31c8467f4b6952a54875eb54ac1ab0934ce573fe926681458201a4fb93cec76c

Analysis

user interaction
yes
max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/10/2026, 11:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MG1HMCBvb.exe
Size 21.5MB
Sample261024-nw2hjstygs
SHA256 31c8467f4b6952a54875eb54ac1ab0934ce573fe926681458201a4fb93cec76c
MD5 d96fd5691aed1e20a0e3775ab62bb55c
SHA1 3b50c71f5ea995f3f6dc71fe297be9db50f64055
SHA512 bb130c75527d8b15fe3cd142610c1b418e45ab2757fe4097fcfb1e8dc07a62496f8a0c5e8dadd72cd10de860eee8976f9d58fbaaa1e815960ec340ce4959d605
SSDEEP 196608:S0Cs0S3WWZYF0tih0oWMnaUVPrdQ8rvsluv67amrYn/u5UapqO0junr0eneK2AH:S0B0NDsih03MnVVPrdQllv7Y/BtWrVnj
TLSH
T1A437AE102BA88A3AD1EFAB72E0F1401193B1E826B313E74F7858A9A51D537D5DF017E7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
96	440	msedge.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\International\Geo\Nation	windowsdesktop-runtime-10.0.13-win-x64.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\International\Geo\Nation	windowsdesktop-runtime-10.0.13-win-x64.exe

Executes dropped EXE 7 IoCs

pid	Process
3876	windowsdesktop-runtime-10.0.13-win-x64.exe
2268	wixstdba.exe
3188	windowsdesktop-runtime-10.0.13-win-x64.exe
3468	windowsdesktop-runtime-10.0.13-win-x64.exe
2228	windowsdesktop-runtime-10.0.13-win-x64.exe
5812	wixstdba.exe
5924	windowsdesktop-runtime-10.0.13-win-x64.exe

Loads dropped DLL 12 IoCs

pid	Process
5232	MsiExec.exe
5232	MsiExec.exe
5552	MsiExec.exe
5552	MsiExec.exe
5760	MsiExec.exe
5760	MsiExec.exe
5844	MsiExec.exe
5844	MsiExec.exe
4832	MsiExec.exe
4832	MsiExec.exe
964	MsiExec.exe
964	MsiExec.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{3A4D9E06-6029-4CBB-BB9F-2799A6AF4AC1} = "\"C:\\ProgramData\\Package Cache\\{3A4D9E06-6029-4CBB-BB9F-2799A6AF4AC1}\\windowsdesktop-runtime-10.0.13-win-x64.exe\" /burn.runonce"	windowsdesktop-runtime-10.0.13-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{3A4D9E06-6029-4CBB-BB9F-2799A6AF4AC1} = "\"C:\\ProgramData\\Package Cache\\{3A4D9E06-6029-4CBB-BB9F-2799A6AF4AC1}\\windowsdesktop-runtime-10.0.13-win-x64.exe\" /burn.runonce"	windowsdesktop-runtime-10.0.13-win-x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.13\PresentationFramework-SystemXml.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.13\System.Threading.Thread.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.13\System.Formats.Nrbf.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.13\zh-Hant\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\ThirdPartyNotices.txt	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.13\System.Security.Cryptography.ProtectedData.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.13\System.Diagnostics.StackTrace.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.13\System.IO.FileSystem.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.13\System.Runtime.Loader.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.13\System.Security.Claims.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.13\mscorlib.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.13\cs\WindowsBase.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.13\es\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.13\ru\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.13\Microsoft.DiaSymReader.Native.amd64.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.13\System.Security.AccessControl.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.13\zh-Hans\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.13\System.ComponentModel.EventBasedAsync.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.13\System.ValueTuple.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.13\clrgc.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.13\de\UIAutomationTypes.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.13\tr\UIAutomationTypes.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.13\pl\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.13\tr\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.13\tr\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.13\Microsoft.VisualBasic.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.13\System.AppContext.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.13\System.Linq.Expressions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.13\System.Net.Http.Json.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.13\System.Resources.ResourceManager.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.13\ru\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.13\System.CodeDom.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.13\UIAutomationProvider.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.13\de\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.13\ja\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.13\ko\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.13\zh-Hans\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.13\zh-Hant\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.13\System.Formats.Asn1.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.13\System.IO.UnmanagedMemoryStream.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.13\System.Runtime.Intrinsics.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.13\pl\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.13\ru\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.13\System.Net.Primitives.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.13\.version	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.13\D3DCompiler_47_cor3.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.13\System.Windows.Forms.Primitives.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.13\es\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.13\ko\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.13\pl\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.13\System.IO.FileSystem.DriveInfo.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.13\netstandard.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.13\fr\UIAutomationTypes.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.13\zh-Hans\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.13\Microsoft.NETCore.App.runtimeconfig.json	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.13\System.Data.DataSetExtensions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.13\System.Text.Json.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.13\System.Collections.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.13\pt-BR\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.13\System.IO.Pipes.AccessControl.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.13\System.Security.Principal.Windows.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.13\System.Threading.Tasks.Parallel.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.13\PresentationFramework.Aero2.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.13\pt-BR\System.Xaml.resources.dll	msiexec.exe

Drops file in Windows directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI7506.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\e592edc.msi	msiexec.exe
File created	C:\Windows\Installer\e592ee1.msi	msiexec.exe
File created	C:\Windows\Installer\e592ee7.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e592ee7.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI78E1.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149\fileCoreHostExe	msiexec.exe
File created	C:\Windows\Installer\SourceHash{8BAD77EC-3BDB-4F74-B5E9-F8C9CF2E5044}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5830.tmp	msiexec.exe
File created	C:\Windows\Installer\e592ed6.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3435.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{C7176B71-AE94-4DD0-BDAE-1BB274CAE6A9}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3EC6.tmp	msiexec.exe
File created	C:\Windows\Installer\e592ee6.msi	msiexec.exe
File created	C:\Windows\Installer\e592eeb.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6E2C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6FB4.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e592ed6.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149\fileCoreHostExe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI41F5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI737F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI37B1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4A45.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{9B54A545-583E-413B-9EE3-36DAE0A429F8}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5DA1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7301.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4119.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI461D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5A93.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1	msiexec.exe
File opened for modification	C:\Windows\Installer\e592edd.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{D03467F7-2366-46E4-A6CB-66FD9BA9B91F}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI42E0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7863.tmp	msiexec.exe
File created	C:\Windows\Installer\e592edd.msi	msiexec.exe
File created	C:\Windows\Installer\e592ee2.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e592ee2.msi	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.13-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wixstdba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.13-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.13-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.13-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wixstdba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.13-win-x64.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
440	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 13 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2B	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2d	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2C	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\545A45B9E385B314E93E63AD0E4A928F\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{9B54A545-583E-413B-9EE3-36DAE0A429F8}v80.52.61384\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_80.52.61384_x64\Dependents\{3A4D9E06-6029-4CBB-BB9F-2799A6AF4AC1}	windowsdesktop-runtime-10.0.13-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7F76430D66324E646ABC66DFB99A9BF1\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{D03467F7-2366-46E4-A6CB-66FD9BA9B91F}v80.52.61384\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_80.52.61384_x64\ = "{8BAD77EC-3BDB-4F74-B5E9-F8C9CF2E5044}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x64\ = "{C7176B71-AE94-4DD0-BDAE-1BB274CAE6A9}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7F76430D66324E646ABC66DFB99A9BF1\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CE77DAB8BDB347F45B9E8F9CFCE20544\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{8BAD77EC-3BDB-4F74-B5E9-F8C9CF2E5044}v80.52.61384\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{3A4D9E06-6029-4CBB-BB9F-2799A6AF4AC1}\Version = "10.0.13.50000"	windowsdesktop-runtime-10.0.13-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\17B6717C49EA0DD4DBEAB12B47AC6E9A\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3C0469388F1598B488598C25888B279D	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\dotnet_runtime_80.52.61384_x64	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CE77DAB8BDB347F45B9E8F9CFCE20544\SourceList	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\545A45B9E385B314E93E63AD0E4A928F\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\545A45B9E385B314E93E63AD0E4A928F\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\windowsdesktop_runtime_80.52.61384_x64	windowsdesktop-runtime-10.0.13-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\17B6717C49EA0DD4DBEAB12B47AC6E9A\MainFeature	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.52.61384_x64	windowsdesktop-runtime-10.0.13-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\545A45B9E385B314E93E63AD0E4A928F\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\17B6717C49EA0DD4DBEAB12B47AC6E9A\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{C7176B71-AE94-4DD0-BDAE-1BB274CAE6A9}v80.52.61384\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\7F76430D66324E646ABC66DFB99A9BF1	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CE77DAB8BDB347F45B9E8F9CFCE20544\Provider	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CE77DAB8BDB347F45B9E8F9CFCE20544\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_80.52.61384_x64\Dependents\{3A4D9E06-6029-4CBB-BB9F-2799A6AF4AC1}	windowsdesktop-runtime-10.0.13-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7F76430D66324E646ABC66DFB99A9BF1\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x64	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x64\Dependents\{3A4D9E06-6029-4CBB-BB9F-2799A6AF4AC1}	windowsdesktop-runtime-10.0.13-win-x64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x64	windowsdesktop-runtime-10.0.13-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7F76430D66324E646ABC66DFB99A9BF1\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D9A62EFE20456945358E797FDDA80C02\CE77DAB8BDB347F45B9E8F9CFCE20544	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CE77DAB8BDB347F45B9E8F9CFCE20544\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{8BAD77EC-3BDB-4F74-B5E9-F8C9CF2E5044}v80.52.61384\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_80.52.61384_x64\DisplayName = "Microsoft Windows Desktop Runtime - 10.0.13 (x64)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\545A45B9E385B314E93E63AD0E4A928F\MainFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\0A11CB4C1CF59DD7E82CF3DF447FBFAA\545A45B9E385B314E93E63AD0E4A928F	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\545A45B9E385B314E93E63AD0E4A928F\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\7F76430D66324E646ABC66DFB99A9BF1\Provider	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\7F76430D66324E646ABC66DFB99A9BF1\MainFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_80.52.61384_x64\DisplayName = "Microsoft .NET Runtime - 10.0.13 (x64)"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.52.61384_x64\Dependents\{3A4D9E06-6029-4CBB-BB9F-2799A6AF4AC1}	windowsdesktop-runtime-10.0.13-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\545A45B9E385B314E93E63AD0E4A928F\Version = "1345646536"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1696934516-3600988056-1840298893-1000\{FBC9BA5E-D23D-4C04-A6AC-D9BBD178B848}	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\17B6717C49EA0DD4DBEAB12B47AC6E9A\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{C7176B71-AE94-4DD0-BDAE-1BB274CAE6A9}v80.52.61384\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7F76430D66324E646ABC66DFB99A9BF1\ProductName = "Microsoft .NET Host FX Resolver - 10.0.13 (x64)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\545A45B9E385B314E93E63AD0E4A928F\SourceList\PackageName = "windowsdesktop-runtime-10.0.13-win-x64.msi"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\545A45B9E385B314E93E63AD0E4A928F\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\17B6717C49EA0DD4DBEAB12B47AC6E9A\Provider	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7F76430D66324E646ABC66DFB99A9BF1\Version = "1345646536"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CE77DAB8BDB347F45B9E8F9CFCE20544	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\545A45B9E385B314E93E63AD0E4A928F\PackageCode = "6FC8B6A4381939048AA38BB044C4B67E"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\17B6717C49EA0DD4DBEAB12B47AC6E9A\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\17B6717C49EA0DD4DBEAB12B47AC6E9A\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{3A4D9E06-6029-4CBB-BB9F-2799A6AF4AC1}\ = "{3A4D9E06-6029-4CBB-BB9F-2799A6AF4AC1}"	windowsdesktop-runtime-10.0.13-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{3A4D9E06-6029-4CBB-BB9F-2799A6AF4AC1}\DisplayName = "Microsoft Windows Desktop Runtime 10.0.13 (x64)"	windowsdesktop-runtime-10.0.13-win-x64.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7F76430D66324E646ABC66DFB99A9BF1\Clients = 3a0000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CE77DAB8BDB347F45B9E8F9CFCE20544\DeploymentFlags = "3"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CE77DAB8BDB347F45B9E8F9CFCE20544\Clients = 3a0000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\545A45B9E385B314E93E63AD0E4A928F\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7F76430D66324E646ABC66DFB99A9BF1\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CE77DAB8BDB347F45B9E8F9CFCE20544\SourceList\PackageName = "dotnet-runtime-10.0.13-win-x64.msi"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\545A45B9E385B314E93E63AD0E4A928F\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\17B6717C49EA0DD4DBEAB12B47AC6E9A	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\17B6717C49EA0DD4DBEAB12B47AC6E9A\Version = "1345646536"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x64	windowsdesktop-runtime-10.0.13-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7F76430D66324E646ABC66DFB99A9BF1\PackageCode = "B10A157DA26C0D84CB9D0392AFDD48B9"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CE77DAB8BDB347F45B9E8F9CFCE20544\MainFeature	msiexec.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4828	msiexec.exe
4828	msiexec.exe
4828	msiexec.exe
4828	msiexec.exe
4828	msiexec.exe
4828	msiexec.exe
4828	msiexec.exe
4828	msiexec.exe
4828	msiexec.exe
4828	msiexec.exe
4828	msiexec.exe
4828	msiexec.exe
5564	msedge.exe
5564	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3188	windowsdesktop-runtime-10.0.13-win-x64.exe
Token: SeIncreaseQuotaPrivilege	3188	windowsdesktop-runtime-10.0.13-win-x64.exe
Token: SeSecurityPrivilege	4828	msiexec.exe
Token: SeCreateTokenPrivilege	3188	windowsdesktop-runtime-10.0.13-win-x64.exe
Token: SeAssignPrimaryTokenPrivilege	3188	windowsdesktop-runtime-10.0.13-win-x64.exe
Token: SeLockMemoryPrivilege	3188	windowsdesktop-runtime-10.0.13-win-x64.exe
Token: SeIncreaseQuotaPrivilege	3188	windowsdesktop-runtime-10.0.13-win-x64.exe
Token: SeMachineAccountPrivilege	3188	windowsdesktop-runtime-10.0.13-win-x64.exe
Token: SeTcbPrivilege	3188	windowsdesktop-runtime-10.0.13-win-x64.exe
Token: SeSecurityPrivilege	3188	windowsdesktop-runtime-10.0.13-win-x64.exe
Token: SeTakeOwnershipPrivilege	3188	windowsdesktop-runtime-10.0.13-win-x64.exe
Token: SeLoadDriverPrivilege	3188	windowsdesktop-runtime-10.0.13-win-x64.exe
Token: SeSystemProfilePrivilege	3188	windowsdesktop-runtime-10.0.13-win-x64.exe
Token: SeSystemtimePrivilege	3188	windowsdesktop-runtime-10.0.13-win-x64.exe
Token: SeProfSingleProcessPrivilege	3188	windowsdesktop-runtime-10.0.13-win-x64.exe
Token: SeIncBasePriorityPrivilege	3188	windowsdesktop-runtime-10.0.13-win-x64.exe
Token: SeCreatePagefilePrivilege	3188	windowsdesktop-runtime-10.0.13-win-x64.exe
Token: SeCreatePermanentPrivilege	3188	windowsdesktop-runtime-10.0.13-win-x64.exe
Token: SeBackupPrivilege	3188	windowsdesktop-runtime-10.0.13-win-x64.exe
Token: SeRestorePrivilege	3188	windowsdesktop-runtime-10.0.13-win-x64.exe
Token: SeShutdownPrivilege	3188	windowsdesktop-runtime-10.0.13-win-x64.exe
Token: SeDebugPrivilege	3188	windowsdesktop-runtime-10.0.13-win-x64.exe
Token: SeAuditPrivilege	3188	windowsdesktop-runtime-10.0.13-win-x64.exe
Token: SeSystemEnvironmentPrivilege	3188	windowsdesktop-runtime-10.0.13-win-x64.exe
Token: SeChangeNotifyPrivilege	3188	windowsdesktop-runtime-10.0.13-win-x64.exe
Token: SeRemoteShutdownPrivilege	3188	windowsdesktop-runtime-10.0.13-win-x64.exe
Token: SeUndockPrivilege	3188	windowsdesktop-runtime-10.0.13-win-x64.exe
Token: SeSyncAgentPrivilege	3188	windowsdesktop-runtime-10.0.13-win-x64.exe
Token: SeEnableDelegationPrivilege	3188	windowsdesktop-runtime-10.0.13-win-x64.exe
Token: SeManageVolumePrivilege	3188	windowsdesktop-runtime-10.0.13-win-x64.exe
Token: SeImpersonatePrivilege	3188	windowsdesktop-runtime-10.0.13-win-x64.exe
Token: SeCreateGlobalPrivilege	3188	windowsdesktop-runtime-10.0.13-win-x64.exe
Token: SeRestorePrivilege	4828	msiexec.exe
Token: SeTakeOwnershipPrivilege	4828	msiexec.exe
Token: SeRestorePrivilege	4828	msiexec.exe
Token: SeTakeOwnershipPrivilege	4828	msiexec.exe
Token: SeRestorePrivilege	4828	msiexec.exe
Token: SeTakeOwnershipPrivilege	4828	msiexec.exe
Token: SeRestorePrivilege	4828	msiexec.exe
Token: SeTakeOwnershipPrivilege	4828	msiexec.exe
Token: SeRestorePrivilege	4828	msiexec.exe
Token: SeTakeOwnershipPrivilege	4828	msiexec.exe
Token: SeRestorePrivilege	4828	msiexec.exe
Token: SeTakeOwnershipPrivilege	4828	msiexec.exe
Token: SeRestorePrivilege	4828	msiexec.exe
Token: SeTakeOwnershipPrivilege	4828	msiexec.exe
Token: SeRestorePrivilege	4828	msiexec.exe
Token: SeTakeOwnershipPrivilege	4828	msiexec.exe
Token: SeRestorePrivilege	4828	msiexec.exe
Token: SeTakeOwnershipPrivilege	4828	msiexec.exe
Token: SeRestorePrivilege	4828	msiexec.exe
Token: SeTakeOwnershipPrivilege	4828	msiexec.exe
Token: SeRestorePrivilege	4828	msiexec.exe
Token: SeTakeOwnershipPrivilege	4828	msiexec.exe
Token: SeRestorePrivilege	4828	msiexec.exe
Token: SeTakeOwnershipPrivilege	4828	msiexec.exe
Token: SeRestorePrivilege	4828	msiexec.exe
Token: SeTakeOwnershipPrivilege	4828	msiexec.exe
Token: SeRestorePrivilege	4828	msiexec.exe
Token: SeTakeOwnershipPrivilege	4828	msiexec.exe
Token: SeRestorePrivilege	4828	msiexec.exe
Token: SeTakeOwnershipPrivilege	4828	msiexec.exe
Token: SeRestorePrivilege	4828	msiexec.exe
Token: SeTakeOwnershipPrivilege	4828	msiexec.exe

Suspicious use of FindShellTrayWindow 13 IoCs

pid	Process
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
2268	wixstdba.exe
5812	wixstdba.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3724 wrote to memory of 5024	3724	MG1HMCBvb.exe	91
PID 5024 wrote to memory of 2152	5024	msedge.exe	92
PID 5024 wrote to memory of 440	5024	msedge.exe	93
PID 5024 wrote to memory of 2080	5024	msedge.exe	94
PID 5024 wrote to memory of 2080	5024	msedge.exe	94
PID 5024 wrote to memory of 2080	5024	msedge.exe	94
PID 5024 wrote to memory of 4464	5024	msedge.exe	95
PID 5024 wrote to memory of 4464	5024	msedge.exe	95
PID 5024 wrote to memory of 5112	5024	msedge.exe	97
PID 5024 wrote to memory of 5112	5024	msedge.exe	97
PID 5024 wrote to memory of 5112	5024	msedge.exe	97
PID 5024 wrote to memory of 4408	5024	msedge.exe	98
PID 5024 wrote to memory of 4408	5024	msedge.exe	98
PID 5024 wrote to memory of 4408	5024	msedge.exe	98
PID 5024 wrote to memory of 740	5024	msedge.exe	99
PID 5024 wrote to memory of 1852	5024	msedge.exe	100
PID 5024 wrote to memory of 740	5024	msedge.exe	99
PID 5024 wrote to memory of 740	5024	msedge.exe	99
PID 5024 wrote to memory of 1852	5024	msedge.exe	100
PID 5024 wrote to memory of 1852	5024	msedge.exe	100
PID 5024 wrote to memory of 2708	5024	msedge.exe	103
PID 5024 wrote to memory of 2708	5024	msedge.exe	103
PID 5024 wrote to memory of 892	5024	msedge.exe	104
PID 5024 wrote to memory of 892	5024	msedge.exe	104
PID 5024 wrote to memory of 4772	5024	msedge.exe	108
PID 5024 wrote to memory of 4772	5024	msedge.exe	108
PID 5024 wrote to memory of 4772	5024	msedge.exe	108
PID 5024 wrote to memory of 3028	5024	msedge.exe	109
PID 5024 wrote to memory of 2900	5024	msedge.exe	110
PID 5024 wrote to memory of 3028	5024	msedge.exe	109
PID 5024 wrote to memory of 2900	5024	msedge.exe	110
PID 5024 wrote to memory of 3408	5024	msedge.exe	112
PID 5024 wrote to memory of 4784	5024	msedge.exe	113
PID 5024 wrote to memory of 4784	5024	msedge.exe	113
PID 5024 wrote to memory of 1992	5024	msedge.exe	114
PID 5024 wrote to memory of 1992	5024	msedge.exe	114
PID 5024 wrote to memory of 2264	5024	msedge.exe	116
PID 5024 wrote to memory of 556	5024	msedge.exe	123
PID 5024 wrote to memory of 2264	5024	msedge.exe	116
PID 5024 wrote to memory of 556	5024	msedge.exe	123
PID 5024 wrote to memory of 1720	5024	msedge.exe	117
PID 5024 wrote to memory of 1720	5024	msedge.exe	117
PID 5024 wrote to memory of 1308	5024	msedge.exe	118
PID 5024 wrote to memory of 2708	5024	msedge.exe	119
PID 5024 wrote to memory of 1308	5024	msedge.exe	118
PID 5024 wrote to memory of 2708	5024	msedge.exe	119
PID 5024 wrote to memory of 2708	5024	msedge.exe	119
PID 5024 wrote to memory of 4620	5024	msedge.exe	120
PID 5024 wrote to memory of 4620	5024	msedge.exe	120
PID 5024 wrote to memory of 1464	5024	msedge.exe	121
PID 5024 wrote to memory of 3876	5024	msedge.exe	122
PID 3876 wrote to memory of 2268	3876	windowsdesktop-runtime-10.0.13-win-x64.exe	124
PID 3876 wrote to memory of 3188	3876	windowsdesktop-runtime-10.0.13-win-x64.exe	125
PID 3468 wrote to memory of 2228	3468	windowsdesktop-runtime-10.0.13-win-x64.exe	129
PID 4828 wrote to memory of 5232	4828	msiexec.exe	131
PID 4828 wrote to memory of 5552	4828	msiexec.exe	132
PID 4828 wrote to memory of 5760	4828	msiexec.exe	134
PID 2228 wrote to memory of 5812	2228	windowsdesktop-runtime-10.0.13-win-x64.exe	135
PID 5024 wrote to memory of 5320	5024	msedge.exe	136
PID 5024 wrote to memory of 5328	5024	msedge.exe	137
PID 5024 wrote to memory of 3440	5024	msedge.exe	138
PID 4828 wrote to memory of 5844	4828	msiexec.exe	139
PID 2228 wrote to memory of 5924	2228	windowsdesktop-runtime-10.0.13-win-x64.exe	140
PID 4828 wrote to memory of 4832	4828	msiexec.exe	141

C:\Users\Admin\AppData\Local\Temp\MG1HMCBvb.exe
"C:\Users\Admin\AppData\Local\Temp\MG1HMCBvb.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.NETCore.App&framework_version=10.0.0&arch=x64&rid=win-x64&os=win10&gui=true
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2ec,0x7ffab720c188,0x7ffab720c194,0x7ffab720c1a0
    3⤵
    PID:2152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1824,i,9548614914919510415,16242684668076017246,524288 --field-trial-handle=2272,i,6687878699345986394,6367569482854118612,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:3
    3⤵
    - Downloads MZ/PE file
    - System Time Discovery
    PID:440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1668,i,11205470793649958789,10527809232983566174,262144 --field-trial-handle=2272,i,6687878699345986394,6367569482854118612,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:2
    3⤵
    PID:2080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2596,i,6047258749945882332,6620524240460212506,524288 --field-trial-handle=2272,i,6687878699345986394,6367569482854118612,262144 --variations-seed-version --mojo-platform-channel-handle=2724 /prefetch:8
    3⤵
    PID:4464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,2621233872678305256,80563444861328779,2097152 --field-trial-handle=2272,i,6687878699345986394,6367569482854118612,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
    3⤵
    PID:5112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,10601045667785917064,1070150598724762455,2097152 --field-trial-handle=2272,i,6687878699345986394,6367569482854118612,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
    3⤵
    PID:4408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4172,i,16478163727396464018,10239032996964069314,2097152 --field-trial-handle=2272,i,6687878699345986394,6367569482854118612,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:1
    3⤵
    PID:740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4188,i,11771275845044791373,10024016728240988612,2097152 --field-trial-handle=2272,i,6687878699345986394,6367569482854118612,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:2
    3⤵
    PID:1852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5056,i,13490585091250787921,744273892010556343,524288 --field-trial-handle=2272,i,6687878699345986394,6367569482854118612,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:8
    3⤵
    PID:2708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3956,i,11218303035094834218,9157954140323975284,524288 --field-trial-handle=2272,i,6687878699345986394,6367569482854118612,262144 --variations-seed-version --mojo-platform-channel-handle=3940 /prefetch:8
    3⤵
    PID:892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5244,i,10139904484006494729,7690659588620624993,2097152 --field-trial-handle=2272,i,6687878699345986394,6367569482854118612,262144 --variations-seed-version --mojo-platform-channel-handle=3916 /prefetch:1
    3⤵
    PID:4772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3660,i,738887224846598784,10346873448795048127,524288 --field-trial-handle=2272,i,6687878699345986394,6367569482854118612,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:8
    3⤵
    PID:3028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3656,i,4067274893608250498,4836796276293199430,524288 --field-trial-handle=2272,i,6687878699345986394,6367569482854118612,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:8
    3⤵
    PID:2900
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5812,i,13286378447963754284,11880874742503910527,524288 --field-trial-handle=2272,i,6687878699345986394,6367569482854118612,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:8
    3⤵
    PID:5088
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5812,i,13286378447963754284,11880874742503910527,524288 --field-trial-handle=2272,i,6687878699345986394,6367569482854118612,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:8
    3⤵
    PID:3408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,1275227297529176473,15605931666428270934,524288 --field-trial-handle=2272,i,6687878699345986394,6367569482854118612,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:8
    3⤵
    PID:4784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6196,i,8492706688968070046,17074343428223137340,524288 --field-trial-handle=2272,i,6687878699345986394,6367569482854118612,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:8
    3⤵
    PID:1992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,1358512916918144321,574369027442129009,524288 --field-trial-handle=2272,i,6687878699345986394,6367569482854118612,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:8
    3⤵
    PID:556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6028,i,12155089483859831020,1277238922954603569,524288 --field-trial-handle=2272,i,6687878699345986394,6367569482854118612,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:8
    3⤵
    PID:2264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6520,i,12741929342101069368,17111243042319927187,524288 --field-trial-handle=2272,i,6687878699345986394,6367569482854118612,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:8
    3⤵
    PID:1720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6264,i,14714913545721025848,496974033876468275,524288 --field-trial-handle=2272,i,6687878699345986394,6367569482854118612,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:8
    3⤵
    PID:1308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6276,i,8669285390759454031,15116281871989277222,2097152 --field-trial-handle=2272,i,6687878699345986394,6367569482854118612,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:1
    3⤵
    PID:2708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6492,i,13693407281199523746,4606045454309881962,524288 --field-trial-handle=2272,i,6687878699345986394,6367569482854118612,262144 --variations-seed-version --mojo-platform-channel-handle=7068 /prefetch:8
    3⤵
    PID:4620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6188,i,12031131640302625322,6143733197448468735,524288 --field-trial-handle=2272,i,6687878699345986394,6367569482854118612,262144 --variations-seed-version --mojo-platform-channel-handle=7028 /prefetch:8
    3⤵
    PID:1464
- - C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.13-win-x64.exe
    "C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.13-win-x64.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3876
  - - C:\Windows\TEMP\{E5C55534-3912-4099-A8F4-4F201F2A513C}\.ba\wixstdba.exe
      "C:\Windows\TEMP\{E5C55534-3912-4099-A8F4-4F201F2A513C}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{3FDFB57D-6131-4E00-9667-D891E3E8B88C} {740459D2-7D00-434C-B6DB-F47E2884892B}
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      PID:2268
  - - C:\Windows\TEMP\{E5C55534-3912-4099-A8F4-4F201F2A513C}\.be\windowsdesktop-runtime-10.0.13-win-x64.exe
      "C:\Windows\TEMP\{E5C55534-3912-4099-A8F4-4F201F2A513C}\.be\windowsdesktop-runtime-10.0.13-win-x64.exe" -q -burn.elevated BurnPipe.{04C54B30-F6EF-45DB-A9A4-9FC1FE780EDB} {33DADFC4-4204-4405-8333-01334E0612A2} 3876
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      PID:3188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5660,i,5537912102284873616,17831135854943440927,524288 --field-trial-handle=2272,i,6687878699345986394,6367569482854118612,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:8
    3⤵
    PID:5320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5080,i,16493801114593182719,4137720123180862240,524288 --field-trial-handle=2272,i,6687878699345986394,6367569482854118612,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
    3⤵
    PID:5328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,13914378604531652922,3258612905061960310,524288 --field-trial-handle=2272,i,6687878699345986394,6367569482854118612,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
    3⤵
    PID:3440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5404,i,48485632313123307,9056307033724624396,524288 --field-trial-handle=2272,i,6687878699345986394,6367569482854118612,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:8
    3⤵
    PID:1744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6832,i,1469970346462237875,9239115161217337402,524288 --field-trial-handle=2272,i,6687878699345986394,6367569482854118612,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:8
    3⤵
    PID:5464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2988,i,612489189517934545,13044429773192337305,524288 --field-trial-handle=2272,i,6687878699345986394,6367569482854118612,262144 --variations-seed-version --mojo-platform-channel-handle=6832 /prefetch:8
    3⤵
    PID:516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4764,i,3931582792277592246,11916718189489757704,524288 --field-trial-handle=2272,i,6687878699345986394,6367569482854118612,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:8
    3⤵
    PID:2704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6216,i,8019383156101136693,2803861450900869362,524288 --field-trial-handle=2272,i,6687878699345986394,6367569482854118612,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:8
    3⤵
    PID:4008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6416,i,2513904906116228981,12672366945803007094,262144 --field-trial-handle=2272,i,6687878699345986394,6367569482854118612,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1300,i,1354169191619862880,1860951725514839265,524288 --field-trial-handle=2272,i,6687878699345986394,6367569482854118612,262144 --variations-seed-version --mojo-platform-channel-handle=6636 /prefetch:8
    3⤵
    PID:1476

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4480

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s PcaSvc
1⤵
PID:556

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4828
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 1BA3481A597D61DD60ACF0CF6110C8C8
  2⤵
  - Loads dropped DLL
  PID:5232
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding ABFD81EED4DFC46BE6000A2FCED988DA
  2⤵
  - Loads dropped DLL
  PID:5552
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding ED2CA4B79975767C55CD71B26A363BF1
  2⤵
  - Loads dropped DLL
  PID:5760
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding FA79C1C20D2D1892BA024B2E3D0F4C10
  2⤵
  - Loads dropped DLL
  PID:5844
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding E3A4B67D3A3CAD9A4913DBB3A144F4F4
  2⤵
  - Loads dropped DLL
  PID:4832
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 80ECFB715E755E2495B98A97EB9415B3
  2⤵
  - Loads dropped DLL
  PID:964

C:\ProgramData\Package Cache\{3A4D9E06-6029-4CBB-BB9F-2799A6AF4AC1}\windowsdesktop-runtime-10.0.13-win-x64.exe
"C:\ProgramData\Package Cache\{3A4D9E06-6029-4CBB-BB9F-2799A6AF4AC1}\windowsdesktop-runtime-10.0.13-win-x64.exe" /burn.runonce
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3468
- C:\ProgramData\Package Cache\{3A4D9E06-6029-4CBB-BB9F-2799A6AF4AC1}\windowsdesktop-runtime-10.0.13-win-x64.exe
  "C:\ProgramData\Package Cache\{3A4D9E06-6029-4CBB-BB9F-2799A6AF4AC1}\windowsdesktop-runtime-10.0.13-win-x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.13_(x64)_20261024124610.log"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2228
- - C:\Windows\TEMP\{B543C229-9C66-4197-A066-71B0BF7334EA}\.ba\wixstdba.exe
    "C:\Windows\TEMP\{B543C229-9C66-4197-A066-71B0BF7334EA}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{8A7C2A75-3B9B-4318-AE34-9965CB940083} {F33033EB-6095-4C4F-94A1-5C162F8B4D4D}
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:5812
- - C:\ProgramData\Package Cache\{3A4D9E06-6029-4CBB-BB9F-2799A6AF4AC1}\windowsdesktop-runtime-10.0.13-win-x64.exe
    "C:\ProgramData\Package Cache\{3A4D9E06-6029-4CBB-BB9F-2799A6AF4AC1}\windowsdesktop-runtime-10.0.13-win-x64.exe" -q -burn.elevated BurnPipe.{9182AB56-053E-4944-8E45-626BDE237392} {8320187B-0D3C-4FC0-94C1-0990450F0402} 2228
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:5924

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5736

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e592ed9.rbs

Path C:\Config.Msi\e592ed9.rbs
Size 11KB
SHA256 14836517124120d36c18d585f0e61b1fc58e5fae2d39eb05709b332783fddf1e
MD5 b343a695b76628eacc33cec69307d1a2
SHA1 1e23a0eaa3eb8c30f16d53d4aeb64c7eb84f7135
SHA512 e572ac4d698d634d0ac1a9f21eefbeaaf056a9e7bbcb8fbe732a8a427f45e33071bc2bc37c69652077137b30d2a5795875da2741c51bb5359af928a86b7495dd
SSDEEP 192:Doo84CIE4C04P4n4bqtp55HbiDw/eIWWczMyaIH8czMyaOHsE0aPC0wplY+/:DNPCrA4mt35H8GtMiMg9
TLSH
T1E0325442BA10C5E3ED571B34C7472B2177B2C7AA5301935B22DDD2389E237DA1E6C29E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e592ee0.rbs

Path C:\Config.Msi\e592ee0.rbs
Size 9KB
SHA256 f452b1b966220d9abad995ec9687e673aee58391d6451b5434e7caacc398a724
MD5 e676c8ba17d83212dcadc0e0d43fbaa1
SHA1 88c65f22fa3f48dda85db309baa4fc51829c5fa5
SHA512 30c67a938e116be35522cddcdc6013d9cf598c750174fbbcfa900a7c116b0fc7448f16a3612701b70cf874beed7606e3735baf98ca90a4b7f2a214ff18fa2d9d
SSDEEP 96:lmppi7C/rmNYhUe2mgu4Um02eD2z0bvCsTle4Um02eD2z0bvC6joCpjn/Tlrn3O7:oQ4Ke+WBaIYBaHYYE4FxYewpaR
TLSH
T10C122001660089D2E99A5B30CA475B123FF7E3DA8608A39F4CDE9120AF077895F5B59A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e592ee5.rbs

Path C:\Config.Msi\e592ee5.rbs
Size 49KB
SHA256 abd3a13e11945734248de2a84d793f5e42e37cea5b281034f63ce04743b10bf1
MD5 95289b439b00ad3ec2eeb5894064bca7
SHA1 b05094d99746a10dcf8f6ae18273421ab40547d1
SHA512 38a0debd57fd5da8ee70e1e213a99141173aa0e87bafcc6db939783ddcbb1987e3af06d1f0d2a804304ed3845ff347db20e3ab33b51c7fba5428bc0840e542af
SSDEEP 1536:12I6VEAsd2MjKRxMXzngOY9EP1KgascFDEXdiLHuItd1D40eyY6pZSduKNKQ9vff:xzVN
TLSH
T1E133E368DB14E2E2F63B7DB463A1BD04B394C982AB04D4AD63C69148D987BDC5F7C0D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e592eea.rbs

Path C:\Config.Msi\e592eea.rbs
Size 71KB
SHA256 6dea74f031f561d670d82108464d941d37c94da0f4ce17ae3640c175fc6a2749
MD5 068422379821aa477ea8e260e85a3f64
SHA1 2060db73ef741c3ba9d883a5b5359e1eae8a5e6d
SHA512 9aeacd4c91e974eb2b48cac9d9ecb756017f89bfe3a67ec4dc51cb3f3f11f4f138f5af6de43c91bf13b6a8d7072a286a13c1b7f18113f07f2b36c69813b413a3
SSDEEP 1536:R5NfBRbxZ1pUugnQeiHTomr43Q8i6sxd2VVVRRJjkh0p1c36LqFX10yHwhvxo0Op:5zSWXECGgUWC6EmuejEG
TLSH
T1F46333A66300CCD1DC723D13ABE7FB4E9D168EA712421A6910C9013DCFA56CB5FE99D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e592eee.rbs

Path C:\Config.Msi\e592eee.rbs
Size 3KB
SHA256 a77841327de3c5327b02fdbb1924273423665e83d9feaff93625ee0b32c22f4e
MD5 9073582c0df6bcebb666ed529ded1c98
SHA1 0d9ef5344c7867ecd43b98cbf374c4c743a02998
SHA512 1829485bbca15bd146d6cf39673bb6b308e1e8e2d40289b263721552e6b0590c068343f9fb74e15755200a98bdad70eb4eb486a49d74715c68cfdb1784d06308
TLSH
T1EA717702EA04D2D3DCA62F30CE131B5033BBD2E7E715838B458DA1705D4B7899FE968A
MD5 SHA1 SHA512 TLSH

Submit Download

e592ef1.rbs

Path C:\Config.Msi\e592ef1.rbs
Size 3KB
SHA256 a43c18c8dd15879d1d86fa45c900668fccd040c9a5bec056eaeb63a493ca8197
MD5 6bed3d73949ad8fd960996a7341bf1e0
SHA1 bddb6259cdbaa73aacda549f507d91ab8755c433
SHA512 e443b8be60722b4c48541afdcfde249f8ef3428bedda1b10251c44bc33229c3876bdbfd70e1020fd973c369e0021260947af72e3107cb5fe02bdedbe647cc6f8
TLSH
T1E081BE03AA449A83ECA31B31CE575B113B77D7E69365438700CC91344E87B8DAEEB68D
MD5 SHA1 SHA512 TLSH

Submit Download

protocols.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5024_169784891\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

llm_user_input_extractor_config.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5024_52582535\llm_user_input_extractor_config.json
Size 4KB
SHA256 2056ee7ed0e7adb69344c93a024158ee4e2332ecd50d183dbad7595c4d588ed9
MD5 7736ccfaf720ef9b0db919dd01c4bf8c
SHA1 24b48ec2dee093b8e4384ad1e25ad8f12af0831e
SHA512 f044ed3b6fee483d211328df83f26b98dfe47890c05409c65c7f7333fde1fc043cd1c05d18250e8ee8731f355c13b3a0aedc0e60b82a26c42a7f209a69ad4781
SSDEEP 96:a0y3Cmyjw2w61skd7GZrlWqPZ96vOim87Ai:wyOy7k5rx0WVS1
TLSH
T11F91DF3BD8A15C2B00F3B225B87A7642F534A35B27C05C5B7A7C5A1C8FB6D312582F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

office_endpoints_list.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5024_52582535\office_endpoints_list.json
Size 9KB
SHA256 f0c77aaacfc571e0bc3f51387febe134d991bf3c7f1941af303ed901f288dcd6
MD5 30719122f9edf4e23019a3b74e4f4325
SHA1 6707d64052797b9c5f1a5ccf016e5859c8ef898b
SHA512 ec2e1a33fcd1301f282512ffafb611ea705dc5df09d9aee014276909c1b62b0c73600121d94e9b6d9e160296672b41f2cb8c3ba23f121244ad2ea6521680723c
SSDEEP 96:DdQ/JJvwjyUsrdfsysVsnQfbJNZidYusysXYs2sFsdv12XvlRT07s/DkhcrHPglW:D7d7mfgiIWRcV4sobxezQd1Y
TLSH
T11512BB3BC4B49F229AB060659705E244F13C43BF5600C6FF76B9829C1F366ECA58E1E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

smart_switch_list.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5024_52582535\smart_switch_list.json
Size 2KB
SHA256 d490aec3403b2daa86aa095db121c2dfee0a35c3ed0770284c0bd0e0a103c776
MD5 a55a23fcdd9af97d33302c8e6de41c18
SHA1 00d9137cdffd273ef849e1122ecbb6f27b6e8423
SHA512 647c19d83bf4db3c4b868738df3a8da0b06f666860f468a2de6863e440800bd5e4057ac03bcae4b5bfed28a8907038bca6a72785d42e7acb6f56580a6859b05d
TLSH
T1E4519EB7CA215CA005B482B16338509AF82827BF62C98AEF377D5B1C3F744B425981E8
MD5 SHA1 SHA512 TLSH

Submit Download

nav_config.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5024_859940585\nav_config.json
Size 2KB
SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
MD5 499d9e568b96e759959dc69635470211
SHA1 2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6
SHA512 3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905
TLSH
T16B51DB73D5988C4B9BF4A29CE919A309F11107CF75D48C0B76BE010C1F7757AB5C6588
MD5 SHA1 SHA512 TLSH

Submit Download

ThirdPartyNotices.txt

Path C:\Program Files\dotnet\ThirdPartyNotices.txt
Size 77KB
SHA256 deb4427a295e1ed474b0d81c5a0d972c1b550b9a715cda939cdfa9236b1b418f
MD5 0d8867a25ba926e6e40cd52ab3536b5c
SHA1 89390dc8b8318d0bfef1c6a2fb4783537e28a465
SHA512 317ca335405274f4f91b173651ca2826760acb5ba5cf41aff51adc55c2cda9059fb268333665f13f62fa48119e55a303720a780dd58d28dd9967db4c88407d61
SSDEEP 1536:HA9jHwsGfgg39/zwgAVkguQxrDjugtSEGepkWvrpX7anuqdLSVnfiStPq+3LefrL:HA97w/ogz1AVxuMjHtSFULryLOgrGWm+
TLSH
T17773A45F7E45077319E2C3916569A8C5F22FA02E3B6B2A44346EF248133B42DD6FF858
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 163KB
SHA256 abce6623a6729059cf39bb0f728c4a7804f625895099c88c17e6e704661e09eb
MD5 21e071bada82a388f86bb9d7787cfa4b
SHA1 7f99765fcc1836b90b9dea74fb5e71c5c24ddcc1
SHA512 165cb61b61fd965b09f7df737ead653ddecc8a60893d40c1306e8a6230b6a50bcdaf5956dabc1639fe430857da38c36332ead1958cbe0caebc330a8645a6634e
SSDEEP 3072:4GgPMwruvTSBbQ/vp4SbDqIG/Kk7l55wKlE5Ey:4GUrubgbQJDvqIWtKiy
TLSH
T12BF3071AD65811AAD06E9575CB528941BB337C668BE0E3CB53C0F8BE0F726905EF9703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetRuntime

Path C:\ProgramData\Package Cache\.unverified\DotNetRuntime
Size 28.1MB
SHA256 d3008cda18f40bc728311e7c5ed3cf18a3f3c30e52496bdc4e271637c6886b0d
MD5 0aef31947cf42d777ef0287a984a3af7
SHA1 3743e3a1cd2debf9c41a5f1c0fd30c7ce4fb509f
SHA512 c7d5db0c032aedd7815fcc78413a9ccfdb81b2f9440553fe6c922a69cfa0c536302eedd13013293a446774f54d0e5abe2bbc8d3e6edd0bd2d2ea50273f40394f
SSDEEP 786432:ll95KZglrt8lmxjcxFtmObjuAyvH8uC4EzUn2HO:d5KqlrRxj8aOvuvH/y+
TLSH
T11457332BBF5204A9D9220EB189B783259E327C04572196DF53A5B14ECEFB2D425FB7C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

state.rsm

Path C:\ProgramData\Package Cache\{3A4D9E06-6029-4CBB-BB9F-2799A6AF4AC1}\state.rsm
Size 1KB
SHA256 cf996a2c9dfd9c9eea6a3782a08993d148ab8de27f74adf7710acc33e8cbf94f
MD5 857eb536ebc1fc8128106afbd2f076df
SHA1 2f0f08efdc7fbf2028058bd6ac4aad6eff2eba3a
SHA512 d2deb7121c7e6eaefa98c9a3313430275b01bb09e704887f95dfdfaf6b1af53596e619a0ac696800f556ce2e3ea6cd574b77f9ad87d4e3ab216afffed5e5fdc0
TLSH
T1E821D1515BFA092CF3F6AB3469F96625443BBC121C20C56E0001318A9E32BD0CCB0B37
MD5 SHA1 SHA512 TLSH

Submit Download

09ddef2f-afb5-4ce7-84b7-874cd4b0cae8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\09ddef2f-afb5-4ce7-84b7-874cd4b0cae8.tmp
Size 18KB
SHA256 76d7387a5fe819e5580ffe3e51cdb1d26d3790e21cf16c5f8ae60d9bb5beb3dc
MD5 51ba228e161d8f70381dde40ff5ee675
SHA1 5db6abf7918864f37bc2c730d36e8dd58c25b8c4
SHA512 171c22532a1ec1186b15cb56786b21b24a9601f408dc02d9ceb78d92bd647391d7a748506d38e544239fb2a226bf5ef4be76f3f86302fa41283d99afd3f4239f
SSDEEP 384:nmQkUSvtsNcgXWNpufFI9iX5Fk+E6S2IuxRIIlv:GtTNwMaQqS5WL1
TLSH
T145828C359C796C378AE7E610F14A36439FA4912BDAC85F54EADA5B2C05C72CC270BA13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0d633cc2-41eb-4045-90b5-443ed192dbee.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0d633cc2-41eb-4045-90b5-443ed192dbee.tmp
Size 8KB
SHA256 587014c99646650e0ec593c29f141570d078b4eefba4dba44dcbe8f373db4f6d
MD5 d5fe0ee6120d7aa99468d57f9c1947cb
SHA1 e3f22993fb5f6f1b4f88e96f8378bfc616d1ac6e
SHA512 b6a203f078f69bb6aed3ae952c6268fcf3f7332abc3ee7853614f2adf925eaaec0fb92461591f70a189422785158af5301656b36dfdc56c61ce70dcfd6b94f3e
SSDEEP 192:oONV6Amwp/QmiUy934siX5FJxY+eteeslRurqk+gU6:oONV6ipBE4siX5Fk+EsSU6
TLSH
T138121A35A879AC7B9EE3B914B48736239EA41177DE846F84E9E80B1C05D778C270E523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0f25e0e8-507f-4bcd-8f94-6858b4cb5593.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0f25e0e8-507f-4bcd-8f94-6858b4cb5593.tmp
Size 28KB
SHA256 373663ac3e5dfbecc86df57467d329acecccaf9aa07f279dd8b1e2cd419255f3
MD5 97068c580bc465e0acc591aa11398b76
SHA1 49bf35dc6e9613d696113199dce28282391bd2ff
SHA512 43fd5f834e3d86ce95cadd050d59b008675c212c2ef441d07276b9aa43af0bd26a8b23c1e74feecd8349548113141d524a9b680f3832c8910d0941d9cf31adb3
SSDEEP 384:nFiFLQkUSvGTsNU8TUNTUlIlgXWNpue4IoDfQEiX5Fk+EpS2IuxRIIlv:MFF65wghNS6EaQZS5WL1
TLSH
T1A7D2B3F598D79937D9AE9783A73E3D429EBCC153B5885984BB851D0CCC821BFD30A802
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

11949081-c473-40d3-90f7-a34cef1fedb4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\11949081-c473-40d3-90f7-a34cef1fedb4.tmp
Size 18KB
SHA256 a89fb014761a3b4965ffe7fd69725dec943ddfed2c53f11ad344394371423760
MD5 4ba0b8d59b78c98a224311fc4d2c21f3
SHA1 07143e413c46aeca26a7b907d54ae489d1aa6af9
SHA512 4c8e8d2899e6bdece69476a6f8fa2ab2ad2bf992614c6afb3950ace2f532c974988bb21789150be8113dad070586e317b9df31c266cdf23bacda59af8040c05a
SSDEEP 384:nFQkUSvtsNcbXWNpufFI9iX5Fk+E6S2IuxRIIlv:ftSNwMaQqS5WL1
TLSH
T1CC829D359C796C378AE3E610F14A36439FA4516BDAC85F54EADA5B2C05C72CC270BA13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1e550316-59c0-40c6-aa14-504a0ac49428.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1e550316-59c0-40c6-aa14-504a0ac49428.tmp
Size 18KB
SHA256 eac597b0b27469d27123092b215ee72573fabde07ebd14d7b03fe30682dd1f66
MD5 1fba04bdddd3548cb6431ccd2f488742
SHA1 9a631c245a182e3844404070cf697f6e9915b4cb
SHA512 c62e40ce2786bc6be3eb7394a24375ec8d18ff5a03e1fb23172d82cebafb4129b4215ca6cdf2edf09af5a54d33b4b663f6609bfff79a15a62d232ca5b76dabc4
SSDEEP 384:nYQkUSv0sNc3XWNpuNFI9iX5Fk+E6S2IuxRIIlv:Q0WNiMaQqS5WL1
TLSH
T15F829D359C796C37CAE3E610F18B36439FA4512BDAC85F54EADA5B2C05C62CC270BA13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1f35ae84-319f-43fd-b81d-d1797bf48591.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1f35ae84-319f-43fd-b81d-d1797bf48591.tmp
Size 8KB
SHA256 fc2b1572e5e4beede30a1e997085704d841b62bc2e1c0840bf0497411e56aad9
MD5 630aa4c39640374fd362b33203ba7666
SHA1 da0f5ec7cec471609cb32260650774a3a4991f93
SHA512 beeb198041002b6c33c2c795e8b08c3f2d23e32741dec9c05886eed98b31cf084ca6950864e1f5119ed3418a94dec6d7ff1ef3025780c46ae7f847187abca99d
SSDEEP 192:LON16AmwprQmiUy136siX5FJxY+MJinYU6:LON16ipdu6siX5Fk+5YU6
TLSH
T19A02CA35EC686C7B9AF3AE05B44B36139F95112BEA942F84D9E81B1C01D769C1306833
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9297a9fd-6c14-4d34-9e92-1676cea22184.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9297a9fd-6c14-4d34-9e92-1676cea22184.tmp
Size 18KB
SHA256 7a930e0459b7f07ab906820df4d1f24391068cf6a2122b024d7bc5fe531b7ce9
MD5 3662fdf594dc1890d9c80167c8f76bbe
SHA1 82277481092eea5c8757cfdd22da9cf77d967634
SHA512 6382912365ae0f3362efcd09bd4296959c5878dc74f300010a8d0045af1846a9a092be64b28f05c3e813c43ca10757dc57ba72d37abe5adb9fe560f819b93715
SSDEEP 384:n5QkUSvgsNcgXWNpueFI9iX5Fk+EkS2IuxRIIlv:bgTNLMaQUS5WL1
TLSH
T157829D359C796C37CAE7E610F14A36439FA4512BDAC85F54EADA5B2C05C72CC270BA13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 daf8c1243ee20a2e95a6bd65ee87f94e97a213f1bc26473da181514314bf0e5e
MD5 22b29b46992ba3d1fd586e35207b402b
SHA1 03a007676fa49e6e9fbeffbbc2e943124c1b3d3d
SHA512 3634d483353d2e9fb49d846c71c6867053c6a8f1ead10608addea75574d5ce0e36c8de933f71d10bae9682752372e6f7925bbc3c9d982dfe840a9d664f859687
TLSH
T1BDD0243C3F514D50DC0041710530D50435D3CC1740D017070C354C074C101C11305CD0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5421c8b0bf6e5f37422a05b412b233cde63f1db63aa71d65c91c5b31275595c0
MD5 07f616e3db8597d59ea940f94c1abb0b
SHA1 eedf28342bbff8c4cae798c2980ea6953992f1b2
SHA512 30782b7b7d8c6db47a40bc15f968f35fca7939aaa4b83a8a19c8f5a415c745b54c161abc0037d24bad8ebf15d5deb4134f24e357c1b5869f1598fa22619302be
TLSH
T163D0243C7F114D50D40041710530D50435D3CC1740D015050C354C074C101C11305CD0
MD5 SHA1 SHA512 TLSH

Submit Download

1b287a98-c0af-4ba4-bbae-70c438dcdaa2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1b287a98-c0af-4ba4-bbae-70c438dcdaa2.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1cc12646-6ab0-43f4-8fc2-95b8581693cd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1cc12646-6ab0-43f4-8fc2-95b8581693cd.tmp
Size 11KB
SHA256 f7366c2fd1dd26657eeb4f387741240ba9c0216f3fdbe77e61accf142ef92361
MD5 192e51c32833e5d802b1b830d4144947
SHA1 9a9f0f5fa88701e6303c945eaef5c3a62b3faafd
SHA512 4be3eb072269059c9c7f1ae39b69179bcc6390401c25740a3c5325c9a3caf4e4daea61471030a3c2be96a27ddd18826d68cb3488fb861439146ee8e95ad6e8b4
SSDEEP 192:sxZcRJ8g/fds0FONEIdpwpHW6+WNrw0/AA3EwSpIg5VJ:sxZc8g/fds08dYHbD/wF
TLSH
T1F932B816AE24A97B8CC7E219BA15BF53E6F9503291D01E44B6FC8A1C05E77DD120B81F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4130b450-1fca-4ca0-a4d0-c72ca96a6de0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4130b450-1fca-4ca0-a4d0-c72ca96a6de0.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

61bda8e5-c384-4067-8c19-9b6e2a867177.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\61bda8e5-c384-4067-8c19-9b6e2a867177.tmp
Size 11KB
SHA256 38393cc25b63e9539931be2f48f9cbcc5120c2ef08ea53ab6d278b65529a5f34
MD5 0dc4fbc0db39e5544de3bdbc15a304eb
SHA1 745f479954236caa2e061bd1d8f5bf07542e9b50
SHA512 921630982822abd461caf8851c6db5e5c97958d11c175537ac408ef0a5405bad75887259b361a135444afebeb54d0401d07e852a1cfbd22b14e74aaa2f2a05fa
SSDEEP 192:sxZcRJ8g/fdsSFONEIdpwpHW6+WNrw0/AA3KSSpIg5rJ:sxZc8g/fdsS8dYHbD/CP
TLSH
T19132B816AE34A97B8CC7E219BA15BF53E6F9503291D41E44B6FC8A2C05E77DD120B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9e43bf5e-2b77-49a0-8489-ee7da50105ba.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9e43bf5e-2b77-49a0-8489-ee7da50105ba.tmp
Size 10KB
SHA256 f6cb92b6c66f17fe8de4e04fd2130a26595d9b6dd4f24e2067664c7ca118df6d
MD5 f907074dceef5d6013148170d50e8147
SHA1 8da8379a3ea958731a21ae909050abfe9d6dd3e6
SHA512 af6b6f1d3b2d57cf6e2aac32d63d9e6789060bf1f2b5f68b900289874dac5af12b8d5169d13d9f112c313dc2d523f3762f2b0f7fd6c1ffac09d42cc41ae42bd5
SSDEEP 192:sxZcRJVg/fdsCkIdpwpHW6+WNrw0/AA3KwSpIg4J:sxZcVg/fdsC9YHbD/Ic
TLSH
T15522B812AE34A97B8CC7E619BB25BF53E6F9503295D01E48A6FC851C05E77DD120B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 599d82dac5514a468f46e2e78c05e01eb9c9ed5456b085abac862fb71dab44ec
MD5 f927e26412b31c481480519ecf24595a
SHA1 b6b2cc36c948408ae4a2f2aa1649e82c111d3ca3
SHA512 7bacac1f7769890f65d64a1e980f71a2ed7c7b3a2d93d2779b7c346d4cf63af67d220f07754fd79cbe02428cd5b8d332e809055bde5abe721f8c12504d9cd4d5
TLSH
T130E026EDC9C8C27EA608E487026C536C8B81A72FDBD0695E2710CEC5B589440E283FD2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 f02b4e6d061867f68acf0030742cd0748bd249530b15080d17c254a5f0efdfbe
MD5 45978668029fc60e7242a8258a5f5236
SHA1 54faeae31f1a05937ed25ac193e7863a85112faf
SHA512 8ece1aae18339ccd5af9962b57fc8acfeb5e6c3acf122f4c023f6d2f6517a07affbac8cd790f7a0c7e6acb933d27a5d154d7ed24422d5c935ba42acb3aa5e0c8
TLSH
T1B171E9B2719F4C52EB64227C9CE460833E387DF528836D238D75F5F94BAAB07A241817
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 8e98b3fe5eef51c2e3372ba1ff8c5c9dce19a301b4d2a58baf4c18dea1be18b8
MD5 b4ad4757b4c961c92beb4d8aa82c5b71
SHA1 c7f1eb72e2a6bceac11326fd12d730b2a39f31e1
SHA512 e57bc840a9e52336c565e8f43f74305fbbba853e86e43e9149f6e104fe53cfce7dc6f5fb29ad546595aced948c679ee606bd4fe9d23f08357039b894dfda626b
TLSH
T15F6119B232AF4C92EFA4227C9CE1A1873E386DB424835D178D75F4F94BAA7079155807
MD5 SHA1 SHA512 TLSH

Submit Download

cad619f9-df32-47be-8a0a-d8f86647f239.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\cad619f9-df32-47be-8a0a-d8f86647f239.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.111.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

3ce2d14b-bd54-4704-8702-8da4f87653ec.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\3ce2d14b-bd54-4704-8702-8da4f87653ec.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

59392f03-0667-47e8-b4ce-93fe61bce2f7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\59392f03-0667-47e8-b4ce-93fe61bce2f7.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

5c6fd31d-93b3-408b-9ade-a1db47e4aa1d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\5c6fd31d-93b3-408b-9ade-a1db47e4aa1d.tmp
Size 3KB
SHA256 536f04c9e292ca9fcc85357ef27e7d96acca94902c41b71c007587d844d71a36
MD5 c41664b06cd15009f414d326822e1a13
SHA1 10c27313ae0495bf2e32a9a484d810f05ff34c52
SHA512 4211eaa3e6d8a331bfda8c25b34ba516a27654347c5fa0a6b1095ccc982702027ac9964c1c4fac8feaa06a818cc9e81d106fe051cc875ae89883d94668d7a4dc
TLSH
T1C7619BF787B4856E8A119AF09A18EE2FDF2D0615431C3C6989D4EE27D7E3472E00265F
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 9e634631c799e0a0dc4b3113c70bca9b599026b9ba146ec1f7fae888f4e9f2f5
MD5 0db47020be810b86eedbf7a3362505a5
SHA1 f10aa2cf7057e873038be0f42cafce5224ca7144
SHA512 0185fac28b3dadc7bc1ebb2bc22a045a2155485b46865804f212e7b6f08687cb5c39192e85917f9e8a7583e5de5cc6959382937244c94b54f5175ffa285983b1
SSDEEP 48:K0rOPrVNNubdQ1ISLuK9b1ZuxD+YYp7vyL8rKfhBh6bZ0JISv6K9P1F6xfqYMNhD:KcYwKR6OB4gKRm+9SKOQaqz
TLSH
T18191A414307B134079BE364950A58A6A528230F3309AE92F7BBC807E4EAFE154DFDDD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f6057222-e64f-4c92-ace6-c0cc370611c9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f6057222-e64f-4c92-ace6-c0cc370611c9.tmp
Size 29KB
SHA256 04c20b25ec5d1b978fe0f32fa528cc1d5d1d8ead6f53ca2895780deaa017cab3
MD5 063b0856f2e9a6142913318d9114fb36
SHA1 ed4911bf7d2eb474b21ce6f4f3604bfaeafc208d
SHA512 f1752e1e94337d53bb210c5eeb77eda1e1657423079930db99a670881253a3d8fd983301fc7e1f2f763d75efeec3502ff541c0f1e2ffaf3e36ba8c413c700a61
SSDEEP 768:OK30ASSWvS2l98F1+UoAYDCx9Tuqh0VfUC9xbog/OVeLqmLlLJ72ZrolZMGn:OK30ASSWvS2l9u1jaHLqmLZ12Sz
TLSH
T13DD2FA3B680CCB7E4FC01E9DDC6AAF9B6E9802C796548D4047FA984C02D77EA511B4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

e6ac7e7f-c3b5-4c8b-b67b-26830d1c0da3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\e6ac7e7f-c3b5-4c8b-b67b-26830d1c0da3.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2026.6.5.1\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\OriginTrials\0.0.1.7\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

45b4f3c3-d3d5-423c-a102-dbd75d7a77d6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\45b4f3c3-d3d5-423c-a102-dbd75d7a77d6.tmp
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

d10fd834-46a6-425f-9ce9-c64d7ec2f767.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\d10fd834-46a6-425f-9ce9-c64d7ec2f767.tmp
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

e380f805-3cdd-490e-9264-7827a0a8f748.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\e380f805-3cdd-490e-9264-7827a0a8f748.tmp
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

1a53992c-bc04-4851-b1f7-116ccf0e90bf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\1a53992c-bc04-4851-b1f7-116ccf0e90bf.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 3d194d16542858613a23c2c95b8fe8967076a373f445a24f3fb6e42401622248
MD5 9a7ceeb6284144d333a60e1275e9d9f1
SHA1 278c30cd001a436ec8cde773c0c67498e8a3dc95
SHA512 bbddcde9b25a3650f1d58f13ea78a5e95f04b5b2752e6f51efffa962e07f50346b3237ed19a6e3a3abddb58204821e69bb3d6bc5913acfe50cef39d185413137
TLSH
T183412B5CA7F91148B3B36F56ABF7786E487AB9772E06D49D10010D4F0A22B44C8B2737
MD5 SHA1 SHA512 TLSH

Submit Download

24a751bf-9c97-4c50-a605-426c625480a4.tmp

Path C:\Users\Admin\AppData\Local\Temp\24a751bf-9c97-4c50-a605-426c625480a4.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

3b13ffe3-ad08-4daf-8487-5510109d7951.tmp

Path C:\Users\Admin\AppData\Local\Temp\3b13ffe3-ad08-4daf-8487-5510109d7951.tmp
Size 158KB
SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
MD5 9c18c4721b560ec55f0d5de055144d5c
SHA1 6af37a3bda916cac276ad5879c9f61262d9ae523
SHA512 51466928eb8d3cf7b917919c98bd8168453583d2c3dc5836036d87ffd0d2c732ab8450212a880fc6de199ea569a96993ba0d250a5012160d2d72211880695f92
SSDEEP 3072:5ZwEurOxn8zXnHc2qHNYEU/rUHCVJWGdi0Ha5HnXk9TFzBsuht7yGik:5ZwPOx8D85UIHEI0HaZ09JzKStjik
TLSH
T1CFF3E13E7EDE891AD80B10BB7F16B18BD80D8E0B460AB44B769D80155B3668D1BD1CFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.13_(x64)_20261024124610_000_DotNetHost.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.13_(x64)_20261024124610_000_DotNetHost.log
Size 2KB
SHA256 3e3a6cb58f706e5bff55c18b7eb937fb4488e3beed70cd4692865449be63a0a7
MD5 bd204043b7e2153fd54d1fbcef8b2305
SHA1 f0df43ccf2e8356f3b4d1cc19a3da981ff277608
SHA512 1980c3365f8539b532fe6469f0c6fce41ed0273d0ffe64508f1884c5e11315689037a31349a21ceda537a3ed0741089f9cc5cb300d2eaa44c0aa65e41dc0417c
TLSH
T1A341E5641BE50D4AB1B6574B5EF7C0525A73FCC16934CB4C2289432E06AAD04A9FCBBE
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.13_(x64)_20261024124610_001_DotNetHostFxr.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.13_(x64)_20261024124610_001_DotNetHostFxr.log
Size 2KB
SHA256 135522895af2de2c1520628e25fe070185bd99a193ca1d25eb1cfccba12ef9cf
MD5 8cf55cd8aac523771c5668192f3b56d5
SHA1 498130b8d344c590a74842568be6d007e3c5d84a
SHA512 b659d1dbe5ae475194533af312025fc1552fbadff7f56e060429f43f6662028e6edd03301f2fd8ea2d350bdb4f76f9b3814d7b357ddf3bc32ce4fe3c3084d2ad
TLSH
T15941CB791BE5094AF1B2A7479DF3D0526B33FC956838CB4C2289421D0667D05ACFCBAB
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.13_(x64)_20261024124610_002_DotNetRuntime.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.13_(x64)_20261024124610_002_DotNetRuntime.log
Size 2KB
SHA256 7797ab7706d1ed0769ead226db3a39a53e7a9ec4c1c5dd0d9ebff130e8027c62
MD5 e9623ad34e66a93e5c1c084edbd93f05
SHA1 fea2b20797052d488679e6da8ad44a1dddf9ff94
SHA512 e32e9ff910ee17cc90837fb87415b9a15b03f680037bbc3b40468a61ec0545f35516b34fc1e1f00b9a9c04a9fd304626c8662d864848a87c2157d37b0313fa6a
TLSH
T1D541B9691BE50A4AB1F697475EF3D0619A33FCD16830CB4C2289421D0666D05ADB8BEF
MD5 SHA1 SHA512 TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5024_287215324\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bfc8b1b5-b5c4-4676-8e00-8bed24c94a0d.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5024_287215324\bfc8b1b5-b5c4-4676-8e00-8bed24c94a0d.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5024_317739309\CRX_INSTALL\_locales\en_CA\messages.json
Size 711B
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
TLSH
T1460197136240AF18470BF05BB9023442A0B44AC62384E0B775EC982C6656DAFB20B3B0
MD5 SHA1 SHA512 TLSH

Submit Download

DotNetHost

Path C:\Users\Admin\AppData\Local\Temp\{E5C55534-3912-4099-A8F4-4F201F2A513C}\DotNetHost
Size 848KB
SHA256 35fc82403cad4434570098cd328e7c08cdaf5900eb28abccce14ca505007ee74
MD5 33e5c38af27469024f0f965b6b6338c3
SHA1 384adea16f1ccb5f76d332b6e788fd2bd40c7b92
SHA512 3ab5392f3c9b2a9e0ef1050df7268405e3a53a40502de1d04e40ad686f05589e380c375c85b52c2cc7179c534db27b26c789569aa75a256974d92ec6f329f29d
SSDEEP 12288:ABGQ4cABdUb/aVo/2WCsT7pXJS5qgBwhY/EgH:oGyASwoO2T7RgZMYh
TLSH
T121055A1BBF9414A9D8A24EB1C5B78321FE357C082320959F46A4B12CDEFB6E4647B7C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetHostFxr

Path C:\Users\Admin\AppData\Local\Temp\{E5C55534-3912-4099-A8F4-4F201F2A513C}\DotNetHostFxr
Size 920KB
SHA256 9859abee395772c1701282e498f8eb712f68bef719ab8d0e7c5c5209b15079c7
MD5 6363c14104a452d5640a2588588a8879
SHA1 c12efb8fa3ef8e497f5f40c7baaecfb4547fb962
SHA512 68c539f9c1e3042d6acd93e9461d577ffd3868402d841cf24a15b826d2adb6642943f78c25d221cc230467a718f68ad685e1973917e339995a96d0ec06f11c34
SSDEEP 12288:CBGQ4cABdUb/aVo/2WCsT7pXJS5qgBwhYI4L9nmhUquwo/j9r:GGyASwoO2T7RgZMYI4RmhtC/j9
TLSH
T15D156B2B7F9414A9D8A24EB1C5B78321FE357C082320959F46A4B12CDEFB6E4647B7C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsDesktopRuntime

Path C:\Users\Admin\AppData\Local\Temp\{E5C55534-3912-4099-A8F4-4F201F2A513C}\WindowsDesktopRuntime
Size 28.7MB
SHA256 e482536962aa0524cac35f3f85e05a88d8ce00b3d98772a9e03983536d7fc195
MD5 60d26b66fd3af6f3c6d376d9d22400ca
SHA1 fef871c85eae2b82e422718bcaaab7e7496887d8
SHA512 41d4fb7da503ff4dc24c6765cf869f942b9d1d2aedd0397f4e028636c2f3a1f463d0d174a83928aa395c9dd8b16b3b0f97af656129d8d5cb2df909f4acfcb30d
SSDEEP 786432:77pl2f0LOoV6McLAnrthy78vptcerTwMRd0uHz:nf2joU9LAn5hygfcerTwM/0mz
TLSH
T19E67334FBE9109A9D8374E35C1B38364AA367C051310859F8AA0B51DDEFBBF0257ABD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cac9de31-f840-4741-be51-88068b4ec20c.tmp

Path C:\Users\Admin\Downloads\cac9de31-f840-4741-be51-88068b4ec20c.tmp
Size 3KB
SHA256 edc8af11027585e9b1e89d9bf86ceb97d47730b406b63d4982a25671de4728f6
MD5 1af89956d0cda753847238b8a5ac5535
SHA1 602182a8605d8dc81eb4b3f7f44d55ded941d21d
SHA512 a28c27b3c82ef625df898bd0ae5370097a513027ed7b019a420c4fbb48bee50b666545637848d6f2630d4830fa56af7465ee9d46d2f399a64e2990d009a70bef
TLSH
T19571B805E72DB075CFAA30364C973E247E56B99452A8E3C2CE814B1138A16F15F277C9
MD5 SHA1 SHA512 TLSH

Submit Download

MSI3435.tmp

Path C:\Windows\Installer\MSI3435.tmp
Size 411KB
SHA256 ac54078e0387d2a8ddcdbee3967da6ea6ec6508172505aca3d27a75fa43ce34f
MD5 1981cd407f5b5e81c70ba2729c56b381
SHA1 e0b6d311930ab3557d5a0a8769edefb49c32aa3f
SHA512 3b7c18ca780cf05a01062661156d71e0a4626469f28040e46f07c7deb8f9a643b838bbc88eda515362c5895171a337a3f5d9b8e321e539408fc1ae47e6ae4181
SSDEEP 6144:GDvoaVoIMrKAzCsTI+q6JL9eZYr1JJS5qZ47BwhYjzmHim:QvoaVo/2WCsT7pXJS5qgBwhYg
TLSH
T135947B29B3E418EDD4B682B6C5A78430FF75744D332095AF8BA4916D1F3BAA470BB701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BootstrapperApplicationData.xml

Path C:\Windows\TEMP\{E5C55534-3912-4099-A8F4-4F201F2A513C}\.ba\BootstrapperApplicationData.xml
Size 9KB
SHA256 d844332a2d80742561596a6f60b97359b11835425122e7d14aeab06fc85c349a
MD5 ace58668e48c924328e4224a63aaa584
SHA1 5838c298677721a7de9c43196d4dcd84070b0d2e
SHA512 aefce9f39dd3b9ce33eb42f5b60badecf105ef6942360695347118f0d8e4353965a0c7c662c360c7a370fde6ff8e664436e579d827c9a1ec8a10e0a6dd68b1d7
SSDEEP 192:XizanZTZzrv/rv+enhX4aqaljP2pfGbSsCsysR:LnLg5sCsysR
TLSH
T18F12D4513BFD0219F0F36F88EBF6A5155A3ABD552E39C82D01201D0E49B2E819962FB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetLogo_256x.png

Path C:\Windows\TEMP\{E5C55534-3912-4099-A8F4-4F201F2A513C}\.ba\DotNetLogo_256x.png
Size 2KB
SHA256 0f571f95d8eab48dbc81b0ec5e9f7225e349e26ef50868bfaab556f3c2443b01
MD5 39aa52615723b782c92dec710caaec7f
SHA1 760b49e256a7979fe50a56a2b1be3688a474b886
SHA512 89d1baa3820154667747b25e9e2fd321bfb2ec71dc309915b0a28dacdc80822a4943b639ebb37c37bd2559d5a4306d2096119cd970c84a0d331f6c68b0456dc9
TLSH
T1534195CF1BFD78D7E6E557918E1A8DD232738483B4B3A42CCE7B10B8274A5642B87940
MD5 SHA1 SHA512 TLSH

Submit Download

dotnet.ico

Path C:\Windows\TEMP\{E5C55534-3912-4099-A8F4-4F201F2A513C}\.ba\dotnet.ico
Size 44KB
SHA256 61a2cbd12868cb9b359e0c78961d409b7875f072eb8e53ea88d3e6bfe2961a18
MD5 b8096652d9ec286709a2c863b244b110
SHA1 b3b7f0f4d608fad7cb59ba499d4d17c2b873a7af
SHA512 492a5aa83220bb77c178b7c5b50bf44968c0427e9e45bb97a33df14d7fb4c667ca7adde0ebb3874c7b6011057b01144e4e6651fbad62c6bcf5e0b93586c4bc7a
SSDEEP 96:r+gfbzo+wHK9NbwOY4tIWQeVlV1W9+H+guapUjFamINUItzf1dBNaIZ:ro5HuNcH4tIzeVlV1WEOFDgUWzf1PIm
TLSH
T1E913EF6DE68547C1C10C2032DB4AC792B5233C72E4DAE0C4F9D4FA7E177906965C6E6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\TEMP\{E5C55534-3912-4099-A8F4-4F201F2A513C}\.ba\thm.wxl
Size 7KB
SHA256 b00edd703dd8a475119d0e4dd70a3aaa47f0e95361af290e76d367a8edef3432
MD5 8b2c667a8bbad3153068c0ed90df7ec4
SHA1 c9e04a3a37e5e6262ab9bfecf78280171b8f7b74
SHA512 5269f00d474acccb4c48cb7bcfdf19e63557a388572d3a6335aa39191319691d924e27f70da3f3495387c319396476c63a8fd7b35835cca0901220e39783847b
SSDEEP 96:HiTgM1+XSNEzA0HtYQstYCpCwZQpCeyk5HQJM9ouvj9urz8:Ew9EmtYQstYCPC9e8
TLSH
T191E1026F68DFDEE03A732651B2B3698D6919C29A136F1CF0F869084B47635016377A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.xml

Path C:\Windows\TEMP\{E5C55534-3912-4099-A8F4-4F201F2A513C}\.ba\thm.xml
Size 11KB
SHA256 dfee8e2d075087227f19c835c145c5bb8e72a46880ea24080bb2472fd3a521be
MD5 4329e418dc56b1386d7ea29a0dcfab5b
SHA1 58387f92e89ca21b4179fb697c7de9675c59142f
SHA512 6934873d27e6efbb94da4f13ee8369b29995490051016fdf82800256b924902306d328bf1d4ebbf266d1a53eb24adb6478d1a67de4ecc3e3bcbe561968f24922
SSDEEP 96:HgvPkoeWEH3IWTaQfSJgHzth5mFahbuB8pR5+Vpwe+UIJLg1gEp+6F5pQnxc:AvoWydmQfVHMyyj5Z
TLSH
T14B42FC6851DC7811C532D702AB9371D3FF12BDA6C6C85A58B48E256B1FF262028B739C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{E5C55534-3912-4099-A8F4-4F201F2A513C}\.ba\1028\thm.wxl
Size 7KB
SHA256 43e1e134d0591532323dfcd138ac8f5e99096cb6cb0213a486bbb3ecc5c47aad
MD5 2d7b0d29deaa836b538baaae8378ba48
SHA1 85d86c566f601ad6e22301183771b9cc7e5062e9
SHA512 ecc84dafe21bf858eb4693fd7c0802cf28dc5fcaf43eccc4ded3c4a83bd550e3dbf58012be695cf267917c39f6047eac89fd0cdec090e253c283783d01d8a916
SSDEEP 96:E5TrTfb5joKvyvOj8USd4sZij7N4WoWKWvsNMNizchn/hD2Rd0E/aQpSK1nuQKbm:4r5owj7NgwsNMNSiK1gd6r
TLSH
T1ECE10F5F7CEFCED46A332A0176B32989191DD28A13AE6CF4F5580C478B634216B73A07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{E5C55534-3912-4099-A8F4-4F201F2A513C}\.ba\1029\thm.wxl
Size 7KB
SHA256 2f174b5eed2a84e43396f3cae2e6521c9247bb0deccb16e7f9b461233c363534
MD5 f483510f350ad116c5c81468ad609bdf
SHA1 5343a3a695e6149c7a7ba831be75a91138763e44
SHA512 a39f3ebedb06361d95c39e4b7c5020d70be0e1e4654d5d5dfe254b44a7fa3a9c9c02659a28acc7ea8294620aa77818fb53609d7a2f6c9b6ae8d9adf9f2ac844c
SSDEEP 192:qxwpVLBj5iGRxrFe+4Lzv3zLfqRBxOTyv354+F:qxwNj5RxrF2PbLfWBETyv354S
TLSH
T17AF1FF1F58DFEED07B33194572B36A88681AC292035FACF5F8AE085787235059677E03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{E5C55534-3912-4099-A8F4-4F201F2A513C}\.ba\1031\thm.wxl
Size 7KB
SHA256 2589887424dd4b0b27d36f7aa36d07fb6fa8d1c4dbe50059248a24823c742f92
MD5 4e98d12cfce46c393dcdf2736a2bda95
SHA1 aaf6a00e50cdf19f1c4fc6256ac040a750ca97af
SHA512 314d712f8fcb2a44abe1920aa9f44d2fef626732397d3d77e4ad0ea6a003b0ea38e361c96515c8e6f8cf7d61ab96de9a349a228522a9f4b81d82c8a8f1962662
SSDEEP 96:jgl95EIQ8+nPQP6Zc0y7jOROgYmwitzvzB5xz2kSl+ACIw052Q/LKtkCGpUvgd/q:jEpcoPWc0y7jGhYmdtzvzr8/oa/Lt/hQ
TLSH
T134F1425BA8EFDAD077332611B3736989791AD2C6136F1DF4F8A9480B8763501537BA03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{E5C55534-3912-4099-A8F4-4F201F2A513C}\.ba\1036\thm.wxl
Size 8KB
SHA256 ecdd5f7b7ed65bef8e3eec00537da44939b8e8f8f604e9b39329b45ec210efde
MD5 7673a053117454b94ff8155b9f06da1e
SHA1 2143896f16e8ec6d52eecb773e99d9a2f9daa4b9
SHA512 0d20a4d6819fc64e36cfcd9c029542d6ef834faa3c74dd636bc1b6697f92d8822cd19c1692c500956fdfe69a3278a84c0545c799878107d0d56520053b9ae266
SSDEEP 96:lsZt1vwZI+XNHwt/o5HezMxzMEy0vBW4eAQf49QcyhZpuWcK61xrG32gUgGv:o1wPWto5+zwzvWhvgYUgg
TLSH
T1E202105F58DBCFE06BB31717B6639589A839C286235F58E4F86B08078763914D337A43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{E5C55534-3912-4099-A8F4-4F201F2A513C}\.ba\1040\thm.wxl
Size 7KB
SHA256 c536f3f85936f6b38782df30a7bf88c7e7e66fa1e3257b20b75f9a4f0112b184
MD5 21fe14f06f2e38ca565581045a67eaba
SHA1 fe56b260ea7986f6234aeaa9f3adb010b01a0ff5
SHA512 a87e53dbcab33b95d78f67c7e62f0c3fa50711f54b11efee890b749dd21f42e68db185dc5a99160dd37403612abb9609d311dea1254c126b1e96ecf7aab67051
SSDEEP 96:p0NpgwGrmKmuaXo+Hnxy7McLi4vgjzH9euz3KLrQTNRREhZDWDIQ0gwZKWakCRos:wNBoJvUzH9euz3tTDCnZKWzDU+c
TLSH
T1BFF1EF7B68DFDDD0BA332748B2B3B589B51ED586235F19E0F4AA094B4753500A27BA03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{E5C55534-3912-4099-A8F4-4F201F2A513C}\.ba\1041\thm.wxl
Size 8KB
SHA256 000e1508d9bacb7156951988ba1d6dc36165facd2163352a93b9a66e8c642089
MD5 e29c1d15cf0eeb5fb10a6f0e92b041fc
SHA1 68cd096f0135524d5d07a9ec1fbcb69e1a1084de
SHA512 47d3acdafbc3dc960d569976fe3c635613608f08102a6cd0c246f8ebe0f3343e73fc9d87a673035a46fbc4de21c59b97054dfd596dde2f5f6eea25f6ff7b7d96
SSDEEP 96:/x55EeSXkI6+QsPIVLYitzzus2iK5EmV26W/0zYe9YQfNpYjruBzUYwvdCz1Q:/BQFPIVLYszzutz8yzYUO/CxQ
TLSH
T1B702102EA5DB89E06A331611756776C8680BCC85DBAB1CF0B07DC817977341DE237A32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{E5C55534-3912-4099-A8F4-4F201F2A513C}\.ba\1042\thm.wxl
Size 7KB
SHA256 09c51c910f7142ab7f73db8e826f3daff1525eea765d03bcd934cba53bc689d3
MD5 095c8d4db15a85c0c62842d0192202ad
SHA1 d703ab6b95a8190a3187a65ba1b779d856eff7b8
SHA512 86860b18e9101c2d27359e53e21c7f2fe939031850387a6a55c12d23b7dbe4133722b5fdf4364dc896d5aac5744b470b45198a47da6912a4827b88f433a79796
SSDEEP 96:YWnvHZWx805aEfLW344uU5OsW+yvuE4uU5J+jpD2kUcdkAdiY10IHDWw/fPb8Qhk:kjcuYhu5jx2kP1/3bmk9d4
TLSH
T1E8F1429B78EFDED026732C413AF36A95591AC2DA235B08F0F9254C878B738114637E27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{E5C55534-3912-4099-A8F4-4F201F2A513C}\.ba\1045\thm.wxl
Size 7KB
SHA256 209911674536ad5976dad21ae1e96a9fdfa61270120a94bbe0e8ae32a67239a2
MD5 4e407f5d7e06084cb9ec7b41b1f4b992
SHA1 0aa44f39e522935de900449937af13df18a6ef44
SHA512 926daa3c9d92b7f0e910101d6482ce6e153af13dd3f59236d3418df4a158857f00ea565869312f35c0bf6e689b6f1a0bead71f54e77783d65311838dc980c996
SSDEEP 96:vz5E6U+A8fOIZcvYqUC/W5TqUbFaOa0Q9zSzfmZ5AKgY1ou5DQ7JPy+u1/8X3vCH:ln9BmNUCqeUJaOaHNCPA/zGYP
TLSH
T1D5F1005FA4EFCED127331A45B6B369C9680AC5CA136F1CE4F8AE081B87675019337A43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{E5C55534-3912-4099-A8F4-4F201F2A513C}\.ba\1046\thm.wxl
Size 7KB
SHA256 7b095c32d1fbdd924d710d18d51a88a710bc152c8b30c6051524583bfabe38c0
MD5 13d65c9d4996d93edafb2696cc2a90b3
SHA1 80047984b6cee842764b24ef33a5c67eaabab2f3
SHA512 14ceaf26e16cfd039e18614d40148c44e09cc2e7130b19a3024aabb46bac77c1445cd7de84ef46577ae1ab4cf15cd0152a3ccd6fe070ee0a34b06f8f29ba0af0
SSDEEP 96:TD5ED4lH+wLwdBc7tlqIz5Vv0gpK0rD45g5q8MSQ7EugTuo6RADvAbK:Z1kvg7xlVv0gpXMfgLGK
TLSH
T1D9F1121F68DFDED037331A42B2B36A8A6509C2C5135F5DF4F8AA494B87A3500A637A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{E5C55534-3912-4099-A8F4-4F201F2A513C}\.ba\1049\thm.wxl
Size 9KB
SHA256 3c911848f83d269fa2cd64bbfd7b5e88eb3a621bdd42c564c69100a8e8a40494
MD5 7904c2832b3cedabcdf0ec49dd8040ba
SHA1 2a7f428568ab6ea5fd54bb80376c552d80a0e7a3
SHA512 3c881efc2b611bda02b290bc79948818ce6e6a495dcf2dc938047875f301f18f9eae37ba109fd9b453504173cb9209192e0d2cd4603c7bf105042bc9775829e0
SSDEEP 96:C7lv+VxxVUC7bqFdwkd/XQF+L++qFQEemLq9OJRgcnZKQ8VXoshXuOxMvlmV3p/n:zVPVU//y+L++9wpZ/oRZ1
TLSH
T1A022FD2615EFA8D81222B117E9626E0E3C5B81FF3B6B5BF174641C6F76B3000833B606
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{E5C55534-3912-4099-A8F4-4F201F2A513C}\.ba\1055\thm.wxl
Size 7KB
SHA256 56d76adc63b71879e3291f0f306e54081e9e80f463fcb41dc6896ecd2298deae
MD5 e2fabe4eb312645c1231029191458f7e
SHA1 f9f143535ba48d9aeb791c62e79ed687911927b1
SHA512 ddf60df1ee2f00561bc806e384478b105182a4bec673b5eb26b1db7f88adb297af80b7bdfeecd5e0aefc3579bf20a84bc9bacdcfb727b9d1af2865cdcdc48a37
SSDEEP 96:YMANNFTFhC4h4bNReiNxfufGzzzSkbAS37lsu+wzPwQT8gpwMu7kVS0uuM/r+9Hc:YlFJydNxfu+zzzgoZ7Twh/6H/0
TLSH
T1DCF1231F78DFEDD467332A56B2B3268CB84EC382132A9CE0F52944479BA351152B7B07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{E5C55534-3912-4099-A8F4-4F201F2A513C}\.ba\2052\thm.wxl
Size 7KB
SHA256 340154c87016bd6af740e6a91ea86d722817f6dc2bc675c33133901443658179
MD5 e89b4290f9255b428cc21e217dc8e5e7
SHA1 84f78df432e53426412e2123c1990acfb743f6c9
SHA512 b313de643859aca6b9b2f05f88efd130c900065c08d2279af6f7d8dd0301a7a762ee0e051ccc76c737c68c86e51decd48287529e7fc9a25c0cb1228151447105
SSDEEP 96:dLf2DllNpoNWZd9rCfE4d57afwUtn93K248RYCPr/I5Qqj9BQru0iCiBkz6/3PPx:d0Np6fHGwMn93MRoL+u0x
TLSH
T11EE1119F78EFCEE02A332A5132B325CC2819D28957AB5DF0F4641C4B8B634205777A07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{E5C55534-3912-4099-A8F4-4F201F2A513C}\.ba\3082\thm.wxl
Size 7KB
SHA256 2416f9a3daa6767f418c5ab94edb8a83dc9326fcaf13de1186e61b5248349edc
MD5 65b3aa6dd10a5b8db1b7f7faa4c4c7e1
SHA1 ca32c8b853681960c86d19d533dff4ff1137a1c6
SHA512 d7fce89011c24d0c3928807293d42a3f694ef4357d3c42a84d9294de000b291279671e2059e063ac58806b8e718654260ce5c9ae8c748d3a0a8c9ce0e23ac55a
SSDEEP 96:oEBx4+Ck8rL6j+zTnnq6LuSznTUzO1GKW+gepaU5/QxANuRypklEDhmh8asuBtz:aX6qfxLzznAzO1G0ERdiu/z
TLSH
T132F1412F68CFDEE27B73194472F3958DA808C295235ECDE0F468085B8793905D637A83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BootstrapperExtensionData.xml

Path C:\Windows\Temp\{E5C55534-3912-4099-A8F4-4F201F2A513C}\.ba\BootstrapperExtensionData.xml
Size 276B
SHA256 258fac237622533e7f9ec3f95bcec8abcc31ae87e2017e5717af0841c61e9df4
MD5 240bac991e5860465ce0dfd580ea7cb3
SHA1 a352934cbb14ab877883ac219ceb78c92e27f495
SHA512 67ff8063a071436ae7dca8ee12ad1991bb70752dcc63f00f129f38dffa1aaf9299fff591fc67dbf4d2fdc57a9242831b149d575181b84857cd4f22463076f315
TLSH
T1DAD05E432FBE2304F1B30F49A6BA94102475BE009D78CC6D0228080C0573D92C8B2F77
MD5 SHA1 SHA512 TLSH

Submit Download

license.rtf

Path C:\Windows\Temp\{E5C55534-3912-4099-A8F4-4F201F2A513C}\.ba\license.rtf
Size 215B
SHA256 75cf03762aea3f3ef6ae0dc0290c4426052549a0b4335bcc3ba9ca30391e0751
MD5 5f5db41d3f86258e4b6f8b08ef870d0a
SHA1 3c02aea43c2bc7dff281ec8e5ad01abf058c1ed6
SHA512 26344831d563e95a26126f2d99ce9b773017596001fbf3d7f56b9a84c77a69240640b7bb191ec8ec7fa66d424134805113be8b9503adae19554aaba6c98223ee
TLSH
T19BD022EA15CC11AA3FB80A8CEB04D029ED7E419DBC41D682B1313A90F81192DB2C76A2
MD5 SHA1 SHA512 TLSH

Submit Download

logo.png

Path C:\Windows\Temp\{E5C55534-3912-4099-A8F4-4F201F2A513C}\.ba\logo.png
Size 852B
SHA256 cd2e8ed1fbb308d9d166f49794d323a9b22efba1033cdf906d1f4b030319e01b
MD5 8346e21859a269dccf1e408dc7593cca
SHA1 239f10674bf6022854c1f1bf7c91955bde34d3e4
SHA512 de9a54e7067fe4feade10f48d7c2bb4169f50efa0b06d3310421376690712af4d55dbc24dc5accc5013379b11abb59cc8c85896fe9f2a7c6a7ea2e28f6feac9f
TLSH
T16B0152E8C16455ACA24E76BA91F32450B653B46010C5CD8EBE00DF3442F4522AB976A6
MD5 SHA1 SHA512 TLSH

Submit Download

wixstdba.exe

Path C:\Windows\Temp\{E5C55534-3912-4099-A8F4-4F201F2A513C}\.ba\wixstdba.exe
Size 431KB
SHA256 e9aad13949cd910523bf9547fc5c23bd2c26595e024809a9f8fa866c8d8e555b
MD5 14e0c606e68508fa618bd5c514015577
SHA1 f8c28db9d2810e872f6ffe7607019851f250c5f9
SHA512 c29fedca692ca2f9c5e63f360aeb95399f2f15f1576a0d06fcf9f0919f6b658329973803bc870b0b1e954b0105757630ca3f4b3ac64f4b80e91742d612fd5b73
SSDEEP 6144:N7lQcp03E0PKVMP/PwMFJ3zdoZmb8LSQsCjzYkffTTp6EoNXJrprSU0e:Np6mM/wML3/QsJDLXJrow
TLSH
T16D942A3165F04023D6F94572E915FA30AF39F208670085EBA3C0DD297968AE6A7FB357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windowsdesktop-runtime-10.0.13-win-x64.exe

Path C:\Windows\Temp\{E5C55534-3912-4099-A8F4-4F201F2A513C}\.be\windowsdesktop-runtime-10.0.13-win-x64.exe
Size 968KB
SHA256 4bdf11603894a1bb59fa182af466602b1172bd5903f1065bde97e466d3d3f4a6
MD5 a67752f8027d60ade79826981fe4afd4
SHA1 617931f8734fd4d57a9eff03b18aba21daba2cfa
SHA512 c70a9a5329d5d4857284761cc246dce6770709f5aa65afcc1f66432299395b6775cb58bd5f276880f6c136a65e9b34db943f8e83d3e224ca4aa224912ca30bf5
SSDEEP 24576:+ZzPRq5eZbpTh47zykJTjJkqFywwG/PUj38K2:qFBb74CmvuqFywtPCU
TLSH
T185256D31A166242BE7F40973F915D6307E28E7082B5C45B6C6D0DD0C39A89EA6FF724B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download