5b66855b96edf996d990c343867829bc6e81a401c94d91d6083f858a06a81d66

Analysis

user interaction
yes
max time kernel
136s
max time network
137s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
24/05/2026, 23:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Voidstrap.exe
Size 31.8MB
Sample260524-3vl4sshv2q
SHA256 5b66855b96edf996d990c343867829bc6e81a401c94d91d6083f858a06a81d66
MD5 55c32fe519d5ec6236b72c1f62b16821
SHA1 424d3b5aec15d368ec1c1d3ebf48de5797675177
SHA512 7f348ef7e4ba8357b88c3a83db80aa4cfad2d3dc9a60eba3f9e3ad4b35b70500b51ace4a0aed5fbcbfa498ed40740e1ffe99a9b4226ebc8058246936d88ef0f6
SSDEEP 196608:noo90CFHS3hVvAkCPIqpM8R4ripPK5kWObAbN03qDtIsL7s32vrbObyUIBsPVs:H90CIfoINs4SmtIAO3AIsL7s3GbObw
TLSH
T11D778C0AA3D88621D37B877986765206D672BC266311D7CF268CFA4D1F737C1C9B2623
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery persistence

Malware Config

Signatures

Downloads MZ/PE file 2 IoCs

flow	pid	Process
81	2780	msedge.exe
179	2780	msedge.exe

Executes dropped EXE 8 IoCs

pid	Process
2232	windowsdesktop-runtime-10.0.8-win-x64.exe
1972	wixstdba.exe
4784	windowsdesktop-runtime-10.0.8-win-x64.exe
2936	windowsdesktop-runtime-10.0.8-win-x64.exe
4912	windowsdesktop-runtime-10.0.8-win-x64.exe
4020	wixstdba.exe
2092	windowsdesktop-runtime-10.0.8-win-x64.exe
3968	Voidstrap.exe

Loads dropped DLL 64 IoCs

pid	Process
4160	MsiExec.exe
4160	MsiExec.exe
3444	MsiExec.exe
3444	MsiExec.exe
1572	MsiExec.exe
1572	MsiExec.exe
2656	MsiExec.exe
2656	MsiExec.exe
4160	MsiExec.exe
4160	MsiExec.exe
3968	Voidstrap.exe
3968	Voidstrap.exe
3968	Voidstrap.exe
3968	Voidstrap.exe
3968	Voidstrap.exe
3968	Voidstrap.exe
3968	Voidstrap.exe
3968	Voidstrap.exe
3968	Voidstrap.exe
3968	Voidstrap.exe
3968	Voidstrap.exe
3968	Voidstrap.exe
3968	Voidstrap.exe
3968	Voidstrap.exe
3968	Voidstrap.exe
3968	Voidstrap.exe
3968	Voidstrap.exe
3968	Voidstrap.exe
3968	Voidstrap.exe
3968	Voidstrap.exe
3968	Voidstrap.exe
3968	Voidstrap.exe
3968	Voidstrap.exe
3968	Voidstrap.exe
3968	Voidstrap.exe
3968	Voidstrap.exe
3968	Voidstrap.exe
3968	Voidstrap.exe
3968	Voidstrap.exe
3968	Voidstrap.exe
3968	Voidstrap.exe
3968	Voidstrap.exe
3968	Voidstrap.exe
3968	Voidstrap.exe
3968	Voidstrap.exe
3968	Voidstrap.exe
3968	Voidstrap.exe
3968	Voidstrap.exe
3968	Voidstrap.exe
3968	Voidstrap.exe
3968	Voidstrap.exe
3968	Voidstrap.exe
3968	Voidstrap.exe
3968	Voidstrap.exe
3968	Voidstrap.exe
3968	Voidstrap.exe
3968	Voidstrap.exe
3968	Voidstrap.exe
3968	Voidstrap.exe
3968	Voidstrap.exe
3968	Voidstrap.exe
3968	Voidstrap.exe
3968	Voidstrap.exe
3968	Voidstrap.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{044C9B3D-6B2E-4F02-BA14-700EE8ECE6BF} = "\"C:\\ProgramData\\Package Cache\\{044C9B3D-6B2E-4F02-BA14-700EE8ECE6BF}\\windowsdesktop-runtime-10.0.8-win-x64.exe\" /burn.runonce"	windowsdesktop-runtime-10.0.8-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{044C9B3D-6B2E-4F02-BA14-700EE8ECE6BF} = "\"C:\\ProgramData\\Package Cache\\{044C9B3D-6B2E-4F02-BA14-700EE8ECE6BF}\\windowsdesktop-runtime-10.0.8-win-x64.exe\" /burn.runonce"	windowsdesktop-runtime-10.0.8-win-x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
145	camo.githubusercontent.com
146	camo.githubusercontent.com
158	camo.githubusercontent.com
185	raw.githubusercontent.com
91	raw.githubusercontent.com

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	Voidstrap.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	Voidstrap.exe
File opened (read-only)	\??\G:	Voidstrap.exe
File opened (read-only)	\??\M:	Voidstrap.exe
File opened (read-only)	\??\O:	Voidstrap.exe
File opened (read-only)	\??\Q:	Voidstrap.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\R:	Voidstrap.exe
File opened (read-only)	\??\U:	Voidstrap.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	Voidstrap.exe
File opened (read-only)	\??\K:	Voidstrap.exe
File opened (read-only)	\??\L:	Voidstrap.exe
File opened (read-only)	\??\X:	Voidstrap.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	Voidstrap.exe
File opened (read-only)	\??\P:	Voidstrap.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	Voidstrap.exe
File opened (read-only)	\??\J:	Voidstrap.exe
File opened (read-only)	\??\N:	Voidstrap.exe
File opened (read-only)	\??\Z:	Voidstrap.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\H:	Voidstrap.exe
File opened (read-only)	\??\T:	Voidstrap.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	Voidstrap.exe
File opened (read-only)	\??\V:	Voidstrap.exe
File opened (read-only)	\??\W:	Voidstrap.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.8\System.IO.IsolatedStorage.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.8\System.Reflection.DispatchProxy.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.8\Accessibility.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.8\PresentationFramework-SystemXmlLinq.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.8\ru\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.8\Microsoft.DiaSymReader.Native.amd64.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.8\System.Data.DataSetExtensions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.8\System.Diagnostics.Contracts.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.8\de\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.8\pt-BR\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.8\tr\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.8\System.Resources.Reader.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.8\zh-Hant\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.8\System.Reflection.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.8\System.Threading.Tasks.Extensions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.8\WindowsBase.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.8\PresentationFramework.Fluent.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.8\System.Design.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.8\it\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.8\zh-Hans\UIAutomationTypes.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.8\System.Reflection.Extensions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.8\System.Threading.ThreadPool.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.8\pl\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.8\pt-BR\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.8\System.Net.Http.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.8\System.Text.RegularExpressions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.8\System.Xml.Serialization.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.8\System.Xml.XPath.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.8\System.ValueTuple.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.8\System.Diagnostics.EventLog.Messages.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.8\WindowsBase.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.8\zh-Hans\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.8\System.IO.Compression.FileSystem.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.8\System.Net.WebSockets.Client.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.8\PresentationFramework-SystemData.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.8\System.Security.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.8\fr\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.8\zh-Hans\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.8\System.Linq.AsyncEnumerable.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.8\System.Private.CoreLib.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.8\System.Threading.Channels.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.8\System.Diagnostics.PerformanceCounter.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.8\UIAutomationProvider.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.8\cs\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.8\pl\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.8\cs\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.8\pl\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.8\pt-BR\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.8\System.Collections.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.8\clrgcexp.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.8\es\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.8\ja\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.8\ru\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.8\zh-Hans\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.8\System.Net.Ping.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.8\System.Windows.Forms.Design.Editors.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.8\es\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.8\fr\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.8\tr\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.8\System.Net.WebClient.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.8\pt-BR\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.8\System.Linq.Queryable.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.8\es\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.8\System.ComponentModel.Primitives.dll	msiexec.exe

Drops file in Windows directory 63 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\~DF0F05429633897CE4.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFC45FFBE5592C4736.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFE0EF40E83A19CF57.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF304AF6840D944B51.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e58b65c.msi	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3600_1254866544\manifest.json	msedge.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB8FD.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFB87CDD1389ACF2C2.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3600_699512788\protocols.json	msedge.exe
File created	C:\Windows\Installer\e58b657.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDFE7.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3600_699512788\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\~DF4CDB589FA10242C2.TMP	msiexec.exe
File created	C:\Windows\Installer\e58b652.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB94D.tmp	msiexec.exe
File created	C:\Windows\Installer\e58b64b.msi	msiexec.exe
File created	C:\Windows\Installer\e58b651.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{D5E1F20D-D271-483B-8963-1360DE7F28FF}	msiexec.exe
File created	C:\Windows\Installer\SourceHash{455C1E9B-235E-4724-B36E-2C33FDA8BD1F}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICEAD.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE19D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB870.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e58b652.msi	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3600_1744467147\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\~DFFB2034B92CF237AC.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBB52.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC304.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB98C.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB735.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF78A36D246C8C42CD.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF1CE4047CEFD908BD.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF07B6817B3B6131DD.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3600_1254866544\nav_config.json	msedge.exe
File opened for modification	C:\Windows\Installer\e58b64b.msi	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149\fileCoreHostExe	msiexec.exe
File created	C:\Windows\SystemTemp\~DF1A6D0D6B2F522460.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF57F37FF2C5A6101B.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE3B1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149\fileCoreHostExe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE400.tmp	msiexec.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\Installer\e58b656.msi	msiexec.exe
File created	C:\Windows\Installer\e58b65c.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID0C2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID324.tmp	msiexec.exe
File created	C:\Windows\Installer\e58b660.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF57A6AE52CCADA1C5.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFC934575966B5B060.TMP	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\SystemTemp\~DFA1C0FEF55CC31013.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB7D3.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149	msiexec.exe
File created	C:\Windows\SystemTemp\~DFD3C90519B3349B5C.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFDE8FE2D3526217EB.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFE82513AA7CAD6F43.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF56ACAD142A82DF2F.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e58b657.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{FF569AC6-1EA2-422C-9E46-F013FDDC4776}	msiexec.exe
File created	C:\Windows\Installer\SourceHash{B57D6467-F8D0-45AD-AE54-0CF1B28B9982}	msiexec.exe
File created	C:\Windows\Installer\e58b65b.msi	msiexec.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 2 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.8-win-x64.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Voidstrap.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wixstdba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.8-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.8-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.8-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wixstdba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.8-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.8-win-x64.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2780	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 13 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2B	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134241404292207130"	msedge.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x64\Dependents	windowsdesktop-runtime-10.0.8-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6CA965FF2AE1C224E9640F31DFCD7467\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{90d77843-5fbd-64ef-6bdf-df7574d01646}	windowsdesktop-runtime-10.0.8-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{90d77843-5fbd-64ef-6bdf-df7574d01646}\ = "{044C9B3D-6B2E-4F02-BA14-700EE8ECE6BF}"	windowsdesktop-runtime-10.0.8-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\6CA965FF2AE1C224E9640F31DFCD7467\MainFeature	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6CA965FF2AE1C224E9640F31DFCD7467\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_80.32.52183_x64\Dependents	windowsdesktop-runtime-10.0.8-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\7646D75B0D8FDA54EA45C01F2BB89928	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7646D75B0D8FDA54EA45C01F2BB89928\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{B57D6467-F8D0-45AD-AE54-0CF1B28B9982}v80.32.52183\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3D8A9697CCE5422713D2A65EFCF320F3\D02F1E5D172DB38498363106EDF782FF	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6CA965FF2AE1C224E9640F31DFCD7467\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D02F1E5D172DB38498363106EDF782FF\ProductName = "Microsoft .NET Host FX Resolver - 10.0.8 (x64)"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B9E1C554E53242743BE6C233DF8ADBF1\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x64\Dependents\{044C9B3D-6B2E-4F02-BA14-700EE8ECE6BF}	windowsdesktop-runtime-10.0.8-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6CA965FF2AE1C224E9640F31DFCD7467\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\dotnet_runtime_80.32.52183_x64	windowsdesktop-runtime-10.0.8-win-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7646D75B0D8FDA54EA45C01F2BB89928\Version = "1344326615"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.32.52183_x64	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B9E1C554E53242743BE6C233DF8ADBF1\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x64	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7646D75B0D8FDA54EA45C01F2BB89928\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x64\Dependents\{044C9B3D-6B2E-4F02-BA14-700EE8ECE6BF}	windowsdesktop-runtime-10.0.8-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B9E1C554E53242743BE6C233DF8ADBF1\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6CA965FF2AE1C224E9640F31DFCD7467\ProductName = "Microsoft Windows Desktop Runtime - 10.0.8 (x64)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6CA965FF2AE1C224E9640F31DFCD7467\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6CA965FF2AE1C224E9640F31DFCD7467\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{FF569AC6-1EA2-422C-9E46-F013FDDC4776}v80.32.52183\\"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\roblox\ = "URL:Roblox Protocol"	Voidstrap.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-125073035-2952146151-721812867-1000\{CA1D6063-A961-4BCE-BBC3-1C20DDB7F9E7}	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{90d77843-5fbd-64ef-6bdf-df7574d01646}\Version = "10.0.8.50000"	windowsdesktop-runtime-10.0.8-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A8A84F1AA6E5EFD5BE00C8237B84D6D4\7646D75B0D8FDA54EA45C01F2BB89928	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\dotnet_runtime_80.32.52183_x64	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B9E1C554E53242743BE6C233DF8ADBF1\Version = "1344326615"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6CA965FF2AE1C224E9640F31DFCD7467\SourceList\PackageName = "windowsdesktop-runtime-10.0.8-win-x64.msi"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\roblox-player\DefaultIcon	Voidstrap.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\roblox-player\shell	Voidstrap.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\windowsdesktop_runtime_80.32.52183_x64	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D02F1E5D172DB38498363106EDF782FF\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{90d77843-5fbd-64ef-6bdf-df7574d01646}\ = "{044C9B3D-6B2E-4F02-BA14-700EE8ECE6BF}"	windowsdesktop-runtime-10.0.8-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B9E1C554E53242743BE6C233DF8ADBF1	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B9E1C554E53242743BE6C233DF8ADBF1\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\windowsdesktop_runtime_80.32.52183_x64	windowsdesktop-runtime-10.0.8-win-x64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\roblox-player\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Voidstrap\\Voidstrap.exe"	Voidstrap.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D02F1E5D172DB38498363106EDF782FF\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D02F1E5D172DB38498363106EDF782FF\SourceList\Media\1 = ";"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B9E1C554E53242743BE6C233DF8ADBF1\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\97D23B51F1F59DB5FB711CFA7F676167\6CA965FF2AE1C224E9640F31DFCD7467	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_80.32.52183_x64\Dependents\{044C9B3D-6B2E-4F02-BA14-700EE8ECE6BF}	windowsdesktop-runtime-10.0.8-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7646D75B0D8FDA54EA45C01F2BB89928\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7646D75B0D8FDA54EA45C01F2BB89928\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B9E1C554E53242743BE6C233DF8ADBF1	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\roblox\shell	Voidstrap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6CA965FF2AE1C224E9640F31DFCD7467\PackageCode = "931B477A782C6D947B38D5240B620454"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\roblox-player\ = "URL:Roblox Protocol"	Voidstrap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\roblox\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Voidstrap\\Voidstrap.exe\" -player \"%1\""	Voidstrap.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{90d77843-5fbd-64ef-6bdf-df7574d01646}	windowsdesktop-runtime-10.0.8-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7646D75B0D8FDA54EA45C01F2BB89928\SourceList\PackageName = "dotnet-host-10.0.8-win-x64.msi"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D02F1E5D172DB38498363106EDF782FF\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.32.52183_x64\Dependents	windowsdesktop-runtime-10.0.8-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_80.32.52183_x64\ = "{FF569AC6-1EA2-422C-9E46-F013FDDC4776}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_80.32.52183_x64\Dependents\{044C9B3D-6B2E-4F02-BA14-700EE8ECE6BF}	windowsdesktop-runtime-10.0.8-win-x64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\roblox-player\URL Protocol	Voidstrap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D02F1E5D172DB38498363106EDF782FF\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{D5E1F20D-D271-483B-8963-1360DE7F28FF}v80.32.52183\\"	msiexec.exe

NTFS ADS 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.8-win-x64.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Voidstrap.exe:Zone.Identifier	msedge.exe
File created	C:\Users\Admin\AppData\Local\Voidstrap\Voidstrap.exe\:Zone.Identifier:$DATA	Voidstrap.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3304	msiexec.exe
3304	msiexec.exe
3304	msiexec.exe
3304	msiexec.exe
3304	msiexec.exe
3304	msiexec.exe
3304	msiexec.exe
3304	msiexec.exe
3304	msiexec.exe
3304	msiexec.exe
3968	Voidstrap.exe
3780	msedge.exe
3780	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4784	windowsdesktop-runtime-10.0.8-win-x64.exe
Token: SeIncreaseQuotaPrivilege	4784	windowsdesktop-runtime-10.0.8-win-x64.exe
Token: SeSecurityPrivilege	3304	msiexec.exe
Token: SeCreateTokenPrivilege	4784	windowsdesktop-runtime-10.0.8-win-x64.exe
Token: SeAssignPrimaryTokenPrivilege	4784	windowsdesktop-runtime-10.0.8-win-x64.exe
Token: SeLockMemoryPrivilege	4784	windowsdesktop-runtime-10.0.8-win-x64.exe
Token: SeIncreaseQuotaPrivilege	4784	windowsdesktop-runtime-10.0.8-win-x64.exe
Token: SeMachineAccountPrivilege	4784	windowsdesktop-runtime-10.0.8-win-x64.exe
Token: SeTcbPrivilege	4784	windowsdesktop-runtime-10.0.8-win-x64.exe
Token: SeSecurityPrivilege	4784	windowsdesktop-runtime-10.0.8-win-x64.exe
Token: SeTakeOwnershipPrivilege	4784	windowsdesktop-runtime-10.0.8-win-x64.exe
Token: SeLoadDriverPrivilege	4784	windowsdesktop-runtime-10.0.8-win-x64.exe
Token: SeSystemProfilePrivilege	4784	windowsdesktop-runtime-10.0.8-win-x64.exe
Token: SeSystemtimePrivilege	4784	windowsdesktop-runtime-10.0.8-win-x64.exe
Token: SeProfSingleProcessPrivilege	4784	windowsdesktop-runtime-10.0.8-win-x64.exe
Token: SeIncBasePriorityPrivilege	4784	windowsdesktop-runtime-10.0.8-win-x64.exe
Token: SeCreatePagefilePrivilege	4784	windowsdesktop-runtime-10.0.8-win-x64.exe
Token: SeCreatePermanentPrivilege	4784	windowsdesktop-runtime-10.0.8-win-x64.exe
Token: SeBackupPrivilege	4784	windowsdesktop-runtime-10.0.8-win-x64.exe
Token: SeRestorePrivilege	4784	windowsdesktop-runtime-10.0.8-win-x64.exe
Token: SeShutdownPrivilege	4784	windowsdesktop-runtime-10.0.8-win-x64.exe
Token: SeDebugPrivilege	4784	windowsdesktop-runtime-10.0.8-win-x64.exe
Token: SeAuditPrivilege	4784	windowsdesktop-runtime-10.0.8-win-x64.exe
Token: SeSystemEnvironmentPrivilege	4784	windowsdesktop-runtime-10.0.8-win-x64.exe
Token: SeChangeNotifyPrivilege	4784	windowsdesktop-runtime-10.0.8-win-x64.exe
Token: SeRemoteShutdownPrivilege	4784	windowsdesktop-runtime-10.0.8-win-x64.exe
Token: SeUndockPrivilege	4784	windowsdesktop-runtime-10.0.8-win-x64.exe
Token: SeSyncAgentPrivilege	4784	windowsdesktop-runtime-10.0.8-win-x64.exe
Token: SeEnableDelegationPrivilege	4784	windowsdesktop-runtime-10.0.8-win-x64.exe
Token: SeManageVolumePrivilege	4784	windowsdesktop-runtime-10.0.8-win-x64.exe
Token: SeImpersonatePrivilege	4784	windowsdesktop-runtime-10.0.8-win-x64.exe
Token: SeCreateGlobalPrivilege	4784	windowsdesktop-runtime-10.0.8-win-x64.exe
Token: SeRestorePrivilege	3304	msiexec.exe
Token: SeTakeOwnershipPrivilege	3304	msiexec.exe
Token: SeRestorePrivilege	3304	msiexec.exe
Token: SeTakeOwnershipPrivilege	3304	msiexec.exe
Token: SeRestorePrivilege	3304	msiexec.exe
Token: SeTakeOwnershipPrivilege	3304	msiexec.exe
Token: SeRestorePrivilege	3304	msiexec.exe
Token: SeTakeOwnershipPrivilege	3304	msiexec.exe
Token: SeRestorePrivilege	3304	msiexec.exe
Token: SeTakeOwnershipPrivilege	3304	msiexec.exe
Token: SeRestorePrivilege	3304	msiexec.exe
Token: SeTakeOwnershipPrivilege	3304	msiexec.exe
Token: SeRestorePrivilege	3304	msiexec.exe
Token: SeTakeOwnershipPrivilege	3304	msiexec.exe
Token: SeRestorePrivilege	3304	msiexec.exe
Token: SeTakeOwnershipPrivilege	3304	msiexec.exe
Token: SeRestorePrivilege	3304	msiexec.exe
Token: SeTakeOwnershipPrivilege	3304	msiexec.exe
Token: SeRestorePrivilege	3304	msiexec.exe
Token: SeTakeOwnershipPrivilege	3304	msiexec.exe
Token: SeRestorePrivilege	3304	msiexec.exe
Token: SeTakeOwnershipPrivilege	3304	msiexec.exe
Token: SeRestorePrivilege	3304	msiexec.exe
Token: SeTakeOwnershipPrivilege	3304	msiexec.exe
Token: SeRestorePrivilege	3304	msiexec.exe
Token: SeTakeOwnershipPrivilege	3304	msiexec.exe
Token: SeRestorePrivilege	3304	msiexec.exe
Token: SeTakeOwnershipPrivilege	3304	msiexec.exe
Token: SeRestorePrivilege	3304	msiexec.exe
Token: SeTakeOwnershipPrivilege	3304	msiexec.exe
Token: SeRestorePrivilege	3304	msiexec.exe
Token: SeTakeOwnershipPrivilege	3304	msiexec.exe

Suspicious use of FindShellTrayWindow 29 IoCs

pid	Process
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
1972	wixstdba.exe
4020	wixstdba.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3968	Voidstrap.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
3600	msedge.exe
3600	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1312 wrote to memory of 3600	1312	Voidstrap.exe	80
PID 3600 wrote to memory of 2252	3600	msedge.exe	81
PID 3600 wrote to memory of 2780	3600	msedge.exe	83
PID 3600 wrote to memory of 496	3600	msedge.exe	84
PID 3600 wrote to memory of 496	3600	msedge.exe	84
PID 3600 wrote to memory of 496	3600	msedge.exe	84
PID 3600 wrote to memory of 3196	3600	msedge.exe	85
PID 3600 wrote to memory of 3196	3600	msedge.exe	85
PID 3600 wrote to memory of 2796	3600	msedge.exe	86
PID 3600 wrote to memory of 2796	3600	msedge.exe	86
PID 3600 wrote to memory of 2796	3600	msedge.exe	86
PID 3600 wrote to memory of 4512	3600	msedge.exe	87
PID 3600 wrote to memory of 4512	3600	msedge.exe	87
PID 3600 wrote to memory of 4512	3600	msedge.exe	87
PID 3600 wrote to memory of 3140	3600	msedge.exe	89
PID 3600 wrote to memory of 5060	3600	msedge.exe	90
PID 3600 wrote to memory of 4132	3600	msedge.exe	91
PID 3600 wrote to memory of 2224	3600	msedge.exe	92
PID 3600 wrote to memory of 3140	3600	msedge.exe	89
PID 3600 wrote to memory of 3140	3600	msedge.exe	89
PID 3600 wrote to memory of 5060	3600	msedge.exe	90
PID 3600 wrote to memory of 5060	3600	msedge.exe	90
PID 3600 wrote to memory of 4132	3600	msedge.exe	91
PID 3600 wrote to memory of 4132	3600	msedge.exe	91
PID 3600 wrote to memory of 2224	3600	msedge.exe	92
PID 3600 wrote to memory of 2224	3600	msedge.exe	92
PID 3600 wrote to memory of 424	3600	msedge.exe	93
PID 3600 wrote to memory of 424	3600	msedge.exe	93
PID 3600 wrote to memory of 4252	3600	msedge.exe	95
PID 3600 wrote to memory of 4252	3600	msedge.exe	95
PID 3600 wrote to memory of 4252	3600	msedge.exe	95
PID 3600 wrote to memory of 4044	3600	msedge.exe	97
PID 3600 wrote to memory of 2040	3600	msedge.exe	96
PID 3600 wrote to memory of 4044	3600	msedge.exe	97
PID 3600 wrote to memory of 2040	3600	msedge.exe	96
PID 3600 wrote to memory of 2728	3600	msedge.exe	99
PID 3600 wrote to memory of 5004	3600	msedge.exe	100
PID 5004 wrote to memory of 2844	5004	msedge.exe	101
PID 3600 wrote to memory of 3440	3600	msedge.exe	102
PID 3600 wrote to memory of 3440	3600	msedge.exe	102
PID 3600 wrote to memory of 128	3600	msedge.exe	103
PID 3600 wrote to memory of 128	3600	msedge.exe	103
PID 3600 wrote to memory of 2656	3600	msedge.exe	104
PID 3600 wrote to memory of 2656	3600	msedge.exe	104
PID 3600 wrote to memory of 1164	3600	msedge.exe	105
PID 3600 wrote to memory of 1164	3600	msedge.exe	105
PID 3600 wrote to memory of 4212	3600	msedge.exe	106
PID 3600 wrote to memory of 4212	3600	msedge.exe	106
PID 3600 wrote to memory of 1760	3600	msedge.exe	107
PID 3600 wrote to memory of 1760	3600	msedge.exe	107
PID 3600 wrote to memory of 5024	3600	msedge.exe	108
PID 3600 wrote to memory of 832	3600	msedge.exe	109
PID 3600 wrote to memory of 5024	3600	msedge.exe	108
PID 3600 wrote to memory of 832	3600	msedge.exe	109
PID 3600 wrote to memory of 832	3600	msedge.exe	109
PID 3600 wrote to memory of 3960	3600	msedge.exe	110
PID 3600 wrote to memory of 2232	3600	msedge.exe	111
PID 2232 wrote to memory of 1972	2232	windowsdesktop-runtime-10.0.8-win-x64.exe	112
PID 2232 wrote to memory of 4784	2232	windowsdesktop-runtime-10.0.8-win-x64.exe	113
PID 3304 wrote to memory of 4160	3304	msiexec.exe	115
PID 3304 wrote to memory of 3444	3304	msiexec.exe	116
PID 3304 wrote to memory of 1572	3304	msiexec.exe	118
PID 2936 wrote to memory of 4912	2936	windowsdesktop-runtime-10.0.8-win-x64.exe	120
PID 3600 wrote to memory of 3344	3600	msedge.exe	121

C:\Users\Admin\AppData\Local\Temp\Voidstrap.exe
"C:\Users\Admin\AppData\Local\Temp\Voidstrap.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.NETCore.App&framework_version=10.0.0&arch=x64&rid=win-x64&os=win10&gui=true
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x350,0x7ffd5c3bc188,0x7ffd5c3bc194,0x7ffd5c3bc1a0
    3⤵
    PID:2252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1840,i,1958262201202863376,1123987185698842866,524288 --field-trial-handle=2272,i,1772149462303017663,2712906234866687057,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:11
    3⤵
    - Downloads MZ/PE file
    - System Time Discovery
    PID:2780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1612,i,2779921102629526187,8768540704983018378,262144 --field-trial-handle=2272,i,1772149462303017663,2712906234866687057,262144 --variations-seed-version --mojo-platform-channel-handle=2028 /prefetch:2
    3⤵
    PID:496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2452,i,16630471426203838035,18300681904795036207,524288 --field-trial-handle=2272,i,1772149462303017663,2712906234866687057,262144 --variations-seed-version --mojo-platform-channel-handle=2612 /prefetch:13
    3⤵
    PID:3196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,8368539471617377843,1499506720266114602,2097152 --field-trial-handle=2272,i,1772149462303017663,2712906234866687057,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
    3⤵
    PID:2796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,9149325981863545781,1758427962710329281,2097152 --field-trial-handle=2272,i,1772149462303017663,2712906234866687057,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
    3⤵
    PID:4512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4244,i,10723152665579754390,9711176148054468366,2097152 --field-trial-handle=2272,i,1772149462303017663,2712906234866687057,262144 --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:1
    3⤵
    PID:3140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4256,i,5457404930033307597,6279043642285393009,2097152 --field-trial-handle=2272,i,1772149462303017663,2712906234866687057,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:9
    3⤵
    PID:5060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4276,i,695595825331755251,10641500548663248182,2097152 --field-trial-handle=2272,i,1772149462303017663,2712906234866687057,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:9
    3⤵
    PID:4132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4264,i,3489711345230350100,12814882282389447577,2097152 --field-trial-handle=2272,i,1772149462303017663,2712906234866687057,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:1
    3⤵
    PID:2224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3632,i,4895653949401804457,9804451026113261993,524288 --field-trial-handle=2272,i,1772149462303017663,2712906234866687057,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:14
    3⤵
    PID:424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3604,i,4771549441116513386,15977689462106941214,2097152 --field-trial-handle=2272,i,1772149462303017663,2712906234866687057,262144 --variations-seed-version --mojo-platform-channel-handle=1620 /prefetch:1
    3⤵
    PID:4252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4000,i,14318384273553333623,15657481155514687681,524288 --field-trial-handle=2272,i,1772149462303017663,2712906234866687057,262144 --variations-seed-version --mojo-platform-channel-handle=3928 /prefetch:14
    3⤵
    PID:2040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3996,i,6903877984426171929,7081570203087672058,524288 --field-trial-handle=2272,i,1772149462303017663,2712906234866687057,262144 --variations-seed-version --mojo-platform-channel-handle=3944 /prefetch:14
    3⤵
    PID:4044
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,4751521284800337799,3714502818367313594,524288 --field-trial-handle=2272,i,1772149462303017663,2712906234866687057,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:14
    3⤵
    PID:2472
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,4751521284800337799,3714502818367313594,524288 --field-trial-handle=2272,i,1772149462303017663,2712906234866687057,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:14
    3⤵
    PID:2728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6216,i,8999918478024990154,13090439251634473872,524288 --field-trial-handle=2272,i,1772149462303017663,2712906234866687057,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1128
      4⤵
      PID:2844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6216,i,8103437534334817421,5164312371294029413,524288 --field-trial-handle=2272,i,1772149462303017663,2712906234866687057,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:14
    3⤵
    PID:3440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6548,i,16508162465525211603,12537662092073023981,524288 --field-trial-handle=2272,i,1772149462303017663,2712906234866687057,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:14
    3⤵
    PID:128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6476,i,9825075775661125001,10263248640093991334,524288 --field-trial-handle=2272,i,1772149462303017663,2712906234866687057,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:14
    3⤵
    PID:2656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6704,i,14854501548480829520,10096309823961448156,524288 --field-trial-handle=2272,i,1772149462303017663,2712906234866687057,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:14
    3⤵
    PID:1164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6900,i,1440041388558095872,7026495974637424134,524288 --field-trial-handle=2272,i,1772149462303017663,2712906234866687057,262144 --variations-seed-version --mojo-platform-channel-handle=6904 /prefetch:14
    3⤵
    PID:4212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6704,i,4299868936088593465,1144411021968585769,524288 --field-trial-handle=2272,i,1772149462303017663,2712906234866687057,262144 --variations-seed-version --mojo-platform-channel-handle=6436 /prefetch:14
    3⤵
    PID:1760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6152,i,14011649213067690569,7693719236251954040,524288 --field-trial-handle=2272,i,1772149462303017663,2712906234866687057,262144 --variations-seed-version --mojo-platform-channel-handle=7044 /prefetch:14
    3⤵
    PID:5024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=6508,i,1061388150407941739,14780633865143234612,2097152 --field-trial-handle=2272,i,1772149462303017663,2712906234866687057,262144 --variations-seed-version --mojo-platform-channel-handle=6764 /prefetch:1
    3⤵
    PID:832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6828,i,677896279800701794,13683406188865946699,524288 --field-trial-handle=2272,i,1772149462303017663,2712906234866687057,262144 --variations-seed-version --mojo-platform-channel-handle=7256 /prefetch:14
    3⤵
    - Subvert Trust Controls: Mark-of-the-Web Bypass
    - NTFS ADS
    PID:3960
- - C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.8-win-x64.exe
    "C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.8-win-x64.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2232
  - - C:\Windows\TEMP\{B22AD9EF-31D6-4EFE-8D49-298D90856630}\.ba\wixstdba.exe
      "C:\Windows\TEMP\{B22AD9EF-31D6-4EFE-8D49-298D90856630}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{33977DCE-7608-4F31-AC96-39166B1BDCFB} {CF12729F-8589-4A1C-BBA1-48723C414843}
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      PID:1972
  - - C:\Windows\TEMP\{B22AD9EF-31D6-4EFE-8D49-298D90856630}\.be\windowsdesktop-runtime-10.0.8-win-x64.exe
      "C:\Windows\TEMP\{B22AD9EF-31D6-4EFE-8D49-298D90856630}\.be\windowsdesktop-runtime-10.0.8-win-x64.exe" -q -burn.elevated BurnPipe.{8283FF62-8378-4856-A952-4B39B43E0F9F} {23EBD1E5-3EDA-4893-ACF4-6B9077463081} 2232
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      PID:4784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5464,i,16888537789690808733,5498847881804753251,524288 --field-trial-handle=2272,i,1772149462303017663,2712906234866687057,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:14
    3⤵
    PID:3344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7780,i,17411433156494156053,15277527271010855434,524288 --field-trial-handle=2272,i,1772149462303017663,2712906234866687057,262144 --variations-seed-version --mojo-platform-channel-handle=7924 /prefetch:14
    3⤵
    PID:1620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7892,i,11406030690205862402,4473722450687649727,524288 --field-trial-handle=2272,i,1772149462303017663,2712906234866687057,262144 --variations-seed-version --mojo-platform-channel-handle=7244 /prefetch:14
    3⤵
    PID:1760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3604,i,17532523880406217208,16215181176914513591,524288 --field-trial-handle=2272,i,1772149462303017663,2712906234866687057,262144 --variations-seed-version --mojo-platform-channel-handle=7068 /prefetch:14
    3⤵
    PID:4092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,12422617991345442904,11511197715806416644,524288 --field-trial-handle=2272,i,1772149462303017663,2712906234866687057,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:14
    3⤵
    PID:5024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=7956,i,15088897410287616304,9706446375850255858,2097152 --field-trial-handle=2272,i,1772149462303017663,2712906234866687057,262144 --variations-seed-version --mojo-platform-channel-handle=7992 /prefetch:1
    3⤵
    PID:2880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=8132,i,7735244021531956097,13357520367177755584,2097152 --field-trial-handle=2272,i,1772149462303017663,2712906234866687057,262144 --variations-seed-version --mojo-platform-channel-handle=3964 /prefetch:1
    3⤵
    PID:1676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=7976,i,4117239416903478062,10636052531275444769,2097152 --field-trial-handle=2272,i,1772149462303017663,2712906234866687057,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:1
    3⤵
    PID:2272
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8024,i,12072236350568594997,15039552770870618742,524288 --field-trial-handle=2272,i,1772149462303017663,2712906234866687057,262144 --variations-seed-version --mojo-platform-channel-handle=7940 /prefetch:14
    3⤵
    PID:4668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=5620,i,13143438117900614675,17129608687462480820,2097152 --field-trial-handle=2272,i,1772149462303017663,2712906234866687057,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
    3⤵
    PID:3144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=8200,i,3471890807083880764,11751911072432067257,2097152 --field-trial-handle=2272,i,1772149462303017663,2712906234866687057,262144 --variations-seed-version --mojo-platform-channel-handle=8052 /prefetch:1
    3⤵
    PID:2092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7840,i,2459668798953363984,16231327261567449953,524288 --field-trial-handle=2272,i,1772149462303017663,2712906234866687057,262144 --variations-seed-version --mojo-platform-channel-handle=3872 /prefetch:14
    3⤵
    - Subvert Trust Controls: Mark-of-the-Web Bypass
    - NTFS ADS
    PID:4788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8148,i,15388610677860724802,360660573571431153,524288 --field-trial-handle=2272,i,1772149462303017663,2712906234866687057,262144 --variations-seed-version --mojo-platform-channel-handle=8140 /prefetch:14
    3⤵
    PID:1836
- - C:\Users\Admin\Downloads\Voidstrap.exe
    "C:\Users\Admin\Downloads\Voidstrap.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Enumerates connected drives
    - Modifies registry class
    - NTFS ADS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    PID:3968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8216,i,15191328230651528229,16344128327074189143,524288 --field-trial-handle=2272,i,1772149462303017663,2712906234866687057,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:14
    3⤵
    PID:3792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7928,i,636613411214027797,11095908461419878283,262144 --field-trial-handle=2272,i,1772149462303017663,2712906234866687057,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3780

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1028

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3304
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 22F0E8A5301AE99042CC319E6DA5916B
  2⤵
  - Loads dropped DLL
  PID:4160
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding AD315CA7F2A2F6CFAA4AF602993A788F
  2⤵
  - Loads dropped DLL
  PID:3444
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 0225FD784C86BD955580EBAEDE0299BF
  2⤵
  - Loads dropped DLL
  PID:1572
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 700C9290EF669386EA6FFA8173315D61
  2⤵
  - Loads dropped DLL
  PID:2656
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 713D6F07C6CE4851CB8788DF08141D02
  2⤵
  - Loads dropped DLL
  PID:4160

C:\ProgramData\Package Cache\{044C9B3D-6B2E-4F02-BA14-700EE8ECE6BF}\windowsdesktop-runtime-10.0.8-win-x64.exe
"C:\ProgramData\Package Cache\{044C9B3D-6B2E-4F02-BA14-700EE8ECE6BF}\windowsdesktop-runtime-10.0.8-win-x64.exe" /burn.runonce
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2936
- C:\ProgramData\Package Cache\{044C9B3D-6B2E-4F02-BA14-700EE8ECE6BF}\windowsdesktop-runtime-10.0.8-win-x64.exe
  "C:\ProgramData\Package Cache\{044C9B3D-6B2E-4F02-BA14-700EE8ECE6BF}\windowsdesktop-runtime-10.0.8-win-x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.8_(x64)_20260525005405.log"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4912
- - C:\Windows\TEMP\{02FB6F96-34A6-4378-A2AC-E02830DF87F5}\.ba\wixstdba.exe
    "C:\Windows\TEMP\{02FB6F96-34A6-4378-A2AC-E02830DF87F5}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{9E69CEFB-3ECF-4611-A06A-103491E494B2} {D5F96927-9C7C-4C0F-8696-61E21BA18D99}
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:4020
- - C:\ProgramData\Package Cache\{044C9B3D-6B2E-4F02-BA14-700EE8ECE6BF}\windowsdesktop-runtime-10.0.8-win-x64.exe
    "C:\ProgramData\Package Cache\{044C9B3D-6B2E-4F02-BA14-700EE8ECE6BF}\windowsdesktop-runtime-10.0.8-win-x64.exe" -q -burn.elevated BurnPipe.{B2527984-CFBA-4274-95D4-6D119F6ACFCF} {087E7FE4-67CE-4149-AE55-17DD268ECEA0} 4912
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2092

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1760

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e58b64e.rbs

Path C:\Config.Msi\e58b64e.rbs
Size 11KB
SHA256 1055948c0e7bc76cd75d64469c71905c3d7d4563a06d797834ccdaaca8038531
MD5 9f0bd2ec740858c6b9fbbe53e83e5e21
SHA1 9fa2fe140950a4613dfba18097dbf7a891b9ab0e
SHA512 37330d1e18917e4fa32c827819c6dbd7d6a910a19de522c242875e926ebe89f30c9375aa42dd573b01844a8118e3b3e243ef4e8a3e984327f6829c0ed873edf2
SSDEEP 192:3/fCxu2Utr5HjQY9CJtw0Idw0nnEe0ZC+nepa:3/fCxu2Utr5HEhw9wG+F
TLSH
T17E321181760182D3D9AB2B76DB4B2B203F72C2D98314935B44EDD0349F177C95FA96CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58b655.rbs

Path C:\Config.Msi\e58b655.rbs
Size 9KB
SHA256 5f76ccfcc5599acbc74b7d519538d5aa3356af0e4cdf1fe4cfaff3044d523a95
MD5 b4d741b2512ecbd08fe31ac4ba39e6ef
SHA1 479bf210c0b8d68a021acf3dbcb72b7a97632a4a
SHA512 e5ef8923592984bca97741a943709c5bb1884e2d82e67273f6fa3e3f3f87c19822f32aa3338e9ad79896047e480f1d88513d6ea24d700c675ef91fb2516a2ec4
SSDEEP 96:fm0ggGqALbroXJoC3hMXqUseD2EBCsTl1qUseD2EBC6jEd/Y3Tl5YHmE5U76/5yO:eNqgPoeCitl0IFl0YJE0SAgepK
TLSH
T1D0122412631089E2ECF22B39C7131B61377AF3D99304935B08DE95A4AF5B7881F6D1DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58b65a.rbs

Path C:\Config.Msi\e58b65a.rbs
Size 49KB
SHA256 89eae777733e30ffbd75d6713613f4c3e5e313ed85789d96d972916eefec5a71
MD5 37aaf6957a60bdb4455913b588916974
SHA1 49a4843b3c40a32c0070edc2a4173a61e9b538be
SHA512 430376b329bb940272ef5b0631bd73f59a0a64be9d8c69234745d10495abb0decfaa4690b867a1b1fc3a29ee7b34249f81ab914b8e1a4bc9cba03943fbc4c179
SSDEEP 1536:LQi6szlPryWnXHwngQl2UmjItQbHS5RW4069EYj6sgaSbixaDWZRKTyKncCxDHoE:KrjB8
TLSH
T16C33DF22DB10C2EAEA33B9647371DE09B335D99327495CAD21ED4574DD82BAC5FAC0C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58b65f.rbs

Path C:\Config.Msi\e58b65f.rbs
Size 71KB
SHA256 de00e5d9bfee56181d8cfc89febd5e5326c85d8aae72dfff558ac8d617dd9d03
MD5 758561039ee7f01b84a9b14f35bb7593
SHA1 c444cc47135fb6758afbb4885fddbd3ab98a89b4
SHA512 0dc0de9175aba54bae191819b6cc240ca14956964707854b02c4759494ef3a02bbe57de9144190deb790b14654807989999a3858c2996987235c1e0775949814
SSDEEP 1536:kv/IvioxFM23zr18Dww5FbH5nDsWsIWuMbJw3Fq6gZQLa1gQxT5+vXG3vHaUcG6Y:Y4byfOeaia6qAySwKlbwH
TLSH
T13F63005A6600C2D1EA373E58337BEA099F54AC6A27488D2F19C5027BDDD1AC76F7C8C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58b663.rbs

Path C:\Config.Msi\e58b663.rbs
Size 3KB
SHA256 e6afad5f7d0630942ca6fcb01edc8182c0997bd149f3117c14136743ee2a1516
MD5 f642d15e0bd7cc1296cee16e55ed1375
SHA1 22cde4eaf1f764167686ba37206063d6c6d3b9eb
SHA512 2e07479f0bad0d56b54584713deee90ddf9331654ccbecc3e705c1b98b1cfaa8a1cacf07d380ae9638a8783b44a89cd20ce9dbe60c39b0d915a04bfbc21ce26b
TLSH
T16281AB03A604E282ECF72F30DD1B07523777EAEA9364874704CC82754D87BC5AEAA5C9
MD5 SHA1 SHA512 TLSH

Submit Download

ThirdPartyNotices.txt

Path C:\Program Files\dotnet\ThirdPartyNotices.txt
Size 77KB
SHA256 deb4427a295e1ed474b0d81c5a0d972c1b550b9a715cda939cdfa9236b1b418f
MD5 0d8867a25ba926e6e40cd52ab3536b5c
SHA1 89390dc8b8318d0bfef1c6a2fb4783537e28a465
SHA512 317ca335405274f4f91b173651ca2826760acb5ba5cf41aff51adc55c2cda9059fb268333665f13f62fa48119e55a303720a780dd58d28dd9967db4c88407d61
SSDEEP 1536:HA9jHwsGfgg39/zwgAVkguQxrDjugtSEGepkWvrpX7anuqdLSVnfiStPq+3LefrL:HA97w/ogz1AVxuMjHtSFULryLOgrGWm+
TLSH
T17773A45F7E45077319E2C3916569A8C5F22FA02E3B6B2A44346EF248133B42DD6FF858
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 163KB
SHA256 cbb1746f9b08dd9825129d451d99869e84e9024e62c804dede22c9fb61e0291d
MD5 b1f5c9c9b65311bd825db803ce074f6f
SHA1 90cb0a1406e2244cc447f627a7a0c841c8d5a29b
SHA512 6d9ced782625334d0d67f926e83185b184a97b9658d5e643ebd661d9ddf1fd02aee22bfe78f8be8387e3f27e2a34a12b1afdd9d173089bb8bbeeba8e299270c5
SSDEEP 3072:dGgPfwruvTSBbQ/vp4SbDqIG/Ik7l55wKPZGgX:dGvrubgbQJDvqIgt9B
TLSH
T1F9F3071AD65811AAD16E9575CB528941BB337C668BE0E3CB13C0F8BE0F726905EF9703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

state.rsm

Path C:\ProgramData\Package Cache\{044C9B3D-6B2E-4F02-BA14-700EE8ECE6BF}\state.rsm
Size 1KB
SHA256 3a1c86a5b017b427ab4117ea739fc1b8ee977bed5ceb633df881d4d8700a3341
MD5 53e4d1e73498b0418333c668daef1219
SHA1 be6730a4fbed7b7d7cbc91933908180b5394275f
SHA512 ea04c62cc23d710106eeb184ace2ebf72e8c11b9977ac1ca8baa83b1c2e3f5dc452edcf5e71aaf6769e00266b2319b619ffbe39ddcfba44bf3b593e51e8ee45d
TLSH
T1E92181515BF6492DF3F6AB75A9F96625543BBC121D24C26E0001318A9E72BD1C874B33
MD5 SHA1 SHA512 TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 3b4e8a7493e47d173ac97c8bc0294a499febe7d1a689bf45257065c984c376ef
MD5 87fabd1f7b57e5a4f0e06d609dd9aa90
SHA1 948952c861e60c008bcfdb7eb34e4423fd30153e
SHA512 d8e5a27187e4309fe0d17ca3481d5c4acb823eaa4287eccca79411d23fb952de9557ca0e6872556c495e66447520c3b5bd769447983df82eb30de94234d14ac0
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7p:fwUQC5VwBIiElEd2K57P7p
TLSH
T12BB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
Size 3KB
SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
MD5 1de85fec2dfcc28011a7c2aaab95eb5f
SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
TLSH
T1D1611DB79A3048090E3412B86B19B35DF63E029F1AD598EB76BE568F1F710F7245C54C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3d6022b8b09d410224e6f49ce6c5693abe531fcaf66bb13ef03126afd2691fe0
MD5 57d5bda89a3ce0cec5e5ba7de9f0b14b
SHA1 f3acef3d86afcfd0b7d491c8c55dd0679342b314
SHA512 b3100104fdba74d8ec0cde3847c8629b3f4d7d2f4eb07a7e44b61ece266b201daf1b4c4f2922da6731aa7e1518a90a163383bcb9d2738a6f78d052f8141237c8
TLSH
T1D4D012237A9CA410D2A78131D017D71556A910E468575A45F2A4C86D556B0A467CD187
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 940cbc9ecbe8080b4f78231e8ea559e5f25ba4586d9b9c7484580010ea141f8b
MD5 7b136c46d44a9c4f8f42a3893196bfa2
SHA1 65e92a8f631d018328a7c2cd1ea9b52d24fb05ed
SHA512 06b71e8d2ad9deb7c9ad47e7b7fc808b8513e4cd6ba4c5e561fab3aec9e937d3990c50625c22f7f7a281e06579a42d4a615f255576af4efa3a9daab503cc1a59
TLSH
T1E7D022233A8CA800D2A78130C016C30002A900E068178A01F2A4C82C442B0E063CD183
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 ebdde57da4c1df18f74f74d3422cd9b3dbe2f4cabed4865b515db9e2d46c54d0
MD5 8debddce65821940a5e35f25768cc52f
SHA1 db78f933b3714be8ce6432273dd9821ca53b2bc4
SHA512 d6e02b767551f7edc55c460b15c870c7cc595ab3d9aaaab3b879588ffa6b959cc82579d266df8d5dadf1308b0883150102617acef418da1bc95050a8e8b9aa96
SSDEEP 96:ZlSwDgODOFLS8DMx3Ra6U3jFnfgY1o943eRF8d6GIqxmY1gIMnK4p7UCFf:ZlSkgSOFLS2fDmMe8/IqxVaIMnK4pQC9
TLSH
T1C8E11C94279E2859DB54A1B0F0D11905FAF14CABEC23AEB30364AC7C2F937914B1DDB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 b30601c7002f1bc0550c6923405297f4f414fa585cbfe6b676bc8f34d59073f7
MD5 9933fd7b92c8b3ae897b37fa716a03af
SHA1 1e85b0ce9b9f355d12dd1e7adc446a33175aa40b
SHA512 9896746c473a23f440bc9fac1a5aa8ec16da292cb604aa38debab1756c654e6e4bf875e3e64bf745e4a902820563c7ab54014dcf15af78092db28e383f08c686
TLSH
T10E71602403937842E79132F0F4E10909F6714CFBF9537EA312B0BCBE6A16765832C2A9
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58d099.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58d099.TMP
Size 3KB
SHA256 1f775905006c3f80198ca749cf296e2e2cda1f90db955fb6a8879d6f8174fba5
MD5 3802f1378d632edc8c65f00d42d4f106
SHA1 e35a5d7fb202224d88af0600d7a7054e5051de59
SHA512 7f93404ebfd60a166be62b1a083f90980c0ef37a25e0c2a7ab28bbb0f9634b544bcd68727f067a7caa79829a6db583eb3161671646e4fd60d63d7ef71600ed07
TLSH
T14E71832403637842E39132F0F1E25509F9718DFFF9577E9312A0BCBE6615B62876D288
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 b93c5ec988d7129bd8067b6d0698d065da25a2787ebf07d487abbaede0f7e478
MD5 962b8fd804d569d2d998f2161d89a120
SHA1 44ed08f0c67618df4c54e659af5d2f4c66ec5671
SHA512 f25a15903570a0b446ba226fd498277f4e37181cefe884599cae2dfff8c81ed9e1cb6dfb913f08e7d02ce0656b492399c560ddf51efd760ed37fc8dc3c2f6fcc
TLSH
T1E8519EF783E4856E8A1196F0AA18AF2FDF2D0615435C3C6A89E4EE17D3E3471E10265F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 4c1d7d3d7e431b9ceb3b20418526b8a0d99fdc655b2a973acf3caf0cde3b68f3
MD5 9384a71999fe30347ca9076281fd7fac
SHA1 20b17d39ac381ac208889dbcc2a2f87c31399f02
SHA512 571781cfe5e88a2509003b5f1d8804374c04c74934d17a8fc8ec378d6cf48220834c13543f7f25cb4ac2da067a14e8e90c9096337593ce70cdc560b307463e91
TLSH
T172D0231313183175566C1D957077EC8FCF2701651C41D9F450F09C59053145C051B284
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe59a36a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe59a36a.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 db8b10e40609648eb5beb808b647b99ff27559e67c949169d8ec0083673b632d
MD5 6241f09090ed99f017bb80efd077bcb6
SHA1 ce0863c0851dbba614d3a22f0887f98e3b5775ce
SHA512 1de805ce6b08eccb263b59f76f8ebce61bd5c50ebd1fd51f375bf04a8cbf194de7fd50dcb7f247d9b2e3614bcf2bfd39fd8a526da87422fa35d417e0a26530b5
SSDEEP 192:sxZpRdyM/jK1Ml8Mlc/fvsn7J763j0IdpfO/W6+WNrD8/Aq0YmCvIg5lJ:sxZpptc/fvs7JYtG/bc/2qt
TLSH
T1A552D716BA34597B8CDBD20AF955BF53D6F8056292904E449AFCCB0C05E6BED2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 c2e74adbe099fafaf86a060b6b9a9531396ba2532ff2fa75902659a835e755dc
MD5 9b36813ed82f5dcbd5d9b5cf2077107c
SHA1 90df282eb4dcb13b34f882b0a24949542356fdec
SHA512 b8491169460ac3b09aca89605d44c0c0cb71bcdd274d91bae0226b08ac3e80947db4016198259a2ed6ed4434ee81708147058eaa6e8d19c3d357a29ff0e3dbeb
SSDEEP 192:sxZpRdyM/jK1Ml8Mgc/fvsH7J763j0IdpfO/W6+WNrD8/Aq0YtCvIg4J:sxZpp4c/fvsbJYtG/bc/2/c
TLSH
T1C252D716AA345977CCDBD20AFA14BF53D6F80562D2904E449AFCCA0C05E6AEC2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 223a7e7c8ef240bec8e5b305f6a7fc5c87ac7f997f8f95b66ab430eee7746ca9
MD5 ff0dee524699b3fd31ad0b16a47f4b76
SHA1 d62b1ada28979dafa3f2b483be3f61ecb22f8fc2
SHA512 6678dc89b7a4ac7e91ec8be5acb55193b6d68e9110abda442e735f9ca1b29ed70a1c1e0461f473da29f972418b35f2f000f4e119e9b7b4ae78a5543f6b9180ae
SSDEEP 384:sxZNLEm4c/fvs7GYQgJ/bwGRKLh/2UOfoC:slIm4c/fwG4/b+2AC
TLSH
T14B82D852A5248977CDCBD61AF935BF53D7F80462DA914E489AFCCA0C01DA6FD2207C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 9e6f440bbac1bc3cae78ff9bcbe118b668019dc05a903cb572c4c50b216ba5a7
MD5 44485da651d8691852d3ca99484c9ee5
SHA1 7b4e66ee59b25e772bfecbfc782d2f36ac7b0d05
SHA512 00a328c25700b11dbd773803bfc888a5f66524bbab82f6ad98e46323635e372abdc2016527449d8d66223b8b04119be1f53c6a2b313d7da19977228c4c3ddce0
SSDEEP 384:sxZpLEm4c/fvs7GYTK/bwGRKLh/2UOfoC:shIm4c/fwGb/b+2AC
TLSH
T14282D85265249977CCCAD60AF935BF53D7F804629A914E4C9AFCCA0C01DA6FD2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 a04bb51ce7c63b4c80b59077ec76bdfc2b760fa8cebb5405f584fa42daa9e18a
MD5 0e9713ca8f390684a227c3dc28e56130
SHA1 c48c16f9f2743e662bd62f7452828ee936ee80b0
SHA512 11c875aefa700374ac15df3f3664142b5ac88624af9b890a16aec5807ab7789e851b2ef287de91cf651fbe2f8bad0e9f37e8a8d1ee3587ae3b179dd203546974
SSDEEP 768:BSl1j83r2Le7pLuLXemWRmeKQBC8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3J+wALl1:BSl1j83r2LeEXemWRmeKQBCu1jaKJ+w6
TLSH
T181032C3B780CCB7A4F844E9CEC267F8A6DE801CB9A98895447FA444C03C67EF55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 a92a5eae4d687d4098084560fd75f186e237e09e94da7299c1823df34654b37b
MD5 88fc5e500654157e5af2c5cd52b4ddae
SHA1 f1d253bd8713de7786445cf892599b6da5d6dd32
SHA512 bf8e5a75ff8dfed934455aa08600675fc67658ede7dda19116deba65d5d4d37a5217ddc5c6b212e009752187a33ac3c2dedfb978eb9336f3bd11d16c52165a23
SSDEEP 48:KkUIHKtecXy7mNcomMc5dPIpK4osHy9pIhKyUM+:KkUgKtemmdP+K4o+2p6KyUV
TLSH
T195A11F1631BB52433C7F784CE2A99B2B1A4271633418B5AB37A880714E77E240DFD5ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4c2b1203-c625-4fff-9be7-bfe07a8eac28.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\4c2b1203-c625-4fff-9be7-bfe07a8eac28.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 7c2164b6ea8783789fc3881f91d744ee4a52eea2a283f52d9e835ef738a81a34
MD5 50c2fa8f1fe60ec07759ef3751d4f71b
SHA1 93b0bf876a93a3ea8357a5ba4960c94c0598e853
SHA512 fa62900974c944fc8e942e6052945e4103b6ff7b440ec8452031e58f945ce75a922ba836812c8b410f134c86d565a97f3968ec26fe412d626358e3b90f25e4d3
SSDEEP 384:nYtNnNnb9t8Na/kF3htRjONgX532x8mnX5zAXDqfNcxUM:YjZbz+F3ht8S+5zATifM
TLSH
T1BA926B316878AD2749E7AA55F05B37536FBC10AB8DC82FA0D6DD9F1D01CA68C130AD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 c80d940f76ffd05ad1d15ec34834323018ac3146aa558fe15712956c1eb8e33e
MD5 798a60376420c750ef04b82dea47f095
SHA1 4af8f006dc97fd7875cfc7413fd7e768b49857e0
SHA512 4133016eb123317b61abafb8b35fb44a6175315d28dd347e57f10936d222a8cc5bc2d0b5e6854b743bbd5f18d59669440c7f6b4752dc6e2fe8ed40d99029ff9d
SSDEEP 384:n/iFKtNnNnb9u8Ni8TUNTUlIlYkF3htR3jz+/NdDf0QX532x8mnX5JAXDqfNcxUM:KFKjZbIXwgJF3htp3+/Qg+5JATifM
TLSH
T162D2B5F598D79937D8AE5783A33E6E429EBCC057B4885990F7C85E0CCC861BFC20A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 04af9156e12f7685627fe440a00265b864bae7b5df7f3715b537359c6f4d83c1
MD5 4c06b8835b2458467f604ca8090bd738
SHA1 b854f78edafced141887e85c7fb99cc0f4c71483
SHA512 99264a25d805d14ef886f2f9d861684b910029fd3db8aeafbf5b02f3edd80e3eba4598f00b376db7e63bc79c35afc65ec51b98b24dd05ba55c2d4f2dd563ed47
SSDEEP 384:n2tNnNnb9t8NaYkF3htRjONgX532x8mnX5zAXDqfNcxUM:2jZbzRF3ht8S+5zATifM
TLSH
T111925B316868AD2749E7AA55F05B37536FBC10AB89C82F90D6DD9F1D01CA68C130AD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 dd2268a0879bd6017b35031ac95939addbd130292f0ddfe89a4bf0c50f19297f
MD5 e98325339c1254e3248b551e725bd47a
SHA1 3f75597d505c34af545e2f77c12f8d1912c0776e
SHA512 a07f4469de628bebe28ac3cecc0506d08840b03d4f75f6f4d44f03ee7c24c521b3d569f6c149e22550c43c8137f79b28f8d6fb80b37092dd9f6c010996f691d3
SSDEEP 384:n/iFqtNnNnb9S8NN8TUNTUlIlYkF3htRcz+o22dxfNQX532x8mnX57AXDqfNcxUM:KFqjZbUqwgJF3htA+o2og+57ATifM
TLSH
T148D2B4F598D78937D99E5783A33E6E429EBCC057B4885990F7C85E0CCC861BFC20A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 9a2de765b87f7e33bef2cd9570149f546905398868885ca24310401593418be5
MD5 5a5ec4c170d8497ea255053c2b9b64cb
SHA1 dadd34850150128bcd8b8a8dd6ed8f04b1855d6a
SHA512 ac3479e7e9ef646cf8ca7f29671f39be3bd403a34e3d64eed6e0c92202afa0e98b789c1d1034296d28853feb74b2d06c10970bd89f1b977b5e004c783510de18
SSDEEP 384:n/iFttNnNnb9j8NN8TUNTUlIlYkF3htR1z+o22difNQX532x8mnX5qAXDqfNcxUM:KFtjZb1qwgJF3htH+o2bg+5qATifM
TLSH
T10FD2B5F598D79937D99E5783A33E6E429EBCC057B4885990F7C85E0CCC861BFC20A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 b1197ae920d81cbd3db3bea77f94c20623f6fdb836cbba55b83a686badde180b
MD5 3cc30fa221097c8091fd4c1d530eb3cf
SHA1 12e28517ff940438c4e95020aab6c509aae8f0c4
SHA512 167ab1101429b90491060061e2b39668bb354c80449f4a365ab2f439817130fe8254df3d5d83cb66f130bb004b75d8f62ac08b7062ed4022badf1336e70e018d
SSDEEP 192:uuiL8NavQizOF3hb5RNBQmiU1g9i4gX5zPr2djzorm3RJ7X5skNtF/rCgOdWH:nQ8NavkF3htRBONgX532x8mnX5xAFdI
TLSH
T16D521831B878AC2749E7A646F15B32139FF810AB9DC86F54D6ED9F1C00CA68C130AD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 4042edf3317a1e9c310752177695a836243d9df2658db3a5ec521f0d5d3003fb
MD5 b400c70f0501ddf9b4e37be08f51c952
SHA1 e01b763ff31855b5c470af0db1e311f13cd70ad2
SHA512 30dcf7d72f4d55eac3eb3f069fcf2c61bcf4cc06338f7353dc151beefef897a71c5e6eb2670c83c2eefb194ddfb4c68a85fc8807a4e2f01fa6793dc87edd32e1
SSDEEP 192:6GNu6i5fQmiUyFdZO7X5zPr2djzorm3RJyajpF9U6:6GNu62hm/O7X532x8mv79U6
TLSH
T10602B835A9A86C6B9EA3AE45B54637136FE8102BDA956F40DBEC1F1C00D764C1306D37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 657062cd7101f3534047abbcba76fa52ed2891e3fb149e0440e0eb9f591068e8
MD5 2adde562cf7dd78d67cf9235de432b2d
SHA1 31e85ea515fd6f49b40f1c6619841f14a70847fa
SHA512 6f23f51baf511563dd34ec2e5740bd3cb61b25dacf6de8ec24e60b28d442a5df5e328e8f01802d77e59af003fd410b1130eb4c503fb72d14613cdd9a567a3f8c
SSDEEP 192:6GNj6i5tQmiUy4ZP7X5zPr2djzorm3RJ7X5snGQF/rCU6:6GNj62rVP7X532x8mnX5CAU6
TLSH
T18812E831B8A8EC674DD3A945B58732639FE8107BDE89AF50D6E81F1C00CA68C170EC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 c860044a8aadd9d6333508cae7487738ab0eb1c527047fc4d09a2ab3d9a3ddf3
MD5 af23faffd8a914f94d52019e05bdbdd5
SHA1 915d737088cf52fc3dbe43b74d8f976b8a8612b3
SHA512 1e822e1f349d8240d19c81192e9f2152a2bfc8cb66092f08e9087e0af9d066cd034a7d138a27660bfba55d6c011819e60bbc755cb592ab413dbb1c19280b877b
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe598d71.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe598d71.TMP
Size 392B
SHA256 fe8817a353e31f33bcbc631709b8b43a342eef4531827109592bdde54bb70a25
MD5 2a930ff61615ea8a26c39af0e0e5c2c9
SHA1 2021ab765b2ba2481d4061acf26330f80a5be73b
SHA512 1ed5a79a9bb526e26598fdbb56c094bfa0290b9c9988eb121b84cb79003bb1b118379c50eebcc2e3f4da007d48ddb39a58c4c11d2f7a9b0585850156dc86cb0b
MD5 SHA1 SHA512

Submit Download

nav_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
Size 2KB
SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
MD5 499d9e568b96e759959dc69635470211
SHA1 2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6
SHA512 3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905
TLSH
T16B51DB73D5988C4B9BF4A29CE919A309F11107CF75D48C0B76BE010C1F7757AB5C6588
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

WMSDKNS.XML.bak

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak
Size 9KB
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
TLSH
T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a50f6563c50ca4d5dcb255ee5cfab097

Path C:\Users\Admin\AppData\Local\Roblox\rbx-storage\a5\a50f6563c50ca4d5dcb255ee5cfab097
Size 1KB
SHA256 5e710f0e8ff474aa78b2b472e371cb869268c3e033626dc6bca0d33bae704eeb
MD5 d81ce1c2102492344712a919ce2a173c
SHA1 85589cd62d0554ec6d7180230dd3e6150af0d9b9
SHA512 bc51ed0b00eff71906108351b025ca0b7edc9080c3d3631bb723f9779fdd7793ed892de87e1254e888bfb08f3586878ca92ec266bc094d74c6c46796ad9d96b8
TLSH
T1B411F6A25341A5A0FB166B7439B0FEF06171829053B29D8EF44522DD13D069D9E650A5
MD5 SHA1 SHA512 TLSH

Submit Download

4623f59f-79ed-421d-a6c8-49e33530532c.tmp

Path C:\Users\Admin\AppData\Local\Temp\4623f59f-79ed-421d-a6c8-49e33530532c.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

87585421-af4f-43af-b6d3-d4d10bda2817.tmp

Path C:\Users\Admin\AppData\Local\Temp\87585421-af4f-43af-b6d3-d4d10bda2817.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.8_(x64)_20260525005405_000_DotNetHost.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.8_(x64)_20260525005405_000_DotNetHost.log
Size 3KB
SHA256 881c306cd5ec0529bbb0c80cc5b6c06aae4a0208e21faa7e920c9270f85b0a22
MD5 7cb749d946840cfd30afe693daad7e96
SHA1 411a0088f40f6c4a8a573cc527a9500201224fee
SHA512 c05b863a6542660e55c6f0bd67e7f20d2ade9b11b99ce2417a5add07fb25f242667e8fc9b80c121077d9f2570f29731a7ea3b8342e9ef76bd4229ed97381f3ff
TLSH
T1C08129142EE80985B2B7574BEEF3C0134A77FCD19C74CB4C6386931902AB9059C6CBBA
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.8_(x64)_20260525005405_001_DotNetHostFxr.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.8_(x64)_20260525005405_001_DotNetHostFxr.log
Size 98KB
SHA256 e710a31339902dd9d0f94009cdeb04f3c39cbf47c0d036cffd48746310657079
MD5 29e71cc7849f7b996198d6dd33b0debb
SHA1 f79e82879cbb9a7293d87f89fde88076e7a0363d
SHA512 a14e61e9988272c4e133f8e99c5cec6aceb5e8941eb3c03f00067ca1f9ca3bc8fa39f62519972c172dd084cd0c42a8d0ec134d52b8caee1a849a0851768f0e0e
SSDEEP 3072:MDUle52AKrc9hfFKdvC2RCFnLJyXcavjZSguFelqKl7QNhwHMh/:Mwle52AKrc9hfFQvC2RCFnLJyXcavjZM
TLSH
T142A315192BF40085B2B3AB07DEF345278A7379165A35D94D61C2D30E01E2A09E97E7BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.8_(x64)_20260525005405_002_DotNetRuntime.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.8_(x64)_20260525005405_002_DotNetRuntime.log
Size 3KB
SHA256 060cf6db1f616291602cbd04d947122da3fbdebd88c61d476c009279d51aefcd
MD5 73b7891417324a34fa8df508b7350cb6
SHA1 5b341fbae691f326a110e3c4f607fb69b0d339d9
SHA512 70afe1ebf75bdf5053c16902d5fe69f6442823da5045be15ce45003bf0ec9cdda7a1d454367df93ee4acac499ac9e9937adcda61d46d836097f575b8e6561053
TLSH
T1A5811A152AE80C86B1B65707DDF3C4139A73FC825C74DF4D6386931A426BC099C68B7E
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.8_(x64)_20260525005405_003_WindowsDesktopRuntime.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.8_(x64)_20260525005405_003_WindowsDesktopRuntime.log
Size 2KB
SHA256 ba56f6948e0a30a0ec0e27d900531aafd5c11cebe21c2875ec13d3c5fc871eb9
MD5 f30b3677872fa3f8c50ceff5d4370b1b
SHA1 6e6fd73cad4266979ae7bcfe1fb3daafef00a9cc
SHA512 9523e4882d23f3762540824a84ecccf1afaae791314d8876870dea1c6e46fa277bb047e795c2cfbde625541b890de055212773199e730766abe2314227f6753b
TLSH
T1134148593BE40D46B2B257479EF3C1636A73FCD16870CF8C23459329066BD089CA8B6E
MD5 SHA1 SHA512 TLSH

Submit Download

a2da57cd-b68a-4e65-8ffd-f30c13304c12.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3600_2145438301\a2da57cd-b68a-4e65-8ffd-f30c13304c12.tmp
Size 147KB
SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
MD5 a9f7675ff091bb15c88909424bab4a39
SHA1 90f753d8d7e4397de0f49631fcd9222a7f59148c
SHA512 ff1f89fb04ae9c9a4c6cf6b1475f5a77f1c4f90829acda95cb39889b6b15c3b4f0b3b822a668f8ec8520b002cc90dd397cc26d314ac8fd5f3e2c9826bd458df5
SSDEEP 3072:Ph3iICVe1DvTtr/3tOpPu8LdKBTJyU4AshzWnD7UVDvuZE4tkGL:PgTVWvTZPghwln0AD7UV8Eeky
TLSH
T12BE3E01D29E2846EC82B24F4BA4A718FC71ECF07910BE40F25D984A55C7474E17E2EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3600_937108688\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetHost

Path C:\Users\Admin\AppData\Local\Temp\{B22AD9EF-31D6-4EFE-8D49-298D90856630}\DotNetHost
Size 1012KB
SHA256 538cbacb8ae48e780ad16aecc9d873e0d8f0a7017ebc5f3e2eb61d51decf73c4
MD5 dbfbeb4d900dac0d7eb8ffaab5ce99ad
SHA1 d915fee14f72296553853f6ad3ad29e9e08c6fbf
SHA512 1dbbc6b721dc0d13f8ca061c4034e5f3408b6f70ccd1099da7fb09b9aa519dfc280a15874cf932d255136bb0c8844afc378760cdf6e567059f2cbc6fc844f0cc
SSDEEP 12288:/N2etgX0xsm7HrObWMInYLE/BbdJ0zErWolCJ9TeWxqYZfDk3BJi:126gG74W6WBbdJwEqECJ9Te7Yxib
TLSH
T1B2257B1BBFA404A9D8B24E75C4B78321EE357C482320969F43A47229DEFB7D0647A7D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetHostFxr

Path C:\Users\Admin\AppData\Local\Temp\{B22AD9EF-31D6-4EFE-8D49-298D90856630}\DotNetHostFxr
Size 1.1MB
SHA256 47699683367d99ea3c003688f3474d5d8fc829ee19298b50a6c71bc61c033e65
MD5 3a9a7767d79281093cf18cd0b69cba14
SHA1 27a7282aeb750b81a93d6f269a8a47094cd46257
SHA512 284bc1c1b67d3275f528589010417d73fd58e85a9dd709d54a18cf1c4b67fbf4840cec2b0778234310931a8753aedf4d51d063743f14eda55b86489b7844cfe3
SSDEEP 24576:426gG74W6WBbdJwEqECJ9Te7YxkFjOYe5y:426748BnwEpI9T6YGVxe5
TLSH
T173357B1BBFA404A9D8A24E75C5B78321EE357C082320969F43A47229DEFB7D0647B7D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetRuntime

Path C:\Users\Admin\AppData\Local\Temp\{B22AD9EF-31D6-4EFE-8D49-298D90856630}\DotNetRuntime
Size 28.1MB
SHA256 7b3c945f4be3350087b55bdfa79110df89bce9a54fc7811ec9440d985a1fba43
MD5 423d6a2b5c3de430dbd2ce169ce2d0f9
SHA1 9edc9445e1234c586c12e059a20d81726bb1caeb
SHA512 8c6c261670795bd849ffd3410bb2e59960472d13c265e2636ff132541f2b8a8d3fb90c0bd308dde3bd1ef67c7ced54bdb80efd161f77d50a1fd7d80488af9066
SSDEEP 786432:IDzJqP7jcu4qUWR5qPSa4aERvSJYbz+U0zflc:IDzJYPc3qdR5mhu6JSx0zNc
TLSH
T12B5733537FA208AAC8724E3185BB4715BA753C893321855F03A4751ADEFB3D461BEBC2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsDesktopRuntime

Path C:\Users\Admin\AppData\Local\Temp\{B22AD9EF-31D6-4EFE-8D49-298D90856630}\WindowsDesktopRuntime
Size 28.8MB
SHA256 127775c3f4cc2855abacca0f6d764147b8d0f80448177d66fbbe98cca542b2ee
MD5 af9968fc2b24f423cc36c5ab0c89f9a0
SHA1 bcd1ab09f985bc96e5c61462d9fcf43a8810c5ef
SHA512 e143e53557f0c4b901a2abdc79094c9a88002a45a035e8aa9e6a04d5f6be970df5ad16d2f06dd7a7725075ae1939c9c5c865e4fe5372d5f83a0d4f7e5ff18705
SSDEEP 786432:Di8w87zfB7WV0uGvx9E4s6mK+WW2WjZkVC:DiJgB7J3BssWLCQ
TLSH
T11A67330BBF5408AAD4B65EB588B78310AB393C4823109A5F6A91352DDFF73E0217E7D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppSettings.json

Path C:\Users\Admin\AppData\Local\Voidstrap\AppSettings.json
Size 2KB
SHA256 f8b97a90defeecd22664f5ed92b35ecda099a843dffbf4c1d603d9f767b95a4f
MD5 0aaa036009d543f8641e9cc1e8d7e6cd
SHA1 a09373afa05cdcf6d0e964221165c44f59bd1c55
SHA512 52768e8e431f57f5708309111ec0611b6fd0b5b0af9a8efc8eb221e6640cfaf805c34ae86cecdcca6806751d896957a7d2034ce67ee9c6e3881cccbd0da3b1f9
TLSH
T16651AE22D91054FE5DBA615CC064D2476B610F2E21345C7FFAFF590E207AB367241F95
MD5 SHA1 SHA512 TLSH

Submit Download

sky512_rt.tex

Path C:\Users\Admin\AppData\Local\Voidstrap\SkyboxPack\ChromaKey\sky512_rt.tex
Size 2KB
SHA256 eeac6dbe921a9841190645bdf545dfa58d5d63b8cb225dc5dd674ad90e9fba9b
MD5 fcadb250780ccb53a0f15d821391d063
SHA1 24d53a65711940bd85f24df96e6fe792cf2569ae
SHA512 f6e222344d5cc6571959830c6a7cd63ebbe04dd989aef49a72f0daaa03290439b8fc7004e6ba26ed91aca733f6d80257c457ead45b66477b519cea4a3879549d
TLSH
T19F41276195A00FA39675C81183834CB1C7F30FE00FA9A3A6C38D5158A24AFA8A88E9C0
MD5 SHA1 SHA512 TLSH

Submit Download

Voidstrap.exe

Path C:\Users\Admin\AppData\Local\Voidstrap\Voidstrap.exe
Size 31.8MB
SHA256 5b66855b96edf996d990c343867829bc6e81a401c94d91d6083f858a06a81d66
MD5 55c32fe519d5ec6236b72c1f62b16821
SHA1 424d3b5aec15d368ec1c1d3ebf48de5797675177
SHA512 7f348ef7e4ba8357b88c3a83db80aa4cfad2d3dc9a60eba3f9e3ad4b35b70500b51ace4a0aed5fbcbfa498ed40740e1ffe99a9b4226ebc8058246936d88ef0f6
SSDEEP 196608:noo90CFHS3hVvAkCPIqpM8R4ripPK5kWObAbN03qDtIsL7s32vrbObyUIBsPVs:H90CIfoINs4SmtIAO3AIsL7s3GbObw
TLSH
T11D778C0AA3D88621D37B877986765206D672BC266311D7CF268CFA4D1F737C1C9B2623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sky512_bk.tex

Path C:\Users\Admin\AppData\Local\Voidstrap\VoidstrapMods\PlatformContent\pc\textures\sky\sky512_bk.tex
Size 682KB
SHA256 eae298532fcc04ac380d78d7cf64a26d37984b8e8af56f34ae6c18cfb2439418
MD5 4ce299ee102e97588c9ce7aace046cab
SHA1 931f0e08bf641ecbab53b080f3ae9bbd8f620cce
SHA512 14e97b2c0449cda57280140ab7737c58d79de7f405d576672bad1ddc413a207cb3def3903ee62b7b4904cf4c6b7abf451863a87479cbeba0fbc873e51c5b883b
SSDEEP 6144:QZcAjXUwfXUQcaujBQ1OYoD/6N76c3uGN9hIFbqQ5xUcB:yct68auBQExDw6c3uG1Ij5ucB
TLSH
T11AE4098E767550CE3F3723DAAA15B4B2E306E21DB26335F61B2F5188367742DC9B1920
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sky512_dn.tex

Path C:\Users\Admin\AppData\Local\Voidstrap\VoidstrapMods\PlatformContent\pc\textures\sky\sky512_dn.tex
Size 682KB
SHA256 97b98273a4261e4d36829a4aae4892837ca27c70bd22251bd7799c50516d605e
MD5 383fe0258cda26e908ea4a9bd2522b14
SHA1 18fc467f81197db8532e4784d72e9e32e122a810
SHA512 7ef6fdadb1e7e27468bf80ebe95059e6a2857f360d8dc1f4b0ca4a86fc5eb8c6156b6c38a1a17aa45f0d5fac3e247d838f27412c83f095f2c1052b0b54659f56
SSDEEP 3072:DS7zPPGKhNAXYIX/w1xMhryRBi1NjB7C6ZQUDPkWF0SU/r5eJiWwUeWd8qF:eGhYyRhryRBi1NjB7C6lk3Si5CCW6qF
TLSH
T15EE4EECCA27565C6851B57E0E920EDA1E30A726EF950306E177FE1AC743B82DDE26C13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sky512_ft.tex

Path C:\Users\Admin\AppData\Local\Voidstrap\VoidstrapMods\PlatformContent\pc\textures\sky\sky512_ft.tex
Size 682KB
SHA256 714c08b0dde8049a501eb81dc2f5e720ef785770970929934e58a575548f92d8
MD5 5a466b46a2e25c0f26c595ac6adcf9fb
SHA1 cb1ea78d4dd31f88e32946005f43115bf94b27a4
SHA512 20b7c9c164b089859490019338c2e9b73351f29cfd38db97063e12485ffb6d6eb79ffcbe6c64750886e755c5753f4e201e51d4ed07f358e5a9bdce484ccbebde
SSDEEP 6144:Sag6EnqqMMgKdVcoCSUR2R2LxfDx+Ofyz+vvBVftTmM:fgRnMMpV67R2R2Njfyz2
TLSH
T1C3E4A64EB67640CA5E3727E55A24B465D31AB32EF1B139FA167FA088347F43DC8B1812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sky512_lf.tex

Path C:\Users\Admin\AppData\Local\Voidstrap\VoidstrapMods\PlatformContent\pc\textures\sky\sky512_lf.tex
Size 682KB
SHA256 46dd4ba796c65d23ca6b4cc4d8ae48f6535f2f888a3bcfbc581d5f767a3b747f
MD5 eeddf22de1228bc4ea67f1128cdfaad4
SHA1 676cdd7a49b8d5d18b20d1beb8a43555f3d96553
SHA512 a614c0d2bb4320c70fc96e4c02b79d60b16992475f60254d5d3cc55b5aa939e116cf3724422dc7129b426e031f3176469c7b4e482a3469050b480c7361d07a28
SSDEEP 6144:aHuGtOkr2lfrKunWhy+0tjYz9UOYuszCBdZNEMX/V+VbhbVPzNH:aO5kCEunaojHAszY1XN+Vbh9zNH
TLSH
T14CE40ACD7A7550C97B2323D6AE15B4B1E20BF26EB16234FA1B1FA0443277428D9F5D22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sky512_rt.tex

Path C:\Users\Admin\AppData\Local\Voidstrap\VoidstrapMods\PlatformContent\pc\textures\sky\sky512_rt.tex
Size 682KB
SHA256 8719aac7d496b20e4198b5407b64c5571e3f241309edc9480a41806efb046560
MD5 1991a94396b8f0ed2b28805cfc17d2e8
SHA1 4c2b313b4c542bc4e007c7f47c3d3ece6dc3f6e9
SHA512 ca13c926f238351acb5a8209c1596f917c0fe91dd91f8012a34950d0d99bbaac57de6a40c8c05522da8c74b0f3dbd0b492f09b87a142badb5b15b1c21a44f678
SSDEEP 6144:tlKydRE1sZ/pRzQNakQaMaOgIqUXb5b0hJjpr0JCxpsaTC5t:tQydRosZ/TzQqgZUXd0hJjpr5xpfTkt
TLSH
T196E4550EE23790CA9E6B17E55A246861E30EF22DB1B135FF1BAB509974BF03DD8B5011
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sky512_up.tex

Path C:\Users\Admin\AppData\Local\Voidstrap\VoidstrapMods\PlatformContent\pc\textures\sky\sky512_up.tex
Size 682KB
SHA256 672375765f9c10387d204bc319dc98537a0e077a8ef395824f0f2dcde6de0f0e
MD5 f89f7a41395b548fa07bd0d295840e99
SHA1 8b61b2244fc9a505539b066da38cb0385b76bec8
SHA512 65345167dfe1ed1f141f3a939ca1f252539553e656f50e911c81dbba145d815d4243893e285756d7c9f8f703f41db1d50dc428c6425833a690744f1b410cb93f
SSDEEP 12288:4cHF30Onio8y6DUgD7YQ7MDOYwBoY01Lo:4cHD38ygFPYQoDOYwBoY01Lo
TLSH
T138E42D2AD86969C78733EB10A07494E1FC9640EE3C43862D497799ACB4B3EE53B1F543
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windowsdesktop-runtime-10.0.8-win-x64.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.8-win-x64.exe:Zone.Identifier
Size 26B
SHA256 eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
MD5 fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1 d59fc84cdd5217c6cf74785703655f78da6b582b
SHA512 aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98
MD5 SHA1 SHA512

Submit Download

MSIB735.tmp

Path C:\Windows\Installer\MSIB735.tmp
Size 392KB
SHA256 a28ed81b8594774c7e1e82f9bbe858c3b36f0d7a93067001387a5a872288231a
MD5 f1fafe5c54813a5d7b60d08b859bd58b
SHA1 95e6598ce1c02220d68edab5474980b7f0f0a12c
SHA512 6dbc8b10277c6fae8d7ba961a843810df0bb11c9c6e3ba54eea1b24e13b1069e454ef5d76d345839a32f94871855928578a15948ba242d03c990b21d8f845df9
SSDEEP 6144:u/VbdUw0z9ursTolCJSqJiIUk8AeWNxFqYrtUc06N:u/VbdJ0zErWolCJ9TeWxqYZfN
TLSH
T1CC846A29F7E418EDD4B782B6C5A68030FF75754D332095AF8BA845291F3BAA470BB701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3600_1254866544\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3600_1744467147\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3600_699512788\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
TLSH
T158C04C668D51DEAB00A747A56B295315E23B4B4B5044800A7AF5429C1A288964171944
MD5 SHA1 SHA512 TLSH

Submit Download

BootstrapperApplicationData.xml

Path C:\Windows\TEMP\{B22AD9EF-31D6-4EFE-8D49-298D90856630}\.ba\BootstrapperApplicationData.xml
Size 9KB
SHA256 03a49b2cb749e9001b852b7de84fbbf1ec4e9ab20f026df52b9b7f5600da4d8d
MD5 efe75ecd0681f1970b5eb7d92c95d087
SHA1 09e1fe2e9098cd2fca054952b376b03ba4d84ad7
SHA512 9de084c8ca97e848509443b832bec356a856fe4afa2ed633d9ae969aa7511dc5e173bbc7ba7c77b6049b39f6de026b267cc5b3af9f12dedef20cf4dd667ae42c
SSDEEP 192:2azaTPC/zvyAfnhXXa0a5N5nnjmYsCsysz:jUnsCsysz
TLSH
T19A12D2513BFD0208F0F3AF48EBF6A4555A3ABD552E39C92D01201D0F49B2E859962FB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetLogo_256x.png

Path C:\Windows\TEMP\{B22AD9EF-31D6-4EFE-8D49-298D90856630}\.ba\DotNetLogo_256x.png
Size 2KB
SHA256 0f571f95d8eab48dbc81b0ec5e9f7225e349e26ef50868bfaab556f3c2443b01
MD5 39aa52615723b782c92dec710caaec7f
SHA1 760b49e256a7979fe50a56a2b1be3688a474b886
SHA512 89d1baa3820154667747b25e9e2fd321bfb2ec71dc309915b0a28dacdc80822a4943b639ebb37c37bd2559d5a4306d2096119cd970c84a0d331f6c68b0456dc9
TLSH
T1534195CF1BFD78D7E6E557918E1A8DD232738483B4B3A42CCE7B10B8274A5642B87940
MD5 SHA1 SHA512 TLSH

Submit Download

dotnet.ico

Path C:\Windows\TEMP\{B22AD9EF-31D6-4EFE-8D49-298D90856630}\.ba\dotnet.ico
Size 44KB
SHA256 61a2cbd12868cb9b359e0c78961d409b7875f072eb8e53ea88d3e6bfe2961a18
MD5 b8096652d9ec286709a2c863b244b110
SHA1 b3b7f0f4d608fad7cb59ba499d4d17c2b873a7af
SHA512 492a5aa83220bb77c178b7c5b50bf44968c0427e9e45bb97a33df14d7fb4c667ca7adde0ebb3874c7b6011057b01144e4e6651fbad62c6bcf5e0b93586c4bc7a
SSDEEP 96:r+gfbzo+wHK9NbwOY4tIWQeVlV1W9+H+guapUjFamINUItzf1dBNaIZ:ro5HuNcH4tIzeVlV1WEOFDgUWzf1PIm
TLSH
T1E913EF6DE68547C1C10C2032DB4AC792B5233C72E4DAE0C4F9D4FA7E177906965C6E6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\TEMP\{B22AD9EF-31D6-4EFE-8D49-298D90856630}\.ba\thm.wxl
Size 7KB
SHA256 b00edd703dd8a475119d0e4dd70a3aaa47f0e95361af290e76d367a8edef3432
MD5 8b2c667a8bbad3153068c0ed90df7ec4
SHA1 c9e04a3a37e5e6262ab9bfecf78280171b8f7b74
SHA512 5269f00d474acccb4c48cb7bcfdf19e63557a388572d3a6335aa39191319691d924e27f70da3f3495387c319396476c63a8fd7b35835cca0901220e39783847b
SSDEEP 96:HiTgM1+XSNEzA0HtYQstYCpCwZQpCeyk5HQJM9ouvj9urz8:Ew9EmtYQstYCPC9e8
TLSH
T191E1026F68DFDEE03A732651B2B3698D6919C29A136F1CF0F869084B47635016377A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.xml

Path C:\Windows\TEMP\{B22AD9EF-31D6-4EFE-8D49-298D90856630}\.ba\thm.xml
Size 11KB
SHA256 dfee8e2d075087227f19c835c145c5bb8e72a46880ea24080bb2472fd3a521be
MD5 4329e418dc56b1386d7ea29a0dcfab5b
SHA1 58387f92e89ca21b4179fb697c7de9675c59142f
SHA512 6934873d27e6efbb94da4f13ee8369b29995490051016fdf82800256b924902306d328bf1d4ebbf266d1a53eb24adb6478d1a67de4ecc3e3bcbe561968f24922
SSDEEP 96:HgvPkoeWEH3IWTaQfSJgHzth5mFahbuB8pR5+Vpwe+UIJLg1gEp+6F5pQnxc:AvoWydmQfVHMyyj5Z
TLSH
T14B42FC6851DC7811C532D702AB9371D3FF12BDA6C6C85A58B48E256B1FF262028B739C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixstdba.exe

Path C:\Windows\Temp\{B22AD9EF-31D6-4EFE-8D49-298D90856630}\.ba\wixstdba.exe
Size 431KB
SHA256 2b1cee5e3e24593247854eb7a7c4308937b9c607754ed2fb83520a8706c26f1e
MD5 0e88ffd2e737ac9b9a4241616838bc23
SHA1 3c8beb465d20bcef0cd6ceca9c60286d1d15cebd
SHA512 169b9e08518834c9bc5adfe4ab7b79e07685b72f30ede1c1a386229668bde8c15da378e1274e4013ad7b84d6f7a5acc64ef0806e3b8a66322861efaa7e26b620
SSDEEP 6144:X9vfS1NP+c3ytxmg4Stlqe3B9m2LSLTwGw7C3ZLaov5xZvSdF:X9v+GIyugllqe3wwGfX5/SdF
TLSH
T129943B3165F04037C6F90572AE14FA31BF69F208231095EBA3C0DD293968AE5BBB7657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windowsdesktop-runtime-10.0.8-win-x64.exe

Path C:\Windows\Temp\{B22AD9EF-31D6-4EFE-8D49-298D90856630}\.be\windowsdesktop-runtime-10.0.8-win-x64.exe
Size 966KB
SHA256 b809e0aacdaf9d423d009d3c5321cf60792119fd27419194414c4195b891a240
MD5 785c0fd93971cb849bdbadc1af4486b8
SHA1 d2806e3ebfa4f543a0f074f41b85465da78f9f43
SHA512 e7bf91b59f0985b97ec59ab1b8a85124c5db4b749835b06a20f91899dabe710adf08c99ce35322227626dbefd8fa1a5b1cb33d5d442409db36d377547dec5368
SSDEEP 12288:FVGWl6qCmyZeU6lqlDjC+fScn6X8GwMgJET5A6GTBB9F3henBpzGkzPV:FVGWl6qCmyt6UdmcpMzFz6XUnn5zPV
TLSH
T195257D32A166242BD6F50973F914D2307E28D7082B5C95B6C6C0DD0D39689FA6FFB24B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3304-1246-0x000001FA935C0000-0x000001FA9367D000-memory.dmp

Download

memory/4784-1272-0x0000000000C80000-0x0000000000D46000-memory.dmp

Download