837d1b77abef74e3fc4f1c717a9077daf06f91255be613c9dced03b6a0cbc602

Analysis

geolocation tags

eueuropelondonukunited-kingdom
user interaction
yes
max time kernel
600s
max time network
476s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
15/10/2026, 23:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dotnet-wave-bootstrapper.exe
Size 8.2MB
Sample261015-3ycdrset8s
SHA256 837d1b77abef74e3fc4f1c717a9077daf06f91255be613c9dced03b6a0cbc602
MD5 cc9ecc49cf1511b302aefd2c4ae4ee01
SHA1 fb6e4cb00b1eb14643620fa00036c2afd3c911b6
SHA512 01f6738d78c48073b6f21319c0cd84671bfdb7b5a056aa2bc3157a957f27719545c4e8234733a0056f3c6aaa49ece7ce8929e49c13f87d096b4a4269a6f32ec3
SSDEEP 196608:LISJ2QXlGEyGYqvZ4qeB5/YE2nMOX/ti6yqRdkVaiwa:LFJ2gbYe4nsM4RyqZi3
TLSH
T18386CF05B794C613CE1F43798076C012E172BAE68361E3CBA94ADCC52E6FBF9563171A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery persistence ransomware

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
84	712	msedge.exe

Executes dropped EXE 7 IoCs

pid	Process
3976	windowsdesktop-runtime-9.0.21-win-x64.exe
3924	windowsdesktop-runtime-9.0.21-win-x64.exe
3356	windowsdesktop-runtime-9.0.21-win-x64.exe
4724	windowsdesktop-runtime-9.0.21-win-x64.exe
1448	windowsdesktop-runtime-9.0.21-win-x64.exe
1724	windowsdesktop-runtime-9.0.21-win-x64.exe
1320	windowsdesktop-runtime-9.0.21-win-x64.exe

Loads dropped DLL 18 IoCs

pid	Process
3924	windowsdesktop-runtime-9.0.21-win-x64.exe
3376	MsiExec.exe
1724	windowsdesktop-runtime-9.0.21-win-x64.exe
3376	MsiExec.exe
1556	MsiExec.exe
1556	MsiExec.exe
2560	MsiExec.exe
2560	MsiExec.exe
3820	MsiExec.exe
3820	MsiExec.exe
1672	MsiExec.exe
1672	MsiExec.exe
1176	MsiExec.exe
1176	MsiExec.exe
764	MsiExec.exe
764	MsiExec.exe
2592	MsiExec.exe
2592	MsiExec.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{9ebd7727-8105-47ca-8e74-76305a8bb1a1} = "\"C:\\ProgramData\\Package Cache\\{9ebd7727-8105-47ca-8e74-76305a8bb1a1}\\windowsdesktop-runtime-9.0.21-win-x64.exe\" /burn.runonce"	windowsdesktop-runtime-9.0.21-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{9ebd7727-8105-47ca-8e74-76305a8bb1a1} = "\"C:\\ProgramData\\Package Cache\\{9ebd7727-8105-47ca-8e74-76305a8bb1a1}\\windowsdesktop-runtime-9.0.21-win-x64.exe\" /burn.runonce"	windowsdesktop-runtime-9.0.21-win-x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.21\Microsoft.VisualBasic.Core.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.21\it\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.21\System.Security.Cryptography.ProtectedData.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.21\tr\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.21\System.IO.UnmanagedMemoryStream.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.21\System.Resources.Writer.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.21\es\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.21\PresentationUI.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.21\ja\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.21\mscordaccore_amd64_amd64_9.0.2126.50404.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.21\cs\UIAutomationTypes.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.21\Microsoft.WindowsDesktop.App.deps.json	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.21\System.Xml.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.21\Microsoft.Win32.Primitives.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.21\System.Net.WebSockets.Client.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.21\zh-Hans\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.21\zh-Hant\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.21\fr\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.21\ko\WindowsBase.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.21\coreclr.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.21\ko\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.21\it\WindowsBase.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.21\Microsoft.NETCore.App.runtimeconfig.json	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.21\System.Collections.Concurrent.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.21\ru\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.21\pl\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.21\cs\WindowsBase.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.21\System.Globalization.Extensions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.21\pl\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.21\ko\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.21\pl\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.21\System.Net.Http.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.21\System.IO.Pipelines.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.21\System.Xml.XDocument.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.21\System.Drawing.Primitives.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.21\System.Numerics.Vectors.dll	msiexec.exe
File created	C:\Program Files\dotnet\ThirdPartyNotices.txt	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.21\System.IO.MemoryMappedFiles.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.21\System.Resources.ResourceManager.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.21\tr\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.21\System.Drawing.Common.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.21\de\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.21\cs\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.21\createdump.exe	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.21\System.Collections.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.21\System.Windows.Forms.Primitives.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.21\ru\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.21\ru\UIAutomationTypes.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.21\System.Diagnostics.FileVersionInfo.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.21\pt-BR\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.21\de\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.21\pt-BR\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.21\System.Windows.Forms.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.21\System.Net.Sockets.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.21\ja\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.21\ru\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.21\pt-BR\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.21\PresentationCore.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.21\es\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.21\it\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.21\PresentationFramework.Classic.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.21\System.Drawing.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.21\System.ComponentModel.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.21\zh-Hant\System.Windows.Input.Manipulations.resources.dll	msiexec.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\~DF2AB9938B59DD7F3D.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF59D9F643AA3B1CCE.TMP	msiexec.exe
File created	C:\Windows\Installer\e58e60b.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1D5D.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF2C2D07D986789CF5.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF11659FA65B59C7F8.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2D95.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI652.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFB7C852F9A8DBC76B.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{22B18430-8F0B-42EE-B75D-4BD2438B0B31}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI283D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e58e5fb.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF65F96822C6B41412.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e58e607.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF006D9FDBA5CDF1BB.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFED1AD9B87915E1B5.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{9F01D8AF-A856-4A52-AED9-E9816487B435}	msiexec.exe
File created	C:\Windows\SystemTemp\~DFD6B42772DD5ABF26.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFB62.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\e58e600.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1	msiexec.exe
File created	C:\Windows\SystemTemp\~DF7887A027A11AA89E.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFA38F6507D23F9FCF.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2DC4.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI78D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI859.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8D7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149	msiexec.exe
File created	C:\Windows\SystemTemp\~DF2D566EB55FFBC024.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\e58e5fb.msi	msiexec.exe
File created	C:\Windows\Installer\e58e600.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149\fileCoreHostExe	msiexec.exe
File created	C:\Windows\SystemTemp\~DF9E46D90519C4E92F.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFD38.tmp	msiexec.exe
File created	C:\Windows\Installer\e58e5ff.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFAFBE369E3FD0A988.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF2A77623C8F993781.TMP	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149\fileCoreHostExe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2A16.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF273FC3561CE64D58.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4EA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2647.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2949.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFE9883A966C885358.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFAE747B3F83974383.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFB6B108584708FDAA.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF7004C9ED74DFDB25.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF7E0E9AAD20F304CD.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e58e5f6.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\SystemTemp\~DFE552A4E694EB54BD.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF6D6EE3B637CF741B.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2AF3.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFDA8E641560664E08.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFE02DF6396D63F700.TMP	msiexec.exe
File created	C:\Windows\Installer\e58e606.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2979.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF83B4E8352C1AF51E.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6F0.tmp	msiexec.exe
File created	C:\Windows\Installer\e58e607.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF91.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF1A372F90B1A9DA35.TMP	msiexec.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\windowsdesktop-runtime-9.0.21-win-x64.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-9.0.21-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-9.0.21-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-9.0.21-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-9.0.21-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-9.0.21-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-9.0.21-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-9.0.21-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
712	msedge.exe

Checks SCSI registry key(s) 3 TTPs 58 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	SearchHost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	SearchHost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 17 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2C	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2e	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2d	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2D	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2f	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2B	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FA8D10F9658A25A4EA9D9E1846784B53\SourceList\PackageName = "dotnet-hostfxr-9.0.21-win-x64.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FA8D10F9658A25A4EA9D9E1846784B53\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BDE5F3B77C715A146805F265416D3BA7\ProductName = "Microsoft .NET Host - 9.0.21 (x64)"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC2FB4E184BB2CD4C9E4AA0613B1F404\Clients = 3a0000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FA8D10F9658A25A4EA9D9E1846784B53\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BDE5F3B77C715A146805F265416D3BA7\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BDE5F3B77C715A146805F265416D3BA7\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_9.0_x64\Dependents\{9ebd7727-8105-47ca-8e74-76305a8bb1a1}	windowsdesktop-runtime-9.0.21-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\03481B22B0F8EE247BD5B42D34B8B013\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{22B18430-8F0B-42EE-B75D-4BD2438B0B31}v72.84.61393\\"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\www.bing.com	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{9ebd7727-8105-47ca-8e74-76305a8bb1a1}\Dependents\{9ebd7727-8105-47ca-8e74-76305a8bb1a1}	windowsdesktop-runtime-9.0.21-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FA8D10F9658A25A4EA9D9E1846784B53\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\361E85EF635599C488AD4C909883BA6E	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BDE5F3B77C715A146805F265416D3BA7\PackageCode = "2680C3E697991FA4D89B73E7446A92DE"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BDE5F3B77C715A146805F265416D3BA7\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\PersistedTitleBarData\Microsoft.MicrosoftStickyNotes_8wekyb3d	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{9ebd7727-8105-47ca-8e74-76305a8bb1a1}	windowsdesktop-runtime-9.0.21-win-x64.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FA8D10F9658A25A4EA9D9E1846784B53\Clients = 3a0000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BDE5F3B77C715A146805F265416D3BA7\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\F71950C1A6A51F479A1ED20855BD5918	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_72.84.61393_x64\ = "{22B18430-8F0B-42EE-B75D-4BD2438B0B31}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\03481B22B0F8EE247BD5B42D34B8B013	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\03481B22B0F8EE247BD5B42D34B8B013\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\03481B22B0F8EE247BD5B42D34B8B013\SourceList\PackageName = "windowsdesktop-runtime-9.0.21-win-x64.msi"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC2FB4E184BB2CD4C9E4AA0613B1F404\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\FA8D10F9658A25A4EA9D9E1846784B53	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FA8D10F9658A25A4EA9D9E1846784B53\Version = "1213525956"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_72.84.61380_x64\Dependents\{9ebd7727-8105-47ca-8e74-76305a8bb1a1}	windowsdesktop-runtime-9.0.21-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BDE5F3B77C715A146805F265416D3BA7\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{7B3F5EDB-17C7-41A5-8650-2F5614D6B37A}v72.84.61380\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\03481B22B0F8EE247BD5B42D34B8B013\Provider	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\PersistedTitleBarData	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{9ebd7727-8105-47ca-8e74-76305a8bb1a1}\Dependents	windowsdesktop-runtime-9.0.21-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BDE5F3B77C715A146805F265416D3BA7\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BDE5F3B77C715A146805F265416D3BA7\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_9.0_x64	windowsdesktop-runtime-9.0.21-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\04E3F5B2BDF518F4E257557521352135\03481B22B0F8EE247BD5B42D34B8B013	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_72.84.61380_x64	windowsdesktop-runtime-9.0.21-win-x64.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "6370"	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_72.84.61380_x64	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BDE5F3B77C715A146805F265416D3BA7\SourceList\PackageName = "dotnet-host-9.0.21-win-x64.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC2FB4E184BB2CD4C9E4AA0613B1F404	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC2FB4E184BB2CD4C9E4AA0613B1F404\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\dotnet_runtime_72.84.61380_x64	windowsdesktop-runtime-9.0.21-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FA8D10F9658A25A4EA9D9E1846784B53\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\03481B22B0F8EE247BD5B42D34B8B013\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_9.0_x64\Version = "72.84.61380"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\03481B22B0F8EE247BD5B42D34B8B013\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{22B18430-8F0B-42EE-B75D-4BD2438B0B31}v72.84.61393\\"	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\UserStartTime = "134336234636501975"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\727B4699CFE52DD66C76836B22B653ED\CC2FB4E184BB2CD4C9E4AA0613B1F404	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FA8D10F9658A25A4EA9D9E1846784B53\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{9ebd7727-8105-47ca-8e74-76305a8bb1a1}\DisplayName = "Microsoft Windows Desktop Runtime - 9.0.21 (x64)"	windowsdesktop-runtime-9.0.21-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\03481B22B0F8EE247BD5B42D34B8B013\PackageCode = "9AFF7AACE79D1144E8AED996E903582D"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\03481B22B0F8EE247BD5B42D34B8B013\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC2FB4E184BB2CD4C9E4AA0613B1F404\ProductName = "Microsoft .NET Runtime - 9.0.21 (x64)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC2FB4E184BB2CD4C9E4AA0613B1F404\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{1E4BF2CC-BB48-4DC2-9C4E-AA60311B4F40}v72.84.61380\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FA8D10F9658A25A4EA9D9E1846784B53\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FA8D10F9658A25A4EA9D9E1846784B53\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{9F01D8AF-A856-4A52-AED9-E9816487B435}v72.84.61380\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\BDE5F3B77C715A146805F265416D3BA7	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\04E3F5B2BDF518F4E257557521352135	msiexec.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\windowsdesktop-runtime-9.0.21-win-x64.exe:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
2716	msiexec.exe
2716	msiexec.exe
2716	msiexec.exe
2716	msiexec.exe
2716	msiexec.exe
2716	msiexec.exe
2716	msiexec.exe
2716	msiexec.exe
2716	msiexec.exe
2716	msiexec.exe
2716	msiexec.exe
2716	msiexec.exe
2716	msiexec.exe
2716	msiexec.exe
2716	msiexec.exe
2716	msiexec.exe
3292	explorer.exe
3292	explorer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3356	windowsdesktop-runtime-9.0.21-win-x64.exe
Token: SeIncreaseQuotaPrivilege	3356	windowsdesktop-runtime-9.0.21-win-x64.exe
Token: SeSecurityPrivilege	2716	msiexec.exe
Token: SeCreateTokenPrivilege	3356	windowsdesktop-runtime-9.0.21-win-x64.exe
Token: SeAssignPrimaryTokenPrivilege	3356	windowsdesktop-runtime-9.0.21-win-x64.exe
Token: SeLockMemoryPrivilege	3356	windowsdesktop-runtime-9.0.21-win-x64.exe
Token: SeIncreaseQuotaPrivilege	3356	windowsdesktop-runtime-9.0.21-win-x64.exe
Token: SeMachineAccountPrivilege	3356	windowsdesktop-runtime-9.0.21-win-x64.exe
Token: SeTcbPrivilege	3356	windowsdesktop-runtime-9.0.21-win-x64.exe
Token: SeSecurityPrivilege	3356	windowsdesktop-runtime-9.0.21-win-x64.exe
Token: SeTakeOwnershipPrivilege	3356	windowsdesktop-runtime-9.0.21-win-x64.exe
Token: SeLoadDriverPrivilege	3356	windowsdesktop-runtime-9.0.21-win-x64.exe
Token: SeSystemProfilePrivilege	3356	windowsdesktop-runtime-9.0.21-win-x64.exe
Token: SeSystemtimePrivilege	3356	windowsdesktop-runtime-9.0.21-win-x64.exe
Token: SeProfSingleProcessPrivilege	3356	windowsdesktop-runtime-9.0.21-win-x64.exe
Token: SeIncBasePriorityPrivilege	3356	windowsdesktop-runtime-9.0.21-win-x64.exe
Token: SeCreatePagefilePrivilege	3356	windowsdesktop-runtime-9.0.21-win-x64.exe
Token: SeCreatePermanentPrivilege	3356	windowsdesktop-runtime-9.0.21-win-x64.exe
Token: SeBackupPrivilege	3356	windowsdesktop-runtime-9.0.21-win-x64.exe
Token: SeRestorePrivilege	3356	windowsdesktop-runtime-9.0.21-win-x64.exe
Token: SeShutdownPrivilege	3356	windowsdesktop-runtime-9.0.21-win-x64.exe
Token: SeDebugPrivilege	3356	windowsdesktop-runtime-9.0.21-win-x64.exe
Token: SeAuditPrivilege	3356	windowsdesktop-runtime-9.0.21-win-x64.exe
Token: SeSystemEnvironmentPrivilege	3356	windowsdesktop-runtime-9.0.21-win-x64.exe
Token: SeChangeNotifyPrivilege	3356	windowsdesktop-runtime-9.0.21-win-x64.exe
Token: SeRemoteShutdownPrivilege	3356	windowsdesktop-runtime-9.0.21-win-x64.exe
Token: SeUndockPrivilege	3356	windowsdesktop-runtime-9.0.21-win-x64.exe
Token: SeSyncAgentPrivilege	3356	windowsdesktop-runtime-9.0.21-win-x64.exe
Token: SeEnableDelegationPrivilege	3356	windowsdesktop-runtime-9.0.21-win-x64.exe
Token: SeManageVolumePrivilege	3356	windowsdesktop-runtime-9.0.21-win-x64.exe
Token: SeImpersonatePrivilege	3356	windowsdesktop-runtime-9.0.21-win-x64.exe
Token: SeCreateGlobalPrivilege	3356	windowsdesktop-runtime-9.0.21-win-x64.exe
Token: SeRestorePrivilege	2716	msiexec.exe
Token: SeTakeOwnershipPrivilege	2716	msiexec.exe
Token: SeRestorePrivilege	2716	msiexec.exe
Token: SeTakeOwnershipPrivilege	2716	msiexec.exe
Token: SeRestorePrivilege	2716	msiexec.exe
Token: SeTakeOwnershipPrivilege	2716	msiexec.exe
Token: SeRestorePrivilege	2716	msiexec.exe
Token: SeTakeOwnershipPrivilege	2716	msiexec.exe
Token: SeRestorePrivilege	2716	msiexec.exe
Token: SeTakeOwnershipPrivilege	2716	msiexec.exe
Token: SeRestorePrivilege	2716	msiexec.exe
Token: SeTakeOwnershipPrivilege	2716	msiexec.exe
Token: SeRestorePrivilege	2716	msiexec.exe
Token: SeTakeOwnershipPrivilege	2716	msiexec.exe
Token: SeRestorePrivilege	2716	msiexec.exe
Token: SeTakeOwnershipPrivilege	2716	msiexec.exe
Token: SeRestorePrivilege	2716	msiexec.exe
Token: SeTakeOwnershipPrivilege	2716	msiexec.exe
Token: SeRestorePrivilege	2716	msiexec.exe
Token: SeTakeOwnershipPrivilege	2716	msiexec.exe
Token: SeRestorePrivilege	2716	msiexec.exe
Token: SeTakeOwnershipPrivilege	2716	msiexec.exe
Token: SeRestorePrivilege	2716	msiexec.exe
Token: SeTakeOwnershipPrivilege	2716	msiexec.exe
Token: SeRestorePrivilege	2716	msiexec.exe
Token: SeTakeOwnershipPrivilege	2716	msiexec.exe
Token: SeRestorePrivilege	2716	msiexec.exe
Token: SeTakeOwnershipPrivilege	2716	msiexec.exe
Token: SeRestorePrivilege	2716	msiexec.exe
Token: SeTakeOwnershipPrivilege	2716	msiexec.exe
Token: SeRestorePrivilege	2716	msiexec.exe
Token: SeTakeOwnershipPrivilege	2716	msiexec.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
3924	windowsdesktop-runtime-9.0.21-win-x64.exe
652	msedge.exe
1724	windowsdesktop-runtime-9.0.21-win-x64.exe
1392	sihost.exe
3292	explorer.exe
3292	explorer.exe
3292	explorer.exe
3292	explorer.exe
3292	explorer.exe
3292	explorer.exe
3292	explorer.exe
3292	explorer.exe
3292	explorer.exe
3292	explorer.exe
3292	explorer.exe
3292	explorer.exe
3292	explorer.exe
3292	explorer.exe
3292	explorer.exe
3292	explorer.exe
3292	explorer.exe
3292	explorer.exe
3292	explorer.exe
3292	explorer.exe
3292	explorer.exe
3292	explorer.exe
3292	explorer.exe
3292	explorer.exe
3292	explorer.exe
3292	explorer.exe
3292	explorer.exe
3292	explorer.exe
3292	explorer.exe
3292	explorer.exe
3292	explorer.exe
3292	explorer.exe
3292	explorer.exe
3292	explorer.exe
3292	explorer.exe
3292	explorer.exe
3292	explorer.exe
3292	explorer.exe
3292	explorer.exe
3292	explorer.exe
3292	explorer.exe
3292	explorer.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
3292	explorer.exe
3292	explorer.exe
3292	explorer.exe
3292	explorer.exe
3292	explorer.exe
3292	explorer.exe
3292	explorer.exe
3292	explorer.exe
3292	explorer.exe
3292	explorer.exe
3292	explorer.exe
3292	explorer.exe
3292	explorer.exe
3292	explorer.exe
3292	explorer.exe
3292	explorer.exe
3292	explorer.exe
3292	explorer.exe
3292	explorer.exe
3292	explorer.exe
3292	explorer.exe
3292	explorer.exe
3292	explorer.exe
3292	explorer.exe
3292	explorer.exe
3292	explorer.exe
3292	explorer.exe
3292	explorer.exe
3292	explorer.exe
3292	explorer.exe
3292	explorer.exe
3292	explorer.exe
3292	explorer.exe
3292	explorer.exe
3292	explorer.exe
3292	explorer.exe
3292	explorer.exe
3292	explorer.exe
3292	explorer.exe
3292	explorer.exe
3292	explorer.exe
3292	explorer.exe
3292	explorer.exe
3292	explorer.exe
3292	explorer.exe
3292	explorer.exe
3292	explorer.exe
3292	explorer.exe
3292	explorer.exe
3292	explorer.exe
3292	explorer.exe
3292	explorer.exe
3292	explorer.exe
3292	explorer.exe
3292	explorer.exe
3292	explorer.exe
3292	explorer.exe
3292	explorer.exe
3292	explorer.exe
3292	explorer.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
3016	MiniSearchHost.exe
3292	explorer.exe
3240	SearchHost.exe
4696	StartMenuExperienceHost.exe
3292	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3416 wrote to memory of 652	3416	dotnet-wave-bootstrapper.exe	83
PID 652 wrote to memory of 2984	652	msedge.exe	84
PID 652 wrote to memory of 712	652	msedge.exe	85
PID 652 wrote to memory of 484	652	msedge.exe	86
PID 652 wrote to memory of 484	652	msedge.exe	86
PID 652 wrote to memory of 484	652	msedge.exe	86
PID 652 wrote to memory of 2920	652	msedge.exe	87
PID 652 wrote to memory of 2920	652	msedge.exe	87
PID 652 wrote to memory of 3540	652	msedge.exe	89
PID 652 wrote to memory of 3540	652	msedge.exe	89
PID 652 wrote to memory of 3540	652	msedge.exe	89
PID 652 wrote to memory of 1452	652	msedge.exe	88
PID 652 wrote to memory of 1452	652	msedge.exe	88
PID 652 wrote to memory of 1452	652	msedge.exe	88
PID 652 wrote to memory of 232	652	msedge.exe	91
PID 652 wrote to memory of 2576	652	msedge.exe	92
PID 652 wrote to memory of 5104	652	msedge.exe	93
PID 652 wrote to memory of 1152	652	msedge.exe	94
PID 652 wrote to memory of 232	652	msedge.exe	91
PID 652 wrote to memory of 232	652	msedge.exe	91
PID 652 wrote to memory of 2576	652	msedge.exe	92
PID 652 wrote to memory of 2576	652	msedge.exe	92
PID 652 wrote to memory of 5104	652	msedge.exe	93
PID 652 wrote to memory of 5104	652	msedge.exe	93
PID 652 wrote to memory of 1152	652	msedge.exe	94
PID 652 wrote to memory of 1152	652	msedge.exe	94
PID 652 wrote to memory of 4280	652	msedge.exe	95
PID 652 wrote to memory of 4280	652	msedge.exe	95
PID 652 wrote to memory of 2272	652	msedge.exe	97
PID 652 wrote to memory of 2272	652	msedge.exe	97
PID 652 wrote to memory of 1424	652	msedge.exe	99
PID 652 wrote to memory of 408	652	msedge.exe	100
PID 652 wrote to memory of 4600	652	msedge.exe	101
PID 652 wrote to memory of 940	652	msedge.exe	103
PID 652 wrote to memory of 1424	652	msedge.exe	99
PID 652 wrote to memory of 1424	652	msedge.exe	99
PID 652 wrote to memory of 408	652	msedge.exe	100
PID 652 wrote to memory of 4600	652	msedge.exe	101
PID 652 wrote to memory of 3660	652	msedge.exe	104
PID 652 wrote to memory of 1340	652	msedge.exe	106
PID 652 wrote to memory of 1340	652	msedge.exe	106
PID 652 wrote to memory of 3288	652	msedge.exe	105
PID 652 wrote to memory of 3288	652	msedge.exe	105
PID 3660 wrote to memory of 3588	3660	msedge.exe	107
PID 652 wrote to memory of 2216	652	msedge.exe	109
PID 652 wrote to memory of 2216	652	msedge.exe	109
PID 652 wrote to memory of 2076	652	msedge.exe	108
PID 652 wrote to memory of 2488	652	msedge.exe	110
PID 652 wrote to memory of 2076	652	msedge.exe	108
PID 652 wrote to memory of 2488	652	msedge.exe	110
PID 652 wrote to memory of 4524	652	msedge.exe	111
PID 652 wrote to memory of 2452	652	msedge.exe	112
PID 652 wrote to memory of 4524	652	msedge.exe	111
PID 652 wrote to memory of 2452	652	msedge.exe	112
PID 652 wrote to memory of 2452	652	msedge.exe	112
PID 652 wrote to memory of 1560	652	msedge.exe	113
PID 652 wrote to memory of 3976	652	msedge.exe	114
PID 3976 wrote to memory of 3924	3976	windowsdesktop-runtime-9.0.21-win-x64.exe	115
PID 3924 wrote to memory of 3356	3924	windowsdesktop-runtime-9.0.21-win-x64.exe	116
PID 4724 wrote to memory of 1448	4724	windowsdesktop-runtime-9.0.21-win-x64.exe	120
PID 1448 wrote to memory of 1724	1448	windowsdesktop-runtime-9.0.21-win-x64.exe	121
PID 2716 wrote to memory of 3376	2716	msiexec.exe	122
PID 2716 wrote to memory of 1556	2716	msiexec.exe	123
PID 2716 wrote to memory of 2560	2716	msiexec.exe	124

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\dotnet-wave-bootstrapper.exe
"C:\Users\Admin\AppData\Local\Temp\dotnet-wave-bootstrapper.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.NETCore.App&framework_version=9.0.0&arch=x64&rid=win-x64&os=win10&gui=true
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:652
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x2f0,0x7ffd60b4c188,0x7ffd60b4c194,0x7ffd60b4c1a0
    3⤵
    PID:2984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1836,i,2647143567037442958,9250374208588231694,524288 --field-trial-handle=2268,i,4981807662385144511,14676367287828165371,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:11
    3⤵
    - Downloads MZ/PE file
    - System Time Discovery
    PID:712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,16134055642115952813,16590203059694257919,262144 --field-trial-handle=2268,i,4981807662385144511,14676367287828165371,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:2
    3⤵
    PID:484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2420,i,18046683203106473559,16264326422674553582,524288 --field-trial-handle=2268,i,4981807662385144511,14676367287828165371,262144 --variations-seed-version --mojo-platform-channel-handle=2528 /prefetch:13
    3⤵
    PID:2920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,1227126714937203697,5918726786110670314,2097152 --field-trial-handle=2268,i,4981807662385144511,14676367287828165371,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
    3⤵
    PID:1452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3492,i,12258767822183886524,13047423945542563454,2097152 --field-trial-handle=2268,i,4981807662385144511,14676367287828165371,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
    3⤵
    PID:3540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4080,i,16330007550948332289,8164635894469331195,2097152 --field-trial-handle=2268,i,4981807662385144511,14676367287828165371,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:1
    3⤵
    PID:232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4104,i,8092019239874071822,5756534875057085388,2097152 --field-trial-handle=2268,i,4981807662385144511,14676367287828165371,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:9
    3⤵
    PID:2576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4084,i,6572455450749369856,14398710644532797235,2097152 --field-trial-handle=2268,i,4981807662385144511,14676367287828165371,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:1
    3⤵
    PID:5104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4088,i,529967803539813761,16625080413912279606,2097152 --field-trial-handle=2268,i,4981807662385144511,14676367287828165371,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:9
    3⤵
    PID:1152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5216,i,9739644570765600427,16974434485440608107,524288 --field-trial-handle=2268,i,4981807662385144511,14676367287828165371,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:14
    3⤵
    PID:4280
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4684,i,2961160243790885789,13453501499897601836,524288 --field-trial-handle=2268,i,4981807662385144511,14676367287828165371,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:14
    3⤵
    PID:2272
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4760,i,16422007143689351184,6938239883245186486,2097152 --field-trial-handle=2268,i,4981807662385144511,14676367287828165371,262144 --variations-seed-version --mojo-platform-channel-handle=4720 /prefetch:1
    3⤵
    PID:1424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4736,i,3603450278208589472,7728956307522624731,524288 --field-trial-handle=2268,i,4981807662385144511,14676367287828165371,262144 --variations-seed-version --mojo-platform-channel-handle=4684 /prefetch:14
    3⤵
    PID:408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4092,i,7280799106716162366,7581912150114822020,524288 --field-trial-handle=2268,i,4981807662385144511,14676367287828165371,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:14
    3⤵
    PID:4600
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,10247407956320261992,17546676218189609301,524288 --field-trial-handle=2268,i,4981807662385144511,14676367287828165371,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:14
    3⤵
    PID:4064
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,10247407956320261992,17546676218189609301,524288 --field-trial-handle=2268,i,4981807662385144511,14676367287828165371,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:14
    3⤵
    PID:940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5920,i,8161119561199170675,13930886964103276587,524288 --field-trial-handle=2268,i,4981807662385144511,14676367287828165371,262144 --variations-seed-version --mojo-platform-channel-handle=6616 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1128
      4⤵
      PID:3588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6092,i,16615435894571605964,1843463775454429044,524288 --field-trial-handle=2268,i,4981807662385144511,14676367287828165371,262144 --variations-seed-version --mojo-platform-channel-handle=6660 /prefetch:14
    3⤵
    PID:3288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,16658405434137986408,16837373704118215073,524288 --field-trial-handle=2268,i,4981807662385144511,14676367287828165371,262144 --variations-seed-version --mojo-platform-channel-handle=6680 /prefetch:14
    3⤵
    PID:1340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6116,i,10966337478097969601,8849767398439304177,524288 --field-trial-handle=2268,i,4981807662385144511,14676367287828165371,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:14
    3⤵
    PID:2076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6976,i,13450448241718401992,9114206669807327479,524288 --field-trial-handle=2268,i,4981807662385144511,14676367287828165371,262144 --variations-seed-version --mojo-platform-channel-handle=6840 /prefetch:14
    3⤵
    PID:2216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7204,i,18330919004982536972,13360808895688769989,524288 --field-trial-handle=2268,i,4981807662385144511,14676367287828165371,262144 --variations-seed-version --mojo-platform-channel-handle=7196 /prefetch:14
    3⤵
    PID:2488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7336,i,4988110844948212723,289696953894391868,524288 --field-trial-handle=2268,i,4981807662385144511,14676367287828165371,262144 --variations-seed-version --mojo-platform-channel-handle=7288 /prefetch:14
    3⤵
    PID:4524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7200,i,4463990059786560371,1495127518155537276,2097152 --field-trial-handle=2268,i,4981807662385144511,14676367287828165371,262144 --variations-seed-version --mojo-platform-channel-handle=7268 /prefetch:1
    3⤵
    PID:2452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7444,i,16087557897670289887,1896944933836198305,524288 --field-trial-handle=2268,i,4981807662385144511,14676367287828165371,262144 --variations-seed-version --mojo-platform-channel-handle=7160 /prefetch:14
    3⤵
    - Subvert Trust Controls: Mark-of-the-Web Bypass
    - NTFS ADS
    PID:1560
- - C:\Users\Admin\Downloads\windowsdesktop-runtime-9.0.21-win-x64.exe
    "C:\Users\Admin\Downloads\windowsdesktop-runtime-9.0.21-win-x64.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3976
  - - C:\Windows\Temp\{7E4D44F0-ECEB-44EC-989E-47AB9C33DEB4}\.cr\windowsdesktop-runtime-9.0.21-win-x64.exe
      "C:\Windows\Temp\{7E4D44F0-ECEB-44EC-989E-47AB9C33DEB4}\.cr\windowsdesktop-runtime-9.0.21-win-x64.exe" -burn.clean.room="C:\Users\Admin\Downloads\windowsdesktop-runtime-9.0.21-win-x64.exe" -burn.filehandle.attached=580 -burn.filehandle.self=728
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:3924
    - - C:\Windows\Temp\{15FFEDC8-C173-4BD5-B37B-E6DC1190EB8D}\.be\windowsdesktop-runtime-9.0.21-win-x64.exe
        
        "C:\Windows\Temp\{15FFEDC8-C173-4BD5-B37B-E6DC1190EB8D}\.be\windowsdesktop-runtime-9.0.21-win-x64.exe" -q -burn.elevated BurnPipe.{55B1FA9C-3539-4A7A-A5CA-B429020697FA} {2914F775-6A8D-42C5-A135-85838F474576} 3924
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:3356

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3148

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2716
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 4CB8CF34EB0A52E4120E4EC8C3E55DEA
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3376
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding BB6C64BB817B7E86D5AA840462A45A6C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1556
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 85C4828721F99715D534360FAF35B4A3
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2560
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 97AF061D61A84D95C3D5D029FCF1D256
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3820
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding F87C9336775CE4C1325D2E268112F655
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1672
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 896AB940F2B854829F57AC21999B0D09
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1176
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 0BB3428722EE57B570F3D0457E495A26
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:764
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 1D211E9000821362C61D2D211F8000AC
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2592

C:\ProgramData\Package Cache\{9ebd7727-8105-47ca-8e74-76305a8bb1a1}\windowsdesktop-runtime-9.0.21-win-x64.exe
"C:\ProgramData\Package Cache\{9ebd7727-8105-47ca-8e74-76305a8bb1a1}\windowsdesktop-runtime-9.0.21-win-x64.exe" /burn.runonce
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4724
- C:\ProgramData\Package Cache\{9ebd7727-8105-47ca-8e74-76305a8bb1a1}\windowsdesktop-runtime-9.0.21-win-x64.exe
  "C:\ProgramData\Package Cache\{9ebd7727-8105-47ca-8e74-76305a8bb1a1}\windowsdesktop-runtime-9.0.21-win-x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_9.0.21_(x64)_20261016005545.log"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1448
- - C:\ProgramData\Package Cache\{9ebd7727-8105-47ca-8e74-76305a8bb1a1}\windowsdesktop-runtime-9.0.21-win-x64.exe
    "C:\ProgramData\Package Cache\{9ebd7727-8105-47ca-8e74-76305a8bb1a1}\windowsdesktop-runtime-9.0.21-win-x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{9ebd7727-8105-47ca-8e74-76305a8bb1a1}\windowsdesktop-runtime-9.0.21-win-x64.exe" -burn.filehandle.attached=548 -burn.filehandle.self=564 /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_9.0.21_(x64)_20261016005545.log"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:1724
  - - C:\ProgramData\Package Cache\{9ebd7727-8105-47ca-8e74-76305a8bb1a1}\windowsdesktop-runtime-9.0.21-win-x64.exe
      "C:\ProgramData\Package Cache\{9ebd7727-8105-47ca-8e74-76305a8bb1a1}\windowsdesktop-runtime-9.0.21-win-x64.exe" -q -burn.elevated BurnPipe.{81AC1A3B-5BA0-4790-955E-954AC6B2759F} {269326F0-774F-4D5E-A71A-BFE739E835C1} 1724
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:1320

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3016

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
PID:1392
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:3292

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3240

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4696

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e58e5f9.rbs

Path C:\Config.Msi\e58e5f9.rbs
Size 48KB
SHA256 b84a57568304b2e481e17428273c284ce142ff246c244337388e3c1c36d7da6f
MD5 9ded13695e58e212adffec930f987cd8
SHA1 f8bcb368449a92416ddc7c638a8ba5edd024e410
SHA512 815a769c88fce4021a63dd07b6bd0a7bedde89975e66554ab0c45b3a6d8f30ab55f637af1817ac73de828e6770fea6985fc6b3d04abb44e4f2d8d7782f5a24db
SSDEEP 1536:jpxQLbwujHP08tjOf9bLmrJyPoXe3tiMpYamO77jaLkbIqDC+/Rqd72l5ON4Ieic:sNdMcW
TLSH
T1A4232078EF40D1E3F53638681B25DE04270A4FD9D7086DAD17CED13A88D6AAC2E785D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58e5fe.rbs

Path C:\Config.Msi\e58e5fe.rbs
Size 9KB
SHA256 02b6031f709f72811402e4947ad2a4ac873dca9c56c4983f80a73b15e6278218
MD5 b02e6886b10dfb25702592215190bcaa
SHA1 dfb682af50da8ed6bcc5ecba431f15c423140b66
SHA512 54ad83d0c3c819efb159c51fbbee78dc58f3a0331ea247d2a6c600ceeea21391b6144e0dff94c65697c271bd9dedb07785ee547eca9ab641fcef6c9f0add7d3b
SSDEEP 96:ajmecRfLHrlWuPCLgA1UfeD2RBfCsTlJUfeD2RBfC6j2JDYaTlPYOKE5g7S/52Gl:fhTLhChO1BqI81Bq3wEEqNUN4ph
TLSH
T1BE120201BA1082D2E9A67B75CB07176077B3D3DA4740A34F15CEA6285F1BBC89F5C1DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58e603.rbs

Path C:\Config.Msi\e58e603.rbs
Size 10KB
SHA256 e53ec07a9459676312ca3d689aef375d619657b04d01386abe1ac5522aa6104e
MD5 ab46acf64f7db121214e35e4be25126d
SHA1 47b9ee652fb18d81feeb67b348adc7ed2cf322ac
SHA512 5748cd5bf211e475148bd91a7773ef5682310c6aa3cc10afd0bfaa05808a912aa3bbea5c22510bc7ebbfe1f1ae16c5364e80b39a6b019fa86f566736bab8420a
SSDEEP 192:fbHhIsA5HLbt9CmOacBqI7acBqCEEH60F4pT:fbHhIsA5H/WacB5acBLE
TLSH
T16D224192A64492C3E8A3073CCB075B257BFBD3D9C714529F09CE91748E0B7C81EA539A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58e60a.rbs

Path C:\Config.Msi\e58e60a.rbs
Size 88KB
SHA256 a8ee3b2f7b7ff4d767b7907f1013843ce25c2535771bd8f68969158e720f58d8
MD5 71622a4730f7c9f250c3c2c60875320b
SHA1 0689bb449e29e5efcbc5964b47aa0911503b0d22
SHA512 f6425ab2fbb65fba0732ce7eee9b1776f5798b42d85462c4e3f2ea313f75e6986ebc836595eb3edee98daadcafe4db1347a9ac59e1efe0d420b85ec74a9b9d82
SSDEEP 1536:LU0lEjS1nmFV3qM4Qbz0lkucOZ2UR7FnXkJTEUmqK0bme/1MeM5MaajWgCRnP0Nf:sr+9ksErkvkeDnpEUiqf04xe
TLSH
T10693E47D9B11C385EC332A48433FEE489E064E6B6745997E03C7812AEAD7E971B784C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58e60e.rbs

Path C:\Config.Msi\e58e60e.rbs
Size 3KB
SHA256 f7f33b90dda3fa74701242a165ffc73b8ab98b787a2cdfa2f34dba2a97a96a19
MD5 fdcf4a63ff1e507c8407b4bf5a176975
SHA1 d6c5668e4d76501677af371908a988f093717b74
SHA512 10449529943d3a4eed1a3bf79b9b7f6ebfdbb8097b8eabdf8fbde1a21181145386e2adee8058c990db87c7c2fdf176442ba4b24080fd449f3606a7727a207ec7
TLSH
T1077179129A40E683DCB62F70CE170B503377D7DAD724438B048DE2745D9BB956EEA28A
MD5 SHA1 SHA512 TLSH

Submit Download

e58e611.rbs

Path C:\Config.Msi\e58e611.rbs
Size 3KB
SHA256 ee4392a7d265a8c246face297e2b934670caca105e0daaf930328bebf42b323d
MD5 0a71a4a6022f8afc74f5861beda316ec
SHA1 82376b9389d918ab72829446f587edd2942b1795
SHA512 4f963dce22cc7f6333cabdaf4c7589d936b1be5f5c66ee17adc8dd0293c019c51471780329d05221a88d97d4fc95a319135615e3dbb8780d2b4a25f96d7c3bb3
TLSH
T1088157029A00D6C2EDA27B71CE170B6073B7D3DB87508387508DD6741E5BBC9AFE919A
MD5 SHA1 SHA512 TLSH

Submit Download

e58e614.rbs

Path C:\Config.Msi\e58e614.rbs
Size 3KB
SHA256 4a0e30b7acca4acef66a6f89312d762aee68dbac06b12a33a9c00515a2ac3171
MD5 adb36407042026b5fb9906f6361e51a4
SHA1 d236dfc9e5079f84ab1b1243b799320e8c135d84
SHA512 c1cb0851609b9564e26be1d625b4bf4004baf2b74da800b1356ea8a97344f0e342a7ffead2ccf7e8f0dccdd607b85c9296e0d12e385bca40c39d5ec5a33a2486
TLSH
T16C718D439604D283ECA31B74CE174B1133BBD7DAC72483CB048D91744D4BBC9AEE628A
MD5 SHA1 SHA512 TLSH

Submit Download

e58e617.rbs

Path C:\Config.Msi\e58e617.rbs
Size 3KB
SHA256 bcdb72ad8adfd540c985f43ff1fa05c5e8610b6977135e19d96a8a1aa1e53f78
MD5 ed64fcaff271a8794a977eaa1b727aca
SHA1 45c5da52330a4f9dd0a9703a349e40b9c8fea548
SHA512 38e6b4b329b2608b0eac99a2c49872be715d42f3a2feee8de1b119cc6e762dc0c061796cb1cbb348b0b5dbf7394e18377d7b4d970fc7df92132e9b91c2cfbdcb
TLSH
T1A4818D439A04D2C2DCB71F70CD1B0B5533B7C7DA8765438B42CD91701E8BB86AEDA68A
MD5 SHA1 SHA512 TLSH

Submit Download

ThirdPartyNotices.txt

Path C:\Program Files\dotnet\ThirdPartyNotices.txt
Size 77KB
SHA256 e8ddd95ac905467e4e519b446ca023fa00c31732bebd9b66e65101c712092ee7
MD5 406d07d20e58568365df0557629fadc6
SHA1 9ab5ba1ef3866afa75b8cf3c392b7dd3d7f52026
SHA512 c6025a947faa5dc2b41a14d75e228ca2bd0df094e8cef914c58a6d2f5854424972a647b2c8ca8173345e40ba7557843d03efa85c5098c6e0e6726377efc8a38f
SSDEEP 1536:HA9jHwsGfgg39/zwgAVkguQxrDjugtSEGepkWvrpX7anuqdLSVnfiStPq+3Lefrb:HA97w/ogz1AVxuMjHtSFULryLOgrGWwa
TLSH
T1F573A45F7E45077319E2C3916569A8C5F22FA02E3B6B2A44346EF248133B42DD6FF858
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 157KB
SHA256 b2162687fe15c4d5b749b1471555f7eb772b57e9a47f85914b355c962194c163
MD5 a38036234f6ccf2a1dd5ce3a6947a029
SHA1 d596349ba4d1e0e85c71bd2d25fca728b52cb1c4
SHA512 7cb89222d1b2fed053f3915c25a96b77614dec83301515880e60cbe45da1a70d19dfc86625788551c668af1bb1f1998f5e3eff3d28ec5687f73ab6c95de31ae4
SSDEEP 3072:jObbfvCnbu6mG/0j0Rhn2p/czEcN7K99wmv60:K/Cnbu6mG/aIhZ4WAHvt
TLSH
T15AF3061AD65811AAD1AE9571C7418A41FB337C6687E0E7CB13D0F9BE0F326906EE9703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet-hostfxr-9.0.21-win-x64.msi

Path C:\ProgramData\Package Cache\{9F01D8AF-A856-4A52-AED9-E9816487B435}v72.84.61380\dotnet-hostfxr-9.0.21-win-x64.msi
Size 776KB
SHA256 b129b76cf90e4a050b7a4544b9de929b36e1ecffc1d5502804850cbb23f939a2
MD5 a8833567c16fb213ab903bdc5892c188
SHA1 ac1011511067ec6fcc53d228112d05ffa1d72d4e
SHA512 0ec473e0fe8fa1667e828ce8a18d74a665e505238248784201103c08f67bdd6a7a198b6ce3654fcbf73b32858deea0b8cc33f0db5e5aba041adda68ae90d3c98
SSDEEP 12288:ZVE/EQZoZCNV1EgXmEI3os2Qx7E4D4Rxbp4K+1uiq:4R1NXdc3/7Rin+s
TLSH
T17AF4AE137D80803AD9BA0D719539D7B16F3DBE204A64889B6380B91DDDF15C0AF36BE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

state.rsm

Path C:\ProgramData\Package Cache\{9ebd7727-8105-47ca-8e74-76305a8bb1a1}\state.rsm
Size 932B
SHA256 9378f76ccbd900f22ce132122d903db43a21b6583fc2e5440faf7b0c7d0b5b84
MD5 8a6dd5db5fa6af0e94f49f7514c98ea1
SHA1 624ca2e2c04ea470f6931300fd2032bca6bb8325
SHA512 8dfb6cecbfc7c2bf0422d101136dea0c219e5f444ef114ed28a7efecb587a8209e296b61dad1805e7c54cbbaa3f6518c8ee744a6a0c7954a1df2161d1a659e18
TLSH
T18E1194A15FFA022AE3FAAB3069F42711643AB8120E32C16C0041318A8F31BA0C870F77
MD5 SHA1 SHA512 TLSH

Submit Download

6ced7433-52ef-460c-92ab-206aa7bedce2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6ced7433-52ef-460c-92ab-206aa7bedce2.tmp
Size 8KB
SHA256 58b46a03fe67394aef4cfb093f5d7cc18748770ef0257ad9b83d74d781825405
MD5 11d58cf41b8832423b02f50db7036920
SHA1 2cb92833a79c1f2cf3485a684c5c51c1ce6175d5
SHA512 9d0405aafbe7595aeecb207ed0893ae19a82442c698a9190f928bbdbad41042c4f33ce8de5e5352d6a7366923cf0cd3aeb695a7633a1668c20c95635c287d51e
SSDEEP 192:fGNeF6KsE7uDQmiUyGf/xuEwjzorFMwEAnX9j+L+2jC62Cqio1vU6:fGNw6LEq1Z/xuEY86wznXsL+2Oio9U6
TLSH
T114121B75A878EC674EE3B451F58736639FA41037ED856F41DAE85B1C00CB29C1B4E827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

99d88f13-7d80-4de7-9d24-6e4b98816fce.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\99d88f13-7d80-4de7-9d24-6e4b98816fce.tmp
Size 23KB
SHA256 5684945fa18cf506a6cc27e61772daac51016c60114360202e77622111c490b1
MD5 61d468931a8021587ab1a63c9c8efa04
SHA1 a75a28372da00b8147dfd6a2aa5d94ee3dcf2960
SHA512 eaf06962c2f6fc04b8bae8026f5eb03c640ab71573a586aad300715b8b4ca14d8d9e031a81e295816079f818c14de2c3270ebe24a14c29e822d33e7ba5c9749c
SSDEEP 384:nvQkUSv28Nc+IB2REqedkdGuEY86wznXsL+2HT/8t6sI6KV385oEvfnIIlH:x2wCqxgdTXOlH4tVLKV385oEvfnL9
TLSH
T1AFB2297C5C74AC3F82EEBB04A64E39639E68523BE5F51A58DB885B0CC0B619CF342815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

860022a4-0a8a-404a-8917-072a946bc05f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\860022a4-0a8a-404a-8917-072a946bc05f.tmp
Size 105KB
SHA256 faa1d17dbaa7275c5bf9f5f85c56bfd5886f17e7f8b00784101de8f5c039c356
MD5 d8b17b6bb640bff8fe28ad44a747f3d3
SHA1 42af3c2e122da92ce166cc222fcb6c05cc8e472e
SHA512 bb4055fb646199a59be3e4d455909dff93e1c0cb13653477973c3a58336f13da6f23290ae834b4b70337e52f6ad5c4ba63776e096e692279fc99eb7436a85abb
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7b:fwUQC5VwBIiElEd2K57P7b
TLSH
T1D7B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 83a1e607d50fc1ea413ea3d46f361ac900a5f1b4d5dd4102b2959cbdb2c4cd70
MD5 d57c7e44d35c9cdb36ed14dfab0dfab0
SHA1 8b9d00e4fc1ace8371328737a28deb3bfb8ed61a
SHA512 00b1b35765c219cf319043400cea5573885f0ec520a41bbd3dbea4d771ffe15fb3bc1f53440e052b4e9c0fedc69b2f606d82e0faabbe997cf35324282c5dcc03
TLSH
T11ED02280FBA80230E0323833C3E2C323220AE0E000802EC808E382CE3F22208000FCEC
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1e44aed290077f723703eaa270354b8a679261909eb9d25cf31be5edfa35db33
MD5 f4979738377744d24dd3dc9c6d376be2
SHA1 2f03a853ef616f8ec5cfdaa8d271c1f091d1676c
SHA512 bb960328c08dd0144b21f50191d2ffdd7b8ef65ef517666a4c3e9845a0aa94e987069b33b5829f37d5e25900f1ed53cf5525ab0a82f30bac5c9a6a7bcbca33a7
TLSH
T173D08051BB693EFCE57F703746D0D5411108DAA345501A5509474D5C2F741461455DEC
MD5 SHA1 SHA512 TLSH

Submit Download

0b30afe6-1d77-4127-9619-824d9089be0e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0b30afe6-1d77-4127-9619-824d9089be0e.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

1c993ff2-cacc-467f-ab06-0b4e32eaaf66.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1c993ff2-cacc-467f-ab06-0b4e32eaaf66.tmp
Size 11KB
SHA256 e0e7af555fc10fe4f6b9f71bfc955c4ff62bebbc3895708bd5daeba31811012f
MD5 62b8b99a04274f7e9064ba9211af49a4
SHA1 211526e8b825f3469787ddb1ad7ac3e01b085fc1
SHA512 bcf72710f27366534cee49456e6eb1cca9a7127af4372aa9f0550964e5531daf270df11e231992f757cb7c47cd6d243136bb6f4afbd7108ba1176cc2d111a88c
SSDEEP 192:sxZYRJrOn/f0siWpVofms+YgPIdpff/W6+WN4ype/AP0YW2B6hIgb+J:sxZYen/f0siWvoesTn/bY/tZ+
TLSH
T15242B756B934A93B8CCBD21DFA55BF13D6F95026A1D15E48AAFCC61C01E76ED220380F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

47c1b891-1444-4bc8-b4b9-b62afb1c7397.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\47c1b891-1444-4bc8-b4b9-b62afb1c7397.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 3f7268fc679b38e588d639ee2e0e15c1c143bfad62802916d8a9dd693925a461
MD5 a80bc570814a0319509324806d350f6a
SHA1 8b5d8a44f3c0a86fd5a28720602ec87dd8badd59
SHA512 bdc74b1b8ff48cea150d1722b54b03662c067f68b33625cff45be56adc0b8209f63d1a82b00d26f6aadecf607b0184b9997f0349997b36db91a5e2a2405bd0bb
TLSH
T1B961A6827AA940E6E7A4583FC5FD13473B7A7748BB937F2704E8EA7C88377465120060
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 0e99ade07d72757f151c5c44bec9ec504853a02f8a09e554d615d698e768f6c8
MD5 09ca37cc3d00e5d3c9417df226634799
SHA1 76acbf5396a6ad77c9e764ab86ed78a6163b90af
SHA512 17d1259669e087102825a2bbdb42d576b3e2940649c2b31e5a8f47cc8b6db668926f62264c7fec49d4f933300a647440ee4adb90defb06098dcc152a7b52ed12
TLSH
T137516F823A6940DAF7A4583FC1ED12473A3A7788B7937F2B04E8C67D88367455120160
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

9b49bd0e-a71f-47ae-bbf3-1803f4fb2572.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\9b49bd0e-a71f-47ae-bbf3-1803f4fb2572.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.111.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

12d40ae5-f102-4060-b480-f9add01786d6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\12d40ae5-f102-4060-b480-f9add01786d6.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

27646d23-27d3-45dd-ae1b-5a6eab98877d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\27646d23-27d3-45dd-ae1b-5a6eab98877d.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

64eb7cbe-c609-4920-8844-36c7ba511d03.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\64eb7cbe-c609-4920-8844-36c7ba511d03.tmp
Size 3KB
SHA256 aa9838a90ce722741affb2a20a10e8226111241d471c2edb4c465137edba9a97
MD5 79274648450b317c67f0ab74099d2b97
SHA1 46ef2a128f1164792e84c7f003046e2f430d54d4
SHA512 871573786183e40c5d413701fdc724ab597ef19dd186782658ea3ceb872e1e1941a2cbb5076f57f32017268f66dfc484dc3ac029a3f8e99f004513683499dbd0
TLSH
T1DB618DF787F4856E8A0096F09618AE2FDF2D0615431C7C6989D4AE27D7E3472E10265B
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 6999a37543869f4a8fa8088e471cb65f44b75217c0ff18ca7c5247e520c5b49b
MD5 0056518c71efa77ff92cf0596285ac0a
SHA1 f86c64cc3539c7f863ab072bfb0c455a5fa205d8
SHA512 73ad6e20f37f77627a9f9f6f027c741532dce3bf5c96a576319ea10621e85f3c10a8c00d2569f7addbf9d2a0da38e3b3926a6b9881d63461f8bdd843db7f0c15
SSDEEP 96:KQL6KUEWakgKN6m0rS37xVBg1NIzTTgK71TZgnjT455:kx/rrj
TLSH
T12291E15030BA52943CBE350890B9871B06517373321CEA2B7FBD16AA8D6BE197CFD5C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a532e1cd-92a8-4e44-ba7d-9f4ea44ec17a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a532e1cd-92a8-4e44-ba7d-9f4ea44ec17a.tmp
Size 10KB
SHA256 ad902e4dc928a43e97f0fa4c50e7e0d9e74da78c0e137c403abc2d76ea50241c
MD5 e03b16cca52add66fe5251590054f498
SHA1 c60d38cdf786e442b4f676d3066749b39f1118e4
SHA512 ec18dbc336f29af850125ce76230b4d27bfdba09ad8d641c4f2476719d038319cb7085d4b30a98c26b11b74f05fd9b530154a1de4072d8454607bc08238fa83e
SSDEEP 192:sxZYRJTOn/f0swfms+Y1PIdpff/W6+WNrpe/AP0gQZBBfIg5+J:sxZY2n/f0sweswn/b0/tfA
TLSH
T16A32D952BD34A93B4CCBE219FA55BF53D6F95032A1D51E48AAFCC61C04E66ED220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bf400a01-4567-43fe-b523-522e951e99be.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\bf400a01-4567-43fe-b523-522e951e99be.tmp
Size 10KB
SHA256 d52ad48c18a6463593fe65dd0da445a196013c144dfe2b3924cfc0635f4cf8db
MD5 6d35f406ba4358f5ba9888a688450834
SHA1 8b854ac5110bab336890610f1651b5846b5c9100
SHA512 23869399312afddba249b7cecee4f46239317369533456f5e3abb2312e4f91a6e905387daef04cc70d049ba976af057190cddd631fae7cf6fd1edda4a326aa16
SSDEEP 192:sxZYRJTOn/f0s1fms+Y1PIdpff/W6+WNrpe/AP0gQZBBfIg4J:sxZY2n/f0s1eswn/b0/tfc
TLSH
T19F32C952BD34A93B4CCBE219FA55BF53D6F95032A1D51E48AAFCC61C04E66ED220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fe06e15c-6ddf-4829-a06a-8040d270e088.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fe06e15c-6ddf-4829-a06a-8040d270e088.tmp
Size 33KB
SHA256 05c9fd5d54fddbe95c4394ac1fa1240f8fa74548e8f6d61316b639c4739b5c9e
MD5 6cb73ab80cac3eab8a6f1fe8ed988d97
SHA1 367cb6d0bcd2e84a885bbd49d4dbe77db4251649
SHA512 27272a18c7f5aef5ba7c7509b9fd23745619dbb227dfccfb41cbd1deedfc2f1e5f72432b65d522d90f7f7832f90e02c0063a7bb0b9ba5e8042dbeab448ef866b
SSDEEP 768:nnnh588N2PK7pLuLjYsWRmUUQ6I8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3GzMrLlK:nnnh588N2PiEjYsWRmUUQ6Iu1jaKGzMo
TLSH
T1A1F2E93B380CCB7E4FC04A9DED567F9A6DA8028BA598CD4047FA985C02C77EE51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b79c47ca-e02f-4ea3-aee2-ab373bc5168b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b79c47ca-e02f-4ea3-aee2-ab373bc5168b.tmp
Size 18KB
SHA256 79c64d30af95132983014a0c3b8254ed0c78049d1d82c9881f30936da1809e84
MD5 217e674199a8c6546220a6edbdb3e4ee
SHA1 bbbfc6a58a704d655534b9a15e6cee839b81d586
SHA512 703c604802ee989b7924a01fcf15f74b6ecd9e769f7a4ca4916d12819aa40192dcdb38e9b988ce19fca1ff4c0d8bcb16b694efe8a8b9bd4cbbcd1b735181a456
SSDEEP 384:nXQkUSv28NN+IB2REqe8WdGuEY86wznXsL+2Eio9vfnIIlH:p2PCqSgdTXOlEio9vfnL9
TLSH
T118826C756C78ED6786F7A101F24A32939FB4907BEDC61F54EAC88B1C00CA2DC274B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e0f74f4d-d6e3-4905-be70-1b933ed041e6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e0f74f4d-d6e3-4905-be70-1b933ed041e6.tmp
Size 18KB
SHA256 754120adc917cedc7bb883d819e8250ede7b61f91874735a2bfb3e7e6de6eeef
MD5 73de277a5b44da271df35838cd25de9d
SHA1 62be4b033ce1955670902cd256ff44712f334438
SHA512 4c3317bc545f0e7f9ea6bba46ee833edd304605f648545378a6b940a244c5a97c50c7cd17aaa05916702223a52fe70e693589b0b441b512bb69afed2d6145073
SSDEEP 384:nlQkUSv08NNqIB2REqeaWdGuEY86wznXsL+2Eio9vfnIIlH:/0PCqIgdTXOlEio9vfnL9
TLSH
T190827C756C38DD6786F7A101F24A36939FB4A07BE9C65F54EAC89B1C00CA2DC274B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

045946fb-76e8-42e5-9138-a8a78d0a0d13.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\045946fb-76e8-42e5-9138-a8a78d0a0d13.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

fc8e3762-9ca2-495e-9c37-3328920b7819.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\fc8e3762-9ca2-495e-9c37-3328920b7819.tmp
Size 8KB
SHA256 6b51a86c24a1c5bb365a75624c0f2db989f50c6d4f3d9ce3d30b1e4c9c016cd2
MD5 e76dbcd5e5a680231b374f57a59c5929
SHA1 0084fd166868b6002d760bc2cf089bbae376a28a
SHA512 354299c5a3e44dcaa827b1ccae72693993afe79975745849bd6bde4d418c514a18b572c335855e116325fc03d91648b7cff908bd0664a3d1f58421d978c81a21
SSDEEP 192:DGN16KsE7uxQmiUyhUfgxuEwjzorFMwE2u9ztU6:DGN16LEqPGAgxuEY86wGBU6
TLSH
T1EC02D8356C786CAB8FF3AD45B54766235FA4112BEA952F80DAE81B1C40D729C1346827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

764cd5f8-abdb-43e9-b1d4-73dcbb0b1a9c.tmp

Path C:\Users\Admin\AppData\Local\Temp\764cd5f8-abdb-43e9-b1d4-73dcbb0b1a9c.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

Microsoft_Windows_Desktop_Runtime_-_9.0.21_(x64)_20261016005545_000_dotnet_runtime_9.0.21_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_9.0.21_(x64)_20261016005545_000_dotnet_runtime_9.0.21_win_x64.msi.log
Size 3KB
SHA256 ff363e7c8915271851d03390cc5d6595147c372639221a20efe4ca211a5773b4
MD5 4f14f74bd3a38622d0386efbf317c267
SHA1 c1100867af70029edb5f5a99206c2826f398405d
SHA512 e472656a7b845dafd52703d2b3769af150d6bd8d01b83de1ded17897b8314247171f8baddcfee1a2e08b464868b2a3b2d7d41c5a29d773e036c950418614a420
TLSH
T1928129241FE80956B1F7965BDEF3C0238A33FDD5A974CB0D1345831946A780199A8F7E
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_9.0.21_(x64)_20261016005545_001_dotnet_hostfxr_9.0.21_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_9.0.21_(x64)_20261016005545_001_dotnet_hostfxr_9.0.21_win_x64.msi.log
Size 2KB
SHA256 a8b0d15d1ff48546084216309331df34112fb9b368561368866088a4787e3d02
MD5 49bc83e5700ea5387a578c618ccb3b65
SHA1 e7e3d871f4b208d1a72841d103821b61e648d632
SHA512 82cac8568e1afc52c61e101e264ac7deb1e02f51a0eada51d2a2d8f7cc6935f4d6a94eca590c88b8d7ba24fb8d050657bd06626def0b499770e101de75523469
TLSH
T1FD410B251BE81984B1BBD743DAF7C0528A33FCD49974CF0C23864219426BD06699CF6E
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_9.0.21_(x64)_20261016005545_002_dotnet_host_9.0.21_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_9.0.21_(x64)_20261016005545_002_dotnet_host_9.0.21_win_x64.msi.log
Size 2KB
SHA256 9e8ebddd7bed8d75fda15badaafcbd8a5bdd7294668625fefa279e2d3d0922f7
MD5 f4ce17a74925a7151dac52e792fba593
SHA1 37fdf7232891b98e98db93882420b0f5d4537c26
SHA512 dc738803afb2a76dd1ec95c90bbea0cc2802e0a1d3d9c73abd47690e8902069de36079faff95c5d64f688a57eed14183c7f2e06e403329afb8e4711f4648a9b8
TLSH
T1104126152EE85944B1BA9647DAF3C063AA33FCD1A874CB0D238683190667D0159ACFBE
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_9.0.21_(x64)_20261016005545_003_windowsdesktop_runtime_9.0.21_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_9.0.21_(x64)_20261016005545_003_windowsdesktop_runtime_9.0.21_win_x64.msi.log
Size 2KB
SHA256 96f38b65c5293dd46c4c8650798a0909d0bf167dd665ab8ac73f35cc989ca224
MD5 a9cedb0f9d1ffc947ab77c3571a84388
SHA1 16d4a143ba3a974a8f64092fd90901f4531fe5d6
SHA512 457202c657507162d2e09fec03cb441ca4df259c55aba9d6ee88e488f5c0dad44addf1e1798bb46234bd4bfb09e6057cbcc84af891d8f7f997464112fd7dd795
TLSH
T1A941F4242AEC1985F1BA9747DAF3C022AA33FCD6A874DF4C134682190667D01996CF7E
MD5 SHA1 SHA512 TLSH

Submit Download

ca53bdbd-2b40-4fbc-a2be-8650f1e85242.tmp

Path C:\Users\Admin\AppData\Local\Temp\ca53bdbd-2b40-4fbc-a2be-8650f1e85242.tmp
Size 158KB
SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
MD5 9c18c4721b560ec55f0d5de055144d5c
SHA1 6af37a3bda916cac276ad5879c9f61262d9ae523
SHA512 51466928eb8d3cf7b917919c98bd8168453583d2c3dc5836036d87ffd0d2c732ab8450212a880fc6de199ea569a96993ba0d250a5012160d2d72211880695f92
SSDEEP 3072:5ZwEurOxn8zXnHc2qHNYEU/rUHCVJWGdi0Ha5HnXk9TFzBsuht7yGik:5ZwPOx8D85UIHEI0HaZ09JzKStjik
TLSH
T1CFF3E13E7EDE891AD80B10BB7F16B18BD80D8E0B460AB44B769D80155B3668D1BD1CFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir652_1260412877\CRX_INSTALL\_locales\en_CA\messages.json
Size 711B
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
TLSH
T1460197136240AF18470BF05BB9023442A0B44AC62384E0B775EC982C6656DAFB20B3B0
MD5 SHA1 SHA512 TLSH

Submit Download

3d598fc9-9f30-483b-a1cf-7899793d515e.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir652_2089398805\3d598fc9-9f30-483b-a1cf-7899793d515e.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir652_2089398805\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8ee713dc-e5e9-4d5e-999a-013a2e491321.tmp

Path C:\Users\Admin\Downloads\8ee713dc-e5e9-4d5e-999a-013a2e491321.tmp
Size 58.0MB
SHA256 3e84553cab2edbcb2d5b907d302b1f38d265994522057be65eb9b0361cc19d56
MD5 2d91f6816f1e3d1675051785c252d73d
SHA1 187aa9c289cdad0219d164ebe6a30b0f71620233
SHA512 524c12e7c6e97af19e9711c4f5daaeb2b962fd50fe8632a34bd3e5539843642c15766f429f66b557a074ea9be278c209036f3e576edc757fb42d5826b1bb2f5e
SSDEEP 1572864:kkdT082KBZDe6b3N6y1R3MyNPNR69waKjSVYawWzL4dbhuL:kE2KbDJb3NzMQPNR8wJuDLzL4dbS
TLSH
T16DD733339616C43FFBA29277D94C97200954B3910F12E992F7D0ED7C6BB74436272A8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windowsdesktop-runtime-9.0.21-win-x64.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\windowsdesktop-runtime-9.0.21-win-x64.exe:Zone.Identifier
Size 185B
SHA256 47fbdb5aec2994685e9b4d6b8a53141c7bd5dc8e43183d6247ea366a0911ba09
MD5 063d0883f60d7848a33aee8ff0846885
SHA1 923c176354f471665ee59cc7a3ea12925c26cfdb
SHA512 59effb2e9294bda8e369ddbf21d626de834f5cc3992f3b5dbacf2b3376f3fc5eb96e898358f779afa7bca6c9c725935bbc5447077b2abc3e880d73f8d6302518
TLSH
T17CC0125BC40045420E3023868B6FD6A8EA0F1E574981D39C8CC5C092E573DDAC191891
MD5 SHA1 SHA512 TLSH

Submit Download

MSIFB62.tmp

Path C:\Windows\Installer\MSIFB62.tmp
Size 219KB
SHA256 2bf33a9b9980e44d21d48f04cc6ac4eed4c68f207bd5990b7d3254a310b944ae
MD5 928f4b0fc68501395f93ad524a36148c
SHA1 084590b18957ca45b4a0d4576d1cc72966c3ea10
SHA512 7f2163f651693f9b73a67e90b5c820af060a23502667a5c32c3beb2d6b043f5459f22d61072a744089d622c05502d80f7485e0f86eb6d565ff711d5680512372
SSDEEP 3072:FVzl3qiEZybztEwiUx6D02cWVsV1v2vZR3X6j7zo6k2FkngTLrOrORT9flQnS6lg:FVIMEgXmEAR3oHon2VaFuG0eEp
TLSH
T1AF248D217494947EEAFA0832A57EDA71BF3DF2241760C8AEC3409D1E6D604C167B7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bg.png

Path C:\Windows\Temp\{15FFEDC8-C173-4BD5-B37B-E6DC1190EB8D}\.ba\bg.png
Size 4KB
SHA256 9095bf7b6baa0107b40a4a6d727215be077133a190f4ca9bd89a176842141e79
MD5 9eb0320dfbf2bd541e6a55c01ddc9f20
SHA1 eb282a66d29594346531b1ff886d455e1dcd6d99
SHA512 9ada3a1757a493fbb004bd767fab8f77430af69d71479f340b8b8ede904cc94cd733700db593a4a2d2e1184c0081fd0648318d867128e1cb461021314990931d
SSDEEP 48:u+Xg+NXWbdlIr33lx9W5OstaDIy3r5XpPyvZKmXYTDeiByNxcaaaaaaaaaaaaaaE:AaXWPIrHT932JsdpPyjqDeioatEn
TLSH
T19891B4D8FCF95322C6002BF255F4C0735A0215B713ABFEC82F496BD90E6878E25058B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixstdba.dll

Path C:\Windows\Temp\{15FFEDC8-C173-4BD5-B37B-E6DC1190EB8D}\.ba\wixstdba.dll
Size 190KB
SHA256 dcea15f3710822ffc262e62ec04cc7bbbf0f33f5d1a853609fbfb65cb6a45640
MD5 f1919c6bd85d7a78a70c228a5b227fbe
SHA1 71647ebf4e7bed3bc1663d520419ac550fe630ff
SHA512 c7ff9b19c9bf320454a240c6abbc382950176a6befce05ea73150eeb0085d0b6ed5b65b2dcb4b04621ef9cca1d5c4e59c6682b9c85d1d5845e5ce3e5eedfd2eb
SSDEEP 3072:sjEoXsLW9OLG8Qp51ySdjDXY33b+Av7O5IkI+/AYkPAEc527uu3k/gLtxavf0ir2:sjEo8LW9553hXWy15I2YrAW7FUVEihs3
TLSH
T1FF14AF1176D0A07AEBFB16307A39A5216E7DBA200FA0C9DF63449D2B1D715C19B36B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet_host_9.0.21_win_x64.msi

Path C:\Windows\Temp\{15FFEDC8-C173-4BD5-B37B-E6DC1190EB8D}\dotnet_host_9.0.21_win_x64.msi
Size 704KB
SHA256 add805f3953b1eb2cd47e38be63d0be5e9885b5c46cc8a47f28be3da8a5552ec
MD5 8c3d24ee4a5d32b9e975ceda6223470e
SHA1 d8ee12db64bb2bbe3d0a10c8e6cb38a3a3421a4e
SHA512 9abf7ee594358139283ec4e2e8b666a984fc610398ad7b1551509f8c5907af9ef0e59275e0b7ead0bcfd28e0c016aa040e319a284d3dcfdf32ebc6d023f24d25
SSDEEP 12288:bvD4l/wSV1EgXmEI3os2Qx7E4D4Rxbp4K+1uiqe:MjXdc3/7Rin+sW
TLSH
T192E49D237D80803AD9BA0D718539D7B16F3DBD204A64889B6380B91DDDF15C0AF76BE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet_runtime_9.0.21_win_x64.msi

Path C:\Windows\Temp\{15FFEDC8-C173-4BD5-B37B-E6DC1190EB8D}\dotnet_runtime_9.0.21_win_x64.msi
Size 27.6MB
SHA256 01385da55508a3485391ca4663de71468df07371902fc76195fd838751a2f5c7
MD5 d008884d130912e1a366a477330f5581
SHA1 fd90e3ff8af829c7bab987ae6e745cd691f4ea76
SHA512 68c95a633606d51f6209bb16079bc48e0ecc83e24b769f2e17b06b1090137c473ef01442362cbec5035297df62b3a8b7da44cfc30b7ba9e677b9d80c1a5aa368
SSDEEP 786432:HNgbJAUvglJ/zAsfAr3aW3pONI9i+UFFEKnI:HbUIlJUsfArP3pONI9itFPI
TLSH
T1CB5733373D83903EE46A1EB5403ACB61472AAD504B22D8D7F3D1722DDDF21D06A72AD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windowsdesktop_runtime_9.0.21_win_x64.msi

Path C:\Windows\Temp\{15FFEDC8-C173-4BD5-B37B-E6DC1190EB8D}\windowsdesktop_runtime_9.0.21_win_x64.msi
Size 29.9MB
SHA256 c267349844f1e38f8880297e9aeae7583b66a1ec1eea7639a746506f71916172
MD5 ae6b6c04c504c4b7e26e387251057180
SHA1 415c38e092c2404cd7d8c76d6fdf60445ac4321c
SHA512 6d7603ad4a810ca9e12a684906c75dd7810c397927bd221f1b5417a766670026c1d93b4b5ffda947945f1ee4c25a5ff0f315bf0da8611f4965a86e6cd232da06
SSDEEP 786432:gh9XA6XHwbGznA/na5UHULMruYBacFRnw4dBt:gh9X3QbGz2D0L+8Ynw4d
TLSH
T14C673323BF92C93AD9B54E76847ED7610A396E600650CD4367E0382DDDF2AC1AB343D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windowsdesktop-runtime-9.0.21-win-x64.exe

Path C:\Windows\Temp\{7E4D44F0-ECEB-44EC-989E-47AB9C33DEB4}\.cr\windowsdesktop-runtime-9.0.21-win-x64.exe
Size 607KB
SHA256 ec370f05c3a187d24324a14134e0083d2c1c01b9001850f82b6e8854f7b8df15
MD5 f954a738593fb93bd0ef4d9c2108c2f8
SHA1 70a003879b3476ee95b9c94a175d6f3cf6a35373
SHA512 4a4183c9cf11436f8eceda4078a0e1c63fcc60c453c28744c9052f7b0e3e40bd3b7e4fea8b66f7145391d54353e4249886c69f0e61a109efeac0cd347a27bdaa
SSDEEP 12288:gmEsd9PZfePv3xl7ft7V+6uC+zd5qLlj33wyDiy7nlEM0Dnmb:gm39PZfePv3r7fm6t+jqpL3xzCM0U
TLSH
T129D47D32A5614032F7F106B3B92896303E3CE328175488AAE7D4AD1D7EB84D667F7257
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BootstrapperApplicationData.xml

Path C:\Windows\Temp\{DA9C53D5-4C8A-4427-AB6D-C615C12BB112}\.ba\BootstrapperApplicationData.xml
Size 7KB
SHA256 4bacd5cd0f7a34d629ce28485cd5059e80b349c287f99d3c88b0a8712a969c78
MD5 9fa3433d723b845d2ce07b06468f1f8c
SHA1 6691219af6277bb0416433cbad4acf18d52956a9
SHA512 1012f0a2d25bc80548426276a134bf2c7031225726ab304f9214a5b21122d0712dceeca4fb252f58b89cfc7942610aff34d6354ba7b6c77ba548131d8b8685e5
SSDEEP 96:XeV2VS/V2VvVtn6Vky0wqyc+an6ti+0wiycJn6xaF0wOyc6n6YMN0wJycRlVM4rN:X0sesv/W+2BaOYOmadqlL/bwVW8gc
TLSH
T1C7F17B142FFD0329F0F74F84E9F8501A5A35BCD26E38DA5D01551D0E8972B819962FBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{DA9C53D5-4C8A-4427-AB6D-C615C12BB112}\.ba\thm.wxl
Size 5KB
SHA256 81a68046b06e09385be8449373e7ceb9e79f7724c3cf11f0b18a4489a8d4926a
MD5 d5070cb3387a0a22b7046ae5ab53f371
SHA1 bc9da146a42bbf9496de059ac576869004702a97
SHA512 8fcf621fb9ce74725c3712e06e5b37b619145078491e828c6069e153359de3bd5486663b1fa6f3bcf1c994d5c556b9964ea1a1355100a634a6c700ef37d381e3
SSDEEP 96:MT0abTxmup/vrCKATQdYQHdYCwgoVOBq9LjP5dbSE7:OQNkdYQHdYCYXt7
TLSH
T1F1C1DBA778CF53C128731255EA925AAA5911C19C537F2DF4FC8B454B838A827A373F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.xml

Path C:\Windows\Temp\{DA9C53D5-4C8A-4427-AB6D-C615C12BB112}\.ba\thm.xml
Size 11KB
SHA256 83ca096f7ba2c83fc3b3aeb697b8139a788fa35eb8632943e26bb9fff7c78e63
MD5 302563a713b142ee41b59e3eeac53a90
SHA1 1340e90cc3c6c5fc19a7feb61d7779f4a4f0fdb5
SHA512 c9d4dfc20802bb542178300d1044bb94b35593b834ab0b50875a32953f890e48da456199128500e2c1fee26eaaf8c2c4fcaffb308b37914215f900cdd5c4cbc8
SSDEEP 96:eCdhlFGZRd4UyAi0Rz96zYFGiRdl6dXXdT9gUoLNEmRG3QBinRFRK03K8+GGI9ki:eCSfiozEW/A
TLSH
T1A2325BA986DE7C00D232E711ABF271D6AF126862C4C46E58F94C39BB4FE25406C7727D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3240-1490-0x0000011243680000-0x0000011243780000-memory.dmp

Download

memory/3240-1491-0x0000011242F90000-0x0000011243090000-memory.dmp

Download

memory/3240-1501-0x0000011264920000-0x0000011264A20000-memory.dmp

Download

memory/3240-1519-0x00000113666D0000-0x00000113666F0000-memory.dmp

Download

memory/3240-1520-0x0000011264F20000-0x0000011264F40000-memory.dmp

Download

memory/3416-0-0x00000244762D0000-0x0000024476A8A000-memory.dmp

Download