d7f4f437d785c27b5beabc3169c0b043a48b080ac1e68396536f037c499507a7

Analysis

user interaction
yes
max time kernel
97s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/04/2026, 14:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Project Launcher_0.0.1_x64_en-US.msi
Size 5.2MB
Sample260419-r2txfaas4v
SHA256 d7f4f437d785c27b5beabc3169c0b043a48b080ac1e68396536f037c499507a7
MD5 427b1eea2bffc667001978d5beefcca7
SHA1 4d38194be9cc25ea35c59b935cb1b0602d6a740a
SHA512 52c6a059c343274806a00207275a84b1b74b22f1c83834abc820c2c4bc78e83c91dfe095458aa4418f32ba8235e7cdc20e69566dc5f7ed0ce370614f17c8c50d
SSDEEP 98304:SHi/GnW6OpdUZTTxT/AhJWrokUXgRrN+AUD6o1NpfYBh08/3978Gm:4i/GnWfdUpTdyUokUXgLhU/NpfIL3978
TLSH
T1F64633077E409913D8AB1EB3583B9331836DFC604B6165577A91722CEEF22E81D79CE2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery ransomware trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3452	Project Launcher.exe

Loads dropped DLL 1 IoCs

pid	Process
3328	MsiExec.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Project Launcher.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\Project Launcher\Project Launcher.exe	msiexec.exe
File created	C:\Program Files\Project Launcher\project.dll	msiexec.exe
File created	C:\Program Files\Project Launcher\Uninstall Project Launcher.lnk	msiexec.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\Installer\SourceHash{5C5BE7C8-C302-4B25-B03A-9588B6C8FB3A}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBEA8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{5C5BE7C8-C302-4B25-B03A-9588B6C8FB3A}\ProductIcon	msiexec.exe
File created	C:\Windows\Installer\e58bd6f.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e58bd6f.msi	msiexec.exe
File created	C:\Windows\Installer\{5C5BE7C8-C302-4B25-B03A-9588B6C8FB3A}\ProductIcon	msiexec.exe
File created	C:\Windows\Installer\e58bd71.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000f6f843118761a0680000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000f6f843110000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900f6f84311000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1af6f84311000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1df6f84311000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134210834188620970"	msedgewebview2.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe

Modifies registry class 26 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8C7EB5C5203C52B40BA359886B8CBFA3\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8C7EB5C5203C52B40BA359886B8CBFA3\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8C7EB5C5203C52B40BA359886B8CBFA3\ShortcutsFeature = "MainProgram"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8C7EB5C5203C52B40BA359886B8CBFA3\PackageCode = "D4307FCC1FCCB4F46B2C813B159906AE"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8C7EB5C5203C52B40BA359886B8CBFA3\Version = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8C7EB5C5203C52B40BA359886B8CBFA3\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8C7EB5C5203C52B40BA359886B8CBFA3\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8C7EB5C5203C52B40BA359886B8CBFA3\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8C7EB5C5203C52B40BA359886B8CBFA3\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8C7EB5C5203C52B40BA359886B8CBFA3\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8C7EB5C5203C52B40BA359886B8CBFA3\ProductIcon = "C:\\Windows\\Installer\\{5C5BE7C8-C302-4B25-B03A-9588B6C8FB3A}\\ProductIcon"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8C7EB5C5203C52B40BA359886B8CBFA3\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\5438292D84D67495C85F93713E30FFEC\8C7EB5C5203C52B40BA359886B8CBFA3	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8C7EB5C5203C52B40BA359886B8CBFA3\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8C7EB5C5203C52B40BA359886B8CBFA3\MainProgram	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8C7EB5C5203C52B40BA359886B8CBFA3\External	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8C7EB5C5203C52B40BA359886B8CBFA3\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\5438292D84D67495C85F93713E30FFEC	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8C7EB5C5203C52B40BA359886B8CBFA3\SourceList\PackageName = "Project Launcher_0.0.1_x64_en-US.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8C7EB5C5203C52B40BA359886B8CBFA3\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8C7EB5C5203C52B40BA359886B8CBFA3	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8C7EB5C5203C52B40BA359886B8CBFA3\Environment = "MainProgram"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8C7EB5C5203C52B40BA359886B8CBFA3	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8C7EB5C5203C52B40BA359886B8CBFA3\ProductName = "Project Launcher"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8C7EB5C5203C52B40BA359886B8CBFA3\Language = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8C7EB5C5203C52B40BA359886B8CBFA3\Assignment = "1"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4552	msiexec.exe
4552	msiexec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
60	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	772	msiexec.exe
Token: SeIncreaseQuotaPrivilege	772	msiexec.exe
Token: SeSecurityPrivilege	4552	msiexec.exe
Token: SeCreateTokenPrivilege	772	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	772	msiexec.exe
Token: SeLockMemoryPrivilege	772	msiexec.exe
Token: SeIncreaseQuotaPrivilege	772	msiexec.exe
Token: SeMachineAccountPrivilege	772	msiexec.exe
Token: SeTcbPrivilege	772	msiexec.exe
Token: SeSecurityPrivilege	772	msiexec.exe
Token: SeTakeOwnershipPrivilege	772	msiexec.exe
Token: SeLoadDriverPrivilege	772	msiexec.exe
Token: SeSystemProfilePrivilege	772	msiexec.exe
Token: SeSystemtimePrivilege	772	msiexec.exe
Token: SeProfSingleProcessPrivilege	772	msiexec.exe
Token: SeIncBasePriorityPrivilege	772	msiexec.exe
Token: SeCreatePagefilePrivilege	772	msiexec.exe
Token: SeCreatePermanentPrivilege	772	msiexec.exe
Token: SeBackupPrivilege	772	msiexec.exe
Token: SeRestorePrivilege	772	msiexec.exe
Token: SeShutdownPrivilege	772	msiexec.exe
Token: SeDebugPrivilege	772	msiexec.exe
Token: SeAuditPrivilege	772	msiexec.exe
Token: SeSystemEnvironmentPrivilege	772	msiexec.exe
Token: SeChangeNotifyPrivilege	772	msiexec.exe
Token: SeRemoteShutdownPrivilege	772	msiexec.exe
Token: SeUndockPrivilege	772	msiexec.exe
Token: SeSyncAgentPrivilege	772	msiexec.exe
Token: SeEnableDelegationPrivilege	772	msiexec.exe
Token: SeManageVolumePrivilege	772	msiexec.exe
Token: SeImpersonatePrivilege	772	msiexec.exe
Token: SeCreateGlobalPrivilege	772	msiexec.exe
Token: SeCreateTokenPrivilege	772	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	772	msiexec.exe
Token: SeLockMemoryPrivilege	772	msiexec.exe
Token: SeIncreaseQuotaPrivilege	772	msiexec.exe
Token: SeMachineAccountPrivilege	772	msiexec.exe
Token: SeTcbPrivilege	772	msiexec.exe
Token: SeSecurityPrivilege	772	msiexec.exe
Token: SeTakeOwnershipPrivilege	772	msiexec.exe
Token: SeLoadDriverPrivilege	772	msiexec.exe
Token: SeSystemProfilePrivilege	772	msiexec.exe
Token: SeSystemtimePrivilege	772	msiexec.exe
Token: SeProfSingleProcessPrivilege	772	msiexec.exe
Token: SeIncBasePriorityPrivilege	772	msiexec.exe
Token: SeCreatePagefilePrivilege	772	msiexec.exe
Token: SeCreatePermanentPrivilege	772	msiexec.exe
Token: SeBackupPrivilege	772	msiexec.exe
Token: SeRestorePrivilege	772	msiexec.exe
Token: SeShutdownPrivilege	772	msiexec.exe
Token: SeDebugPrivilege	772	msiexec.exe
Token: SeAuditPrivilege	772	msiexec.exe
Token: SeSystemEnvironmentPrivilege	772	msiexec.exe
Token: SeChangeNotifyPrivilege	772	msiexec.exe
Token: SeRemoteShutdownPrivilege	772	msiexec.exe
Token: SeUndockPrivilege	772	msiexec.exe
Token: SeSyncAgentPrivilege	772	msiexec.exe
Token: SeEnableDelegationPrivilege	772	msiexec.exe
Token: SeManageVolumePrivilege	772	msiexec.exe
Token: SeImpersonatePrivilege	772	msiexec.exe
Token: SeCreateGlobalPrivilege	772	msiexec.exe
Token: SeCreateTokenPrivilege	772	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	772	msiexec.exe
Token: SeLockMemoryPrivilege	772	msiexec.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
772	msiexec.exe
772	msiexec.exe
772	msiexec.exe
3452	Project Launcher.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4552 wrote to memory of 3328	4552	msiexec.exe	88
PID 4552 wrote to memory of 2384	4552	msiexec.exe	99
PID 772 wrote to memory of 3452	772	msiexec.exe	104
PID 3452 wrote to memory of 60	3452	Project Launcher.exe	105
PID 60 wrote to memory of 2644	60	msedgewebview2.exe	106
PID 60 wrote to memory of 5016	60	msedgewebview2.exe	107
PID 60 wrote to memory of 5016	60	msedgewebview2.exe	107
PID 60 wrote to memory of 5016	60	msedgewebview2.exe	107
PID 60 wrote to memory of 4540	60	msedgewebview2.exe	108
PID 60 wrote to memory of 704	60	msedgewebview2.exe	109
PID 60 wrote to memory of 704	60	msedgewebview2.exe	109
PID 60 wrote to memory of 4480	60	msedgewebview2.exe	110
PID 60 wrote to memory of 4480	60	msedgewebview2.exe	110
PID 60 wrote to memory of 4480	60	msedgewebview2.exe	110

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\Project Launcher_0.0.1_x64_en-US.msi"
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:772
- C:\Program Files\Project Launcher\Project Launcher.exe
  "C:\Program Files\Project Launcher\Project Launcher.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3452
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name="Project Launcher.exe" --webview-exe-version=0.0.1 --user-data-dir="C:\Users\Admin\AppData\Local\com.project.launcher\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=3452.1148.232663616994837009
    3⤵
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:60
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.project.launcher\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.project.launcher\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ffe09a3b078,0x7ffe09a3b084,0x7ffe09a3b090
      4⤵
      PID:2644
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.project.launcher\EBWebView" --webview-exe-name="Project Launcher.exe" --webview-exe-version=0.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1740,i,14601977668491256576,11815084544301150290,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1736 /prefetch:2
      4⤵
      PID:5016
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.project.launcher\EBWebView" --webview-exe-name="Project Launcher.exe" --webview-exe-version=0.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2028,i,14601977668491256576,11815084544301150290,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2044 /prefetch:3
      4⤵
      PID:4540
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.project.launcher\EBWebView" --webview-exe-name="Project Launcher.exe" --webview-exe-version=0.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2356,i,14601977668491256576,11815084544301150290,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:8
      4⤵
      PID:704
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.project.launcher\EBWebView" --webview-exe-name="Project Launcher.exe" --webview-exe-version=0.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3564,i,14601977668491256576,11815084544301150290,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
      4⤵
      PID:4480

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4552
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding E8875876C7CDCA938BD9B5360F8E7427 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3328
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:2384

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:4472

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e58bd70.rbs

Path C:\Config.Msi\e58bd70.rbs
Size 10KB
SHA256 3a5857baa2205bf746166e5a4847a571f3ae97c2efd4f46c80879c57df38c029
MD5 c6be823a7ffc10a17c178d590f80599a
SHA1 f30ee60feceeb3be7b21f72912648a96ffe67c72
SHA512 6c0424b2af032258a539b71f52b3d31f708e914d50be669df44eebd580c011e4e685cf001764fb1fbd947246b39b0ab8de044f9df9959aa289c1bbe36b9aedea
SSDEEP 192:OcdBdCZdCHdCAqdCXdCx2dCbRcdxeAgiyCdFdNPGpd2CdFdNPc7np3pdQMHYdHci:OcdBdCZdCHdCVdCXdCMdCGdJghCdFdNu
TLSH
T161222203A604C1E2F8AA0B38C71337317FE7D7889715529F09DEA5360E477886E5A29F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Project Launcher.exe

Path C:\Program Files\Project Launcher\Project Launcher.exe
Size 10.4MB
SHA256 0766a3013038fe5a7c3a5ce48694874828432eea96248c470e2cf2a3a941032a
MD5 06ac443a7f91cd50f7a18c993cd2970f
SHA1 40e0ef9f166c94b1be8311f8c850b94e76be914c
SHA512 c33e6a54b7842d314710f370aa090583cd387fdedffa7fc77deded62d949a2a62384570436bac4b66eadb2b3bf252555583495a5da12b005d9dcbf81aa881e13
SSDEEP 98304:bXnM/g966Yl+yr6AUQ2P5sNuRQ0N8DBPk0ibqjQoQKi+Q:eFv9iWtB
TLSH
T141B62921EA5B99ADC15AC870C3864A735E2130DB1B36B9FF45C455393FA9BF41F38228
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Project Launcher.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Project Launcher\Project Launcher.lnk
Size 2KB
SHA256 769106da1e3fd8d057818a14165d7688f608d017566232a6b0312ba500ab470c
MD5 8c2eb373ae3a615fb4781ddf2607208a
SHA1 d701435e22ecdef7b0e21fd3c5685dc2cf4ee2d1
SHA512 0bcbc21a4ad36c96b16823c47bf279c8c45623ad34d0956def48fd2bd0d7e1ec4d649b7e1cbdc51d3647396d426cd1095332b08fd5d56b1174e310936fb15153
TLSH
T1F741CB0043D657A9F37693794EB10A31AF33FC26E6348E2F4089D28E0974900AD68F6B
MD5 SHA1 SHA512 TLSH

Submit Download

Project Launcher.lnk~RFe58bff0.TMP

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Project Launcher\Project Launcher.lnk~RFe58bff0.TMP
Size 2KB
SHA256 48641aaf8ac953c6fb77c18cf1a75e00c6bbd057e4ab9d40ee38d4270250dde1
MD5 4827d1aaf82030bafd407a43f63c8acf
SHA1 2a46bc947243c2f7100ee856b08429e2cf969035
SHA512 f9a8f57af735956fcd4a56b16bd7349e2e8f276703a1be71734e707a775cf4ecfa39b83e4f291274828e8b5844eafb05e661bd11d5236e77614dcb47b19078b7
TLSH
T122418A1003D657A9F37693794EB50A31AF33FC16A6348E2F4095E28A0974501A958F6B
MD5 SHA1 SHA512 TLSH

Submit Download

MSI7441.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI7441.tmp
Size 132KB
SHA256 7f47d98ab25cfea9b3a2e898c3376cc9ba1cd893b4948b0c27caa530fd0e34cc
MD5 cfbb8568bd3711a97e6124c56fcfa8d9
SHA1 d7a098ae58bdd5e93a3c1b04b3d69a14234d5e57
SHA512 860cbf3286ac4915580cefaf56a9c3d48938eb08e3f31b7f024c4339c037d7c8bdf16e766d08106505ba535be4922a87dc46bd029aae99a64ea2fc02cf3aec04
SSDEEP 3072:Kx2YbpcgwmiTPJDnCO+DATkURBnrskNwPj2:XXgwmY1CPx2XG2
TLSH
T1DBD39D02B5D0C473D9BE09390870DB229F7EB930DF909EDB636856699E702C19E35A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.project.launcher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 9812353cc68c5d7c8e06d2ff6467b01c675524cd852f8f23f5832f7a65faa14d
MD5 a782cda6b1e8178346bae25a26560b65
SHA1 26043c4d03f81836212fd9b262d1f4a5593923b4
SHA512 f3dec6c2212b7a2bf3dc1efb77f2956fa26772faede39ccc4749527e120c3709f1a1ce719fac7d34a1dc53de9df88d282fbf51738ccb5ca6674897f68cd6f700
TLSH
T1E1D0129636420134C02027730003A1181442E91F8109C1105829992E1E140640D12451
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.project.launcher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 443b8a7b06f496c81a27fa98c45d2a245af5fee28677363627615956ab5efacb
MD5 f4db65992db8da07c97567ee0bb6add8
SHA1 9cba8c8c060951a29b636f15f2cc2d64302492c0
SHA512 86ecc7aa5ae7deb7c73c59c567f810a7f1d637d00ecb4bf2a014108e7c50b00a772a90363aee9a0740f43d6ae0cec2eb404c03274d6c27a61903282119581a76
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.project.launcher\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.project.launcher\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 16a90fcccca8639aa61c0a551517cd55861d55cf050dfb1d26c04ba77c908bad
MD5 149a6047863cb2bcfcfaae1aef7599cf
SHA1 3087ed29796af365493f6e5f0e44f13711a2a22a
SHA512 16da4693ba0f90379687a3af9169c52b0010f8adaf64116be940aa37fc08bc2efdb4c9fda0e5c7fd8c3fa99f62294643c969c392cbf9163ce7def0bb25ff6950
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.project.launcher\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 336B
SHA256 667675981043701c41de6246b8c4075521a19073fce88f7cc15479d9392a7ee4
MD5 08954ef13116c2c3a51793633a57bb1a
SHA1 caf2f374f366b3323587445d3c4c07db5907528d
SHA512 c02a315f9affdeb1663762f0e89b64a7307e305d0293c816ffc69eb01d78efd3a916c8fa373de852ec37dc8c2f6a70a30ef04c50361a44f8419558335907f2d3
TLSH
T1F2E0A9A04A20C4C8F7E01A7158C3E48832FCBD2919170C8412ED08FCCD4472836DC1A3
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.project.launcher\EBWebView\Default\DawnGraphiteCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.project.launcher\EBWebView\Default\DawnGraphiteCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\com.project.launcher\EBWebView\Default\DawnGraphiteCache\index
Size 256KB
SHA256 f8772b90f44ebba0bf073ea7f327a9b802417682536628fee98dc78e02600b5a
MD5 0bd39863dfa337e5a1cadcd9e9169473
SHA1 aa3f0482120d9f5885e087bd559017056e9a2c87
SHA512 e458b6927f907158fb04ef8a97372fa383cb040dadfec7ea80a34bb620cd064008bc57a26393b81e2634ef987c7845b035d7ab78ed0088f712a70b59ddf7c826
SSDEEP 3:LstlNllkll/lLal:LsX3lEtLa
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.project.launcher\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.project.launcher\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.project.launcher\EBWebView\Default\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.project.launcher\EBWebView\Default\Network\Network Persistent State
Size 955B
SHA256 24d2ebf66a961543201f6350d4282e324ceb21f2a5859fbe4eb94b755fa446e6
MD5 41e7dd164a5cc88e74904adab7674349
SHA1 b839a749ccb4af54f3db1c23910b8e4090681d44
SHA512 ff1130b8aef489807fe0a64976f1b6f2ebc836581bbd9c705299189d763b20be3ec30cd9c67804c4ff3c19e0b60d6e12ff845814c155ab0c45050888bc62fb90
TLSH
T12F1178B782E486AD892152FC2A202D1BCF5D080907BD2D6989E2EF8B57E1474E20054E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe59c53a.TMP

Path C:\Users\Admin\AppData\Local\com.project.launcher\EBWebView\Default\Network\Network Persistent State~RFe59c53a.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.project.launcher\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.project.launcher\EBWebView\Default\Preferences
Size 6KB
SHA256 f7c484f4a8d31b7358eeac2932b29a2157d3079a6bc3e45aeccf016afd06398b
MD5 7a57889dfe3b978834ac38c260ca4be3
SHA1 48f38a5bc68c75d7b990064f9d24146e14a8ffbf
SHA512 741dde836b6aa1a79af19af50ae2075ac6f68db3f82443616930e4b50baa35856c54f5a7a6dac61d6b141b6742e1cdba6c45d947142d9496bd8b74aab240b8c9
SSDEEP 192:stU031d24fInZ8paZ2/S+Wi7KfwxBdqm2M8:stl31d/wW1/VMwxB8
TLSH
T16ED1D8075F6869774CC7E21DBA35BB57E2FA102166D51E98EFFC860C08DA6CD220790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.project.launcher\EBWebView\Default\Preferences
Size 6KB
SHA256 7db4942c2382df54446008ef31caed5ce56f248d308e51dc51332d263bc7603b
MD5 f878c4b96442fd26c562617487055019
SHA1 f58cc043ed6cab0b98c51ab659cf4725b818d340
SHA512 cc494bdddeeef9e30e3238b1c7fcc5f240659d67d458451044ce21afa38b2c1589c11dc27d6cd4dea658ca4dcf8503ec5ce9e22c03a31e1d8c3728bb2a646c0b
SSDEEP 192:stU031d24fLnZ8paZ2/S+Wi77UoxBdqm+K8:stl31d/zW1/VMoxn8
TLSH
T13FE1C9079E68697B4CC7E11D7935BB67E2FA102166D41F98EFFC860C08DA2DD620790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.project.launcher\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.project.launcher\EBWebView\Local State
Size 16KB
SHA256 1a9620c3ea4b95edd69d9329717c8a66299bb531f1a69603abd5f1ae415f4be5
MD5 8e397a263dab4c5f59237bda31e91e41
SHA1 0bf7e97c8aa88312abb6f4442b9c74e8c227cfb1
SHA512 145bcfc932402a34e1c17c33f94e9e57e193a8ae456c32bfa72c14447139e2693f5b0e395d3667e4cb3968117020a4f2744391acfdba1a220e72daad91a6c37b
SSDEEP 384:z/fRE5BdEZfr0kuh9Rt/nP9yi3Nbkol11nu06GQx:jRkurqhNsiKKTX6GQx
TLSH
T128729D638930A9376CE7850B39092B07A5F8844A96D62EA4ADDD1F0D06D7BCA1323D33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.project.launcher\EBWebView\Local State
Size 2KB
SHA256 caf15e2ee1a43da69070a6dc0d045779eda6760f8e02c032abf06bc53ac21c38
MD5 dd16ae0a9f9febe9cde960a94f5b7a09
SHA1 c9eaa754e41be7faee77e9ca84c613d8d62b8f12
SHA512 d1f78362bf7bd00cd5656748cf582520912a99968fcb5494ec625a8ee8eb6bb240c059da2176953bf8a0d1b78b45467ba258ea194a02605022ce1179870f1efc
TLSH
T16C51A573A858AB378DE25949B9453FA36E75806686622F70D9DD0F0C01EB69D2703C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.project.launcher\EBWebView\Local State
Size 3KB
SHA256 35fec983ea2d9e09b85f6e95d47a3aad40138a40485d525a3d4e4475acdd6ae5
MD5 898e84502b2a6175e365658600fc243f
SHA1 a2d399df7f3c943e199a20d842eb330fb9029f31
SHA512 281d590c5cb9ab8d624c2eec97377a11f2a8de773743670aa3eb9404913fae0789eec8bfc8d5246a117ec0f338261049bd4a68d55edc8f1bd2bc9ac10907b0bc
TLSH
T14E71A63BA9A8AA374DE29905B9852B537BA58037D1953FA5D9ED0F0C01EB7CC2302C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.project.launcher\EBWebView\Local State
Size 1KB
SHA256 ca73e136f593c0adc58d160beae03d9fcb7ab57c5cab7ec58120c5c7072ce4c7
MD5 43a21a405ad2d8a037f875e95b3aec0c
SHA1 da38e54f5877515ca89cf6b3594971c2deabb826
SHA512 39fe2c6a6dfd3c23dcd4d5fd7c6f2155dae935dc7db09368bc16bddfb8e58c6c70d12d778bd84be1ac4c0c159a309886240f9876426b053bf95524fe20fb8343
TLSH
T15F3185B7E5D52F336DD2694AB2012AE32E50806B81115F60D1CE4F0C01FBACD6A27C32
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.project.launcher\EBWebView\Local State
Size 16KB
SHA256 23915039818646f0d83af469e85d158701dca3d2972f9e31d2bf565fbe73841d
MD5 6ee2fe265ca8c3a2cfdef9b5a3ed30d6
SHA1 e492bef46a214bf7a66cdb54cf95f19680bb7af6
SHA512 f4fb4347af564fb6ea16cd75d82629a7dc17c05e93992e01baff35c98432e0dd844a444d9f82f9665eac0026cc1ad0d265ad07bd311a4ae31d58ba0431d897cf
SSDEEP 384:zBfRE5BdEZfr0kuh9Rt/nP9yxNbkoV11nu06GQx:pRkurqhNsYITX6GQx
TLSH
T16B729E638934A9376CE7850A39092F0365F4845A96A63AA4BCDD1F0D06D7BDA1363D33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe5993f9.TMP

Path C:\Users\Admin\AppData\Local\com.project.launcher\EBWebView\Local State~RFe5993f9.TMP
Size 1KB
SHA256 4feefcc9184cc15be6c085d8095dda382402d3452d1a96c9d3743125be569e68
MD5 d4e7edfaf34bc4f4e86e8456c64bd3a0
SHA1 007c6c0d9d4027cad74dea1e660a23654f2e93b4
SHA512 06cdca44d55f919e27110ac44c49bc63825b70c6e7e91bbe0e4b2cfd84efa5803606f9ba11e216f04fdf4ad1a8c3b1c6572887366340aed45d4a1d8990c354c2
TLSH
T1E12162B7D4D96F37BDD1580AB2016BD72E90806B81105F24D1CE4F0901EBACD6A26C33
MD5 SHA1 SHA512 TLSH

Submit Download

e58bd6f.msi

Path C:\Windows\Installer\e58bd6f.msi
Size 5.2MB
SHA256 d7f4f437d785c27b5beabc3169c0b043a48b080ac1e68396536f037c499507a7
MD5 427b1eea2bffc667001978d5beefcca7
SHA1 4d38194be9cc25ea35c59b935cb1b0602d6a740a
SHA512 52c6a059c343274806a00207275a84b1b74b22f1c83834abc820c2c4bc78e83c91dfe095458aa4418f32ba8235e7cdc20e69566dc5f7ed0ce370614f17c8c50d
SSDEEP 98304:SHi/GnW6OpdUZTTxT/AhJWrokUXgRrN+AUD6o1NpfYBh08/3978Gm:4i/GnWfdUpTdyUokUXgLhU/NpfIL3978
TLSH
T1F64633077E409913D8AB1EB3583B9331836DFC604B6165577A91722CEEF22E81D79CE2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.1MB
SHA256 fa552b5e663ecd3eb5c6c3faa7f31845ab96f20030216a24e5727b9c5c72f272
MD5 b1e38c4ef86f6be39d49611550a629b9
SHA1 fc5f9c37cfbb3a8deaa6ecfee9c95ac471c7a598
SHA512 4bee844bd878b114505a8fc84db99e84ce286988fd5b624911459ca00f5cc77485e162af6a7b5fb9a660fb2e3b44a8ab286832e92eb888920e80c0940c902b77
SSDEEP 24576:Qu8m+1zLdoO/vvTLbW0ORG6A1d0zMlUyYymt2r1VsUqVuzN54/19sSvBh:c
TLSH
T1DB47B62436F92101E7F7AE3CB8F0AA234D3A7D579C19DE8D45411B4E0921BB1E872F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{ad35858b-29f2-4aa1-8e5c-a34e345ee2ae}_OnDiskSnapshotProp

Path \??\Volume{1143f8f6-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{ad35858b-29f2-4aa1-8e5c-a34e345ee2ae}_OnDiskSnapshotProp
Size 6KB
SHA256 2aeea0ae950cbba089c4e4c89670730dd25db7ac060fa80d4b547e2dc8ab9aa4
MD5 16b6c50faca4f41bdff05cbb4fa0370e
SHA1 a8eb9c728860d7d7d29b4b18a6d610a56b0e9c85
SHA512 ef03d378c1a399fc27ad4df7e408a5be123d28e05a7f17e0fdd7754c13a72f088710cfe52c85b4a317d0272c2d81f28ee473818d227b31014d59dd86bc9664ec
SSDEEP 96:FEZqJvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:Gqb++ZVmN
TLSH
T141D18A085AF54711E2B3AB7129F14557A877B911EF33CB8E0298638E2670A10F835F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/60-436-0x000002154C7D0000-0x000002154C7F7000-memory.dmp

Download

memory/60-274-0x0000021544150000-0x000002154415C000-memory.dmp

Download

memory/60-275-0x000002154C7D0000-0x000002154C7F7000-memory.dmp

Download

memory/60-276-0x000002154C800000-0x000002154C83B000-memory.dmp

Download

memory/60-273-0x0000021544110000-0x000002154413C000-memory.dmp

Download

memory/60-437-0x000002154C800000-0x000002154C83B000-memory.dmp

Download

memory/60-435-0x0000021544150000-0x000002154415C000-memory.dmp

Download

memory/60-434-0x0000021544110000-0x000002154413C000-memory.dmp

Download

memory/704-113-0x00007FFE27EA0000-0x00007FFE27EA1000-memory.dmp

Download

memory/704-114-0x00007FFE27EE0000-0x00007FFE27EE1000-memory.dmp

Download

memory/4480-197-0x00007FFE28450000-0x00007FFE28451000-memory.dmp

Download

memory/5016-293-0x0000027657600000-0x0000027657715000-memory.dmp

Download

memory/5016-76-0x00007FFE28450000-0x00007FFE28451000-memory.dmp

Download