d707be7484cf139f78f62b22e56b3cede4e71838465771b9f6389f0596c0346f

Resubmissions

02/11/2026, 06:29

261102-g86vgafx5s6

01/11/2026, 22:29

261101-2d9m4az12n6

Analysis

user interaction
yes
max time kernel
299s
max time network
302s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/11/2026, 06:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Elsify.exe
Size 40.0MB
Sample261102-g86vgafx5s
SHA256 d707be7484cf139f78f62b22e56b3cede4e71838465771b9f6389f0596c0346f
MD5 9ee4494343fe1bae95f6b5443771dd62
SHA1 5aee54d7da7896168919b77bc9b96ce186305b1f
SHA512 90a546ecf1c97af2863aba77d5604f464292e3a223fc3fb247498e01b5d5faacd762f2daaab303614236f085bf2101a2eac4c3cd39017293d8721adf9d0fd597
SSDEEP 393216:cUo6LGgjctJYGdPKRlRY4+koT1hiAgaI8AIpER:cUo6aZOGJqoT1hiAIR
TLSH
T186979D0323968E2ED99F1BBAE0D14325D739DA06A75793DB240C99991FC33C15A343FA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{e1d068be-adc4-418c-815f-83da627461a5} = "\"C:\\ProgramData\\Package Cache\\{e1d068be-adc4-418c-815f-83da627461a5}\\windowsdesktop-runtime-9.0.22-win-x64.exe\" /burn.runonce"	windowsdesktop-runtime-9.0.22-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{e1d068be-adc4-418c-815f-83da627461a5} = "\"C:\\ProgramData\\Package Cache\\{e1d068be-adc4-418c-815f-83da627461a5}\\windowsdesktop-runtime-9.0.22-win-x64.exe\" /burn.runonce"	windowsdesktop-runtime-9.0.22-win-x64.exe

Downloads MZ/PE file 2 IoCs

flow	pid	Process
101	4696	msedge.exe
149	5296	msedge.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation	windowsdesktop-runtime-9.0.22-win-x64.exe
Key value queried	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation	windowsdesktop-runtime-9.0.22-win-x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.22\System.Runtime.Handles.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.22\System.IO.Pipes.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.22\System.Threading.ThreadPool.dll	msiexec.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping620_888405534\keys.json	msedge.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.22\System.IO.Pipes.AccessControl.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.22\System.Security.Cryptography.Primitives.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.22\mscordaccore_amd64_amd64_9.0.2226.52218.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.22\Microsoft.Win32.Registry.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.22\it\UIAutomationTypes.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.22\de\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.22\de\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.22\System.Security.SecureString.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.22\tr\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.22\System.ObjectModel.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.22\System.Globalization.Extensions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.22\mscorrc.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.22\System.Security.AccessControl.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.22\System.Security.Cryptography.Algorithms.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.22\clrgc.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.22\System.Xml.XDocument.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.22\pl\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.22\UIAutomationClient.dll	msiexec.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping620_1943698138\manifest.json	msedge.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.22\System.Net.WebProxy.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.22\System.Data.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.22\fr\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.22\System.Runtime.InteropServices.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.22\System.Reflection.Emit.Lightweight.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.22\zh-Hans\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.22\PresentationFramework-SystemXmlLinq.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.22\ko\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.22\System.ComponentModel.Annotations.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.22\es\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.22\PresentationFramework-SystemDrawing.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.22\tr\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.22\pt-BR\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.22\System.Threading.Tasks.Dataflow.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.22\ja\UIAutomationTypes.resources.dll	msiexec.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping620_1688591678\protocols.json	msedge.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.22\System.Reflection.Emit.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.22\zh-Hant\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.22\ko\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.22\PresentationUI.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.22\System.Numerics.Vectors.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.22\WindowsBase.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.22\System.Memory.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.22\pl\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.22\ru\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.22\fr\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.22\fr\UIAutomationTypes.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.22\ru\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.22\zh-Hant\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.22\System.Linq.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.22\es\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.22\zh-Hant\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.22\es\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.22\ko\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.22\System.Globalization.Calendars.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.22\System.Private.CoreLib.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.22\System.Transactions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.22\pt-BR\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.22\es\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.22\tr\PresentationCore.resources.dll	msiexec.exe

Drops file in Windows directory 41 IoCs

description	ioc	Process
File created	C:\Windows\Installer\SourceHash{EC3D80DB-1C50-433F-BC10-F39F9F356CE1}	msiexec.exe
File opened for modification	C:\Windows\Installer\e593e7b.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149\fileCoreHostExe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI889E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8C39.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4A7D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e593e80.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8745.tmp	msiexec.exe
File created	C:\Windows\Installer\e593e7a.msi	msiexec.exe
File created	C:\Windows\Installer\e593e7b.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{AE325D9A-671F-44B2-A537-5E15D58161AA}	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149\fileCoreHostExe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI86F6.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\e593e80.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5DBC.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5E88.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6A23.tmp	msiexec.exe
File created	C:\Windows\Installer\e593e76.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI57AE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6129.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6E1C.tmp	msiexec.exe
File created	C:\Windows\Installer\e593e8b.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4481.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\e593e86.msi	msiexec.exe
File created	C:\Windows\Installer\e593e87.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{D03F7FCE-B96F-41A8-B54A-038465A171C4}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7C84.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8CA7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI58B9.tmp	msiexec.exe
File created	C:\Windows\Installer\e593e7f.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5AAE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e593e87.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI85EC.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e593e76.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5617.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{404EFD89-B0DE-427F-8597-8049202AA283}	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe

Executes dropped EXE 9 IoCs

pid	Process
628	windowsdesktop-runtime-9.0.22-win-x64.exe
3764	windowsdesktop-runtime-9.0.22-win-x64.exe
2864	windowsdesktop-runtime-9.0.22-win-x64.exe
1480	windowsdesktop-runtime-9.0.22-win-x64.exe
5180	windowsdesktop-runtime-9.0.22-win-x64.exe
5848	windowsdesktop-runtime-9.0.22-win-x64.exe
5876	windowsdesktop-runtime-9.0.22-win-x64.exe
5900	windowsdesktop-runtime-9.0.22-win-x64.exe
6076	windowsdesktop-runtime-9.0.22-win-x64.exe

Loads dropped DLL 16 IoCs

pid	Process
2864	windowsdesktop-runtime-9.0.22-win-x64.exe
1480	windowsdesktop-runtime-9.0.22-win-x64.exe
1264	MsiExec.exe
1264	MsiExec.exe
6048	MsiExec.exe
5900	windowsdesktop-runtime-9.0.22-win-x64.exe
6048	MsiExec.exe
1656	MsiExec.exe
1656	MsiExec.exe
4992	MsiExec.exe
4992	MsiExec.exe
2584	MsiExec.exe
2584	MsiExec.exe
4224	MsiExec.exe
4224	MsiExec.exe
216	Elsify.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-9.0.22-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-9.0.22-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-9.0.22-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-9.0.22-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-9.0.22-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-9.0.22-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-9.0.22-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-9.0.22-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-9.0.22-win-x64.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4696	msedge.exe
5296	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 13 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2B	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2C	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2d	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BD08D3CE05C1F334CB013FF9F953C61E\DeploymentFlags = "3"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\98DFE404ED0BF7245879089402A22A38\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A9D523EAF1762B445A73E5515D1816AA\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_72.88.61677_x64\DisplayName = "Microsoft Windows Desktop Runtime - 9.0.22 (x64)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{e1d068be-adc4-418c-815f-83da627461a5}\Version = "9.0.22.36622"	windowsdesktop-runtime-9.0.22-win-x64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\dotnet_runtime_72.88.61666_x64	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_72.88.61666_x64\DisplayName = "Microsoft .NET Host FX Resolver - 9.0.22 (x64)"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\98DFE404ED0BF7245879089402A22A38\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\98DFE404ED0BF7245879089402A22A38\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A9D523EAF1762B445A73E5515D1816AA\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\ECF7F30DF69B8A145BA43048561A174C\MainFeature	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BD08D3CE05C1F334CB013FF9F953C61E\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\98DFE404ED0BF7245879089402A22A38\Provider	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\A9D523EAF1762B445A73E5515D1816AA\MainFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\F71950C1A6A51F479A1ED20855BD5918\A9D523EAF1762B445A73E5515D1816AA	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ECF7F30DF69B8A145BA43048561A174C\ProductName = "Microsoft Windows Desktop Runtime - 9.0.22 (x64)"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ECF7F30DF69B8A145BA43048561A174C\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ECF7F30DF69B8A145BA43048561A174C\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_72.88.61666_x64\Dependents\{e1d068be-adc4-418c-815f-83da627461a5}	windowsdesktop-runtime-9.0.22-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BD08D3CE05C1F334CB013FF9F953C61E\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{EC3D80DB-1C50-433F-BC10-F39F9F356CE1}v72.88.61666\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_72.88.61666_x64\Dependents	windowsdesktop-runtime-9.0.22-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\98DFE404ED0BF7245879089402A22A38\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\98DFE404ED0BF7245879089402A22A38\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{404EFD89-B0DE-427F-8597-8049202AA283}v72.88.61666\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A9D523EAF1762B445A73E5515D1816AA\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\windowsdesktop_runtime_72.88.61677_x64	windowsdesktop-runtime-9.0.22-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{e1d068be-adc4-418c-815f-83da627461a5}\Dependents\{e1d068be-adc4-418c-815f-83da627461a5}	windowsdesktop-runtime-9.0.22-win-x64.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A9D523EAF1762B445A73E5515D1816AA\Clients = 3a0000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BD08D3CE05C1F334CB013FF9F953C61E\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_9.0_x64\Dependents\{e1d068be-adc4-418c-815f-83da627461a5}	windowsdesktop-runtime-9.0.22-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_72.88.61677_x64\Version = "72.88.61677"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ECF7F30DF69B8A145BA43048561A174C\Version = "1213788397"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ECF7F30DF69B8A145BA43048561A174C\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BD08D3CE05C1F334CB013FF9F953C61E\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ECF7F30DF69B8A145BA43048561A174C\SourceList\PackageName = "windowsdesktop-runtime-9.0.22-win-x64.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_72.88.61666_x64\Version = "72.88.61666"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\98DFE404ED0BF7245879089402A22A38\MainFeature	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A9D523EAF1762B445A73E5515D1816AA\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ECF7F30DF69B8A145BA43048561A174C\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\BD08D3CE05C1F334CB013FF9F953C61E	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BD08D3CE05C1F334CB013FF9F953C61E\ProductName = "Microsoft .NET Runtime - 9.0.22 (x64)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\98DFE404ED0BF7245879089402A22A38\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{404EFD89-B0DE-427F-8597-8049202AA283}v72.88.61666\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ECF7F30DF69B8A145BA43048561A174C\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{D03F7FCE-B96F-41A8-B54A-038465A171C4}v72.88.61677\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\98DFE404ED0BF7245879089402A22A38\PackageCode = "18C8B2ADC95C18A4F92658E24B1C1CFA"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\98DFE404ED0BF7245879089402A22A38\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\A9D523EAF1762B445A73E5515D1816AA	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\A9D523EAF1762B445A73E5515D1816AA\Provider	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A9D523EAF1762B445A73E5515D1816AA\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_72.88.61666_x64	windowsdesktop-runtime-9.0.22-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\98DFE404ED0BF7245879089402A22A38\SourceList\PackageName = "dotnet-hostfxr-9.0.22-win-x64.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\98DFE404ED0BF7245879089402A22A38\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A9D523EAF1762B445A73E5515D1816AA\SourceList\PackageName = "dotnet-host-9.0.22-win-x64.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_72.88.61677_x64\ = "{D03F7FCE-B96F-41A8-B54A-038465A171C4}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{e1d068be-adc4-418c-815f-83da627461a5}\Version = "9.0.22.36622"	windowsdesktop-runtime-9.0.22-win-x64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\dotnet_runtime_72.88.61666_x64	windowsdesktop-runtime-9.0.22-win-x64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_72.88.61666_x64	windowsdesktop-runtime-9.0.22-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A9D523EAF1762B445A73E5515D1816AA\ProductName = "Microsoft .NET Host - 9.0.22 (x64)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ECF7F30DF69B8A145BA43048561A174C\PackageCode = "97A6D38C30DE8CA47B7FB34444839F53"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D153533346857104A73845FDF71BE1D9\ECF7F30DF69B8A145BA43048561A174C	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\dotnet_runtime_72.88.61666_x64	windowsdesktop-runtime-9.0.22-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_72.88.61666_x64\ = "{EC3D80DB-1C50-433F-BC10-F39F9F356CE1}"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BD08D3CE05C1F334CB013FF9F953C61E\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BD08D3CE05C1F334CB013FF9F953C61E\Version = "1213788386"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_72.88.61666_x64\Dependents\{e1d068be-adc4-418c-815f-83da627461a5}	windowsdesktop-runtime-9.0.22-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A9D523EAF1762B445A73E5515D1816AA\AdvertiseFlags = "388"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
5372	msiexec.exe
5372	msiexec.exe
5372	msiexec.exe
5372	msiexec.exe
5372	msiexec.exe
5372	msiexec.exe
5372	msiexec.exe
5372	msiexec.exe
5372	msiexec.exe
5372	msiexec.exe
5372	msiexec.exe
5372	msiexec.exe
4600	msedge.exe
4600	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5180	windowsdesktop-runtime-9.0.22-win-x64.exe
Token: SeIncreaseQuotaPrivilege	5180	windowsdesktop-runtime-9.0.22-win-x64.exe
Token: SeSecurityPrivilege	5372	msiexec.exe
Token: SeCreateTokenPrivilege	5180	windowsdesktop-runtime-9.0.22-win-x64.exe
Token: SeAssignPrimaryTokenPrivilege	5180	windowsdesktop-runtime-9.0.22-win-x64.exe
Token: SeLockMemoryPrivilege	5180	windowsdesktop-runtime-9.0.22-win-x64.exe
Token: SeIncreaseQuotaPrivilege	5180	windowsdesktop-runtime-9.0.22-win-x64.exe
Token: SeMachineAccountPrivilege	5180	windowsdesktop-runtime-9.0.22-win-x64.exe
Token: SeTcbPrivilege	5180	windowsdesktop-runtime-9.0.22-win-x64.exe
Token: SeSecurityPrivilege	5180	windowsdesktop-runtime-9.0.22-win-x64.exe
Token: SeTakeOwnershipPrivilege	5180	windowsdesktop-runtime-9.0.22-win-x64.exe
Token: SeLoadDriverPrivilege	5180	windowsdesktop-runtime-9.0.22-win-x64.exe
Token: SeSystemProfilePrivilege	5180	windowsdesktop-runtime-9.0.22-win-x64.exe
Token: SeSystemtimePrivilege	5180	windowsdesktop-runtime-9.0.22-win-x64.exe
Token: SeProfSingleProcessPrivilege	5180	windowsdesktop-runtime-9.0.22-win-x64.exe
Token: SeIncBasePriorityPrivilege	5180	windowsdesktop-runtime-9.0.22-win-x64.exe
Token: SeCreatePagefilePrivilege	5180	windowsdesktop-runtime-9.0.22-win-x64.exe
Token: SeCreatePermanentPrivilege	5180	windowsdesktop-runtime-9.0.22-win-x64.exe
Token: SeBackupPrivilege	5180	windowsdesktop-runtime-9.0.22-win-x64.exe
Token: SeRestorePrivilege	5180	windowsdesktop-runtime-9.0.22-win-x64.exe
Token: SeShutdownPrivilege	5180	windowsdesktop-runtime-9.0.22-win-x64.exe
Token: SeDebugPrivilege	5180	windowsdesktop-runtime-9.0.22-win-x64.exe
Token: SeAuditPrivilege	5180	windowsdesktop-runtime-9.0.22-win-x64.exe
Token: SeSystemEnvironmentPrivilege	5180	windowsdesktop-runtime-9.0.22-win-x64.exe
Token: SeChangeNotifyPrivilege	5180	windowsdesktop-runtime-9.0.22-win-x64.exe
Token: SeRemoteShutdownPrivilege	5180	windowsdesktop-runtime-9.0.22-win-x64.exe
Token: SeUndockPrivilege	5180	windowsdesktop-runtime-9.0.22-win-x64.exe
Token: SeSyncAgentPrivilege	5180	windowsdesktop-runtime-9.0.22-win-x64.exe
Token: SeEnableDelegationPrivilege	5180	windowsdesktop-runtime-9.0.22-win-x64.exe
Token: SeManageVolumePrivilege	5180	windowsdesktop-runtime-9.0.22-win-x64.exe
Token: SeImpersonatePrivilege	5180	windowsdesktop-runtime-9.0.22-win-x64.exe
Token: SeCreateGlobalPrivilege	5180	windowsdesktop-runtime-9.0.22-win-x64.exe
Token: SeRestorePrivilege	5372	msiexec.exe
Token: SeTakeOwnershipPrivilege	5372	msiexec.exe
Token: SeRestorePrivilege	5372	msiexec.exe
Token: SeTakeOwnershipPrivilege	5372	msiexec.exe
Token: SeRestorePrivilege	5372	msiexec.exe
Token: SeTakeOwnershipPrivilege	5372	msiexec.exe
Token: SeRestorePrivilege	5372	msiexec.exe
Token: SeTakeOwnershipPrivilege	5372	msiexec.exe
Token: SeRestorePrivilege	5372	msiexec.exe
Token: SeTakeOwnershipPrivilege	5372	msiexec.exe
Token: SeRestorePrivilege	5372	msiexec.exe
Token: SeTakeOwnershipPrivilege	5372	msiexec.exe
Token: SeRestorePrivilege	5372	msiexec.exe
Token: SeTakeOwnershipPrivilege	5372	msiexec.exe
Token: SeRestorePrivilege	5372	msiexec.exe
Token: SeTakeOwnershipPrivilege	5372	msiexec.exe
Token: SeRestorePrivilege	5372	msiexec.exe
Token: SeTakeOwnershipPrivilege	5372	msiexec.exe
Token: SeRestorePrivilege	5372	msiexec.exe
Token: SeTakeOwnershipPrivilege	5372	msiexec.exe
Token: SeRestorePrivilege	5372	msiexec.exe
Token: SeTakeOwnershipPrivilege	5372	msiexec.exe
Token: SeRestorePrivilege	5372	msiexec.exe
Token: SeTakeOwnershipPrivilege	5372	msiexec.exe
Token: SeRestorePrivilege	5372	msiexec.exe
Token: SeTakeOwnershipPrivilege	5372	msiexec.exe
Token: SeRestorePrivilege	5372	msiexec.exe
Token: SeTakeOwnershipPrivilege	5372	msiexec.exe
Token: SeRestorePrivilege	5372	msiexec.exe
Token: SeTakeOwnershipPrivilege	5372	msiexec.exe
Token: SeRestorePrivilege	5372	msiexec.exe
Token: SeTakeOwnershipPrivilege	5372	msiexec.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
1480	windowsdesktop-runtime-9.0.22-win-x64.exe
2248	msedge.exe
5900	windowsdesktop-runtime-9.0.22-win-x64.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5012 wrote to memory of 2248	5012	Elsify.exe	87
PID 2248 wrote to memory of 3216	2248	msedge.exe	88
PID 2248 wrote to memory of 4696	2248	msedge.exe	89
PID 2248 wrote to memory of 1296	2248	msedge.exe	90
PID 2248 wrote to memory of 1296	2248	msedge.exe	90
PID 2248 wrote to memory of 1296	2248	msedge.exe	90
PID 2248 wrote to memory of 5104	2248	msedge.exe	91
PID 2248 wrote to memory of 5104	2248	msedge.exe	91
PID 2248 wrote to memory of 1832	2248	msedge.exe	92
PID 2248 wrote to memory of 1832	2248	msedge.exe	92
PID 2248 wrote to memory of 1832	2248	msedge.exe	92
PID 2248 wrote to memory of 3828	2248	msedge.exe	93
PID 2248 wrote to memory of 3828	2248	msedge.exe	93
PID 2248 wrote to memory of 3828	2248	msedge.exe	93
PID 2248 wrote to memory of 4764	2248	msedge.exe	95
PID 2248 wrote to memory of 4764	2248	msedge.exe	95
PID 2248 wrote to memory of 4764	2248	msedge.exe	95
PID 2248 wrote to memory of 4008	2248	msedge.exe	96
PID 2248 wrote to memory of 4008	2248	msedge.exe	96
PID 2248 wrote to memory of 4008	2248	msedge.exe	96
PID 2248 wrote to memory of 1488	2248	msedge.exe	99
PID 2248 wrote to memory of 1488	2248	msedge.exe	99
PID 2248 wrote to memory of 1300	2248	msedge.exe	101
PID 2248 wrote to memory of 1300	2248	msedge.exe	101
PID 2248 wrote to memory of 3620	2248	msedge.exe	103
PID 2248 wrote to memory of 2440	2248	msedge.exe	104
PID 2248 wrote to memory of 3620	2248	msedge.exe	103
PID 2248 wrote to memory of 2440	2248	msedge.exe	104
PID 2248 wrote to memory of 4316	2248	msedge.exe	105
PID 2248 wrote to memory of 4316	2248	msedge.exe	105
PID 2248 wrote to memory of 4316	2248	msedge.exe	105
PID 2248 wrote to memory of 3536	2248	msedge.exe	109
PID 2248 wrote to memory of 2728	2248	msedge.exe	111
PID 2248 wrote to memory of 2728	2248	msedge.exe	111
PID 2248 wrote to memory of 3700	2248	msedge.exe	112
PID 2248 wrote to memory of 3700	2248	msedge.exe	112
PID 2248 wrote to memory of 4652	2248	msedge.exe	113
PID 2248 wrote to memory of 4652	2248	msedge.exe	113
PID 2248 wrote to memory of 4840	2248	msedge.exe	114
PID 2248 wrote to memory of 4840	2248	msedge.exe	114
PID 2248 wrote to memory of 2860	2248	msedge.exe	115
PID 2248 wrote to memory of 2860	2248	msedge.exe	115
PID 2248 wrote to memory of 4484	2248	msedge.exe	117
PID 2248 wrote to memory of 4484	2248	msedge.exe	117
PID 2248 wrote to memory of 4336	2248	msedge.exe	118
PID 2248 wrote to memory of 4336	2248	msedge.exe	118
PID 2248 wrote to memory of 4336	2248	msedge.exe	118
PID 2248 wrote to memory of 1648	2248	msedge.exe	119
PID 2248 wrote to memory of 628	2248	msedge.exe	120
PID 2248 wrote to memory of 3764	2248	msedge.exe	122
PID 3764 wrote to memory of 2864	3764	windowsdesktop-runtime-9.0.22-win-x64.exe	123
PID 628 wrote to memory of 1480	628	windowsdesktop-runtime-9.0.22-win-x64.exe	124
PID 1480 wrote to memory of 5180	1480	windowsdesktop-runtime-9.0.22-win-x64.exe	125
PID 5848 wrote to memory of 5876	5848	windowsdesktop-runtime-9.0.22-win-x64.exe	129
PID 5876 wrote to memory of 5900	5876	windowsdesktop-runtime-9.0.22-win-x64.exe	130
PID 5372 wrote to memory of 1264	5372	msiexec.exe	132
PID 5372 wrote to memory of 6048	5372	msiexec.exe	134
PID 5372 wrote to memory of 1656	5372	msiexec.exe	135
PID 5372 wrote to memory of 4992	5372	msiexec.exe	136
PID 5900 wrote to memory of 6076	5900	windowsdesktop-runtime-9.0.22-win-x64.exe	137
PID 5372 wrote to memory of 2584	5372	msiexec.exe	138
PID 5372 wrote to memory of 4224	5372	msiexec.exe	139
PID 216 wrote to memory of 4328	216	Elsify.exe	147
PID 4328 wrote to memory of 620	4328	msedge.exe	148

C:\Users\Admin\AppData\Local\Temp\Elsify.exe
"C:\Users\Admin\AppData\Local\Temp\Elsify.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.NETCore.App&framework_version=9.0.0&arch=x64&rid=win-x64&os=win10&gui=true
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2ec,0x7ffbc9ebc188,0x7ffbc9ebc194,0x7ffbc9ebc1a0
    3⤵
    PID:3216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1956,i,18420690594118610496,2226188135108788125,524288 --field-trial-handle=2296,i,12256639489399404797,5536246575263244262,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:3
    3⤵
    - Downloads MZ/PE file
    - System Time Discovery
    PID:4696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1748,i,14030265991635846604,13150574778881135161,262144 --field-trial-handle=2296,i,12256639489399404797,5536246575263244262,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:2
    3⤵
    PID:1296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2464,i,17017916892289725278,239606004625539486,524288 --field-trial-handle=2296,i,12256639489399404797,5536246575263244262,262144 --variations-seed-version --mojo-platform-channel-handle=2460 /prefetch:8
    3⤵
    PID:5104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3488,i,6207857701173513488,4670647997222730981,2097152 --field-trial-handle=2296,i,12256639489399404797,5536246575263244262,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
    3⤵
    PID:1832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3508,i,6906068182887598490,13942614634426371931,2097152 --field-trial-handle=2296,i,12256639489399404797,5536246575263244262,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
    3⤵
    PID:3828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4280,i,17574653529527745202,14401127673773968749,2097152 --field-trial-handle=2296,i,12256639489399404797,5536246575263244262,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:1
    3⤵
    PID:4764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4288,i,15840431950465415526,8705900293278319351,2097152 --field-trial-handle=2296,i,12256639489399404797,5536246575263244262,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:2
    3⤵
    PID:4008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3636,i,4004399874938432020,11913482155432393632,524288 --field-trial-handle=2296,i,12256639489399404797,5536246575263244262,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:8
    3⤵
    PID:1488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5300,i,10490568489074862823,2326052510290222921,524288 --field-trial-handle=2296,i,12256639489399404797,5536246575263244262,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:8
    3⤵
    PID:1300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5256,i,6668948525950416450,1539688032596294855,524288 --field-trial-handle=2296,i,12256639489399404797,5536246575263244262,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:8
    3⤵
    PID:3620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5288,i,5616017459149959042,13864229629271223244,524288 --field-trial-handle=2296,i,12256639489399404797,5536246575263244262,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:8
    3⤵
    PID:2440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5584,i,6343298366310893583,18032050780658611079,2097152 --field-trial-handle=2296,i,12256639489399404797,5536246575263244262,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:1
    3⤵
    PID:4316
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6048,i,6453255146879154052,1855224369488866236,524288 --field-trial-handle=2296,i,12256639489399404797,5536246575263244262,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:8
    3⤵
    PID:4644
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6048,i,6453255146879154052,1855224369488866236,524288 --field-trial-handle=2296,i,12256639489399404797,5536246575263244262,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:8
    3⤵
    PID:3536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3740,i,16669746440196608432,10619385838552525195,524288 --field-trial-handle=2296,i,12256639489399404797,5536246575263244262,262144 --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:8
    3⤵
    PID:2728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6264,i,7327369267891293205,7026277652913936621,524288 --field-trial-handle=2296,i,12256639489399404797,5536246575263244262,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:8
    3⤵
    PID:3700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6304,i,17590478245461870763,16900993966795553991,524288 --field-trial-handle=2296,i,12256639489399404797,5536246575263244262,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:8
    3⤵
    PID:4652
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6436,i,2809732897036425508,6895265829414601626,524288 --field-trial-handle=2296,i,12256639489399404797,5536246575263244262,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:8
    3⤵
    PID:4840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6596,i,8391973241246908392,15760029432780548569,524288 --field-trial-handle=2296,i,12256639489399404797,5536246575263244262,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:8
    3⤵
    PID:2860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6180,i,16462594192132428389,3773466771489186964,524288 --field-trial-handle=2296,i,12256639489399404797,5536246575263244262,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:8
    3⤵
    PID:4484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6632,i,7761705283153572485,11393010510727980907,2097152 --field-trial-handle=2296,i,12256639489399404797,5536246575263244262,262144 --variations-seed-version --mojo-platform-channel-handle=3724 /prefetch:1
    3⤵
    PID:4336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6608,i,15302471183945306940,7302818225017393896,524288 --field-trial-handle=2296,i,12256639489399404797,5536246575263244262,262144 --variations-seed-version --mojo-platform-channel-handle=6900 /prefetch:8
    3⤵
    PID:1648
- - C:\Users\Admin\Downloads\windowsdesktop-runtime-9.0.22-win-x64.exe
    "C:\Users\Admin\Downloads\windowsdesktop-runtime-9.0.22-win-x64.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:628
  - - C:\Windows\Temp\{8D52981C-C838-4FC0-BA3A-9973C1DA1633}\.cr\windowsdesktop-runtime-9.0.22-win-x64.exe
      "C:\Windows\Temp\{8D52981C-C838-4FC0-BA3A-9973C1DA1633}\.cr\windowsdesktop-runtime-9.0.22-win-x64.exe" -burn.clean.room="C:\Users\Admin\Downloads\windowsdesktop-runtime-9.0.22-win-x64.exe" -burn.filehandle.attached=732 -burn.filehandle.self=588
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:1480
    - - C:\Windows\Temp\{0B4C47AF-534F-4717-AC7F-41F30B674AC9}\.be\windowsdesktop-runtime-9.0.22-win-x64.exe
        
        "C:\Windows\Temp\{0B4C47AF-534F-4717-AC7F-41F30B674AC9}\.be\windowsdesktop-runtime-9.0.22-win-x64.exe" -q -burn.elevated BurnPipe.{2EF34F5A-8208-45D5-912F-43204AAFAA2A} {35D11C28-B17E-4957-B6A1-A4FC936F52F3} 1480
        5⤵
        Adds Run key to start application
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:5180
- - C:\Users\Admin\Downloads\windowsdesktop-runtime-9.0.22-win-x64.exe
    "C:\Users\Admin\Downloads\windowsdesktop-runtime-9.0.22-win-x64.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3764
  - - C:\Windows\Temp\{4286B4FB-AB78-4715-9CE0-24978E6B3E30}\.cr\windowsdesktop-runtime-9.0.22-win-x64.exe
      "C:\Windows\Temp\{4286B4FB-AB78-4715-9CE0-24978E6B3E30}\.cr\windowsdesktop-runtime-9.0.22-win-x64.exe" -burn.clean.room="C:\Users\Admin\Downloads\windowsdesktop-runtime-9.0.22-win-x64.exe" -burn.filehandle.attached=552 -burn.filehandle.self=720
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:2864

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2180

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5372
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding EE4759F8A3408330E07BDEAC7C4FDD36
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1264
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 7829F76BF2E2D6A6A1BF712F5B044FDA
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:6048
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 86B57F490294EE4AADF84685967A9A68
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1656
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding FB01C540B9D9E5603373801A6EBB9317
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4992
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding F550EDB793831B4A681D1DD6F4B3443E
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2584
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding A882D8F82BF6FE86CB6C2EAB42AAE636
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4224

C:\ProgramData\Package Cache\{e1d068be-adc4-418c-815f-83da627461a5}\windowsdesktop-runtime-9.0.22-win-x64.exe
"C:\ProgramData\Package Cache\{e1d068be-adc4-418c-815f-83da627461a5}\windowsdesktop-runtime-9.0.22-win-x64.exe" /burn.runonce
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5848
- C:\ProgramData\Package Cache\{e1d068be-adc4-418c-815f-83da627461a5}\windowsdesktop-runtime-9.0.22-win-x64.exe
  "C:\ProgramData\Package Cache\{e1d068be-adc4-418c-815f-83da627461a5}\windowsdesktop-runtime-9.0.22-win-x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_9.0.22_(x64)_20261102063012.log"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5876
- - C:\ProgramData\Package Cache\{e1d068be-adc4-418c-815f-83da627461a5}\windowsdesktop-runtime-9.0.22-win-x64.exe
    "C:\ProgramData\Package Cache\{e1d068be-adc4-418c-815f-83da627461a5}\windowsdesktop-runtime-9.0.22-win-x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{e1d068be-adc4-418c-815f-83da627461a5}\windowsdesktop-runtime-9.0.22-win-x64.exe" -burn.filehandle.attached=520 -burn.filehandle.self=540 /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_9.0.22_(x64)_20261102063012.log"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5900
  - - C:\ProgramData\Package Cache\{e1d068be-adc4-418c-815f-83da627461a5}\windowsdesktop-runtime-9.0.22-win-x64.exe
      "C:\ProgramData\Package Cache\{e1d068be-adc4-418c-815f-83da627461a5}\windowsdesktop-runtime-9.0.22-win-x64.exe" -q -burn.elevated BurnPipe.{4BA6062B-2F99-4BBA-B857-EDDE76462405} {A327AA7D-C8CC-4F88-BF67-EACCC2D52068} 5900
      4⤵
      Adds Run key to start application
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:6076

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4124

C:\Users\Admin\AppData\Local\Temp\Elsify.exe
"C:\Users\Admin\AppData\Local\Temp\Elsify.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.AspNetCore.App&framework_version=9.0.0&arch=x64&rid=win-x64&os=win10&gui=true
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.AspNetCore.App&framework_version=9.0.0&arch=x64&rid=win-x64&os=win10&gui=true
    3⤵
    - Drops file in Program Files directory
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    PID:620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x25c,0x7ffbc9ebc188,0x7ffbc9ebc194,0x7ffbc9ebc1a0
      4⤵
      PID:2136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1968,i,7417438090030919739,3646218343679239723,524288 --field-trial-handle=1808,i,6663459579554956141,11962025405680840270,262144 --variations-seed-version --mojo-platform-channel-handle=2160 /prefetch:3
      4⤵
      Downloads MZ/PE file
      System Time Discovery
      PID:5296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,10745026328942062398,7359997352243086470,262144 --field-trial-handle=1808,i,6663459579554956141,11962025405680840270,262144 --variations-seed-version --mojo-platform-channel-handle=1804 /prefetch:2
      4⤵
      PID:5336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2588,i,1678005682155966328,16120011881628271465,524288 --field-trial-handle=1808,i,6663459579554956141,11962025405680840270,262144 --variations-seed-version --mojo-platform-channel-handle=2796 /prefetch:8
      4⤵
      PID:4392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3416,i,11397392827697045766,9533856792256048033,2097152 --field-trial-handle=1808,i,6663459579554956141,11962025405680840270,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
      4⤵
      PID:5528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3420,i,11440907676405698507,275732642124932871,2097152 --field-trial-handle=1808,i,6663459579554956141,11962025405680840270,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
      4⤵
      PID:5544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4932,i,11022837479815733727,10360022073742509655,2097152 --field-trial-handle=1808,i,6663459579554956141,11962025405680840270,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:1
      4⤵
      PID:5088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3732,i,6593708739782232262,1294597678462241001,524288 --field-trial-handle=1808,i,6663459579554956141,11962025405680840270,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:8
      4⤵
      PID:752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5108,i,7261334129244714584,4595785591889685672,2097152 --field-trial-handle=1808,i,6663459579554956141,11962025405680840270,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
      4⤵
      PID:3548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5508,i,9093503155214967074,15881559461544405311,524288 --field-trial-handle=1808,i,6663459579554956141,11962025405680840270,262144 --variations-seed-version --mojo-platform-channel-handle=4804 /prefetch:8
      4⤵
      PID:3700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5720,i,8385060880724658119,2788094096713362714,524288 --field-trial-handle=1808,i,6663459579554956141,11962025405680840270,262144 --variations-seed-version --mojo-platform-channel-handle=556 /prefetch:8
      4⤵
      PID:3264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5728,i,219295816977455351,8344016753897121408,524288 --field-trial-handle=1808,i,6663459579554956141,11962025405680840270,262144 --variations-seed-version --mojo-platform-channel-handle=5740 /prefetch:8
      4⤵
      PID:5072
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5732,i,1476703237881258805,17806525046626286812,524288 --field-trial-handle=1808,i,6663459579554956141,11962025405680840270,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:8
      4⤵
      PID:4056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,2132931856588201217,13743772495900008837,524288 --field-trial-handle=1808,i,6663459579554956141,11962025405680840270,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:8
      4⤵
      PID:4952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,12932460964247464623,779995831730490349,524288 --field-trial-handle=1808,i,6663459579554956141,11962025405680840270,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:8
      4⤵
      PID:700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,13592373714944883991,13982765078180624620,524288 --field-trial-handle=1808,i,6663459579554956141,11962025405680840270,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
      4⤵
      PID:4908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6648,i,10080423700512343389,13486528665329825175,524288 --field-trial-handle=1808,i,6663459579554956141,11962025405680840270,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:8
      4⤵
      PID:4488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6648,i,10080423700512343389,13486528665329825175,524288 --field-trial-handle=1808,i,6663459579554956141,11962025405680840270,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:8
      4⤵
      PID:5096
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5520,i,7269708561102336072,5697968880731873092,524288 --field-trial-handle=1808,i,6663459579554956141,11962025405680840270,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:8
      4⤵
      PID:2624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3564,i,11020537855637390273,17505996871362594051,524288 --field-trial-handle=1808,i,6663459579554956141,11962025405680840270,262144 --variations-seed-version --mojo-platform-channel-handle=6724 /prefetch:8
      4⤵
      PID:5304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6152,i,17052297073804694040,1702124701526172523,524288 --field-trial-handle=1808,i,6663459579554956141,11962025405680840270,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:8
      4⤵
      PID:636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5504,i,13333644112441989501,2022584073485602875,524288 --field-trial-handle=1808,i,6663459579554956141,11962025405680840270,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:8
      4⤵
      PID:2004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5212,i,5868983179652525323,14069550690783930471,262144 --field-trial-handle=1808,i,6663459579554956141,11962025405680840270,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5228,i,12181608696982661784,14045075972970222477,524288 --field-trial-handle=1808,i,6663459579554956141,11962025405680840270,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:8
      4⤵
      PID:3024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6272,i,10134342722824819015,8382361105098274748,524288 --field-trial-handle=1808,i,6663459579554956141,11962025405680840270,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:8
      4⤵
      PID:4488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5728,i,14816914653853234836,9348334295145347961,524288 --field-trial-handle=1808,i,6663459579554956141,11962025405680840270,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
      4⤵
      PID:872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,16056010810857312744,17840484362286264748,524288 --field-trial-handle=1808,i,6663459579554956141,11962025405680840270,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:8
      4⤵
      PID:2968

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5564

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2664

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e593e79.rbs

Path C:\Config.Msi\e593e79.rbs
Size 48KB
SHA256 5a0adf1a5294054cf32b7c057748dfd489ee60e70708ac1c674bcc091615e5b3
MD5 b83dc5732d494f81e758dcc3a6e16b51
SHA1 7ea9091b0e26d74edf00c53aa99edd0508b56626
SHA512 079122ff1853e7e2999eb111e14223ce9ed27e791c9ffca95adc1d81be17a1297555484ee2ee4f139dbb0c082b02719a2d4d5353934f74a89274f050e89f6d03
SSDEEP 1536:MYCQVq/vLb/Dzy+JeuVAIh3lSD8rgo4+y6KCeJzHo5WzI3yo+h4TlqPRUW19kUxs:xpS
TLSH
T1F72300A89F02C1F2F2322D645760DD5973088FD6AB489C4E53CA875CC98DEE9DB681D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e593e7e.rbs

Path C:\Config.Msi\e593e7e.rbs
Size 9KB
SHA256 281b1f24e2ed808d81215fc8a845eb06c4e418ea6c9d200d04412073ca1d88fa
MD5 397932c955c289d7f7aadc1a97a497ff
SHA1 229b92c4aadaca879efc591a8c230e599f4c76e4
SHA512 1700f08e1165ec217505c4caa4fb8b99fa439a29f82db60deb3b49082819751da33fc564bea196a7ab64a1e6fab422fa985b7ee53b617cf29170a9f901fbf7d8
SSDEEP 96:ymBvnHSEU5gyrRNleGb3GUUeD2gFPJCsTlZUUeD2gFPJC6jvq+YrTlkYjBE5H7TI:zUEQD9eO5BFMI8BFMnlEFrucupz
TLSH
T1511251407B0082D2ECE22B34C7036B217B77E2D95651B34B09DE92648F4B78D1FA55DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e593e83.rbs

Path C:\Config.Msi\e593e83.rbs
Size 10KB
SHA256 c5d84f08c0c79b9f19404b2e41b59fe6ed75855f53dbdc4874874adac3c4a2e4
MD5 22bf95b19af5b90229a1014b6a754966
SHA1 87c5edd63fce734208a5a079bf3b62f3eb5b257f
SHA512 cdcdb1e5df452b6ffabb51bc360515e242e2478bf1ac07c2165b51085f20c2aafb75009a8def2ab9bf50df3b837d56c09bd3b44e82eb1e3c6f6ae9d0b3271f1f
SSDEEP 192:MWFX6+E5Hpx1/eX5D+FMIyD+FM7JE3ik6up6:MWFX6+E5Hb6D+FKD+Fxw
TLSH
T1E5222283EA2085E2E8926771C74757213B76C396E314169B25CDE1144F277C92FE4B8B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e593e8a.rbs

Path C:\Config.Msi\e593e8a.rbs
Size 87KB
SHA256 6643850023bd9ac970a5029325dc7662bf157b2ce05cfcc93294ed166cea033b
MD5 0a6373a15ae17eec077f1601ed984ae6
SHA1 176da9cdf29686d8c03507857f60cb5444a80377
SHA512 2afce5f9ac1b3b64152efa6ca35d0527c2e8e01c2659c04ed7dd27b290bdfcbdd8606de8a0492a7ffb20b16218dcebc03086609170de4b5d7c3801853c7ce9ce
SSDEEP 1536:Xg7e+565pMyMLR3DsfKWEs02zXYEqEVFeJPmJl8xhT2wdHCfuyl8lpd41R3RMzQG:QjqwRSO8xJEdb9YpEmfLXRA
TLSH
T18893035D5722C2D1D8333984C32FFA18FE050DBB67455B2A67C5523AE9E2A8B1F786C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e593e8e.rbs

Path C:\Config.Msi\e593e8e.rbs
Size 3KB
SHA256 0b5be2355a1f7a7839a9de8b3596d067d319a15ed74a432c133e5b6983b0f8b6
MD5 5e497e194effb41d6b893b350d5c287a
SHA1 1e10caf8f2e6c5e97fdff661df8a3484d2dec372
SHA512 d330065757f23e39a1144f35e6ef65bbe34aee5ee886458b8d304ecf494c2e4633855e65714a2e295ead3ce4af78f55548f0ee949022576bb7998b54c7cabcda
TLSH
T167716943DA14D692DCA22B70CE074B213777C3DAD725438750CCA1740E17B856FE568A
MD5 SHA1 SHA512 TLSH

Submit Download

e593e91.rbs

Path C:\Config.Msi\e593e91.rbs
Size 3KB
SHA256 f31603297d2c113c5bfb5e6f5e4f989f70eee47015f6ac47d01d2f70d39f6328
MD5 2efc6a0d95ef0d1a56bdd5a5abd1e531
SHA1 b15e6fe1820df0c9f2173b913a7e0400ea64a6e1
SHA512 ac3636266017f5a8a13d4c4617382b74169ea98670602a91665168d7114a302ea7d00bf443d7c668a71e6081116c5741729e612cf23e3b8c8c1fc36530e72ea4
TLSH
T1F9819B039E40D292DCB32F70CA1B172237B7D7EA9355438740CC92395E87B89AFD9686
MD5 SHA1 SHA512 TLSH

Submit Download

automation.js

Path C:\Program Files\chrome_Unpacker_BeginUnzipping620_1198033282\automation.js
Size 4KB
SHA256 dfc5596bf78e6b83c069c18092837f1cb55f40634500a4fd93cff0ca36b75686
MD5 26db57709242c137cb49f9ececdf094d
SHA1 e823dc2fac142a98a0ab2b7cd0b0881e12021e9e
SHA512 d223502285ce62d496c9a1b6ba8abc931bc7ac5adea486d85f1f7ca5a41beb9085a27f4ad4808545da05c6b6e3263e3910a1116838bd155b4a5dfcc766b0acb2
SSDEEP 96:1rOqpMXG4Eja7tzhr2W4KNgYCI5mvXzYUsChfHF+wRWctlyScN4Qn:1rOqGXLGaRNr2O6YCICXzzrhflbR5tty
TLSH
T1C49163D830FBD235C6A451DF92905195F35908BABCDDC99AE2054C0B7C7A803A7FE662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

classification.js

Path C:\Program Files\chrome_Unpacker_BeginUnzipping620_1198033282\classification.js
Size 863B
SHA256 eece6ab47ed7b6a2bdb651948f09aea7d72d177e66630c00c9fd440281a06a77
MD5 7c70357eeae91e531421ff766e4859a2
SHA1 41fc5855ced9858d016f22649e313cc6024e1a22
SHA512 b00a36d7261c85e2dd51fcd6c28dbf384ae4cea221a3177a2e7935a95f3c6894d2c38083ede251e2e1fa681538e1e071c39cc2d0b02669dfe960ca78873e8ff9
TLSH
T18311C0C6A58DDDD16BE365F3502861C3E3232136D981B43C36F7AE50A501E82D2F32E5
MD5 SHA1 SHA512 TLSH

Submit Download

extraction.js

Path C:\Program Files\chrome_Unpacker_BeginUnzipping620_1198033282\extraction.js
Size 5KB
SHA256 22881d4e6e323e8421543137a5fbdce3d6ef744e995270d5ca576055e3d59965
MD5 1561138d8188e5d6ebc052feb4246c16
SHA1 714ed534b4d036ed3c92c3bfc1cf1c2eae466288
SHA512 9defc32b50bef864e51676fb42dadaa64ff51486a23c2eef47b0f3ead9f915081fbbf98ebe613de2753919a973d913dd72f3580a41ebe9915a46f4ca9c6d5ac0
SSDEEP 96:C7nrFPByDZUae631B/WxTAbRNkRrNRP+wKtI4Re26L3YX28H:C7n5PADZUP63wqRkNRP+wKtRh6MJ
TLSH
T176B1711131F3E72183E151D441218596F719AEACBD2D84DAFF6D68C36CC19C3A26EBB1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

travel-facilitated-booking-bing.js

Path C:\Program Files\chrome_Unpacker_BeginUnzipping620_1198033282\travel-facilitated-booking-bing.js
Size 2KB
SHA256 c9f9f81bc1b32cd58fd3b307b57bf8f5c5507e7c3caed283470a15f3f9f366bc
MD5 392a2dc4c1c3055c1c870fd780b85d9d
SHA1 33d973d46cab26b27a341921dc75a7a546e8dfdd
SHA512 ce8e5546c9c4a8ab1f39838fe877f9c0a6c589bc055b85001ba157e86bcf91533d893a4d53b04281e10de41182a5ea7f4a502a84452157ec3ab005e2b0e73812
TLSH
T1DF41E0889AE1537181B770A95B1BB22B33312457343CEDC57B8C7B40BF84CB24A71B91
MD5 SHA1 SHA512 TLSH

Submit Download

travel-facilitated-booking-kayak.js

Path C:\Program Files\chrome_Unpacker_BeginUnzipping620_1198033282\travel-facilitated-booking-kayak.js
Size 5KB
SHA256 d084602d6fff658248603c6bc4bad7b6056c08b5df1b294b2ff3a2965e643cb4
MD5 d2e6e4048b8e7cd4734a6e55ec2cc0d1
SHA1 d387c7d9474d527926262a94d9dd161edcc0648d
SHA512 739b7f31e64702377a365cb1eacb445d72050fc4169733c0718bf2755bf428ac7411d9b8db19fd91cb62c381d3161d1741104d4564cdb971e5636369ef1137e5
SSDEEP 96:PDHykezorcuwsybYrCaeJfZqJtTvUnoGRqpNHyjqmdw+AgAspitSMV3y8yqdi6JR:rykkorKpACR5ZqJlU6DyumGLgBUnMMlX
TLSH
T184C1EB4A21FB1B27016F786F9A97501D7720A18F3616DD407A4C33143F92D30A6F2BE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping620_149701808\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

protocols.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping620_1688591678\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

nav_config.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping620_1943698138\nav_config.json
Size 2KB
SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
MD5 499d9e568b96e759959dc69635470211
SHA1 2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6
SHA512 3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905
TLSH
T16B51DB73D5988C4B9BF4A29CE919A309F11107CF75D48C0B76BE010C1F7757AB5C6588
MD5 SHA1 SHA512 TLSH

Submit Download

llm_user_input_extractor_config.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping620_2146356665\llm_user_input_extractor_config.json
Size 4KB
SHA256 2056ee7ed0e7adb69344c93a024158ee4e2332ecd50d183dbad7595c4d588ed9
MD5 7736ccfaf720ef9b0db919dd01c4bf8c
SHA1 24b48ec2dee093b8e4384ad1e25ad8f12af0831e
SHA512 f044ed3b6fee483d211328df83f26b98dfe47890c05409c65c7f7333fde1fc043cd1c05d18250e8ee8731f355c13b3a0aedc0e60b82a26c42a7f209a69ad4781
SSDEEP 96:a0y3Cmyjw2w61skd7GZrlWqPZ96vOim87Ai:wyOy7k5rx0WVS1
TLSH
T11F91DF3BD8A15C2B00F3B225B87A7642F534A35B27C05C5B7A7C5A1C8FB6D312582F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

office_endpoints_list.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping620_2146356665\office_endpoints_list.json
Size 9KB
SHA256 f0c77aaacfc571e0bc3f51387febe134d991bf3c7f1941af303ed901f288dcd6
MD5 30719122f9edf4e23019a3b74e4f4325
SHA1 6707d64052797b9c5f1a5ccf016e5859c8ef898b
SHA512 ec2e1a33fcd1301f282512ffafb611ea705dc5df09d9aee014276909c1b62b0c73600121d94e9b6d9e160296672b41f2cb8c3ba23f121244ad2ea6521680723c
SSDEEP 96:DdQ/JJvwjyUsrdfsysVsnQfbJNZidYusysXYs2sFsdv12XvlRT07s/DkhcrHPglW:D7d7mfgiIWRcV4sobxezQd1Y
TLSH
T11512BB3BC4B49F229AB060659705E244F13C43BF5600C6FF76B9829C1F366ECA58E1E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

smart_switch_list.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping620_2146356665\smart_switch_list.json
Size 2KB
SHA256 d490aec3403b2daa86aa095db121c2dfee0a35c3ed0770284c0bd0e0a103c776
MD5 a55a23fcdd9af97d33302c8e6de41c18
SHA1 00d9137cdffd273ef849e1122ecbb6f27b6e8423
SHA512 647c19d83bf4db3c4b868738df3a8da0b06f666860f468a2de6863e440800bd5e4057ac03bcae4b5bfed28a8907038bca6a72785d42e7acb6f56580a6859b05d
TLSH
T1E4519EB7CA215CA005B482B16338509AF82827BF62C98AEF377D5B1C3F744B425981E8
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Program Files\chrome_Unpacker_BeginUnzipping620_888405534\LICENSE
Size 1KB
SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
MD5 ee002cb9e51bb8dfa89640a406a1090a
SHA1 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
SHA512 d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
TLSH
T17D31535723840B9306DA2B4566AEBDC4B0DDC02D7F27AE05186EF394537B52ED8B3443
MD5 SHA1 SHA512 TLSH

Submit Download

verified_contents.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping620_888405534\_metadata\verified_contents.json
Size 1KB
SHA256 c9e76a313bb06d9d761611d7cb8c2ab8de59eb9959b77458138630dacebaeb0e
MD5 243afa1f565d5789d05d9762162cfa32
SHA1 7c7b6757be9b6ae391a59b940ddfb646cf6ce732
SHA512 671b53dd21e4566df6fb4ef811fb95382447f57a82d497de029ce1528aaaa47f26277615f6ca91ffe4834598b2a0b5b78ec2f2dabed2ef704581cbb990ad67a2
TLSH
T11F3119B8380E324F90A7E30425BB9D33534570BE13E0A517B1C26A4E5598A40B2732FA
MD5 SHA1 SHA512 TLSH

Submit Download

keys.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping620_888405534\keys.json
Size 3KB
SHA256 b0724d5592e6441a840c6622d7ad51caad2564a3746e563ce1f1bbde30944b2b
MD5 a86e3ddeb60db5984686f5bd89a95646
SHA1 e5f417a8f70c34b293ee20bb9f54a423a07982ec
SHA512 f3df95b51940a12ffd2d58648c302fbd649dc3097e0961a86da65e324690488d1b3d80c6267a6a0685f220a89c279ba54cb56fc02f19860e99ffcd6448cf0db5
TLSH
T19971D6BF14A40082CF3BD16A8F0735A78FB23C0623C67AC3965FE94A04425AC276F475
MD5 SHA1 SHA512 TLSH

Submit Download

ThirdPartyNotices.txt

Path C:\Program Files\dotnet\ThirdPartyNotices.txt
Size 77KB
SHA256 e8ddd95ac905467e4e519b446ca023fa00c31732bebd9b66e65101c712092ee7
MD5 406d07d20e58568365df0557629fadc6
SHA1 9ab5ba1ef3866afa75b8cf3c392b7dd3d7f52026
SHA512 c6025a947faa5dc2b41a14d75e228ca2bd0df094e8cef914c58a6d2f5854424972a647b2c8ca8173345e40ba7557843d03efa85c5098c6e0e6726377efc8a38f
SSDEEP 1536:HA9jHwsGfgg39/zwgAVkguQxrDjugtSEGepkWvrpX7anuqdLSVnfiStPq+3Lefrb:HA97w/ogz1AVxuMjHtSFULryLOgrGWwa
TLSH
T1F573A45F7E45077319E2C3916569A8C5F22FA02E3B6B2A44346EF248133B42DD6FF858
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 157KB
SHA256 c16771e660235d63ae509966c0908664c1c2850dff3869aece8b8d060dafd773
MD5 dc2d09dda78d7c968a75bdd2be6a1ac7
SHA1 29787324781ca803acea29f4a1bb26d018b03270
SHA512 90a82845bf80f35477791b9b73ad36bd7a1eefb21749ac061af038bfbc1e7aba1326a987379586b2a16fe9c7cf58a804c5d626e8e9c30e9257633c42fc4dfc48
SSDEEP 3072:UObbijC+b6mG/AD0Rhb2p/EFEcN7K99z+RlJ:7/F+b6mG/uIhtWWAA9
TLSH
T1F7F3061AD65811AAD1AE9571C7518A41FB337C6687E0E7CB13D0F8BE0F326906EE9703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet-hostfxr-9.0.22-win-x64.msi

Path C:\ProgramData\Package Cache\{404EFD89-B0DE-427F-8597-8049202AA283}v72.88.61666\dotnet-hostfxr-9.0.22-win-x64.msi
Size 776KB
SHA256 91d460512ed575507fb0b7e28d542af087b0f746a31ecd8e5bcb4779d6fa2cdd
MD5 1f377f2ba0773838d6403314dbd204b7
SHA1 73eb52ebbc3209e69c53e4eb3003d7771c4bdcb8
SHA512 c3bc4701cd671ea04b7b253765603df94f35209a0aef69f5dd2318fe5bd16d70aac1936c6427f94dd860c9fabb7f12cc06fd5b08b316c094a83f9bc789b2717b
SSDEEP 12288:XRyMaM1OPo49V1EgXmEI3os2Qx7E4D4Rxbp4K+1uiq:h9UfXdc3/7Rin+s
TLSH
T18DF4AD237D80803AD8BA1D71953DD7B16B3DBD204A64899B6380B91DDDF11C0AF36BE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

state.rsm

Path C:\ProgramData\Package Cache\{e1d068be-adc4-418c-815f-83da627461a5}\state.rsm
Size 932B
SHA256 a043d5dd41ed5ada12f8a5e77a910068604463c0596f35e683f7a6de5fb910fd
MD5 1141dbe340836147af3b234d6e120a80
SHA1 2a6c5e66cd14dca2389de521d4b54ac3027a23a1
SHA512 95904f1d0bcb2cab74b2c78a7b701ae6828c827e330dcac2415f4e58289d274ce43f69bc6b3e186f6970709bf2ae730ea679ed36a7faa91b29ef3447a5b3fb6b
TLSH
T140119A555FFA0629E3FAAB3069F42711643AB8160D32C16C0081318A8F31BA0C874F77
MD5 SHA1 SHA512 TLSH

Submit Download

0e5e6745-4b78-4659-814d-d35196caa8c9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0e5e6745-4b78-4659-814d-d35196caa8c9.tmp
Size 8KB
SHA256 50b8de1eda6c11f593a9b31aac0512a7b0ea43571ad27df24cda598dc92e7911
MD5 2901a9f36322186758b1826435660546
SHA1 f894e12abf8511fe6c93ea7c8a877b25183b55ce
SHA512 09d09efd67dacf430371efcdbac4e3419db66fb7cef50d1eb256cc7cb2427777564b343cd3d28752a4f60860578c84bea53cab4b3b9affddd30a361804e72239
SSDEEP 192:6ONh6wlDGQmiUySUv4X58gZxjzorvA7w0XN7R+2fvejqPxU6:6ONh6kigv4X58EN8vAU0Xf+2+2U6
TLSH
T131120635F46DEC275CE2A109B48B36539FE52067DE85AF80D6EC0B1C00D769D2B9B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2376a593-e0d9-4a3b-833c-d7d55559eefd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2376a593-e0d9-4a3b-833c-d7d55559eefd.tmp
Size 19KB
SHA256 b3029dc921c980cb92fd58b2eab255fe1403e3e47a8531db4dfc43bc887b35d2
MD5 fa56e9fdc34dd2ee8e8f9f0813e7c028
SHA1 29940bd8533c1258e3537f9a0f2042b671e7f7d5
SHA512 630812c67f24eb932622ad6c1ce58b91ac30dbb0c0504b1ccf279823f202e06317e34b654eed85af337548f9ed1045ef87aeaecfc56ef95f05f816c2e9d71722
SSDEEP 384:n8QkUSvwsNT14SblZlBtHX58EN8vAU0Xf+2XCLH7vBE/SI/7IzRIIlF:8wyll5aTcflXCLH75E/yLr
TLSH
T128926C75A869EC6709E7A105F25E3A43FFF46067C9C42F90D6EC4B2D0086289374B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2f276cc2-6a77-4458-b03f-ba9b8ad82e9b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2f276cc2-6a77-4458-b03f-ba9b8ad82e9b.tmp
Size 18KB
SHA256 083febc0a0502531e2be3d386a6cdfed88be265b2fc39d9a7a5ea6532360bea3
MD5 abaa319ac9277451840306039411aab3
SHA1 b3f53602043c697712704d4ec1ff840c61970c17
SHA512 aee052f2000b7c1d8c3470f154dc42b492f204e5508afd49b09ce92ad1418c020944665200ed71841d846ccada03ef1ca3b30f3d5c8374b9be8cd2ba1b89a22a
SSDEEP 384:neQkUSv0sNYJ4SblZgLtHX58EN8vAU0Xf+2a2H7vBE/3IIl1:O0tlc5aTcfla2H75E/3Lv
TLSH
T1DA827C31A869ED2709F7A105F24E3653EFB46067D9C46F90DAED8B2C00C668D374BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3cdeded6-e730-4e09-85c1-9b40f701a5bf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3cdeded6-e730-4e09-85c1-9b40f701a5bf.tmp
Size 24KB
SHA256 3b4d9b9177dc2c0f0dc9f83030068e1b589114b6d2384a4a4a9280a18f4b881e
MD5 72ce22f14566135606894620acf21d40
SHA1 c908a450421fea4c4bd141b0a1e8e1c48b61da3f
SHA512 8645ec1f782d5611e791aefa2b0f290917a8d51d26f6bac82a285ea4c9584ae9e9bfa996d0dcbdf0e52629b5820b2bf87b7e5888ef28ceece3eb3296def645d2
SSDEEP 384:nCiFGQkUSve3sNt8TUNTUlIlX4SblZlBtXDfeVX58EN8vAU0Xf+25CLH7vBE/SIe:JFmGswg5llo1aTcfl5CLH75E/yLr
TLSH
T101B23A76E895DE2BADE39785F31A3683EFE01063C9C85AD0DAD95D5C00832DE274BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

66aa71a2-d22d-4a5d-8f28-f18ee2fdd4b4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\66aa71a2-d22d-4a5d-8f28-f18ee2fdd4b4.tmp
Size 19KB
SHA256 e48a603b640e431524b03aef7fa4ab682d380f294044a8b002884c2313fe6d29
MD5 6a6a07ac966f3112ff263d2027ece332
SHA1 e34f1f2d43214ffbc5d44b2c23b8e3c603c1061f
SHA512 7a29e749fe6db4fa30d87d0d380c21bd3e9cbc9bf647944e1a7af610d2aa329f615c859ed05b55019236c3fcf1d50cc017f7c70b3a28f2f8137134d16f8f7c24
SSDEEP 384:nKQkUSvwsNTI4SblZlBtHX58EN8vAU0Xf+2XCLH7vBE/SI/7IzRIIlF:ywtll5aTcflXCLH75E/yLr
TLSH
T1AD927C75B869EC6709E7A105F25E3A43FFF46067C9C42F90D6EC4B2D008628D374B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 58b461967016818ce2213ba739aa830e079c4747cc98baea5feaffc8b09c915d
MD5 8800a672498272bad98dd79644e30101
SHA1 14a42c33d6271869cc680cadc5ae061e7092e3ae
SHA512 a17f90c73859841f3e0a3211d7f8d1027a7f8ec3a4ef87ddc96b1a39e0b52bc65decb3dd694a7092e22f06f2124864535e2e8632387dd42184abe2d3e22d7e12
TLSH
T135D022F2F32200E8C8C02A3C20030B080208C8000C833220C832C0C23ECCBC0A88F08C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e1441bc9d733d2b51647a3c9ba8cb39dda5f1f0eb3c16b3d22d800b5961e82d0
MD5 4f6f4b8c5cd14e5f2c4ed038c7eb36bd
SHA1 d5c57262b357df18256482029ae1e6e61ae1fa2d
SHA512 0a060463a7a268a3d817f591ebc29f02e12753b21c08ba4cc4aec0e43cbab62e8f65d464889be0b2ceab2759b8ee067bf34b26af0dec629eddf4dc49b21719a5
TLSH
T153D08075B3573D5CCF8E6575154557805100CE035847552059134D141D8C7995D855ED
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d5971e00089461dd4760f2e503146c274f3e3077b2b96a6c812e6a8d2ae562ab
MD5 3906e976cfd9415f22038981e3c9acba
SHA1 52e18f2db318aa2bfde64edb31a46cbb3cb668fc
SHA512 f3daaf64b46c1a9f00e8452997e580bd0974d3af38f95a63392b5eaf254de45bbef88c8c1622ecd4fd95cbe5aeb14c6ccde045964ec3512f8115d88075c4b362
TLSH
T13CD0C075B3173C5CCF8E6134190047805100CE030803152048134C140D8C3891DC10EC
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7b81d8521f4289b1259fa60587a7bc7131f06581c3a734224a7de2fe2669bfb7
MD5 46bc1ee7f1b3386bbc305d48ade31614
SHA1 b5e469cf75c16715fb850bd86db01e329da2928e
SHA512 09a97914c725107f4c125aa0ff0826f0410030841011f0bc5c9eed9e023261ab13abc5f59c9c311d02baf1b25e7398de5ea81438c8a8ede3cc60ca3906edfce9
TLSH
T152D022F2B3A208E8CCC02A3C20030B080208C8000C83B320C832C0C22ECEBC0A88F08C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 49ad6872da0e53fa2156de2ab29aae15d756e399214100166ee3b981776c9e71
MD5 ec47d7bcfb6fcae0bf0c2b01172a50ce
SHA1 20474467d868ddc238b4a6f05bd8c60a9a69235e
SHA512 38fc241b6dcada0c5d074fcd3a03d2786292deff2b4e86af77e745f823ab3f7a20920fec3c454838305c94f586355a5c360fd844cb107f4a9279878245548c61
TLSH
T19FD0807175273DFDD19D667C05515A405104CE53595115108A134D551E9C6C27CD3EDC
MD5 SHA1 SHA512 TLSH

Submit Download

2ab9222e-0a0d-4144-bead-3ca5c32cd6da.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2ab9222e-0a0d-4144-bead-3ca5c32cd6da.tmp
Size 11KB
SHA256 e95a4543d62d1614fb5220c5d7a5a32ca7b535b92d054a1fb51680c434afae59
MD5 f77399a1e9825e2cedef8eb62c23134b
SHA1 257e728322e616b0b8b36afbc4306a1055549a93
SHA512 7834841c70445515dc807132511c03406a117c5271c566391a76bf6110295c36b796136f60a4772387e9382422cc039c7a2a79760340275eb607859e5ca69b82
SSDEEP 192:sxZGRu8p/fbszWpVpUaTPIdpwRHW6+WNZFKP/AUrbJ0CSIgboJ:sxZGVp/fbszWvpBg4Hbg/ko
TLSH
T19642C752AD38A97B8CC6D21DFA15BF13E6F9103291D52E54ABFC8A1C01E77DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

492fb90f-2aca-4c3a-9da2-af6933ac67c5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\492fb90f-2aca-4c3a-9da2-af6933ac67c5.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4bc0e6dc-c3e4-40ac-9bfa-158d9e9a0612.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4bc0e6dc-c3e4-40ac-9bfa-158d9e9a0612.tmp
Size 414B
SHA256 c225f8af714ab84058a4394eda26f6ebe1af8a6ac3ce95815c23b6d45b1095a4
MD5 b04369011c73fa467a78af40d235076b
SHA1 229b8b4425eeae7a360848857ba9b1df8d084cfc
SHA512 1872ecf5a3e33b2542194a84c47d3dcac0cdfed331d2aed6115556240b1d800f3733707ade0bd29e953b07ca33671456947312950b1282ec8afb2afded695e55
TLSH
T139E02BA6CC35FC2B28FD0B5850540B8BE78013673A40545B7B3C81084FB0627029685D
MD5 SHA1 SHA512 TLSH

Submit Download

65725fd6-4f09-4bad-9234-3f24404db4df.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\65725fd6-4f09-4bad-9234-3f24404db4df.tmp
Size 12KB
SHA256 bf5d4b609f607413308d5b8a662fd0a40cc69773aa186700c047688623461b61
MD5 e956b2f8a4b84c0cc4b3d28ef7f7f01f
SHA1 40af4a1380503e5fa8cfff3a2aec81fead9f7943
SHA512 40f33f068c549d4fad8433b91120c3aafe34fb621d9a7223d2dff5d200e203da4b2722c2ac856c132811370e4af71cb037a2a0495b89f707d419a42874cc51e5
SSDEEP 192:sxZGRuJp/fbsPSWpVVEUaTlmUZizodpwoHW6+WNZFBOfAOffc50TcIgboJ:sxZGGp/fbsKWvuBlPZ9HbUfuo
TLSH
T1F352EA02A928A97B8CC7D219FA15BF13D7F9503291D12E44ABFC8A1C05E7BDD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6c573125-0a2d-475b-b8a9-d9ad6d45b3e2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6c573125-0a2d-475b-b8a9-d9ad6d45b3e2.tmp
Size 10KB
SHA256 c88b740834c6feb017e2fd9fa83c2ad39450ea84d8cf096d90ec7a9bc35ad571
MD5 48a3d16bec4ee67cd75762873c65fdb3
SHA1 bb4083671bf3321342bdf4aa61375a0dce610694
SHA512 86c70373326209dbdb367988304e28093efa36358c4754c885a463a2306252dc128b863c63396748ad238f0ed70733618c1a20a25061b34f613845798eeaf701
SSDEEP 192:sxZGRcVp/fbs0UaT6IdpwRHW6+WNrKP/AUrnrtcIg4J:sxZGCp/fbs0BT4HbQ/uc
TLSH
T1B922D952AE38E97B8CC7E21DBA18BF13E6F5503291951E54ABFC861C05E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6dfc6a9d-43fd-42e5-8cfe-df5bd019fd26.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6dfc6a9d-43fd-42e5-8cfe-df5bd019fd26.tmp
Size 12KB
SHA256 e626138a300b61b5437f9e0073f843ac33aa3ae31252300a6cdfbba19bf4e685
MD5 4bf706876def4c9700fbece1473114c8
SHA1 4e2bb9d3d53e61f7e530b59476b469613030389f
SHA512 03c4e4acf6d8c8284662c86fcf3aa0ea6876edbfdfd65f752c3dd44cd3ac107659e4e37616249fe18c7668003117fba8a6f62c71886dc5992328e475a3ca40c2
SSDEEP 192:sxZGRuJp/fbsPSWpViUaTlmUZizodpwoHW6+WNZFBOfAOffjr0TcIgboJ:sxZGGp/fbsKWviBlPZ9HbUfPo
TLSH
T16142E802A938A97B8CC7D219FA15BF17D7F9103291D12E54ABFC8A1C05E7ADD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7b547456-21c7-4790-94d4-e6acf19f5802.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7b547456-21c7-4790-94d4-e6acf19f5802.tmp
Size 13KB
SHA256 20a79b1236ec786dcca8825357c62b4b6ad2b5b397d5144494d4e45d4afc9fc5
MD5 99cc11a0e92797e54929dcdeb613451a
SHA1 4d6e1fa7d7bbd85cfb23685c2ed157c56a731de6
SHA512 488e2bb8475126c9ef4195cec3b805511f3952be1c7f14f76d11072769acc7cc168155b8c137ab88c43c90ec097b330e0e88d5d7a0f2fb7182e90e9dc663a69e
SSDEEP 192:sxZGRuJp/fbsPSWpVVE7aTlmUZizodp6oHW6+WNZFBOfAOffYl0TcIgbz/J:sxZGGp/fbsKWvualPZfHbUfanB
TLSH
T1CD52FA06B928A97B9CC7D219FA15BF13D7F5503291912E44ABFC8A1C05E76DD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8c668d85-613a-40e9-9f12-07437ff3111b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8c668d85-613a-40e9-9f12-07437ff3111b.tmp
Size 32KB
SHA256 8f3b9ff7114a630643146be94bb10dc7ed1adc957d53c9556942339edbc94998
MD5 0f2df3d03c47c92390973fed86e7248d
SHA1 2cc617ea92ce2781357593298bb78b0f020425dc
SHA512 f8c8e2c86d665d483690efeed49f4fe710f671e2975491503a2c5fb3602e776663a90b5f27b8b215e3458182b7d531f6057ab303caf73dd6f4e358f3f03f95c7
SSDEEP 768:Kny4Jjw7pLuLj/DWvbtBh8F1+UoAYDCx9Tuqh0VfUC9xbog/OVP+jiLlc2Tblro3:Kny4Jj8Ej/DWvbtBhu1jaC+jiLm0bePf
TLSH
T1A8E2FA3B780DCA7F4F800A9DED1E7F9F6EA8028B95D8C94047FA945C02D67EA51160DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 91d94f0d8260a2dfda39620b1049853c3191d1e7a4758302ee3565ced8167527
MD5 dcc4464f81161912896e2f583996cbba
SHA1 cfac57942d76c143796fa0d3541f617ebbf95c06
SHA512 e03a9c9697960f7f46bb280a54c08eb6340b349a2223fc988bd43f96285e9a9c7fba80f5bd8192dd98e6213f7aa6cef12dae74a63ad4cda3a81cd46388ad81ce
TLSH
T14BE026AA07CAC22FB308644B09EA578CC3E0371F93C0A90F9B49CDCE7201250A3C66A4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 3c465a02130cffb526c16243246f24224532f6706ed3788b0b3907978d56a1e0
MD5 c1e9ed0db6bc2ce02dba23d8cc2dbf0c
SHA1 0825b719dc1367eb42d7c63054528c6514b45467
SHA512 cfcf2d78eecabed9b548935b765f03da0ff951d154ac8c8b31f86ac86c41be26dbfd782484edcd3e6460dc1d3ed40243913827b194cd2eab1d6205e12502ca4c
TLSH
T166E020B955C5C31F7104A84701D8CF4CD1C0771FD3C1B94D1B04CAC870C21407B85769
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 76ada0d94eabfcae285303168d72aadf3cee05401b64082d890cf95fc073817c
MD5 e99859fcec402a062f5216be76a4774f
SHA1 09f13398b10533e6fa13a667196603d969a3a942
SHA512 f62ef08aee4a224f23b0fb76bc1fa11cdec199a7eac367e5d024ce301a82ae60c148315fdc6853f0fe786997586e39b20ca876e5cc859871b44313f7c74d81e2
TLSH
T10971B8AEFF4AE26EF7944430EDEB2B97393C0CA338C3DD4314ACE67A64867584152064
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 1a2465053d2cc6ff0733e11f918bbd0198ab324fa919329b6b29aed6f0938a57
MD5 4e8f6d86f5a767e95d5dee6412c6c68e
SHA1 403ad600efeba8a623cb127f23fbf3a0adfbaaaf
SHA512 24c899ee554b93e9d8b65e7eb5041765d3acf1fc0bc1ebb28357175302b06004237d9e8430d8d2bfd919b4dcc5400943ab9831971a5671bd72309317cb29659f
TLSH
T1B971BC6EFF5AE26EF7944870A9EB2B97393C0DA338C3DD03146CE6BB74867584112064
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 c53ee4982fe8a1cfe0d6f0a66ea5eb9445526bb06d626b6f87103021c9efbdb2
MD5 156c1cfc70448cd1601f3993b34be1a6
SHA1 ede7fb67e117cc1cc9afcd668bf8dfebb004e6ca
SHA512 4d7b367d4e958512032299affa843125a3c6fcb33229639246606ad50a8ddd3bb93a847d3e5d3b61ee225c3c561ca99cdef7aef79988770085a4f1a0f7e690e5
TLSH
T1B16153AEFF5AD66EF7944070E9EB2B9B393C1DA338C3DD0324ACE67A64467584112064
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

46079743-43bf-4481-a47f-4aaac2410445.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\46079743-43bf-4481-a47f-4aaac2410445.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.111.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

18478578-1348-4057-a663-bdfdd590cbe3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\18478578-1348-4057-a663-bdfdd590cbe3.tmp
Size 3KB
SHA256 7d6d56824cdd5df989e39f940b32ef3014030c007e4fff600d5a43b2b527c151
MD5 d44081404b7fd74fad05bfa50ec001ed
SHA1 43d01edbc8bbea9b1681fe55b485d9e853ed400d
SHA512 6b07475b0a749686137e4d9cdd62b582e8a80c208895595f119638e29e4469cf7c0bacb13ec424c619badfdd81350d240b6677431d999121ddc567b6c8611f01
TLSH
T173619CF783B4856ECA0196F09A18EE2FDF2D0615431C7C6989D4EE27D7E3472E10269B
MD5 SHA1 SHA512 TLSH

Submit Download

73b6b4c2-ee77-4b31-927f-30227110a1e0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\73b6b4c2-ee77-4b31-927f-30227110a1e0.tmp
Size 3KB
SHA256 29a884232758d37e4e4111ed9d0d62992b2293fc3926862d733962c142db96f0
MD5 72455bc575763fe0f829022a7a305283
SHA1 7befbc666cbaba5b8538e436f06685f52d89350e
SHA512 fe9949bbd6c1ad4b084ad563802debb816b04726c865e9356fe7af37e95dbee2715deafb78f9f4405e276270681b00cef145400078e922a18de413c9758e1e38
TLSH
T1BE71ACF783B4856ECA1196F09A18EE2FDF2C0615431C7C6989D4EE27D3E3472E00269B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

a4f64ea2-4d49-451f-8609-292c7a4fd3ba.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\a4f64ea2-4d49-451f-8609-292c7a4fd3ba.tmp
Size 3KB
SHA256 357513ca85eead4bbba8365aca6fe1e376f695723ca3efd7476a7f513f3730ff
MD5 7e9d169596364f6c2f1adeada5a85cba
SHA1 eb6a13b85bd858ee4ca43ce0e3396482ae77b08c
SHA512 7c6116eb4bbcb7aacc56948acfcc3121d0d92ed2de107ddd491c068504b25f103969c05d2926ff44b9076d568474b56006bb44afc05c947f2ffae301013c71ae
TLSH
T13E619DF783B4856ECA0196F09A18EE2FDF2C0615431C7C6989D4EE27D3E3472E10265B
MD5 SHA1 SHA512 TLSH

Submit Download

ab69a40c-13ce-4f01-8957-e76c8b956acd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\ab69a40c-13ce-4f01-8957-e76c8b956acd.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

f7069721-5470-4161-ad43-0f2ea035b632.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\f7069721-5470-4161-ad43-0f2ea035b632.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 6d3232f017b9e5e63c6cc52fb6aab7bc29d608329c6ecdeb57fb4511296e5874
MD5 3ced5518aac15a8015a9c0be51ce576e
SHA1 b3d61e01b646b47585585cded833e033010675c5
SHA512 be992b6d9337f7969e9ccc64c220fcf67e626d6af4589c81dcf084da255092b8747cc43cc32b3cac18444c4beecf665a4287f07d2bcd7d94074acf158edca548
SSDEEP 48:KIDI1Ks04jylzIJKAY8TydjIdKA0ogPSb/r:KIDCKs0+GziKAYa+jmKA0Q
TLSH
T13C91F258706B13093ABD2A4D40FAD59B128171B77068E4BF3FB9D4A14E67E104EFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c789243d-698c-43b5-9c06-b132e1e3bd9e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c789243d-698c-43b5-9c06-b132e1e3bd9e.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

c7dbad0a-25af-45fc-9be5-109e7580443f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c7dbad0a-25af-45fc-9be5-109e7580443f.tmp
Size 11KB
SHA256 77890b632b132915505a080bff1f9e7bb21235583dd589c01e94aff2a18a022e
MD5 fc4dd8396c5ede06b66ec162d7fb9fe2
SHA1 e2c9db0f0e52e72598e0d96bd1e7fa6cb6231674
SHA512 acf36645b60d55ac69dc73412789845539171321a708553d5f78abd8ddf29870f8754cf5827cf6ba4f66ba067083514fce760b1ebae39be498ec995785be6244
SSDEEP 192:sxZGRc8p/fbsgUaT6IdpwRHW6+WNrKP/AUrnJtcIg5oJ:sxZGTp/fbsgBT4HbQ/sC
TLSH
T14932D952BE38A97B8CCBD219BA15BF13E6F9103291951E54ABFC861C05E77DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

e0edf790-9608-4ec9-82bd-6032fc8b6d26.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\e0edf790-9608-4ec9-82bd-6032fc8b6d26.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2026.6.5.1\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Travel\1.0.0.2\manifest.json
Size 135B
SHA256 cb929ae2d466e597ecc4f588ba22faf68f7cfc204b3986819c85ac608d6f82b5
MD5 4055ba4ebd5546fb6306d6a3151a236a
SHA1 609a989f14f8ee9ed9bffbd6ddba3214fd0d0109
SHA512 58d39f7ae0dafd067c6dba34c686506c1718112ad5af8a255eb9a7d6ec0edca318b557565f5914c5140eb9d1b6e2ffbb08c9d596f43e7a79fdb4ef95457bf29a
TLSH
T1CEC09223CC019CB119743B642AB2AB82F7B41B0B6869705A3AB3148C1F7E1B48082680
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2026.10.12.1\manifest.json
Size 80B
SHA256 abe933f0db95b1a75786da21de82feb5270ffa7ae072270923da2437710d93ba
MD5 3790d9257ba14f8be2ba08acf259a57f
SHA1 c54ab2e79d0ac9dc27425c7450e01ad593f02d60
SHA512 9568fef732369f06aafd8270638a38531a26f6f40a1c7c65fb7254eed36807789756e1c6efabaec86017b3decead2773de9ef5814650dbb334e6000ebd44a467
TLSH
T1A8A012605811E13310C403700260438243E01C112015240405461140218823713A3129
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

cf271258-169c-4606-acb1-5850fc1c9a2e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\cf271258-169c-4606-acb1-5850fc1c9a2e.tmp
Size 24KB
SHA256 2b7dc5a9c9bf4d100feeeae40d5a6f245298bbab643d5d152e5a56f69678914e
MD5 af81af178f50e95dce4052cd08512ba7
SHA1 9ccbc1b91dd5df12c69677b08bf2e4b6bd5ddcc7
SHA512 e5dd0428514f57b12301bff699562d44c12ad6171abe689d884348566dfd1a59a5986d1246126ee756b547651e130a2699f4ff2a5cac1f4747f1bdaab1c47ea0
SSDEEP 384:n9FGQkUSve3sNt8TUNTUlIlX4SblZlBtXDf/VX58EN8vAU0Xf+2XCLH7vBE/SI/2:9FmGswg5llx1aTcflXCLH75E/yLr
TLSH
T13CB23A76E895DE2BADF39785B31A3683EFE01063C9C85AD0DAD95D5C00832DE274BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6023e07b-e0a6-4781-9d27-290fabcee200.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\6023e07b-e0a6-4781-9d27-290fabcee200.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

65b55109-fc6f-42cf-8c19-368dbb15a237.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\65b55109-fc6f-42cf-8c19-368dbb15a237.tmp
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

7972e8c8-91e1-4934-8013-9e8a3e45e192.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\7972e8c8-91e1-4934-8013-9e8a3e45e192.tmp
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

acb6460c-0247-4336-9948-27fb0f6bd049.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\acb6460c-0247-4336-9948-27fb0f6bd049.tmp
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

b4b19f60-b647-4324-81ce-db385e00e662.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\b4b19f60-b647-4324-81ce-db385e00e662.tmp
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

cfd4c58a-1c9b-4335-9562-0393096f2362.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\cfd4c58a-1c9b-4335-9562-0393096f2362.tmp
Size 612B
SHA256 aefe41ba49514b111597c7f1d7c4be25749a5c72259d4deeeba6393a98942c23
MD5 4979eccaf0b564a0be3a74243ff501d5
SHA1 f2eb355e1da53299417438cdbd859a325e9513c8
SHA512 84a1e794b4ba4e190cfc8fff8859eefe20120a2e923c9efcb28351a42dbe0210ffd8d1317c8de1f31ad0cce028e1348ce14ea878921aea32f7d4de5e7834b7b6
TLSH
T1E7F00C808C391DC5C6B90F9FA4032AFC40C84A26B0C8387814CEE89CA43A05F3111CBD
MD5 SHA1 SHA512 TLSH

Submit Download

fc24e37b-bc07-4de5-927e-b054fd02c19c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\fc24e37b-bc07-4de5-927e-b054fd02c19c.tmp
Size 23KB
SHA256 cb2a56370dbd5fc88530d67080fe5057d5ff3381e25b610dd8ff983f1a0186b9
MD5 99a9592b2dfb67f07442add85c47b922
SHA1 99fafc59807260415902be23605f07eaae324d30
SHA512 9169a11486b877ba7bee87bdb057b3f360c15dda4708040ce6904011d79f1a5d513cde9e52b8d2c90aa44243f3d0d824fd2876b3504798daabdb62ae80caac29
SSDEEP 384:n+QkUSvYsNY14SblZG8tHX58EN8vAU0Xf+24HZvKASBv9dsnMKW/NaH7vBE/3IIv:uYRlj5aTcfl4xtSOMKW/NaH75E/3Lv
TLSH
T1E9B25CB5E8A96DE705E2E9C5A10AF503AFB45037C5C81A4CC6FDBA3C308F5F82352952
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fde15dd7-a6f7-4a32-adb4-127aa8d681f6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\fde15dd7-a6f7-4a32-adb4-127aa8d681f6.tmp
Size 8KB
SHA256 7517937021994445b0c7b7d9973028b8d6e8fa065e2c7517a45ab2d60a0be974
MD5 3961e1476f4dfb3156573d36162f54b9
SHA1 00bc5a1dea3de4e079a969103738bd698006e0eb
SHA512 9234fce24bd9ea14e537893427cdb6642aad9d3a15d909610351c8c646c38186063409ef243859d12edeb5f00bdd6877ba98bb2295f535089f0f74e566791832
SSDEEP 192:1ONV6wlDgQmiUyMUW4X58gZxjzorvA7wbDl6YU6:1ONV6kgIW4X58EN8vAU9rU6
TLSH
T12302D935F978BC6B8EF2AE49F58A36139FE5102BE6552F80CAEC1A1C00D765C1347927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 9b927e0da9b56500fb48b617bcf56be929f3a2a30a3735c18ec05e14629111d5
MD5 5c5d8f15f59fda67639f8e31ccb5dc35
SHA1 caabe74f3c1e01bd4ebce726fc7f3376de0098e9
SHA512 04e9d97f66a98ff2609fee03e74e0baf7efb8b4d69e777f57be6eb047aab004b8c1e1b2c544d0ac1d9ab9e9bd3fde7747cd243bacd4de0ceaab7a85238d9ee2d
TLSH
T120410758B6EA2048B3B76F1AABF6686D487E7D372F4AD55D00010D4F0A77A44C971B33
MD5 SHA1 SHA512 TLSH

Submit Download

6dd2c63c-3990-4549-bf6e-57bba39d5551.tmp

Path C:\Users\Admin\AppData\Local\Temp\6dd2c63c-3990-4549-bf6e-57bba39d5551.tmp
Size 158KB
SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
MD5 9c18c4721b560ec55f0d5de055144d5c
SHA1 6af37a3bda916cac276ad5879c9f61262d9ae523
SHA512 51466928eb8d3cf7b917919c98bd8168453583d2c3dc5836036d87ffd0d2c732ab8450212a880fc6de199ea569a96993ba0d250a5012160d2d72211880695f92
SSDEEP 3072:5ZwEurOxn8zXnHc2qHNYEU/rUHCVJWGdi0Ha5HnXk9TFzBsuht7yGik:5ZwPOx8D85UIHEI0HaZ09JzKStjik
TLSH
T1CFF3E13E7EDE891AD80B10BB7F16B18BD80D8E0B460AB44B769D80155B3668D1BD1CFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8533b5e7-5eb1-4b2c-ba1e-f948f4465b54.tmp

Path C:\Users\Admin\AppData\Local\Temp\8533b5e7-5eb1-4b2c-ba1e-f948f4465b54.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

Microsoft_Windows_Desktop_Runtime_-_9.0.22_(x64)_20261102063012_000_dotnet_runtime_9.0.22_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_9.0.22_(x64)_20261102063012_000_dotnet_runtime_9.0.22_win_x64.msi.log
Size 2KB
SHA256 9cde67d014c3ec4f2f6e8a05014c46eede875bdefcb16d44ef580e20ecfa188c
MD5 87505bdbe8ecb843d3c96dd5a7e8a5a3
SHA1 a94e37293fcb6313f386e62f8a411c454ff1a5cc
SHA512 75c401700b0e9fe28c411e82f788748a39ffcf5e4b3b175220ccddee1e0ebd808f6b5afb362f02f86986fb5fc0870308d1088b629007e46b15122e664a5b012c
TLSH
T14841D2A81EF40A05B5B75B875AF3C0532A73FCDA7974CF0C6344832D466AD0449A9B7A
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_9.0.22_(x64)_20261102063012_001_dotnet_hostfxr_9.0.22_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_9.0.22_(x64)_20261102063012_001_dotnet_hostfxr_9.0.22_win_x64.msi.log
Size 2KB
SHA256 6fd930701376930f583831c0be0d572318778ff30bfa9d6c91b3aa20cf374d46
MD5 8ccaf4eecf07c04e7c011d09231c6060
SHA1 0f91af0523f33053fac506e42124f90162190ff0
SHA512 3cbfdbcefc67f70e9c8500330cfe387299e16ec2a972b1f15d64bfaadd375b865b9e2a5e711cec31c83b63ae43de29dafb880a676d5fcf829eb44231498a72bf
TLSH
T15C412AA92BE40905B2F257879AF7C0537A73FCDA7834DF0C1284421D4667D05ADA8BBA
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_9.0.22_(x64)_20261102063012_002_dotnet_host_9.0.22_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_9.0.22_(x64)_20261102063012_002_dotnet_host_9.0.22_win_x64.msi.log
Size 2KB
SHA256 a7ae1de7689f5bd62cad739fe87aed365f70f1193b5e58a7e681e8dae2181ca7
MD5 cf9f87b77297dce0f72aded2437f6974
SHA1 d8ab3d7d1d9019d8d9a728b8a6b0a44d4533b7f8
SHA512 a8b7c8849bec3c1587aded587a58a7d8e3b24f547192a863d71ec38a52ef44f76e2e2b1fa4fc948d64d8ed275b336c02168e7fc01b5123c0062bd0bf33d17f97
TLSH
T1524101792AE4090DB5F2D7439AF7C0136A73FCDA7874CF0D22C58619466BD006AE4BB6
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_9.0.22_(x64)_20261102063012_003_windowsdesktop_runtime_9.0.22_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_9.0.22_(x64)_20261102063012_003_windowsdesktop_runtime_9.0.22_win_x64.msi.log
Size 2KB
SHA256 15985928a3a7310dd2d39b2759a82cfd877f1287eda10d7c1b930077bc882cf9
MD5 da286e5fe6ff18a5e41bd3f486f7095a
SHA1 4324367679dc51a26fa410c36b299d07e339cf71
SHA512 18867c93f59689e1f001f8c4cc16db002a6801476f4458f4d30621367bbedb35e537febd07315f289b665ba8616ade1a138d2095101ad034028b7c72ea10a981
TLSH
T1D94104691EE40915F1B757479AF3C0232AB3FCD6A874DF4C238483190777D0569A4BAA
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2248_1344768529\CRX_INSTALL\_locales\en_CA\messages.json
Size 711B
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
TLSH
T1460197136240AF18470BF05BB9023442A0B44AC62384E0B775EC982C6656DAFB20B3B0
MD5 SHA1 SHA512 TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2248_1464696950\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f2909459-219c-4e87-a60c-59fd68f67268.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2248_1464696950\f2909459-219c-4e87-a60c-59fd68f67268.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a4569b45-ab2e-49df-bf3d-77b98daf9a3e.tmp

Path C:\Users\Admin\Downloads\a4569b45-ab2e-49df-bf3d-77b98daf9a3e.tmp
Size 15KB
SHA256 462a3c417d7e11d8c3eaebecbdde57210798aff61068bfcfbb84f213e0dce33c
MD5 fed7c60909933abb2d094d95d1af958a
SHA1 060b674d26c7e83c30f00b0f3cb044ee96ed5461
SHA512 cf10321c1a6bc68520a66d6546acb10bdafe3dcaa66b4b64f3b620c9b2d277c4cef4bf91f35d3d52d77671b40d316a61b5979a64ae87dd578c793db2e649719b
SSDEEP 384:QLDULILL7EounBaU3VttkZB2hyHIUFfTFYq2Qd1bLYH/:RMX7EounBj3VwZTFPb0f
TLSH
T14362F522A98995FBDBD20331CF2D393573AC823D0069C59B93586D4176E28438B7FB97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aspnetcore-runtime-9.0.22-win-x64.exe

Path C:\Users\Admin\Downloads\aspnetcore-runtime-9.0.22-win-x64.exe
Size 10.1MB
SHA256 db9ff4e204299d46a168726000679c3e7df9fe4fb07f11929d658ce2749cb3fd
MD5 79c81d51623f7dc146dabe7152774d21
SHA1 ed10ee4f00fabf152ba8f7713f0e3def18578300
SHA512 a993b56645d583c203c49ae48eb7233f9ea6d56581a51269154144613b9803f58d2163b8d61d469d5bf315b1337e6102862940ef7aa6cd91e0ca3c699969a901
SSDEEP 196608:+gZ2//Njs+8h98wL53LKJipQeIjtC5A4GDvtAYuLa2exMSkp70:v2/Vjs+8h9THQeDkAhq
TLSH
T1DEB63332A4604136EBF11673B928E1703D3DE7242B5188BAD3D4BA1C7EA88D657FB153
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f86ccf13-e3a5-4f5c-a950-4b3515a1f376.tmp

Path C:\Users\Admin\Downloads\f86ccf13-e3a5-4f5c-a950-4b3515a1f376.tmp
Size 15KB
SHA256 9c94544ab9f8872b74da6d857d2d965b768d57f246e5742074ed6fdf1017aaf3
MD5 61b0f84c34fbff35cd97943721683728
SHA1 f2bfba03df33a5405ed74676b746b1f063c47888
SHA512 c473c6e63667eb0f80e5cca7fc61bf44412c0a98c90415875986cea1e8c0e6899460c6b91eb84c3534f3c14382b847273d0f7f6d89114eca4c7fbd225dd8eda8
SSDEEP 384:sLDULILL7EounBaU3VttkZB2hyHIUFfTFYq2Qd1bLYH/:FMX7EounBj3VwZTFPb0f
TLSH
T14062F622B98995FBDBD20331CF2D393573A8823D0069C59B93586D4176E28438B7FB97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI4481.tmp

Path C:\Windows\Installer\MSI4481.tmp
Size 219KB
SHA256 2bf33a9b9980e44d21d48f04cc6ac4eed4c68f207bd5990b7d3254a310b944ae
MD5 928f4b0fc68501395f93ad524a36148c
SHA1 084590b18957ca45b4a0d4576d1cc72966c3ea10
SHA512 7f2163f651693f9b73a67e90b5c820af060a23502667a5c32c3beb2d6b043f5459f22d61072a744089d622c05502d80f7485e0f86eb6d565ff711d5680512372
SSDEEP 3072:FVzl3qiEZybztEwiUx6D02cWVsV1v2vZR3X6j7zo6k2FkngTLrOrORT9flQnS6lg:FVIMEgXmEAR3oHon2VaFuG0eEp
TLSH
T1AF248D217494947EEAFA0832A57EDA71BF3DF2241760C8AEC3409D1E6D604C167B7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{0B4C47AF-534F-4717-AC7F-41F30B674AC9}\.ba\1033\thm.wxl
Size 5KB
SHA256 81a68046b06e09385be8449373e7ceb9e79f7724c3cf11f0b18a4489a8d4926a
MD5 d5070cb3387a0a22b7046ae5ab53f371
SHA1 bc9da146a42bbf9496de059ac576869004702a97
SHA512 8fcf621fb9ce74725c3712e06e5b37b619145078491e828c6069e153359de3bd5486663b1fa6f3bcf1c994d5c556b9964ea1a1355100a634a6c700ef37d381e3
SSDEEP 96:MT0abTxmup/vrCKATQdYQHdYCwgoVOBq9LjP5dbSE7:OQNkdYQHdYCYXt7
TLSH
T1F1C1DBA778CF53C128731255EA925AAA5911C19C537F2DF4FC8B454B838A827A373F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BootstrapperApplicationData.xml

Path C:\Windows\Temp\{0B4C47AF-534F-4717-AC7F-41F30B674AC9}\.ba\BootstrapperApplicationData.xml
Size 7KB
SHA256 7e3f30423da0d5345b425857bd31c03f1113aac4de655eeb77a2aff2b1cfe45b
MD5 d7257f35afb6809dc404a191397bd24f
SHA1 e8246c5bb9d832b6610187ce9ba8abb0ab0ded0e
SHA512 23ea53f392526f77bd52694bbc513b295bc7814fcccedcd4df13c6e3d886fcbe959d8a29368af7feec11fab0f7c73cf004a7f7ce5e8163efb2ea4aab5a7bd395
SSDEEP 96:XeV2VS/V2VvGtn6WqH0wHyckTn6O/xA0w/ychUn6y3M0wrycuIqn67td0wgyc8L7:X0sesvgVXlBtHdh595vokI7ANQVxV
TLSH
T13EF14B182FFD0329F0F78F84E9B4110A5A35BCD26D38DA5D01951E0E8972B81E962FB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.xml

Path C:\Windows\Temp\{0B4C47AF-534F-4717-AC7F-41F30B674AC9}\.ba\thm.xml
Size 11KB
SHA256 83ca096f7ba2c83fc3b3aeb697b8139a788fa35eb8632943e26bb9fff7c78e63
MD5 302563a713b142ee41b59e3eeac53a90
SHA1 1340e90cc3c6c5fc19a7feb61d7779f4a4f0fdb5
SHA512 c9d4dfc20802bb542178300d1044bb94b35593b834ab0b50875a32953f890e48da456199128500e2c1fee26eaaf8c2c4fcaffb308b37914215f900cdd5c4cbc8
SSDEEP 96:eCdhlFGZRd4UyAi0Rz96zYFGiRdl6dXXdT9gUoLNEmRG3QBinRFRK03K8+GGI9ki:eCSfiozEW/A
TLSH
T1A2325BA986DE7C00D232E711ABF271D6AF126862C4C46E58F94C39BB4FE25406C7727D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet_host_9.0.22_win_x64.msi

Path C:\Windows\Temp\{0B4C47AF-534F-4717-AC7F-41F30B674AC9}\dotnet_host_9.0.22_win_x64.msi
Size 704KB
SHA256 cd3f588e05d2fe35fd6a5cc9671c75bb2e0baba3dc257ef1cf3c4564d888f1bf
MD5 eb832274c0333a582038ddc2da02cc75
SHA1 017d41a82f2d3a1d757e3a2c3679a69b2c3c818c
SHA512 ec59af014cd6772f509d45e566131c9f4dfe72b84a0fb9fb4b7a3c3841733882f87bc0d2c0d3d0bbac29e86cf56c310caaeaaa05b892545317c07693d9a258be
SSDEEP 6144:XdHqbZ1VIMEgXmEAR3oHon2VaFuG0eE4D4C9kxiZNDOpPQSr+1AdiqtCc2ap2rrH:0V1EgXmEI3os2Qx7E4D4Rxbp4K+1uiq
TLSH
T1A9E49D237D80803AD9BA1D318539D7B16F3DBD204A64889B9380B91DDDF15C0AF76BE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet_runtime_9.0.22_win_x64.msi

Path C:\Windows\Temp\{0B4C47AF-534F-4717-AC7F-41F30B674AC9}\dotnet_runtime_9.0.22_win_x64.msi
Size 27.5MB
SHA256 460a25d5e2b8637fc27d87b919c2500efea0670ae2e031037c37e5ba15e2b6d8
MD5 1ab8f08f716fe85d34177626b4a7663d
SHA1 9b79f7011606ba7ac1e9c6471301e312b67ee70a
SHA512 ac991f420b08506c6c73b1b48a5d21f5869b382fcdb651466c49d1ac7d1d3bdebc166f1dd1926bc6ddaf4bb3103d2bfa7ff1ffaa23c4bfc90333ece73066a342
SSDEEP 786432:+f0QcvlIBl8NLpXGrlU24tF20R2z1ksgU4SVlr7s:A2WBq12rlb0R2Dbr7
TLSH
T16B573363FE919535D9731C7050BACBD62A3EBC2027119D4BA348A51CDDF18C1CAB2AF6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windowsdesktop_runtime_9.0.22_win_x64.msi

Path C:\Windows\Temp\{0B4C47AF-534F-4717-AC7F-41F30B674AC9}\windowsdesktop_runtime_9.0.22_win_x64.msi
Size 29.9MB
SHA256 163ad4c00bcdb9c192805c4fdd38e6ca7e250ddbd75c0802816af5f2ddf6e6bc
MD5 1c21185e113573d7062133bbc0bb0226
SHA1 8740a1ba19a21e74effec0fdb288b2dbfeb08810
SHA512 69b1978771fc8f43189c125d963ebeb507b9bd3f0c016867fdb005667e2fc116452dc2532f5cc2ccb4b26e6e0e1a3f7eee31983c77dab3f1c58c8551d593b53b
SSDEEP 786432:xMcWGyjfJn05FpU/YhdMhMeW0WKSgKBBpB8g9:xMc5IfJgFGNhX9J2nD
TLSH
T1A3673317BD82C67BD13A0EBA657687601A3D4E258240EE432720B86DECF65D05F36BF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windowsdesktop-runtime-9.0.22-win-x64.exe

Path C:\Windows\Temp\{4286B4FB-AB78-4715-9CE0-24978E6B3E30}\.cr\windowsdesktop-runtime-9.0.22-win-x64.exe
Size 607KB
SHA256 475f81f63e02df841073074a9019a4f1d9d3404fb7c147153566cff9e089ddc6
MD5 40f3aea06d369d5a2d78750d0748753f
SHA1 4110ac8f63161e4a74ffc375c7b5d023470f7446
SHA512 f6dea398ccc2b8de803f11264bc7d568a5fc301dec9aa5d5f972695839c02f6c5fbec4197ad7271103fc9bcc79ae20490052c1e6e7110d3aabde045d4eead935
SSDEEP 12288:2mEsd9PZfePv3xl7ft7V+6uC+zd5qLlmy3w53iy7nlEM0DnmDw:2m39PZfePv3r7fm6t+jqp33azCM0l
TLSH
T1ADD48D32A5614032F7F10673B92896303E3CE328175488AAE7D4AD1D7EB88D667F7257
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bg.png

Path C:\Windows\Temp\{EB80AB67-5DDF-411B-9AD7-0DA5693EC162}\.ba\bg.png
Size 4KB
SHA256 9095bf7b6baa0107b40a4a6d727215be077133a190f4ca9bd89a176842141e79
MD5 9eb0320dfbf2bd541e6a55c01ddc9f20
SHA1 eb282a66d29594346531b1ff886d455e1dcd6d99
SHA512 9ada3a1757a493fbb004bd767fab8f77430af69d71479f340b8b8ede904cc94cd733700db593a4a2d2e1184c0081fd0648318d867128e1cb461021314990931d
SSDEEP 48:u+Xg+NXWbdlIr33lx9W5OstaDIy3r5XpPyvZKmXYTDeiByNxcaaaaaaaaaaaaaaE:AaXWPIrHT932JsdpPyjqDeioatEn
TLSH
T19891B4D8FCF95322C6002BF255F4C0735A0215B713ABFEC82F496BD90E6878E25058B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixstdba.dll

Path C:\Windows\Temp\{EB80AB67-5DDF-411B-9AD7-0DA5693EC162}\.ba\wixstdba.dll
Size 190KB
SHA256 dcea15f3710822ffc262e62ec04cc7bbbf0f33f5d1a853609fbfb65cb6a45640
MD5 f1919c6bd85d7a78a70c228a5b227fbe
SHA1 71647ebf4e7bed3bc1663d520419ac550fe630ff
SHA512 c7ff9b19c9bf320454a240c6abbc382950176a6befce05ea73150eeb0085d0b6ed5b65b2dcb4b04621ef9cca1d5c4e59c6682b9c85d1d5845e5ce3e5eedfd2eb
SSDEEP 3072:sjEoXsLW9OLG8Qp51ySdjDXY33b+Av7O5IkI+/AYkPAEc527uu3k/gLtxavf0ir2:sjEo8LW9553hXWy15I2YrAW7FUVEihs3
TLSH
T1FF14AF1176D0A07AEBFB16307A39A5216E7DBA200FA0C9DF63449D2B1D715C19B36B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download