hxxp://wireshark[.]org

Analysis

user interaction
yes
max time kernel
155s
max time network
160s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
29/06/2026, 03:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://wireshark.org
Sample260629-ejezcady4m

Score

9^/10

defense_evasion discovery execution persistence ransomware

Malware Config

Signatures

Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
defense_evasion

Software Discovery
T1518

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4136	powershell.exe
4304	powershell.exe
464	powershell.exe
4976	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
75	1048	msedge.exe

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\DRIVERS\SETB54C.tmp	NPFInstall.exe
File created	C:\Windows\system32\DRIVERS\SETB54C.tmp	NPFInstall.exe
File opened for modification	C:\Windows\system32\DRIVERS\npcap.sys	NPFInstall.exe

Manipulates Digital Signatures 1 TTPs 5 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C\Blob = 0300000001000000140000007b0f360b775f76c94a12ca48445aa2d2a875701c2000000001000000b4060000308206b030820498a003020102021008ad40b260d29c4c9f5ecda9bd93aed9300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3231303432393030303030305a170d3336303432383233353935395a3069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e6720525341343039362053484133383420323032312043413130820222300d06092a864886f70d01010105000382020f003082020a0282020100d5b42f42d028ad78b75dd539591bb18842f5338ceb3d819770c5bbc48526309fa48e68d85cf5eb342407e14b4fd37843f417d71edaf9d2d5671a524f0ea157fc8899c191cc81033e4d702464b38de2087d347d4c8057126b439a99f2c53b1ff2efcb475a13a64cb3012025f310d38bb2fb08f08ae09d09c065a7fa98804935873d5119e8902178452ea19f2ce118c21accc5ee93497042328ffbc6ea1cf3656891a24d4c8211485268de10bd14575de8181365c57fb24f852c48a4568435d6f92e9caa0015d137fe1a0694c27cc8ea1b32e6cac2f4a7a3030e74a5af39b6ab6012e3e8d6b9f731e1dcade418a0d8c1234747b3a10f6ea3ab6d9806831bb76a672dd2bd441a9210818fb03b09d7c79b325ac2ff6a60548b49c193ede1b45ce06feb26f98cd5b2f93810e6eace91f5bed3fb6f9361345cbc93452883362a66285fb073ce8b262506b283d45cf615194ced62e05e33f2e8e8ec0aa7b0032b91b23679bef7ad081e75a665ccbbe34850f377911afedb50a246c8615898f57c02163c8328ad3986ecd4b70d53d0f847e675308dec30937614a65b4b5d74614d3f129176debf58cb72102941f0d5c56d267668114113589adc262b01f4894d59db78cf814a3e40475fc98150738510232159608a6454c1cc211ae838197c661ccd78384530994fff634f4cbbaa0d0853417c583d47b3fab6ec8c320902cc6c3c0c56110203010001a38201593082015530120603551d130101ff040830060101ff020100301d0603551d0e041604146837e0ebb63bf85f1186fbfe617b088865f44e42301f0603551d23041830168014ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300e0603551d0f0101ff04040302018630130603551d25040c300a06082b06010505070303307706082b06010505070101046b3069302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304106082b060105050730028635687474703a2f2f636163657274732e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63727430430603551d1f043c303a3038a036a0348632687474703a2f2f63726c332e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63726c301c0603551d20041530133007060567810c01033008060667810c010401300d06092a864886f70d01010c050003820201003a23443d8d0876ee8fbc3a99d356e0021aa5f84834f32cb6e67466f79472b100caaf6c302713129e90449f4bfd9ea37c26d537bc3a5d486d95d53f49f427bb16814550fd9cbdb685e0767e3771cb22f75aaa90cff5936ae3eb20d1d55079889a8a8ac1b6bda148187edcd8801a111918cd61998156f6c9e376e7c4e41b5f43f83e94ff76393d9ed499cf4add28eb5f26a1955848d51afed7273ffd90d17686dd1cb0605cf30da8eee089a1bd39e1384eda6ebb369dfbe521535ac3cae96af1a23edb43b833c84f38149299f5ddce546dd95d02141f40337c03e295b2c221757352cb46d8c4341ca2a54b8dcd6f76372c853f1ace26e918be9007b0437f9588208270f0cccaeffd29355c1f893855f7378a8b09a1cb0be9311aff2e195c3971e1be9ca70a06d62667b792e64e5fde7aac49cf2ea47492addb3ca49c861fe3c1561b2b23ff8fb5ea887b706be6a0bafd3a3f45a6c4e81691528b41c048844b964dab4440e38df01528ceedf11856072a2f10c40c08643c338fae288c3ccb8f880b0dbf3bf4ce1e7b8eefb5ebcbb7f07713e6e7283fac12aea52f226c41f9825c1566cc6c0ecac586c3f626330c074ba0d307026a6a4030484b34a85120bbad1b8508e2590d6dca05502bea4a1c9ea5fda0a71f0674e7f2d65290fdaf854821f9573bb49c03ed8645f4b4616ebf68e2266086eac8afa9fe941de7631b3a8656784e	certutil.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\0629C303220B256580AABA536A1A3C060B87E3A2\Blob = 0300000001000000140000000629c303220b256580aaba536a1a3c060b87e3a22000000001000000c7070000308207c3308205aba00302010202100675d6b59ef1b0ab30e5d2e046da2431300d06092a864886f70d01010b05003069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e67205253413430393620534841333834203230323120434131301e170d3234303732353030303030305a170d3237303630393233353935395a3081cb31133011060b2b0601040182373c0201031302555331193017060b2b0601040182373c020102130844656c6177617265311d301b060355040f0c1450726976617465204f7267616e697a6174696f6e3110300e0603550405130736333937353838310b3009060355040613025553310f300d060355040813064f7265676f6e3112301006035504071309426561766572746f6e311a3018060355040a13114e6d617020536f667477617265204c4c43311a3018060355040313114e6d617020536f667477617265204c4c4330820222300d06092a864886f70d01010105000382020f003082020a0282020100e80f7d81d43b6e7f27c5a9d671bf92b5bb4ebe29ab087341abb94a189869339d2928269ff8a142a831cb6c77e45f8691375ae009280d148456ad7f817cd96d8beacd09980761fdd99d8ceb289dcb4f0da4030eeba61fcf227f3e42728e3d569fe239197d44ecf3b532ad126cff9a15aafc66807ba9d637aa3a5d4ab45189b835d15ccb5502513b00b8423b3c536b4bf3bc4374186237603223142f66881eb17f699f9467f66c829366b8d66788ba1268ccdac909e2024e53413abe2033825c8f94bdcc96f1464d7a5e3b0aea7aa7ed2daeb5579f40279c4d879ae167fc7f064a54a7f474cf8a8590e6f9c78efb7f4f6d396cc6b23c23c75a2a0ad7ced10e9d18d883508a01f87acc1bb3bc33db5464432be5e5042ab4e138ec6467b25b5362cce1a856fed1c8dcd3a1e58b4d7dbe38e2cb9a9a0f7af88de58678e948c295dbf1a7f35d4be1389ed802b3d1bc982c2272eaf13a8da04c005cef21ffac7eb292bd384bd33c726bb7fd469b6d5e926bd41728f0b1611a237334636858ad4f75393223d932cc857d863e8f22af3bdc39436fa31ceb6d03c8b655fd3afb34d168a092fb434b325060ccc64de0b399cacadcba02425f56433204bd44ec2c926453e154e73e3351c16c06f015d52e7c289b353fe5f08319e274ba63c3b48dfcd1b113896438e8a81552d1a7844deb8164d90393a1e1389787d759fe5bcf0cdfb00f9ccf0203010001a3820202308201fe301f0603551d230418301680146837e0ebb63bf85f1186fbfe617b088865f44e42301d0603551d0e041604147bb55ac506010287feefade54638ade666ff1b9f303d0603551d20043630343032060567810c01033029302706082b06010505070201161b687474703a2f2f7777772e64696769636572742e636f6d2f435053300e0603551d0f0101ff04040302078030130603551d25040c300a06082b060105050703033081b50603551d1f0481ad3081aa3053a051a04f864d687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63726c3053a051a04f864d687474703a2f2f63726c342e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63726c30819406082b06010505070101048187308184302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d305c06082b060105050730028650687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63727430090603551d1304023000300d06092a864886f70d01010b050003820201007c007a47ac4224e18d5d0c7a795f8718070b8fbd59bae2fa4926029cc464cbca37ef70c683cc1762655f4a91faeac9de304a4193148ad807835a084389ef248237a374c248da6120446da39c10a46852e8fc2a594c031d2de6c19eb0ee6b4da8b5159ce9947ab5b977f805934aef11ccb98fc1b6e19ea41384dee1bbcbef2c8af5d267098662f8d72f82b98b180be27f3d0289469d27cc6981f67bc0753693272786ccbb49097c88669b6a0db0df5cda0434704c57854189dcaa8c3873ffa172f757ef28784442c0839ef92c62ca7314d6804ad4a28bc392c87ec592a207e4981513677e2f7f294db0f6109b5a80d9d04d364022cce1e0aaf29de55fae0756c87cd1c147e663168a518ce2de5e9e4de99b1c350d284277cc5bd15fcb8ba92f9aee6cf3632e9e8b972f7acb38c8ce4e4402b1b26a94f7cb09e8ecd7b817ed22e2e4c1faf3522c238459b1fd427b5e7c84efe3214b644223f650392928c815336264961eabda172f0898eb4a42eeaa033c4f0ade9068e7e3f964b2f788ba3c13aa1c2369afccac5810e166c2aeeaebb648af287673fe3dfc6d0a28597b7d2fe5dc4552f7ee1d018009868eb6967c57348ef0aa84af7e7f7e36dcaedaa5acb871b417292d7278ec31499e00015358d5e4dc4f280d656ecba18fe7ac5b9ee552874afdbfa7b64521a7ef962bd8b6c161f2f4c49434ba4e2b406e548dbaaec9b664b9	certutil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.60.3.1!7\Name = "szOID_ROOT_PROGRAM_AUTO_UPDATE_CA_REVOCATION"	certutil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.60.3.2!7\Name = "szOID_ROOT_PROGRAM_AUTO_UPDATE_END_REVOCATION"	certutil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.60.3.3!7\Name = "szOID_ROOT_PROGRAM_NO_OCSP_FAILOVER_TO_CRL"	certutil.exe

Executes dropped EXE 19 IoCs

pid	Process
2220	Wireshark-4.6.6-x64.exe
5072	vc_redist.x64.exe
3144	vc_redist.x64.exe
848	VC_redist.x64.exe
2512	VC_redist.x64.exe
1100	VC_redist.x64.exe
1972	VC_redist.x64.exe
3728	npcap-1.88.exe
5040	VC_redist.x64.exe
5000	NPFInstall.exe
3328	NPFInstall.exe
1916	NPFInstall.exe
2724	NPFInstall.exe
6700	Wireshark.exe
6820	etwdump.exe
6872	etwdump.exe
5656	dumpcap.exe
5908	etwdump.exe
7188	dumpcap.exe

Loads dropped DLL 64 IoCs

pid	Process
2220	Wireshark-4.6.6-x64.exe
2220	Wireshark-4.6.6-x64.exe
2220	Wireshark-4.6.6-x64.exe
2220	Wireshark-4.6.6-x64.exe
2220	Wireshark-4.6.6-x64.exe
2220	Wireshark-4.6.6-x64.exe
2220	Wireshark-4.6.6-x64.exe
2220	Wireshark-4.6.6-x64.exe
2220	Wireshark-4.6.6-x64.exe
3144	vc_redist.x64.exe
1620	VC_redist.x64.exe
3728	npcap-1.88.exe
3728	npcap-1.88.exe
3728	npcap-1.88.exe
1972	VC_redist.x64.exe
3728	npcap-1.88.exe
3728	npcap-1.88.exe
3728	npcap-1.88.exe
3728	npcap-1.88.exe
3728	npcap-1.88.exe
3728	npcap-1.88.exe
3728	npcap-1.88.exe
3728	npcap-1.88.exe
3728	npcap-1.88.exe
3728	npcap-1.88.exe
3728	npcap-1.88.exe
3728	npcap-1.88.exe
3728	npcap-1.88.exe
3728	npcap-1.88.exe
6700	Wireshark.exe
6700	Wireshark.exe
6700	Wireshark.exe
6700	Wireshark.exe
6700	Wireshark.exe
6700	Wireshark.exe
6700	Wireshark.exe
6700	Wireshark.exe
6700	Wireshark.exe
6700	Wireshark.exe
6700	Wireshark.exe
6700	Wireshark.exe
6700	Wireshark.exe
6700	Wireshark.exe
6700	Wireshark.exe
6700	Wireshark.exe
6700	Wireshark.exe
6700	Wireshark.exe
6700	Wireshark.exe
6700	Wireshark.exe
6700	Wireshark.exe
6700	Wireshark.exe
6700	Wireshark.exe
6700	Wireshark.exe
6700	Wireshark.exe
6700	Wireshark.exe
6700	Wireshark.exe
6700	Wireshark.exe
6700	Wireshark.exe
6700	Wireshark.exe
6700	Wireshark.exe
6700	Wireshark.exe
6700	Wireshark.exe
6700	Wireshark.exe
6700	Wireshark.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515} = "\"C:\\ProgramData\\Package Cache\\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\\VC_redist.x64.exe\" /burn.runonce"	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515} = "\"C:\\ProgramData\\Package Cache\\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\\VC_redist.x64.exe\" /burn.runonce"	VC_redist.x64.exe

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
85	3352	msiexec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\system32\mfc140rus.dll	msiexec.exe
File created	C:\Windows\System32\DriverStore\Temp\{a872cd9f-030f-4843-80ac-35de259048fd}\SETB377.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netbrdg.inf_amd64_3debe5e78bab1bca\netbrdg.PNF	NPFInstall.exe
File opened for modification	C:\Windows\system32\mfc140chs.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140esn.dll	msiexec.exe
File created	C:\Windows\system32\mfc140ita.dll	msiexec.exe
File created	C:\Windows\system32\mfcm140u.dll	msiexec.exe
File created	C:\Windows\SysWOW64\Npcap\Packet.dll	npcap-1.88.exe
File created	C:\Windows\system32\Npcap\NpcapHelper.exe	npcap-1.88.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\npcap.inf_amd64_78aa2d1ec853ea38\npcap.sys	DrvInst.exe
File opened for modification	C:\Windows\system32\msvcp140_atomic_wait.dll	msiexec.exe
File created	C:\Windows\system32\concrt140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm140.dll	msiexec.exe
File created	C:\Windows\system32\mfc140fra.dll	msiexec.exe
File created	C:\Windows\System32\DriverStore\Temp\{a872cd9f-030f-4843-80ac-35de259048fd}\SETB388.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_netservice.inf_amd64_bc519c177a90877a\c_netservice.PNF	NPFInstall.exe
File created	C:\Windows\System32\DriverStore\FileRepository\npcap.inf_amd64_78aa2d1ec853ea38\npcap.PNF	NPFInstall.exe
File opened for modification	C:\Windows\system32\vcamp140.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_atomic_wait.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140kor.dll	msiexec.exe
File created	C:\Windows\SysWOW64\Npcap\WlanHelper.exe	npcap-1.88.exe
File opened for modification	C:\Windows\system32\msvcp140_codecvt_ids.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcomp140.dll	msiexec.exe
File created	C:\Windows\System32\DriverStore\Temp\{a872cd9f-030f-4843-80ac-35de259048fd}\SETB399.tmp	DrvInst.exe
File created	C:\Windows\system32\vcamp140.dll	msiexec.exe
File created	C:\Windows\system32\vcomp140.dll	msiexec.exe
File created	C:\Windows\system32\mfc140.dll	msiexec.exe
File created	C:\Windows\system32\mfc140cht.dll	msiexec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{a872cd9f-030f-4843-80ac-35de259048fd}\SETB399.tmp	DrvInst.exe
File opened for modification	C:\Windows\system32\msvcp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140ita.dll	msiexec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{a872cd9f-030f-4843-80ac-35de259048fd}\npcap.sys	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netserv.inf_amd64_56c163d21e8c2b62\netserv.PNF	NPFInstall.exe
File created	C:\Windows\system32\mfc140kor.dll	msiexec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{a872cd9f-030f-4843-80ac-35de259048fd}\npcap.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{a872cd9f-030f-4843-80ac-35de259048fd}\SETB388.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{a872cd9f-030f-4843-80ac-35de259048fd}	DrvInst.exe
File created	C:\Windows\SysWOW64\Npcap\NpcapHelper.exe	npcap-1.88.exe
File opened for modification	C:\Windows\system32\msvcp140_2.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_2.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140enu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140jpn.dll	msiexec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{a872cd9f-030f-4843-80ac-35de259048fd}\NPCAP.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\npcap.inf_amd64_78aa2d1ec853ea38\NPCAP.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\npcap.inf_amd64_78aa2d1ec853ea38\npcap.cat	DrvInst.exe
File created	C:\Windows\system32\vccorlib140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140deu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140fra.dll	msiexec.exe
File created	C:\Windows\system32\mfc140chs.dll	msiexec.exe
File created	C:\Windows\system32\mfc140esn.dll	msiexec.exe
File created	C:\Windows\system32\Npcap\wpcap.dll	npcap-1.88.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netvwififlt.inf_amd64_882899f2b1006416\netvwififlt.PNF	NPFInstall.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netpacer.inf_amd64_8074ac14f1ab2957\netpacer.PNF	NPFInstall.exe
File opened for modification	C:\Windows\system32\vcruntime140.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140_threads.dll	msiexec.exe
File created	C:\Windows\system32\mfc140deu.dll	msiexec.exe
File created	C:\Windows\system32\mfc140enu.dll	msiexec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ndiscap.inf_amd64_d34968d7b3e6da21\ndiscap.PNF	NPFInstall.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netnb.inf_amd64_10acfa4b924dd181\netnb.PNF	NPFInstall.exe
File opened for modification	C:\Windows\system32\mfc140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140u.dll	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Wireshark\radius\dictionary.rfc3576	Wireshark-4.6.6-x64.exe
File created	C:\Program Files\Wireshark\radius\dictionary.wimax.alvarion	Wireshark-4.6.6-x64.exe
File created	C:\Program Files\Wireshark\snmp\mibs\RADIUS-DYNAUTH-CLIENT-MIB	Wireshark-4.6.6-x64.exe
File created	C:\Program Files\Wireshark\snmp\mibs\TUNNEL-MIB	Wireshark-4.6.6-x64.exe
File created	C:\Program Files\Wireshark\Wireshark User's Guide\ChMateConfigurationTutorial.html	Wireshark-4.6.6-x64.exe
File created	C:\Program Files\Wireshark\Wireshark User's Guide\ChMateManual.html	Wireshark-4.6.6-x64.exe
File created	C:\Program Files\Wireshark\Wireshark User's Guide\ChSccpUsers.html	Wireshark-4.6.6-x64.exe
File created	C:\Program Files\Wireshark\Wireshark User's Guide\images\ws-main.png	Wireshark-4.6.6-x64.exe
File created	C:\Program Files\Wireshark\snmp\mibs\NAT-MIB	Wireshark-4.6.6-x64.exe
File created	C:\Program Files\Wireshark\snmp\mibs\[email protected]	Wireshark-4.6.6-x64.exe
File created	C:\Program Files\Wireshark\Wireshark User's Guide\images\ws-analyze-menu.png	Wireshark-4.6.6-x64.exe
File created	C:\Program Files\Wireshark\Wireshark User's Guide\images\ws-pingpongprotocol-statistics.png	Wireshark-4.6.6-x64.exe
File created	C:\Program Files\Wireshark\diameter\Travelping.xml	Wireshark-4.6.6-x64.exe
File created	C:\Program Files\Wireshark\snmp\mibs\DOCS-IETF-SUBMGT-MIB	Wireshark-4.6.6-x64.exe
File created	C:\Program Files\Wireshark\snmp\mibs\SNMP-FRAMEWORK-MIB	Wireshark-4.6.6-x64.exe
File created	C:\Program Files\Wireshark\snmp\mibs\[email protected]	Wireshark-4.6.6-x64.exe
File created	C:\Program Files\Wireshark\Wireshark User's Guide\images\ws-tel-rtp-player_1.xcf	Wireshark-4.6.6-x64.exe
File created	C:\Program Files\Wireshark\radius\dictionary.pfsense	Wireshark-4.6.6-x64.exe
File created	C:\Program Files\Wireshark\radius\dictionary.rfc4072	Wireshark-4.6.6-x64.exe
File opened for modification	C:\Program Files\Npcap\NPFInstall.log	NPFInstall.exe
File created	C:\Program Files\Wireshark\snmp\mibs\FR-ATM-PVC-SERVICE-IWF-MIB	Wireshark-4.6.6-x64.exe
File created	C:\Program Files\Wireshark\snmp\mibs\ACCESSBIND-PIB	Wireshark-4.6.6-x64.exe
File created	C:\Program Files\Wireshark\Wireshark User's Guide\images\ws-choose-color-rule.png	Wireshark-4.6.6-x64.exe
File created	C:\Program Files\Wireshark\Wireshark User's Guide\images\ws-flow-graph.png	Wireshark-4.6.6-x64.exe
File created	C:\Program Files\Wireshark\diameter\CiscoSystems.xml	Wireshark-4.6.6-x64.exe
File created	C:\Program Files\Wireshark\snmp\mibs\RBRIDGE-MIB	Wireshark-4.6.6-x64.exe
File created	C:\Program Files\Wireshark\Wireshark User's Guide\images\ws-enrp-statistics.png	Wireshark-4.6.6-x64.exe
File created	C:\Program Files\Wireshark\radius\dictionary.manzara	Wireshark-4.6.6-x64.exe
File created	C:\Program Files\Wireshark\radius\dictionary.nexans	Wireshark-4.6.6-x64.exe
File created	C:\Program Files\Wireshark\radius\dictionary.perle	Wireshark-4.6.6-x64.exe
File created	C:\Program Files\Wireshark\dtds\presence.dtd	Wireshark-4.6.6-x64.exe
File created	C:\Program Files\Wireshark\snmp\mibs\[email protected]	Wireshark-4.6.6-x64.exe
File created	C:\Program Files\Wireshark\Wireshark User's Guide\images\toolbar\x-capture-file-save.png	Wireshark-4.6.6-x64.exe
File created	C:\Program Files\Wireshark\radius\dictionary.calix	Wireshark-4.6.6-x64.exe
File created	C:\Program Files\Wireshark\translations\qt_gd.qm	Wireshark-4.6.6-x64.exe
File created	C:\Program Files\Wireshark\snmp\mibs\PPP-IP-NCP-MIB	Wireshark-4.6.6-x64.exe
File created	C:\Program Files\Wireshark\snmp\mibs\[email protected]	Wireshark-4.6.6-x64.exe
File created	C:\Program Files\Wireshark\Wireshark User's Guide\AppGPL.html	Wireshark-4.6.6-x64.exe
File created	C:\Program Files\Wireshark\Wireshark User's Guide\ChIOPacketRangeSection.html	Wireshark-4.6.6-x64.exe
File created	C:\Program Files\Wireshark\Wireshark User's Guide\images\toolbar\x-capture-options.png	Wireshark-4.6.6-x64.exe
File created	C:\Program Files\Wireshark\radius\dictionary.arbor	Wireshark-4.6.6-x64.exe
File created	C:\Program Files\Wireshark\snmp\mibs\MOBILEIPV6-MIB	Wireshark-4.6.6-x64.exe
File created	C:\Program Files\Wireshark\snmp\mibs\MPLS-OAM-ID-STD-MIB	Wireshark-4.6.6-x64.exe
File created	C:\Program Files\Wireshark\snmp\mibs\MPLS-SETUP-PIB-orig	Wireshark-4.6.6-x64.exe
File created	C:\Program Files\Wireshark\radius\dictionary.alcatel	Wireshark-4.6.6-x64.exe
File created	C:\Program Files\Wireshark\radius\dictionary.nortel	Wireshark-4.6.6-x64.exe
File created	C:\Program Files\Wireshark\Wireshark User's Guide\images\toolbar\filter-toolbar-apply.png	Wireshark-4.6.6-x64.exe
File created	C:\Program Files\Wireshark\libiconv-2.dll	Wireshark-4.6.6-x64.exe
File created	C:\Program Files\Wireshark\d3dcompiler_47.dll	Wireshark-4.6.6-x64.exe
File created	C:\Program Files\Wireshark\snmp\mibs\DIRECTORY-SERVER-MIB	Wireshark-4.6.6-x64.exe
File created	C:\Program Files\Wireshark\snmp\mibs\IPSEC-POLICY-PIB-orig	Wireshark-4.6.6-x64.exe
File created	C:\Program Files\Wireshark\Wireshark User's Guide\ChBuildInstallDistro.html	Wireshark-4.6.6-x64.exe
File created	C:\Program Files\Wireshark\cares.dll	Wireshark-4.6.6-x64.exe
File created	C:\Program Files\Wireshark\radius\dictionary.kineto	Wireshark-4.6.6-x64.exe
File created	C:\Program Files\Wireshark\radius\dictionary.xylan	Wireshark-4.6.6-x64.exe
File created	C:\Program Files\Wireshark\snmp\mibs\IANA-BFD-TC-STD-MIB	Wireshark-4.6.6-x64.exe
File created	C:\Program Files\Wireshark\snmp\mibs\FLOAT-TC-MIB	Wireshark-4.6.6-x64.exe
File opened for modification	C:\Program Files\Wireshark\snmp\mibs\IANA-ITU-ALARM-TC-MIB	Wireshark-4.6.6-x64.exe
File created	C:\Program Files\Wireshark\snmp\mibs\IP-TE-PIB	Wireshark-4.6.6-x64.exe
File created	C:\Program Files\Wireshark\Wireshark User's Guide\ChCapCaptureFiles.html	Wireshark-4.6.6-x64.exe
File created	C:\Program Files\Wireshark\xxhash.dll	Wireshark-4.6.6-x64.exe
File created	C:\Program Files\Wireshark\tls\qopensslbackend.dll	Wireshark-4.6.6-x64.exe
File created	C:\Program Files\Wireshark\snmp\mibs\BATTERY-MIB	Wireshark-4.6.6-x64.exe
File created	C:\Program Files\Wireshark\Wireshark User's Guide\ChIOOpenSection.html	Wireshark-4.6.6-x64.exe

Drops file in Windows directory 30 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\SourceHash{43B0D101-A022-48F4-9D04-BA404CEB1D53}	msiexec.exe
File opened for modification	C:\Windows\Installer\e590103.msi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	svchost.exe
File created	C:\Windows\INF\oem3.PNF	NPFInstall.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\Installer\e5900f0.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFFFC1EB232F00F103.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI548.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{86AB2CC9-08BD-4643-B0F9-F82D006D72FF}	msiexec.exe
File created	C:\Windows\Installer\e590103.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFD61D29F9A6A7AEDA.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF4E67E20633D6391F.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF6758FE8AFAA78EA1.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2C5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3A1.tmp	msiexec.exe
File opened for modification	C:\Windows\inf\oem3.inf	DrvInst.exe
File created	C:\Windows\inf\oem3.inf	DrvInst.exe
File created	C:\Windows\SystemTemp\~DFEBA24747796316A0.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF2ED04DE2EF7117F6.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFC65C81AA8E07CE8F.TMP	msiexec.exe
File created	C:\Windows\Installer\e590118.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\e590102.msi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\~DF56A120EB39FBD5C9.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6A0.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	NPFInstall.exe
File created	C:\Windows\Installer\e5900f0.msi	msiexec.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Wireshark-4.6.6-x64.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 20 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	npcap-1.88.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vc_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	certutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vc_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Wireshark-4.6.6-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	certutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	certutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	certutil.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1048	msedge.exe

Checks SCSI registry key(s) 3 TTPs 43 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000512b028b2c2fe2ee0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000512b028b0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900512b028b000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a512b028b000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d512b028b000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	NPFInstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	NPFInstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	NPFInstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	NPFInstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	NPFInstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	NPFInstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	NPFInstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	NPFInstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	NPFInstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	NPFInstall.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	NPFInstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	NPFInstall.exe

Checks processor information in registry 2 TTPs 57 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	Wireshark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dumpcap.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	dumpcap.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	Wireshark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dumpcap.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	dumpcap.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	dumpcap.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	dumpcap.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	dumpcap.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	dumpcap.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	dumpcap.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	dumpcap.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	dumpcap.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	dumpcap.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Wireshark.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	Wireshark.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	dumpcap.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	Wireshark.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	dumpcap.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	dumpcap.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Wireshark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	dumpcap.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	dumpcap.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	dumpcap.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	Wireshark.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	dumpcap.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	dumpcap.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	dumpcap.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Wireshark.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	Wireshark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	Wireshark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	dumpcap.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	dumpcap.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	dumpcap.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	dumpcap.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	dumpcap.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	dumpcap.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	dumpcap.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	Wireshark.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	dumpcap.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	dumpcap.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	dumpcap.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	dumpcap.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	dumpcap.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Wireshark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	Wireshark.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	dumpcap.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	dumpcap.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	Wireshark.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	Wireshark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	Wireshark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	dumpcap.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	dumpcap.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	Wireshark.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	dumpcap.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	Wireshark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	Wireshark.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 61 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@%SystemRoot%\System32\fveui.dll,-843 = "BitLocker Drive Encryption"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@%SystemRoot%\System32\fveui.dll,-844 = "BitLocker Data Recovery Agent"	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@%SystemRoot%\System32\wuaueng.dll,-400 = "Windows Update"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@%SystemRoot%\system32\NgcRecovery.dll,-100 = "Windows Hello Recovery Key Encryption"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@%SystemRoot%\System32\ci.dll,-101 = "Enclave"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134271790918509046"	msedge.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@%SystemRoot%\System32\ci.dll,-100 = "Isolated User Mode (IUM)"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.out\ = "wireshark-capture-file"	Wireshark-4.6.6-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vwr	Wireshark-4.6.6-x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\09A86F63C932FD435BC8463B1035EC53	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\101D0B34220A4F84D940AB04C4BED135\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\09A86F63C932FD435BC8463B1035EC53	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9CC2BA68DB8034640B9F8FD200D627FF\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.5vw\ = "wireshark-capture-file"	Wireshark-4.6.6-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bfr	Wireshark-4.6.6-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\101D0B34220A4F84D940AB04C4BED135	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\101D0B34220A4F84D940AB04C4BED135\AuthorizedLUAApp = "0"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\101D0B34220A4F84D940AB04C4BED135\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\101D0B34220A4F84D940AB04C4BED135\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{43B0D101-A022-48F4-9D04-BA404CEB1D53}v14.44.35211\\packages\\vcRuntimeMinimum_amd64\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rtp	Wireshark-4.6.6-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.rtp\ = "wireshark-capture-file"	Wireshark-4.6.6-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bfr\ = "wireshark-capture-file"	Wireshark-4.6.6-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.fdc	Wireshark-4.6.6-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9CC2BA68DB8034640B9F8FD200D627FF	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9CC2BA68DB8034640B9F8FD200D627FF\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\wireshark-capture-file\Shell\open\command	Wireshark-4.6.6-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.apc	Wireshark-4.6.6-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.pcapng	Wireshark-4.6.6-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.pcapng\ = "wireshark-capture-file"	Wireshark-4.6.6-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\Dependents\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\wireshark-capture-file\Shell\open\command\ = "\"C:\\Program Files\\Wireshark\\Wireshark.exe\" \"%1\""	Wireshark-4.6.6-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.pklg\ = "wireshark-capture-file"	Wireshark-4.6.6-x64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14	VC_redist.x64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1679180529-4058988202-686829476-1000\{E13B1BB0-8A6F-4E4E-BD65-11C3AA52CF5D}	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\101D0B34220A4F84D940AB04C4BED135\Provider	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9CC2BA68DB8034640B9F8FD200D627FF\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\wireshark-capture-file\Shell	Wireshark-4.6.6-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\.erf	Wireshark-4.6.6-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.ipfix\ = "wireshark-capture-file"	Wireshark-4.6.6-x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.30,bundle	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.pcap\ = "wireshark-capture-file"	Wireshark-4.6.6-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tpc\ = "wireshark-capture-file"	Wireshark-4.6.6-x64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14	VC_redist.x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\Dependents\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}	VC_redist.x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8A567BD6FA501A947AD1F646E53EEC14	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9CC2BA68DB8034640B9F8FD200D627FF\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.ems\ = "wireshark-capture-file"	Wireshark-4.6.6-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.enc	Wireshark-4.6.6-x64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\.erf\ = "wireshark-capture-file"	Wireshark-4.6.6-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.rf5\ = "wireshark-capture-file"	Wireshark-4.6.6-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\101D0B34220A4F84D940AB04C4BED135\VC_Runtime_Minimum	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\101D0B34220A4F84D940AB04C4BED135\ProductName = "Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.44.35211"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.apc\ = "wireshark-capture-file"	Wireshark-4.6.6-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.pklg	Wireshark-4.6.6-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.syc	Wireshark-4.6.6-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.wpc\ = "wireshark-capture-file"	Wireshark-4.6.6-x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\88AAB0B9F51EF1A3CA0C2B609EDD7FC1	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\VC,REDIST.X64,AMD64,14.30,BUNDLE\DEPENDENTS\{57A73DF6-4BA9-4C1D-BBBB-517289FF6C13}	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.trc\ = "wireshark-capture-file"	Wireshark-4.6.6-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.44,bundle\Version = "14.44.35211.0"	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\ = "{43B0D101-A022-48F4-9D04-BA404CEB1D53}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.5vw	Wireshark-4.6.6-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tr1	Wireshark-4.6.6-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tr1\ = "wireshark-capture-file"	Wireshark-4.6.6-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\101D0B34220A4F84D940AB04C4BED135\Servicing_Key	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\101D0B34220A4F84D940AB04C4BED135\Language = "1033"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9CC2BA68DB8034640B9F8FD200D627FF\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.44,bundle\Dependents	VC_redist.x64.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Wireshark-4.6.6-x64.exe:Zone.Identifier	msedge.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
6700	Wireshark.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
3352	msiexec.exe
3352	msiexec.exe
3352	msiexec.exe
3352	msiexec.exe
3352	msiexec.exe
3352	msiexec.exe
3352	msiexec.exe
3352	msiexec.exe
5000	NPFInstall.exe
5000	NPFInstall.exe
4136	powershell.exe
4136	powershell.exe
4136	powershell.exe
4304	powershell.exe
4304	powershell.exe
4304	powershell.exe
464	powershell.exe
464	powershell.exe
464	powershell.exe
4976	powershell.exe
4976	powershell.exe
4976	powershell.exe
4124	msedge.exe
4124	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2220	Wireshark-4.6.6-x64.exe
6700	Wireshark.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
680	Process not Found
680	Process not Found
680	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeBackupPrivilege	3268	vssvc.exe
Token: SeRestorePrivilege	3268	vssvc.exe
Token: SeAuditPrivilege	3268	vssvc.exe
Token: SeShutdownPrivilege	848	VC_redist.x64.exe
Token: SeIncreaseQuotaPrivilege	848	VC_redist.x64.exe
Token: SeSecurityPrivilege	3352	msiexec.exe
Token: SeCreateTokenPrivilege	848	VC_redist.x64.exe
Token: SeAssignPrimaryTokenPrivilege	848	VC_redist.x64.exe
Token: SeLockMemoryPrivilege	848	VC_redist.x64.exe
Token: SeIncreaseQuotaPrivilege	848	VC_redist.x64.exe
Token: SeMachineAccountPrivilege	848	VC_redist.x64.exe
Token: SeTcbPrivilege	848	VC_redist.x64.exe
Token: SeSecurityPrivilege	848	VC_redist.x64.exe
Token: SeTakeOwnershipPrivilege	848	VC_redist.x64.exe
Token: SeLoadDriverPrivilege	848	VC_redist.x64.exe
Token: SeSystemProfilePrivilege	848	VC_redist.x64.exe
Token: SeSystemtimePrivilege	848	VC_redist.x64.exe
Token: SeProfSingleProcessPrivilege	848	VC_redist.x64.exe
Token: SeIncBasePriorityPrivilege	848	VC_redist.x64.exe
Token: SeCreatePagefilePrivilege	848	VC_redist.x64.exe
Token: SeCreatePermanentPrivilege	848	VC_redist.x64.exe
Token: SeBackupPrivilege	848	VC_redist.x64.exe
Token: SeRestorePrivilege	848	VC_redist.x64.exe
Token: SeShutdownPrivilege	848	VC_redist.x64.exe
Token: SeDebugPrivilege	848	VC_redist.x64.exe
Token: SeAuditPrivilege	848	VC_redist.x64.exe
Token: SeSystemEnvironmentPrivilege	848	VC_redist.x64.exe
Token: SeChangeNotifyPrivilege	848	VC_redist.x64.exe
Token: SeRemoteShutdownPrivilege	848	VC_redist.x64.exe
Token: SeUndockPrivilege	848	VC_redist.x64.exe
Token: SeSyncAgentPrivilege	848	VC_redist.x64.exe
Token: SeEnableDelegationPrivilege	848	VC_redist.x64.exe
Token: SeManageVolumePrivilege	848	VC_redist.x64.exe
Token: SeImpersonatePrivilege	848	VC_redist.x64.exe
Token: SeCreateGlobalPrivilege	848	VC_redist.x64.exe
Token: SeRestorePrivilege	3352	msiexec.exe
Token: SeTakeOwnershipPrivilege	3352	msiexec.exe
Token: SeRestorePrivilege	3352	msiexec.exe
Token: SeTakeOwnershipPrivilege	3352	msiexec.exe
Token: SeRestorePrivilege	3352	msiexec.exe
Token: SeTakeOwnershipPrivilege	3352	msiexec.exe
Token: SeRestorePrivilege	3352	msiexec.exe
Token: SeTakeOwnershipPrivilege	3352	msiexec.exe
Token: SeRestorePrivilege	3352	msiexec.exe
Token: SeTakeOwnershipPrivilege	3352	msiexec.exe
Token: SeRestorePrivilege	3352	msiexec.exe
Token: SeTakeOwnershipPrivilege	3352	msiexec.exe
Token: SeRestorePrivilege	3352	msiexec.exe
Token: SeTakeOwnershipPrivilege	3352	msiexec.exe
Token: SeRestorePrivilege	3352	msiexec.exe
Token: SeTakeOwnershipPrivilege	3352	msiexec.exe
Token: SeRestorePrivilege	3352	msiexec.exe
Token: SeTakeOwnershipPrivilege	3352	msiexec.exe
Token: SeRestorePrivilege	3352	msiexec.exe
Token: SeTakeOwnershipPrivilege	3352	msiexec.exe
Token: SeRestorePrivilege	3352	msiexec.exe
Token: SeTakeOwnershipPrivilege	3352	msiexec.exe
Token: SeRestorePrivilege	3352	msiexec.exe
Token: SeTakeOwnershipPrivilege	3352	msiexec.exe
Token: SeRestorePrivilege	3352	msiexec.exe
Token: SeTakeOwnershipPrivilege	3352	msiexec.exe
Token: SeRestorePrivilege	3352	msiexec.exe
Token: SeTakeOwnershipPrivilege	3352	msiexec.exe
Token: SeRestorePrivilege	3352	msiexec.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe

Suspicious use of SendNotifyMessage 18 IoCs

pid	Process
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1816 wrote to memory of 2412	1816	msedge.exe	81
PID 1816 wrote to memory of 1048	1816	msedge.exe	82
PID 1816 wrote to memory of 5080	1816	msedge.exe	83
PID 1816 wrote to memory of 5080	1816	msedge.exe	83
PID 1816 wrote to memory of 5080	1816	msedge.exe	83
PID 1816 wrote to memory of 1900	1816	msedge.exe	85
PID 1816 wrote to memory of 1900	1816	msedge.exe	85
PID 1816 wrote to memory of 1016	1816	msedge.exe	86
PID 1816 wrote to memory of 1016	1816	msedge.exe	86
PID 1816 wrote to memory of 1016	1816	msedge.exe	86
PID 1816 wrote to memory of 3444	1816	msedge.exe	87
PID 1816 wrote to memory of 3444	1816	msedge.exe	87
PID 1816 wrote to memory of 3444	1816	msedge.exe	87
PID 1816 wrote to memory of 1844	1816	msedge.exe	88
PID 1816 wrote to memory of 2872	1816	msedge.exe	89
PID 1816 wrote to memory of 3956	1816	msedge.exe	90
PID 1816 wrote to memory of 1844	1816	msedge.exe	88
PID 1816 wrote to memory of 1844	1816	msedge.exe	88
PID 1816 wrote to memory of 2872	1816	msedge.exe	89
PID 1816 wrote to memory of 2872	1816	msedge.exe	89
PID 1816 wrote to memory of 3956	1816	msedge.exe	90
PID 1816 wrote to memory of 3956	1816	msedge.exe	90
PID 1816 wrote to memory of 2740	1816	msedge.exe	91
PID 1816 wrote to memory of 2740	1816	msedge.exe	91
PID 1816 wrote to memory of 2740	1816	msedge.exe	91
PID 1816 wrote to memory of 1340	1816	msedge.exe	93
PID 1816 wrote to memory of 1340	1816	msedge.exe	93
PID 1816 wrote to memory of 1340	1816	msedge.exe	93
PID 1816 wrote to memory of 3396	1816	msedge.exe	95
PID 1816 wrote to memory of 3396	1816	msedge.exe	95
PID 1816 wrote to memory of 384	1816	msedge.exe	96
PID 1816 wrote to memory of 384	1816	msedge.exe	96
PID 1816 wrote to memory of 1588	1816	msedge.exe	98
PID 1816 wrote to memory of 4628	1816	msedge.exe	99
PID 4628 wrote to memory of 4656	4628	msedge.exe	100
PID 1816 wrote to memory of 4840	1816	msedge.exe	101
PID 1816 wrote to memory of 5012	1816	msedge.exe	102
PID 1816 wrote to memory of 4840	1816	msedge.exe	101
PID 1816 wrote to memory of 5012	1816	msedge.exe	102
PID 1816 wrote to memory of 5012	1816	msedge.exe	102
PID 1816 wrote to memory of 5000	1816	msedge.exe	103
PID 1816 wrote to memory of 820	1816	msedge.exe	104
PID 1816 wrote to memory of 820	1816	msedge.exe	104
PID 1816 wrote to memory of 820	1816	msedge.exe	104
PID 1816 wrote to memory of 3140	1816	msedge.exe	105
PID 1816 wrote to memory of 3144	1816	msedge.exe	106
PID 1816 wrote to memory of 3140	1816	msedge.exe	105
PID 1816 wrote to memory of 3140	1816	msedge.exe	105
PID 1816 wrote to memory of 648	1816	msedge.exe	109
PID 1816 wrote to memory of 580	1816	msedge.exe	110
PID 1816 wrote to memory of 2176	1816	msedge.exe	111
PID 2220 wrote to memory of 5072	2220	Wireshark-4.6.6-x64.exe	112
PID 5072 wrote to memory of 3144	5072	vc_redist.x64.exe	113
PID 3144 wrote to memory of 848	3144	vc_redist.x64.exe	114
PID 2512 wrote to memory of 1100	2512	VC_redist.x64.exe	124
PID 1100 wrote to memory of 1972	1100	VC_redist.x64.exe	125
PID 1816 wrote to memory of 2292	1816	msedge.exe	126
PID 1816 wrote to memory of 2292	1816	msedge.exe	126
PID 848 wrote to memory of 1236	848	VC_redist.x64.exe	128
PID 1236 wrote to memory of 1620	1236	VC_redist.x64.exe	129
PID 1620 wrote to memory of 2972	1620	VC_redist.x64.exe	130
PID 2220 wrote to memory of 3728	2220	Wireshark-4.6.6-x64.exe	131
PID 1972 wrote to memory of 5040	1972	VC_redist.x64.exe	132
PID 3728 wrote to memory of 5000	3728	npcap-1.88.exe	134

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://wireshark.org
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f0,0x7ff9a639c188,0x7ff9a639c194,0x7ff9a639c1a0
  2⤵
  PID:2412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1828,i,11456768790108301773,15822889667369644265,524288 --field-trial-handle=2324,i,12767091493658603013,3819373613357035790,262144 --variations-seed-version --mojo-platform-channel-handle=2596 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:1048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1660,i,13944693634484057817,3871266463149111538,262144 --field-trial-handle=2324,i,12767091493658603013,3819373613357035790,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:2
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2240,i,4838050286925027054,10807684652887272016,524288 --field-trial-handle=2324,i,12767091493658603013,3819373613357035790,262144 --variations-seed-version --mojo-platform-channel-handle=3044 /prefetch:13
  2⤵
  PID:1900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3480,i,12323393064010307373,14632110109786288618,2097152 --field-trial-handle=2324,i,12767091493658603013,3819373613357035790,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:1016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,15056268642324708148,13809419118871151624,2097152 --field-trial-handle=2324,i,12767091493658603013,3819373613357035790,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:3444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4136,i,9117186948462587577,12231321204643565943,2097152 --field-trial-handle=2324,i,12767091493658603013,3819373613357035790,262144 --variations-seed-version --mojo-platform-channel-handle=2416 /prefetch:1
  2⤵
  PID:1844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4172,i,2804245613358677998,18043587713138458493,2097152 --field-trial-handle=2324,i,12767091493658603013,3819373613357035790,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:1
  2⤵
  PID:2872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4164,i,8313612390899019073,1521041138855794106,2097152 --field-trial-handle=2324,i,12767091493658603013,3819373613357035790,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:9
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4184,i,14362382529583016068,14883148645500511066,2097152 --field-trial-handle=2324,i,12767091493658603013,3819373613357035790,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:9
  2⤵
  PID:2740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4348,i,393914709163067025,239025838631270522,2097152 --field-trial-handle=2324,i,12767091493658603013,3819373613357035790,262144 --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:1
  2⤵
  PID:1340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3556,i,15028122678357817454,10057201548772802769,524288 --field-trial-handle=2324,i,12767091493658603013,3819373613357035790,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:14
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3548,i,12120578330569163766,17128655749041554508,524288 --field-trial-handle=2324,i,12767091493658603013,3819373613357035790,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:14
  2⤵
  PID:384
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5940,i,12452112930228029401,18198667505193756823,524288 --field-trial-handle=2324,i,12767091493658603013,3819373613357035790,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:14
  2⤵
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5940,i,12452112930228029401,18198667505193756823,524288 --field-trial-handle=2324,i,12767091493658603013,3819373613357035790,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:14
  2⤵
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6248,i,2413464087619532413,10792937551883300615,524288 --field-trial-handle=2324,i,12767091493658603013,3819373613357035790,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4628
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1132
    3⤵
    PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6672,i,14216037124937142462,9347708541131045039,524288 --field-trial-handle=2324,i,12767091493658603013,3819373613357035790,262144 --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:14
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6668,i,16115371189444211969,3894225705788646593,2097152 --field-trial-handle=2324,i,12767091493658603013,3819373613357035790,262144 --variations-seed-version --mojo-platform-channel-handle=6708 /prefetch:1
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7180,i,1506391792382268974,16968304911710436034,524288 --field-trial-handle=2324,i,12767091493658603013,3819373613357035790,262144 --variations-seed-version --mojo-platform-channel-handle=7236 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6088,i,5593568510266853996,14918920948803675213,2097152 --field-trial-handle=2324,i,12767091493658603013,3819373613357035790,262144 --variations-seed-version --mojo-platform-channel-handle=7276 /prefetch:1
  2⤵
  PID:820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6080,i,13170293921139509001,1074594195897502741,2097152 --field-trial-handle=2324,i,12767091493658603013,3819373613357035790,262144 --variations-seed-version --mojo-platform-channel-handle=7096 /prefetch:1
  2⤵
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4804,i,1017987627171592827,16048828164154829759,524288 --field-trial-handle=2324,i,12767091493658603013,3819373613357035790,262144 --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:14
  2⤵
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7312,i,11781615673946789601,2529591750522231978,524288 --field-trial-handle=2324,i,12767091493658603013,3819373613357035790,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:14
  2⤵
  PID:648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7116,i,12068792339913182792,17088525584184779520,524288 --field-trial-handle=2324,i,12767091493658603013,3819373613357035790,262144 --variations-seed-version --mojo-platform-channel-handle=6864 /prefetch:14
  2⤵
  PID:580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7164,i,729971988148025830,4295708067238785018,524288 --field-trial-handle=2324,i,12767091493658603013,3819373613357035790,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:14
  2⤵
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3540,i,14002212883925810946,678225040451251140,524288 --field-trial-handle=2324,i,12767091493658603013,3819373613357035790,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:14
  2⤵
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6552,i,13867414604686906591,3189960615389228696,262144 --field-trial-handle=2324,i,12767091493658603013,3819373613357035790,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4124

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3376

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1100

C:\Users\Admin\Downloads\Wireshark-4.6.6-x64.exe
"C:\Users\Admin\Downloads\Wireshark-4.6.6-x64.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Program Files\Wireshark\vc_redist.x64.exe
  "C:\Program Files\Wireshark\vc_redist.x64.exe" /install /quiet /norestart
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5072
- - C:\Windows\Temp\{8D38D3E3-5B80-4914-901C-6B491F82D8D6}\.cr\vc_redist.x64.exe
    "C:\Windows\Temp\{8D38D3E3-5B80-4914-901C-6B491F82D8D6}\.cr\vc_redist.x64.exe" -burn.clean.room="C:\Program Files\Wireshark\vc_redist.x64.exe" -burn.filehandle.attached=696 -burn.filehandle.self=704 /install /quiet /norestart
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3144
  - - C:\Windows\Temp\{EC65C643-5137-4273-8AA1-C4E309A22D19}\.be\VC_redist.x64.exe
      "C:\Windows\Temp\{EC65C643-5137-4273-8AA1-C4E309A22D19}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{F890021C-E881-4504-8DE8-B8615858435D} {09D867DF-31B7-4C91-AB7C-DB19BB397000} 3144
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:848
    - - C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={d8bbe9f9-7c5b-42c6-b715-9ee898a2e515} -burn.filehandle.self=1028 -burn.embedded BurnPipe.{9E328D8C-F262-4EBC-A370-BDA6EA9A100B} {BC007E6B-BC99-4DD4-8D17-A7B5F6FB12F7} 848
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1236
      - C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=544 -burn.filehandle.self=560 -uninstall -quiet -burn.related.upgrade -burn.ancestors={d8bbe9f9-7c5b-42c6-b715-9ee898a2e515} -burn.filehandle.self=1028 -burn.embedded BurnPipe.{9E328D8C-F262-4EBC-A370-BDA6EA9A100B} {BC007E6B-BC99-4DD4-8D17-A7B5F6FB12F7} 848
        6⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1620
        
        C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{FB961980-8D28-4810-906E-BA5491F9B085} {407D00CE-14C6-441B-89BE-08243D2F6A23} 1620
        7⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2972
- C:\Program Files\Wireshark\npcap-1.88.exe
  "C:\Program Files\Wireshark\npcap-1.88.exe" /winpcap_mode=no /loopback_support=no
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3728
- - C:\Users\Admin\AppData\Local\Temp\nsa11DA.tmp\NPFInstall.exe
    "C:\Users\Admin\AppData\Local\Temp\nsa11DA.tmp\NPFInstall.exe" -n -check_dll
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:5000
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -WindowStyle Hidden -NonInteractive -Command "Get-ChildItem Cert:\LocalMachine\Root | Where-Object {$_.Thumbprint -eq 'DDFB16CD4931C973A2037D3FC83A4D7D775D05E4'} | Sort-Object -Descending -Property FriendlyName | Select-Object -Skip 1 | Remove-Item"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:4136
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -WindowStyle Hidden -NonInteractive -Command "If (Get-ChildItem Cert:\LocalMachine\Root\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4){certutil.exe -verifystore 'Root' 'DDFB16CD4931C973A2037D3FC83A4D7D775D05E4';If($LASTEXITCODE -ne 0){Remove-Item Cert:\LocalMachine\Root\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4}}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:4304
- - C:\Windows\SysWOW64\certutil.exe
    certutil.exe -verifystore "Root" "DDFB16CD4931C973A2037D3FC83A4D7D775D05E4"
    3⤵
    - Manipulates Digital Signatures
    - System Location Discovery: System Language Discovery
    PID:2392
- - C:\Windows\SysWOW64\certutil.exe
    certutil.exe -addstore -f "Root" "C:\Users\Admin\AppData\Local\Temp\nsa11DA.tmp\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4.sst"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2572
- - C:\Windows\SysWOW64\certutil.exe
    certutil.exe -addstore -f "TrustedPublisher" "C:\Users\Admin\AppData\Local\Temp\nsa11DA.tmp\signing.p7b"
    3⤵
    - Manipulates Digital Signatures
    - System Location Discovery: System Language Discovery
    PID:4500
- - C:\Windows\SysWOW64\certutil.exe
    certutil.exe -addstore -f "AddressBook" "C:\Users\Admin\AppData\Local\Temp\nsa11DA.tmp\digi-ts-2023.p7b"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:240
- - C:\Program Files\Npcap\NPFInstall.exe
    "C:\Program Files\Npcap\NPFInstall.exe" -n -c
    3⤵
    - Executes dropped EXE
    PID:3328
  - - C:\Windows\SYSTEM32\pnputil.exe
      pnputil.exe -e
      4⤵
      PID:4556
- - C:\Program Files\Npcap\NPFInstall.exe
    "C:\Program Files\Npcap\NPFInstall.exe" -n -iw
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    PID:1916
- - C:\Program Files\Npcap\NPFInstall.exe
    "C:\Program Files\Npcap\NPFInstall.exe" -n -i
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Checks SCSI registry key(s)
    PID:2724
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -WindowStyle Hidden -NonInteractive -Command "Microsoft.PowerShell.Management\Start-Service -Name npcap -PassThru | Microsoft.PowerShell.Management\Stop-Service -PassThru | Microsoft.PowerShell.Management\Start-Service"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:464
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -WindowStyle Hidden -NonInteractive -Command "ScheduledTasks\Register-ScheduledTask -Force -TaskName 'npcapwatchdog' -Description 'Ensure Npcap service is configured to start at boot' -Action (ScheduledTasks\New-ScheduledTaskAction -Execute 'C:\Program Files\Npcap\CheckStatus.bat') -Principal (ScheduledTasks\New-ScheduledTaskPrincipal -UserId 'SYSTEM' -LogonType ServiceAccount) -Trigger (ScheduledTasks\New-ScheduledTaskTrigger -AtStartup) -Settings (ScheduledTasks\New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Compatibility Win8)"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:4976

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3268

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
PID:2572

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3352

C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe
"C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" /burn.runonce
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2512
- C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe
  "C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260629045857.log" /install
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1100
- - C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe
    "C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" -burn.filehandle.attached=548 -burn.filehandle.self=564 /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260629045857.log" /install
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1972
  - - C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe
      "C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{5DEB791C-6434-4743-BA6D-CBE5BFD79E4D} {03E2DB50-AED4-4458-8728-FF9F958F776A} 1972
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:5040

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
PID:2040
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{2f928828-0f2b-9a4e-9997-2cad090d6296}\NPCAP.inf" "9" "405306be3" "0000000000000154" "WinSta0\Default" "0000000000000160" "208" "C:\Program Files\Npcap"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:488

C:\Program Files\Wireshark\Wireshark.exe
"C:\Program Files\Wireshark\Wireshark.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
PID:6700
- C:\Program Files\Wireshark\extcap\etwdump.exe
  "C:\Program Files\Wireshark\extcap\etwdump.exe" --extcap-interfaces --extcap-version=4.6
  2⤵
  - Executes dropped EXE
  PID:6820
- C:\Program Files\Wireshark\extcap\etwdump.exe
  "C:\Program Files\Wireshark\extcap\etwdump.exe" --extcap-config --extcap-interface etwdump
  2⤵
  - Executes dropped EXE
  PID:6872
- C:\Program Files\Wireshark\dumpcap.exe
  "C:\Program Files\Wireshark\dumpcap.exe" --log-level MESSAGE --application-flavor wireshark -S -D -L --signal-pipe 6700.dummy -Z 1808
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  PID:5656
- C:\Program Files\Wireshark\extcap\etwdump.exe
  "C:\Program Files\Wireshark\extcap\etwdump.exe" --extcap-dlts --extcap-interface etwdump
  2⤵
  - Executes dropped EXE
  PID:5908
- C:\Program Files\Wireshark\dumpcap.exe
  "C:\Program Files\Wireshark\dumpcap.exe" --log-level MESSAGE --application-flavor wireshark -S --signal-pipe 6700.dummy -Z 4012
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  PID:7188

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

Software Discovery

T1518

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5900f5.rbs

Path C:\Config.Msi\e5900f5.rbs
Size 19KB
SHA256 7dc6633d5696a01dcfa628d91fd8af3517377356cac79b9353da75e89a1eda62
MD5 e08ded8a6c55bcb5e377123dcb8f6992
SHA1 4c6483a12709d155c9f6421d1a2a71baa5c7ecf1
SHA512 a8414ce881bc5ef612e35dba1617bb95615c8b8aeda905e66e0c52d389c0bdc321480c0d3426d211f76e0606e2a9a89e9ef3ab7544eef3658dae254375022839
SSDEEP 192:BXRA1kR815dXcFUADIc1f+W+y4+ogPfx7:BXRA6R8TeC81f/cYx7
TLSH
T165920C026680C9D3D8766B30CD671BA53B76DBD9A350438B50DC94308F93BCA2F9D68D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e590101.rbs

Path C:\Config.Msi\e590101.rbs
Size 19KB
SHA256 c37cb43027500f48004c1fbe8b2d47849b8e27a11c7cf96ce1f57de273594e31
MD5 0483b88863310508b09b41f859beec73
SHA1 799ca8c9ddc1e4953da1144c390e421d818caaa3
SHA512 3c2b74724315f520fc3ed5aa5f851023ba7a514b6c127a4cb8bfc287ab64e4f2249fd4374bb73bc92a7658a720db89ef0532ceab0340c452d35328770672d200
SSDEEP 384:uOOGnJXMjZ7Up+BFqiO6dxgJf0uJf0GoaOD8Lfv/8c3zMZxq+nNwzQ6R:uOOGnJXMjZ7Up+BFItfFfx
TLSH
T1C492BB026640C5E3D8A62B70DD4B67243BB5D7CAA355A38B41DCC1708FA77CA7F8D24A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e590108.rbs

Path C:\Config.Msi\e590108.rbs
Size 21KB
SHA256 b2c133a66cb173635a560202b5cd456f1ae1fab01caf5cce1e834de813df3aca
MD5 953570008f3a1d30338567c8424003d2
SHA1 20c0ea8d15920ca5992d94d61c6b8320c282555f
SHA512 16b19d6fc4d52bdf1b46f7ca43db1ce363589137101490f28a52288504e3c28c22fbcdd4f9f29b4b2b80f7e2ba267196b577f0afdb0fce3c099520adbf2ed7ec
SSDEEP 384:upRhGR1nAKxNAUhUC7xJjrMNYPzIbSfIKi98szot+TFkP:u/gJAKhkmX
TLSH
T18FA20E03768099E3C86627B1DD671BA93B73D7D99350434B10ACD1388F633C72E5AA9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e590117.rbs

Path C:\Config.Msi\e590117.rbs
Size 21KB
SHA256 e7e84c9120d5860eca898e28b586f09758adfcc66773178d8ab706e1c8ef8a38
MD5 56a5203a8f59f9667a858b9968732685
SHA1 35b5cce258325da4e5d8b05330afcff5df16bce5
SHA512 149eef085f440b9adb1ce9ad45e1f98c39ec0a40b52d7af9c459ce8a1620d60b7a8a6604c8b5a8cb6969d1df989435215b14576ae6bdb1a300ebf74622d74b5f
SSDEEP 384:urqvDIAZxEth/phSYjK4WbJGwazsalckU72eC6jJkE5KxJyUJysr76c+0dWg:usDIAZxEth/phSYujbJpT0lNr76/0dP
TLSH
T172A20D42BA40D6D3D8A62B70CD975B2437B5D3DAA755474B00CC90308F937DA2F9AACB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NPFInstall.exe

Path C:\Program Files\Npcap\NPFInstall.exe
Size 316KB
SHA256 97bdbecd9cd9d246369d14b24a5f0c8ddaae9c8592f55566158a13e02dff2301
MD5 16b4a8175b18a973803e5531117d3ba2
SHA1 4c52f54772256599e7dd24148bf72ce5e406093d
SHA512 94b95926660762c39571c4a56dd5f2c2a4b37ed353ae82fdef1ad1e8e26ac34f5fb54e50b6dc36408a8613a9bcedd704da3ccb60f495cac49a636623098e451e
SSDEEP 3072:WIr5xYtcNr7of18CYGU/ZGThCe32wpifkUAr0IdDzI7GROy/TJ4DvRnCye8sA/wV:FX9Nr76+ZOhCe3ZpicGO1ROB5RIWnep
TLSH
T124645C11E7E510B9F9BB8A798DB68545DA737C420B70D9CF039045BA2F73AD08E39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NPFInstall.log

Path C:\Program Files\Npcap\NPFInstall.log
Size 926B
SHA256 25ea3d30826d256df482d77017831598042f23db7a41c02d86285c905984dc62
MD5 19db1f858b425bda7533f8dc7c92d25b
SHA1 049da9645be109f64c499b4c0416d1370fd35914
SHA512 9a2a4c797b2c52d02766b7ed907905516efe4f48222f3b0f7f3d768564f87051b7def8aed667cec219526a13c90bdb92c2b6fd95fca8d400fc887728b4eebbfd
TLSH
T1DD119D5279AC5EE8D5EF9346F9163CED0AC0710111F341317788E5A0BBA708F5FD5A09
MD5 SHA1 SHA512 TLSH

Submit Download

NPFInstall.log

Path C:\Program Files\Npcap\NPFInstall.log
Size 3KB
SHA256 c0ff90066d06be30d40efba0a3f099c443fd33dc4181315b78b6c253f2903824
MD5 e25cc842acebb70a1d7b9eef4c816b78
SHA1 1f805256f9503e9586a8b8871db9541ea3f36f07
SHA512 d29048e27df60a39e0fbd9d8d6e061a84b63302b4aa4a6ecf1f88a5e37464ee15a0c9c379c134bdad47532e4cf15568e60e59c037e63dee50f09f453493a31cb
TLSH
T1956143623AAC5EE4C1EE8342FA167CDD5E85B14211F30071768CF298BB960CF9FD5A09
MD5 SHA1 SHA512 TLSH

Submit Download

NPFInstall.log

Path C:\Program Files\Npcap\NPFInstall.log
Size 4KB
SHA256 69bd5e4d59c2f06341ee3753ae974b84e7b352842707ee9c2a7863c085373f4d
MD5 681eeef7d768880d9d1c1a4498a2a48a
SHA1 fb314ecdfd3aa806b4f94b4f53bf91ea9274c5f4
SHA512 148d1f6dea5bddc2e151390631e0851207ea414cec0a16d150bb84cc8ada442d78249433abbf1adcd96d006771732ecd608d9a466630a95cf7402922d359bc20
SSDEEP 96:8kxGxm+xnxdxWx5xDx9xlxciyQuUo4oTRA/4oTuUo4K:HAjl7MzZ/fjQXC/wXh
TLSH
T18E8154523AAC6AE4D1EE8742FE5A7CDD4A81F14221F30071768CF288B7560CF9FD5A49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

etwdump.exe

Path C:\Program Files\Wireshark\extcap\etwdump.exe
Size 350KB
SHA256 e25d7d61dad0aa7dca835d4265e62ba2f4a3707276b21e8b2443a8a89aea1d5e
MD5 9670879a12f276502652c79906ecad4e
SHA1 984577ca4f7434fef55cded5d4a3edde00acca30
SHA512 6cadb5323764507632d6350868894e95695712d767c57b6217e605bff8b3de4bf507610031a7564538ac53d6acb8f76e58747cf5636e2778045a2c3ba717caa4
SSDEEP 1536:6McN06GSZRkAoyTuyKAq8WCk5Khy7T7ODuYUg48o0VBgWHncnFPXavErjnCj2Weu:Tx6zZR3oyFDWT5K4yr2rFP0oBjbCjTZ
TLSH
T1FB74B7E46BC9E5E3DEE012368103B7B835675FFD9AB1241DEA8CB7013674CD825BA058
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

npcap-1.88.exe

Path C:\Program Files\Wireshark\npcap-1.88.exe
Size 1.3MB
SHA256 a2f4ec1e5ea353ff67efd24b2ebf081ba44532410fae8d5e146af0310aa4f56b
MD5 c78aaa2a95794030f71798c94f0da181
SHA1 35f6c49deefffbe51f96985e87e813ad68c1f217
SHA512 ce732beee69c3431268fe7ec51b99be338c8d5e963c009eda5a622d965fb91c3c3bc1ed071839f964c84a2cddf557d39272040036a6d51138ed8064aef282d08
SSDEEP 24576:Y2S1Qavd8udnTYXUIavMq/Zcw31W8PGFmlc4BbRfEra3Az:aXu0mii81XPyAbBbRuaQ
TLSH
T1AC55238896E8E81EF0B34E3728F0835E52BAB10A06E1D60F7350F55EF935B55C61C7A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vc_redist.x64.exe

Path C:\Program Files\Wireshark\vc_redist.x64.exe
Size 24.4MB
SHA256 cc0ff0eb1dc3f5188ae6300faef32bf5beeba4bdd6e8e445a9184072096b713b
MD5 486f81facf798678c3244c7cf35a557f
SHA1 21ce0ee54bff57f69fafa741025bf2f15b356405
SHA512 e131b93acde5ffc76c19eb0784183a1e94dfa9fe06111a7830eae3ad8583895575dd4dca66aa70efddb243c95735a0105efcd3042b4b5ca445d3d8e8c39d957e
SSDEEP 786432:mjjpx5hYBug51eEdO41UnAyijgtUHFt9q4YYOQdV:kpx56Bu61eGv1pjg6pb
TLSH
T10A473332E0448026EBE61037A168F5206F7CF624A3649ABBD6CCED0D37B649717FB615
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

state.rsm

Path C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\state.rsm
Size 900B
SHA256 67d4e16380c480041e8d7c31faa72e6fe7352f0d235428ae73981459aea7fc3a
MD5 00126f53bd11c3cf16f77bb7ae218d03
SHA1 a2a4906e11c5ca9a8226d49e658066d9e5b1a1e1
SHA512 42cea28bfb57c4b78ea762d38f88bb2b8c75e9aa08964805fdc185a4373443784dd340aad65adbde16d312496c45c68262b17a232a9ffa2786a2405b6762136c
TLSH
T1FA1190605FE2042EF3F7AA7138F40715587BF8020931812D408231869F72A90DC24B66
MD5 SHA1 SHA512 TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 9420686d12b2cba6dc69896d607eadac629280a010e5358a4872ab9753f24ed7
MD5 8be6e81804d8b903ae07c11b2e53e3d9
SHA1 817c41cb00b05a8f2040323b93c6416b92dbc01b
SHA512 c2cfff48ebb312975aa2615d841d0badff185589ad3a3f5e8420c2ea0eb5dc0e5354d917cc43d57bec169a63d4fa21d66e91dc3e195592ece23d37fff7c04680
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7R:fwUQC5VwBIiElEd2K57P7R
TLSH
T1CDB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 45f521737e34108fcec0f24251f1736a9124dca7794b71ae2966e26d8a05fc0d
MD5 cd7793cdfb9295f447572efb6e70bf81
SHA1 dce217c94f7231f2559527c77b17604e0c11be61
SHA512 14938c84baa985800075d40695a2c29c097db067e02c4e847dadba963bcb208d88cf963091e96a6bfb0bf1ee245e50457f5f714cbd561eed42d6bcb9f59219f5
TLSH
T190D092317F5AB451DA46123A9841872A2DA5444A2AAB9207A261888DFDA50A8A3C60A6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b83d8b3b3bb64ff97dfd21017822c565c50fa4655623c882c9854229a2eb9fc0
MD5 2a1c26025a16af9770d1943aece12b07
SHA1 e99f200ab4b656082ea4283baf673ac37faaae9d
SHA512 c6a6b667c750c33f99946cd667b400c38692f5bf6c8cc28971c0ef5899c7166adba2ea6dda0f083bb68464d66d757a9fa633c1820e825946725f45a260f459cf
TLSH
T15BD09B313F5A7451DA451235584087162D554445155793079151444DED9509493C60A6
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 7694ec45b9c6beb71b3941f755819c8729642e36a16c3942a53de936db4ff1ab
MD5 36fcf365fa3639167f1b41a9dbad95dc
SHA1 907d8adec2d811a1b34d69f543ee3466024b4360
SHA512 4d1739ee862283aa6146346527983aa7f9e465ce6aa3385fd02e0d3f20213992fc73156a0bbf8cd70083ce814e7482124da3fc4fd6e509fe061068fbfb11dfe3
TLSH
T18D614F1502627E9BDB35033594D0A33F3DB281A89D9FDE86354878BD6616BD2E11DC34
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe588b53.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe588b53.TMP
Size 3KB
SHA256 5f34186f3cd5ce6706420b05cf945e6ed5f738ccd36c21767c3983956e846e15
MD5 c9b989e3fcee2420a5be729d8fd697a2
SHA1 cb06408dabe468fdfc51720b10b80a4dcebf8ef6
SHA512 e7fcb6ccaabb1c0b9d0d0f4fc137875ff9b6acffa1e47a6967a65e0b72669b2517c017eb144423a1677520e699993f24f26f0d3e3abe970ea080e08898e98d77
TLSH
T181613E1502627EABDB39033094D0A33F3DB281A89D9FEE86354878BD6656BD2E11DC34
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 b976cceeb9f7ac8819a82ae835dc0b3cd54122b1f3e55b2a475ee8a57f6d0752
MD5 0bdf6dbc52158377bdd45ad697126f08
SHA1 341244903cd0eb4f8c6ea9f9d3f2d038ed391d9d
SHA512 6d058b8e0228a7b5c59db2f810f68436bb2373a4082c80bb2f73bb372e75d663346d089daedf2f99cede41a0871a45a2ec38428474eae91c9234956da1d2dac9
SSDEEP 48:YALlj1sNeOj1MC8ej1FWCstzEsJjojcxJzsVjgjasWjcbsljMwBj6AsL1jDjJsgd:DGoOSkLSzVkwQk0Qw4wBj6ZfLvfcxq
TLSH
T1E2819CF3C2E48A6E885355F1AB247E17CE5D059943283D2A89E0EF4763D6872D641A0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 b58aacaaaa7c4cd2e827ccba2cd7551fc47ce6d6c3a0a226aa87a0b4afe755d0
MD5 88a505cea7598284ad0b91d006700001
SHA1 910372511ee4fde15df04137a7c3467f6869f0d0
SHA512 4a0cb6dbdd7c354c85326e323d9b43208d170ce4cdb6f935eafb545b525b78a74c365e4ae1a0764c8a3b7206d5e310dbce2505bf2da294e584a72499b5a0bad1
SSDEEP 192:sxZzRhyM/jK1Ml8MoY/fGsmYAIdp5a7/W6+WNfgm/Y0aqn7PIgrJ:sxZzDQY/fGsmYB+/bB/599
TLSH
T1E052D812AA345977CCDBD309FA45BB53D6F9546293900E48AAFCDA0C05E7AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 3b7afd79cf5a3d9e06fd01304fde56471c556becbb2a81afa46e087b9bd8ee35
MD5 5333ea8bcc5bfd5d8c516cab115ba3e2
SHA1 ab9b5c4b70319fd9be89a35f0aac67333522d17b
SHA512 e1855029ba21f7a3538415d1f0ec02bed9e4834ce90ef55d6113623977273bb244a2adc85da5ab06ab78886466a44bcd810863fb22ca00f1d0af93bd648b3d79
SSDEEP 192:sxZzRhyM/jK1Ml8UQLoY/fGsoXAIdpTa7/W6+WNfgm/Y0a+pDwPIg5zJ:sxZzDq0Y/fGsoXBI/bB/5Qj
TLSH
T13052E712AA345977CCDBD309FA45BF53D6F9546292900E48AAFCCA0C05E7BED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 1bdac7db977ce27301a998ad25b049d9d951dd5034af99a5edfe7eb2d68a6cc1
MD5 63e1cab3d5a2514d632ed63d7a5d9062
SHA1 4b0f7dc639604246046f3e58cec7f7756f9d994f
SHA512 7c4863f1973e16a009a6a45ece3eba85335dd3aa00e8be37b8819eb3bc6e203c75c4c79c452f2fd300e94175ca27030a2582e394be5e1c439df19b0ed3ea77b9
SSDEEP 768:R4/zh8dF2PkWRmEcQXw8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3WjLl/2c0VSQropf:R4/zh8dF2PkWRmEcQXwu1jaKWjLp2tVi
TLSH
T1ACE20A3F284CC7BE4F844E9CEC266F976ED801CB66684D5447FA894C03C76DB521A49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 3b19ac07cbfb9e7e274d99e97d34193abd54be145c0249fc1544ee27921866e6
MD5 f2056e171e78007ceb75746b88ab5bac
SHA1 924ba18020e92c849a436975be9802a285b2c534
SHA512 0afd832bf90b99e5ee63e48d777b6f8f609a464bf7c3effec78f6591470b90d5b57a3bb5131d99ad7c52d31163d1a6ff9c5cb146029e1659fbfbecca42e39c64
SSDEEP 48:KEWIHKvDAIfK12cryReIvKfK07yn32jXltt+X9UlIS3+KNLVB+5fucsxLTYXz5:KEWgKvDAgK12ayeYKfKKSsgKxmb
TLSH
T1C7B16A5231FA06423D3D270DA6A5975B7A41B2633255B52B7BE802B20E2BE305DFDCCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe590749.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe590749.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 bd162e2e77773fc93c75d3c3c8a2a1e5361bcc157a4a362a8da063ab1591f658
MD5 a7700c96c91d90ed77bbe0c5c87ebcd9
SHA1 a2261880686f1ff5f8a9273dcf025152eba1fb7a
SHA512 5854eabf5d3b29080d6ca12c557adf2bb6c6bfd5ff4edf375f74f5d2afa417b60d2534878e63a3e34b8cdd22bd3adce323be2b39d7afa7a4368d621fce2efddd
SSDEEP 384:0tNn/s3n9Sf8NFhdoUuDH/Ins3vnbmn15wbAjEJ83:0j+9UZUyQs/bmn12bfJ83
TLSH
T153927C3A6C384D774DA3D544F44A33075FB880A7D7892B58D5EC5F4E01DF698231AA16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 b8ca50be1408b08b9dfd560863a5cc8edc9e31bfa5a2cf2fb73e48022479ca30
MD5 65ef46d36974d1c2ed977e87b3e83ce8
SHA1 635dc5a943ea7a17b32158f1ae2e0dd9d4bb240a
SHA512 2442a3c0e5dbb2246f448bdf7c72bd3b52dc238aa882fc285217046faf35dae9d5eca78adfbe889ea4c129534b79895acec4f2e9c72b2f3068f2218882f637f8
SSDEEP 384:riFRtNn/s3n9Se8Nf8TUNTUlIledoUueiZyZ2ns3vUbmn15wbAjEJ83:GFRj+93qwgnU1NZKsMbmn12bfJ83
TLSH
T10FC23AF658D74936CDAE8747A73D2E064EBCC0A3B6842A54B3984E0DCD9B1BFD306911
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2fae457eb9a450cb5535f37478b0e0c9abf9fd23bb1a78e162db855831a30e95
MD5 52901e957246c028d8375d0c55f8a146
SHA1 763d9ed8f02a7e25244ce92da9097d5dad42d62e
SHA512 1f09c0ca23ae35012d1f278bad3fe1c8be22a00422d746997a682724abb059fe0c3e2d13049fea73c3d57f6940f1f60f346aef6b3744d5d49432b349e5a900c9
SSDEEP 192:fGNg6P2U4QmiUyxwEl4Gv0W4vS6HtI0BEqtU6:fGNg6erHO4Gs3vtbU6
TLSH
T1B6120976AC686C7B4DA2E540F88732035FF8416BDB897B80D5DC2F1D01DF65C234A926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 00cbd161eacee12bf73745f099e0b8b6f3439801075928535ac3b19b9674b1c1
MD5 c1fef9b35e62d122a1e20f0fc2e81c33
SHA1 43bb1288018af076306d17ca1c034b96147a3802
SHA512 381ef45e773558ded63294907687c42a3f013da06d77fa75fe867311466fb602f9378d91f0c0ae5eb6180f737f9a29840fe7c2a35e525a6b31f0c5330a395049
SSDEEP 384:GtNn/s3n9SG8NFVdoUueiHyZ2ns3vnbmn15wbAjEJ83:Gj+9lZU1vZKs/bmn12bfJ83
TLSH
T158927C3A6C384D774DA3D545F44A33079FB880A797C92B98D4EC5F0E02DF69C231AA26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 05f9356a1be9a4b86790bd61b39d0fbd0dbf4e24aa4dd4a4bb02079ae7d1efb2
MD5 71d1d6d053fb8302f51da7a1a53b4ca8
SHA1 0d28bbdb9b54336aa798adf0533d9ef845fa922d
SHA512 09e5bf6fd799d5c0c30c56385c68a30037a291c7dcbf6ab28fd85c8785f3aacc44b797e32ce00efb13d3207f7ea67e17b3e2e2b1f9ff30eee9662a59f1ebb975
SSDEEP 192:BGNz6P2UOcQmiUyxoIUlqGv0W4zwSnyU6:BGNz6eXsFIeqGs3DyU6
TLSH
T1EC02FA796C786CBB8EB2AE45B88737135FE8107BDA952B44D9E41F1C00DB64C2347936
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 29b4182c524658ea28ffcb89b95321a01ef96a699149246a5264596912ccc2fa
MD5 27731f3449dbad42517af22d4b32bfe9
SHA1 99cb02b3918797c6af94e3b491212dd7f3350681
SHA512 9c1ee84662f188900fb69640fc9fc1af441039dfe25a738171d60098c03a5b34e01622791dd168482a18aad42d4d7d24e3b4db2f17fae6bc6e566d039bc1c25a
SSDEEP 384:ztNn/s3n9SG8NFedoUueiHyZ2ns3vnbmn15wbAjEJ83:zj+9lCU1vZKs/bmn12bfJ83
TLSH
T168927C3A6C284D774DA3D545F44A33079FB880A797892F58D5EC4F0E02EF69C231AA26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_irkmt3p0.1ej.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_irkmt3p0.1ej.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

dd_vcredist_amd64_20260629045857.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260629045857.log
Size 18KB
SHA256 6fce917d1de77eaedcefa8ad5d25d7fbbca2eba0378f98ab6e5cd75affdfe0d1
MD5 7fc4ff9ec2b944156550fa543789bc8f
SHA1 46e5e305a671e67e5b633bff7c6eae3a174fd039
SHA512 2d4ca47bfb41f4398f40dbe8bcb44d27b25620b1e34948d3069a5aba861454fd454453a2c74b18f44f47231bea89ecc679c8d5717fdbbedfb0e90af7f489ddc6
SSDEEP 192:6yJ2bnP1L1x121G1V1b1Y1tyyBtMEcURwdLmoq1/Iem4VeyjNjJK2UBWt8RfG6wo:6yJknLmoq1Cyhtz0wLItOUV
TLSH
T116920403F7FCBE6018DCD396909D5FD9DB9A7124294214B4F7B592CC606982A8BCE1CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd_vcredist_amd64_20260629045857_000_vcRuntimeMinimum_x64.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260629045857_000_vcRuntimeMinimum_x64.log
Size 2KB
SHA256 89aab0090e3dd8974cf39111aa7289c47a9215d9ec584c9cf1dc837f0b90b253
MD5 61160e536577fbeb20aa91c9d89e833b
SHA1 6499b78901d7db792f5908a6b1c210c3ddda2c60
SHA512 92715c1ec36ba05bcc922eb252cc12fce8fecc54c397dff717afd174ec6d7b12cddf0908875a636456e9f0b207fc13dfeca95f734a64aea8762e1c64f64078bf
TLSH
T1C44126251AE9085AB2B79707DAF3C1134A33FDD9A971CB0C6289435A4267C056CBC77E
MD5 SHA1 SHA512 TLSH

Submit Download

dd_vcredist_amd64_20260629045857_001_vcRuntimeAdditional_x64.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260629045857_001_vcRuntimeAdditional_x64.log
Size 2KB
SHA256 49c0dc14c855135a24bd6e9b8fd5ac147d85cfcbfd34397eb4bc6b89a1ca707b
MD5 7d6f04f9e43d8c003df9609c09aa00cc
SHA1 a92e2aa95572eb34254a0e7083ef42d9a699da76
SHA512 dd200b139ab4bef1a35b0fe7c2db290d16e6f48e24a36bfae3eb1c476846ffe1ba6fab6119d36f29a3bbbbc53d2b7876fd16af95965c23dd9178e63138f741a1
TLSH
T1154126201FE8094AB2B75647DAF3C0539A33FCD26934DB0C2286435E066BD0888AC77F
MD5 SHA1 SHA512 TLSH

Submit Download

InstallOptions.dll

Path C:\Users\Admin\AppData\Local\Temp\nsa11DA.tmp\InstallOptions.dll
Size 25KB
SHA256 04f9432186b2aaffe44cf9610ef3d148eff881880ceda6efa59b3cba1405b892
MD5 5f840911e4fc9015ce7a2fcb54dcaf5e
SHA1 589d1ad1c0e7c9a5454c2a5afab283e98b90f061
SHA512 53b62c5545e4378110d45355d4bf493caa40dc63167f86955752e43d93b96e4b9465578797a4a9b6fe107f76ed1816cf076a0be3e97d9f943c1c63ddf8142a37
SSDEEP 384:EKNt+4t7uJalUnGesY7Lt8nC3/YosaiIYi/kn/hy8RbmL4nNygB:EH4t7uJnGeXLtUJ+Yi/S5ALO
TLSH
T18CC27D527BD05C72E5A72E3479E0A227DFB1F6226881C987E2365E069B413813EBD361
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsa11DA.tmp\System.dll
Size 22KB
SHA256 3ceadba8f202e3f7f605dcad341255e596810fc94d623de2b2c9169ff7bc4592
MD5 cd6a36dd894b5a4d5a09b14f8b4141c6
SHA1 e65bad79ac9c676f65a988afd779f72cc699430f
SHA512 ac1443f441e9e37604d7c13a4601debd06fc335aaa43a147d914c6940cffedd2d2075463f82b815861849c3f28c240d33b948442d981287958deb3174e212de0
SSDEEP 384:b/Qlt7wiij/lMRv/9V4brrzIYi/knoQy8RbmL4nNyj1+M:baeiijipo8Yi/k5AL/R
TLSH
T18DA28E138BA04CF1F9165D3034D4BA36AFBB79991AD081D377E6C191AB503C329BD297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

final.ini

Path C:\Users\Admin\AppData\Local\Temp\nsa11DA.tmp\final.ini
Size 666B
SHA256 c1dee3a664510a32035fee68d7bbe171e5cda681059526d3ff60019a08725a64
MD5 3b887355d2a4a183ca131724d765b6af
SHA1 ecce382567e8b7bdd4c2ebc070183af7559d0736
SHA512 a71b9323fe9f346c25993d2f443d3ec2f292969807ef7d37216cbaff1291d98ce3352716493a34e5a4201dff46365e956dcea045609ac6b3d86af30c9bf2dfcf
TLSH
T10301AF032EF88028D0FBFA48EBF5403557347851582CC91EA0D00A0F88F2B418933BEB
MD5 SHA1 SHA512 TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsa11DA.tmp\nsExec.dll
Size 17KB
SHA256 6a7e0435c5094eb4ecb21164ea8c28329ca150e298db78b1954fb981c39d57bc
MD5 44825db7369e6c6744a1651ffdbb100a
SHA1 3f8df790fa16fad120f43cfc76e080bb2328bc11
SHA512 e9658f1944ebeb48ac2485e89c5bdf7d76830e9a3bd49b56d16fdc6e18aff82ee84a4dc22c8f46efa9b3545eeac7fcd937afd2eca57def16de1dbeb2749367cd
SSDEEP 384:3H/cXtqfUNQZGdHyIYi/knkEcGy8RbmL4nNyvH0x:3Hw8fUAGRfYi/BG5ALxQ
TLSH
T124825D7349C02C52DC1B8D7078C4A93BABB5A5A51BD0C1D2322BC5959B80793FF9D3D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

options.ini

Path C:\Users\Admin\AppData\Local\Temp\nsa11DA.tmp\options.ini
Size 2KB
SHA256 6c4fd23d6f512b3d4f288814f417c5ccb8df2667816571f39e3aa4925eebc066
MD5 f67e342328744cd09ffac806a50f7ecc
SHA1 ce995fba8498c6b4ed65329dbaeab5a6697ae878
SHA512 701cfb49f775d0cc1c890ae0ae5ede0082500a97a7d40192776e5de9a581b1b0d75f2b379605ec1b741298979fdedfb32e81865ac1449ba56fafed3ca1843f2e
TLSH
T1DF414A133AF96024F0AAA64CEBF6843597383485192EC94FD1D14A0F4DE5A818627FEF
MD5 SHA1 SHA512 TLSH

Submit Download

options.ini

Path C:\Users\Admin\AppData\Local\Temp\nsa11DA.tmp\options.ini
Size 2KB
SHA256 8e369be241bdabfd325cb9c117e6168685bd994f911a64d1f94a865f8c67f1d6
MD5 93f65cb31a0d65c65bd4b9e32759984f
SHA1 4030cd0f7e573fd90b0a8f8782b2bbca81c4c99e
SHA512 7d6688e8ac101cbba918c030e8db09edbdaf6b22f1a482646d549f958f645ecf893475baee17c3fbdae4ab42824b5bdeeeace771915e78e565f53ccdae46ce74
TLSH
T1F54159133AF91028E1ABB54DEBF6847597383585182EC90FD1D10A0F4DEAA814627FEF
MD5 SHA1 SHA512 TLSH

Submit Download

options.ini

Path C:\Users\Admin\AppData\Local\Temp\nsa11DA.tmp\options.ini
Size 2KB
SHA256 71965f034ae5f141464ae0f40c6c9e39f347d3bba206b38dfbc539fe1fcc26e5
MD5 9d0d61388e5cd44d5b004bc8de2ffd28
SHA1 28bb1f5cfb6b9a1a1c922e450a6a1113d9995796
SHA512 ee69c8419056f61f7624ea9b70f60c122210e3e853e9fa17434ddfa30b285327215718d1142114c8112d7298feeded55cf6516de9b4bef22ed1a1fc2bd936703
TLSH
T1CE416C133AF91428E0BBB54DEBF6847597383585542EC90FD1D00A0F4DEAA814A27BEF
MD5 SHA1 SHA512 TLSH

Submit Download

options.ini

Path C:\Users\Admin\AppData\Local\Temp\nsa11DA.tmp\options.ini
Size 2KB
SHA256 d324440d90fcae55bd443470ad227e38cd70469839042fa4b61ef4d274281f44
MD5 403c0cdb6bfdcbd4cbc30e6becac4865
SHA1 4c704565daf976b44c49bcf2601fe258d7e44a35
SHA512 c127d60e14bafbade9364cc9c12998d65f751d0b5f7650e4f60745ce42f264a8e3108c9028a7b6ac60dedd8a5eb5afa8e93af46ed1a53c2c46b6353fdc51f309
TLSH
T1434169133AF91028E1ABB54DEBF6847597383485182EC90FD1D10A0F4DEAA814627FEF
MD5 SHA1 SHA512 TLSH

Submit Download

options.ini

Path C:\Users\Admin\AppData\Local\Temp\nsa11DA.tmp\options.ini
Size 2KB
SHA256 fe2077ba39ff21d241fc734ee80ba81aad57dbd8f76c0307a0de7c3affa0e67c
MD5 c0c662191a072c83b36eefc8b5d5f4b3
SHA1 235622f4a53ca08eeb8cd0b98bfc141e3fb9d32f
SHA512 8109b368ea609de157703660b2fa5b4d10d7c5dde1b669ebcf6b148be7b569ec696bc0c12e8f9a708658d2cc634e94d1a20de9c21cf90c6b71d6b9094c481a59
TLSH
T1BE516C133AF91428E0BBB54DEBF6847597383585542EC90FD1D00A0F4DEAA814A27BEF
MD5 SHA1 SHA512 TLSH

Submit Download

CertificationPage.ini

Path C:\Users\Admin\AppData\Local\Temp\nsa7760.tmp\CertificationPage.ini
Size 968B
SHA256 f3e0a044d59dca01f94ffaec50377876d6c79e710912bc9ffed4ea3f66147aaf
MD5 ef40af1b51a668d54d24ef8b75c2c5c2
SHA1 28a5d8215a96888b54983a9df4e31e660b77e8b5
SHA512 51d2cf105c3b08023b18303d4707751f5a04efa23852571152a6cc2c97bc4ea72856433ec61b4864a2120d48197f9f50a230ce3b060bc11d2d23fa111ac81b5c
TLSH
T1E711480327F90618F5FBAB58EAF854356B797C85583CC54D51D1060E44FAE80C836BBB
MD5 SHA1 SHA512 TLSH

Submit Download

CertificationPage.ini

Path C:\Users\Admin\AppData\Local\Temp\nsa7760.tmp\CertificationPage.ini
Size 986B
SHA256 32cf99064a6f6d667285d7c507738e722eee0ad8dd3d1b31cdc273d346641d90
MD5 6427eede99a1e93bbc8b301caa5b4ebf
SHA1 41f39512ae708eee8bbf2d04046e7cb70780cad6
SHA512 3c75ad0ea18e42fed85a84ebf2a4e3a1bb3959f3ceb03eb22213455be2f7aa398ff0bf59577eff3ae9d767bb88d142b9e800d920811017ccdb0c24854d7b78ae
TLSH
T19C11880327F90618F0FBAB18EAF850316B787C81583CC54D51D1060E44FAE80C832BBB
MD5 SHA1 SHA512 TLSH

Submit Download

CertificationPage.ini

Path C:\Users\Admin\AppData\Local\Temp\nsa7760.tmp\CertificationPage.ini
Size 986B
SHA256 bebdebe0997dae66e78d01d09fecb1166cb3e8af3c241f424ea9615be2bdcf58
MD5 ae0798bd5f288d7577621f94370115e1
SHA1 ea4dd7e72ababa36357394cb698b1711f7aa73cd
SHA512 ca8964dc26e41f8f6de35b62e70b9d95774eae8724f7d8bf167b3e469683f7f22e94ab999fa63aab202b6549aa9d6b93c59a1fd41a8525b695c4af840955976d
TLSH
T14611880327F90608F0FBAB18EAF454316B78BC81583CC94D51D1060E44FAE80C832BBB
MD5 SHA1 SHA512 TLSH

Submit Download

InstallOptions.dll

Path C:\Users\Admin\AppData\Local\Temp\nsa7760.tmp\InstallOptions.dll
Size 15KB
SHA256 44b1d70219f88564d94da9fc8a7ca4d25d103575519c84a44df3057b8af98f71
MD5 cfc7c53e282b0a7c527e4ed091f17fcd
SHA1 3f3fb2dfaa9a0576803c5fd693f5c4c288ae4f1e
SHA512 367fc4024397381cfc5fa83b303d5eb78e97904821260589ce81a51c3cbe5d7f5dd0bf7fa07142bcb13a91bce2b523de21cbb1d940cb7fdfeca35c54c67694f6
SSDEEP 192:EhGQtZkTktEQUrJaZfuyCnSmUsv3sY7L7cW8Y6Q86QvoTmT11929WtshLAzgSrX8:EhNt+4t7uJalUnGesY7Lt8nCy/Yosa
TLSH
T162624D1137D598B3E2E62A797EF377138FA5F722A4428E0BC7332E0638565806D78311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NpcapPage.ini

Path C:\Users\Admin\AppData\Local\Temp\nsa7760.tmp\NpcapPage.ini
Size 2KB
SHA256 dc09f9762c4f073df6f7db7507858a6abd7afa40150ee8eb7436ad20c0fbf65c
MD5 ec4b9f4fb4bfe56199f651aaa250a5eb
SHA1 a03fb7d851e46f8902d637ba5967cc9c94a93c97
SHA512 be2dd56f1b9d852a145e6d357f9e4b8ff4dbf44d7daab41f502acd502d1905cf79bcf20cab90fb70609c6e124b63c23c30ede5771d2dcc7785950b9b1244a7b1
TLSH
T1625157533AF90528F5BBA64CEBF480359B393845583CC50D91D10A0E48FAA8189A7BEB
MD5 SHA1 SHA512 TLSH

Submit Download

NpcapPage.ini

Path C:\Users\Admin\AppData\Local\Temp\nsa7760.tmp\NpcapPage.ini
Size 2KB
SHA256 adc608caf7a1bc2d377426b19e5767e77b582bb2ee870b4ffd0c3176df4adf3b
MD5 7ada613f83076d7f742254add99a6a61
SHA1 f63518c731376b0634651878e8762333b92a7087
SHA512 62195556ccc38c01df6144a278a09aa48480b07e107e02b62bbc1bb13fd804181cb334ac284795b79bfd790ef62988f59b5359636289ba93cec693f5ac9ecc2f
TLSH
T15B516C533EF90428F1FBB64CEBF4803597393845583CC51D91D10A0E48F6A8189A7BEB
MD5 SHA1 SHA512 TLSH

Submit Download

NpcapPage.ini

Path C:\Users\Admin\AppData\Local\Temp\nsa7760.tmp\NpcapPage.ini
Size 2KB
SHA256 0b338c78349ac80baa4388ca693e7ca3b032220c79954157451dca9d11ebfe23
MD5 2dcc10bbaf70a5f400d65b93a67c7eec
SHA1 8476997db8c02cd6b33afdbc021f45e8f4aeea66
SHA512 4ff8eb13e512cd5fa14e642c62ae8bd030198ee60173edd4f8b9e3ba5dcfa431a7afaeb6ba65437bdb0f522e1b605a534d6af0dc9021bdc41d075d49a4d2bd75
TLSH
T19B516C533EF90428F1FBB64CEBF4803597393845583CC51D91D10A0E48F6A8189A7BEB
MD5 SHA1 SHA512 TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsa7760.tmp\System.dll
Size 12KB
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
TLSH
T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

USBPcapPage.ini

Path C:\Users\Admin\AppData\Local\Temp\nsa7760.tmp\USBPcapPage.ini
Size 2KB
SHA256 39d6b788976ef65875acf9e7cab5ceddfb3753cf2efe3ece00f2334b639cee2c
MD5 30082ee9ab0d282ac9470ac1bb334194
SHA1 77cf7fe8971ac7f4f2e131aafcc692fd76a08633
SHA512 c801e447fdce294fd1d65e0abd114defdadc4e0522bcae435e73fac19f9b1fbbb4d7743188f4fb5392318fe98c7aad59ce30e7d413daa1260d13c58936aed2b0
TLSH
T1A851CF033EF94114E1BBBA4CFBF5407587393846582DC91D90E10A0E99F6A81C97BBEB
MD5 SHA1 SHA512 TLSH

Submit Download

USBPcapPage.ini

Path C:\Users\Admin\AppData\Local\Temp\nsa7760.tmp\USBPcapPage.ini
Size 2KB
SHA256 6721a3fb9ec914fa84836174b6eb46f1c55900cd88215f143130f963ee0461f7
MD5 1b17d0a40d7b668c24feae8ad3622e73
SHA1 67dfda486edfd11cd4d53eb3649f4c648a0f5bda
SHA512 109933cd07d532c406b85d0172c6a7d45741384b10f71911deab8cc2f003dd313e77b42e17f6d5066d3707900bcef5b9f1c211a9a23e59d743eb47d4d74939b1
TLSH
T106416D433EF84114F1BABA0CEBF580719B3979465C2DC91D81E10A0E59F6B81857BBEB
MD5 SHA1 SHA512 TLSH

Submit Download

USBPcapPage.ini

Path C:\Users\Admin\AppData\Local\Temp\nsa7760.tmp\USBPcapPage.ini
Size 2KB
SHA256 f7d0d8a9cfbc31f3ca42bff48eb0e69b50580dda2f2428deca47eda7eb6e7b22
MD5 5b3062330aa1446add4b331ff6e34ebb
SHA1 6d815e1ac112b9b4fb5082a2fe8dd76dc61abe37
SHA512 a8977f782de2c8a8a849f21dc342c12a92a4cf066a5246ec90fc9e1039be45f3b0e4c645d4dba04d66791f44350111b03ef23c8e8be61381253f2e18e2eb366d
TLSH
T1F251CF033EF94114E1BBBA4CFBF5407587393846582DC91D90E10A0E99F6A81C97BBEB
MD5 SHA1 SHA512 TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsa7760.tmp\modern-wizard.bmp
Size 25KB
SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
TLSH
T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsa7760.tmp\nsDialogs.dll
Size 9KB
SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
MD5 8f0e7415f33843431df308bb8e06af81
SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
TLSH
T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Wireshark-4.6.6-x64.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\Wireshark-4.6.6-x64.exe:Zone.Identifier
Size 249B
SHA256 a302c288f5d2403936b04c802396b51a42d0aa6f1036c479d1296385f2f48c5b
MD5 366c7e8b83ac8db34405b1eda881cdc7
SHA1 29a8b98cc7e02933ab9e4b1ef1779a89e3a78bf9
SHA512 ae1831f18ee45fe56d4e5da1e6e234086fbf3455569749af102f1b69f033915bf91b78a03a2507a54da0aac1b3f7719507a97b2bab1a128b49f131c8c94aabe4
TLSH
T1FBD02EA33D80622A090E2DC0633AD838A16A12C898F900A8EE5020EDE4C0020C0E06BA
MD5 SHA1 SHA512 TLSH

Submit Download

SETB377.tmp

Path C:\Windows\System32\DriverStore\Temp\{a872cd9f-030f-4843-80ac-35de259048fd}\SETB377.tmp
Size 12KB
SHA256 e71aee891d5374c9edcfd429445d687e0fd56832ff8681e6ab975e2bd767607b
MD5 0df964d5b0e957bcfd5ed365e6a0cf76
SHA1 36a3a7e8107161a16cdee8e275cfe3aeea1f449d
SHA512 9e552f7b5b8a36460718d473a54b5881bba2117d4ab85d9fbf1c3683454f7a5c13c7f6c694698e461a5431533d5aadc25678be04e0ba943cd300ec6c7d63ad62
SSDEEP 192:vfkglYOcpcgJCc2PXWEwGJhYCMz5j4HsX01k9z3Aif2R:+n2P3h36R9zx2R
TLSH
T1044208B551984082F9A7AC2003E4F45B7C7E37CB985041AA66EFE71E0C637C9FB6816D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SETB388.tmp

Path C:\Windows\System32\DriverStore\Temp\{a872cd9f-030f-4843-80ac-35de259048fd}\SETB388.tmp
Size 8KB
SHA256 5c3b9d1242d66e1b0ed94beb11ff4842057ab806bfc044e0d587f8338c13a00d
MD5 75928d545662d93ca07fede2783a4766
SHA1 83dcd217ebbb658f5868b0f2a2e1e263f344cfcf
SHA512 d3a0564577a06993c9324efb435101707beb4a478635ea1676b0a67f9c9428a4d9763ab4bbc357e74c4a80840bc88406e0541fb65198ca051f83f2b3aca69b63
SSDEEP 192:l3ZH71HTe4BMNaoyOpW0O3lv5YMN7YyOpW0O3lU7Gb2L9dpnG5YV0q/4vOOgS:jJTe4BMN3yOXO3lv5YMNsyOXO3lU7E2M
TLSH
T1FC02850A9C826B1011F2C292F7417842D53DB2D2AACF0148728ED695A71FD8CF63DE7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SETB399.tmp

Path C:\Windows\System32\DriverStore\Temp\{a872cd9f-030f-4843-80ac-35de259048fd}\SETB399.tmp
Size 80KB
SHA256 13d598e277e9c7bf43688d7087ef9b944e8036561a1e7169d31d9ec1d38f9a01
MD5 741276512ad6ce0a4e9d72c797c1316a
SHA1 13233a3c28c3561025dc60c27b1c6f8526306367
SHA512 1372a323c0a0fb395f514845cce3d59588d035a7edefab5af6b07b59fadf00a25ba58f8917a17b79ad2eed20b13b0669b4e5222a09758c80f06058b2fecae581
SSDEEP 1536:tY9LKF7XQVyw//0bu6pFGMLgQPSFlK9/s5Fks7/aS7ozh:taWQow3K1cFl6/s5FksDagoN
TLSH
T1E0839ED262F458E5E56BC674D2E18A0BEFB1B58227219BCF0260C56C1F237D1AE3D319
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vc_redist.x64.exe

Path C:\Windows\Temp\{8D38D3E3-5B80-4914-901C-6B491F82D8D6}\.cr\vc_redist.x64.exe
Size 670KB
SHA256 568c9ba533624084ea18f7a562b4aa2249ed4e41281524a061a0d0b1008cf6bd
MD5 bc9c8a6a42e8d3ea18f8da78d5031820
SHA1 07812a4b945364d04627363e46ab38de188281b3
SHA512 b583f41b8f9cbb2b04e4c7403b54241bf4c51caefdb0bbe9184202dc615f599b496d65f6d36984b75f9b9003289c0c13066dc1e6eb294f9139248595114b4f73
SSDEEP 12288:n3mgqnIZuYfCYqFet4CovkM7x61nE4rfDDIcbMZ3Mya:n3WnIZuMCxezot7MhbfDBMZ8ya
TLSH
T10DE49E32A5604033F7F10573B928A6303E7CE3282B51C9A9D7D4AD1D7EB4892A7F7256
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logo.png

Path C:\Windows\Temp\{EC65C643-5137-4273-8AA1-C4E309A22D19}\.ba\logo.png
Size 1KB
SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
MD5 d6bd210f227442b3362493d046cea233
SHA1 ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
SHA512 464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
TLSH
T1CF312CF34748B7A7D30581351471819AD242FFD8F9CE291E35CD5307664018115C75CF
MD5 SHA1 SHA512 TLSH

Submit Download

wixstdba.dll

Path C:\Windows\Temp\{EC65C643-5137-4273-8AA1-C4E309A22D19}\.ba\wixstdba.dll
Size 215KB
SHA256 e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
MD5 f68f43f809840328f4e993a54b0d5e62
SHA1 01da48ce6c81df4835b4c2eca7e1d447be893d39
SHA512 a7a799ecf1784fb5e8cd7191bf78b510ff5b07db07363388d7b32ed21f4fddc09e34d1160113395f728c0f4e57d13768a0350dbdb207d9224337d2153dc791e1
SSDEEP 6144:K6EZdi6e93SuDeTKZxQfsRy26BqbUHYJe:K62i6eNSYeuZ2sRDK
TLSH
T15E24AF12B5D0907AEBFB19305939E5216DBDBA210FA0C9CE5348AD2B2E705C1DB36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cab2C04DDC374BD96EB5C8EB8208F2C7C92

Path C:\Windows\Temp\{EC65C643-5137-4273-8AA1-C4E309A22D19}\cab2C04DDC374BD96EB5C8EB8208F2C7C92
Size 5.4MB
SHA256 7dee5b77719fb6a6627145357c5a93bf8af2a9de54d34c79ffc1ae71d52c79f5
MD5 ea81447ef1038bd5726b36063896b39a
SHA1 8f484a24bfe42276580d120c200a99bf604eea70
SHA512 31fe32db60d9a0579374ce3a51b586ef0fa7b891aebcd33613a818264bb9eeccba4f2b5ac4b95feca144d4be6146e99d9f5dfa7bfa5e11cfae46e06b41da251f
SSDEEP 98304:JnfKe/OhMAf7WUHioDNe/rdRlRFQdU8o2VDF/ZXZsHOtnF9r:hPAzWxZgU85VDbXZs+z
TLSH
T17D4633018111941B63BB250753FCF1518FF2F087A4B672BA3BD2934E4AE78CF59EA51A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cab5046A8AB272BF37297BB7928664C9503

Path C:\Windows\Temp\{EC65C643-5137-4273-8AA1-C4E309A22D19}\cab5046A8AB272BF37297BB7928664C9503
Size 964KB
SHA256 640aa6c516c72444523b8fbe034db46ff4e118ed02705340e3ccb62d426ff040
MD5 efc41c00aadf8b2050ecf9e38e9036f1
SHA1 bc4afc5cb90411f0e4e874372f1fbabab0cfd33d
SHA512 bc9cc1e83acc8dbe53501ca4554dec6d31cb0ccd3609d0e760c7fdbf73fbc4c46baf14c397667eaeced284506d0a9a0bdf7777736f05ae277e9e2f3349371136
SSDEEP 24576:+e9fUQD6DozFBvW8lRBAaKycdSCTbiVTPf1eg++4:+exUQX/e8lzAjdZTbiVTnw
TLSH
T15625338685244AC1694EEC06B346F9BF74D331FD59B5B8032A262EC8E3D33857593937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcRuntimeAdditional_x64

Path C:\Windows\Temp\{EC65C643-5137-4273-8AA1-C4E309A22D19}\vcRuntimeAdditional_x64
Size 208KB
SHA256 7df26ee2169ef6c61c17675e1a2edbaf01bca2ed1a0bdc0f8396d029a336c1f7
MD5 f375f3d81a661e188146d701d8ed3ba9
SHA1 0851e6da56fa65981ae27d9eb7e396afe1ea0c73
SHA512 d67709e2f25ad12532ed33d26c0ae365b7a4eb0e6711b2ee7dda489480b9976b4bbfd0b902cbb847cb602922a1653a2981741718fdec4091ae25f07fe5b8bf2a
SSDEEP 3072:F9laht5Xel69YGnfxC2WB/bEPcefrKROjibDPxriT6qF:/laZeKFxCnBheIdlu2q
TLSH
T19E24AE12B5808033DAFE1A311178DB615F3D7E608F544A9B6364B6AD1E717C08F3AAB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcRuntimeMinimum_x64

Path C:\Windows\Temp\{EC65C643-5137-4273-8AA1-C4E309A22D19}\vcRuntimeMinimum_x64
Size 208KB
SHA256 fe5af8f2efc9bbdd2c23f22f2d3daf480a4047acf3b1edc6ecda81147c1ec14f
MD5 23626831f9a05572c6ebd133e5ffc4b0
SHA1 ad044cdf938a5532aa270c6bc687db95d803fe10
SHA512 1b45ea55e7278ec61f0689b70794f371d56eb2787c22106ebec38d17f1670441a853849460249d08380053bc8b2fae0285845b47ad62670029639d5de5ace10c
SSDEEP 3072:o9laht5Xel69YGnfxC2WB/bEPcefrKROjibDPxriTA:+laZeKFxCnBheIdlu
TLSH
T1A3249E12B5808033DAFE1A311578DB615F3D7E608F54899B6364B6AC1E717C08F3AAB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

license.rtf

Path C:\Windows\Temp\{ED0736AF-4C16-4121-A5D9-3BDF0A5CD7BB}\.ba\license.rtf
Size 9KB
SHA256 8099dc3cf9502c335da829e5c755948a12e3e6de490eb492a99deb673d883d8b
MD5 04b33f0a9081c10e85d0e495a1294f83
SHA1 1efe2fb2d014a731b752672745f9ffecdd716412
SHA512 d1dbed00df921169dd61501e2a3e95e6d7807348b188be9dd8fc63423501e4d848ece19ac466c3cacfccc6084e0eb2f457dc957990f6f511df10fd426e432685
SSDEEP 192:H8kZ1UVDWkiWZTIsp/4hghFF1Qf4lCfnEtHixEGx736wHqItfSpOtJ32:cM1RWZMi/zzlOnjt5HLoa2
TLSH
T13F12A7A8234783D103D213D7055294C1B71F0BF6AE7AF95C34E4D53826E2E6CB6B91E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{ED0736AF-4C16-4121-A5D9-3BDF0A5CD7BB}\.ba\thm.wxl
Size 2KB
SHA256 70400f181d00e1769774ff36bcd8b1ab5fbc431418067d31b876d18cc04ef4ce
MD5 fbfcbc4dacc566a3c426f43ce10907b6
SHA1 63c45f9a771161740e100faf710f30eed017d723
SHA512 063fb6685ee8d2fa57863a74d66a83c819fe848ba3072b6e7d1b4fe397a9b24a1037183bb2fda776033c0936be83888a6456aae947e240521e2ab75d984ee35e
TLSH
T11F519B6778CF639028335125EAD2966A6920C5DC923F2DF1FC4A914B838D522A373F57
MD5 SHA1 SHA512 TLSH

Submit Download

thm.xml

Path C:\Windows\Temp\{ED0736AF-4C16-4121-A5D9-3BDF0A5CD7BB}\.ba\thm.xml
Size 8KB
SHA256 f13bae0ec08c91b4a315bb2d86ee48fade597e7a5440dce6f751f98a3a4d6916
MD5 f62729c6d2540015e072514226c121c7
SHA1 c1e189d693f41ac2eafcc363f7890fc0fea6979c
SHA512 cbbfbfa7e013a2b85b78d71d32fdf65323534816978e7544ca6cea5286a0f6e8e7e5ffc4c538200211f11b94373d5658732d5d8aa1d01f9ccfdbf20f154f1471
SSDEEP 96:8L2HdQG+3VzHfz96zYFGaPSWXdhRAmImlqFQKFBiUxn7Ke5A82rkO/pWk3nswP:ZHAzZ/3
TLSH
T1D30259B546DDB801D232FB1166E231D27F126971C0C46E59F90C2AFB5FE1140A8B72BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixstdba.dll

Path C:\Windows\Temp\{ED0736AF-4C16-4121-A5D9-3BDF0A5CD7BB}\.ba\wixstdba.dll
Size 191KB
SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
MD5 eab9caf4277829abdf6223ec1efa0edd
SHA1 74862ecf349a9bedd32699f2a7a4e00b4727543d
SHA512 45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2
SSDEEP 3072:OXoiFK6b0k77I+QfaIl191rSJHvlalB+8BHkY6v53EfcUzN0m6I+WxBlnKzeZuqt:OXoQNb++gDrSJdr8BHkPh3wIgnK/IU1a
TLSH
T103149E11B5D0907AE7FB1A385938B5216D7FBA201B60C99E17589D6F2DF02C0AF35B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/464-1901-0x0000000006B50000-0x0000000006B9C000-memory.dmp

Download

memory/464-1899-0x0000000006350000-0x00000000066A7000-memory.dmp

Download

memory/1236-1035-0x0000000000DF0000-0x0000000000E67000-memory.dmp

Download

memory/1620-1034-0x0000000000DF0000-0x0000000000E67000-memory.dmp

Download

memory/2972-1032-0x0000000000DF0000-0x0000000000E67000-memory.dmp

Download

memory/3352-1385-0x000001F13DA60000-0x000001F13E522000-memory.dmp

Download

memory/4136-1688-0x0000000007760000-0x0000000007D06000-memory.dmp

Download

memory/4136-1682-0x0000000005C40000-0x0000000005F97000-memory.dmp

Download

memory/4136-1673-0x00000000059C0000-0x00000000059E2000-memory.dmp

Download

memory/4136-1672-0x0000000005390000-0x00000000059BA000-memory.dmp

Download

memory/4136-1671-0x0000000004C80000-0x0000000004CB6000-memory.dmp

Download

memory/4136-1674-0x0000000005B60000-0x0000000005BC6000-memory.dmp

Download

memory/4136-1690-0x0000000007560000-0x000000000759D000-memory.dmp

Download

memory/4136-1689-0x0000000008390000-0x0000000008A0A000-memory.dmp

Download

memory/4136-1683-0x0000000006120000-0x000000000613E000-memory.dmp

Download

memory/4136-1675-0x0000000005BD0000-0x0000000005C36000-memory.dmp

Download

memory/4136-1687-0x0000000006670000-0x0000000006692000-memory.dmp

Download

memory/4136-1686-0x00000000065F0000-0x000000000660A000-memory.dmp

Download

memory/4136-1685-0x0000000007110000-0x00000000071A6000-memory.dmp

Download

memory/4136-1684-0x0000000006150000-0x000000000619C000-memory.dmp

Download

memory/4976-1912-0x0000000007240000-0x0000000007274000-memory.dmp

Download

memory/6700-4316-0x00007FF992140000-0x00007FF992787000-memory.dmp

Download

memory/6700-4317-0x00007FF6CED30000-0x00007FF6CFF04000-memory.dmp

Download