a360ddba8b04b51c7a973e79214f7ba442c5aa4d5f8f9b69991aeca5926b8078

Resubmissions

24/10/2026, 15:12

261024-slem9afb773

24/10/2026, 15:09

261024-sjyncazw4r8

Analysis

user interaction
yes
max time kernel
77s
max time network
79s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
24/10/2026, 15:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NL-X.exe
Size 3.4MB
Sample261024-sjyncazw4r
SHA256 a360ddba8b04b51c7a973e79214f7ba442c5aa4d5f8f9b69991aeca5926b8078
MD5 a39f445ab688aa065e7f3bc2386a730f
SHA1 0a45d19cc45beb32f5227f32313ff175b9997bb4
SHA512 f89fe4a6a78e9dc55ac269f11fef6da7928c636c2f10ccca120e2a0d292249845912d2343b22d2744e91336de64ae7b8a1faa69235785182c3e57d496693271f
SSDEEP 98304:nr6utwIUEvj7rTTN/V701kUZK6rE0ourDRvr6E:nr6utwZ4B/VI5wBgr6E
TLSH
T1FDF5E12751AA8D47C5B097FDC156A34A8A33A7C47A32E39F39307514EDE57D30E2A2E0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery persistence

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
63	3608	msedge.exe

Executes dropped EXE 6 IoCs

pid	Process
4060	windowsdesktop-runtime-9.0.21-win-x64.exe
2660	windowsdesktop-runtime-9.0.21-win-x64.exe
2928	windowsdesktop-runtime-9.0.21-win-x64.exe
4892	windowsdesktop-runtime-9.0.21-win-x64.exe
4668	windowsdesktop-runtime-9.0.21-win-x64.exe
2640	windowsdesktop-runtime-9.0.21-win-x64.exe

Loads dropped DLL 10 IoCs

pid	Process
2660	windowsdesktop-runtime-9.0.21-win-x64.exe
4516	MsiExec.exe
2640	windowsdesktop-runtime-9.0.21-win-x64.exe
4516	MsiExec.exe
2496	MsiExec.exe
2496	MsiExec.exe
2100	MsiExec.exe
2100	MsiExec.exe
5892	MsiExec.exe
5892	MsiExec.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{9ebd7727-8105-47ca-8e74-76305a8bb1a1} = "\"C:\\ProgramData\\Package Cache\\{9ebd7727-8105-47ca-8e74-76305a8bb1a1}\\windowsdesktop-runtime-9.0.21-win-x64.exe\" /burn.runonce"	windowsdesktop-runtime-9.0.21-win-x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.21\ja\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.21\ja\WindowsBase.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.21\it\PresentationCore.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\ThirdPartyNotices.txt	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.21\it\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.21\it\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.21\System.Net.WebSockets.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.21\tr\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.21\zh-Hans\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.21\System.AppContext.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.21\fr\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.21\System.IO.FileSystem.AccessControl.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.21\System.Runtime.Serialization.Formatters.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.21\System.Formats.Nrbf.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.21\fr\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.21\es\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.21\it\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.21\tr\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.21\System.Diagnostics.EventLog.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.21\System.IO.MemoryMappedFiles.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.21\clrgc.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.21\System.Security.Permissions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.21\mscorlib.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.21\System.Threading.Timer.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.21\pl\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.21\zh-Hans\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.21\System.Security.Cryptography.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.21\System.ComponentModel.Annotations.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.21\zh-Hans\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.21\ja\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.21\zh-Hant\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.21\System.Runtime.Serialization.Json.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.21\System.Diagnostics.Tools.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.21\de\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.21\pl\ReachFramework.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\LICENSE.txt	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.21\System.Diagnostics.FileVersionInfo.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.21\System.Net.Http.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.21\System.IO.Compression.Brotli.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.21\System.Console.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.21\System.Windows.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.21\de\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.21\PresentationUI.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.21\System.Web.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.21\es\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.21\ko\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.21\zh-Hant\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.21\System.Configuration.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.21\System.Xml.XPath.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.21\pl\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.21\System.Collections.NonGeneric.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.21\System.Runtime.dll	msiexec.exe
File created	C:\Program Files\dotnet\dotnet.exe	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.21\pt-BR\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.21\Microsoft.WindowsDesktop.App.runtimeconfig.json	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.21\Microsoft.Win32.Registry.AccessControl.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.21\cs\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.21\pl\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.21\fr\UIAutomationTypes.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.21\ja\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.21\pt-BR\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.21\ja\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.21\System.ValueTuple.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.21\System.Xml.Linq.dll	msiexec.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e58d69f.msi	msiexec.exe
File created	C:\Windows\Installer\e58d6a6.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI11B5.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFF6CCCF2D8C7A6A42.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2976_1775632174\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2976_1775632174\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2976_1775632174\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2976_1775632174\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2976_1775632174\_locales\ta\messages.json	msedge.exe
File opened for modification	C:\Windows\Installer\MSIF317.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2976_1775632174\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2976_1775632174\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\~DF638497EE471DAB44.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF685.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFAAF.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2976_1775632174\_locales\th\messages.json	msedge.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2976_1775632174\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2976_1775632174\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2976_1775632174\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2976_1775632174\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2976_1775632174\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2976_1775632174\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2976_1775632174\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2976_1775632174\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2976_1775632174\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2976_1775632174\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2976_1775632174\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2976_1775632174\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2976_1775632174\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2976_1775632174\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2976_1775632174\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2976_1775632174\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2976_1775632174\_locales\mr\messages.json	msedge.exe
File opened for modification	C:\Windows\Installer\e58d6a6.msi	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2976_1775632174\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2976_1775632174\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\~DF85094B6A28C33145.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2976_1775632174\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\Installer\e58d6a5.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFED1011565364CDB2.TMP	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2976_1775632174\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2976_1775632174\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2976_1775632174\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\Installer\SourceHash{7B3F5EDB-17C7-41A5-8650-2F5614D6B37A}	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2976_1775632174\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2976_1775632174\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2976_1775632174\_locales\am\messages.json	msedge.exe
File opened for modification	C:\Windows\Installer\MSIAC.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2976_1775632174\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2976_1775632174\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2976_1775632174\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2976_1775632174\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\e58d69a.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF57B.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF5CF2836A1323F6B8.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2976_1775632174\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2976_1775632174\_locales\fi\messages.json	msedge.exe
File opened for modification	C:\Windows\Installer\MSIE962.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF86B6E6B489DAACE6.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF400E99C40EDFC738.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2976_1775632174\_locales\hi\messages.json	msedge.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\windowsdesktop-runtime-9.0.21-win-x64.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-9.0.21-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-9.0.21-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-9.0.21-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-9.0.21-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-9.0.21-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-9.0.21-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3608	msedge.exe
3328	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_72.84.61393_x64\Version = "72.84.61393"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\03481B22B0F8EE247BD5B42D34B8B013\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC2FB4E184BB2CD4C9E4AA0613B1F404\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\03481B22B0F8EE247BD5B42D34B8B013\Provider	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC2FB4E184BB2CD4C9E4AA0613B1F404\ProductName = "Microsoft .NET Runtime - 9.0.21 (x64)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FA8D10F9658A25A4EA9D9E1846784B53\ProductName = "Microsoft .NET Host FX Resolver - 9.0.21 (x64)"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FA8D10F9658A25A4EA9D9E1846784B53\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\361E85EF635599C488AD4C909883BA6E\FA8D10F9658A25A4EA9D9E1846784B53	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FA8D10F9658A25A4EA9D9E1846784B53\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{9F01D8AF-A856-4A52-AED9-E9816487B435}v72.84.61380\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_9.0_x64	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\03481B22B0F8EE247BD5B42D34B8B013\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CC2FB4E184BB2CD4C9E4AA0613B1F404\MainFeature	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\03481B22B0F8EE247BD5B42D34B8B013\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\windowsdesktop_runtime_72.84.61393_x64	windowsdesktop-runtime-9.0.21-win-x64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1826067017-2692080558-3687773357-1000\{D342596F-615F-4D3A-AB7F-B9FA324BB384}	msedge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC2FB4E184BB2CD4C9E4AA0613B1F404\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BDE5F3B77C715A146805F265416D3BA7\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\F71950C1A6A51F479A1ED20855BD5918	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BDE5F3B77C715A146805F265416D3BA7\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\03481B22B0F8EE247BD5B42D34B8B013\MainFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC2FB4E184BB2CD4C9E4AA0613B1F404\SourceList\Media\1 = ";"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\03481B22B0F8EE247BD5B42D34B8B013\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FA8D10F9658A25A4EA9D9E1846784B53\PackageCode = "71F64DD52827B9C4483E6542508F3365"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FA8D10F9658A25A4EA9D9E1846784B53\Version = "1213525956"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BDE5F3B77C715A146805F265416D3BA7\ProductName = "Microsoft .NET Host - 9.0.21 (x64)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_72.84.61393_x64\ = "{22B18430-8F0B-42EE-B75D-4BD2438B0B31}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC2FB4E184BB2CD4C9E4AA0613B1F404\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BDE5F3B77C715A146805F265416D3BA7	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BDE5F3B77C715A146805F265416D3BA7\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BDE5F3B77C715A146805F265416D3BA7\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\windowsdesktop_runtime_72.84.61393_x64	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_72.84.61380_x64\ = "{1E4BF2CC-BB48-4DC2-9C4E-AA60311B4F40}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\FA8D10F9658A25A4EA9D9E1846784B53	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\361E85EF635599C488AD4C909883BA6E	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BDE5F3B77C715A146805F265416D3BA7\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{9ebd7727-8105-47ca-8e74-76305a8bb1a1}\ = "{9ebd7727-8105-47ca-8e74-76305a8bb1a1}"	windowsdesktop-runtime-9.0.21-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC2FB4E184BB2CD4C9E4AA0613B1F404\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FA8D10F9658A25A4EA9D9E1846784B53\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_72.84.61380_x64	windowsdesktop-runtime-9.0.21-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_9.0_x64\DisplayName = "Microsoft .NET Host - 9.0.21 (x64)"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\03481B22B0F8EE247BD5B42D34B8B013\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\03481B22B0F8EE247BD5B42D34B8B013\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{22B18430-8F0B-42EE-B75D-4BD2438B0B31}v72.84.61393\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\03481B22B0F8EE247BD5B42D34B8B013\Version = "1213525969"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_72.84.61380_x64	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\BDE5F3B77C715A146805F265416D3BA7	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BDE5F3B77C715A146805F265416D3BA7\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BDE5F3B77C715A146805F265416D3BA7\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{7B3F5EDB-17C7-41A5-8650-2F5614D6B37A}v72.84.61380\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_9.0_x64\Dependents	windowsdesktop-runtime-9.0.21-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\03481B22B0F8EE247BD5B42D34B8B013\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_9.0_x64\ = "{7B3F5EDB-17C7-41A5-8650-2F5614D6B37A}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BDE5F3B77C715A146805F265416D3BA7\SourceList\PackageName = "dotnet-host-9.0.21-win-x64.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\03481B22B0F8EE247BD5B42D34B8B013\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{22B18430-8F0B-42EE-B75D-4BD2438B0B31}v72.84.61393\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1826067017-2692080558-3687773357-1000\{328A34E3-5B16-49A3-B6F1-D1141A866C65}	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CC2FB4E184BB2CD4C9E4AA0613B1F404\Provider	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FA8D10F9658A25A4EA9D9E1846784B53\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FA8D10F9658A25A4EA9D9E1846784B53\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FA8D10F9658A25A4EA9D9E1846784B53\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{9F01D8AF-A856-4A52-AED9-E9816487B435}v72.84.61380\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BDE5F3B77C715A146805F265416D3BA7\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\04E3F5B2BDF518F4E257557521352135	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FA8D10F9658A25A4EA9D9E1846784B53\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC2FB4E184BB2CD4C9E4AA0613B1F404\Version = "1213525956"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC2FB4E184BB2CD4C9E4AA0613B1F404\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC2FB4E184BB2CD4C9E4AA0613B1F404\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{1E4BF2CC-BB48-4DC2-9C4E-AA60311B4F40}v72.84.61380\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\FA8D10F9658A25A4EA9D9E1846784B53\MainFeature	msiexec.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\windowsdesktop-runtime-9.0.21-win-x64.exe:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2856	msiexec.exe
2856	msiexec.exe
2856	msiexec.exe
2856	msiexec.exe
2856	msiexec.exe
2856	msiexec.exe
2856	msiexec.exe
2856	msiexec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2928	windowsdesktop-runtime-9.0.21-win-x64.exe
Token: SeIncreaseQuotaPrivilege	2928	windowsdesktop-runtime-9.0.21-win-x64.exe
Token: SeSecurityPrivilege	2856	msiexec.exe
Token: SeCreateTokenPrivilege	2928	windowsdesktop-runtime-9.0.21-win-x64.exe
Token: SeAssignPrimaryTokenPrivilege	2928	windowsdesktop-runtime-9.0.21-win-x64.exe
Token: SeLockMemoryPrivilege	2928	windowsdesktop-runtime-9.0.21-win-x64.exe
Token: SeIncreaseQuotaPrivilege	2928	windowsdesktop-runtime-9.0.21-win-x64.exe
Token: SeMachineAccountPrivilege	2928	windowsdesktop-runtime-9.0.21-win-x64.exe
Token: SeTcbPrivilege	2928	windowsdesktop-runtime-9.0.21-win-x64.exe
Token: SeSecurityPrivilege	2928	windowsdesktop-runtime-9.0.21-win-x64.exe
Token: SeTakeOwnershipPrivilege	2928	windowsdesktop-runtime-9.0.21-win-x64.exe
Token: SeLoadDriverPrivilege	2928	windowsdesktop-runtime-9.0.21-win-x64.exe
Token: SeSystemProfilePrivilege	2928	windowsdesktop-runtime-9.0.21-win-x64.exe
Token: SeSystemtimePrivilege	2928	windowsdesktop-runtime-9.0.21-win-x64.exe
Token: SeProfSingleProcessPrivilege	2928	windowsdesktop-runtime-9.0.21-win-x64.exe
Token: SeIncBasePriorityPrivilege	2928	windowsdesktop-runtime-9.0.21-win-x64.exe
Token: SeCreatePagefilePrivilege	2928	windowsdesktop-runtime-9.0.21-win-x64.exe
Token: SeCreatePermanentPrivilege	2928	windowsdesktop-runtime-9.0.21-win-x64.exe
Token: SeBackupPrivilege	2928	windowsdesktop-runtime-9.0.21-win-x64.exe
Token: SeRestorePrivilege	2928	windowsdesktop-runtime-9.0.21-win-x64.exe
Token: SeShutdownPrivilege	2928	windowsdesktop-runtime-9.0.21-win-x64.exe
Token: SeDebugPrivilege	2928	windowsdesktop-runtime-9.0.21-win-x64.exe
Token: SeAuditPrivilege	2928	windowsdesktop-runtime-9.0.21-win-x64.exe
Token: SeSystemEnvironmentPrivilege	2928	windowsdesktop-runtime-9.0.21-win-x64.exe
Token: SeChangeNotifyPrivilege	2928	windowsdesktop-runtime-9.0.21-win-x64.exe
Token: SeRemoteShutdownPrivilege	2928	windowsdesktop-runtime-9.0.21-win-x64.exe
Token: SeUndockPrivilege	2928	windowsdesktop-runtime-9.0.21-win-x64.exe
Token: SeSyncAgentPrivilege	2928	windowsdesktop-runtime-9.0.21-win-x64.exe
Token: SeEnableDelegationPrivilege	2928	windowsdesktop-runtime-9.0.21-win-x64.exe
Token: SeManageVolumePrivilege	2928	windowsdesktop-runtime-9.0.21-win-x64.exe
Token: SeImpersonatePrivilege	2928	windowsdesktop-runtime-9.0.21-win-x64.exe
Token: SeCreateGlobalPrivilege	2928	windowsdesktop-runtime-9.0.21-win-x64.exe
Token: SeRestorePrivilege	2856	msiexec.exe
Token: SeTakeOwnershipPrivilege	2856	msiexec.exe
Token: SeRestorePrivilege	2856	msiexec.exe
Token: SeTakeOwnershipPrivilege	2856	msiexec.exe
Token: SeRestorePrivilege	2856	msiexec.exe
Token: SeTakeOwnershipPrivilege	2856	msiexec.exe
Token: SeRestorePrivilege	2856	msiexec.exe
Token: SeTakeOwnershipPrivilege	2856	msiexec.exe
Token: SeRestorePrivilege	2856	msiexec.exe
Token: SeTakeOwnershipPrivilege	2856	msiexec.exe
Token: SeRestorePrivilege	2856	msiexec.exe
Token: SeTakeOwnershipPrivilege	2856	msiexec.exe
Token: SeRestorePrivilege	2856	msiexec.exe
Token: SeTakeOwnershipPrivilege	2856	msiexec.exe
Token: SeRestorePrivilege	2856	msiexec.exe
Token: SeTakeOwnershipPrivilege	2856	msiexec.exe
Token: SeRestorePrivilege	2856	msiexec.exe
Token: SeTakeOwnershipPrivilege	2856	msiexec.exe
Token: SeRestorePrivilege	2856	msiexec.exe
Token: SeTakeOwnershipPrivilege	2856	msiexec.exe
Token: SeRestorePrivilege	2856	msiexec.exe
Token: SeTakeOwnershipPrivilege	2856	msiexec.exe
Token: SeRestorePrivilege	2856	msiexec.exe
Token: SeTakeOwnershipPrivilege	2856	msiexec.exe
Token: SeRestorePrivilege	2856	msiexec.exe
Token: SeTakeOwnershipPrivilege	2856	msiexec.exe
Token: SeRestorePrivilege	2856	msiexec.exe
Token: SeTakeOwnershipPrivilege	2856	msiexec.exe
Token: SeRestorePrivilege	2856	msiexec.exe
Token: SeTakeOwnershipPrivilege	2856	msiexec.exe
Token: SeRestorePrivilege	2856	msiexec.exe
Token: SeTakeOwnershipPrivilege	2856	msiexec.exe

Suspicious use of FindShellTrayWindow 15 IoCs

pid	Process
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe
2660	windowsdesktop-runtime-9.0.21-win-x64.exe
2976	msedge.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
2976	msedge.exe
2976	msedge.exe

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 3568 wrote to memory of 2976	3568	NL-X.exe	82
PID 2976 wrote to memory of 3852	2976	msedge.exe	83
PID 2976 wrote to memory of 3608	2976	msedge.exe	84
PID 2976 wrote to memory of 1960	2976	msedge.exe	85
PID 2976 wrote to memory of 1960	2976	msedge.exe	85
PID 2976 wrote to memory of 1960	2976	msedge.exe	85
PID 2976 wrote to memory of 5828	2976	msedge.exe	86
PID 2976 wrote to memory of 5828	2976	msedge.exe	86
PID 2976 wrote to memory of 5792	2976	msedge.exe	89
PID 2976 wrote to memory of 5792	2976	msedge.exe	89
PID 2976 wrote to memory of 5792	2976	msedge.exe	89
PID 2976 wrote to memory of 4072	2976	msedge.exe	88
PID 2976 wrote to memory of 4072	2976	msedge.exe	88
PID 2976 wrote to memory of 4072	2976	msedge.exe	88
PID 2976 wrote to memory of 1484	2976	msedge.exe	91
PID 2976 wrote to memory of 1484	2976	msedge.exe	91
PID 2976 wrote to memory of 1484	2976	msedge.exe	91
PID 2976 wrote to memory of 1112	2976	msedge.exe	92
PID 2976 wrote to memory of 1112	2976	msedge.exe	92
PID 2976 wrote to memory of 5324	2976	msedge.exe	93
PID 2976 wrote to memory of 5324	2976	msedge.exe	93
PID 2976 wrote to memory of 5324	2976	msedge.exe	93
PID 2976 wrote to memory of 3420	2976	msedge.exe	94
PID 2976 wrote to memory of 4660	2976	msedge.exe	95
PID 2976 wrote to memory of 3420	2976	msedge.exe	94
PID 2976 wrote to memory of 4660	2976	msedge.exe	95
PID 2976 wrote to memory of 2504	2976	msedge.exe	96
PID 2976 wrote to memory of 1776	2976	msedge.exe	98
PID 2976 wrote to memory of 2076	2976	msedge.exe	99
PID 2504 wrote to memory of 1676	2504	msedge.exe	100
PID 2976 wrote to memory of 2068	2976	msedge.exe	103
PID 2976 wrote to memory of 2068	2976	msedge.exe	103
PID 2976 wrote to memory of 2068	2976	msedge.exe	103
PID 2976 wrote to memory of 4060	2976	msedge.exe	104
PID 4060 wrote to memory of 2660	4060	windowsdesktop-runtime-9.0.21-win-x64.exe	105
PID 2660 wrote to memory of 2928	2660	windowsdesktop-runtime-9.0.21-win-x64.exe	106
PID 4892 wrote to memory of 4668	4892	windowsdesktop-runtime-9.0.21-win-x64.exe	110
PID 4668 wrote to memory of 2640	4668	windowsdesktop-runtime-9.0.21-win-x64.exe	111
PID 2976 wrote to memory of 5468	2976	msedge.exe	112
PID 2976 wrote to memory of 3160	2976	msedge.exe	113
PID 2976 wrote to memory of 1168	2976	msedge.exe	114
PID 2976 wrote to memory of 4520	2976	msedge.exe	115
PID 2976 wrote to memory of 4520	2976	msedge.exe	115
PID 2856 wrote to memory of 4516	2856	msiexec.exe	116
PID 2976 wrote to memory of 3264	2976	msedge.exe	118
PID 2976 wrote to memory of 3264	2976	msedge.exe	118
PID 2856 wrote to memory of 2496	2856	msiexec.exe	119
PID 2856 wrote to memory of 2100	2856	msiexec.exe	120
PID 2856 wrote to memory of 5892	2856	msiexec.exe	121
PID 2976 wrote to memory of 4888	2976	msedge.exe	125
PID 2976 wrote to memory of 4888	2976	msedge.exe	125
PID 2976 wrote to memory of 852	2976	msedge.exe	128
PID 852 wrote to memory of 5144	852	msedge.exe	129
PID 852 wrote to memory of 2356	852	msedge.exe	130
PID 852 wrote to memory of 3328	852	msedge.exe	131
PID 852 wrote to memory of 2356	852	msedge.exe	130
PID 852 wrote to memory of 2356	852	msedge.exe	130
PID 852 wrote to memory of 5896	852	msedge.exe	132
PID 852 wrote to memory of 5896	852	msedge.exe	132
PID 852 wrote to memory of 5576	852	msedge.exe	135

C:\Users\Admin\AppData\Local\Temp\NL-X.exe
"C:\Users\Admin\AppData\Local\Temp\NL-X.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.NETCore.App&framework_version=9.0.0&arch=x64&rid=win-x64&os=win10&gui=true
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2e0,0x2bc,0x7ff814b7c188,0x7ff814b7c194,0x7ff814b7c1a0
    3⤵
    PID:3852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1840,i,3947636554897761157,4636566825002990382,524288 --field-trial-handle=2572,i,9873474632129621387,11740306068910454957,262144 --variations-seed-version --mojo-platform-channel-handle=2600 /prefetch:11
    3⤵
    - Downloads MZ/PE file
    - System Time Discovery
    PID:3608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1644,i,1777327525289974612,15689717724622697287,262144 --field-trial-handle=2572,i,9873474632129621387,11740306068910454957,262144 --variations-seed-version --mojo-platform-channel-handle=2568 /prefetch:2
    3⤵
    PID:1960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2264,i,8013774597865665666,14637420763456082128,524288 --field-trial-handle=2572,i,9873474632129621387,11740306068910454957,262144 --variations-seed-version --mojo-platform-channel-handle=3024 /prefetch:13
    3⤵
    PID:5828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,17558666208147879617,11115291954021242784,2097152 --field-trial-handle=2572,i,9873474632129621387,11740306068910454957,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
    3⤵
    PID:4072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,2506094623284383168,2622475958447216746,2097152 --field-trial-handle=2572,i,9873474632129621387,11740306068910454957,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
    3⤵
    PID:5792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4968,i,8510265193051820337,16747073852598363652,2097152 --field-trial-handle=2572,i,9873474632129621387,11740306068910454957,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:1
    3⤵
    PID:1484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5184,i,13047589755671991212,17994336426310987325,524288 --field-trial-handle=2572,i,9873474632129621387,11740306068910454957,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:14
    3⤵
    PID:1112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5232,i,17040030087857332810,6336068090142294602,2097152 --field-trial-handle=2572,i,9873474632129621387,11740306068910454957,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:1
    3⤵
    PID:5324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5700,i,279282558454211550,15920425935126608121,524288 --field-trial-handle=2572,i,9873474632129621387,11740306068910454957,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:14
    3⤵
    PID:3420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5704,i,3491849043378241655,3171852741679184646,524288 --field-trial-handle=2572,i,9873474632129621387,11740306068910454957,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:14
    3⤵
    PID:4660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6548,i,15681475292684760420,6986260384534622305,524288 --field-trial-handle=2572,i,9873474632129621387,11740306068910454957,262144 --variations-seed-version --mojo-platform-channel-handle=6744 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1132
      4⤵
      PID:1676
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6568,i,3820959582730607881,7293144544546721394,524288 --field-trial-handle=2572,i,9873474632129621387,11740306068910454957,262144 --variations-seed-version --mojo-platform-channel-handle=6876 /prefetch:14
    3⤵
    PID:5924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,17707794150243316521,1682436676343562683,524288 --field-trial-handle=2572,i,9873474632129621387,11740306068910454957,262144 --variations-seed-version --mojo-platform-channel-handle=6908 /prefetch:14
    3⤵
    - Subvert Trust Controls: Mark-of-the-Web Bypass
    - NTFS ADS
    PID:1776
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6568,i,3820959582730607881,7293144544546721394,524288 --field-trial-handle=2572,i,9873474632129621387,11740306068910454957,262144 --variations-seed-version --mojo-platform-channel-handle=6876 /prefetch:14
    3⤵
    PID:2076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4984,i,4701146851095510858,15350907766393280875,2097152 --field-trial-handle=2572,i,9873474632129621387,11740306068910454957,262144 --variations-seed-version --mojo-platform-channel-handle=6732 /prefetch:1
    3⤵
    PID:2068
- - C:\Users\Admin\Downloads\windowsdesktop-runtime-9.0.21-win-x64.exe
    "C:\Users\Admin\Downloads\windowsdesktop-runtime-9.0.21-win-x64.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4060
  - - C:\Windows\Temp\{FCA8039F-2CA8-4194-A4FB-F8A9123A6264}\.cr\windowsdesktop-runtime-9.0.21-win-x64.exe
      "C:\Windows\Temp\{FCA8039F-2CA8-4194-A4FB-F8A9123A6264}\.cr\windowsdesktop-runtime-9.0.21-win-x64.exe" -burn.clean.room="C:\Users\Admin\Downloads\windowsdesktop-runtime-9.0.21-win-x64.exe" -burn.filehandle.attached=580 -burn.filehandle.self=728
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:2660
    - - C:\Windows\Temp\{3ED746F2-050E-4357-8A45-22274AB35B8E}\.be\windowsdesktop-runtime-9.0.21-win-x64.exe
        
        "C:\Windows\Temp\{3ED746F2-050E-4357-8A45-22274AB35B8E}\.be\windowsdesktop-runtime-9.0.21-win-x64.exe" -q -burn.elevated BurnPipe.{27F0F112-DEA7-4761-ABAB-5AA84CD906AD} {E50E7CBD-5425-4D4C-A598-CAEA4C4BA8E2} 2660
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:2928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6892,i,1254455931679479476,14774005531032323097,524288 --field-trial-handle=2572,i,9873474632129621387,11740306068910454957,262144 --variations-seed-version --mojo-platform-channel-handle=6840 /prefetch:14
    3⤵
    PID:5468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6836,i,17973211841555530198,5331652008848549946,524288 --field-trial-handle=2572,i,9873474632129621387,11740306068910454957,262144 --variations-seed-version --mojo-platform-channel-handle=7816 /prefetch:14
    3⤵
    PID:3160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6860,i,8500585944264653002,6063801097206296281,524288 --field-trial-handle=2572,i,9873474632129621387,11740306068910454957,262144 --variations-seed-version --mojo-platform-channel-handle=6936 /prefetch:14
    3⤵
    PID:1168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6876,i,12436914184551894381,7492574016959404559,524288 --field-trial-handle=2572,i,9873474632129621387,11740306068910454957,262144 --variations-seed-version --mojo-platform-channel-handle=1248 /prefetch:14
    3⤵
    PID:4520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7880,i,10057936586600267530,9740056063631838543,524288 --field-trial-handle=2572,i,9873474632129621387,11740306068910454957,262144 --variations-seed-version --mojo-platform-channel-handle=7884 /prefetch:14
    3⤵
    PID:3264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5384,i,2757016513809677895,9418424579760846542,524288 --field-trial-handle=2572,i,9873474632129621387,11740306068910454957,262144 --variations-seed-version --mojo-platform-channel-handle=2792 /prefetch:14
    3⤵
    PID:4888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x264,0x7ff814b7c188,0x7ff814b7c194,0x7ff814b7c1a0
      4⤵
      PID:5144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1556,i,9468790042237491060,4932592774152432299,262144 --field-trial-handle=2180,i,9129147148007493013,16051356203410502122,262144 --variations-seed-version --mojo-platform-channel-handle=2176 /prefetch:2
      4⤵
      PID:2356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1820,i,16257750681180457328,2079274342163463533,524288 --field-trial-handle=2180,i,9129147148007493013,16051356203410502122,262144 --variations-seed-version --mojo-platform-channel-handle=2208 /prefetch:11
      4⤵
      System Time Discovery
      PID:3328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2364,i,17431687122455578758,17003550550465224584,524288 --field-trial-handle=2180,i,9129147148007493013,16051356203410502122,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:13
      4⤵
      PID:5896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4420,i,12991458245671004911,4588246351803070263,524288 --field-trial-handle=2180,i,9129147148007493013,16051356203410502122,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:14
      4⤵
      PID:2368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4420,i,12991458245671004911,4588246351803070263,524288 --field-trial-handle=2180,i,9129147148007493013,16051356203410502122,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:14
      4⤵
      PID:5576

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2220

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:964

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2856
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 5D8786BED69A75796E56A5DB1132239E
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4516
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding F11A9B6C7CC94E2AD8279F141B665444
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2496
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 5119E37A849AA7C92C798115B1BE6CA6
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2100
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 3106D38BBC067960886F36B9BBC78132
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5892

C:\ProgramData\Package Cache\{9ebd7727-8105-47ca-8e74-76305a8bb1a1}\windowsdesktop-runtime-9.0.21-win-x64.exe
"C:\ProgramData\Package Cache\{9ebd7727-8105-47ca-8e74-76305a8bb1a1}\windowsdesktop-runtime-9.0.21-win-x64.exe" /burn.runonce
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4892
- C:\ProgramData\Package Cache\{9ebd7727-8105-47ca-8e74-76305a8bb1a1}\windowsdesktop-runtime-9.0.21-win-x64.exe
  "C:\ProgramData\Package Cache\{9ebd7727-8105-47ca-8e74-76305a8bb1a1}\windowsdesktop-runtime-9.0.21-win-x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_9.0.21_(x64)_20261024161033.log"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4668
- - C:\ProgramData\Package Cache\{9ebd7727-8105-47ca-8e74-76305a8bb1a1}\windowsdesktop-runtime-9.0.21-win-x64.exe
    "C:\ProgramData\Package Cache\{9ebd7727-8105-47ca-8e74-76305a8bb1a1}\windowsdesktop-runtime-9.0.21-win-x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{9ebd7727-8105-47ca-8e74-76305a8bb1a1}\windowsdesktop-runtime-9.0.21-win-x64.exe" -burn.filehandle.attached=548 -burn.filehandle.self=564 /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_9.0.21_(x64)_20261024161033.log"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2640

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4964

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4972

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e58d698.rbs

Path C:\Config.Msi\e58d698.rbs
Size 48KB
SHA256 d32b33e59ea0a5952096290c250cdfca2e17ab2ef9b378ecc839c994bf78b8d3
MD5 fcb08b9a12b24d737918c3cd61fdd690
SHA1 baca264eb4790b94db8d2f4d0c80f4207998cc1c
SHA512 7266570b89026bfd60afeaea5da109b22dcea750b356da2d71812603f279b00347d2d2f2aefb90fa5e307cbe92e7eb9bf2494d85255260db1b3d4461ed3a9a61
SSDEEP 1536:0pxQLbwujHP08tjOf9bLmrJyPoXe3tiMpYamO77jaLkbIqDC+/Rqd72l5ON4IeiJ:PNdZcW
TLSH
T1B7232078EF40D1E3F53638685B25DE04270A4FD9D7086DAD17CEC13A88D6AAC2E785D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58d69d.rbs

Path C:\Config.Msi\e58d69d.rbs
Size 9KB
SHA256 8759488156af976de810dc7fbcd7ada4ff4b3eb84791fd678e088eb3ada4ef54
MD5 c42fd2f26b33f74bc15d4650424b7c7b
SHA1 4f175be85a78d55301e18d23aff7c851197531ed
SHA512 ee75f6f691b531b390e46a3d18637d4b7f3bd378d86381e48291e3ea176125c7710542e5b4894bc028716d6134558302bba05892b407a1a6908359ee83075656
SSDEEP 96:VmecRfLHrlWuPCvGA1UYeD2RBfCsTlJUYeD2RBfC6j2JDYaTlPYOKE5g7S/52GWG:4hTLhCDOABqI8ABq3wEEqNUN4ph
TLSH
T1CE120201BA1082D2E9A67B75CB07176077B3D3D68740A34F15CEA6285F1BBC89F5C1DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58d6a2.rbs

Path C:\Config.Msi\e58d6a2.rbs
Size 10KB
SHA256 02ba1002f149811353c9848084fd04c4b086619fdc5b6ec26737ee904bc2dfb5
MD5 8e7d3ae43032862d3c26af2703717a62
SHA1 fb34586930086175b81a5c8e0584325512d9341e
SHA512 13910e5cfd75209f459465aecf2f99f64cce85b10203de65799b82b53ba337a226012e1e9211be42565f0b700bf6fd9e1bc1a934b5d735d9237d27bce1f4a82f
SSDEEP 192:4bHhIsA5H7bt9CROpcBqI7pcBqCEEH60F4pT:4bHhIsA5HvbpcB5pcBLE
TLSH
T17F224182A64492D3E8A3073CCB075B257BFBD3D9CB54528F09DE91748E0B7C81E9439A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58d6a9.rbs

Path C:\Config.Msi\e58d6a9.rbs
Size 88KB
SHA256 378d953b1de02bbe9ecb931750e445d0063c5f529451d015718844b08138a13b
MD5 1214508ae8b385a8548bea6869a9151a
SHA1 e7ac9b11f7fdde5c032c4980fb1dccedf8b8cdae
SHA512 05da538a905e0efd2807707e24d6585470f5276fa0e9da31e6e5a4d3061baec3e99ae8f6ffc928d8ecdb503dfe30d3bed941e1435774bf5643ca2c41d360f620
SSDEEP 1536:BU0lEjS1nmFV3qM4Qbz0lkucOZ2UR7FnXkJTEUmqK0bme/1MeM5MaajWgCRnP0NO:ar+9ksErkvkeDnpEUiqf34xe
TLSH
T15C93E47D9B11C385EC332A48433FEE489E064E6B6745997E03C7812AEAD7E971B784C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ThirdPartyNotices.txt

Path C:\Program Files\dotnet\ThirdPartyNotices.txt
Size 77KB
SHA256 e8ddd95ac905467e4e519b446ca023fa00c31732bebd9b66e65101c712092ee7
MD5 406d07d20e58568365df0557629fadc6
SHA1 9ab5ba1ef3866afa75b8cf3c392b7dd3d7f52026
SHA512 c6025a947faa5dc2b41a14d75e228ca2bd0df094e8cef914c58a6d2f5854424972a647b2c8ca8173345e40ba7557843d03efa85c5098c6e0e6726377efc8a38f
SSDEEP 1536:HA9jHwsGfgg39/zwgAVkguQxrDjugtSEGepkWvrpX7anuqdLSVnfiStPq+3Lefrb:HA97w/ogz1AVxuMjHtSFULryLOgrGWwa
TLSH
T1F573A45F7E45077319E2C3916569A8C5F22FA02E3B6B2A44346EF248133B42DD6FF858
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 157KB
SHA256 b2162687fe15c4d5b749b1471555f7eb772b57e9a47f85914b355c962194c163
MD5 a38036234f6ccf2a1dd5ce3a6947a029
SHA1 d596349ba4d1e0e85c71bd2d25fca728b52cb1c4
SHA512 7cb89222d1b2fed053f3915c25a96b77614dec83301515880e60cbe45da1a70d19dfc86625788551c668af1bb1f1998f5e3eff3d28ec5687f73ab6c95de31ae4
SSDEEP 3072:jObbfvCnbu6mG/0j0Rhn2p/czEcN7K99wmv60:K/Cnbu6mG/aIhZ4WAHvt
TLSH
T15AF3061AD65811AAD1AE9571C7418A41FB337C6687E0E7CB13D0F9BE0F326906EE9703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet-hostfxr-9.0.21-win-x64.msi

Path C:\ProgramData\Package Cache\{9F01D8AF-A856-4A52-AED9-E9816487B435}v72.84.61380\dotnet-hostfxr-9.0.21-win-x64.msi
Size 776KB
SHA256 b129b76cf90e4a050b7a4544b9de929b36e1ecffc1d5502804850cbb23f939a2
MD5 a8833567c16fb213ab903bdc5892c188
SHA1 ac1011511067ec6fcc53d228112d05ffa1d72d4e
SHA512 0ec473e0fe8fa1667e828ce8a18d74a665e505238248784201103c08f67bdd6a7a198b6ce3654fcbf73b32858deea0b8cc33f0db5e5aba041adda68ae90d3c98
SSDEEP 12288:ZVE/EQZoZCNV1EgXmEI3os2Qx7E4D4Rxbp4K+1uiq:4R1NXdc3/7Rin+s
TLSH
T17AF4AE137D80803AD9BA0D719539D7B16F3DBE204A64889B6380B91DDDF15C0AF36BE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

state.rsm

Path C:\ProgramData\Package Cache\{9ebd7727-8105-47ca-8e74-76305a8bb1a1}\state.rsm
Size 932B
SHA256 9378f76ccbd900f22ce132122d903db43a21b6583fc2e5440faf7b0c7d0b5b84
MD5 8a6dd5db5fa6af0e94f49f7514c98ea1
SHA1 624ca2e2c04ea470f6931300fd2032bca6bb8325
SHA512 8dfb6cecbfc7c2bf0422d101136dea0c219e5f444ef114ed28a7efecb587a8209e296b61dad1805e7c54cbbaa3f6518c8ee744a6a0c7954a1df2161d1a659e18
TLSH
T18E1194A15FFA022AE3FAAB3069F42711643AB8120E32C16C0041318A8F31BA0C870F77
MD5 SHA1 SHA512 TLSH

Submit Download

0c94a1b8-ca8e-493a-9884-d1a6342d2198.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0c94a1b8-ca8e-493a-9884-d1a6342d2198.tmp
Size 25KB
SHA256 82d2037b649ad56a2e01177828e112fcbe0e0aafb7133bfa37705f814cf0dbab
MD5 233d1ef9812aa35bfa4e4cd1009b5a8e
SHA1 57f8b8890433ff5439aad4e55be94df1b66f3bed
SHA512 cec0fdd311748368f113761446b3cd4730828787979cffda78fdbb6181d5238e4f13d0887f77f2337fe9eceb3909d4c26cbbb7833caf1e80cb490f6b5fdac109
SSDEEP 384:n5iFiZcI638Nd8TUNTUlIxBCC7JfDcxzyfoBjT+Cyl9kn6V/7Qesa+VYTQgL/7Ig:QFQ63+wgCCxDWdBGzW6V/MehgB8
TLSH
T176C24A35EC94C9BBECEA8FD9AB4A7A03DEF40163959CAAC4D9D45D1D109718D0307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

207bd7f5-bcf1-4f85-8309-fa5ad74e0dbf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\207bd7f5-bcf1-4f85-8309-fa5ad74e0dbf.tmp
Size 32KB
SHA256 2492be0c598d2e6753d0c525edf2f538a19f1eded0657e64781b55eb095c178c
MD5 7e83f04f9665e5369f24ec2d27184eb1
SHA1 47a6c0379692ec27e73fbf5de5170f36b5995e05
SHA512 c2e8848c8d79e6d4f593bf5a95b9a571383634ea140bddfac5231aac00a6ce0b3c734c9d3d85480b3f933aa67aeec7c28014f61ac8b2501c01d490057b79564f
SSDEEP 768:QFRogwgqCI6dBGzW6V/Usu5SrC+owUEr5RLu:wo/C56VMGZo1ErLa
TLSH
T1B9E21871D895CDE798EAD9D5A64AF642ADE00133C98C8A8CE6F47D3C208F1FD174B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

58a9b2f4-0d9c-4fc4-bc63-79c18a30c4f2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\58a9b2f4-0d9c-4fc4-bc63-79c18a30c4f2.tmp
Size 27KB
SHA256 aeabc2b8dbf47269e769953aa5fd4b5de7775ff345c18790be6d7c40812f689c
MD5 70ca260d52c81b0d88f33851b31ea2bc
SHA1 06104dac2199b8aae85d301a6caf2829fc9a82d9
SHA512 2a7f483062526801adafeb43f4023d6493ffb454ada7dfabdf7263fb5edd2ba0f725ce8ed14d5842b2e6911a7b28981b2fb859de9009be3a56a624283dfe84f8
SSDEEP 384:n1iFjQkUSvM38Nz8TUNTUlIRlDCC76JFuxzyfoBjT+Cyl9kn6V/fMHvv2IZrgL/F:8FNM3gwgqC66dBGzW6V/UPv5RLu
TLSH
T19FC24A35EC95DEBBEDEA8E99A34E7A43EEE01153D99C9AC4DAC41D1C00871CD134BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

71937a16-8748-455f-8e92-250e8dc0b007.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\71937a16-8748-455f-8e92-250e8dc0b007.tmp
Size 27KB
SHA256 1139afc0ff7f1acb9f19d69ab9e4f2d48eb002a3c7d81d712b85c69522ffc92e
MD5 98c5c5e50d2e2a87534a75af740bc632
SHA1 4e4fa0c8586e1ef8fc876c5eb902bbd939d6b11c
SHA512 e50c783e0e49edecfd1684cb4bb958019a094c3cfa264b4ba7935ba15f0fc1a71d6ce1e90b62f6cc953a6be7a59708116652b539db780dcd1bd62f6d081f05c0
SSDEEP 384:n1iF/QkUSvg38Nz8TUNTUlIRlDCC78JFuxzyfoBjT+Cyl9kn6V/fMEvv2IZrgL/F:8FBg3gwgqCo6dBGzW6V/U6v5RLu
TLSH
T1A1C23935EC95DEBBEDEA8E99A34E7A43EEE00153D99C9AC4DAC41D1C00871CD134BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

71c52bc4-2cdc-4bf3-9233-aa665c6febd8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\71c52bc4-2cdc-4bf3-9233-aa665c6febd8.tmp
Size 27KB
SHA256 dff9dbd44c692f2d2f3ea803a360a6d1c887b8d682e9beb113a183063bb51701
MD5 18d7b5c32d6fb8a68035e5a09f9df540
SHA1 320e37891128e89668f4d1478d6854649392259d
SHA512 bfa02406ddabc2aaa9b52acae8f5f5d9865ca37f93f48a7084f0067662214ded3f906002e318ae3fd443182768ebb106963b7ec58ba8b5a9192de208894d6428
SSDEEP 384:n5iFzQkUSvP38Nz8TUNTUlIRBDCC73JFuxzyfoBjT+Cyl9kn6V/fMHvv2IZrgL/F:QFdP3gwgqC96dBGzW6V/UPv5RLu
TLSH
T145C24A35EC95DEBBEDEA4E99A34E7A43EEE00163D99C9AC4DAC41D1C00871CD134BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

888d215c-e641-44b1-bcc1-560ec55c3cd2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\888d215c-e641-44b1-bcc1-560ec55c3cd2.tmp
Size 26KB
SHA256 9b5f627d998cd94baa236aaf255f8eefb7e0521b0e6daf64a6f66a03c046e932
MD5 0a50ae340d5e42bc7483a9101be6ef28
SHA1 347e7780ca1186ca615ea3de7ea2405fac031da5
SHA512 8a456afe5b4ef9a24f5b6da39d192db967452ff86ad9a416e0503c253c4d5c4cc933b08b48013f779d358e414221aab68dbfcacd58637db69fe085b4b8ba4615
SSDEEP 384:naiFiZcI638NX8TUNTUlIxBCC7uydxzyfoBjT+Cyl9kn6V/fMUvvsa+VYTQgL/75:RFQ63wwgCC9vdBGzW6V/UKvhgB8
TLSH
T183C25B31EC94C9BBECEA8FDAA74ABA03DEF4016395DCA5C4D9D85D1D109719D030BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 00fd53d4e341ca585361bfbe699a2c8a3fdbc255133db935051b0958a30a7abf
MD5 e720824e80db33ac2843bf1ebb30faec
SHA1 f511d38f1de46ab026d3c6963050a3f1f512b92d
SHA512 09eb559f6018245581b30678d5f9952fcadb0adcee197127c7448f39c53ff841dddd8b077678d837d33d8e01126c7d80b7ec77764938cb5368f955ce628ed81c
TLSH
T1E3D02B5CEFD99290D436343A4035428531CFA904D1035200E090010319811410061865
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9a3eec5a56d1c0eacd8e7d32039bb5fe310bf1d944a0bb159df141fd0ee5dd76
MD5 19b4be0e84d087141f64a0de5e56e9fd
SHA1 1b81271e5dfc6def42722382a5e423492cbc7180
SHA512 edc3aea46b547f18db8e9ecf310123ae7534849c280e8f10c0f55dd9b6940a7e4b46e3a2f3bdddc9dcc10e5909ab81ab8d0240ea0bed70df2cb064907dfd7a1a
TLSH
T151D080157A673AD8D27E7176456489C02545DF53D25302406B074C175AA044118E1FDD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3612a2a029390242707be2995ae585e1d55aaa34973fa49bc2d56dd91eb9fb49
MD5 380f979e012339fda3049b97ad844ef7
SHA1 b847df9d2173555461fed2e4b3a02296654bac05
SHA512 1b9a2ed8361b16bfa76da91d8640af6240112d4247ebb7e0b09fa3e46a6be8e7f4030e33a4139f5a4b93338bb250d93e3a208edc5deca30d463b4dfe756de6f2
TLSH
T1DBD0C03D735B390CCF7F30335554C6C02102DF07C103431036030822558001409508DD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 fdc466e3c37a3b9c01ee08da8a5eccdceedfb46c4333f8568c1e242da2416575
MD5 731eab847a87a8dd2c87b2c770a59efa
SHA1 bed65dce50900be286c83c98f6e6608795d68043
SHA512 f3a58fa70556537c3aac6b3c60492dafdf364ccfd3e8f13f4f9d51093a7031f7fff918f553662bbc8e1cf0f65042de4676be4dc8bc61dd887083d39e8967adc6
TLSH
T182D0C03973573A0CCF6F30335594C6C02102DF07C103431036030822758003409508DD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ef8e0a91cc3656fe639527b7c461215de3584a9b32168d8efc58c800c3fcf45a
MD5 7611be076e62556d26aa1ad65d6c21ee
SHA1 3b62033283275e165c1cdb998b2b174841695892
SHA512 949a38fce52f98059e4356f1465fa0cb57397b5b5a79c468fea50c81a884f46ee37ab38ecf492df88f7280e9e041eedad365f8eab019be95f1d7b37d95794929
TLSH
T110D02B58EFD58290D432343A4075428532CFA504D1035200E0D0011319C11410061865
MD5 SHA1 SHA512 TLSH

Submit Download

0dfdd6ed-428c-4858-96a7-95f65cf2bb2c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0dfdd6ed-428c-4858-96a7-95f65cf2bb2c.tmp
Size 12KB
SHA256 c1d1a74da6884018445ee9635257950bf85139ffbb89a073e930795c7f8fdb6c
MD5 4cbd06096fbc348079e5b5f24e404c77
SHA1 ab1751d581d92594b358b4730938dabc7f7eb854
SHA512 ff27223dc6b87f7b52aa55ca513b44d5b733d95effd35f9ab7d33fd2085c6117fb5917734e74183ede4906d5e4a007e1a4d371f8df329a4f60d8e4d03f0a4d33
SSDEEP 192:sxZpwRHl7/fosgI1ZqMqO+/IXzodp5z/W6+WNry/XY0gJwZV2uROxIg5vWJ:sxZGj7/fosN7q++/Tt/bgX5Aa24sBi
TLSH
T1A552C605AD28AD3B8CC7E219FB497F53E6FD103291915E48AAFC8A1C15EB6DD220741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

24ac9b8c-24be-4c89-9d13-37a062ed3850.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\24ac9b8c-24be-4c89-9d13-37a062ed3850.tmp
Size 13KB
SHA256 33d57c7125c27c354f2c1b21f3d47cc8c2c513005ae82b405280a8d0fda8d865
MD5 684a57939d610d7d2b2e247032cf38ae
SHA1 6808c8c82d739380575e9a088c70f2678dee57d6
SHA512 b7ca989f7500ecd4f367106d394b2adda338f12893a9ef36fd58c2c61de5201abce5c97c975f02bf1008cc4386501cc2ffbee98847b2a0bbb51ea883bfe1e5eb
SSDEEP 192:sxZpwRHl7/fosoI1ZqMqO+/IXzodp5z/W6+WNry/XY0gJheV2uROxIg5B4NlJ:sxZGj7/fosl7q++/Tt/bgX5AM24s0NP
TLSH
T14152E755AD24AD3B8CC7E219FB597F53E6FD203250811E88AAFC8A1C15EB6DD220741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

76f41106-4176-444f-8998-dadda4e1be00.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\76f41106-4176-444f-8998-dadda4e1be00.tmp
Size 414B
SHA256 9928ade21c7bde22c03e82e5d0abc9a6f5e1ee5ef3c5283f28576bebe4eaa130
MD5 fd77d1c11f240006784f549f8e2c34bd
SHA1 0bbb1a8d5696337c3b7081c45f847205cc3a1be3
SHA512 2d1ddd7fba9773f88da08885f7ca3bf65ccd89c97fd9f03c9f5163bd39c98c217e9057d7f6850c075c59159ce5279e75245dcfe482496aebc78061f251d298c3
TLSH
T1D2E02BA9C826FC3B18FD072D61645B8AEA5413972E50841F3F3CC1088FB063A41C9D5C
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 6c9549af4d431105d172be9a7f0d5b686185b41a199781e130aa0dcefe3a48d6
MD5 9f650ece680a524860ada172e716433c
SHA1 6bf98d64cbc11df7d9f7418dc2df2594599e1d97
SHA512 742bc6927f06a72e48b08740235197f5c4c1f824dbc5e98d122efe5e754c70a556907fd03128447e8a858a67c66564cb77131df12fbf702b959b77c1c5df1534
TLSH
T13E71E98396BB41E4DBBA447CD5E11B8B3FBC0BAC38832F5E0494D53A6C063C952B5470
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 c1f79e45534a31a90d0356c9983de3656027f5f94ff8a198018040e5f35fc8ce
MD5 dc47581fbc2c4b92270bdfecd7614d51
SHA1 5530e7886d98aa08d8737a270d628520391905e2
SHA512 05acaacb0be7acae514ab2499aea8b3af66f157a775efa128e05555361a6631b3d69b9d2c1dc906165969e904d07349fdfcf3c5cc3b214dbb18306d2c5faa660
TLSH
T1FB614F83557B40D0DBBA847CE5E11B873FBC0BA834432F5F0098D57A6D063D91175070
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 9e82d65a07361263a8469ca4266342af20dbad375ea41937674efaa7698bca71
MD5 cc474e4c36a5f99a98e5d61f2c1f5b91
SHA1 dcd7cc7ac893a0b57838e016e97deef981704fac
SHA512 fa111a67cba370790d52415917207a94848bd5d05ec8b22ebb77d7c6f6ec6e10ceb5325e6b1a7f2afe7f950f2859056e88adccd5c60b12c5920c589f22f13eaf
SSDEEP 3:MsEllllkEthXllkl2zE/lPQt:/M/xT02zuQ
TLSH
T1424404047FF10C47C501113040D1C3501370DC10071757433C530C375CCDF510D40000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

75d415dc-2c83-4a64-857e-bf226be2c4af.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\75d415dc-2c83-4a64-857e-bf226be2c4af.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.111.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

33ce224d-7196-4bef-90f3-9da71184e84a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\33ce224d-7196-4bef-90f3-9da71184e84a.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

f05c4210-eb3d-4666-b2ef-58038e49353e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\f05c4210-eb3d-4666-b2ef-58038e49353e.tmp
Size 3KB
SHA256 5fd489c029ef38c0ffe086841d26bd257452a71c81bc43c47e7e6ca6e27c7335
MD5 22a32391bf55648858a1fc8fc967d054
SHA1 dc5e98913069144545d22177909f087103327291
SHA512 5038fba4690e37f53dec05d3d98e7bf2129e10f893087e4c6940c5a99ef45689a8d03427a6098509e457717db5b383be1c1ad510a45e56c4946b28fa7c880c67
TLSH
T17F617CF787B4856E8A0196F09A18EE2FDF2D0615431C7C6989D4EE27D7E3472E00269F
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 5de6145e4c19a91c1079ac376efd62e83cb61aa4b1ca2fbe13c5d269895040bc
MD5 c0ee1cdd7c197964cb9123cf80f199f0
SHA1 b5d356927cb9190235892598de63952a05b6b5eb
SHA512 6db02dbd0c893afde63d9efd998c764765e51a5e30e2acd54b97e39808f677956cc72a0442a82904fb84c9c34e2829f426ab1ee225a35b66910323fb0f603a82
SSDEEP 96:K4JaKygi+ZSKiIX6cKTKE+9eKOUV9eKukoWtGKEgrhOKKQk6QgKFKWDCK4AiyAg7:ohdNdBzXXFPXgRbKvtp0Jlzn+BRB
TLSH
T145B2595130BA12593CBE350890B5972F52823573711CE62B7FFD40A68E6BE481DFD9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a0d034cd-2948-44a5-a322-2b0ac186d7c0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a0d034cd-2948-44a5-a322-2b0ac186d7c0.tmp
Size 33KB
SHA256 6cdf4be8b73b0936d1a5e99b5a34398293e39d0d362e178748ade7d778342e45
MD5 f9022f1af6c9da63c1ccecc0afc0e24c
SHA1 42991727269e84969c6bfcacdefa099806fbbc31
SHA512 9fcda911bff868b6deeeeaa314469fc01a4db46769423a0e263bc6946a8becbdfc1247c8e5aa3d197e0c919370511a8081e906dae963256b4d98c27d1288de72
SSDEEP 768:AvmgC8Ba2P67pLuLbdtWRmpbQPL8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3XHRgLlL:AvmgC8Ba2PSEbdtWRmpbQPLu1jaKXHR0
TLSH
T1A1F20A7B680CCA7E4FC04E9DDD267F9A6DA802DBAA98CD4047F9845C02C77EE51160DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b96ccef0-22e3-4c2a-bdc8-9f816d433b2d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b96ccef0-22e3-4c2a-bdc8-9f816d433b2d.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

fbbea65a-c1ed-4351-b12a-45743f749510.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fbbea65a-c1ed-4351-b12a-45743f749510.tmp
Size 12KB
SHA256 36ae50f856ceebdc1e21e6cba7f4118d25d81a19ab6fe321c0c71605c0ef94ac
MD5 8153b388cb37c241073e94771f48c586
SHA1 59bef0909849fcfded2bc695377e9e43aa69014d
SHA512 1d9ec07bd92d023834f718b0e70a45ff5c26b7232c5c92d4117ce6113dd6ca24b9565c5cc133f234a74006cbfec1400d4cbb2af24950ec443991b03a83afee1b
SSDEEP 192:sxZpwRHl7/foskI1ZqMqO+/Ixzodp5z/W6+WNrKY/Y0gRDzuROxIgjWJ:sxZGj7/fosh7q++/jt/bh/5Uv4sji
TLSH
T1AF42D605AD28A93B9CC7E219FB097F53E7FD503291915E48AAFC8A1C11EB6DD220741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fe6053a3-e17c-45c6-8502-1ee38c676034.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fe6053a3-e17c-45c6-8502-1ee38c676034.tmp
Size 14KB
SHA256 11bd212ad8db8e627b9c82dbe4ce5431b8342120d12e6cd8cd9af7d3b0918d7f
MD5 55f88462e81397a26aeb1d0a29ef6641
SHA1 692403e37032487966d80dc473733a1ad0cd1713
SHA512 5f66a91a78221e104481cd5f0126a545b524092cd2218e91ab45d1d7539b5a8bb2a5fd6c9e6222b662bec7e73cf0822a8bc35aedd67be1a14c98724dd0765a4b
SSDEEP 384:sxZG27/fosgWv77q++/kt/b4GxZ6gQ24/2NP:s+27/fcY7efs/b4GH6l24y
TLSH
T1FE62C615AD25AD3B8CC7E219FB597F13E6FD203251915E48AAFC8E1C01E76DD220781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 819b949adb3cec84dbe11132ed6ecf0f183a947055907aa060c75101dcd3a088
MD5 4b32f537486ee99528ff7f470045676d
SHA1 8afa6213edac269977a7d41e889e3b39e9ffbaf0
SHA512 c8142bb77427ac430dc2ddb4d22857b63142f7a2af9e4a1056ae1343a447c36bc4bd3fdbdfaaaa509f20247dc8cbb02341cd287a5a25e9bb07a98cb0b03dc213
SSDEEP 768:QFRogwgqC/6dBGzW6V/Usu5SrC+owUEr5RLu:wo/Cw6VMGZo1ErLa
TLSH
T1FAE21871D895CDE798EAD9D5A64AF642ADE00133C98C8A8CE6F47D3C208F1FD174B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 cb39f0e92ade5432dabf7b935ff043ff4ca03090564facbb7e9c40a26b8009bf
MD5 a79cdbd73c4b0a599fbad92d25f95138
SHA1 961e9ae139b96f2bf5571af364cf7ba8a7e4ae37
SHA512 97191de5f618ae0e779fd4182043d8d82963c262866e2cd6fe0f976b85c1b7db4ea3ed1d2f208bfd46c68650ae9893e5b474f68b52a3b4e5d5d816b8a3a4730b
SSDEEP 3:MsEllllkEthXllkl2zELQt:/M/xT02z4Q
TLSH
T13D4404047FF10D45C501103040D1C3500370DC11051557473C530C377CCDD710D40000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

aa9038bd-2a6b-4475-9d5e-12c2530e96d7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\aa9038bd-2a6b-4475-9d5e-12c2530e96d7.tmp
Size 25KB
SHA256 50e73a7c4454e5a640cdb18e2bb93fb60e622e6254454314b02e416164e46bdb
MD5 4aff0524179ffceeaf48edf0fa2b2f60
SHA1 dbf9618907f3749bf2b2516a3b248cce5f24c0c1
SHA512 a044be8c1759967534d44357415fad12efe31cb353c11a08f2e94a1b6df956a7e6c2102c959856d9ac593a47b81a5327af8c28042ae67a662ff84de7d8aad132
SSDEEP 384:n5iFiZcI638Nz8TUNTUlIRLDCC7qJFuxzyfoBjT+Cyl9kn6V/fMHvvXKgL/7IzIl:QFQ63gwgUCq6dBGzW6V/UPvXbau
TLSH
T173C24A31EC94CDBBECEA8F99A74ABA03DEF41163959C99C4D9D85D1D00971DE030BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0317587d-1fd9-4101-bb92-b17b53e0ce72.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\0317587d-1fd9-4101-bb92-b17b53e0ce72.tmp
Size 132B
SHA256 cf4125d94d82b448cb33d6f462cf53eec00f2ee8165fa00f1b9c3bdba48e3328
MD5 8126a600a3d95922fb651e3a6f104f68
SHA1 e386add1c2c1d9ca74461e5ce0d1b271d689160f
SHA512 5a0e81111f0d9a0f7943b99f7bad8162de0d3f99fffa9d8f8ab466fa9c7c4249808bedfa6e4d26426bc2d1a422e2155900ba71adc222617a5f0880dc60b89a93
TLSH
T122C02B8F542E47CBBAA5152D42D40B3B4690CD60F199E6B449FA5640006435CC608C47
MD5 SHA1 SHA512 TLSH

Submit Download

3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
Size 158KB
SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
MD5 9c18c4721b560ec55f0d5de055144d5c
SHA1 6af37a3bda916cac276ad5879c9f61262d9ae523
SHA512 51466928eb8d3cf7b917919c98bd8168453583d2c3dc5836036d87ffd0d2c732ab8450212a880fc6de199ea569a96993ba0d250a5012160d2d72211880695f92
SSDEEP 3072:5ZwEurOxn8zXnHc2qHNYEU/rUHCVJWGdi0Ha5HnXk9TFzBsuht7yGik:5ZwPOx8D85UIHEI0HaZ09JzKStjik
TLSH
T1CFF3E13E7EDE891AD80B10BB7F16B18BD80D8E0B460AB44B769D80155B3668D1BD1CFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_9.0.21_(x64)_20261024161033_000_dotnet_runtime_9.0.21_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_9.0.21_(x64)_20261024161033_000_dotnet_runtime_9.0.21_win_x64.msi.log
Size 4KB
SHA256 c4684dd10f4c08192a510a04edba9b716074f1cec18acf7b76a428b93faa9492
MD5 2f8f0ed7b39a0ef6e4231ab5dbe3b9c4
SHA1 e4bb6177d998e5402b1a86e893e6ac39db3a59f3
SHA512 1bb9398b6bdbcfc0e73cc0433ee08217ec8fe69cc0a9ae91a602962b9e324345673bad3bef36ee99b2256376b5af45bb569a8ad5d2d4b5233fd239211f05575b
SSDEEP 48:YcN4U+lg2sJ7g1JLBdrZ8ELFORL4cPIj/Ac3UaqcV1+drZXJh1JgdrZ8B1JN9fiQ:Yy+lsI/BO+3ffizFYevmKFMy
TLSH
T11281F8581BF80955E6B35647DDF7C0232A33BCD67930DF4C6384831A0267905A8BDBBA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_9.0.21_(x64)_20261024161033_001_dotnet_hostfxr_9.0.21_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_9.0.21_(x64)_20261024161033_001_dotnet_hostfxr_9.0.21_win_x64.msi.log
Size 2KB
SHA256 4db074ec07d1279b40074a0cf0a55fd660dcc302949b8cfffa0b07b5e68a1fb3
MD5 0bf79d45bec9fba88eecf8c0903a7012
SHA1 266bb82ff366b2ce3b6b96de90d1de28d0cda6aa
SHA512 1d663a57eca1fc8a936ad851e6440598d78e76eff871ced9e7d840c0dcc4145e28c0dd8bca5ebae6d72af0b6336299edf6b9347625ec1a3be930037234ce5bc9
TLSH
T1D34115642BE80946B5B627079EF7D0537A33BDC17835DB4D2245821A0667D08A8F8B7F
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_9.0.21_(x64)_20261024161033_002_dotnet_host_9.0.21_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_9.0.21_(x64)_20261024161033_002_dotnet_host_9.0.21_win_x64.msi.log
Size 2KB
SHA256 09752ef5540bf2031193d902e0fa67c1dd8f2110f44b132d424de3e0e30b71e2
MD5 56089ce9c5ca036f26c6d6ef9406d63b
SHA1 c3c595e586045a13519005024069fb458a7a6a8b
SHA512 37b14b7d63fc448177bead452fe4e8012e06ad155a07f4041a0875e9a903b023fd72ab0b8c9bf987357f20993ad51a1ede025abe54b5c5740fa2096f15c99e6d
TLSH
T1484135741BE45A46B1B657079EF7C052AA33BC817838EF4D2245431A5667C0898F8B7F
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_9.0.21_(x64)_20261024161033_003_windowsdesktop_runtime_9.0.21_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_9.0.21_(x64)_20261024161033_003_windowsdesktop_runtime_9.0.21_win_x64.msi.log
Size 3KB
SHA256 ed0cfb6fffacfd6f6159b3069b03c4042647a3fea3e4413d7ab6db3217330197
MD5 308b345bb05f3c46f2011a844b1419f2
SHA1 a079ae4c34103d310791aeb5a2565e76268858d6
SHA512 e1d65dda4e12af97f79f1675033305b17a87600877d9d6eb799e5c36cefc285f7ec6d8e14dbe69d1eccce950b379419846c9edc7706169da9d6ee8418a45733d
TLSH
T151711A681BE40D46A5F6570B9DF7C0231B33BCC26931DF4C2784831A469B909A4BCBBE
MD5 SHA1 SHA512 TLSH

Submit Download

a0f8a876-86d7-41d5-bd34-8bc9f075c3fe.tmp

Path C:\Users\Admin\AppData\Local\Temp\a0f8a876-86d7-41d5-bd34-8bc9f075c3fe.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2976_1410024721\CRX_INSTALL\_locales\en_CA\messages.json
Size 711B
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
TLSH
T1460197136240AF18470BF05BB9023442A0B44AC62384E0B775EC982C6656DAFB20B3B0
MD5 SHA1 SHA512 TLSH

Submit Download

0297d4a0-0492-402e-bec6-6db58c553758.tmp

Path C:\Users\Admin\Downloads\0297d4a0-0492-402e-bec6-6db58c553758.tmp
Size 15KB
SHA256 b8f97dabaedef5808dfe759f850b8ae055d3dcebf305422ee0bcb29be1f78576
MD5 a122f871260637d66d3214299efcc8e4
SHA1 eb55eb7ea802e12bd40c010158a0c24ce4b3cf66
SHA512 3b17feb9781712d92fca6909f2fc3a36f6cba201657a1d38e559d4649efd5eab6ce5675a0401a9cc679fe0d724835ab3a633513d895adde7c66548655c4270da
SSDEEP 384:FLDULILL7EounBaU3VttkZB2hyHIUFfTFYq2Qd1bLYH/:CMX7EounBj3VwZTFPb0f
TLSH
T1B562F612B98995FBDBD20331CF2D393573A8823D0069C59B93586D4176E28438B7FB97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windowsdesktop-runtime-9.0.21-win-x64.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\windowsdesktop-runtime-9.0.21-win-x64.exe:Zone.Identifier
Size 185B
SHA256 47fbdb5aec2994685e9b4d6b8a53141c7bd5dc8e43183d6247ea366a0911ba09
MD5 063d0883f60d7848a33aee8ff0846885
SHA1 923c176354f471665ee59cc7a3ea12925c26cfdb
SHA512 59effb2e9294bda8e369ddbf21d626de834f5cc3992f3b5dbacf2b3376f3fc5eb96e898358f779afa7bca6c9c725935bbc5447077b2abc3e880d73f8d6302518
TLSH
T17CC0125BC40045420E3023868B6FD6A8EA0F1E574981D39C8CC5C092E573DDAC191891
MD5 SHA1 SHA512 TLSH

Submit Download

MSIE47F.tmp

Path C:\Windows\Installer\MSIE47F.tmp
Size 219KB
SHA256 2bf33a9b9980e44d21d48f04cc6ac4eed4c68f207bd5990b7d3254a310b944ae
MD5 928f4b0fc68501395f93ad524a36148c
SHA1 084590b18957ca45b4a0d4576d1cc72966c3ea10
SHA512 7f2163f651693f9b73a67e90b5c820af060a23502667a5c32c3beb2d6b043f5459f22d61072a744089d622c05502d80f7485e0f86eb6d565ff711d5680512372
SSDEEP 3072:FVzl3qiEZybztEwiUx6D02cWVsV1v2vZR3X6j7zo6k2FkngTLrOrORT9flQnS6lg:FVIMEgXmEAR3oHon2VaFuG0eEp
TLSH
T1AF248D217494947EEAFA0832A57EDA71BF3DF2241760C8AEC3409D1E6D604C167B7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bg.png

Path C:\Windows\Temp\{3ED746F2-050E-4357-8A45-22274AB35B8E}\.ba\bg.png
Size 4KB
SHA256 9095bf7b6baa0107b40a4a6d727215be077133a190f4ca9bd89a176842141e79
MD5 9eb0320dfbf2bd541e6a55c01ddc9f20
SHA1 eb282a66d29594346531b1ff886d455e1dcd6d99
SHA512 9ada3a1757a493fbb004bd767fab8f77430af69d71479f340b8b8ede904cc94cd733700db593a4a2d2e1184c0081fd0648318d867128e1cb461021314990931d
SSDEEP 48:u+Xg+NXWbdlIr33lx9W5OstaDIy3r5XpPyvZKmXYTDeiByNxcaaaaaaaaaaaaaaE:AaXWPIrHT932JsdpPyjqDeioatEn
TLSH
T19891B4D8FCF95322C6002BF255F4C0735A0215B713ABFEC82F496BD90E6878E25058B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixstdba.dll

Path C:\Windows\Temp\{3ED746F2-050E-4357-8A45-22274AB35B8E}\.ba\wixstdba.dll
Size 190KB
SHA256 dcea15f3710822ffc262e62ec04cc7bbbf0f33f5d1a853609fbfb65cb6a45640
MD5 f1919c6bd85d7a78a70c228a5b227fbe
SHA1 71647ebf4e7bed3bc1663d520419ac550fe630ff
SHA512 c7ff9b19c9bf320454a240c6abbc382950176a6befce05ea73150eeb0085d0b6ed5b65b2dcb4b04621ef9cca1d5c4e59c6682b9c85d1d5845e5ce3e5eedfd2eb
SSDEEP 3072:sjEoXsLW9OLG8Qp51ySdjDXY33b+Av7O5IkI+/AYkPAEc527uu3k/gLtxavf0ir2:sjEo8LW9553hXWy15I2YrAW7FUVEihs3
TLSH
T1FF14AF1176D0A07AEBFB16307A39A5216E7DBA200FA0C9DF63449D2B1D715C19B36B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet_host_9.0.21_win_x64.msi

Path C:\Windows\Temp\{3ED746F2-050E-4357-8A45-22274AB35B8E}\dotnet_host_9.0.21_win_x64.msi
Size 704KB
SHA256 add805f3953b1eb2cd47e38be63d0be5e9885b5c46cc8a47f28be3da8a5552ec
MD5 8c3d24ee4a5d32b9e975ceda6223470e
SHA1 d8ee12db64bb2bbe3d0a10c8e6cb38a3a3421a4e
SHA512 9abf7ee594358139283ec4e2e8b666a984fc610398ad7b1551509f8c5907af9ef0e59275e0b7ead0bcfd28e0c016aa040e319a284d3dcfdf32ebc6d023f24d25
SSDEEP 12288:bvD4l/wSV1EgXmEI3os2Qx7E4D4Rxbp4K+1uiqe:MjXdc3/7Rin+sW
TLSH
T192E49D237D80803AD9BA0D718539D7B16F3DBD204A64889B6380B91DDDF15C0AF76BE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet_runtime_9.0.21_win_x64.msi

Path C:\Windows\Temp\{3ED746F2-050E-4357-8A45-22274AB35B8E}\dotnet_runtime_9.0.21_win_x64.msi
Size 27.6MB
SHA256 01385da55508a3485391ca4663de71468df07371902fc76195fd838751a2f5c7
MD5 d008884d130912e1a366a477330f5581
SHA1 fd90e3ff8af829c7bab987ae6e745cd691f4ea76
SHA512 68c95a633606d51f6209bb16079bc48e0ecc83e24b769f2e17b06b1090137c473ef01442362cbec5035297df62b3a8b7da44cfc30b7ba9e677b9d80c1a5aa368
SSDEEP 786432:HNgbJAUvglJ/zAsfAr3aW3pONI9i+UFFEKnI:HbUIlJUsfArP3pONI9itFPI
TLSH
T1CB5733373D83903EE46A1EB5403ACB61472AAD504B22D8D7F3D1722DDDF21D06A72AD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windowsdesktop_runtime_9.0.21_win_x64.msi

Path C:\Windows\Temp\{3ED746F2-050E-4357-8A45-22274AB35B8E}\windowsdesktop_runtime_9.0.21_win_x64.msi
Size 29.9MB
SHA256 c267349844f1e38f8880297e9aeae7583b66a1ec1eea7639a746506f71916172
MD5 ae6b6c04c504c4b7e26e387251057180
SHA1 415c38e092c2404cd7d8c76d6fdf60445ac4321c
SHA512 6d7603ad4a810ca9e12a684906c75dd7810c397927bd221f1b5417a766670026c1d93b4b5ffda947945f1ee4c25a5ff0f315bf0da8611f4965a86e6cd232da06
SSDEEP 786432:gh9XA6XHwbGznA/na5UHULMruYBacFRnw4dBt:gh9X3QbGz2D0L+8Ynw4d
TLSH
T14C673323BF92C93AD9B54E76847ED7610A396E600650CD4367E0382DDDF2AC1AB343D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BootstrapperApplicationData.xml

Path C:\Windows\Temp\{B9A741B7-940C-4FFA-B58C-FAE0C9B5CBCB}\.ba\BootstrapperApplicationData.xml
Size 7KB
SHA256 4bacd5cd0f7a34d629ce28485cd5059e80b349c287f99d3c88b0a8712a969c78
MD5 9fa3433d723b845d2ce07b06468f1f8c
SHA1 6691219af6277bb0416433cbad4acf18d52956a9
SHA512 1012f0a2d25bc80548426276a134bf2c7031225726ab304f9214a5b21122d0712dceeca4fb252f58b89cfc7942610aff34d6354ba7b6c77ba548131d8b8685e5
SSDEEP 96:XeV2VS/V2VvVtn6Vky0wqyc+an6ti+0wiycJn6xaF0wOyc6n6YMN0wJycRlVM4rN:X0sesv/W+2BaOYOmadqlL/bwVW8gc
TLSH
T1C7F17B142FFD0329F0F74F84E9F8501A5A35BCD26E38DA5D01551D0E8972B819962FBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{B9A741B7-940C-4FFA-B58C-FAE0C9B5CBCB}\.ba\thm.wxl
Size 5KB
SHA256 81a68046b06e09385be8449373e7ceb9e79f7724c3cf11f0b18a4489a8d4926a
MD5 d5070cb3387a0a22b7046ae5ab53f371
SHA1 bc9da146a42bbf9496de059ac576869004702a97
SHA512 8fcf621fb9ce74725c3712e06e5b37b619145078491e828c6069e153359de3bd5486663b1fa6f3bcf1c994d5c556b9964ea1a1355100a634a6c700ef37d381e3
SSDEEP 96:MT0abTxmup/vrCKATQdYQHdYCwgoVOBq9LjP5dbSE7:OQNkdYQHdYCYXt7
TLSH
T1F1C1DBA778CF53C128731255EA925AAA5911C19C537F2DF4FC8B454B838A827A373F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.xml

Path C:\Windows\Temp\{B9A741B7-940C-4FFA-B58C-FAE0C9B5CBCB}\.ba\thm.xml
Size 11KB
SHA256 83ca096f7ba2c83fc3b3aeb697b8139a788fa35eb8632943e26bb9fff7c78e63
MD5 302563a713b142ee41b59e3eeac53a90
SHA1 1340e90cc3c6c5fc19a7feb61d7779f4a4f0fdb5
SHA512 c9d4dfc20802bb542178300d1044bb94b35593b834ab0b50875a32953f890e48da456199128500e2c1fee26eaaf8c2c4fcaffb308b37914215f900cdd5c4cbc8
SSDEEP 96:eCdhlFGZRd4UyAi0Rz96zYFGiRdl6dXXdT9gUoLNEmRG3QBinRFRK03K8+GGI9ki:eCSfiozEW/A
TLSH
T1A2325BA986DE7C00D232E711ABF271D6AF126862C4C46E58F94C39BB4FE25406C7727D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windowsdesktop-runtime-9.0.21-win-x64.exe

Path C:\Windows\Temp\{FCA8039F-2CA8-4194-A4FB-F8A9123A6264}\.cr\windowsdesktop-runtime-9.0.21-win-x64.exe
Size 607KB
SHA256 ec370f05c3a187d24324a14134e0083d2c1c01b9001850f82b6e8854f7b8df15
MD5 f954a738593fb93bd0ef4d9c2108c2f8
SHA1 70a003879b3476ee95b9c94a175d6f3cf6a35373
SHA512 4a4183c9cf11436f8eceda4078a0e1c63fcc60c453c28744c9052f7b0e3e40bd3b7e4fea8b66f7145391d54353e4249886c69f0e61a109efeac0cd347a27bdaa
SSDEEP 12288:gmEsd9PZfePv3xl7ft7V+6uC+zd5qLlj33wyDiy7nlEM0Dnmb:gm39PZfePv3r7fm6t+jqpL3xzCM0U
TLSH
T129D47D32A5614032F7F106B3B92896303E3CE328175488AAE7D4AD1D7EB84D667F7257
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2076-319-0x0000017443D50000-0x0000017444D50000-memory.dmp

Download