3f5188ae6300faef32bf5beeba4bdd6e8e445a9184072096b713b
MD5 486f81facf798678c3244c7cf35a557f
SHA1 21ce0ee54bff57f69fafa741025bf2f15b356405
SHA512 e131b93acde5ffc76c19eb0784183a1e94dfa9fe06111a7830eae3ad8583895575dd4dca66aa70efddb243c95735a0105efcd3042b4b5ca445d3d8e8c39d957e
SSDEEP 786432:mjjpx5hYBug51eEdO41UnAyijgtUHFt9q4YYOQdV:kpx56Bu61eGv1pjg6pb
TLSH
T10A473332E0448026EBE61037A168F5206F7CF624A3649ABBD6CCED0D37B649717FB615
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zlib1.dll

Path C:\Users\Admin\AppData\Local\Programs\PrismLauncher\zlib1.dll
Size 103KB
SHA256 b696f1f0ddf182ffb1245e5ff41883d4d8c454a8fc720fa99e6c2a20db64baf1
MD5 b8b882032c94ec670c3f4a27a9a652ff
SHA1 3e66bf7b6919fbb9e04b21d5a562518f7bdabe87
SHA512 efb0a181d7e900ff9cb6fb0e2fbf335886f11269ac649b3b93650a084fa64ee61e39c786bfaa3b84235493431c753b38d3f4f63037287052de57e31c4a3346ea
SSDEEP 1536:ZvEyaXGzTqbvqRfSOzhppf/ISUaYuOlqjebaIOcIOZCdGULHU5a9IfIkG5:SdXozVhppnURkeboSZCdGULf1
TLSH
T10EA3AE8A6A7412A2D6F78174D8D28B9ED33471510BA04BDF5158A3961F13BE02F353FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd_vcredist_amd64_20260925172145_000_vcRuntimeMinimum_x64.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260925172145_000_vcRuntimeMinimum_x64.log
Size 2KB
SHA256 45c0efe173cc9ba25274eb5ea9415cbb7c164c259c91bf59f9a57d9e678a6535
MD5 54650b9632ad1b8efda44f9f19e16e79
SHA1 b0b5326fcf1259af97b2a99f4e7bab7991b48f54
SHA512 3fabefa3813402c95cfeb31c45123444597713faaaea486c342985c5cefbbbbb7ae0866cb028be7013ee75743c4c52fed4564e1e8e20970b8bedeb5569a2bf80
TLSH
T17F41F5291AE80919B1F79747EBF380226A33FCE96975CB4C1385421A4267C017CAD7EE
MD5 SHA1 SHA512 TLSH

Submit Download

dd_vcredist_amd64_20260925172145_001_vcRuntimeAdditional_x64.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260925172145_001_vcRuntimeAdditional_x64.log
Size 2KB
SHA256 170b1b252524706fae36ca0b7d1d7b15a42a4bd61567549e6646e17daf138406
MD5 844f25a700c666f6d087c6cd9ca13c48
SHA1 f7e3ce0756386d41e8a004a0dcf4ce0938398ee8
SHA512 1c03a44e4b14c5e9f975f6937400f3e8230aabcd2f34a279098015a0ee42e1a987a0a63228629d053e341aaae8aed959acea536b23fde1e0a986620339f35101
TLSH
T13541EA2D1AF5080DB1B6D747ABF3C0130A33FDE964758B0C13C957194667D0679A87E6
MD5 SHA1 SHA512 TLSH

Submit Download

NScurl.dll

Path C:\Users\Admin\AppData\Local\Temp\nsj3FFE.tmp\NScurl.dll
Size 6.0MB
SHA256 d9438094e22bd3183864b712e2cbae07f6b184a5ad7b018185e425e215feaca9
MD5 bf43de0fb8a2c38abcf7b1cf6be7e7ce
SHA1 5c14855ddbf563da3bc14af40ea5650d627ab81d
SHA512 145388afde1367253d723ea78501dfd61ebcfb17d440d324dbceb5d9b1c50dbd5a69946209722396f1d0f3699dc967bedab690dd670eedc9910b75a4e7d13830
SSDEEP 196608:ohFz25oFKhmagHDetua42OOMoMy+Tgt/VqiWWO+ac88vdPkR:oXmSLTgtDqU
TLSH
T1DA563994FECB44F1E91384B0D8DBA37F9B349B118021D6BAFE4C5E56F933701252A25A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsj3FFE.tmp\System.dll
Size 12KB
SHA256 23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6
MD5 192639861e3dc2dc5c08bb8f8c7260d5
SHA1 58d30e460609e22fa0098bc27d928b689ef9af78
SHA512 6e573d8b2ef6ed719e271fd0b2fd9cd451f61fc9a9459330108d6d7a65a0f64016303318cad787aa1d5334ba670d8f1c7c13074e1be550b4a316963ecc465cdc
SSDEEP 192:ljHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZqE0QPi:R/Qlt7wiij/lMRv/9V4bfr
TLSH
T1B1427C1297B089F2F551493419667F2A6FBEAC5C13F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsj3FFE.tmp\modern-wizard.bmp
Size 25KB
SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
TLSH
T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsj3FFE.tmp\nsDialogs.dll
Size 9KB
SHA256 89a82c4849c21dfe765052681e1fad02d2d7b13c8b5075880c52423dca72a912
MD5 b7d61f3f56abf7b7ff0d4e7da3ad783d
SHA1 15ab5219c0e77fd9652bc62ff390b8e6846c8e3e
SHA512 6467c0de680fadb8078bdaa0d560d2b228f5a22d4d8358a1c7d564c6ebceface5d377b870eaf8985fbee727001da569867554154d568e3b37f674096bbafafb8
SSDEEP 96:ooEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YMNqkzfFc:ooEvCu5e81785qHFcU0PuAw0uyyIFc
TLSH
T16A12F992E2A454B3C5D6523B35AA2F2DCBBD5329B0927C01C7738E4D393957A6E38343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsj3FFE.tmp\nsExec.dll
Size 7KB
SHA256 2cd3a2d4053954db1196e2526545c36dfc138c6de9b81f6264632f3132843c77
MD5 11092c1d3fbb449a60695c44f9f3d183
SHA1 b89d614755f2e943df4d510d87a7fc1a3bcf5a33
SHA512 c182e0a1f0044b67b4b9fb66cef9c4955629f6811d98bbffa99225b03c43c33b1e85cacabb39f2c45ead81cd85e98b201d5f9da4ee0038423b1ad947270c134a
SSDEEP 96:JgzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHIDQ:JDQHDb2vSuOc41ZfUNQZGdHA
TLSH
T1D5E1093571C02DF7D08D897438167D2F43F4D52627BA05B046771AD579D0AF6EE28B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prismlauncher.cfg.lock

Path C:\Users\Admin\AppData\Roaming\PrismLauncher\prismlauncher.cfg.lock
Size 66B
SHA256 c2603cde4dd1b05e984946557a1f6d93a6632b6f2cb6cdffd017dd2e0baf51b1
MD5 a8c12d7c6f38248dc41976d2870005b1
SHA1 b8dca29322e517b301ba0d41cfa2bb10587a695b
SHA512 aaa3892aae53866eecdc17c0c78810bb17db8545afe367d1c9ab0ca08f8d4e398e29f084edf14b8a174ed3c8df547f9dc288bda5c0b065d4658797c3c9b1fc0d
TLSH
T1E8A00208DD06CC15A61553464E485F160B64415B39B015F1AEA614E2C16E35E2754084
MD5 SHA1 SHA512 TLSH

Submit Download

license.rtf

Path C:\Windows\Temp\{18A44835-90B0-42BC-B422-C738F7715BDF}\.ba\license.rtf
Size 9KB
SHA256 8099dc3cf9502c335da829e5c755948a12e3e6de490eb492a99deb673d883d8b
MD5 04b33f0a9081c10e85d0e495a1294f83
SHA1 1efe2fb2d014a731b752672745f9ffecdd716412
SHA512 d1dbed00df921169dd61501e2a3e95e6d7807348b188be9dd8fc63423501e4d848ece19ac466c3cacfccc6084e0eb2f457dc957990f6f511df10fd426e432685
SSDEEP 192:H8kZ1UVDWkiWZTIsp/4hghFF1Qf4lCfnEtHixEGx736wHqItfSpOtJ32:cM1RWZMi/zzlOnjt5HLoa2
TLSH
T13F12A7A8234783D103D213D7055294C1B71F0BF6AE7AF95C34E4D53826E2E6CB6B91E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{18A44835-90B0-42BC-B422-C738F7715BDF}\.ba\thm.wxl
Size 2KB
SHA256 70400f181d00e1769774ff36bcd8b1ab5fbc431418067d31b876d18cc04ef4ce
MD5 fbfcbc4dacc566a3c426f43ce10907b6
SHA1 63c45f9a771161740e100faf710f30eed017d723
SHA512 063fb6685ee8d2fa57863a74d66a83c819fe848ba3072b6e7d1b4fe397a9b24a1037183bb2fda776033c0936be83888a6456aae947e240521e2ab75d984ee35e
TLSH
T11F519B6778CF639028335125EAD2966A6920C5DC923F2DF1FC4A914B838D522A373F57
MD5 SHA1 SHA512 TLSH

Submit Download

thm.xml

Path C:\Windows\Temp\{18A44835-90B0-42BC-B422-C738F7715BDF}\.ba\thm.xml
Size 8KB
SHA256 f13bae0ec08c91b4a315bb2d86ee48fade597e7a5440dce6f751f98a3a4d6916
MD5 f62729c6d2540015e072514226c121c7
SHA1 c1e189d693f41ac2eafcc363f7890fc0fea6979c
SHA512 cbbfbfa7e013a2b85b78d71d32fdf65323534816978e7544ca6cea5286a0f6e8e7e5ffc4c538200211f11b94373d5658732d5d8aa1d01f9ccfdbf20f154f1471
SSDEEP 96:8L2HdQG+3VzHfz96zYFGaPSWXdhRAmImlqFQKFBiUxn7Ke5A82rkO/pWk3nswP:ZHAzZ/3
TLSH
T1D30259B546DDB801D232FB1166E231D27F126971C0C46E59F90C2AFB5FE1140A8B72BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixstdba.dll

Path C:\Windows\Temp\{1D842D7D-9469-469A-8694-EE782E3AF48F}\.ba\wixstdba.dll
Size 191KB
SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
MD5 eab9caf4277829abdf6223ec1efa0edd
SHA1 74862ecf349a9bedd32699f2a7a4e00b4727543d
SHA512 45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2
SSDEEP 3072:OXoiFK6b0k77I+QfaIl191rSJHvlalB+8BHkY6v53EfcUzN0m6I+WxBlnKzeZuqt:OXoQNb++gDrSJdr8BHkPh3wIgnK/IU1a
TLSH
T103149E11B5D0907AE7FB1A385938B5216D7FBA201B60C99E17589D6F2DF02C0AF35B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vc_redist.x64.exe

Path C:\Windows\Temp\{7DB781BA-1DF9-4B73-AD92-1F9A8E53FAC1}\.cr\vc_redist.x64.exe
Size 670KB
SHA256 568c9ba533624084ea18f7a562b4aa2249ed4e41281524a061a0d0b1008cf6bd
MD5 bc9c8a6a42e8d3ea18f8da78d5031820
SHA1 07812a4b945364d04627363e46ab38de188281b3
SHA512 b583f41b8f9cbb2b04e4c7403b54241bf4c51caefdb0bbe9184202dc615f599b496d65f6d36984b75f9b9003289c0c13066dc1e6eb294f9139248595114b4f73
SSDEEP 12288:n3mgqnIZuYfCYqFet4CovkM7x61nE4rfDDIcbMZ3Mya:n3WnIZuMCxezot7MhbfDBMZ8ya
TLSH
T10DE49E32A5604033F7F10573B928A6303E7CE3282B51C9A9D7D4AD1D7EB4892A7F7256
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logo.png

Path C:\Windows\Temp\{D965D8C1-4AC4-4C56-ADB0-80C5F9C17C2F}\.ba\logo.png
Size 1KB
SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
MD5 d6bd210f227442b3362493d046cea233
SHA1 ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
SHA512 464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
TLSH
T1CF312CF34748B7A7D30581351471819AD242FFD8F9CE291E35CD5307664018115C75CF
MD5 SHA1 SHA512 TLSH

Submit Download

wixstdba.dll

Path C:\Windows\Temp\{D965D8C1-4AC4-4C56-ADB0-80C5F9C17C2F}\.ba\wixstdba.dll
Size 215KB
SHA256 e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
MD5 f68f43f809840328f4e993a54b0d5e62
SHA1 01da48ce6c81df4835b4c2eca7e1d447be893d39
SHA512 a7a799ecf1784fb5e8cd7191bf78b510ff5b07db07363388d7b32ed21f4fddc09e34d1160113395f728c0f4e57d13768a0350dbdb207d9224337d2153dc791e1
SSDEEP 6144:K6EZdi6e93SuDeTKZxQfsRy26BqbUHYJe:K62i6eNSYeuZ2sRDK
TLSH
T15E24AF12B5D0907AEBFB19305939E5216DBDBA210FA0C9CE5348AD2B2E705C1DB36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cab2C04DDC374BD96EB5C8EB8208F2C7C92

Path C:\Windows\Temp\{D965D8C1-4AC4-4C56-ADB0-80C5F9C17C2F}\cab2C04DDC374BD96EB5C8EB8208F2C7C92
Size 5.4MB
SHA256 7dee5b77719fb6a6627145357c5a93bf8af2a9de54d34c79ffc1ae71d52c79f5
MD5 ea81447ef1038bd5726b36063896b39a
SHA1 8f484a24bfe42276580d120c200a99bf604eea70
SHA512 31fe32db60d9a0579374ce3a51b586ef0fa7b891aebcd33613a818264bb9eeccba4f2b5ac4b95feca144d4be6146e99d9f5dfa7bfa5e11cfae46e06b41da251f
SSDEEP 98304:JnfKe/OhMAf7WUHioDNe/rdRlRFQdU8o2VDF/ZXZsHOtnF9r:hPAzWxZgU85VDbXZs+z
TLSH
T17D4633018111941B63BB250753FCF1518FF2F087A4B672BA3BD2934E4AE78CF59EA51A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cab5046A8AB272BF37297BB7928664C9503

Path C:\Windows\Temp\{D965D8C1-4AC4-4C56-ADB0-80C5F9C17C2F}\cab5046A8AB272BF37297BB7928664C9503
Size 964KB
SHA256 640aa6c516c72444523b8fbe034db46ff4e118ed02705340e3ccb62d426ff040
MD5 efc41c00aadf8b2050ecf9e38e9036f1
SHA1 bc4afc5cb90411f0e4e874372f1fbabab0cfd33d
SHA512 bc9cc1e83acc8dbe53501ca4554dec6d31cb0ccd3609d0e760c7fdbf73fbc4c46baf14c397667eaeced284506d0a9a0bdf7777736f05ae277e9e2f3349371136
SSDEEP 24576:+e9fUQD6DozFBvW8lRBAaKycdSCTbiVTPf1eg++4:+exUQX/e8lzAjdZTbiVTnw
TLSH
T15625338685244AC1694EEC06B346F9BF74D331FD59B5B8032A262EC8E3D33857593937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcRuntimeAdditional_x64

Path C:\Windows\Temp\{D965D8C1-4AC4-4C56-ADB0-80C5F9C17C2F}\vcRuntimeAdditional_x64
Size 208KB
SHA256 7df26ee2169ef6c61c17675e1a2edbaf01bca2ed1a0bdc0f8396d029a336c1f7
MD5 f375f3d81a661e188146d701d8ed3ba9
SHA1 0851e6da56fa65981ae27d9eb7e396afe1ea0c73
SHA512 d67709e2f25ad12532ed33d26c0ae365b7a4eb0e6711b2ee7dda489480b9976b4bbfd0b902cbb847cb602922a1653a2981741718fdec4091ae25f07fe5b8bf2a
SSDEEP 3072:F9laht5Xel69YGnfxC2WB/bEPcefrKROjibDPxriT6qF:/laZeKFxCnBheIdlu2q
TLSH
T19E24AE12B5808033DAFE1A311178DB615F3D7E608F544A9B6364B6AD1E717C08F3AAB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcRuntimeMinimum_x64

Path C:\Windows\Temp\{D965D8C1-4AC4-4C56-ADB0-80C5F9C17C2F}\vcRuntimeMinimum_x64
Size 208KB
SHA256 fe5af8f2efc9bbdd2c23f22f2d3daf480a4047acf3b1edc6ecda81147c1ec14f
MD5 23626831f9a05572c6ebd133e5ffc4b0
SHA1 ad044cdf938a5532aa270c6bc687db95d803fe10
SHA512 1b45ea55e7278ec61f0689b70794f371d56eb2787c22106ebec38d17f1670441a853849460249d08380053bc8b2fae0285845b47ad62670029639d5de5ace10c
SSDEEP 3072:o9laht5Xel69YGnfxC2WB/bEPcefrKROjibDPxriTA:+laZeKFxCnBheIdlu
TLSH
T1A3249E12B5808033DAFE1A311578DB615F3D7E608F54899B6364B6AC1E717C08F3AAB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1780-2025-0x00007FF6D2990000-0x00007FF6D32C8000-memory.dmp

Download

memory/1780-2026-0x00007FFBB30C0000-0x00007FFBB3707000-memory.dmp

Download

memory/2080-2136-0x00007FFBB30C0000-0x00007FFBB3707000-memory.dmp

Download

memory/3300-2156-0x00007FFBB30C0000-0x00007FFBB3707000-memory.dmp

Download

memory/3300-2155-0x00007FF6D2990000-0x00007FF6D32C8000-memory.dmp

Download

memory/3648-2010-0x0000000000440000-0x00000000004B7000-memory.dmp

Download

memory/5372-2011-0x0000000000440000-0x00000000004B7000-memory.dmp

Download

memory/5596-1812-0x00000000733B0000-0x00000000739C0000-memory.dmp

Download

memory/5596-1732-0x00000000733B0000-0x00000000739C0000-memory.dmp

Download

memory/5864-2008-0x0000000000440000-0x00000000004B7000-memory.dmp

Download