28102319adcc684a1f3c85fd4953b21b8b0b0433e35a4f01feea01d6379506d5

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
03/03/2024, 09:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Galaxy Swapper v2.exe
Size 4.7MB
Sample240303-lt379ahb99
SHA256 28102319adcc684a1f3c85fd4953b21b8b0b0433e35a4f01feea01d6379506d5
MD5 3b342bccddd3b9e2444a643bd42ebc71
SHA1 e9aa3efd4d3f0a135cb5c304e9edd0555f539c1f
SHA512 f925db08cab152d841c9601b900b2804d489b254f574c6f0124e4f41d7f26f209c7b103f2606710370a0af89e94aaf421c96aa31bf1ae552146abf0ccdf58d2e
SSDEEP 98304:TNAlj2vL5CHSHlyFGvFomw3/49sOjNjTUJECByxW5B9ch12dlv+s+SbRSuYPjlFd:TxhsqYgRNcagIeD4uy
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery persistence

Malware Config

Signatures

Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation	windowsdesktop-runtime-7.0.16-win-x64.exe

Executes dropped EXE 5 IoCs

pid	Process
5500	windowsdesktop-runtime-7.0.16-win-x64.exe
5524	windowsdesktop-runtime-7.0.16-win-x64.exe
2636	windowsdesktop-runtime-7.0.16-win-x64.exe
4444	windowsdesktop-runtime-7.0.16-win-x64.exe
3088	windowsdesktop-runtime-7.0.16-win-x64.exe

Loads dropped DLL 5 IoCs

pid	Process
4444	windowsdesktop-runtime-7.0.16-win-x64.exe
2636	windowsdesktop-runtime-7.0.16-win-x64.exe
32	MsiExec.exe
32	MsiExec.exe
5092	MsiExec.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{ef5af41f-d68c-48f7-bfb0-5055718601fc} = "\"C:\\ProgramData\\Package Cache\\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\\windowsdesktop-runtime-7.0.16-win-x64.exe\" /burn.runonce"	windowsdesktop-runtime-7.0.16-win-x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.NonGeneric.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ValueTuple.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Metadata.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscordaccore.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XPath.XDocument.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.UnmanagedMemoryStream.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\clrjit.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.Annotations.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.TraceSource.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ObjectModel.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.ZipFile.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Intrinsics.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XmlSerializer.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.ReaderWriter.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Data.Common.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.DiagnosticSource.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Http.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Web.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.Json.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.SecureString.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.MemoryMappedFiles.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XDocument.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\clretwrc.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.DispatchProxy.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Csp.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.NETCore.App.deps.json	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebSockets.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.FileVersionInfo.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Globalization.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Emit.ILGeneration.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.Xml.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Claims.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Configuration.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Emit.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.OpenSsl.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Debug.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.StackTrace.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Tasks.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.RegularExpressions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Overlapped.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Timer.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Emit.Lightweight.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebClient.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Tasks.Extensions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Extensions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.Concurrent.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebProxy.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Extensions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Principal.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.CompilerServices.Unsafe.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.AppContext.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Loader.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Linq.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Process.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.Win32.Registry.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Http.Json.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Tasks.Dataflow.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Encoding.Extensions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Core.dll	msiexec.exe

Drops file in Windows directory 15 IoCs

description	ioc	Process
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\e5984cb.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIACA5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5984c6.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\e5984ca.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5984cb.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{1B690A4C-381A-40D4-BA4A-3F8ACD5CE797}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI91F5.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{CE4D7AE0-FCBA-486F-A58F-DBA3626FBE4B}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9736.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA58F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA997.tmp	msiexec.exe
File created	C:\Windows\Installer\e5984c6.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\22\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\23	msiexec.exe

Modifies registry class 36 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_56.64.8781_x64\DisplayName = "Microsoft .NET Runtime - 7.0.16 (x64)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\0EA7D4ECABCFF6845AF8BD3A26F6EBB4\Provider	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0EA7D4ECABCFF6845AF8BD3A26F6EBB4\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0EA7D4ECABCFF6845AF8BD3A26F6EBB4\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\04147B1B3295B4161C8ED46FA6E46912\0EA7D4ECABCFF6845AF8BD3A26F6EBB4	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0EA7D4ECABCFF6845AF8BD3A26F6EBB4\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{CE4D7AE0-FCBA-486F-A58F-DBA3626FBE4B}v56.64.8781\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{ef5af41f-d68c-48f7-bfb0-5055718601fc}	windowsdesktop-runtime-7.0.16-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\Version = "7.0.16.33318"	windowsdesktop-runtime-7.0.16-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0EA7D4ECABCFF6845AF8BD3A26F6EBB4	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0EA7D4ECABCFF6845AF8BD3A26F6EBB4\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0EA7D4ECABCFF6845AF8BD3A26F6EBB4\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0EA7D4ECABCFF6845AF8BD3A26F6EBB4\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0EA7D4ECABCFF6845AF8BD3A26F6EBB4\SourceList\PackageName = "dotnet-runtime-7.0.16-win-x64.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\DisplayName = "Microsoft Windows Desktop Runtime - 7.0.16 (x64)"	windowsdesktop-runtime-7.0.16-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\0EA7D4ECABCFF6845AF8BD3A26F6EBB4\MainFeature	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0EA7D4ECABCFF6845AF8BD3A26F6EBB4\SourceList\Media	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0EA7D4ECABCFF6845AF8BD3A26F6EBB4\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_56.64.8781_x64\Dependents	windowsdesktop-runtime-7.0.16-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\ = "{ef5af41f-d68c-48f7-bfb0-5055718601fc}"	windowsdesktop-runtime-7.0.16-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_56.64.8781_x64\ = "{CE4D7AE0-FCBA-486F-A58F-DBA3626FBE4B}"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0EA7D4ECABCFF6845AF8BD3A26F6EBB4\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0EA7D4ECABCFF6845AF8BD3A26F6EBB4\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\0EA7D4ECABCFF6845AF8BD3A26F6EBB4	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0EA7D4ECABCFF6845AF8BD3A26F6EBB4\PackageCode = "74EEF11D81DB3C6458F196B0238079C8"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0EA7D4ECABCFF6845AF8BD3A26F6EBB4\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_56.64.8781_x64\Version = "56.64.8781"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0EA7D4ECABCFF6845AF8BD3A26F6EBB4\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_56.64.8781_x64\Dependents\{ef5af41f-d68c-48f7-bfb0-5055718601fc}	windowsdesktop-runtime-7.0.16-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\Dependents\{ef5af41f-d68c-48f7-bfb0-5055718601fc}	windowsdesktop-runtime-7.0.16-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\04147B1B3295B4161C8ED46FA6E46912	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\dotnet_runtime_56.64.8781_x64	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\dotnet_runtime_56.64.8781_x64	windowsdesktop-runtime-7.0.16-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0EA7D4ECABCFF6845AF8BD3A26F6EBB4\Version = "943727181"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0EA7D4ECABCFF6845AF8BD3A26F6EBB4\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{CE4D7AE0-FCBA-486F-A58F-DBA3626FBE4B}v56.64.8781\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\Dependents	windowsdesktop-runtime-7.0.16-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0EA7D4ECABCFF6845AF8BD3A26F6EBB4\ProductName = "Microsoft .NET Runtime - 7.0.16 (x64)"	msiexec.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 18868.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
4696	taskmgr.exe
4696	taskmgr.exe
4696	taskmgr.exe
4696	taskmgr.exe
4696	taskmgr.exe
4696	taskmgr.exe
1648	msedge.exe
1648	msedge.exe
2620	msedge.exe
2620	msedge.exe
3584	identity_helper.exe
3584	identity_helper.exe
1604	msedge.exe
1604	msedge.exe
5828	msiexec.exe
5828	msiexec.exe
5828	msiexec.exe
5828	msiexec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4696	taskmgr.exe
Token: SeSystemProfilePrivilege	4696	taskmgr.exe
Token: SeCreateGlobalPrivilege	4696	taskmgr.exe
Token: 33	4696	taskmgr.exe
Token: SeIncBasePriorityPrivilege	4696	taskmgr.exe
Token: SeShutdownPrivilege	3088	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeIncreaseQuotaPrivilege	3088	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeSecurityPrivilege	5828	msiexec.exe
Token: SeCreateTokenPrivilege	3088	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeAssignPrimaryTokenPrivilege	3088	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeLockMemoryPrivilege	3088	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeIncreaseQuotaPrivilege	3088	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeMachineAccountPrivilege	3088	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeTcbPrivilege	3088	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeSecurityPrivilege	3088	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeTakeOwnershipPrivilege	3088	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeLoadDriverPrivilege	3088	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeSystemProfilePrivilege	3088	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeSystemtimePrivilege	3088	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeProfSingleProcessPrivilege	3088	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeIncBasePriorityPrivilege	3088	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeCreatePagefilePrivilege	3088	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeCreatePermanentPrivilege	3088	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeBackupPrivilege	3088	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeRestorePrivilege	3088	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeShutdownPrivilege	3088	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeDebugPrivilege	3088	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeAuditPrivilege	3088	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeSystemEnvironmentPrivilege	3088	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeChangeNotifyPrivilege	3088	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeRemoteShutdownPrivilege	3088	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeUndockPrivilege	3088	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeSyncAgentPrivilege	3088	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeEnableDelegationPrivilege	3088	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeManageVolumePrivilege	3088	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeImpersonatePrivilege	3088	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeCreateGlobalPrivilege	3088	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeRestorePrivilege	5828	msiexec.exe
Token: SeTakeOwnershipPrivilege	5828	msiexec.exe
Token: SeRestorePrivilege	5828	msiexec.exe
Token: SeTakeOwnershipPrivilege	5828	msiexec.exe
Token: SeRestorePrivilege	5828	msiexec.exe
Token: SeTakeOwnershipPrivilege	5828	msiexec.exe
Token: SeRestorePrivilege	5828	msiexec.exe
Token: SeTakeOwnershipPrivilege	5828	msiexec.exe
Token: SeRestorePrivilege	5828	msiexec.exe
Token: SeTakeOwnershipPrivilege	5828	msiexec.exe
Token: SeRestorePrivilege	5828	msiexec.exe
Token: SeTakeOwnershipPrivilege	5828	msiexec.exe
Token: SeRestorePrivilege	5828	msiexec.exe
Token: SeTakeOwnershipPrivilege	5828	msiexec.exe
Token: SeRestorePrivilege	5828	msiexec.exe
Token: SeTakeOwnershipPrivilege	5828	msiexec.exe
Token: SeRestorePrivilege	5828	msiexec.exe
Token: SeTakeOwnershipPrivilege	5828	msiexec.exe
Token: SeRestorePrivilege	5828	msiexec.exe
Token: SeTakeOwnershipPrivilege	5828	msiexec.exe
Token: SeRestorePrivilege	5828	msiexec.exe
Token: SeTakeOwnershipPrivilege	5828	msiexec.exe
Token: SeRestorePrivilege	5828	msiexec.exe
Token: SeTakeOwnershipPrivilege	5828	msiexec.exe
Token: SeRestorePrivilege	5828	msiexec.exe
Token: SeTakeOwnershipPrivilege	5828	msiexec.exe
Token: SeRestorePrivilege	5828	msiexec.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4696	taskmgr.exe
4696	taskmgr.exe
4696	taskmgr.exe
4696	taskmgr.exe
4696	taskmgr.exe
4696	taskmgr.exe
4696	taskmgr.exe
4696	taskmgr.exe
4696	taskmgr.exe
4696	taskmgr.exe
4696	taskmgr.exe
4696	taskmgr.exe
4696	taskmgr.exe
4696	taskmgr.exe
4696	taskmgr.exe
4696	taskmgr.exe
4696	taskmgr.exe
4696	taskmgr.exe
4696	taskmgr.exe
4696	taskmgr.exe
4696	taskmgr.exe
4696	taskmgr.exe
4696	taskmgr.exe
4696	taskmgr.exe
4696	taskmgr.exe
4696	taskmgr.exe
4696	taskmgr.exe
4696	taskmgr.exe
4696	taskmgr.exe
4696	taskmgr.exe
4696	taskmgr.exe
4696	taskmgr.exe
4696	taskmgr.exe
1208	Galaxy Swapper v2.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe

Suspicious use of SendNotifyMessage 56 IoCs

pid	Process
4696	taskmgr.exe
4696	taskmgr.exe
4696	taskmgr.exe
4696	taskmgr.exe
4696	taskmgr.exe
4696	taskmgr.exe
4696	taskmgr.exe
4696	taskmgr.exe
4696	taskmgr.exe
4696	taskmgr.exe
4696	taskmgr.exe
4696	taskmgr.exe
4696	taskmgr.exe
4696	taskmgr.exe
4696	taskmgr.exe
4696	taskmgr.exe
4696	taskmgr.exe
4696	taskmgr.exe
4696	taskmgr.exe
4696	taskmgr.exe
4696	taskmgr.exe
4696	taskmgr.exe
4696	taskmgr.exe
4696	taskmgr.exe
4696	taskmgr.exe
4696	taskmgr.exe
4696	taskmgr.exe
4696	taskmgr.exe
4696	taskmgr.exe
4696	taskmgr.exe
4696	taskmgr.exe
4696	taskmgr.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 2620	1668	Galaxy Swapper v2.exe	103
PID 1668 wrote to memory of 2620	1668	Galaxy Swapper v2.exe	103
PID 2620 wrote to memory of 2956	2620	msedge.exe	104
PID 2620 wrote to memory of 2956	2620	msedge.exe	104
PID 2620 wrote to memory of 4552	2620	msedge.exe	105
PID 2620 wrote to memory of 4552	2620	msedge.exe	105
PID 2620 wrote to memory of 4552	2620	msedge.exe	105
PID 2620 wrote to memory of 4552	2620	msedge.exe	105
PID 2620 wrote to memory of 4552	2620	msedge.exe	105
PID 2620 wrote to memory of 4552	2620	msedge.exe	105
PID 2620 wrote to memory of 4552	2620	msedge.exe	105
PID 2620 wrote to memory of 4552	2620	msedge.exe	105
PID 2620 wrote to memory of 4552	2620	msedge.exe	105
PID 2620 wrote to memory of 4552	2620	msedge.exe	105
PID 2620 wrote to memory of 4552	2620	msedge.exe	105
PID 2620 wrote to memory of 4552	2620	msedge.exe	105
PID 2620 wrote to memory of 4552	2620	msedge.exe	105
PID 2620 wrote to memory of 4552	2620	msedge.exe	105
PID 2620 wrote to memory of 4552	2620	msedge.exe	105
PID 2620 wrote to memory of 4552	2620	msedge.exe	105
PID 2620 wrote to memory of 4552	2620	msedge.exe	105
PID 2620 wrote to memory of 4552	2620	msedge.exe	105
PID 2620 wrote to memory of 4552	2620	msedge.exe	105
PID 2620 wrote to memory of 4552	2620	msedge.exe	105
PID 2620 wrote to memory of 4552	2620	msedge.exe	105
PID 2620 wrote to memory of 4552	2620	msedge.exe	105
PID 2620 wrote to memory of 4552	2620	msedge.exe	105
PID 2620 wrote to memory of 4552	2620	msedge.exe	105
PID 2620 wrote to memory of 4552	2620	msedge.exe	105
PID 2620 wrote to memory of 4552	2620	msedge.exe	105
PID 2620 wrote to memory of 4552	2620	msedge.exe	105
PID 2620 wrote to memory of 4552	2620	msedge.exe	105
PID 2620 wrote to memory of 4552	2620	msedge.exe	105
PID 2620 wrote to memory of 4552	2620	msedge.exe	105
PID 2620 wrote to memory of 4552	2620	msedge.exe	105
PID 2620 wrote to memory of 4552	2620	msedge.exe	105
PID 2620 wrote to memory of 4552	2620	msedge.exe	105
PID 2620 wrote to memory of 4552	2620	msedge.exe	105
PID 2620 wrote to memory of 4552	2620	msedge.exe	105
PID 2620 wrote to memory of 4552	2620	msedge.exe	105
PID 2620 wrote to memory of 4552	2620	msedge.exe	105
PID 2620 wrote to memory of 4552	2620	msedge.exe	105
PID 2620 wrote to memory of 4552	2620	msedge.exe	105
PID 2620 wrote to memory of 4552	2620	msedge.exe	105
PID 2620 wrote to memory of 1648	2620	msedge.exe	106
PID 2620 wrote to memory of 1648	2620	msedge.exe	106
PID 2620 wrote to memory of 3304	2620	msedge.exe	107
PID 2620 wrote to memory of 3304	2620	msedge.exe	107
PID 2620 wrote to memory of 3304	2620	msedge.exe	107
PID 2620 wrote to memory of 3304	2620	msedge.exe	107
PID 2620 wrote to memory of 3304	2620	msedge.exe	107
PID 2620 wrote to memory of 3304	2620	msedge.exe	107
PID 2620 wrote to memory of 3304	2620	msedge.exe	107
PID 2620 wrote to memory of 3304	2620	msedge.exe	107
PID 2620 wrote to memory of 3304	2620	msedge.exe	107
PID 2620 wrote to memory of 3304	2620	msedge.exe	107
PID 2620 wrote to memory of 3304	2620	msedge.exe	107
PID 2620 wrote to memory of 3304	2620	msedge.exe	107
PID 2620 wrote to memory of 3304	2620	msedge.exe	107
PID 2620 wrote to memory of 3304	2620	msedge.exe	107
PID 2620 wrote to memory of 3304	2620	msedge.exe	107
PID 2620 wrote to memory of 3304	2620	msedge.exe	107
PID 2620 wrote to memory of 3304	2620	msedge.exe	107
PID 2620 wrote to memory of 3304	2620	msedge.exe	107

C:\Users\Admin\AppData\Local\Temp\Galaxy Swapper v2.exe
"C:\Users\Admin\AppData\Local\Temp\Galaxy Swapper v2.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:1208

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4696

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c82192ee-6cb5-4bc0-9ef0-fb818773790a} -Embedding
1⤵
PID:1928

C:\Users\Admin\AppData\Local\Temp\Galaxy Swapper v2.exe
"C:\Users\Admin\AppData\Local\Temp\Galaxy Swapper v2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.NETCore.App&framework_version=7.0.0&arch=x64&rid=win-x64&os=win10&gui=true
  2⤵
  - Enumerates system info in registry
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff99ee046f8,0x7ff99ee04708,0x7ff99ee04718
    3⤵
    PID:2956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,9661425741494605906,12461287199485348993,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
    3⤵
    PID:4552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,9661425741494605906,12461287199485348993,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,9661425741494605906,12461287199485348993,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2924 /prefetch:8
    3⤵
    PID:3304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,9661425741494605906,12461287199485348993,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
    3⤵
    PID:4924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,9661425741494605906,12461287199485348993,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
    3⤵
    PID:4492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,9661425741494605906,12461287199485348993,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4676 /prefetch:1
    3⤵
    PID:3624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,9661425741494605906,12461287199485348993,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
    3⤵
    PID:4596
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,9661425741494605906,12461287199485348993,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5740 /prefetch:8
    3⤵
    PID:4656
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,9661425741494605906,12461287199485348993,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5740 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,9661425741494605906,12461287199485348993,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5820 /prefetch:1
    3⤵
    PID:208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,9661425741494605906,12461287199485348993,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5788 /prefetch:1
    3⤵
    PID:400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2072,9661425741494605906,12461287199485348993,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5184 /prefetch:8
    3⤵
    PID:5168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,9661425741494605906,12461287199485348993,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
    3⤵
    PID:5176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,9661425741494605906,12461287199485348993,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6284 /prefetch:1
    3⤵
    PID:5328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,9661425741494605906,12461287199485348993,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6168 /prefetch:1
    3⤵
    PID:5336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2072,9661425741494605906,12461287199485348993,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6540 /prefetch:8
    3⤵
    PID:5444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2072,9661425741494605906,12461287199485348993,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7112 /prefetch:8
    3⤵
    PID:5776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2072,9661425741494605906,12461287199485348993,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5068 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1604
- - C:\Users\Admin\Downloads\windowsdesktop-runtime-7.0.16-win-x64.exe
    "C:\Users\Admin\Downloads\windowsdesktop-runtime-7.0.16-win-x64.exe"
    3⤵
    - Executes dropped EXE
    PID:5500
  - - C:\Windows\Temp\{A1C6405B-2178-4037-8014-C19C65DEEA1F}\.cr\windowsdesktop-runtime-7.0.16-win-x64.exe
      "C:\Windows\Temp\{A1C6405B-2178-4037-8014-C19C65DEEA1F}\.cr\windowsdesktop-runtime-7.0.16-win-x64.exe" -burn.clean.room="C:\Users\Admin\Downloads\windowsdesktop-runtime-7.0.16-win-x64.exe" -burn.filehandle.attached=580 -burn.filehandle.self=676
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4444
- - C:\Users\Admin\Downloads\windowsdesktop-runtime-7.0.16-win-x64.exe
    "C:\Users\Admin\Downloads\windowsdesktop-runtime-7.0.16-win-x64.exe"
    3⤵
    - Executes dropped EXE
    PID:5524
  - - C:\Windows\Temp\{7147FFCA-9567-47E9-8F48-F87AAD599A66}\.cr\windowsdesktop-runtime-7.0.16-win-x64.exe
      "C:\Windows\Temp\{7147FFCA-9567-47E9-8F48-F87AAD599A66}\.cr\windowsdesktop-runtime-7.0.16-win-x64.exe" -burn.clean.room="C:\Users\Admin\Downloads\windowsdesktop-runtime-7.0.16-win-x64.exe" -burn.filehandle.attached=568 -burn.filehandle.self=576
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      PID:2636
    - - C:\Windows\Temp\{0886E58C-E06A-4C00-ADFF-64651FD8E452}\.be\windowsdesktop-runtime-7.0.16-win-x64.exe
        
        "C:\Windows\Temp\{0886E58C-E06A-4C00-ADFF-64651FD8E452}\.be\windowsdesktop-runtime-7.0.16-win-x64.exe" -q -burn.elevated BurnPipe.{EA19EEA7-EF0B-4120-9D64-085B797972B1} {A8061844-6ABC-4C17-AB4C-9D9379B2A572} 2636
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:3088

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4812

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2592

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5828
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 1508188D627CBE5789E9AE22324B46BA
  2⤵
  - Loads dropped DLL
  PID:32
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding A7167688089FE94ECCA4CD9EDB5D8E63
  2⤵
  - Loads dropped DLL
  PID:5092
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding E9E4D98EF3FABCCDED4501039F877B08
  2⤵
  PID:1500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5984c9.rbs

Path C:\Config.Msi\e5984c9.rbs
Size 48KB
SHA256 57995ef632854b3c2f835b095fad74d9f40f7106fadc0ddb961295949d3dff94
MD5 e3af06de8425d76b6c37ba1f88f8d0e4
SHA1 862af12753ad41dec3920b286e65a606d6130e33
SHA512 2e39537d8cf92ccc3d59bcb42db44182d67f02d3c5fec7fc0de7219987a5f6c9b3c6c1edb6d08cc5cf6601e2b8e780d837a5575071f5d828ffdc63e1fcb50938
SSDEEP 1536:GFbf6jPFoPswgSI1pVcQesul65oVxzaLBAibq/y4bzqGOptHv52XfSledwWTxn1c:uY+t2sqn
MD5 SHA1 SHA512 SSDEEP

Submit Download

e5984ce.rbs

Path C:\Config.Msi\e5984ce.rbs
Size 9KB
SHA256 0cc608bf640a60658945164058b9e1198e53fea4989e420bb33b48dceaea636a
MD5 7836c1433bb472596ce42474576c6a75
SHA1 02e90be31aadb3aba1a761b6cb2e04fb32204893
SHA512 e284ce897018a4423b507977e86eabd619e947cdf74956b2fb2dea45576da406a6bb7616b99e3aaf2a6e8f299e3247049c89070b4ae60454c423ee48571f2508
SSDEEP 96:7mcKLLv5faHetem+q+UEeD2rTCsTl4UEeD2rTC6j7vhYqTl0UYMcE5K7v9/5EkWh:yThiAeURCOIVCOEWXEC9VwEp31a
MD5 SHA1 SHA512 SSDEEP

Submit Download

e5984d3.rbs

Path C:\Config.Msi\e5984d3.rbs
Size 10KB
SHA256 631fbe84aa7a81223cd1f4687f861dc27283f3c52c6e7acf7028346daee543c1
MD5 c3552840943c66ec6095e68eb48cb9db
SHA1 b57ea72924b21632e9a9ae3eabc5553bd37c6dfc
SHA512 27bc645987183039d0bc12250f2814f1ae813572a92130f0242ae0cd027168422f2a144d1457c2df88c7e0366207591323b67cfad07c7dbbcdbc301a8a2ee6f7
SSDEEP 192:hudX6mBK7/eAR/OIQ/ONnaEJgq93EpOkiH:hudX6mgh/6/o9AiH
MD5 SHA1 SHA512 SSDEEP

Submit Download

ThirdPartyNotices.txt

Path C:\Program Files\dotnet\ThirdPartyNotices.txt
Size 85KB
SHA256 4f9bb3901879bafae3a17c6c4009ee5c15384a06fc234bed78937969079c77da
MD5 5c13a5ea8c8cc3474240981d0ffa88ff
SHA1 1d8d3ce27d9dc3d9fb4fa4b06c20137d25879d80
SHA512 32ea79ff5194d8a18e75f277aed5610b4955db15b0abbcc2664cf07f372bebfc57eb665ad078dc3da3ce5ee0d8856140c2a1bc7032b578dd103d43998d682d88
SSDEEP 1536:HA9jHwLvGfgg39/zwgAVkguQXrDjugtSEGepkWvrpX7anuqdLSVnfiStPq+3LefA:HA97wyogz1AVxuujHtSFULryLOgrGWMB
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 01946a2d65e59b66ebc256470ff4861f32edee90a44e31bf67529add95cafef4
MD5 a774512b00820b61a51258335097b2c9
SHA1 38c28d1ea3907a1af6c0443255ab610dd9285095
SHA512 ce109be65060a5e7a872707c6c2ccce3aacd577e59c59d6e23e78d03e3d502f2707713fda40a546ed332e41a56ef90297af99590a5ab02f686a58bcbf3a82da1
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 360B
SHA256 8be5b0d5714f23da33b6d7f48c393ffd22778ddc8246a0cca157e533f9dd7a29
MD5 a5d74d1493aab9fb57a5ce1e8fff6a98
SHA1 7aaabcdf740e0988376a2a72e98976ee51c05c47
SHA512 22a274d3a3c8dbd7c6ca90d2523ca4960b6ee46ef15041391d0170e916aab205f6d2e624a699666a318789e5ff59bfd6c66ccfe22a512af485b4b5538a02300b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1002B
SHA256 775db751a9c30b418dc64a43edcb28ffd123e92aabb553e5b3bd4a5a1d91383b
MD5 00f8d095ec8c8420cd26ce4ab251c161
SHA1 7f36173933292baa403781a220f132693c120670
SHA512 5d4fa2ff6d27f4ad4e92190bfaab4841dcb6f726029ea999580d3982da0bee8cc2e0032c28c436dd4700ae4b92df9280f74e2fcc72ef4cd8b610d0fa080e1e8a
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 38838d78d7d7020ce48f244e301259b874351af97681ba600a5d2ebee40bccc4
MD5 829ea9ac5c2939ebb192ba45a56e199c
SHA1 6520099458aba8c1f79a271fedbf00f702d62748
SHA512 a9993b27e457a7b65233c1c084e35bd76ad2ac189f97379ca0a55a0702dd42f51afe548c0974758295df5960bb8f329874a1b3577c8569ccd0e3bb301cdd1b70
SSDEEP 96:nmk6xm/KQYmq+13p0wpvWMoiVmdeHI/gUWQyV+VD7ziEwb:nmkHT5Rp0GWMXzrt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 e03127b77e8c3ba9555f04b5cceb4d98035660ee5d927dbd8f22478f2967448f
MD5 a445f3a0bee7cc0c7659d285332de676
SHA1 e21d55bd2bc2173be946ec1a0be790b28078bf2b
SHA512 8277bee5bb65f515be90c2b680d4b679dd41374b06f12a5d1ea3452caf4e77250921dc76c806411b05b4e1d486dbc5252ae45ffd6553295904f6b063f39ff680
SSDEEP 96:nmk6xm/Kemq+1b50wpvWMoiVmdezpuy1jIUgUWQyV+VD7AiEwb:nmkHq5R50GWMVuyhgrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 108250988cf6e4edd347bf0794ef6fd108e74ecda0b4dd4ce7306acf6ab78588
MD5 f0dca6601f934ab3ba32e1e72fd46646
SHA1 b1b75ee8faa6cf9c9c59034ad1bbf6515ca32922
SHA512 e5c8aa9149340ab745e1ceb7535cc1ddee2ab84530bd8eaf4c1c8b1f451f4b51b1d1c3ca1b035c374cd7fdd6ab9032fe8336fcd194597e7e9068248a9555f20b
SSDEEP 96:nmk8sQMxm/Kemq+1b50wpvWMoiVmdez5wZjNIsgUWQyV+VD7AiEwb:nmkCq5R50GWMlwZpIrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 705B
SHA256 88da1be66361fc2db9896886eac26499ccd7a7e27fb6d8907c738a63018e897f
MD5 d5ad2d5a99b8469e8229613681e37fc7
SHA1 0607c7c442e8e3ea3c6b868454a3609da331b682
SHA512 85d78eab21936516ddd757413177f90f7e80df4d0f1c4b259064f1ef993dfe6ca9ff86f868270c2ed1c2948dfec6246985643e78defd5b24f986f1d4514ef55e
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 703B
SHA256 9b64f3ce861a5572dc1b233ce3658d815ccfb7cb2caae2405a40b2a8cd102930
MD5 f82385bf414528b147450b1b31463142
SHA1 3d23c96ac5aa6e20b0eb5a65e118778095b85029
SHA512 25315c511cb746c7c125d7942a852350a7e0d748fe69475253f16fb79cf5eb0be9e7e0c6f356c92f3e10c25af2eef38eeb51a945d31baa4a21a952f4a7779be1
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe5854f1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5854f1.TMP
Size 539B
SHA256 786273ffa16e141068254a8a5291064e6c57967d9e18a167be1be9bcaec1dab3
MD5 52fcf9a2f3a9952660bc1b6518333088
SHA1 99e8c202a001944e5fc4da909f5471e526eff6f8
SHA512 506812353b28c551fb884c1a6f1fa1149edd7b83cdc7c39ed4db728b9d72644bb8accbcfce95bb9580ec52f3d2182a55b5860642dfe653c3c27e67b06b03b62a
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 6d3b0f3b4b21670a88de22865f44c15bb2c2c2b74b146f8e2f4126e9b4ae9573
MD5 c677f28f27671acc8efa254b225c9056
SHA1 29d90da19e8a6880769279e8c1c36401cf5b7085
SHA512 e31faaaec91a1516112f07f38502a3cb6d5dbda74a59527ead9f4a2838e6a64c9d0969f158fb07c8942b3937746410329651c1e1da8113cfc08cd70d83d875f4
SSDEEP 384:A9iIxuERzA83h09RZxYAN9i29E1MeuBOvO:rIxuERzA83h09RZxX9i2TOvO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 a1777a6cc2e8fca80af013c649ffbd1f451227a14c78c56e469c72d8fd467f43
MD5 84538f7301d5a4a74684ac81ffe1cf6a
SHA1 e6a9628abc07caf3566b12eb695bba921299c332
SHA512 8dacd5323d3d0c0019e722e4e8f4449ce6ad7aed4b8e17ffe3d378a6f98d6b52da0bae03de732bfb18a5a6c209932b09ef07081e3ae9d6d87888fbaaf768ba16
SSDEEP 192:doCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupnFe2RUX3hblb9xUX1MPeuv:R9iIxuERzA83h09RZxYhSb9E1MeuBOvO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20240303095240_000_dotnet_runtime_7.0.16_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20240303095240_000_dotnet_runtime_7.0.16_win_x64.msi.log
Size 2KB
SHA256 a8eb149ecbf81e9ed8a065772dacaf4cb5c90d2a66da916d8f72953e63e47520
MD5 53c7074d2f292612979084ac8478e653
SHA1 b7fd9b94bf45d0865d009bbd6b24f98bfb6b79df
SHA512 fc3b24ea25a28c15d9431b49bbe9cdb6fa12a4ddb80b5a233c2228d1b43118d961aa4e1adf0fcf4658eb783835cf12f8679f61580a8956a8bb7c9b326e4709ba
MD5 SHA1 SHA512

Submit Download

Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20240303095240_001_dotnet_hostfxr_7.0.16_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20240303095240_001_dotnet_hostfxr_7.0.16_win_x64.msi.log
Size 2KB
SHA256 c1151551de00faa40e8909c72fdad3613cbc7bfda6b1a1e24b5500c3041e2cf6
MD5 f66f39645d6cd4a4b8cb472e908a038e
SHA1 f6bf86442e54d4b9fafdb837a62ad6d111b8380f
SHA512 e4594423dd711bdc6ca50cdd6ae23fd501bcb3d018d920778f82e654ca501375ce5954368311dca198a6ad08262bd91a54daface1e4020f1044d42b5c8a73efd
MD5 SHA1 SHA512

Submit Download

Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20240303095240_002_dotnet_host_7.0.16_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20240303095240_002_dotnet_host_7.0.16_win_x64.msi.log
Size 2KB
SHA256 e5f3abe5cf4db104d4466db45c330fe4f21c999d046aaee7a827167fd018e60a
MD5 09ca6ada4e7d8532ca9ce3222bcd4992
SHA1 6ffceeef49d9969b6de531ce142f978f63fabb7d
SHA512 ae1025b159b45ca56c115fa45bcde281abb9c9229e0eca45dc413518d7be646ce32249141fae1c36a3eca6a5282df3bbdba03583da83cd6a76f78e4435f2eedf
MD5 SHA1 SHA512

Submit Download

Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20240303095240_003_windowsdesktop_runtime_7.0.16_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20240303095240_003_windowsdesktop_runtime_7.0.16_win_x64.msi.log
Size 2KB
SHA256 817278fdda19c6ecadf8bb46b2dfc91b5405114e3399807950fe014efc6363dd
MD5 27d648ef51fe8c4363ae2748adba382f
SHA1 01d9354f684e2a43675e3cb01f8b9d4c21f24969
SHA512 2bf96a7ec62dfd9f4b3281f635760246666e79b951ebcd1f9e3476a32225937fe0c4298fe2b12846f0c339c7e5b27a7a0e81610369710c088d4229c8eaaf0299
MD5 SHA1 SHA512

Submit Download

Unconfirmed 549044.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 549044.crdownload
Size 322KB
SHA256 83b8dc93647620239c3b81ee0177bf0f4b3ebed7636f9502858ddaa9d2e20e9f
MD5 c73d63ff522e63121e7830aa0fa505c3
SHA1 05cf82e1e9c1d9ce13497bd254984239883c0a49
SHA512 b547fa4b41d822a8292e20ff602699331d4d680762be552c193cf2143f6ea0d9ac70c3c91c89df5edf97aba87eece77a34853db3bec243b71a22b49daba67dfd
SSDEEP 6144:A6CwUmmTukhIDyjFWR48dSjnysAsfXkIfFTD/GspZTD5mrBRuFR:A5mWukhI2jFMSjysAS9X/GsfTDYrGH
MD5 SHA1 SHA512 SSDEEP

Submit Download

windowsdesktop-runtime-7.0.16-win-x64.exe

Path C:\Users\Admin\Downloads\windowsdesktop-runtime-7.0.16-win-x64.exe
Size 4.1MB
SHA256 52756f4fc9658771fde450b36ea6ee2928498f0582b1b830d4c8f386cd596433
MD5 17da66200fa40926f5d52fb921a79348
SHA1 c4fdda4c43126d1041ccea27255f7f0f9f263698
SHA512 3e87dbc7be9e46b85d511a8453bd9db3659292e0d2b703598ffb1804679c5eb8c9c20b42f5117b5c0d0e3ac1ffe298682cda8c609f47415d592c57ce178474b5
SSDEEP 98304:A/j9TJ+dVQ0EWe/Bo4K4OSgLk83IXCKjyOPsmlglRFsAmCKI6:A/jTAXEW+Bol3SA3IygxbAiAq
MD5 SHA1 SHA512 SSDEEP

Submit Download

windowsdesktop-runtime-7.0.16-win-x64.exe

Path C:\Users\Admin\Downloads\windowsdesktop-runtime-7.0.16-win-x64.exe
Size 4.0MB
SHA256 702179e350e0ef2c6e7503e42a086060728800d17eb7e2c271ae3658543bbac5
MD5 c64a7aa757c678412e6ae81aae3694f1
SHA1 ff77616376fb97f2b3b5ce128e3bd6396f4588e7
SHA512 41f69661732c4c3fa3e44f9d4d4b196e278f869298376420fe540526d6f0fe58aae8501389992293112ca7fd917457dd207eb8a56b1c2cdf91f4e70f58f7b279
SSDEEP 98304:A/j9TJ+dVQ0EWe/Bo4K4OSgLk83IXCKjyOPsmlglRFsAmCKIr:A/jTAXEW+Bol3SA3IygxbAiAb
MD5 SHA1 SHA512 SSDEEP

Submit Download

windowsdesktop-runtime-7.0.16-win-x64.exe

Path C:\Users\Admin\Downloads\windowsdesktop-runtime-7.0.16-win-x64.exe
Size 2.1MB
SHA256 d89a6e2b716aef748c9811f5cbbb3debd325857b9fdc46f64345b2cd72016727
MD5 55a0212bff3a74eff0d01d3ddf061622
SHA1 426fc462a33b8f0e181a2e1942a172bbbcdf08c7
SHA512 21510fe3fc1b22bf8761e7c4ebb20d695e83aa5baf644aeef7d3ae23bfa7cb7511aa62db813242c32791862346307a928cd4ce6ff9886b0b369df09b553c3d67
SSDEEP 49152:A5BjBbTpiSR8d9HAcK0EeuWJkJhBoBn3yKWhAtAXgLh3:A/j9TJ+dVQ0EWe/Bo4K4OSgLl
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSI91F5.tmp

Path C:\Windows\Installer\MSI91F5.tmp
Size 225KB
SHA256 3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283
MD5 d711da8a6487aea301e05003f327879f
SHA1 548d3779ed3ab7309328f174bfb18d7768d27747
SHA512 c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681
SSDEEP 3072:Q73AMq06T/ttluwYNCwzMVVv2BZb3X3DncAiE2l4v79WTflQnjSAFP40SrwMvRIs:QpAVt07kub3jcA/2c9u0AIYsi
MD5 SHA1 SHA512 SSDEEP

Submit Download

e5984ca.msi

Path C:\Windows\Installer\e5984ca.msi
Size 15.5MB
SHA256 7e38c43025c637fb4d34ce1a910d7348f78c5d3e44170f188ac232e5c601ba6e
MD5 e9c77f34378ee28b3b94d2d7c8c8d339
SHA1 5bb8cd998964ad98e75fa7deed5f1628ec11d7c9
SHA512 bd9a6a5a1289ad8653ebd7430bfd689b15edb16a1201f0ac83ea99ca01e7586b0fdffd5471dbd7eaef906a898a716e46e0249953b328136b215e0ceb5a012867
SSDEEP 393216:DdB1vloCIkmHY4rpVRBtu5bFtWHMHelRjPAdm5a6Hb16w:DdBVqCIkQY6zu5fvkPEux
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet_host_7.0.16_win_x64.msi

Path C:\Windows\Temp\{0886E58C-E06A-4C00-ADFF-64651FD8E452}\dotnet_host_7.0.16_win_x64.msi
Size 744KB
SHA256 7c01b2af6cd178d88dc11b2c12840beb0b08f8dc4e8958ba8d7166759e0c64b8
MD5 a1f68b5ec6da37ffc65f12f106d70f3d
SHA1 1bef05fa3f179a9ad079326a5a38b7728a81967c
SHA512 0dc65ee5f8a4720012e678dbeaaa44df10e12ad7941f4835c37a0d178abb7f282d0ee13e7b45fc56141489826c3c980020179ffb5973989a463f4aeacd188a93
SSDEEP 12288:xnV4L6uVt07kw3jl2tBds5IBjxMbJxuz+N1qq:Vq6uVql3CBdxqTm+f
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet_hostfxr_7.0.16_win_x64.msi

Path C:\Windows\Temp\{0886E58C-E06A-4C00-ADFF-64651FD8E452}\dotnet_hostfxr_7.0.16_win_x64.msi
Size 804KB
SHA256 7b32cfc57dae7fe08f7ed00d54771107aeb4b80305a7269f6b9ac2cb19710c35
MD5 3db1b0ad874499a5bd80b9ad2ed2103f
SHA1 77f02d58918daa3cb25364960a1196ce2f711d0f
SHA512 e2214799e8febb31e2dadeef8904e5692fb94f916500960642b780a4b68f9bd2d8d7e62d579418bcced9a7b0f7ff958e672783fc019617d17499e8c5e1b777e1
SSDEEP 12288:Ce80wWJ+9ryuVt07kw3jl2tBds5IBjxMbJxuz+N1qq:Ce8BWJUyuVql3CBdxqTm+f
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet_runtime_7.0.16_win_x64.msi

Path C:\Windows\Temp\{0886E58C-E06A-4C00-ADFF-64651FD8E452}\dotnet_runtime_7.0.16_win_x64.msi
Size 11.7MB
SHA256 30f97183b2d20ba6b0f7ec54802d40e04ad7bc17b4cf81e403b14c24fc41ed5f
MD5 365b0fc58509ccbe0c576448f96ad4ad
SHA1 1b0e09c452e630b174fd667a0ddb4166a7cf0db9
SHA512 b5d1195acecd5374b9c412f86291fa7b7024f4f98039e464ef2bbce5bdab746d27aeac410578109b3153501ed7eddd05e47ebfc6b4a85444537ee5f9ac300ec1
SSDEEP 196608:RRd3XBxIqtQjulIPC4IOkmHYT4HLJbOILRBtu5s6Fd4uWvfFWzkidelZTeSPAdmh:DdB1vloCIkmHY4rpVRBtu5bFtWHMHelT
MD5 SHA1 SHA512 SSDEEP

Submit Download

windowsdesktop_runtime_7.0.16_win_x64.msi

Path C:\Windows\Temp\{0886E58C-E06A-4C00-ADFF-64651FD8E452}\windowsdesktop_runtime_7.0.16_win_x64.msi
Size 6.4MB
SHA256 a86afaeae8b85f4f4a632fdaf33819e12c2922ec2d609cd68af2706f4dd5e6c9
MD5 55c1151cc3934a600e10706ee09dd571
SHA1 557956f3a2ea0e15474b32f68cd7f5f7e73916c0
SHA512 9f5cc8b9f8514e2f5f83a19b25d88cb47b6ca1454467d5b991f5b41c7911ead0459ee3c0b55b30c2db49f170d877e457c5b864a3217e141f55717565377ced8d
SSDEEP 196608:s8P9HeAKXneifq1eTk3kpKgzFFjquXwfIwi:s8PUpnekqik3sFFjJXQVi
MD5 SHA1 SHA512 SSDEEP

Submit Download

thm.wxl

Path C:\Windows\Temp\{5F69609A-CDDA-414A-B7E9-383F7F10DAF5}\.ba\1033\thm.wxl
Size 5KB
SHA256 81a68046b06e09385be8449373e7ceb9e79f7724c3cf11f0b18a4489a8d4926a
MD5 d5070cb3387a0a22b7046ae5ab53f371
SHA1 bc9da146a42bbf9496de059ac576869004702a97
SHA512 8fcf621fb9ce74725c3712e06e5b37b619145078491e828c6069e153359de3bd5486663b1fa6f3bcf1c994d5c556b9964ea1a1355100a634a6c700ef37d381e3
SSDEEP 96:MT0abTxmup/vrCKATQdYQHdYCwgoVOBq9LjP5dbSE7:OQNkdYQHdYCYXt7
MD5 SHA1 SHA512 SSDEEP

Submit Download

bg.png

Path C:\Windows\Temp\{5F69609A-CDDA-414A-B7E9-383F7F10DAF5}\.ba\bg.png
Size 4KB
SHA256 9095bf7b6baa0107b40a4a6d727215be077133a190f4ca9bd89a176842141e79
MD5 9eb0320dfbf2bd541e6a55c01ddc9f20
SHA1 eb282a66d29594346531b1ff886d455e1dcd6d99
SHA512 9ada3a1757a493fbb004bd767fab8f77430af69d71479f340b8b8ede904cc94cd733700db593a4a2d2e1184c0081fd0648318d867128e1cb461021314990931d
SSDEEP 48:u+Xg+NXWbdlIr33lx9W5OstaDIy3r5XpPyvZKmXYTDeiByNxcaaaaaaaaaaaaaaE:AaXWPIrHT932JsdpPyjqDeioatEn
MD5 SHA1 SHA512 SSDEEP

Submit Download

wixstdba.dll

Path C:\Windows\Temp\{5F69609A-CDDA-414A-B7E9-383F7F10DAF5}\.ba\wixstdba.dll
Size 197KB
SHA256 41a8787fdc9467f563438daba4131191aa1eb588a81beb9a89fe8bd886c16104
MD5 4356ee50f0b1a878e270614780ddf095
SHA1 b5c0915f023b2e4ed3e122322abc40c4437909af
SHA512 b9e482efe9189683dabfc9feff8b386d7eba4ecf070f42a1eebee6052cfb181a19497f831f1ea6429cfcce1d4865a5d279b24bd738d702902e9887bb9f0c4691
SSDEEP 3072:4Fj2AYmaHqco56wsPZozShZTjVORuXzv7x5Okw7QWwF4QUdPArtOuw6meOlONtZz:4Fj2ARaKaPZ3TjcAR5OflbQ7tOzKh40V
MD5 SHA1 SHA512 SSDEEP

Submit Download

windowsdesktop-runtime-7.0.16-win-x64.exe

Path C:\Windows\Temp\{7147FFCA-9567-47E9-8F48-F87AAD599A66}\.cr\windowsdesktop-runtime-7.0.16-win-x64.exe
Size 610KB
SHA256 6a7a85e1b9e899ce83ca29eca2e0b34126acf97675991b431b279278a03c41f2
MD5 9656c3086081a41540338b94df6ae084
SHA1 dc87b2d0dde3604437d13d2f89fe9ecb7c7b0373
SHA512 7bdfc5943968403b787700f5c4e12d88f34bdca4569fbff21e178c17eba40f8db68135aaf426b990617316c10b86687a08375c611c4a9e5a8db8eb2c2be3e9cc
SSDEEP 12288:f5mWukhI2jFMSjysAS9X/GsfTDYrGiJ91Brr8GU0yJlhrY2Dnm6:f5mWpI2jFM5sFzfTpi71R8dZd
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4696-0-0x000001CA45220000-0x000001CA45221000-memory.dmp

Download

memory/4696-12-0x000001CA45220000-0x000001CA45221000-memory.dmp

Download

memory/4696-10-0x000001CA45220000-0x000001CA45221000-memory.dmp

Download

memory/4696-11-0x000001CA45220000-0x000001CA45221000-memory.dmp

Download

memory/4696-9-0x000001CA45220000-0x000001CA45221000-memory.dmp

Download

memory/4696-8-0x000001CA45220000-0x000001CA45221000-memory.dmp

Download

memory/4696-7-0x000001CA45220000-0x000001CA45221000-memory.dmp

Download

memory/4696-6-0x000001CA45220000-0x000001CA45221000-memory.dmp

Download

memory/4696-2-0x000001CA45220000-0x000001CA45221000-memory.dmp

Download

memory/4696-1-0x000001CA45220000-0x000001CA45221000-memory.dmp

Download