Analysis
- user interaction
yes - max time kernel
329s - max time network
331s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
03/10/2026, 17:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Dusk.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
31 signatures
150 seconds
General
- Target Dusk.exe
- Size 5.3MB
- Sample261003-v3d46atcmd
- SHA256 b5bbd8c3ff339fcb04d7fff28fc49fdb0ea47572f2dc6219b43effe2ccc7be5d
- MD5 ce219500a6caff29427ab002ad7f1f64
- SHA1 afae25daf3e322104d211f05ae5945f22daeb344
- SHA512 a2693f3021a44af51089bf1b1a524307f69f84c46d46fa5319665093cdef4a6bfcda5f93b58d84f5bac79800e7d45cbcf43f27ff6636538089bcd3eb3f012746
- SSDEEP 49152:h/OsUSmeRgu4EIzFkeAgZvVUVRxAa/nxWie+Zb/3QQddUUZZzz3wtCjl0+LOsGH0:h/jUj84eYQJjGHK4T6hl
- TLSH T1DE466C2177AC9933D55E5776E5F24D1063B2A812BB2AD78E30CC236C0FA37D6A914393
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Downloads MZ/PE file 2 IoCs
flow pid Process 77 4224 msedge.exe 363 4224 msedge.exe - Executes dropped EXE 9 IoCs
pid Process 4992 windowsdesktop-runtime-10.0.12-win-x64.exe 624 wixstdba.exe 4080 windowsdesktop-runtime-10.0.12-win-x64.exe 1220 windowsdesktop-runtime-10.0.12-win-x64.exe 4508 windowsdesktop-runtime-10.0.12-win-x64.exe 1096 wixstdba.exe 3796 windowsdesktop-runtime-10.0.12-win-x64.exe 1040 Dusk.exe 5128 Dusk.exe - Loads dropped DLL 64 IoCs
pid Process 2904 MsiExec.exe 2904 MsiExec.exe 2252 MsiExec.exe 2252 MsiExec.exe 4220 MsiExec.exe 4220 MsiExec.exe 4548 MsiExec.exe 4548 MsiExec.exe 2284 MsiExec.exe 2284 MsiExec.exe 4524 MsiExec.exe 4524 MsiExec.exe 1040 Dusk.exe 1040 Dusk.exe 1040 Dusk.exe 1040 Dusk.exe 1040 Dusk.exe 1040 Dusk.exe 1040 Dusk.exe 1040 Dusk.exe 1040 Dusk.exe 1040 Dusk.exe 1040 Dusk.exe 1040 Dusk.exe 1040 Dusk.exe 1040 Dusk.exe 1040 Dusk.exe 1040 Dusk.exe 1040 Dusk.exe 1040 Dusk.exe 1040 Dusk.exe 1040 Dusk.exe 1040 Dusk.exe 1040 Dusk.exe 1040 Dusk.exe 1040 Dusk.exe 1040 Dusk.exe 1040 Dusk.exe 1040 Dusk.exe 1040 Dusk.exe 1040 Dusk.exe 1040 Dusk.exe 1040 Dusk.exe 1040 Dusk.exe 1040 Dusk.exe 1040 Dusk.exe 1040 Dusk.exe 1040 Dusk.exe 1040 Dusk.exe 1040 Dusk.exe 5128 Dusk.exe 5128 Dusk.exe 5128 Dusk.exe 5128 Dusk.exe 5128 Dusk.exe 5128 Dusk.exe 5128 Dusk.exe 5128 Dusk.exe 5128 Dusk.exe 5128 Dusk.exe 5128 Dusk.exe 5128 Dusk.exe 5128 Dusk.exe 5128 Dusk.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2} = "\"C:\\ProgramData\\Package Cache\\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}\\windowsdesktop-runtime-10.0.12-win-x64.exe\" /burn.runonce" windowsdesktop-runtime-10.0.12-win-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2} = "\"C:\\ProgramData\\Package Cache\\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}\\windowsdesktop-runtime-10.0.12-win-x64.exe\" /burn.runonce" windowsdesktop-runtime-10.0.12-win-x64.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
flow ioc 143 mediafire.com 136 mediafire.com 137 mediafire.com 140 mediafire.com 141 mediafire.com - Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Z: msiexec.exe \??\F:\ msiexec.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\zh-Hans\System.Windows.Forms.Design.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Runtime.Serialization.Primitives.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Threading.Tasks.Dataflow.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\Microsoft.VisualBasic.Core.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Reflection.TypeExtensions.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Web.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\DirectWriteForwarder.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\ko\PresentationFramework.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Threading.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\Microsoft.Win32.SystemEvents.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\PresentationFramework.Fluent.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\es\PresentationFramework.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\fr\PresentationCore.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\ko\WindowsBase.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\pl\Microsoft.VisualBasic.Forms.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\pl\UIAutomationTypes.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\ru\Microsoft.VisualBasic.Forms.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\tr\PresentationFramework.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\tr\WindowsFormsIntegration.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\es\UIAutomationTypes.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\it\ReachFramework.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\ru\System.Xaml.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Diagnostics.Contracts.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\cs\System.Windows.Controls.Ribbon.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\de\ReachFramework.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\es\System.Windows.Forms.Design.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\fr\System.Windows.Forms.Primitives.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\it\System.Windows.Forms.Primitives.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\ja\PresentationFramework.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\pl\WindowsBase.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Text.Json.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\cs\System.Windows.Input.Manipulations.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\ko\System.Windows.Forms.Design.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\pt-BR\Microsoft.VisualBasic.Forms.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Dynamic.Runtime.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Net.WebSockets.Client.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\PresentationFramework.Classic.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\ko\System.Windows.Controls.Ribbon.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\tr\System.Windows.Forms.Design.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\zh-Hant\Microsoft.VisualBasic.Forms.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Net.NameResolution.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\PresentationFramework-SystemCore.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\System.Windows.Input.Manipulations.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\cs\System.Windows.Forms.Primitives.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\ru\UIAutomationTypes.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\zh-Hant\System.Windows.Forms.Primitives.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\System.IO.Packaging.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\es\UIAutomationClientSideProviders.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\it\UIAutomationProvider.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Data.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Drawing.Primitives.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.IO.Compression.Native.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Net.ServerSentEvents.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Resources.Writer.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\Microsoft.VisualBasic.Forms.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\ja\UIAutomationProvider.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\ru\PresentationFramework.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Memory.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\de\UIAutomationClientSideProviders.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\ru\ReachFramework.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\ru\WindowsFormsIntegration.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\zh-Hans\UIAutomationClient.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\Microsoft.DiaSymReader.Native.amd64.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Private.Uri.dll msiexec.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\Installer\e5964a8.msi msiexec.exe File created C:\Windows\Installer\e5964ad.msi msiexec.exe File created C:\Windows\SystemTemp\~DF028017630A0B4AF2.TMP msiexec.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1776_715739727\_metadata\verified_contents.json msedge.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1 msiexec.exe File opened for modification C:\Windows\Installer\MSI9143.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF185F300956BB97BF.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF7A80D61C8CD6367D.TMP msiexec.exe File created C:\Windows\Installer\e5964a7.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI8327.tmp msiexec.exe File created C:\Windows\Installer\e5964ac.msi msiexec.exe File created C:\Windows\SystemTemp\~DF27B86DA2891FF3FC.TMP msiexec.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1776_575803176\manifest.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1776_1483461281\LICENSE msedge.exe File created C:\Windows\Installer\e5964a2.msi msiexec.exe File created C:\Windows\Installer\e5964a3.msi msiexec.exe File created C:\Windows\Installer\e5964a8.msi msiexec.exe File created C:\Windows\SystemTemp\~DF746D6E099D060A8E.TMP msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149\fileCoreHostExe msiexec.exe File created C:\Windows\Installer\SourceHash{17D94539-A423-48D9-BD4A-69A9186C5B66} msiexec.exe File opened for modification C:\Windows\Installer\MSIA3C3.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB2DB.tmp msiexec.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1776_1483461281\manifest.json msedge.exe File opened for modification C:\Windows\Installer\e59649c.msi msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1776_1257560814\llm_user_input_extractor_config.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1776_1207474662\classification.js msedge.exe File opened for modification C:\Windows\Installer\MSI8E15.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB1BF.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB5DA.tmp msiexec.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1776_575803176\protocols.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1776_715739727\LICENSE msedge.exe File opened for modification C:\Windows\Installer\MSI799D.tmp msiexec.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1776_1117804705\nav_config.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1776_1207474662\travel-facilitated-booking-bing.js msedge.exe File opened for modification C:\Windows\Installer\MSI7BF1.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI7B25.tmp msiexec.exe File created C:\Windows\SystemTemp\~DFF0697D6669C96C63.TMP msiexec.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1776_1207474662\extraction.js msedge.exe File opened for modification C:\Windows\Installer\e5964a3.msi msiexec.exe File created C:\Windows\Installer\SourceHash{E358F0F7-0226-419D-85E6-D45A08BF195F} msiexec.exe File created C:\Windows\SystemTemp\~DF4F034430EE01C9A6.TMP msiexec.exe File created C:\Windows\SystemTemp\~DFA524AE2D16035A0B.TMP msiexec.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1776_1257560814\office_endpoints_list.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1776_1257560814\smart_switch_list.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1776_715739727\sets.json msedge.exe File created C:\Windows\Installer\e59649c.msi msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149 msiexec.exe File created C:\Windows\SystemTemp\~DF5CB5DCC7481500A0.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF6A3A11009639B10F.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF91010F8718DF681F.TMP msiexec.exe File created C:\Windows\SystemTemp\~DFB277FB4CB5F84D52.TMP msiexec.exe File created C:\Windows\Installer\SourceHash{8C704AC7-A0DB-44DD-A1F3-F0FBDF1FF693} msiexec.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1776_1257560814\manifest.json msedge.exe File created C:\Windows\SystemTemp\~DFD5000AE8A6B42387.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF7C65678FBC1BD40C.TMP msiexec.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1776_280442274\manifest.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1776_715739727\manifest.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1776_1207474662\automation.js msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1776_1483461281\keys.json msedge.exe File opened for modification C:\Windows\Installer\MSI7CEC.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI6632.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF5B57A8CAF78741D3.TMP msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
- System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language windowsdesktop-runtime-10.0.12-win-x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language windowsdesktop-runtime-10.0.12-win-x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language windowsdesktop-runtime-10.0.12-win-x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language windowsdesktop-runtime-10.0.12-win-x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wixstdba.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language windowsdesktop-runtime-10.0.12-win-x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wixstdba.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DllHost.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 4224 msedge.exe - Checks SCSI registry key(s) 3 TTPs 39 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A TextInputHost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 TextInputHost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 TextInputHost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A TextInputHost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 TextInputHost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 TextInputHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A TextInputHost.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Internet Explorer\DOMStorage\microsoft.com TextInputHost.exe Key created \REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Internet Explorer\DOMStorage TextInputHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Internet Explorer\DOMStorage\microsoft.com\NumberOfSubdomains = "1" TextInputHost.exe - Modifies data under HKEY_USERS 13 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28 msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2B msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2C msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2d msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29 msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a msiexec.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7F0F853E6220D914586E4DA580FB91F5\SourceList\PackageName = "dotnet-hostfxr-10.0.12-win-x64.msi" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2} windowsdesktop-runtime-10.0.12-win-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\7CA407C8BD0ADD441A3F0FBFFDF16F39\Provider msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}\Dependents windowsdesktop-runtime-10.0.12-win-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\93549D71324A9D84DBA4969A81C6B566\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{17D94539-A423-48D9-BD4A-69A9186C5B66}v80.48.58476\\" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD0172090E5FBE249895CE1CC03C86FD\Language = "1033" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x64 windowsdesktop-runtime-10.0.12-win-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7CA407C8BD0ADD441A3F0FBFFDF16F39\SourceList\Media\1 = ";" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}\DisplayName = "Microsoft Windows Desktop Runtime 10.0.12 (x64)" windowsdesktop-runtime-10.0.12-win-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7F0F853E6220D914586E4DA580FB91F5\ProductName = "Microsoft .NET Host FX Resolver - 10.0.12 (x64)" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD0172090E5FBE249895CE1CC03C86FD msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD0172090E5FBE249895CE1CC03C86FD\PackageCode = "1996005C24BB6ED459236374EB503368" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD0172090E5FBE249895CE1CC03C86FD\Clients = 3a0000000000 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7CA407C8BD0ADD441A3F0FBFFDF16F39\Assignment = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD0172090E5FBE249895CE1CC03C86FD\ProductName = "Microsoft .NET Runtime - 10.0.12 (x64)" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD0172090E5FBE249895CE1CC03C86FD\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\93549D71324A9D84DBA4969A81C6B566\SourceList msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7F0F853E6220D914586E4DA580FB91F5\Assignment = "1" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7F0F853E6220D914586E4DA580FB91F5\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD0172090E5FBE249895CE1CC03C86FD\SourceList\PackageName = "dotnet-runtime-10.0.12-win-x64.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD0172090E5FBE249895CE1CC03C86FD\SourceList\Media\1 = ";" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7CA407C8BD0ADD441A3F0FBFFDF16F39\PackageCode = "42D1166D1B8486B4FB84F5D703BB4E53" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7CA407C8BD0ADD441A3F0FBFFDF16F39\AdvertiseFlags = "388" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\93549D71324A9D84DBA4969A81C6B566 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\93549D71324A9D84DBA4969A81C6B566\PackageCode = "F51312C54E22CEC4182D8D57784720B0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7F0F853E6220D914586E4DA580FB91F5\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{E358F0F7-0226-419D-85E6-D45A08BF195F}v80.48.58476\\" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.48.58476_x64 windowsdesktop-runtime-10.0.12-win-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\5840E2420625E5A4B03C0089F5778860 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD0172090E5FBE249895CE1CC03C86FD\SourceList\Media msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7CA407C8BD0ADD441A3F0FBFFDF16F39\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_80.48.58476_x64\Dependents\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2} windowsdesktop-runtime-10.0.12-win-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ msedge.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}\ = "{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}" windowsdesktop-runtime-10.0.12-win-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\7F0F853E6220D914586E4DA580FB91F5\Provider msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\dotnet_runtime_80.48.58476_x64 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD0172090E5FBE249895CE1CC03C86FD\InstanceType = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7CA407C8BD0ADD441A3F0FBFFDF16F39\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children msedge.exe Key created \REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage msedge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x64\Dependents\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2} windowsdesktop-runtime-10.0.12-win-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.48.58476_x64\Dependents\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2} windowsdesktop-runtime-10.0.12-win-x64.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7CA407C8BD0ADD441A3F0FBFFDF16F39\Version = "1345381484" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902 msedge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\ msedge.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\93549D71324A9D84DBA4969A81C6B566\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A8A84F1AA6E5EFD5BE00C8237B84D6D4 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\5840E2420625E5A4B03C0089F5778860\FD0172090E5FBE249895CE1CC03C86FD msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\7CA407C8BD0ADD441A3F0FBFFDF16F39\MainFeature msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7CA407C8BD0ADD441A3F0FBFFDF16F39\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{8C704AC7-A0DB-44DD-A1F3-F0FBDF1FF693}v80.48.58476\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\93549D71324A9D84DBA4969A81C6B566\SourceList\PackageName = "dotnet-host-10.0.12-win-x64.msi" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7F0F853E6220D914586E4DA580FB91F5\Version = "1345381484" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_80.48.58476_x64\Version = "80.48.58476" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}\DisplayName = "Microsoft Windows Desktop Runtime 10.0.12 (x64)" windowsdesktop-runtime-10.0.12-win-x64.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7CA407C8BD0ADD441A3F0FBFFDF16F39\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7CA407C8BD0ADD441A3F0FBFFDF16F39\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7CA407C8BD0ADD441A3F0FBFFDF16F39\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7CA407C8BD0ADD441A3F0FBFFDF16F39\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{8C704AC7-A0DB-44DD-A1F3-F0FBDF1FF693}v80.48.58476\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\93549D71324A9D84DBA4969A81C6B566\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{17D94539-A423-48D9-BD4A-69A9186C5B66}v80.48.58476\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.48.58476_x64\DisplayName = "Microsoft .NET Host FX Resolver - 10.0.12 (x64)" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\245448558535FDC5C8905F329F49898C msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7F0F853E6220D914586E4DA580FB91F5\SourceList\Media msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.48.58476_x64\Dependents\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2} windowsdesktop-runtime-10.0.12-win-x64.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD0172090E5FBE249895CE1CC03C86FD\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_80.48.58476_x64\Dependents windowsdesktop-runtime-10.0.12-win-x64.exe - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4632 TextInputHost.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1048 msiexec.exe 1048 msiexec.exe 1048 msiexec.exe 1048 msiexec.exe 1048 msiexec.exe 1048 msiexec.exe 1048 msiexec.exe 1048 msiexec.exe 1048 msiexec.exe 1048 msiexec.exe 1048 msiexec.exe 1048 msiexec.exe 1048 msiexec.exe 1048 msiexec.exe 4632 TextInputHost.exe 4632 TextInputHost.exe 3024 msedge.exe 3024 msedge.exe 1040 Dusk.exe 5128 Dusk.exe 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4196 osk.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 21 IoCs
pid Process 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4080 windowsdesktop-runtime-10.0.12-win-x64.exe Token: SeIncreaseQuotaPrivilege 4080 windowsdesktop-runtime-10.0.12-win-x64.exe Token: SeSecurityPrivilege 1048 msiexec.exe Token: SeCreateTokenPrivilege 4080 windowsdesktop-runtime-10.0.12-win-x64.exe Token: SeAssignPrimaryTokenPrivilege 4080 windowsdesktop-runtime-10.0.12-win-x64.exe Token: SeLockMemoryPrivilege 4080 windowsdesktop-runtime-10.0.12-win-x64.exe Token: SeIncreaseQuotaPrivilege 4080 windowsdesktop-runtime-10.0.12-win-x64.exe Token: SeMachineAccountPrivilege 4080 windowsdesktop-runtime-10.0.12-win-x64.exe Token: SeTcbPrivilege 4080 windowsdesktop-runtime-10.0.12-win-x64.exe Token: SeSecurityPrivilege 4080 windowsdesktop-runtime-10.0.12-win-x64.exe Token: SeTakeOwnershipPrivilege 4080 windowsdesktop-runtime-10.0.12-win-x64.exe Token: SeLoadDriverPrivilege 4080 windowsdesktop-runtime-10.0.12-win-x64.exe Token: SeSystemProfilePrivilege 4080 windowsdesktop-runtime-10.0.12-win-x64.exe Token: SeSystemtimePrivilege 4080 windowsdesktop-runtime-10.0.12-win-x64.exe Token: SeProfSingleProcessPrivilege 4080 windowsdesktop-runtime-10.0.12-win-x64.exe Token: SeIncBasePriorityPrivilege 4080 windowsdesktop-runtime-10.0.12-win-x64.exe Token: SeCreatePagefilePrivilege 4080 windowsdesktop-runtime-10.0.12-win-x64.exe Token: SeCreatePermanentPrivilege 4080 windowsdesktop-runtime-10.0.12-win-x64.exe Token: SeBackupPrivilege 4080 windowsdesktop-runtime-10.0.12-win-x64.exe Token: SeRestorePrivilege 4080 windowsdesktop-runtime-10.0.12-win-x64.exe Token: SeShutdownPrivilege 4080 windowsdesktop-runtime-10.0.12-win-x64.exe Token: SeDebugPrivilege 4080 windowsdesktop-runtime-10.0.12-win-x64.exe Token: SeAuditPrivilege 4080 windowsdesktop-runtime-10.0.12-win-x64.exe Token: SeSystemEnvironmentPrivilege 4080 windowsdesktop-runtime-10.0.12-win-x64.exe Token: SeChangeNotifyPrivilege 4080 windowsdesktop-runtime-10.0.12-win-x64.exe Token: SeRemoteShutdownPrivilege 4080 windowsdesktop-runtime-10.0.12-win-x64.exe Token: SeUndockPrivilege 4080 windowsdesktop-runtime-10.0.12-win-x64.exe Token: SeSyncAgentPrivilege 4080 windowsdesktop-runtime-10.0.12-win-x64.exe Token: SeEnableDelegationPrivilege 4080 windowsdesktop-runtime-10.0.12-win-x64.exe Token: SeManageVolumePrivilege 4080 windowsdesktop-runtime-10.0.12-win-x64.exe Token: SeImpersonatePrivilege 4080 windowsdesktop-runtime-10.0.12-win-x64.exe Token: SeCreateGlobalPrivilege 4080 windowsdesktop-runtime-10.0.12-win-x64.exe Token: SeRestorePrivilege 1048 msiexec.exe Token: SeTakeOwnershipPrivilege 1048 msiexec.exe Token: SeRestorePrivilege 1048 msiexec.exe Token: SeTakeOwnershipPrivilege 1048 msiexec.exe Token: SeRestorePrivilege 1048 msiexec.exe Token: SeTakeOwnershipPrivilege 1048 msiexec.exe Token: SeRestorePrivilege 1048 msiexec.exe Token: SeTakeOwnershipPrivilege 1048 msiexec.exe Token: SeRestorePrivilege 1048 msiexec.exe Token: SeTakeOwnershipPrivilege 1048 msiexec.exe Token: SeRestorePrivilege 1048 msiexec.exe Token: SeTakeOwnershipPrivilege 1048 msiexec.exe Token: SeRestorePrivilege 1048 msiexec.exe Token: SeTakeOwnershipPrivilege 1048 msiexec.exe Token: SeRestorePrivilege 1048 msiexec.exe Token: SeTakeOwnershipPrivilege 1048 msiexec.exe Token: SeRestorePrivilege 1048 msiexec.exe Token: SeTakeOwnershipPrivilege 1048 msiexec.exe Token: SeRestorePrivilege 1048 msiexec.exe Token: SeTakeOwnershipPrivilege 1048 msiexec.exe Token: SeRestorePrivilege 1048 msiexec.exe Token: SeTakeOwnershipPrivilege 1048 msiexec.exe Token: SeRestorePrivilege 1048 msiexec.exe Token: SeTakeOwnershipPrivilege 1048 msiexec.exe Token: SeRestorePrivilege 1048 msiexec.exe Token: SeTakeOwnershipPrivilege 1048 msiexec.exe Token: SeRestorePrivilege 1048 msiexec.exe Token: SeTakeOwnershipPrivilege 1048 msiexec.exe Token: SeRestorePrivilege 1048 msiexec.exe Token: SeTakeOwnershipPrivilege 1048 msiexec.exe Token: SeRestorePrivilege 1048 msiexec.exe Token: SeTakeOwnershipPrivilege 1048 msiexec.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 624 wixstdba.exe 1096 wixstdba.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 4632 TextInputHost.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe - Suspicious use of SendNotifyMessage 43 IoCs
pid Process 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe - Suspicious use of SetWindowsHookEx 55 IoCs
pid Process 1048 msiexec.exe 2904 MsiExec.exe 2252 MsiExec.exe 4220 MsiExec.exe 4548 MsiExec.exe 2284 MsiExec.exe 4524 MsiExec.exe 4632 TextInputHost.exe 4632 TextInputHost.exe 4632 TextInputHost.exe 4632 TextInputHost.exe 4632 TextInputHost.exe 4632 TextInputHost.exe 4632 TextInputHost.exe 4632 TextInputHost.exe 4196 osk.exe 4196 osk.exe 4196 osk.exe 4196 osk.exe 4196 osk.exe 4196 osk.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 4196 osk.exe 4196 osk.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 4196 osk.exe 4196 osk.exe 4196 osk.exe 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe 2676 taskmgr.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4844 wrote to memory of 1776 4844 Dusk.exe 89 PID 1776 wrote to memory of 4200 1776 msedge.exe 90 PID 1776 wrote to memory of 2388 1776 msedge.exe 91 PID 1776 wrote to memory of 4224 1776 msedge.exe 92 PID 1776 wrote to memory of 2388 1776 msedge.exe 91 PID 1776 wrote to memory of 2388 1776 msedge.exe 91 PID 1776 wrote to memory of 4292 1776 msedge.exe 93 PID 1776 wrote to memory of 4292 1776 msedge.exe 93 PID 1776 wrote to memory of 4336 1776 msedge.exe 95 PID 1776 wrote to memory of 4336 1776 msedge.exe 95 PID 1776 wrote to memory of 3828 1776 msedge.exe 96 PID 1776 wrote to memory of 4336 1776 msedge.exe 95 PID 1776 wrote to memory of 3828 1776 msedge.exe 96 PID 1776 wrote to memory of 3828 1776 msedge.exe 96 PID 1776 wrote to memory of 2788 1776 msedge.exe 97 PID 1776 wrote to memory of 2456 1776 msedge.exe 98 PID 1776 wrote to memory of 2788 1776 msedge.exe 97 PID 1776 wrote to memory of 2788 1776 msedge.exe 97 PID 1776 wrote to memory of 2456 1776 msedge.exe 98 PID 1776 wrote to memory of 2456 1776 msedge.exe 98 PID 1776 wrote to memory of 3440 1776 msedge.exe 99 PID 1776 wrote to memory of 3440 1776 msedge.exe 99 PID 1776 wrote to memory of 3620 1776 msedge.exe 101 PID 1776 wrote to memory of 3620 1776 msedge.exe 101 PID 1776 wrote to memory of 3620 1776 msedge.exe 101 PID 1776 wrote to memory of 2704 1776 msedge.exe 102 PID 1776 wrote to memory of 2704 1776 msedge.exe 102 PID 1776 wrote to memory of 1456 1776 msedge.exe 103 PID 1776 wrote to memory of 1456 1776 msedge.exe 103 PID 1776 wrote to memory of 4496 1776 msedge.exe 105 PID 1776 wrote to memory of 3380 1776 msedge.exe 108 PID 1776 wrote to memory of 3380 1776 msedge.exe 108 PID 1776 wrote to memory of 5484 1776 msedge.exe 109 PID 1776 wrote to memory of 5484 1776 msedge.exe 109 PID 1776 wrote to memory of 3676 1776 msedge.exe 110 PID 1776 wrote to memory of 3676 1776 msedge.exe 110 PID 1776 wrote to memory of 3676 1776 msedge.exe 110 PID 1776 wrote to memory of 2472 1776 msedge.exe 111 PID 1776 wrote to memory of 2472 1776 msedge.exe 111 PID 1776 wrote to memory of 5052 1776 msedge.exe 112 PID 1776 wrote to memory of 4992 1776 msedge.exe 113 PID 4992 wrote to memory of 624 4992 windowsdesktop-runtime-10.0.12-win-x64.exe 114 PID 4992 wrote to memory of 4080 4992 windowsdesktop-runtime-10.0.12-win-x64.exe 115 PID 1220 wrote to memory of 4508 1220 windowsdesktop-runtime-10.0.12-win-x64.exe 119 PID 1048 wrote to memory of 2904 1048 msiexec.exe 120 PID 1048 wrote to memory of 2252 1048 msiexec.exe 121 PID 1048 wrote to memory of 4220 1048 msiexec.exe 122 PID 4508 wrote to memory of 1096 4508 windowsdesktop-runtime-10.0.12-win-x64.exe 123 PID 1048 wrote to memory of 4548 1048 msiexec.exe 125 PID 1776 wrote to memory of 4212 1776 msedge.exe 126 PID 1776 wrote to memory of 2848 1776 msedge.exe 127 PID 1776 wrote to memory of 1380 1776 msedge.exe 128 PID 4508 wrote to memory of 3796 4508 windowsdesktop-runtime-10.0.12-win-x64.exe 129 PID 1048 wrote to memory of 2284 1048 msiexec.exe 130 PID 1048 wrote to memory of 4524 1048 msiexec.exe 131 PID 1776 wrote to memory of 4092 1776 msedge.exe 132 PID 1776 wrote to memory of 4092 1776 msedge.exe 132 PID 1776 wrote to memory of 4092 1776 msedge.exe 132 PID 1776 wrote to memory of 3084 1776 msedge.exe 135 PID 1776 wrote to memory of 3084 1776 msedge.exe 135 PID 1776 wrote to memory of 3512 1776 msedge.exe 136 PID 1776 wrote to memory of 4624 1776 msedge.exe 139 PID 1776 wrote to memory of 4624 1776 msedge.exe 139 PID 1776 wrote to memory of 6604 1776 msedge.exe 140 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Dusk.exe"C:\Users\Admin\AppData\Local\Temp\Dusk.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.NETCore.App&framework_version=10.0.0&arch=x64&rid=win-x64&os=win10&gui=true2⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ffdb71ac188,0x7ffdb71ac194,0x7ffdb71ac1a03⤵PID:4200
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1612,i,16530752301401946064,6457659549030479591,262144 --field-trial-handle=2376,i,7681236091272699802,1836999582847570932,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:23⤵PID:2388
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1912,i,4542900840449316736,528424471259162402,524288 --field-trial-handle=2376,i,7681236091272699802,1836999582847570932,262144 --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:113⤵
- Downloads MZ/PE file
- System Time Discovery
PID:4224
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2440,i,8402477935627025100,1230860288993699167,524288 --field-trial-handle=2376,i,7681236091272699802,1836999582847570932,262144 --variations-seed-version --mojo-platform-channel-handle=3124 /prefetch:133⤵PID:4292
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3612,i,7054962578756874203,2939716186158129657,2097152 --field-trial-handle=2376,i,7681236091272699802,1836999582847570932,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:13⤵PID:4336
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3624,i,2727494755293709493,12727061260207383910,2097152 --field-trial-handle=2376,i,7681236091272699802,1836999582847570932,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:13⤵PID:3828
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4244,i,1585991799748739033,10002327535590541306,2097152 --field-trial-handle=2376,i,7681236091272699802,1836999582847570932,262144 --variations-seed-version --mojo-platform-channel-handle=2172 /prefetch:93⤵PID:2788
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4216,i,203040202005702699,16937894902175897488,2097152 --field-trial-handle=2376,i,7681236091272699802,1836999582847570932,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:13⤵PID:2456
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3832,i,13866057210089837727,10528898171799885781,524288 --field-trial-handle=2376,i,7681236091272699802,1836999582847570932,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:143⤵PID:3440
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5364,i,11822057637916433012,1428864556256098012,2097152 --field-trial-handle=2376,i,7681236091272699802,1836999582847570932,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:13⤵PID:3620
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3840,i,2323538351055452877,8768912523205807207,524288 --field-trial-handle=2376,i,7681236091272699802,1836999582847570932,262144 --variations-seed-version --mojo-platform-channel-handle=3916 /prefetch:143⤵PID:2704
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3844,i,3738334466277626904,15448999768296194801,524288 --field-trial-handle=2376,i,7681236091272699802,1836999582847570932,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:143⤵PID:1456
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6004,i,2332265055335408933,2436211488867384476,524288 --field-trial-handle=2376,i,7681236091272699802,1836999582847570932,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:143⤵PID:2116
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6004,i,2332265055335408933,2436211488867384476,524288 --field-trial-handle=2376,i,7681236091272699802,1836999582847570932,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:143⤵PID:4496
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6260,i,16512596855397447501,12295650102082362545,524288 --field-trial-handle=2376,i,7681236091272699802,1836999582847570932,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:143⤵PID:3380
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6584,i,15024629979159273351,16899864015098951307,524288 --field-trial-handle=2376,i,7681236091272699802,1836999582847570932,262144 --variations-seed-version --mojo-platform-channel-handle=6736 /prefetch:143⤵PID:5484
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6480,i,16351340180626750166,2856797819919448806,2097152 --field-trial-handle=2376,i,7681236091272699802,1836999582847570932,262144 --variations-seed-version --mojo-platform-channel-handle=6776 /prefetch:13⤵PID:3676
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7228,i,3959651825246767449,8804264642476957388,524288 --field-trial-handle=2376,i,7681236091272699802,1836999582847570932,262144 --variations-seed-version --mojo-platform-channel-handle=7212 /prefetch:143⤵PID:2472
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7208,i,16468126197730108430,6020542970043805428,524288 --field-trial-handle=2376,i,7681236091272699802,1836999582847570932,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:143⤵PID:5052
-
-
C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.12-win-x64.exe"C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.12-win-x64.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Windows\TEMP\{1AC17D2D-A4C9-47D2-B5BA-FF4B6AD0856B}\.ba\wixstdba.exe"C:\Windows\TEMP\{1AC17D2D-A4C9-47D2-B5BA-FF4B6AD0856B}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{0DAF94BC-8B7A-4095-B026-E52B65EEF806} {8800CB6A-01B5-4C84-B509-64BF9BEA13E2}4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
PID:624
-
-
C:\Windows\TEMP\{1AC17D2D-A4C9-47D2-B5BA-FF4B6AD0856B}\.be\windowsdesktop-runtime-10.0.12-win-x64.exe"C:\Windows\TEMP\{1AC17D2D-A4C9-47D2-B5BA-FF4B6AD0856B}\.be\windowsdesktop-runtime-10.0.12-win-x64.exe" -q -burn.elevated BurnPipe.{D1B4F247-42CA-4DFC-BEF6-4CF832DDA1BE} {2243086F-BA65-4CBD-A301-5A694E61C2AE} 49924⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4080
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4956,i,7702033309239316704,14325382670298762244,524288 --field-trial-handle=2376,i,7681236091272699802,1836999582847570932,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:143⤵PID:4212
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,5182668020660618194,7918901210327945796,524288 --field-trial-handle=2376,i,7681236091272699802,1836999582847570932,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:143⤵PID:2848
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6116,i,8821963445146251012,9837409516185244155,524288 --field-trial-handle=2376,i,7681236091272699802,1836999582847570932,262144 --variations-seed-version --mojo-platform-channel-handle=7336 /prefetch:143⤵PID:1380
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=5340,i,31413371692846032,3813243788692831139,2097152 --field-trial-handle=2376,i,7681236091272699802,1836999582847570932,262144 --variations-seed-version --mojo-platform-channel-handle=3724 /prefetch:13⤵PID:4092
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5384,i,12324138376159866132,14376694524244175302,524288 --field-trial-handle=2376,i,7681236091272699802,1836999582847570932,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:143⤵PID:3084
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6152,i,14604899296094991837,2762102561581987926,524288 --field-trial-handle=2376,i,7681236091272699802,1836999582847570932,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:143⤵PID:3512
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6992,i,5914504931202941552,7546946482271292666,524288 --field-trial-handle=2376,i,7681236091272699802,1836999582847570932,262144 --variations-seed-version --mojo-platform-channel-handle=6988 /prefetch:143⤵PID:4624
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6732,i,1890535280688420512,12142215685087369278,524288 --field-trial-handle=2376,i,7681236091272699802,1836999582847570932,262144 --variations-seed-version --mojo-platform-channel-handle=6948 /prefetch:143⤵PID:6604
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6176,i,8625109922075336514,1395512040781814086,524288 --field-trial-handle=2376,i,7681236091272699802,1836999582847570932,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:143⤵PID:5572
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6852,i,16839353787588944712,17453442831413561321,262144 --field-trial-handle=2376,i,7681236091272699802,1836999582847570932,262144 --variations-seed-version --mojo-platform-channel-handle=4776 /prefetch:103⤵
- Suspicious behavior: EnumeratesProcesses
PID:3024
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5960,i,1402541439476866467,12297398027260513305,524288 --field-trial-handle=2376,i,7681236091272699802,1836999582847570932,262144 --variations-seed-version --mojo-platform-channel-handle=3032 /prefetch:143⤵PID:6744
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7340,i,5260754789664917892,10652533985146050959,524288 --field-trial-handle=2376,i,7681236091272699802,1836999582847570932,262144 --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:143⤵PID:4296
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5224,i,16462974218551753081,3960614913724620148,524288 --field-trial-handle=2376,i,7681236091272699802,1836999582847570932,262144 --variations-seed-version --mojo-platform-channel-handle=164 /prefetch:143⤵PID:3400
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3296,i,8839300202414056020,12451007840928069937,524288 --field-trial-handle=2376,i,7681236091272699802,1836999582847570932,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:143⤵PID:6928
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5732,i,7643422368766115113,7200454382802040299,524288 --field-trial-handle=2376,i,7681236091272699802,1836999582847570932,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:143⤵PID:2364
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5740,i,12372104568813265437,7176373657698652228,524288 --field-trial-handle=2376,i,7681236091272699802,1836999582847570932,262144 --variations-seed-version --mojo-platform-channel-handle=3900 /prefetch:143⤵PID:6556
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=5428,i,11056741153499362569,13998755028090248148,2097152 --field-trial-handle=2376,i,7681236091272699802,1836999582847570932,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:13⤵PID:6500
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=6152,i,1138455504510666246,13911501165492133910,2097152 --field-trial-handle=2376,i,7681236091272699802,1836999582847570932,262144 --variations-seed-version --mojo-platform-channel-handle=7552 /prefetch:13⤵PID:964
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=5740,i,11862081280796814831,14107428192603144690,2097152 --field-trial-handle=2376,i,7681236091272699802,1836999582847570932,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:13⤵PID:7064
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=1960,i,1627187627107808248,2765478832643525249,2097152 --field-trial-handle=2376,i,7681236091272699802,1836999582847570932,262144 --variations-seed-version --mojo-platform-channel-handle=3912 /prefetch:13⤵PID:7056
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=7864,i,1222875544028496899,1906675848955957668,2097152 --field-trial-handle=2376,i,7681236091272699802,1836999582847570932,262144 --variations-seed-version --mojo-platform-channel-handle=7540 /prefetch:13⤵PID:6692
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=744,i,10308206405319518945,3769341585292332664,2097152 --field-trial-handle=2376,i,7681236091272699802,1836999582847570932,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:13⤵PID:5964
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=7492,i,15782569427489880167,16669009737512068037,2097152 --field-trial-handle=2376,i,7681236091272699802,1836999582847570932,262144 --variations-seed-version --mojo-platform-channel-handle=7512 /prefetch:13⤵PID:1728
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=8012,i,5762446466186072923,17538441506123649159,2097152 --field-trial-handle=2376,i,7681236091272699802,1836999582847570932,262144 --variations-seed-version --mojo-platform-channel-handle=8020 /prefetch:13⤵PID:6176
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=8140,i,16529950751327352747,4750113330256804106,2097152 --field-trial-handle=2376,i,7681236091272699802,1836999582847570932,262144 --variations-seed-version --mojo-platform-channel-handle=8156 /prefetch:13⤵PID:6212
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=8348,i,4084029251467821064,3837903087554398095,2097152 --field-trial-handle=2376,i,7681236091272699802,1836999582847570932,262144 --variations-seed-version --mojo-platform-channel-handle=8324 /prefetch:13⤵PID:5188
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7988,i,17395577465213441660,3139104660935988845,524288 --field-trial-handle=2376,i,7681236091272699802,1836999582847570932,262144 --variations-seed-version --mojo-platform-channel-handle=7980 /prefetch:143⤵PID:6384
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=7488,i,10656874473108466095,4748375554981842571,2097152 --field-trial-handle=2376,i,7681236091272699802,1836999582847570932,262144 --variations-seed-version --mojo-platform-channel-handle=8516 /prefetch:13⤵PID:2012
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=4128,i,10002825190940823543,1230018640683749528,2097152 --field-trial-handle=2376,i,7681236091272699802,1836999582847570932,262144 --variations-seed-version --mojo-platform-channel-handle=8728 /prefetch:13⤵PID:6720
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=8648,i,16789834851807905943,4687676488395985173,2097152 --field-trial-handle=2376,i,7681236091272699802,1836999582847570932,262144 --variations-seed-version --mojo-platform-channel-handle=8732 /prefetch:13⤵PID:4108
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4816,i,17069114433918729227,13220426845603468936,524288 --field-trial-handle=2376,i,7681236091272699802,1836999582847570932,262144 --variations-seed-version --mojo-platform-channel-handle=744 /prefetch:143⤵PID:4612
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8680,i,1774073495450141706,5954193719677100011,524288 --field-trial-handle=2376,i,7681236091272699802,1836999582847570932,262144 --variations-seed-version --mojo-platform-channel-handle=8580 /prefetch:143⤵PID:6640
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8224,i,14825513824657934809,5627816144208414992,524288 --field-trial-handle=2376,i,7681236091272699802,1836999582847570932,262144 --variations-seed-version --mojo-platform-channel-handle=8208 /prefetch:143⤵PID:3860
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8216,i,6476046990434027861,11085116959689290307,524288 --field-trial-handle=2376,i,7681236091272699802,1836999582847570932,262144 --variations-seed-version --mojo-platform-channel-handle=8300 /prefetch:143⤵PID:4320
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵PID:2140
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵PID:6132
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 71258DA33A8051BAEB05DB51ACAF1E172⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2904
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 96B189BAB3E6D2836C079429C25BAB242⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2252
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding FA98422CFB356D64722BC45A83304AD82⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4220
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 95695C9D7001A731CD5B1C7B80E524AF2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4548
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 6293B3402497A3C575997AD85415D3552⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2284
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 9C8DD22E56940DD8E28170E00D9DD5362⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4524
-
-
C:\ProgramData\Package Cache\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}\windowsdesktop-runtime-10.0.12-win-x64.exe"C:\ProgramData\Package Cache\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}\windowsdesktop-runtime-10.0.12-win-x64.exe" /burn.runonce1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\ProgramData\Package Cache\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}\windowsdesktop-runtime-10.0.12-win-x64.exe"C:\ProgramData\Package Cache\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}\windowsdesktop-runtime-10.0.12-win-x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.12_(x64)_20261003183058.log"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Windows\TEMP\{215E52CC-1939-44A7-AFE4-CDF6AF29B46C}\.ba\wixstdba.exe"C:\Windows\TEMP\{215E52CC-1939-44A7-AFE4-CDF6AF29B46C}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{FD13198C-E2BD-402B-9FCC-0BA4FC028DF0} {958B41E0-9994-4A83-8A8D-07933A291A78}3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
PID:1096
-
-
C:\ProgramData\Package Cache\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}\windowsdesktop-runtime-10.0.12-win-x64.exe"C:\ProgramData\Package Cache\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}\windowsdesktop-runtime-10.0.12-win-x64.exe" -q -burn.elevated BurnPipe.{AAAA017D-DEFA-495D-9A1C-1CD696D1E2FF} {3AC9F3B0-169E-4883-ACF5-FC5AF98C9204} 45083⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3796
-
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXk0k6mrh4r2q0ct33a9wgbez0x7v9cz5y.mca1⤵
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4632
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}1⤵
- System Location Discovery: System Language Discovery
PID:5188
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,Control_RunDLL C:\Windows\System32\main.cpl,@1 ,1⤵PID:6268
-
C:\Windows\system32\osk.exe"C:\Windows\system32\osk.exe"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4196
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x000000000000048C 0x00000000000004B01⤵PID:6796
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:6168
-
C:\Users\Admin\Downloads\Dusk.exe"C:\Users\Admin\Downloads\Dusk.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1040
-
C:\Users\Admin\Downloads\Dusk.exe"C:\Users\Admin\Downloads\Dusk.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:5128
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2676
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Accessibility Features
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Accessibility Features
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e59649f.rbs
- Size 11KB
- SHA256 0480651ec8fe11066af7763f05300309ad659f12eebf212fc23cf942eddc4364
- MD5 6099408efb2c06083600a0497f24cb26
- SHA1 a6aa2ac38d224c5c54af26936cae8e64131fe07b
- SHA512 bd2d287b6accdec27765dd38eabf5353c2a26b507f6ac2f7c0fe3a17085707b366811e0480bf04973c0b101e621de621d87c9f7ce27062d09642f0d8b1bee327
- SSDEEP 192:wKv1TCNyaSt/5HjSO9CB5RKnIlRKn7lEy8FCPePp/K:wc1TCNyaSt/5He/RKuRKVW8
- TLSH T1FF326291A60182D3E9962B75C70F1B367B73D2DAA348A79F09CDC1245F273CE0F6418A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e5964a6.rbs
- Size 9KB
- SHA256 a9555932dffa25e1ce27178fc5dec754a603892ef855dc30bbcc9949f356f391
- MD5 2a29cbcbdf68b0b82f91b4e0fe38b739
- SHA1 b88e1e76d3fd2c04835f2170c16c1a527bd987ae
- SHA512 0fe84f28b5ddd13d45e9fe4132feb0bf8d18a5635364fdbe15530467b86a49b3069bb03e64026e87599108d7ef923f52ea489cc5d92f20130474ee0000eba72b
- SSDEEP 96:0m0B0y/ALrE0MCXSVGU3UeD2KPKACsTlHU3UeD2KPKAC6jfsQnUTl+nMLE5t7J/d:RYJ+KC+5PKnI6PKnjZEHRvaePpx
- TLSH T13612310166008BD3F9626B38D71727353FB6E3DA9314179B089C93744F0B7892F6A19B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e5964ab.rbs
- Size 49KB
- SHA256 3b6027dac3c40a5da3c3d263472f1020ebdf26641501bc874a46619496124212
- MD5 a5c6fa4323b9373c243547f3c6a17710
- SHA1 0a576ef2ed0406bb946ff292290b19371d2a27e8
- SHA512 66c3d7f11c53d01083ba2eda3cffa81c3f5b57a81b4e833b00830430d9874abcde8e903b3d4b485f84c17f16a913c35c59175e50de28f5f270aa75507e10f493
- SSDEEP 1536:c4OMFA4VnTxhBGGNpC14R9poCUv/X9u7DwzqWQn6XnbrFZeEB3tve9wN1E6sLYeI:O6/C
- TLSH T1A4330F38FB80C1E6F633B9A9B330D9447349CB8597198D9917CE0509CE8679D6FA83D2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e5964b0.rbs
- Size 71KB
- SHA256 1cf519ee62e86bc4ac8aa5bd2204063b3d5ba80ae4d8d3ee97dbaf1593e241a5
- MD5 2fe75f9b50089863faf33f855c963a48
- SHA1 44050b95b00084f589e147dd4dd6bff7b23a8154
- SHA512 f42b5dd7602e91d62c15ab827a3a70e1014883c4baf4ce6e00e455cf49293e042351c9c956d269c08ec30204f212500e20bb5681009f89d5c94ffb539c2da82c
- SSDEEP 1536:p+0pVuVCQUF3YJvOOfcVvQHNxaeeskGWcgayskAKwVxNbTO8E2fu/ocV4qBgpdWf:Mh0Z7Aj6s4Se9eIOm0i6E
- TLSH T1E263DEEB5610C5C1E8322A5813FBFE48AAD9CD67B344463D00C5332ADEB79C6DF68991
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e5964b4.rbs
- Size 3KB
- SHA256 412df90d21e8c44563438c137aa3a2682ee2ffbbe39f2e1446171375f50e5f1c
- MD5 9cd78d729b29da3e036bbb63a2b0b048
- SHA1 f475a20929d727e6ba0868e9acfe9d03091ca5e1
- SHA512 9e9668cf946423e235164cf9b3c5b6702d1c52f3c1a3ab6b555c3438bca850e12dcc97e27c8745b5c7d534b49909b15808218a687cfa7fd14813ef0fb8be74ab
- TLSH T1E571C002DA40C6D3DCA22B35CE271B6133BBD7DA9324838705DCA5340E47789AFE9246
- MD5 SHA1 SHA512 TLSH
- Path C:\Config.Msi\e5964b7.rbs
- Size 3KB
- SHA256 0edc05c580b5fb48c92b95fe859ba9de3dd3632571a1974baab5ec26395d5190
- MD5 a6c6d33434b4c035d2bfb085a8e7c357
- SHA1 80d6f463c1d1e7441e0200f013857b27f3d88ad0
- SHA512 e9d30dee59883c89df333d1a09102ec47cea76ee519aff0c92838a8d7a14ce3127e95fe57ccbfc5876487cc8db76d82131470796a6ed3ec553e888b6642984d8
- TLSH T15A81AF43AA40D6C3ECA31B34C9171B1177B7D6E7A364434B10CC92714D57BC59FEA686
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\dotnet\ThirdPartyNotices.txt
- Size 77KB
- SHA256 deb4427a295e1ed474b0d81c5a0d972c1b550b9a715cda939cdfa9236b1b418f
- MD5 0d8867a25ba926e6e40cd52ab3536b5c
- SHA1 89390dc8b8318d0bfef1c6a2fb4783537e28a465
- SHA512 317ca335405274f4f91b173651ca2826760acb5ba5cf41aff51adc55c2cda9059fb268333665f13f62fa48119e55a303720a780dd58d28dd9967db4c88407d61
- SSDEEP 1536:HA9jHwsGfgg39/zwgAVkguQxrDjugtSEGepkWvrpX7anuqdLSVnfiStPq+3LefrL:HA97w/ogz1AVxuMjHtSFULryLOgrGWm+
- TLSH T17773A45F7E45077319E2C3916569A8C5F22FA02E3B6B2A44346EF248133B42DD6FF858
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 163KB
- SHA256 21a46f1e5235cf4e844b9de5429f0e198b9c97a41f0503a66442f1d639ca3ee6
- MD5 522dca4be4f99d21ad35ebc3bb24a066
- SHA1 5fa4dba916a6bc846eb6001e7f6a468d04c2be04
- SHA512 3d65cd300176d21c95c2ff5a75cea9b478c505dd42bf95d45a0b2486d544096791eafb04aaf3d42bfc4e731ec4320b47cd2ae3b57c5a760f6a89645ce11ef98b
- SSDEEP 3072:nGgPR9lIuvTSBbQ/09n4SbDqIG/Tk7l55wKjpFF:nGalIubgbQoDvqIrthr
- TLSH T19FF3071AD65811AAD16E9575CB528941BB337C668BE0E3CB13C0F8BE0F726905EF9703
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\swidtag\Microsoft Windows Desktop Runtime 10.0.12 (x64).swidtag
- Size 490B
- SHA256 d89e96e8195a8fb48e7af9c9434045078495931fba064b2e5a86e80704c976d6
- MD5 810f80c58fd2a665a0c3f75752675626
- SHA1 02604b8d3bac8061c3c8cf8ec27471d76f6993f5
- SHA512 5a18532697d287108e4c68f16baa013b9e21864f9d3ab11f31fbd2a7be57398a9323dd5adabb1efc4db21f7ca49d94b3b7199449ced755ac40fe833b3c17c33d
- TLSH T1E1F0D4C9F5947B3246B21B50E55DB055E34DF7D3DC8C16C84C69C85901DB9AA437B900
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Package Cache\.unverified\DotNetRuntime
- Size 28.1MB
- SHA256 22319614080d76c82a33b196c5765ca70ff1f38041e907c7d5ed8775f6c5f3f6
- MD5 4d24332e3f8bc0e2b708e5ef1a77c7bc
- SHA1 c5719df9a461dbe3fcdc98fa124233c2ab9c40d7
- SHA512 40b135e2e289067cbfb90f7f26cde73342411faa028533fb969effe688734c88ba19e2083040e62309011f81eb964c18b6017929a3a04b145c7677160163173b
- SSDEEP 393216:H4lM4oYejHXelWkVUhg75WNLimpDkyBKuy75k9PX17foSjUQaoMU+//+tFwA/T/g:N487t5DkD+VJnixU+nuFP/mP1QgRvx
- TLSH T1C95733637FC419B9D8625FB6C0FB8751AE353C44236055AB42947269EEFA3E024BB3C1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Package Cache\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}\state.rsm
- Size 1KB
- SHA256 24c268e18fe2fa61b9bfbbec2d225fd38e22f293041cb50f40dd503a0d1b8828
- MD5 04262cac692c70373b5c576a90c78848
- SHA1 f7033084aebcabed10adc9ae1009d7b9518e8353
- SHA512 7e67a7d1bc66b427f121fda5840e5938a40c7f3b99a03842a3041aaae213fba6e17b824d8ea2312c9fab1c8f554d206faa38eb1b3298352e8827dbd847a12627
- TLSH T14921D1515BF6092CF3F6AB3469F96625443BBC121C20C16E0001318A9E32BD0CCB0B37
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\330b02a3-8fa4-4abe-aa2e-781aff35f84a.tmp
- Size 392B
- SHA256 af90e6638d263c22b0715849ceec367c69f8f0491dc6f01a7d94875d4210b436
- MD5 e55e37ae5fb1bb9f3ce9f7b0ab74bc52
- SHA1 a48bec9d5a487989c6cf3da62bc633dee28800f0
- SHA512 0687d99b4b4d9f69a863375ead4fa9b9ac37902671f45b9f0ed68b907178314da56cba62106cdba3016ce0fab4c213afba72eafbd1ca78240c4b8cd1e0247b2f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6e3a178a-808c-4935-a8f5-6082dc29ab1a.tmp
- Size 42KB
- SHA256 7ab49aa3953bb9ff9b3d4f7a185f7980abc1a29f2af33c613892b5e1ebd22bf6
- MD5 615be1888ad33d845bdbcc7980039579
- SHA1 d3719a5f88be5592765837daba6d696410c2e28d
- SHA512 6713b50487c2f5aa31592075eb11ec83dc9048842702f60cbc654668e25ce27eedf55ee0d0873ffe91597bd10ac989c74191d1272d89f7aa120c9158c0f656a2
- SSDEEP 768:74Fg73+wg1+wQWlaj4HtdnqMwQi5BgK5/CwYcZV2s8GB:d73u+Ps/VmBg8/d32sHB
- TLSH T13C1317F598E38A7BD8AE4743A37D6E429EBCD153B8984484B7D94D0DCC825BFC30A815
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\79d69cbb-847a-4024-957a-d75a00ab3fdc.tmp
- Size 37KB
- SHA256 f182e2e56eb428552a504c7476fd9058fe3d4446a7a3728954e3f01bbd678724
- MD5 69cb8cf53cfbdce9f42f159e8c6bf4d4
- SHA1 2ddfd7848041de756d29aef739cbbf098e346554
- SHA512 21cf060f26fc987f69fa23b8ed58eb9ed6fe2d2c6f04ad3d02c091d9dfe044cfb619d00d7ee24bd3a6765cdec5a52e110d339c7977ceef619820f05d9ed7fa53
- SSDEEP 768:O/UxvxjgC+Ft32vpSFaj4inqMwQi5BgK5/CwYclRA8Dea:DZj3+Ft32DsiVmBg8/dvA8Sa
- TLSH T12E03D036ECB49D778CF69240764A638BEFF45253D58409A489EE1E0E03C7AED5307C56
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\90c9a549-5d4d-4b57-8708-adaa72fa2fc1.tmp
- Size 33KB
- SHA256 63fefbd3d9f4a9d7271f7712daade48f3f6f50356f7512bfba2fdcff9a675323
- MD5 9b89a8aa1f942ff1b47f4486b2e206d9
- SHA1 f90f523c1d685261b6b965aa5605e99c95d49767
- SHA512 9182dcd4b671cb59fd28360808f1241846d066c774793eb96a218b589c50e3632b9106e22d8495844d2952096402cc353df42324a472fd27dfbe5489ff804a05
- SSDEEP 768:ww3X+xQSFaj4HtfnqMwQi5BgK5/CwYcZV2s8GB:ww3X+SstVmBg8/d32sHB
- TLSH T122F2BF31ECB58EB75CFA9144B2873743AFF4516798990A59D4EE8B0E0583AFE130BC16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 a23025f4d05b749cd64019222483e40f71e2bd4380052e2b64a234eb0323dd12
- MD5 f2999f57642ce17248d9900b8034961f
- SHA1 5a92b97bdc3c0e5222e917e766218a9ee7568f1f
- SHA512 001c4dde433f6d4b3121bd2e5736ab1443818c9c8ef22f8298c411039f23f15532e8510ef806e0f54b26c4ef31db9b77ed6c750a42b27167e98f8b691edafe8f
- TLSH T1F4D02BB1E0ED8473C050307C000681815205F8426AC555801F25D07C091014C234B108
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 9da7eb4878a6027aba4b99a96529081310463f7258d2bd96a8f30d8970da7a75
- MD5 a42ff7872fc07a0650237993c7e95026
- SHA1 98112e42e8b72d035e5a5c2c6ca5030660baaac9
- SHA512 3e34a04c7cdecefb5d52748ec84b5727ed1e0e6853c72b0c477d36c455b33ca7640f89f0acbc0718e8e561575f84854c2bfaee664dee6d5e1c42345d1a974b63
- TLSH T1BCD0C050C4EC56F0E030303C03204201724CCA93BB8331065B6081BC0D31186029BCB8
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 ae4519203ea4a71f8bb5a86dffca3b288f02f1bf4cb8d6f78e8a591b676414b1
- MD5 1293a304484c7d4be275f1eb20c69a28
- SHA1 b568174debe43e00bc9d8880e0c5166dc6720312
- SHA512 ffd84ca0277d7fb25239662676bdc1988ee3267dfd6a7a17da4c4ab32edd7fa146f36c8d8b2c5f1b06efedf5cf636eaa55943e5f89902c62e6a914ebbc3ae1b7
- TLSH T143D02BB1E0DD8473C0503078000581815215F842BEC555801F25D07C091014C234B10C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0445781e-59eb-4a02-ad08-f952d0e6e3ce.tmp
- Size 12KB
- SHA256 26235047d864d043e036ae667143f906e7c9e0d357512de4cff908960b288719
- MD5 83555d42e6487adf644f56203ed8793c
- SHA1 0aa8d8c9c8686be0935b745385cb2a9545cbc948
- SHA512 4aa5ba7a507af593ea35f1a06f96d893fa520701d94b1a7dae123a5e8af67767c109db6f51979af8fcc2ae5d5e3674e3fd0f3aa837af2d4cc737f29f095a5bd9
- SSDEEP 192:sxRyRoT7/fXsKaoZfX+SzoA8p95/g6+WNZD5/AYlacajGJIgDkXJ:sxRyI7/fXsKaWWff/5H/xU
- TLSH T11E42B819AD28AD7B8CD7D21DBA65BF13E2F95032A0D41F48B6FC861C14E76DE120780B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1b6f936d-8d43-4daf-8a51-a6671a79b323.tmp
- Size 11KB
- SHA256 9f9885d60bce25a62ed0a6e073855acedcb580f1ed9c15d9de03107bd0adee97
- MD5 ae5f54be42a12209d2da55160d6686c3
- SHA1 7b08025e73ef48a3f770825ddd2af211f2d1287f
- SHA512 44fc40b43e3a187a577b190c58f870d2c81fb6d9766b6ec6c32a7a8fc519e13a91cce1c2dbd02f5390200b1fe921eb9a518e66898589e9327d35b8781f9570d9
- SSDEEP 192:sxRtRoT7/fXsyQ7R73SzoA8p95/g6+WNZD5/AYlac3jGJIgVXJ:sxRtI7/fXsyy73ff/5H/cD
- TLSH T10242A719AD28AD7B4CDBD21DBA65BF13D6F95033A1D41E48BAFC861C04E76DE120780B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1dbad499-c4df-4e8c-be6b-eae2520e4485.tmp
- Size 70KB
- SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
- MD5 efe54a870e0f5ff28d7e00036b861065
- SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
- SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
- SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
- TLSH T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
- Size 331B
- SHA256 9fc839854553468c796c892c732bca782d76ad4f98e34ba2bb58c7b54fe6901a
- MD5 6fc04f69adf999efa8f5ffa318d5b8d8
- SHA1 eb6d1406ed3b3c828d715f84b0e5b2307b51c2ee
- SHA512 b0c4dd0ccdf1f15228f9337119aac398d75d2b2ffe3f17d9528bad333b433b14bdcef87730cfd1fd03b43b8a980b6198bdba966f0838535f07ad4caa38dd3305
- TLSH T1A2E026E528D8C22FAE486887016CE38CC3C0361BA2C0FD4E5F64C9D57806844A3A26A1
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
- Size 334B
- SHA256 a35e55518a5da674135ba64a3842da72345ee63506d436aae7b30978273c44fa
- MD5 84230db01a1bd359a980b71280d6aac0
- SHA1 79cf59f9b689184ec1b91cad4c50c8ca0ba92a62
- SHA512 4ade7410d58528cd3f0d4150aca1bee508e510946455a93afae3c013a678cd3d3d0268e1d33b87f25c82b77c18782c4b88e6d1c241b7a7cd6ddf5256cc7ca77e
- TLSH T150E020D424CDC25D6914658711FC732CC7C0361E9BC0BD5D5B54C59578454447BD1570
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000073
- Size 23KB
- SHA256 cbd89e5637327e186b67ddf3d1d27f53566022e627530ab3cf0c5e38aff8cd5a
- MD5 c1b1b034b050af51bdea2dae6f390a97
- SHA1 2855882b8159541682b4ceff0176c5f1ce6472ae
- SHA512 0d49ae4d90414c35b18c02c1a928daded1782def517f55e27a69156a9ad22c2b295653bd1403c1705c4d68979856b1929d9925cee47fce220e2076912f224d35
- SSDEEP 384:P0zrnuA3jB866z80wRGWV+D+plmj95IFBP7Fu9IXt+fTptL4EGMGlvxMni7/xcH:cOyeD8DDVu+pA9K5Xt8ArH2iWH
- TLSH T16EB26C6433E05B24D66B223C889E972C9D7AFC253631C25F21A99D3D1C646C1AF217FA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007a
- Size 89KB
- SHA256 ad8130849155b660fb49d89eba7d5efa362561a5b55a1d1e6a58c5c72242e0a2
- MD5 ca80b9dd9e1f95594a77fc449ad512f4
- SHA1 32d982987913da03ab7215063d38c4c1600b9434
- SHA512 7ac52ef2e557a12bd8f7b20730642308f1fdbf71c2364d740aacca0ccab8fa2af9057cb57cbbee673059c53d3cc98a1e82f9f45d1d9c8484c2ff22747bf99a80
- SSDEEP 1536:zwJGbw5REfI1razpjIH6AulUaypqYuYimJIf7YqYm/6Yrf8xnI/biOu:z6Gbw5kFzpjI8lKqYuYtJIf/D/60fMnp
- TLSH T1D59312D5AEC43F1336E465F996F1B9EEB8363B1167FD8C9020548A6EE2C204A071DD87
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
- Size 3KB
- SHA256 e294c4cc66bcbb664bd5d2d7928d6051b4ed8f5be1d64b1f340302e8c01d0762
- MD5 2df0e2ab20adb5aa86a113df2a53d451
- SHA1 b5b1def1ceeaef89616a9114b79c36963545394d
- SHA512 01dcfd08b036c687a055f786db25e09cf48fde4b70e0d06e34120b2279fcbb7f2cba095c29f33bcce219f30aa02c3507fc5a7b2fe264360b0dc30f73861e6857
- TLSH T1E871CA8984F48356FF7BECB16ED836AF3278C5C689472E5186ACDE757C0EB02130A044
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
- Size 5KB
- SHA256 a9a7ac51e5ce527787ce29d5c513fdb0824086e544420044a2a81a4bbd22f8e7
- MD5 71054ace7c4f00d97ebed190b759043a
- SHA1 4f3394d6ff6f80536eabf2dcb98888a7e39460ec
- SHA512 a63a0c5f57bc5f0d099704f48d220dd85f053a76ad0a052a706bfcf0403b8ec84a7bf5797b45d4a88201f381d49d22c4341c45cdc5d4948b740fa4c5807f23a3
- SSDEEP 96:f3o5RYxUw6T3lLZigvTbsUf1Avhi6I2RiUffRHuzTa4QaA5Ajn:fY5R5zji61fa5iq8gfROzTfQx5Ajn
- TLSH T120C1EA8490F0C21DFF3BECB12AE929AE3274D5D698073F46916DCE707C3EB5A8259650
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
- Size 5KB
- SHA256 ec27186e21577c92ed955d3b314616c01c673d0f4abef05dc8736beb7ec3d614
- MD5 21af2579447dfdaac6d755072efcc3f1
- SHA1 62317440a24899af6f5eed8f7fcd865daf39b8f3
- SHA512 bda64eb7e97505ea433f482c03ec578a5dfc832416e75f5724975ef1afa82e93302c45d29244e687cb9d85c9dcac044bda66267b259b3887d0c33e2d1bd3d117
- SSDEEP 96:Y3X5RYxUw93lLZigm8fbsUf1AvBo6I2RiUffqiTa4QaA5AjV:YH5RCjiwD1faZoq8gfqiTfQx5AjV
- TLSH T14BC1FB8894F0C20DFF3BECB12EE929AE3234D5D654073F46916DCE707C3AB5A8259640
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
- Size 3KB
- SHA256 31f6c470d2ea127e87fa5e31ac32ba949737bc400ce416159d8e40b7b19c012f
- MD5 b1ea3242befa3cd4d2db705641e7f9ad
- SHA1 b060c122af5090c3790aea6100fbec6cda01e8e2
- SHA512 21e0d0963cbc6e731912c0f0b5007e1f59e71d7ae346cd18f490f1bd63a7a58494cdbb583cee9e058629e1f023f00c06137c296e7a6de22ee0890e80a7d46d70
- TLSH T10271C78495E08316FF7BECB15EE836AF3278C5C689472F518AACDE75B84FB02530A044
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 3KB
- SHA256 f6a8d02202ad0c590f54a9ca431b6bebb5ceff16520f42902e819827a34554a5
- MD5 02d64c7bc52a2de44a0cb8761cb2831e
- SHA1 144cbeeea06ecf31c37fb62fd91abe0dba52b425
- SHA512 9ea4b59eb23420989cc84e711bd06685bed29d144251070eb68f605dce128a893651ee18ffd0ad11e5a7a28907e6b9833b1721bc842998254482193b1d81f8a4
- TLSH T1F561738495E08355FF7BECB19ED432AF3678C5C289472E1182BCDEB6B50EB525316094
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\b55ed532-f1f7-4bf5-a898-962d8845cc22.tmp
- Size 2B
- SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
- MD5 99914b932bd37a50b983c5e7c90ae93b
- SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
- SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\173b74db-5bca-47de-b0bd-1b56499767f0.tmp
- Size 3KB
- SHA256 bbb86b7f0d24c8398cf6ec00bf12602902e1b2954dc2af981b613aa9383c3572
- MD5 6ebf941730c15cf0c5e5e5434c14e6a8
- SHA1 429ae5862de65febba2e634320f1130964d3754d
- SHA512 9b3e45e032ebc073e23f1ca721d702c80663e22e5672168a6a2c7e2cb63d16ed0fa20565822e866ac0528fa9ce59f12f8bce1161f47c50c5ec1742163ce867d4
- TLSH T139819EF787F4856E8A0195F09A18AE2FDF2C0615431C7C6A89D4EE27D3E3472E14265F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\3be0dfca-2783-4d44-8095-e0d9c41f881e.tmp
- Size 40B
- SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
- MD5 20d4b8fa017a12a108c87f540836e250
- SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
- SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\4183ba69-ba6e-4837-83d2-0e0990527099.tmp
- Size 29KB
- SHA256 56418b50b1712cc8fd8406f69589c2e924e4fbf5a372494163013b3ac35ede0e
- MD5 940879ea6e4f3f110f81fc10b1f020aa
- SHA1 72d10d98ad5eb9f284606f32c820b8308afe857d
- SHA512 ffaed560d17ce67f6517080e8924dd99861219975e6364ecae36e2e39377265fe541fd428b04c2d8edbff2ce68f38fb3a01def6099c0c3ed6cbb334f2c0399c0
- SSDEEP 384:DYMIPi+PgYtO3z3Alzew0FSEeCTk1J+OO8qv9OKJeWNRRPfvfa+E15eKzidr4b4k:m4h3WWgIWTO6+jTlRtvGIk
- TLSH T11BD29BF783E5D62E89015AF856146E1FCF1D0619432C3C1A88D5EE4BE3E3072E15A65F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\52645772-26c1-4e3f-aef1-7369668f87a0.tmp
- Size 4KB
- SHA256 db45ea1a75687eb252d5aadfc94898196dcb76de5855447522fa5d31b0322120
- MD5 dd8945e66e4aaed434dbb6c2812bdd40
- SHA1 14939f242dd7074c927019191c9f756a6062b0b7
- SHA512 8422a14848a38e5ee2c8dc9873aaa1438392603370aeac3fc17a644aa70453d1b6ebf1d0e5f6e160df28d603759c8493c2873ca7ef15431f7f71a976abe45a38
- SSDEEP 96:DVOMImKPfvfa+EzBPBGBKziLBtBMBbMBwBlwd04Aex:DYMIzPfvfa+E15eKzidr4b4klG04Hx
- TLSH T11091BCF787E4856EC90196F09A18AE1FDF2C0615431C3C6A89D4EE27D3E3472E14265F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\77699ac5-73c8-4d56-9d19-c48fe5d24669.tmp
- Size 211B
- SHA256 8fee560ece834b6a4f652ce78704c1b93596940784ea8047cdb728bc24ea24ee
- MD5 ad9cce9817d739a058a148275e1f33d6
- SHA1 8af1bca73d7717dd174ce420369b2c00e72a7b22
- SHA512 4e50e591b937becf1f37b423e1afbf34ecf3e0f724fa89aa759ccf2a2e812b8c8241fa6ec6d1751ad34b10e43776aa8c45b58d9394ddef88130675034d0133dd
- TLSH T1E1D02333220030B5555D5FC540BBBC4FC32700209403DED535D0645D457647C0747240
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\e62caaeb-9dc4-40f8-9c37-b189d2975e22.tmp
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8a4b0100-eb68-4f41-9a73-cdbcbf878092\index-dir\temp-index
- Size 384B
- SHA256 3a6917101c43c2d3b2fbd0ee75cc11ff1955484987e795c7af74304b376f4588
- MD5 a03045498d15bd75d953e36313cf8449
- SHA1 1a517cfe650f86b80018ece500dd9bf91b056e1c
- SHA512 f7e0585984401fe1ffaf6672e640d90ca06cf7a35fdeb90c2eb72b732809fd86dcf64cb885b515703a75c99f1a40a39ab441a2ea2410a729cd671615b81c36a4
- TLSH T16CE0C29A2D178346F85441B5303E6862AA7124EC52287B0EA0FDD01A88496C4BE07B68
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8a4b0100-eb68-4f41-9a73-cdbcbf878092\index-dir\the-real-index
- Size 384B
- SHA256 1147d525a8d7281a61dfe515359f3c3401d07857ce17ed884ea398bf41b47bfb
- MD5 8cc0cdf40b6c264021c545cd829e5548
- SHA1 4ab0cef7ea3ce1dff293a182242a0e993a6466a1
- SHA512 6cdec9e864630142b6680502894e164b720f14f610db3858cc36b41af57ccb245bbc481134d12d1709760e7b93a42a15b5fe335db2a0ae2c9509cc72381e8989
- TLSH T153E02B5996139745F8084171256F216662B12408E324370F91FED457C847B84AE03F64
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
- Size 371B
- SHA256 9aca4a915cc5d66d70d5024a90f53dae49b0fbe9e89e7244f7a206171d19e1f7
- MD5 500c4bb4e66af718a8ecf84bd1a94937
- SHA1 83a1c510f7f13631fa362d55f7d15e40a1cf1c5e
- SHA512 5e12004638168f7a95e3b2805fcdab06a86961a04ce931aaea54194ec8ed05a93914e809430506d939f0abab597da8f781934939e671b0c76c7b491a7212446b
- TLSH T19AE068762EE72C24A8FB83E6687140944001BA10C5C1BC8E842B818740B23152822C92
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a70e744c-0626-45f9-b369-1f00c2d3963e.tmp
- Size 12KB
- SHA256 7b352593066742a0f0c77a223f6f9a78b6e4ffc806c2635b80272b4a9c22eca2
- MD5 d544c45c2cc01bd25fd2d0505b3920f8
- SHA1 ccffa194561066b466f646a013c1a07a5fa68eda
- SHA512 fce7c2d15fe43bc94e4736b0b53444a77c052c8ecf54e314761b96facedb3452c8b20ad411bc531e1dbac80de87d07b20c0511cb5a05692452d8a0e4be0bf972
- SSDEEP 192:sxRyRoT7/fXsGoZfX+SzoA8p95/g6+WNZD5/AYlacbjGJIgD+XJ:sxRyI7/fXsGWWff/5H/gi
- TLSH T1E642A719AD28AD7B8CDBD21DBA65BF13D6F95032A0D41F48A6FC861C04E76DE520780B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\caf4a48a-6b59-4fe3-a31c-bd912b11dff4.tmp
- Size 17KB
- SHA256 48c7c3a0ed38114700bf0e981e6d388ab06388268c22a01f1a42ac7bfb7fe1b8
- MD5 b73e754bf13f9de31dfc28fe3a1b27d2
- SHA1 ad5b150714fec202e91b008c36897b947a8c3dcb
- SHA512 90f0772556274754275e3231418de327961fd6e394bf6aed3775ac6e867e61a5e670c3d3e69642119fe82414422be966f16b3530bff77d9f92b6e4f881ac11ef
- SSDEEP 384:sxRy47/fXsKaWMfj/5C59/Vii+BBNbD3VwU:sW47/fNah7/5CHVii+F3D
- TLSH T15A8283ABF5342DBB0DD6D229F554F72BD2E5442694D04E8AAAFCC81C04D7AEE6102CC7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\cb4fa266-390e-462c-a97c-98d794415d43.tmp
- Size 27KB
- SHA256 9cc3308a9ec977f611fae3497d82c4b3f48fc2e6519496453e742b141cf8202a
- MD5 bb7c4eec1534f3b9f33db6377f07a53d
- SHA1 fad98be60504bfc05dd498e920c340ffabf3aa0c
- SHA512 f5612f592997c5f25f00b5d578eb3610be3362598994e4e2144ad9a03a0ab2453cf08d0d8429b4b9c89d1d8f14ff052358f8b4da94e18915e7fa210902d7d9a4
- SSDEEP 768:ksRdwG7pLuLb0JWgSwffT8F1+UoAYDCx9Tuqh0VfUC9xbog/OV32+gCroe20iHZ:ksRdwmEb0JWgSwffTu1jakrgZe27HZ
- TLSH T1EFC2DA7B640CCB7F4F904ADDDC197E9B6DAC02CB5698CD8087FE941C02C67EA91164DA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e3c6c50e-eced-43e1-aa5f-3cd63f93e19d.tmp
- Size 16KB
- SHA256 33e9d6548d9c90da0cc3b128cc29ca64dab4d09d746b28df8d8d57df504bb9e5
- MD5 f31a65e601adfdd296095e891741e362
- SHA1 8ab78d25728ee923848ed4353237f38f831348ab
- SHA512 ab0044248d1ea04468f8d6923a3407bc9f4481c37f077cd2f82b9cdda146502465362842621b678eb2a5f082262a0ad65b982ba52fb99271ff59c63ffb859fb7
- SSDEEP 384:sxRyc7/fXsKaWMfj/5CK9/Vii+BBRD3VdU:sWc7/fNah7/5CSVii+J3Y
- TLSH T1737295ABE5346DBB0DD6D229F514F72BD2F4442694D04E8AAAFDC81C04D7AEE6102CC7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fb24f3d7-faf3-4393-8039-f48e2c814201.tmp
- Size 31KB
- SHA256 0c9184477c05300d9dfe93e58e0bbc0938ed2a15d543f3a4747cdacbe948ea98
- MD5 cfd0ff21526a208585898f9d81b5731d
- SHA1 8177b4c58f62002f12f96f4e7484cdf2a06838fa
- SHA512 49329886d5626b7a9366f41ccb8ddd943b64006d4cbc8b9a63c6dfecb186f7428ef036bb47ee39de34725464caef2e02b3ae0cc63a144ffefeb29dc38c803998
- SSDEEP 384:sxRy47/fXsZ66sjqMpRiYnazAW8pZS15posJWeT+1aWMfj/5C59/Vii+BBNbD3V5:sW47/fu4nnc7WeT+1ah7/5CHVii+F3D
- TLSH T1E5E2D696A530D9AB4BC35D29B43CBE37D69C405255D4CEDB6AECC91C00DA5FEAB028C3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\4e342408-63ca-4260-bff5-9f86f1370b61.tmp
- Size 22KB
- SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
- MD5 f768bcb451a187c18099961c484eef8b
- SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
- SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
- SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
- TLSH T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
- Size 392B
- SHA256 b8ad261d7111d291ac458481e2d1e8994a7d2af442037732e54be0828621cd0f
- MD5 262c9db15e4e11f9a978f8c6930b6360
- SHA1 33311b3ebb7679739e406330eabbb0f71afd136e
- SHA512 ce94087915e056b1b27f9324e7a592afb37444bacf3a3e08e2ff804441756fc5da526217b7e9b72372ed4bf5b4ca6f200803cf1ae5dd244719c69e7fc28a4fd5
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a3969038-8466-482d-953f-56abd9fe3eee.tmp
- Size 33KB
- SHA256 1477c97086e997d54d203cd2688947b4ba4e32181bbca61b9fc7951e40a16fe9
- MD5 0c58d5fd2c621e866ac74e969f939903
- SHA1 bbf2cf7460e6cfb372345ef8b98d723727953007
- SHA512 d484c454bc45c814be786fd770b2f1a4f577799eadb9a4fc1bef484db80f349fe7d54e0b98cf276ce90ce52cc9143f97fd2d4f119c5a6529266d20184d7acc22
- SSDEEP 768:5J3g+fQSFaj4HtBnqMwQi5BgK5/CwYcZV2s8GB:5J3g+EsjVmBg8/d32sHB
- TLSH T10DF2BF31DCB58EB75CFA9244B2873743AFF4516798990949D4EE8B0E0587AFE130BC16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\bdcb8743-d801-42be-9f04-5f3bad27c090.tmp
- Size 40KB
- SHA256 9cc3d27672f91ff75f1c8f02c84e945a28c35d3e11eac51d9084ff0567250af8
- MD5 aa1e7977058aa4567fd4b0c6a280cde2
- SHA1 fa9d44b1a7015982973fd6f1aa2691762855f03f
- SHA512 62ba5bc7ae9408fad3bbd744909ab4c68e32a1b1341d6e29519771c0c7af0ac0f787c8be3c4220479b4fab2ec91dbbd7748ebb1771f42d82207f6633d7588cbc
- SSDEEP 768:9/UxvxjgC+Ft38+4dQSFaj4HthnqMwQi5BgK5/CwYcZV2s8WV:gZj3+Ft38+/sbVmBg8/d32szV
- TLSH T18203C035ECB59D775CFAA104B28B3787EFF4556398C5096885EA4E0E0687AFD130BC06
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\cbced464-66a4-4bf4-81f7-568ddad22c41.tmp
- Size 43KB
- SHA256 dd09f25c78ee9df459d33cd5d1fd4904e0e4794856d16a3c3cf0a103b4f98fb5
- MD5 9879ab042d3caff0aa6fbe41f0013439
- SHA1 8664371f40037e1954a0a46445dab4c221dba991
- SHA512 89cf44f6bdf4023ecb2f78d6392a61b47081af1b338593fdf385b33df904b68a092c624e6f0b4aced7e7d4d32ed4c171218e9de20c05525ad4e04bebdd64674a
- SSDEEP 768:74FkT3/wgV+Xa5laj4HtfnqMwQi5BgK5/CwYcZV2s8GB:VT3b+rs1VmBg8/d32sHB
- TLSH T1411317F598E38A77D8AE4747A37D6E429EBCC153B4984584B7D94D0CCC825BFC30A815
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\0066a6b9-cff9-463e-a7af-dc6c05f8e4d6.tmp
- Size 252B
- SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
- MD5 880fe67d2d8def8a73d1f09d09f8f2ff
- SHA1 adad7fdd0652919461f89bfe36b449081489052b
- SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
- TLSH T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\024d817f-e045-4b61-911a-78b63f1b5379.tmp
- Size 132B
- SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
- MD5 f5a3b29f9a977e23d6ca4eb728238f9f
- SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
- SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
- TLSH T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\228c6081-a2c2-4537-b5d2-f75339f7f2e8.tmp
- Size 372B
- SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
- MD5 80c2dfaf9affc09798a4976ae70f1b0b
- SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
- SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
- TLSH T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\6218b48d-39c2-4129-aa8f-8ecf8f3ba760.tmp
- Size 852B
- SHA256 cc631188ae4a22c0621e596be3d4335218373ee3aafe98bb7b213069a0dc3b70
- MD5 1a8162cc03c34509f59ea81728419884
- SHA1 459f726ff17ed37a212bf5291cc592b4745c3c06
- SHA512 129393fb77432dda8e2c4181dc778f609f56572e69213f9f8cffc544b845119929242d41078170b2dc72a678116df340544edb181c2aff069f8cd4ac2a541083
- TLSH T1E8011ED14C7E1AC7CABE0EAEA0872BEC44D86522B098347818CCF864917940E3451C3E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\cd43f072-99da-4ea5-a095-9b5fda1764a0.tmp
- Size 732B
- SHA256 cf5e5467ab3de71fcb419acbbb754c3effd5e787864ffa7c767f24ff9bbe5ae3
- MD5 87299a8105078d6252386ba9d333ff05
- SHA1 c43e027b4174d2ae2c7f138de07b18ac0407148a
- SHA512 f6678cce079ae97838bf5aebf3c195a2c82d27dd6546fd7e5428396130ca4bd2c809f2d2edca4f130da479624c3418beffe998ae1a032451706b9a47bad62885
- TLSH T1670110D14C3E1AC3C6B90EAFE04717EC40C89512B0D8387818CDF8A4917A41E345182E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\fa147bc4-3225-4eee-876c-fdc8f9d8de96.tmp
- Size 492B
- SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
- MD5 c1bec3bc77db46888e279f8b3eeb18fc
- SHA1 c2d14f387c796193ddc6378267768745c10dae14
- SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
- TLSH T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\fa2bbf1f-bcec-464f-8ecf-dd68a30b26e6.tmp
- Size 612B
- SHA256 918167fab0fb4435546513252415c1a2e44b6e8e60caf6f31d07587ba0a71ab0
- MD5 5ca920f0e1c81dfb329b916e242a4065
- SHA1 1d068ad79883fd23c27647c98e761858e46f48cd
- SHA512 2b99239123f922883dea3137835bb8b74713799981e5aa1434ea70db85e7666f2372db684f94bb599ecff70c8c31d02286b0587ffe620333eb1d4bbc7feb84b8
- TLSH T11DF002D04C3E19C3D5B90E6EA40717EC50D45517B0D8383804CDE894D07A05E315183E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d2698cd6-89c9-4ee1-a708-d3996c2cbece.tmp
- Size 33KB
- SHA256 be1b885990e1d543aaa20b3e079bf6de1d291e97278d161b74f1476aec457f1c
- MD5 5185be9fb463592d87a6fa79f6232223
- SHA1 7e832dce6c9bd889586a6889e8933437509e11e3
- SHA512 e8c1f60e1263688a83eed454e9ac1bb18579928957269608c31321f8aaf6d3d3febff9355c58be101cd8e2093d7ed27a342086fb2390980e9470b3eee6cc657d
- SSDEEP 768:RJ38+fQSFaj4HtBnqMwQi5BgK5/CwYcZV2s8GB:RJ38+EsjVmBg8/d32sHB
- TLSH T1A2F2BF31DCB58EB75CFA9244B2873743AFF4516798980949D4EE8B0E05839FE130BC16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ed2f0949-e927-4136-a8c5-1b5b44f559bb.tmp
- Size 33KB
- SHA256 b962117cc98708079a4e178fefad01b5965d034badb13a6e088e13f09c18d5b2
- MD5 211819aebf093b7edd613d776c793287
- SHA1 0eb37fd6829a97c6a26d0beaf41171c4c0d91d74
- SHA512 49cf09bfa27a61fe4a33babd2a8b4442d1ae43582d78275cea1182a25cefc316a4f59734cf70e174834523cc0a6926eb0de70674bf6a0a767646e44bc941bedb
- SSDEEP 768:rJ3X+fQSFaj4HtBnqMwQi5BgK5/CwYcZV2s8GB:rJ3X+EsjVmBg8/d32sHB
- TLSH T1DCF2BE31ECB58EB75CFA9244B2873743AFF4516798980959D4EE8B0E0583AFE130BC16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\a2d124c2-03d2-4603-8edb-fa39192b8704.tmp
- Size 13B
- SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
- MD5 2aa9e263ee3796d9ce358460a2451b4c
- SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
- SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f9af4d69-6971-4ee2-a497-f2008a39fcc4.tmp
- Size 37KB
- SHA256 a33993277c353d71c777a6ed3c4821e597ec1288e31e4ca36453a927d306bb8d
- MD5 57f4306c05bdf310947e646a61ffe7c8
- SHA1 1c291c2fa5c78a66b7f33c93e687a6c19e3a4677
- SHA512 9abda3edadc02b76c6ff5b60bb6e9cf0c97d1a631cfb4942fddc38c32b654d220a4ddc6183f90fb30f2edcc7a73a006ca85b549a083bacd5f837c153de70c362
- SSDEEP 768:74FHR3dwg1+IQElaj4HtUYnqMwQi5BgK5/CwYcZV2s8GB:ER3p+JsyYVmBg8/d32sHB
- TLSH T1CD038D36DCA5CEBBACFA9785F7867746EEF051A3889849D4D9D94E0D00835EE030BC16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\11c3bf38-ddbc-4bdc-aeeb-cdd265a7d076.tmp
- Size 10KB
- SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
- MD5 78e47dda17341bed7be45dccfd89ac87
- SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
- SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
- SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
- TLSH T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\8f79bac1-0efb-4e40-9112-a29b81c65758.tmp
- Size 1B
- SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
- MD5 5058f1af8388633f609cadb75a75dc9d
- SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
- SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.12_(x64)_20261003183058_000_DotNetHost.log
- Size 2KB
- SHA256 c974a5defd86e08250841fb5d3e6327024db524c1df96de5a988ec57c3939df7
- MD5 6fa6f53b0626b62b2b439beed744e981
- SHA1 d0852194ee3916494b876f9aea6664cab5254fba
- SHA512 f426d2cde7b25e0001b6f1efcb066b424a5549f27869e789d02589095cf16eb2c4b2c25419093fcc33c7e04bf32c665e03cc8d3b349197b31b480a46f2ff1994
- TLSH T163412B6A1AE40806B1B69747DEF7C0625A33FDD6A830CF8C238482190667D06786CB7E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.12_(x64)_20261003183058_001_DotNetHostFxr.log
- Size 2KB
- SHA256 eae171adec357e253a793eda460af0a6bdd9ebbf6876efd2f49f2e78c939dfee
- MD5 b88c9c8bbd726d58e546ab0d7045f4ff
- SHA1 1d03ca4d4a66a44c5d6aa587e8b67ddee9b1860a
- SHA512 a1cb752bf35bdafa5ac36300ca599eadd70ebe1839d8d3643bba7f710678273932b2d5e145be6f658effed1ff9614c64d99a6c4253c77114b19e64361b0df54c
- TLSH T15841D6551EF50905B1F25787EAF7C4A35A33FCD36834CF8C22848359066BD06A96CB6E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.12_(x64)_20261003183058_002_DotNetRuntime.log
- Size 2KB
- SHA256 8b56d9a427f7b615e7afba7f2d8b589c5212497fd5bd9ceb4cc42a234b9c8d80
- MD5 ea39e994e792463171a25c9819caef4e
- SHA1 4d2799bc0f628c6cb012085fbfbfdf1416029cde
- SHA512 108f877329ace656e929e3c0287673e8871932cfcd55f0927e9663b9a403856f5cf94b273a051d06c8a49212656b2c5b9aa3018fb98133486c53416b9d8b4dea
- TLSH T1DA4126461AF80816B1F39757AEF7C0635E33FCD29830CB8C22848359066BD05686DBBA
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.12_(x64)_20261003183058_003_WindowsDesktopRuntime.log
- Size 3KB
- SHA256 d4a677897d4d582174fdb149b4f6f772f7e93413dbf7a16b77a2388c3c2530b6
- MD5 e87233c2fe2657381eae54006f7397af
- SHA1 de41d4392460c77a161e9f60acf17e894639b5f9
- SHA512 1c24c0f185a842d67c9edcdf2f8b2436069083b230fdabfc09c951427872e5275df965649bddfa88b20146483f88db4199373b6a72d4b7c64eba4ad09745974a
- TLSH T15B71EC151AED0906B1B35787EAF7D4625A33FDD75830DF4C2344831A06ABD06A86CB6E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1776_1242757751\CRX_INSTALL\content.js
- Size 9KB
- SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
- MD5 3d20584f7f6c8eac79e17cca4207fb79
- SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
- SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
- SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
- TLSH T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{1AC17D2D-A4C9-47D2-B5BA-FF4B6AD0856B}\DotNetHost
- Size 848KB
- SHA256 f59a0c4177cd57a71c99b22009131a3bdf898ee6db62ef0415f056c4b26bb53c
- MD5 57a71197c3da73f5088600fe1315f870
- SHA1 5ee2d560c4d70756e29cd7d065cb38fd8a750ac3
- SHA512 df44b6deb6c72b0bf8de820767041a378e97e4994e95ce00b675676b3892803620d94373492a04a598dfef334f135152b267b175ca3148af10f8341a88024927
- SSDEEP 12288:LBGQ4cABdUb/aVo/2WCsT7pXJS5qgBwhYA3hy6J:dGyASwoO2T7RgZMY0hy2
- TLSH T119055A1BBF9414A9D8A24EB1C5B78321FE357C082320959F46A4B12DDEFB6E0647B7C1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{1AC17D2D-A4C9-47D2-B5BA-FF4B6AD0856B}\DotNetHostFxr
- Size 920KB
- SHA256 ff33e8f0a6f4624f8c160f96aa8066eeb86bcc6e608fe258deeea13bbd18e82f
- MD5 0dbebff80e13ff5ab5de800e763e5b37
- SHA1 e044e032e89bbdededce81d655ae84e3123d367d
- SHA512 6a4d2f9d8c713aa4abb3281904a61a0be2241d1bd419d97b8650d2398925f169a85dbcf2467653fcd624127df74cc2c8f4025c70a222f47bd91cc0e3e2cab8f9
- SSDEEP 12288:CBGQ4cABdUb/aVo/2WCsT7pXJS5qgBwhYY1a3rHLf:GGyASwoO2T7RgZMYF7
- TLSH T171157B1B7F9014A9D8A24EB5C5BB8321EE357C082320959F47A4B12DDEFB6E0647B7C1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{1AC17D2D-A4C9-47D2-B5BA-FF4B6AD0856B}\WindowsDesktopRuntime
- Size 28.7MB
- SHA256 1a20c13d8103d83ada5db2f9b380f69273cb17766c6e5ca954ecb93230f218e2
- MD5 6712931c838d7173b4fe90e26cf3b44a
- SHA1 f84ec5355723e6ec63fbae066c1279c343da0450
- SHA512 a52a9a6f8a93fad3b2bab1abab55cec643b1b5f32a40ac11a89c36fc79a7fc1603c58de7883adad7730a6790eaae831a8c4a556cf5f09f4588f1be0a4e116c43
- SSDEEP 786432:6BL3xuy6hjEjqDpD2dSNcZojdjc6uAkCt/BDmR+Wbv:6BL3xuysjRV2dSqGlMAkApDKb
- TLSH T1FC6733577E8209FAD8264E71C4FB9364EA393C4C6310659F02A4741AEEFB7D0627A3C5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\Dusk.exe.crdownload
- Size 5.3MB
- SHA256 b5bbd8c3ff339fcb04d7fff28fc49fdb0ea47572f2dc6219b43effe2ccc7be5d
- MD5 ce219500a6caff29427ab002ad7f1f64
- SHA1 afae25daf3e322104d211f05ae5945f22daeb344
- SHA512 a2693f3021a44af51089bf1b1a524307f69f84c46d46fa5319665093cdef4a6bfcda5f93b58d84f5bac79800e7d45cbcf43f27ff6636538089bcd3eb3f012746
- SSDEEP 49152:h/OsUSmeRgu4EIzFkeAgZvVUVRxAa/nxWie+Zb/3QQddUUZZzz3wtCjl0+LOsGH0:h/jUj84eYQJjGHK4T6hl
- TLSH T1DE466C2177AC9933D55E5776E5F24D1063B2A812BB2AD78E30CC236C0FA37D6A914393
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\eea37f14-d0a2-43a2-a236-7d1fd76906b6.tmp
- Size 15KB
- SHA256 c82f907069a965b1f04072d499d777661ae8e3e5e1f46e4a3a685378f6bee2e1
- MD5 fc5ba2ecf91a9711c3e1d78079c44036
- SHA1 512863855ba9a71f6c765276842da9e06db37d31
- SHA512 950635aa19df5292c1ecdde6d9805bf943f395678e1e86787549b04f14ece4e687a0b8927388f7ea08797c5662575b53001cf87cc77d8f675a242b17255ad921
- SSDEEP 384:aw/F48MgevVPi/gol7IU83c95B+N0qa2bYDJ/tS17:DFgJVPizl7IU831N0q7bYdc
- TLSH T101621A12FCA3D572DBD23233ED776F2075CE6D1090E9D2569744880238E27D29BA7B1A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI6632.tmp
- Size 411KB
- SHA256 ac54078e0387d2a8ddcdbee3967da6ea6ec6508172505aca3d27a75fa43ce34f
- MD5 1981cd407f5b5e81c70ba2729c56b381
- SHA1 e0b6d311930ab3557d5a0a8769edefb49c32aa3f
- SHA512 3b7c18ca780cf05a01062661156d71e0a4626469f28040e46f07c7deb8f9a643b838bbc88eda515362c5895171a337a3f5d9b8e321e539408fc1ae47e6ae4181
- SSDEEP 6144:GDvoaVoIMrKAzCsTI+q6JL9eZYr1JJS5qZ47BwhYjzmHim:QvoaVo/2WCsT7pXJS5qgBwhYg
- TLSH T135947B29B3E418EDD4B682B6C5A78430FF75744D332095AF8BA4916D1F3BAA470BB701
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1776_1117804705\manifest.json
- Size 160B
- SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
- MD5 c3911ceb35539db42e5654bdd60ac956
- SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
- SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
- TLSH T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1776_1207474662\manifest.json
- Size 135B
- SHA256 cb929ae2d466e597ecc4f588ba22faf68f7cfc204b3986819c85ac608d6f82b5
- MD5 4055ba4ebd5546fb6306d6a3151a236a
- SHA1 609a989f14f8ee9ed9bffbd6ddba3214fd0d0109
- SHA512 58d39f7ae0dafd067c6dba34c686506c1718112ad5af8a255eb9a7d6ec0edca318b557565f5914c5140eb9d1b6e2ffbb08c9d596f43e7a79fdb4ef95457bf29a
- TLSH T1CEC09223CC019CB119743B642AB2AB82F7B41B0B6869705A3AB3148C1F7E1B48082680
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1776_1257560814\manifest.json
- Size 165B
- SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
- MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
- SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
- SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
- TLSH T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1776_1483461281\LICENSE
- Size 1KB
- SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
- MD5 ee002cb9e51bb8dfa89640a406a1090a
- SHA1 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
- SHA512 d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
- TLSH T17D31535723840B9306DA2B4566AEBDC4B0DDC02D7F27AE05186EF394537B52ED8B3443
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1776_1483461281\manifest.json
- Size 78B
- SHA256 c7e506687caffcf3906916ad3fc190a19212d67a2535479241096bd0d4418b03
- MD5 259f068207f60fb9d4448c02c27b74ba
- SHA1 99131d95cce94750a928738a99caa5c710bbc924
- SHA512 fa41eac9d1ca244d06083e3d4230dd94700861155359722c1d815d0d9933dcd39c113b6f0f6ea02ff7ee1acd2fbc6ed40267d557afde16f417e80b678e8136bd
- TLSH T173A02230AC02E23320C803B002B083C383A02C02302A388C0B0320A232C823BE2F323C
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1776_280442274\manifest.json
- Size 43B
- SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
- MD5 af3a9104ca46f35bb5f6123d89c25966
- SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
- SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
- MD5 SHA1 SHA512
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1776_575803176\manifest.json
- Size 135B
- SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
- MD5 616eb6b585f16811dc5db5063e088cd7
- SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
- SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
- TLSH T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1776_715739727\manifest.json
- Size 85B
- SHA256 2d905d7b28b1afd313753d14f6a916a2e56ec4c1316bfa43046b09214ceb6090
- MD5 8ce95626b39ebc2401eee0b34c24fc7c
- SHA1 f97a2fefe756f7a03e388e1333573b884730c2b0
- SHA512 f04e4f695977918adf6e0603386b6f9c75a4a2202b0fe7215b642f3db491a1db398039cc28633b8e2541749403581622d28c1400f3f8fc66a3daab200e27266d
- TLSH T106A0121018015DE318880320213143D2D3A51C05247437001106108019B8636027A22E
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\TEMP\{1AC17D2D-A4C9-47D2-B5BA-FF4B6AD0856B}\.ba\BootstrapperApplicationData.xml
- Size 9KB
- SHA256 0da13bd67e88529919a3d066aa6767188b7b2b97e5dd1df2e3e1a83970c25111
- MD5 6134cde82dee63b5cdfc38e7686622f9
- SHA1 fcb0ab62a70f76f8ac704027ad1676080055edde
- SHA512 f365db6d84c137b2257996bab84a923f7d90464416cb7605a80539fbc446e72511c7946fcb0eb496e790ce505c29d8ac5469fa6f047acf786149f07315b6fb85
- SSDEEP 192:iFzanZTl6/wvRSn9Xta+ai2fZ8SsCsysz:3nFptsCsysz
- TLSH T10812E5512BFD0219F0F3AF48EFF6A4155A3ABD152E39C92D01211D0F49B2E819962FB7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\TEMP\{1AC17D2D-A4C9-47D2-B5BA-FF4B6AD0856B}\.ba\DotNetLogo_256x.png
- Size 2KB
- SHA256 0f571f95d8eab48dbc81b0ec5e9f7225e349e26ef50868bfaab556f3c2443b01
- MD5 39aa52615723b782c92dec710caaec7f
- SHA1 760b49e256a7979fe50a56a2b1be3688a474b886
- SHA512 89d1baa3820154667747b25e9e2fd321bfb2ec71dc309915b0a28dacdc80822a4943b639ebb37c37bd2559d5a4306d2096119cd970c84a0d331f6c68b0456dc9
- TLSH T1534195CF1BFD78D7E6E557918E1A8DD232738483B4B3A42CCE7B10B8274A5642B87940
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\TEMP\{1AC17D2D-A4C9-47D2-B5BA-FF4B6AD0856B}\.ba\dotnet.ico
- Size 44KB
- SHA256 61a2cbd12868cb9b359e0c78961d409b7875f072eb8e53ea88d3e6bfe2961a18
- MD5 b8096652d9ec286709a2c863b244b110
- SHA1 b3b7f0f4d608fad7cb59ba499d4d17c2b873a7af
- SHA512 492a5aa83220bb77c178b7c5b50bf44968c0427e9e45bb97a33df14d7fb4c667ca7adde0ebb3874c7b6011057b01144e4e6651fbad62c6bcf5e0b93586c4bc7a
- SSDEEP 96:r+gfbzo+wHK9NbwOY4tIWQeVlV1W9+H+guapUjFamINUItzf1dBNaIZ:ro5HuNcH4tIzeVlV1WEOFDgUWzf1PIm
- TLSH T1E913EF6DE68547C1C10C2032DB4AC792B5233C72E4DAE0C4F9D4FA7E177906965C6E6B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\TEMP\{1AC17D2D-A4C9-47D2-B5BA-FF4B6AD0856B}\.ba\thm.wxl
- Size 7KB
- SHA256 b00edd703dd8a475119d0e4dd70a3aaa47f0e95361af290e76d367a8edef3432
- MD5 8b2c667a8bbad3153068c0ed90df7ec4
- SHA1 c9e04a3a37e5e6262ab9bfecf78280171b8f7b74
- SHA512 5269f00d474acccb4c48cb7bcfdf19e63557a388572d3a6335aa39191319691d924e27f70da3f3495387c319396476c63a8fd7b35835cca0901220e39783847b
- SSDEEP 96:HiTgM1+XSNEzA0HtYQstYCpCwZQpCeyk5HQJM9ouvj9urz8:Ew9EmtYQstYCPC9e8
- TLSH T191E1026F68DFDEE03A732651B2B3698D6919C29A136F1CF0F869084B47635016377A03
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\TEMP\{1AC17D2D-A4C9-47D2-B5BA-FF4B6AD0856B}\.ba\thm.xml
- Size 11KB
- SHA256 dfee8e2d075087227f19c835c145c5bb8e72a46880ea24080bb2472fd3a521be
- MD5 4329e418dc56b1386d7ea29a0dcfab5b
- SHA1 58387f92e89ca21b4179fb697c7de9675c59142f
- SHA512 6934873d27e6efbb94da4f13ee8369b29995490051016fdf82800256b924902306d328bf1d4ebbf266d1a53eb24adb6478d1a67de4ecc3e3bcbe561968f24922
- SSDEEP 96:HgvPkoeWEH3IWTaQfSJgHzth5mFahbuB8pR5+Vpwe+UIJLg1gEp+6F5pQnxc:AvoWydmQfVHMyyj5Z
- TLSH T14B42FC6851DC7811C532D702AB9371D3FF12BDA6C6C85A58B48E256B1FF262028B739C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{1AC17D2D-A4C9-47D2-B5BA-FF4B6AD0856B}\.ba\1028\thm.wxl
- Size 7KB
- SHA256 43e1e134d0591532323dfcd138ac8f5e99096cb6cb0213a486bbb3ecc5c47aad
- MD5 2d7b0d29deaa836b538baaae8378ba48
- SHA1 85d86c566f601ad6e22301183771b9cc7e5062e9
- SHA512 ecc84dafe21bf858eb4693fd7c0802cf28dc5fcaf43eccc4ded3c4a83bd550e3dbf58012be695cf267917c39f6047eac89fd0cdec090e253c283783d01d8a916
- SSDEEP 96:E5TrTfb5joKvyvOj8USd4sZij7N4WoWKWvsNMNizchn/hD2Rd0E/aQpSK1nuQKbm:4r5owj7NgwsNMNSiK1gd6r
- TLSH T1ECE10F5F7CEFCED46A332A0176B32989191DD28A13AE6CF4F5580C478B634216B73A07
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{1AC17D2D-A4C9-47D2-B5BA-FF4B6AD0856B}\.ba\1029\thm.wxl
- Size 7KB
- SHA256 2f174b5eed2a84e43396f3cae2e6521c9247bb0deccb16e7f9b461233c363534
- MD5 f483510f350ad116c5c81468ad609bdf
- SHA1 5343a3a695e6149c7a7ba831be75a91138763e44
- SHA512 a39f3ebedb06361d95c39e4b7c5020d70be0e1e4654d5d5dfe254b44a7fa3a9c9c02659a28acc7ea8294620aa77818fb53609d7a2f6c9b6ae8d9adf9f2ac844c
- SSDEEP 192:qxwpVLBj5iGRxrFe+4Lzv3zLfqRBxOTyv354+F:qxwNj5RxrF2PbLfWBETyv354S
- TLSH T17AF1FF1F58DFEED07B33194572B36A88681AC292035FACF5F8AE085787235059677E03
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{1AC17D2D-A4C9-47D2-B5BA-FF4B6AD0856B}\.ba\1031\thm.wxl
- Size 7KB
- SHA256 2589887424dd4b0b27d36f7aa36d07fb6fa8d1c4dbe50059248a24823c742f92
- MD5 4e98d12cfce46c393dcdf2736a2bda95
- SHA1 aaf6a00e50cdf19f1c4fc6256ac040a750ca97af
- SHA512 314d712f8fcb2a44abe1920aa9f44d2fef626732397d3d77e4ad0ea6a003b0ea38e361c96515c8e6f8cf7d61ab96de9a349a228522a9f4b81d82c8a8f1962662
- SSDEEP 96:jgl95EIQ8+nPQP6Zc0y7jOROgYmwitzvzB5xz2kSl+ACIw052Q/LKtkCGpUvgd/q:jEpcoPWc0y7jGhYmdtzvzr8/oa/Lt/hQ
- TLSH T134F1425BA8EFDAD077332611B3736989791AD2C6136F1DF4F8A9480B8763501537BA03
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{1AC17D2D-A4C9-47D2-B5BA-FF4B6AD0856B}\.ba\1036\thm.wxl
- Size 8KB
- SHA256 ecdd5f7b7ed65bef8e3eec00537da44939b8e8f8f604e9b39329b45ec210efde
- MD5 7673a053117454b94ff8155b9f06da1e
- SHA1 2143896f16e8ec6d52eecb773e99d9a2f9daa4b9
- SHA512 0d20a4d6819fc64e36cfcd9c029542d6ef834faa3c74dd636bc1b6697f92d8822cd19c1692c500956fdfe69a3278a84c0545c799878107d0d56520053b9ae266
- SSDEEP 96:lsZt1vwZI+XNHwt/o5HezMxzMEy0vBW4eAQf49QcyhZpuWcK61xrG32gUgGv:o1wPWto5+zwzvWhvgYUgg
- TLSH T1E202105F58DBCFE06BB31717B6639589A839C286235F58E4F86B08078763914D337A43
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{1AC17D2D-A4C9-47D2-B5BA-FF4B6AD0856B}\.ba\1040\thm.wxl
- Size 7KB
- SHA256 c536f3f85936f6b38782df30a7bf88c7e7e66fa1e3257b20b75f9a4f0112b184
- MD5 21fe14f06f2e38ca565581045a67eaba
- SHA1 fe56b260ea7986f6234aeaa9f3adb010b01a0ff5
- SHA512 a87e53dbcab33b95d78f67c7e62f0c3fa50711f54b11efee890b749dd21f42e68db185dc5a99160dd37403612abb9609d311dea1254c126b1e96ecf7aab67051
- SSDEEP 96:p0NpgwGrmKmuaXo+Hnxy7McLi4vgjzH9euz3KLrQTNRREhZDWDIQ0gwZKWakCRos:wNBoJvUzH9euz3tTDCnZKWzDU+c
- TLSH T1BFF1EF7B68DFDDD0BA332748B2B3B589B51ED586235F19E0F4AA094B4753500A27BA03
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{1AC17D2D-A4C9-47D2-B5BA-FF4B6AD0856B}\.ba\1041\thm.wxl
- Size 8KB
- SHA256 000e1508d9bacb7156951988ba1d6dc36165facd2163352a93b9a66e8c642089
- MD5 e29c1d15cf0eeb5fb10a6f0e92b041fc
- SHA1 68cd096f0135524d5d07a9ec1fbcb69e1a1084de
- SHA512 47d3acdafbc3dc960d569976fe3c635613608f08102a6cd0c246f8ebe0f3343e73fc9d87a673035a46fbc4de21c59b97054dfd596dde2f5f6eea25f6ff7b7d96
- SSDEEP 96:/x55EeSXkI6+QsPIVLYitzzus2iK5EmV26W/0zYe9YQfNpYjruBzUYwvdCz1Q:/BQFPIVLYszzutz8yzYUO/CxQ
- TLSH T1B702102EA5DB89E06A331611756776C8680BCC85DBAB1CF0B07DC817977341DE237A32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{1AC17D2D-A4C9-47D2-B5BA-FF4B6AD0856B}\.ba\1042\thm.wxl
- Size 7KB
- SHA256 09c51c910f7142ab7f73db8e826f3daff1525eea765d03bcd934cba53bc689d3
- MD5 095c8d4db15a85c0c62842d0192202ad
- SHA1 d703ab6b95a8190a3187a65ba1b779d856eff7b8
- SHA512 86860b18e9101c2d27359e53e21c7f2fe939031850387a6a55c12d23b7dbe4133722b5fdf4364dc896d5aac5744b470b45198a47da6912a4827b88f433a79796
- SSDEEP 96:YWnvHZWx805aEfLW344uU5OsW+yvuE4uU5J+jpD2kUcdkAdiY10IHDWw/fPb8Qhk:kjcuYhu5jx2kP1/3bmk9d4
- TLSH T1E8F1429B78EFDED026732C413AF36A95591AC2DA235B08F0F9254C878B738114637E27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{1AC17D2D-A4C9-47D2-B5BA-FF4B6AD0856B}\.ba\1045\thm.wxl
- Size 7KB
- SHA256 209911674536ad5976dad21ae1e96a9fdfa61270120a94bbe0e8ae32a67239a2
- MD5 4e407f5d7e06084cb9ec7b41b1f4b992
- SHA1 0aa44f39e522935de900449937af13df18a6ef44
- SHA512 926daa3c9d92b7f0e910101d6482ce6e153af13dd3f59236d3418df4a158857f00ea565869312f35c0bf6e689b6f1a0bead71f54e77783d65311838dc980c996
- SSDEEP 96:vz5E6U+A8fOIZcvYqUC/W5TqUbFaOa0Q9zSzfmZ5AKgY1ou5DQ7JPy+u1/8X3vCH:ln9BmNUCqeUJaOaHNCPA/zGYP
- TLSH T1D5F1005FA4EFCED127331A45B6B369C9680AC5CA136F1CE4F8AE081B87675019337A43
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{1AC17D2D-A4C9-47D2-B5BA-FF4B6AD0856B}\.ba\1046\thm.wxl
- Size 7KB
- SHA256 7b095c32d1fbdd924d710d18d51a88a710bc152c8b30c6051524583bfabe38c0
- MD5 13d65c9d4996d93edafb2696cc2a90b3
- SHA1 80047984b6cee842764b24ef33a5c67eaabab2f3
- SHA512 14ceaf26e16cfd039e18614d40148c44e09cc2e7130b19a3024aabb46bac77c1445cd7de84ef46577ae1ab4cf15cd0152a3ccd6fe070ee0a34b06f8f29ba0af0
- SSDEEP 96:TD5ED4lH+wLwdBc7tlqIz5Vv0gpK0rD45g5q8MSQ7EugTuo6RADvAbK:Z1kvg7xlVv0gpXMfgLGK
- TLSH T1D9F1121F68DFDED037331A42B2B36A8A6509C2C5135F5DF4F8AA494B87A3500A637A03
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{1AC17D2D-A4C9-47D2-B5BA-FF4B6AD0856B}\.ba\1049\thm.wxl
- Size 9KB
- SHA256 3c911848f83d269fa2cd64bbfd7b5e88eb3a621bdd42c564c69100a8e8a40494
- MD5 7904c2832b3cedabcdf0ec49dd8040ba
- SHA1 2a7f428568ab6ea5fd54bb80376c552d80a0e7a3
- SHA512 3c881efc2b611bda02b290bc79948818ce6e6a495dcf2dc938047875f301f18f9eae37ba109fd9b453504173cb9209192e0d2cd4603c7bf105042bc9775829e0
- SSDEEP 96:C7lv+VxxVUC7bqFdwkd/XQF+L++qFQEemLq9OJRgcnZKQ8VXoshXuOxMvlmV3p/n:zVPVU//y+L++9wpZ/oRZ1
- TLSH T1A022FD2615EFA8D81222B117E9626E0E3C5B81FF3B6B5BF174641C6F76B3000833B606
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{1AC17D2D-A4C9-47D2-B5BA-FF4B6AD0856B}\.ba\1055\thm.wxl
- Size 7KB
- SHA256 56d76adc63b71879e3291f0f306e54081e9e80f463fcb41dc6896ecd2298deae
- MD5 e2fabe4eb312645c1231029191458f7e
- SHA1 f9f143535ba48d9aeb791c62e79ed687911927b1
- SHA512 ddf60df1ee2f00561bc806e384478b105182a4bec673b5eb26b1db7f88adb297af80b7bdfeecd5e0aefc3579bf20a84bc9bacdcfb727b9d1af2865cdcdc48a37
- SSDEEP 96:YMANNFTFhC4h4bNReiNxfufGzzzSkbAS37lsu+wzPwQT8gpwMu7kVS0uuM/r+9Hc:YlFJydNxfu+zzzgoZ7Twh/6H/0
- TLSH T1DCF1231F78DFEDD467332A56B2B3268CB84EC382132A9CE0F52944479BA351152B7B07
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{1AC17D2D-A4C9-47D2-B5BA-FF4B6AD0856B}\.ba\2052\thm.wxl
- Size 7KB
- SHA256 340154c87016bd6af740e6a91ea86d722817f6dc2bc675c33133901443658179
- MD5 e89b4290f9255b428cc21e217dc8e5e7
- SHA1 84f78df432e53426412e2123c1990acfb743f6c9
- SHA512 b313de643859aca6b9b2f05f88efd130c900065c08d2279af6f7d8dd0301a7a762ee0e051ccc76c737c68c86e51decd48287529e7fc9a25c0cb1228151447105
- SSDEEP 96:dLf2DllNpoNWZd9rCfE4d57afwUtn93K248RYCPr/I5Qqj9BQru0iCiBkz6/3PPx:d0Np6fHGwMn93MRoL+u0x
- TLSH T11EE1119F78EFCEE02A332A5132B325CC2819D28957AB5DF0F4641C4B8B634205777A07
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{1AC17D2D-A4C9-47D2-B5BA-FF4B6AD0856B}\.ba\3082\thm.wxl
- Size 7KB
- SHA256 2416f9a3daa6767f418c5ab94edb8a83dc9326fcaf13de1186e61b5248349edc
- MD5 65b3aa6dd10a5b8db1b7f7faa4c4c7e1
- SHA1 ca32c8b853681960c86d19d533dff4ff1137a1c6
- SHA512 d7fce89011c24d0c3928807293d42a3f694ef4357d3c42a84d9294de000b291279671e2059e063ac58806b8e718654260ce5c9ae8c748d3a0a8c9ce0e23ac55a
- SSDEEP 96:oEBx4+Ck8rL6j+zTnnq6LuSznTUzO1GKW+gepaU5/QxANuRypklEDhmh8asuBtz:aX6qfxLzznAzO1G0ERdiu/z
- TLSH T132F1412F68CFDEE27B73194472F3958DA808C295235ECDE0F468085B8793905D637A83
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{1AC17D2D-A4C9-47D2-B5BA-FF4B6AD0856B}\.ba\BootstrapperExtensionData.xml
- Size 276B
- SHA256 258fac237622533e7f9ec3f95bcec8abcc31ae87e2017e5717af0841c61e9df4
- MD5 240bac991e5860465ce0dfd580ea7cb3
- SHA1 a352934cbb14ab877883ac219ceb78c92e27f495
- SHA512 67ff8063a071436ae7dca8ee12ad1991bb70752dcc63f00f129f38dffa1aaf9299fff591fc67dbf4d2fdc57a9242831b149d575181b84857cd4f22463076f315
- TLSH T1DAD05E432FBE2304F1B30F49A6BA94102475BE009D78CC6D0228080C0573D92C8B2F77
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Temp\{1AC17D2D-A4C9-47D2-B5BA-FF4B6AD0856B}\.ba\license.rtf
- Size 215B
- SHA256 75cf03762aea3f3ef6ae0dc0290c4426052549a0b4335bcc3ba9ca30391e0751
- MD5 5f5db41d3f86258e4b6f8b08ef870d0a
- SHA1 3c02aea43c2bc7dff281ec8e5ad01abf058c1ed6
- SHA512 26344831d563e95a26126f2d99ce9b773017596001fbf3d7f56b9a84c77a69240640b7bb191ec8ec7fa66d424134805113be8b9503adae19554aaba6c98223ee
- TLSH T19BD022EA15CC11AA3FB80A8CEB04D029ED7E419DBC41D682B1313A90F81192DB2C76A2
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Temp\{1AC17D2D-A4C9-47D2-B5BA-FF4B6AD0856B}\.ba\logo.png
- Size 852B
- SHA256 cd2e8ed1fbb308d9d166f49794d323a9b22efba1033cdf906d1f4b030319e01b
- MD5 8346e21859a269dccf1e408dc7593cca
- SHA1 239f10674bf6022854c1f1bf7c91955bde34d3e4
- SHA512 de9a54e7067fe4feade10f48d7c2bb4169f50efa0b06d3310421376690712af4d55dbc24dc5accc5013379b11abb59cc8c85896fe9f2a7c6a7ea2e28f6feac9f
- TLSH T16B0152E8C16455ACA24E76BA91F32450B653B46010C5CD8EBE00DF3442F4522AB976A6
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Temp\{1AC17D2D-A4C9-47D2-B5BA-FF4B6AD0856B}\.ba\wixstdba.exe
- Size 431KB
- SHA256 e9aad13949cd910523bf9547fc5c23bd2c26595e024809a9f8fa866c8d8e555b
- MD5 14e0c606e68508fa618bd5c514015577
- SHA1 f8c28db9d2810e872f6ffe7607019851f250c5f9
- SHA512 c29fedca692ca2f9c5e63f360aeb95399f2f15f1576a0d06fcf9f0919f6b658329973803bc870b0b1e954b0105757630ca3f4b3ac64f4b80e91742d612fd5b73
- SSDEEP 6144:N7lQcp03E0PKVMP/PwMFJ3zdoZmb8LSQsCjzYkffTTp6EoNXJrprSU0e:Np6mM/wML3/QsJDLXJrow
- TLSH T16D942A3165F04023D6F94572E915FA30AF39F208670085EBA3C0DD297968AE6A7FB357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{1AC17D2D-A4C9-47D2-B5BA-FF4B6AD0856B}\.be\windowsdesktop-runtime-10.0.12-win-x64.exe
- Size 968KB
- SHA256 08a7e2db64e2ed8f0c0476d4463af75e691d1db571a05de6e161ce0178fbce90
- MD5 95f7a028a67ce1c82bc647d02e1f2d0d
- SHA1 6facfe6e1234168184b3ffb62189e608040fd65b
- SHA512 07c388e66f7c6d9e9c257fc595c6eb9da5f9b1647a52fa10c81e72a49ce2b714eaeae9b7a604fbda61ca7f1aa1ae6a9781c50d8ce5259164ce27b81281cea773
- SSDEEP 12288://hzPsOEX5eZbWC1I0iqm+4/Pm0zykD7xd5DWs2DuHxXQPE4Z8ob:/ZzPRq5eZbpTh47zykJnDWs5NQ84Zl
- TLSH T1CA256D31A566242BE6F40973F914D6307E28E7082B1C45B6C6D0DD0C79A89FA6FF724B
- MD5 SHA1 SHA512 SSDEEP TLSH