5b66855b96edf996d990c343867829bc6e81a401c94d91d6083f858a06a81d66

Analysis

user interaction
yes
max time kernel
26s
max time network
116s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 22:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Voidstrap.exe
Size 31.8MB
Sample260701-2spapsfw3p
SHA256 5b66855b96edf996d990c343867829bc6e81a401c94d91d6083f858a06a81d66
MD5 55c32fe519d5ec6236b72c1f62b16821
SHA1 424d3b5aec15d368ec1c1d3ebf48de5797675177
SHA512 7f348ef7e4ba8357b88c3a83db80aa4cfad2d3dc9a60eba3f9e3ad4b35b70500b51ace4a0aed5fbcbfa498ed40740e1ffe99a9b4226ebc8058246936d88ef0f6
SSDEEP 196608:noo90CFHS3hVvAkCPIqpM8R4ripPK5kWObAbN03qDtIsL7s32vrbObyUIBsPVs:H90CIfoINs4SmtIAO3AIsL7s3GbObw
TLSH
T11D778C0AA3D88621D37B877986765206D672BC266311D7CF268CFA4D1F737C1C9B2623
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence ransomware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
64	5904	msedge.exe

Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
86	raw.githubusercontent.com
177	camo.githubusercontent.com
178	camo.githubusercontent.com
183	camo.githubusercontent.com
217	raw.githubusercontent.com
235	raw.githubusercontent.com

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5904	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134274198899772515"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2639994890-966400312-4246138405-1000\{AD9CF560-70BC-41BC-8931-914CBB38CAC0}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe

Suspicious use of FindShellTrayWindow 9 IoCs

pid	Process
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 1180	2988	Voidstrap.exe	88
PID 1180 wrote to memory of 5232	1180	msedge.exe	89
PID 1180 wrote to memory of 5904	1180	msedge.exe	90
PID 1180 wrote to memory of 5508	1180	msedge.exe	92
PID 1180 wrote to memory of 5508	1180	msedge.exe	92
PID 1180 wrote to memory of 5544	1180	msedge.exe	91
PID 1180 wrote to memory of 5544	1180	msedge.exe	91
PID 1180 wrote to memory of 5544	1180	msedge.exe	91
PID 1180 wrote to memory of 1120	1180	msedge.exe	94
PID 1180 wrote to memory of 1120	1180	msedge.exe	94
PID 1180 wrote to memory of 1120	1180	msedge.exe	94
PID 1180 wrote to memory of 3780	1180	msedge.exe	95
PID 1180 wrote to memory of 3780	1180	msedge.exe	95
PID 1180 wrote to memory of 3780	1180	msedge.exe	95
PID 1180 wrote to memory of 3096	1180	msedge.exe	96
PID 1180 wrote to memory of 2612	1180	msedge.exe	97
PID 1180 wrote to memory of 3096	1180	msedge.exe	96
PID 1180 wrote to memory of 3096	1180	msedge.exe	96
PID 1180 wrote to memory of 2612	1180	msedge.exe	97
PID 1180 wrote to memory of 2612	1180	msedge.exe	97
PID 1180 wrote to memory of 3916	1180	msedge.exe	98
PID 1180 wrote to memory of 3916	1180	msedge.exe	98
PID 1180 wrote to memory of 3680	1180	msedge.exe	100
PID 1180 wrote to memory of 3680	1180	msedge.exe	100
PID 1180 wrote to memory of 3680	1180	msedge.exe	100
PID 1180 wrote to memory of 2800	1180	msedge.exe	101
PID 1180 wrote to memory of 2800	1180	msedge.exe	101
PID 1180 wrote to memory of 4652	1180	msedge.exe	102
PID 1180 wrote to memory of 4652	1180	msedge.exe	102
PID 1180 wrote to memory of 2616	1180	msedge.exe	104
PID 1180 wrote to memory of 2056	1180	msedge.exe	105
PID 1180 wrote to memory of 2056	1180	msedge.exe	105
PID 1180 wrote to memory of 5652	1180	msedge.exe	106
PID 1180 wrote to memory of 5652	1180	msedge.exe	106
PID 1180 wrote to memory of 3268	1180	msedge.exe	107
PID 1180 wrote to memory of 3268	1180	msedge.exe	107
PID 1180 wrote to memory of 3268	1180	msedge.exe	107
PID 1180 wrote to memory of 2676	1180	msedge.exe	110

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\Voidstrap.exe
"C:\Users\Admin\AppData\Local\Temp\Voidstrap.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.NETCore.App&framework_version=10.0.0&arch=x64&rid=win-x64&os=win10&gui=true
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x314,0x7fff1952c188,0x7fff1952c194,0x7fff1952c1a0
    3⤵
    PID:5232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1892,i,9377863943786245676,3443292100579191128,524288 --field-trial-handle=2256,i,16876271251915655590,16450363794100031367,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:11
    3⤵
    - Downloads MZ/PE file
    - System Time Discovery
    PID:5904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1580,i,6047175089198652164,13440329153087514395,262144 --field-trial-handle=2256,i,16876271251915655590,16450363794100031367,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:2
    3⤵
    PID:5544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2532,i,13039496195699460627,13903130226121709825,524288 --field-trial-handle=2256,i,16876271251915655590,16450363794100031367,262144 --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:13
    3⤵
    PID:5508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3524,i,7800428899075712330,8433074662545599482,2097152 --field-trial-handle=2256,i,16876271251915655590,16450363794100031367,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
    3⤵
    PID:1120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3528,i,5657839741609483056,16904917519319866394,2097152 --field-trial-handle=2256,i,16876271251915655590,16450363794100031367,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
    3⤵
    PID:3780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4144,i,11666160141488474489,15453015154953797002,2097152 --field-trial-handle=2256,i,16876271251915655590,16450363794100031367,262144 --variations-seed-version --mojo-platform-channel-handle=4704 /prefetch:1
    3⤵
    PID:3096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4192,i,6052952892508713396,5347769266665533933,2097152 --field-trial-handle=2256,i,16876271251915655590,16450363794100031367,262144 --variations-seed-version --mojo-platform-channel-handle=4708 /prefetch:9
    3⤵
    PID:2612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5176,i,10840440009611627535,6937983779113528849,524288 --field-trial-handle=2256,i,16876271251915655590,16450363794100031367,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:14
    3⤵
    PID:3916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5272,i,12793815862175536036,2424935288579295034,2097152 --field-trial-handle=2256,i,16876271251915655590,16450363794100031367,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:1
    3⤵
    PID:3680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3824,i,10316555748860961325,16024434453030650975,524288 --field-trial-handle=2256,i,16876271251915655590,16450363794100031367,262144 --variations-seed-version --mojo-platform-channel-handle=3764 /prefetch:14
    3⤵
    PID:2800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3636,i,7904005667605349998,3473454779642188780,524288 --field-trial-handle=2256,i,16876271251915655590,16450363794100031367,262144 --variations-seed-version --mojo-platform-channel-handle=3820 /prefetch:14
    3⤵
    PID:4652
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,6149439532553902248,15671081014863192144,524288 --field-trial-handle=2256,i,16876271251915655590,16450363794100031367,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:14
    3⤵
    PID:2252
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,6149439532553902248,15671081014863192144,524288 --field-trial-handle=2256,i,16876271251915655590,16450363794100031367,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:14
    3⤵
    PID:2616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6508,i,5646726909008903816,11737804114955384171,524288 --field-trial-handle=2256,i,16876271251915655590,16450363794100031367,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:14
    3⤵
    PID:2056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6780,i,1201490822488379432,1121438453284577564,524288 --field-trial-handle=2256,i,16876271251915655590,16450363794100031367,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:14
    3⤵
    PID:5652
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6632,i,17283228673732166399,11344688206876379773,2097152 --field-trial-handle=2256,i,16876271251915655590,16450363794100031367,262144 --variations-seed-version --mojo-platform-channel-handle=6884 /prefetch:1
    3⤵
    PID:3268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7580,i,943040492124876704,17829719520972583070,524288 --field-trial-handle=2256,i,16876271251915655590,16450363794100031367,262144 --variations-seed-version --mojo-platform-channel-handle=7576 /prefetch:14
    3⤵
    PID:2676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7400,i,6525070403921127496,13371411946619534076,524288 --field-trial-handle=2256,i,16876271251915655590,16450363794100031367,262144 --variations-seed-version --mojo-platform-channel-handle=7384 /prefetch:14
    3⤵
    PID:1956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5404,i,7514469042079827731,10944394077502436744,2097152 --field-trial-handle=2256,i,16876271251915655590,16450363794100031367,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:1
    3⤵
    PID:2968
- - C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.9-win-x64.exe
    "C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.9-win-x64.exe"
    3⤵
    PID:5680
  - - C:\Windows\TEMP\{40C582CD-575C-4645-81D3-0AF86EFE7574}\.ba\wixstdba.exe
      "C:\Windows\TEMP\{40C582CD-575C-4645-81D3-0AF86EFE7574}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{642C73FE-2205-45DD-BDE0-298B9438C59E} {FB7AEEDD-99A1-4BBF-8DBC-2EC6FEF481CB}
      4⤵
      PID:1352
  - - C:\Windows\TEMP\{40C582CD-575C-4645-81D3-0AF86EFE7574}\.be\windowsdesktop-runtime-10.0.9-win-x64.exe
      "C:\Windows\TEMP\{40C582CD-575C-4645-81D3-0AF86EFE7574}\.be\windowsdesktop-runtime-10.0.9-win-x64.exe" -q -burn.elevated BurnPipe.{9A8DBB6A-5FEE-43FE-AC53-8AA146001395} {E6D8BBBB-5302-49BC-BCC1-BDAA3C916DFA} 5680
      4⤵
      PID:1952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=4728,i,9384219508188645031,2845372334662995410,2097152 --field-trial-handle=2256,i,16876271251915655590,16450363794100031367,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:1
    3⤵
    PID:2056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7812,i,13911850890585112400,17206497780272296653,2097152 --field-trial-handle=2256,i,16876271251915655590,16450363794100031367,262144 --variations-seed-version --mojo-platform-channel-handle=7732 /prefetch:1
    3⤵
    PID:1500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7712,i,17518234960585978206,16909794486177565970,2097152 --field-trial-handle=2256,i,16876271251915655590,16450363794100031367,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:1
    3⤵
    PID:904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7608,i,742064660870949016,17658869896311876498,2097152 --field-trial-handle=2256,i,16876271251915655590,16450363794100031367,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:1
    3⤵
    PID:4976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7532,i,17372005492454539770,3910622315147958428,2097152 --field-trial-handle=2256,i,16876271251915655590,16450363794100031367,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:1
    3⤵
    PID:2512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,12813354363724307426,12249005523108369318,524288 --field-trial-handle=2256,i,16876271251915655590,16450363794100031367,262144 --variations-seed-version --mojo-platform-channel-handle=7396 /prefetch:14
    3⤵
    PID:1388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5168,i,12325781385410668281,6534592586347038098,524288 --field-trial-handle=2256,i,16876271251915655590,16450363794100031367,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:14
    3⤵
    PID:1748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6236,i,9557641797822807128,17769543374878081891,524288 --field-trial-handle=2256,i,16876271251915655590,16450363794100031367,262144 --variations-seed-version --mojo-platform-channel-handle=8048 /prefetch:14
    3⤵
    PID:4972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=3604,i,735857632013346319,14829389700044657448,2097152 --field-trial-handle=2256,i,16876271251915655590,16450363794100031367,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:1
    3⤵
    PID:5564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3832,i,15593506904132372318,10410304923044440544,524288 --field-trial-handle=2256,i,16876271251915655590,16450363794100031367,262144 --variations-seed-version --mojo-platform-channel-handle=7632 /prefetch:14
    3⤵
    PID:5964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7356,i,6470189318627889870,10593926728296015608,524288 --field-trial-handle=2256,i,16876271251915655590,16450363794100031367,262144 --variations-seed-version --mojo-platform-channel-handle=7408 /prefetch:14
    3⤵
    PID:1132
- - C:\Users\Admin\Downloads\Voidstrap.exe
    "C:\Users\Admin\Downloads\Voidstrap.exe"
    3⤵
    PID:3040
- - C:\Users\Admin\Downloads\Voidstrap.exe
    "C:\Users\Admin\Downloads\Voidstrap.exe"
    3⤵
    PID:4772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6780,i,10267861807685616895,14838416490090300308,524288 --field-trial-handle=2256,i,16876271251915655590,16450363794100031367,262144 --variations-seed-version --mojo-platform-channel-handle=6876 /prefetch:14
    3⤵
    PID:6984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7652,i,4577629722575245968,624779196440371422,524288 --field-trial-handle=2256,i,16876271251915655590,16450363794100031367,262144 --variations-seed-version --mojo-platform-channel-handle=7784 /prefetch:14
    3⤵
    PID:6516

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5208

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6064

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:1976
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding D73F4A717FC45C63B1F10C70A3834897
  2⤵
  PID:5520
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 12D7DECA8D2AEDEFA4C85D53181EB59C
  2⤵
  PID:2788
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 8709AE773A821D160DD4F59C4E03105F
  2⤵
  PID:2284
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding EFA962BAFE762BFEA47952A3A40DF5AA
  2⤵
  PID:2036
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 600CEFBBB726990F1942CC6ADC675EB7
  2⤵
  PID:6312
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 0D9B9F7943EFC1CA1459F6A64B266D28
  2⤵
  PID:6464

C:\ProgramData\Package Cache\{0B1257AA-9D34-46E7-B27B-07DF8CD5B92C}\windowsdesktop-runtime-10.0.9-win-x64.exe
"C:\ProgramData\Package Cache\{0B1257AA-9D34-46E7-B27B-07DF8CD5B92C}\windowsdesktop-runtime-10.0.9-win-x64.exe" /burn.runonce
1⤵
PID:3420
- C:\ProgramData\Package Cache\{0B1257AA-9D34-46E7-B27B-07DF8CD5B92C}\windowsdesktop-runtime-10.0.9-win-x64.exe
  "C:\ProgramData\Package Cache\{0B1257AA-9D34-46E7-B27B-07DF8CD5B92C}\windowsdesktop-runtime-10.0.9-win-x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.9_(x64)_20260701235141.log"
  2⤵
  PID:2696
- - C:\Windows\TEMP\{8EECF6AF-32BC-4C6E-A609-9781D3AA41AB}\.ba\wixstdba.exe
    "C:\Windows\TEMP\{8EECF6AF-32BC-4C6E-A609-9781D3AA41AB}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{F3734E7F-2441-4229-A04B-2263F40E7653} {DC73EA15-F82E-44C6-9819-EBD6B0562E97}
    3⤵
    PID:5068
- - C:\ProgramData\Package Cache\{0B1257AA-9D34-46E7-B27B-07DF8CD5B92C}\windowsdesktop-runtime-10.0.9-win-x64.exe
    "C:\ProgramData\Package Cache\{0B1257AA-9D34-46E7-B27B-07DF8CD5B92C}\windowsdesktop-runtime-10.0.9-win-x64.exe" -q -burn.elevated BurnPipe.{2F566265-063E-42A2-8543-E0D4F869A467} {1D3E7C38-33A0-4317-B5DD-65344C1784F0} 2696
    3⤵
    PID:6212

C:\Users\Admin\AppData\Local\Voidstrap\Voidstrap.exe
"C:\Users\Admin\AppData\Local\Voidstrap\Voidstrap.exe"
1⤵
PID:6576

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e594ce1.rbs

Path C:\Config.Msi\e594ce1.rbs
Size 11KB
SHA256 d0b0c8b5fce2a10eeb633a18322e8dacef83a031b57da8c55693e23b3d0080b9
MD5 3a5d0b291ae2e6aa21ffb894d8e3a30c
SHA1 1fdc24374edf98b8ba75e4fca898c0727442b8ec
SHA512 2406e8e9c0e077f1742d2611313737cc3233c85a595bff193880f9b3642acc6526f664a48e1b9392b5a6a702e4a15608398c563c6bc0f303a28d9eb9588eeea6
SSDEEP 192:ROLCfIQ2tH5HhYP9CqObUIYbUMcEKs9Cdeph:ROLCfIQ2tH5HWobYbkk
TLSH
T1623222456304C6D7F9D60734D3172F21B7B7E2E6E328124B00AD92359F0B3A52B6A6DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e594ce8.rbs

Path C:\Config.Msi\e594ce8.rbs
Size 9KB
SHA256 57938c87fc1753743976b183f91c0eb5ae88a9a6feb7d9ff237b313bca0f97a6
MD5 9fcd787965f4b7805cb4d8e2efa55ee3
SHA1 25d1d7b5de9defe948b7e9c3faae26b9ddba4ad3
SHA512 8208affc59dcb9fd222a78ece1f66ae5f911f5d6770bb4e98ddb7cb7f88ef9914264496aa88dc0499b47afc93beb5a15861b5f38510db6aa1ac63e857121f244
SSDEEP 96:GmfD1HZjALHrbcBCXbZ1UBeD2RhCsTlkUBeD2RhC6jI74UYsTlSY0j7E5Z7P/5L+:/rHjgL0CFOnUIdnUPe7E/nvSG2uepd
TLSH
T173122F41B60081E2F89F1B39E7577BA13BB7D297D380635F58ADA0708F4B7C84B94199
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e594ced.rbs

Path C:\Config.Msi\e594ced.rbs
Size 49KB
SHA256 8e9fe75b0200c0b141b70c3b2c54fdc7db8e74f275c63f955702a7c6ab2200f9
MD5 2a33be28e7741126ab69d27d6c3f8b9e
SHA1 fb58d6b05de5aab5a23ba51d9874447ae72ed490
SHA512 8cf6aaec63c505a70e4921b80b6fb2a0fe0f4d8c95c911ad9186fe8ad7d313a49b4bf648075445ffc56259badac28e8afdfbac474c4bebb8df86abc7bc94d9f7
SSDEEP 1536:t7EkxpNrxEFzaq0BfH8vjUbjvTyUk9ENNzdoKrCSZOnlFaMd2uuRHCoEzaKQKkDK:HUtVV
TLSH
T19433EE58FFC8D1D2FA363DB82761DE053345D9CB272058AD65CE429AAEC26C94EFC484
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e594cf2.rbs

Path C:\Config.Msi\e594cf2.rbs
Size 71KB
SHA256 af9ec0702441d63ba75fcc1c55fecd3b7ebf91c66d85dcb85b85eaa1b594c29c
MD5 5863ee98e7ee0360d358026ad574d74a
SHA1 f821ebe61a6172c28d82ad6e2044e188c19d4c0a
SHA512 5f7256ec99e2616dc1aff49277224163e602ec868e67f16d1c5631b65d4bbd31a60911416d96135741b275822e834f9c763c3b9d7f8f2aa764d066409c0d45d8
SSDEEP 1536:hCsJtY1z2XlYfypaocNCiOsh18/gd5n9GttC111v7eGHvoOfup2RmRcBi6hhuNWj:0X5vym+SeC6GWmiE/+k
TLSH
T19163E0961B00C2E1BC33AD5C1B6BF9C5FE068D96AB61896E02C85039DD925CF6F7C6C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e594cf6.rbs

Path C:\Config.Msi\e594cf6.rbs
Size 3KB
SHA256 11ef2f6c1b8e41086536352d904f2d2f2f90453475c5669e881e538647049c16
MD5 70828029c47333e2c0a60716af36635e
SHA1 9d582f2a91b1108f9f52128da32b0b5b89ed8fb9
SHA512 5cf205281da11b944c691b915635515858bd0ddd55ae227c7f419307e1a1075ad2f16be9aa1d148f1e0a5482a5b51d6645975b893471c28d311d2e4525d72100
TLSH
T1B671CD02EE40D2C3ECAA2F31CE170B5133B7D6EB9320434B058D91751E577C69EE918A
MD5 SHA1 SHA512 TLSH

Submit Download

e594cf9.rbs

Path C:\Config.Msi\e594cf9.rbs
Size 3KB
SHA256 5d9d2ba07248c80183592f599a7351cc2dc9154b941d51a770f4a9cf4350f7e8
MD5 0cc72d487b230918e578f655b0eff59d
SHA1 2972eeca9ad9be3ca4e340a598bbedcc7c5e7979
SHA512 f577a4381dfdd6fa2d3607c122bf42f69d28ef90b7ecae39d2cc58968cf57adac092e0bebb794d9455c62b0fc689965c6d4fc0274ccbdad4dc6314c19d65d236
TLSH
T15C819B43AB04D6C3ECB21F34CE571BA23777C6DA9725834704CC91750E877DAAEAA285
MD5 SHA1 SHA512 TLSH

Submit Download

ThirdPartyNotices.txt

Path C:\Program Files\dotnet\ThirdPartyNotices.txt
Size 77KB
SHA256 deb4427a295e1ed474b0d81c5a0d972c1b550b9a715cda939cdfa9236b1b418f
MD5 0d8867a25ba926e6e40cd52ab3536b5c
SHA1 89390dc8b8318d0bfef1c6a2fb4783537e28a465
SHA512 317ca335405274f4f91b173651ca2826760acb5ba5cf41aff51adc55c2cda9059fb268333665f13f62fa48119e55a303720a780dd58d28dd9967db4c88407d61
SSDEEP 1536:HA9jHwsGfgg39/zwgAVkguQxrDjugtSEGepkWvrpX7anuqdLSVnfiStPq+3LefrL:HA97w/ogz1AVxuMjHtSFULryLOgrGWm+
TLSH
T17773A45F7E45077319E2C3916569A8C5F22FA02E3B6B2A44346EF248133B42DD6FF858
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 163KB
SHA256 a5ccdc3a41d5e5c6014ff64509aed176db39f4f14caffff3dd1997f8907e94d7
MD5 b497651137eb819839df76f909340d9a
SHA1 549dbe63c781ee26d5ebd2ca8f605ce757b3dc21
SHA512 ed4e6f3556c08b832da992ec329610a0cd4671c51da49a81e1e08075036b46ae1951c5caff14789d5faafef84e88d467343ad400a0810522edadcc31141f18f2
SSDEEP 3072:UGgPzwruvTSBbQ/fp4SbDqIG/sk7l55wKGxvu:UGrrubgbQpDvqIwtQG
TLSH
T152F3F61AD65811AAD16E9575CB528941BB337C668BE0E3CB13C0F8BE0F726905EF9703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

state.rsm

Path C:\ProgramData\Package Cache\{0B1257AA-9D34-46E7-B27B-07DF8CD5B92C}\state.rsm
Size 1KB
SHA256 325a948d2f1f7757c2a8c8ad67bc6a91588d42ed0dd6aae2016471015840c8c0
MD5 84ca94a2a83e57d6980a407f7e039351
SHA1 7a94323e68f54be832a68422df0353f626e8b6b4
SHA512 e28f399a2465eb8ae1dfe7fb2035cf6b2fe5220911a2831071e0ad2fe3c94958878148adb2291ce62d5c64181f1b14d1a8d8b20c4b1014d268d07f1d64805d85
TLSH
T19F2181515BFA092DF3F6AB7569F96625543BBC161D24C26E0001318A9E72BD0C874B33
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 674d24008448b140a9b320032b4ed333cf5a592b073bf375c453c816d33c703b
MD5 b989ec4e221bd567659492bc1ad7ab3b
SHA1 372670805b3060960e77e6ba32a3b9edd0241cf0
SHA512 f6934e6a831bcac97110107a79389dae0e669b743e0d62e5b411c19471bf237f4d61c7cee27d9fcacbd7045cbe27e78b4e6c38f6e76ca789a7760295558b0bb3
TLSH
T1CBD0C0383E28F508C5402076E4504310E3238131742B8242B010F02DEC581810BDF0DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5e1a5fea1006889b9c3bcf0a470a6a4256d5300a4b7036038ddce5fd042c424c
MD5 e9af81b8f1175d007e2c699939cb3df6
SHA1 696178bffe86e4e363a26747d6a5cb80e28621ce
SHA512 38174d529846c50b0af9a056e65ca491645c3cbf1fb867ef22a3b7c7ee4287ba29c3a28d736bc2e9c562faa24bb671db3b9cc40507a467140e47eaa4aeae6d51
TLSH
T145D0C0343E38F408C540207AE4514310E3138131302B8242B010F03DEC581810BDE0CF
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 baa9ccca7ab5aa192d036d2d158a081676bdf53d25d1fc8b7a9773a520d61bee
MD5 59a956dea351019d748a4050f951311c
SHA1 6d1ccfdb63a178f9478ff1f026b43512d64be55e
SHA512 f0f34733f8cc62173eb78234a0bbf194453aec7d41aa070a4e00e012ac922ec01ed9adf056deb89e52d818ff425d94a06ecb22409f54bec9e63b9de82e78b13c
SSDEEP 192:mhBWyjn9ELjPLt+3BxhuNi0j6DykVoxqc/WO35zidL+xKvU:aWu9ELjLcBxwNi0WDykVoxqc/WO35zi2
TLSH
T12BF161A04BD7A2E8EBE784FC2CE51B433F300682DC07BF87234656398B4279B6D84456
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe59e5f1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59e5f1.TMP
Size 3KB
SHA256 14cc4a74a99bdb27863396d5baa85454360ba448db6a6f344438e16658791097
MD5 9c80e13b46c828aa476c92f0a73bff09
SHA1 2a9b271dec1246a698772e5f1bf84d910d3f9716
SHA512 0e080210a70b2a8cf953c69aec0860ea78614a3f2edb8a0a5283bfe96a80a6165a36b75b39f90228213b18cf0bb5e593e9ad430db409cbba486938c20d96ed07
TLSH
T12761963A2BEB8436CB27847015F39BA97372885265A76EB473DF637BC70532D51810D2
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 f023fc833895a94e78170b024e9d1437a01e90e5fd2f3792d32c634e446a4f4c
MD5 120e768b0ab4b33e09bd3887777c736f
SHA1 2381110d43f2d48b71975d6af1a2ccd47bce9ded
SHA512 f4e619efd4c8bc964359933b21f61909b422db65fd09561f9e1abdd834cce79c7e81479fe0e0ec1ea61fc924696346a2ae3985f5aeaad5262699f2638b85d50e
SSDEEP 192:DM5ldhMas0mi48aC15ej6VkKfbdzilG3075cWytD2IPvmrm9m/mLmDmt2Gmgmzk:DM5ldhMas0mi48aC15eGVkKfbdziA30e
TLSH
T1B0F1BDF787E5866ECA1195F0AA18AE1FCE2C0515836C386A85E0AE17D3F3471E141B9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 592c629a403d0fa7f5f58ef07ec9698c40b744dd4ca38e93dd1c26e58b4a5f01
MD5 9ae9c10fc1490302ce8fb88da2a68e50
SHA1 eb5e4bd7874416cce903772e038af33fa0e4520b
SHA512 3a5d9fe635d2c8d3522d3a5402e611b5b4744f70f4291fa0e3874088c1684b79f3eeb0bcd789bade369801b1a81b5d0852eaca87283279bb89230b7b59c64a7b
TLSH
T187D022A32200B0B9A66C3E8660AAACAFC33A10204E12DDDC11D49D9C2A314AE460B249
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 5e31d9088de5862f0b397140c95f219b78bddb40fcee67123719806ded10cf61
MD5 8d9d8377092a8d8f79fb8b78fd57c101
SHA1 a219bafde871b435b4e32906ba35b8316d01bef6
SHA512 07aed95803ac2f0c9d2e6d9ef61460aa80c92b7ea7cdfceda6a6f32fa629dd2eda79a6844c2be05634af52bdfa9338fb6c75cfca6d750738fed466d9532fd8b3
SSDEEP 384:sxRUlSm4E/f4eOsHOZPUGMcS/5Azl/gFQ6Chm:swUm4E/fsZPlY/5Agufm
TLSH
T1FB82F942A624997B8CCBD219F9657F53D6F80463DA544E4CADFCCA0C05E77ED210382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 87c88e268775915edb33177d2f923698dfa5dedbb3779f0a1f974b4724804ecf
MD5 d077acd161332c5ea9e41932c6f387a7
SHA1 98e62f25fb12fc987734f0297fa63065b4054d0b
SHA512 3d6ca5c510948547bfd4985b844bf4530a1636824160f187258d2771efcf085de6160ba97082031725069822e00778ee6a8c56e519023354cb75677d2f8ce4a7
SSDEEP 384:sxRflwm4E/f4eOsHOZHUGkrzbm/5Azl/0FQ6shm:srWm4E/fsZHlkfC/5A0u9m
TLSH
T1FB92E952AA24997B8CCBD519F9657F53D6F80423DA444E4CAEFCCA1C05E77ED220382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 7b01b3dc85d413b0f9713971a9cb16a120d246af717dea7337af78799342a24b
MD5 52ffd78b8ea01a08cc18b195fa0454b5
SHA1 037d4aab40ce96cc7afb415e10b233de240d9183
SHA512 9024014356922756997eee35977d84c24384dfaa8b04584823481673107b1ba4864f49ed976f4deff854ec4af92be3d658b08e9506c6988f633c1af7ccc88b4b
SSDEEP 384:sxRflSm4E/f4eOsHOZHUGdc3/5Azl/tFQ60hm:srUm4E/fsZHle/5Atutm
TLSH
T1D592E852A624997B8CCBD119B9657F63D6F80463DA444E4CAEFCCA1C05E77ED220382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 10cd00e8ceda4d41d7482836594066ea81ff68c1f24de259c93bd172994168bf
MD5 718ba9b92978b18c8fb2d393e5b4b6b6
SHA1 c8c0875ec710258a64fd255f66e14c3a34b02212
SHA512 a7b47f6d186e5db50bdf431026f59ecd524259b8f43648fceabc34779f91d8f879c050c0183c15049f3976582008f7b5c6496182a071d3f2df13f7eada5cfa25
SSDEEP 192:sxR5R/yM/jK1Ml8wlE/f4eOsTZ/XE1jD3zoA8p96/g6+WNZro/Ak+CuFQ+GYIgtJ:sxR5rTE/f4eOsTZPijyU/5O/OFQ63
TLSH
T1E962DA056A34993B8CDBD209FA557F53D6F91573E2901E44AAFC8A1C01E77DD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 2263067fa0630689d32be681439cccd01c237fbbaa06d2cdea916e75ef91cc91
MD5 717453ce19961f716ee57b9675c0ea45
SHA1 80e1958a69906b743ef08a8f4feb9f928b5cc890
SHA512 574924c0bdb478631b4f4fb411d3f5795fbdf7bf6caf624e9e6ddbc6858ae3bfe5579f66316918f4ab75481c28bcb61be82828e967cf98559be9c88f54163856
SSDEEP 768:7dUhBR7pLuL7tgWgEyf3w8F1+UoAYDCx9Tuqh0VfUC9xbog/OV0e0GLroddQp:7dUhBHE7tgWgEyf3wu1jaPRG4dap
TLSH
T145E2EB3B680CCB7F4F4049DCE829BE9A6DA901CB9698CD5447EA840C03C7BEF551A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\3d4db5ca-f483-4d6f-ac67-ba3b47a7ec5d\index-dir\the-real-index
Size 72B
SHA256 7a714489c5fecf5d0d5bb1f482d0716f185f70c5db752ca57cc5f8a020cc0e3e
MD5 b8ec213faee1b3b426b8c3a8bd4fb9e1
SHA1 eb5500af388dae623df7c6dde8d3111a71d8e76d
SHA512 556723d40b2a91c4bf9701d0a0242d62653a13890d94bc817a290e83efd656b2bf6d2604eebf1ba3a8a20c9b204267851a8209d77355cf239464e27ce433ea8c
TLSH
T131A0022003C50017C15711B12DF7466133048850B105670695D51385CC90461858390C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\3d4db5ca-f483-4d6f-ac67-ba3b47a7ec5d\index-dir\the-real-index
Size 72B
SHA256 d14e51220f619ea7aa982e707bd2ef2f8842a02db295e95de4a30317ae12b983
MD5 f4c0955221800dea81a31d192e74aaaf
SHA1 47e013c3af5b47f9edd54093dde4e101bf38d604
SHA512 97a02cebc6db5619a74241aae7555484044a1bb92009e31cc82075c7132315196249d87fbea78e3442172dd09e64a180302660f4bfd3ea8ea524e13090a815bd
TLSH
T13BA0021413C09017C04213F569D6117267208A20F607330686900285D8D09AA864705D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\546debcb-1733-4547-b4db-916d75206e0d\index-dir\the-real-index
Size 600B
SHA256 6e6a46f3ec47dc2c7e327a92c5c14ea9575cd42294cf074b6bed33d017d31187
MD5 f562f19d9700992dd209fa263dda7a2a
SHA1 ca41e0c861234e163c226d477d472269baf83c4a
SHA512 603e24ac22ac6a6191c453600b88a5aecd370b25a6364fadd9bc498122024d1895d801721846e06f3b517fc4c22189af41231b38acce12595101d1ce4226ce38
TLSH
T1ABF0A376ADC15803EF11D5B71931F01D32FB21FE31445E57206D793E8923A7D5550245
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\546debcb-1733-4547-b4db-916d75206e0d\index-dir\the-real-index
Size 3KB
SHA256 81f75e7fcfffbea3a39cbc4ead1b5efa6f9a711f0d37e82c133c3aa7c209ae37
MD5 2610cdc6b1c60b808cb13e0c4cad0708
SHA1 a295cec8f40d111b81a55cfe6677dc8dbcb49163
SHA512 1be2c7c6fafb7c02f283513c06d458dd51dc93a5a3c22ee3d5e9d1f78e5142dc22487062bd366690626851e53b45bf6df0a50ab9bc62264fa2eee390afdb61e8
TLSH
T1E151F74E8C4A294FC86C157269FA14CA33792CED1F848F071AAD663878C333C1844249
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59336a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\546debcb-1733-4547-b4db-916d75206e0d\index-dir\the-real-index~RFe59336a.TMP
Size 600B
SHA256 2edf35e81a5691cbc9d9a29bb1c958ed41cda919da9300f7eae520a1335e7690
MD5 7bbdf39b07e6124bfcde63d7a20b8e63
SHA1 e3d66664acab66e1145f196e3ba5578a5ae41be4
SHA512 48cc4a13f4afa234c863d0cec90dcbdbecb5b97a2a5a9fb4d524acef094c511ccc234f755b1938b57f87fed0be5c9bba8aeac69a2d161c24b721039533f2cb81
TLSH
T187F0ABAA49D15983DE01CAFA0E16A50D32BF68313308AE0720EAB0BE463362D6691295
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\773f2306-ca89-464f-8872-1545267b579b\index-dir\the-real-index
Size 72B
SHA256 5ca16f0ba519aabe56c5cc485d9e44959368e75b82edabdfbe111e55e80b3ecd
MD5 a108a27f01a70f90fe2311339e3e97b3
SHA1 ec7d7367385d4dfdddce1271e4db39fed39c2898
SHA512 43f24a91692bdcaf7e40c5e798705e65f367eb7df7d1328bd6bf83fe3a48ac4fe9e33b093f75eba67c809440359dc54b51e01be9cdd18c96a6d8ac1a9da6919e
TLSH
T1FBA0022D45654F55F5415371314506913E525AD1B20513D2809646D99C682A1A11370D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a5881.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\773f2306-ca89-464f-8872-1545267b579b\index-dir\the-real-index~RFe5a5881.TMP
Size 48B
SHA256 8caf22ca14544af6615cb9e18e3562caace6bd54bd077bede92b22555e203b25
MD5 c36f248429f82f2c20ef2619ece7ca44
SHA1 eb5150609bf6f76b729df58d7cff664ee93cf212
SHA512 1dc30b6c743a53635d75693371f094275ffda4aa1ef010615e98ebae689c802ba54548a6d32f97ef43533e3c3dc212052ad61d362a49a57e9ae71241e889a1a5
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ce8f32e1-1438-430a-98d9-b9f0431b0a78\index-dir\the-real-index
Size 72B
SHA256 a008a062a16c6efcfa78b4c72ae6fdeba3300fc12a86541b20c5941d4aabcf11
MD5 8467abe4dad067ad973ca43bab173c25
SHA1 ba34fb8322c339d90a44958053d667aa7de8ef15
SHA512 bcdd0c9c0ecb76b52432a05cb86c9e0c401ef3375d5438ec645869217ef03a40639b5bf2d02038a1ba929c1defe10965f6203113f429b65b63ad390c704c3bec
TLSH
T119A0022601B4018BC2930EB1755711502716DC5D0615430990D18556E9512988D21185
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 481B
SHA256 07fdc50fc7a831cd54ff7fd7ec343da756bdf88884e5b5c47f59f07e04a9607b
MD5 86a4c10d37ca8f47cbc83d5c4a95b8d4
SHA1 7aaceb574693c6c345230bfa93ce27b62abdaf63
SHA512 778939bc53fa8ace949a0d0156f0dbd011dca62a3df12611b97642ff362d4d6555eb44ba3f4c2eef0129de5d154950ce2abf9e48ee0986fe35cd869d92c0a6e9
TLSH
T17AF027B32FF70918FA9FD2D5243194A904147D68C442ED4F112A71A394B2367248DCA6
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 629b856d4caee3aec5384235c7778d85e5154b8e611765815979df209d9615c7
MD5 e1187113d32e2309fdbcb2b8b93c567f
SHA1 d88345a26228a90ce7f6e1e8fa1aba2a0d30858a
SHA512 c5be31237f9c044a40167bd8a91f01d0051cb85caaf786b50b8aae9a5c299358129419bd2506fecf5a9b68487d09a48b7d6c552683124010a0166d4a6803a891
TLSH
T14DE0C0F62DF60A14FE9FD3C1283184A504017978C545BE4F003EA1D314B23632489CA5
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 476B
SHA256 c3d3281f6812e32c9dd83cc967022947091de16874c536a6721bbd6b5ad6a67a
MD5 de13770d6c19599e95cc79b4820a0a2c
SHA1 acbb5749c018cbc4511b4cf208684672ce293853
SHA512 7961fac5f63ee9e29140c805a0a1981259668d0ded7f3cb51f6e8c3ad8ef95be38da78137012448de3dc1bb2b5aea0d69e0200665ccaae6bcc797e8d3dc359b4
TLSH
T16CF027B32FF70918FA9FD3D5343194A904157968C451FD4F112A71A355B2266248DCA6
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 ad16e5c7af0831f1b51c1b52057378de98b593b82ae316895949c5a2a93d5a31
MD5 1cc1a603f131f7bde403d17f2e54544d
SHA1 c58bab60a0d92042cea37db17b1becb93ade5221
SHA512 1075aa865ffce1d57cc5c26cce37825b7439819f937fe21252febbfa0f12f9821d8a8a3db91df53ee6d2da202c3f24eb9f85cb7e2dcc91f252e4dc0c1838d62e
TLSH
T1FBA002E2C2960855E14953B0B8A101C46716FC604B26371382A80154A86A1814616114
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe598766.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe598766.TMP
Size 48B
SHA256 e2c0614e5af97c964b4e76623c3db2f97e3dff7197d71fa7549530056fee1162
MD5 3436030ab3616c5c1c53e2f4c8ffb4c0
SHA1 60a8db952bc61595367ab5878d59ee5bd9220463
SHA512 8622bc1c32ff34199f628c4fdf88a27d2dd32fee57c39c478234ecfa8a1056ca59f686f83b720ab466185162af3b9ca9e6676111962c3c96312a0efa9b9c88b6
MD5 SHA1 SHA512

Submit Download

a260258e-1db8-4617-aba4-0b64b7f5ce10.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\a260258e-1db8-4617-aba4-0b64b7f5ce10.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 989c66ef516ca70b36226de6c4cabaa35ab3e79aeb611fbd3c622915b8b6e20e
MD5 21d734e06bcfd6cdeaa5ef26e5f83b4e
SHA1 51ac4c14bbcad20a1c9f613941ec5874a0ee77b9
SHA512 5bd0851d45e08a9a1a343335289072405cde674d6f592c36fbfdc877bc6cfae17c250eba9b64f06d034bc7f4a1f9ae08a3e1f62f2505b44681e40e998960757a
SSDEEP 768:1Fcj+9k3lwgdjc9i8McvnWgWWR+2SrXH78tRMCqUki:/9k3pAi8JPWg1bSroPBki
TLSH
T1D0037C32E855CE77ACE29B85B3167787EEE001A3C5C86EC8D9D95E4D01872EE1707C29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 8f97d7451f1d18593b893fc36f9534d44aea53994468ed4666872da78a61bd8a
MD5 1362cd4e1da786484b6e01ea5d2c96ce
SHA1 384b70c58ef005e230f54aa230ebcb0430837479
SHA512 33075b6e97bb4f23a7721b953d0087982dbbd742a6dec02649f681fa0e93b4c2014d644bd5c540eab4f45a0b6abc0c9d192f0c763a691b4babfe92e1b70f6b58
SSDEEP 768:1F5j+9/3AwgEyt9iqMcvnWgWWR+2SrXH78tRMCqUki:49/3ZciqJPWg1bSroPBki
TLSH
T1C81327F198D38976D8AE8783633D6E42AEBCD193B5885984F7C45D0DCC872BFD206825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 aa2da8a76466a7085ee59b0fecad57395d8f4171c5918129c2bc4f38a4fb6784
MD5 cf5531cc92b5d894ae59c6c48e785312
SHA1 31261330e8980f177cf83c36e3fe782c35f01935
SHA512 2ff3a2d39ed982124f97c11d2b34f5258b651bc869c2daa4f88e1e676046aeff2bb9d949fafefcfe33d533b533b7e7712e646e5678bea7b09ad8553bc6bf66d1
SSDEEP 768:Uj+9S3zy+5pitMcvnWgWWR+2SrXH78tRMCqUki:D9S3z3itJPWg1bSroPBki
TLSH
T128F2AE31A8569D738CE6D684B2177783BEE01193D5C82F88D4D96F0E02877AE2747D39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 216dbd60f4d9812f52b28aa7d67a3f275888a29e9e0f2544b5e311c03935ae59
MD5 7e70b4081e33ab596250c8c6a2515bed
SHA1 b801a35ba6f44c636119e0fc641cd4442e40793c
SHA512 349ac65801e9b47d4ff1712eafdfc94b36142eb1d3c1f054973cce288767fe309069877af7ecdb5db64393b8f781f99d68d7ac2acda9fc37e28766c11c9532a4
SSDEEP 768:Oj+9k3H5OP5piAMcvnWgWWR+2SrXH78tRMCqUki:t9k3H8iAJPWg1bSroPBki
TLSH
T11FF2AF31A8665D738CE6D644B2177783BEE01193D5C82F88D4D96E0E02877EE2707939
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 ef6819beb1d07be896aa933b645398742f34cab58dbfd235455135485a339de7
MD5 da1d81e5f33213f5c0731aab4a0a59a6
SHA1 edcea92e8b49edda58769732b98d62ec879afd2f
SHA512 03d777c09d489bed34c1123b0dffbbafc21c5bc9e5459eb68ba2fc122804a08204d449916c8395f52979ab261122c9d333cb77362538b11c12d08f8d0468218d
SSDEEP 768:Oj+9b3sI65pi4McvnWgWWR+2SrXH78tRMCqUki:t9b3sJi4JPWg1bSroPBki
TLSH
T19AF2AF31A8565D738CE6D684B2177783BEE01293D5C92F88D4D96F0E02877AE2707939
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 e24b2de43fdb458454a13dc0422147887d38df47698f0d401ae8480324b9287c
MD5 21dfe1d1eaf410aacaf9fbdfdb105355
SHA1 a61f58ac258bc283a8ee85ba1919189807c6b4cc
SHA512 98dddb116b3ef3e7c20f9c99e987b67768bd6211b65e2cdacdb11923c3ba13acadf8afe87552b0a3afcde602ba87424d18c3000f7fef38b3ff66c6ed7f3b53aa
SSDEEP 768:Orv+4UNbdp3p4r5plMcvnWgWWR+2SrXH78tRkE+8rr6F:Obsb/3mlJPWg1bSro9Dr6
TLSH
T11203BF32A8688973DCF2D685720B72037FF44183D6C91B88C4D91B4D829F9DE270BD66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 3d81a00e4fe55eb2f5fdfb75a34abfa116e88bd30a75d665f1fdad9193e5da42
MD5 1007bffc9cdfffc876beac341199fb13
SHA1 30922e608311e14dd3c228a256cee0c80e276b71
SHA512 93826734ee1f4500653c72086a016135a0e8e3df45f19d59060cd8408dc8fecab561963959a73f1524b508183ab87c7da668a41b6762b960f4fc9babf893b0be
SSDEEP 768:1FKj+9a3lwghyc9iJMcvnWgWWR+2SrXH78tRMCqUki:N9a3l/iJJPWg1bSroPBki
TLSH
T14A037C32E855CE77ACE29B85B3167787EEE001A3C5C86EC8D9D95E4D01872EE1707C29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 a9cb12b19f012c51328eba7575cdc106dcd0e28821a700da5881448f352fe278
MD5 a6922d8890c22f32ce1b1662064d2f21
SHA1 a5715ecd19ebca3e4bcf44774006adeb863287dd
SHA512 16ac4c3818a153edcb7f0c55f8c5c879bdef78b9838d8081b680cb6fbe4a70aa836aeed307bfceeafbf91cbf344030853bfef5d6b625abbf410866fd39599d63
SSDEEP 768:nj+9U3dy+5pipMcvnWgWWR+2SrXH78tRMCqUki:K9U3d3ipJPWg1bSroPBki
TLSH
T1DCF2AF31A8565D738CE6D684B2177783BEE011A3D5C92F88D4D96F0E02877AE2707D39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 cec3091368686767fba9bca19e2ce633821b3b6a1211945674eaf0991851f1b6
MD5 0bc66800f47d2324755c6c291d0c2257
SHA1 a4470e9bcb451690d85d206908049222c8f0cfc4
SHA512 bca79e6d81ca542dde1ffd0c4ee2a8055362a0a3a26634062c9fe3c05b3bc4b83ac5331bd30a166e30f6d437a1245d173db5f94bc68506343d476ae6c48bbb39
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe596d56.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe596d56.TMP
Size 392B
SHA256 aedb7ddaf2d3282351842cb62119efc8755df56537d37b15d36a00e006c4e35a
MD5 b7ad91b6dd188448af09e8d541b48843
SHA1 2b98738df712443d2039c6ecc39045324dcb381b
SHA512 fe79a059a91b587e312577db1c7cc15afee6c0d7e5192d6f7ef79735d6cae32afd3ab672bd75498c4ff9d18628779164cfde09c344640cd9d47d590debc4d4d4
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

7abdb576-82e2-40a2-be5c-05a77f0f5127.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\7abdb576-82e2-40a2-be5c-05a77f0f5127.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

a50f6563c50ca4d5dcb255ee5cfab097

Path C:\Users\Admin\AppData\Local\Roblox\rbx-storage\a5\a50f6563c50ca4d5dcb255ee5cfab097
Size 1KB
SHA256 5e710f0e8ff474aa78b2b472e371cb869268c3e033626dc6bca0d33bae704eeb
MD5 d81ce1c2102492344712a919ce2a173c
SHA1 85589cd62d0554ec6d7180230dd3e6150af0d9b9
SHA512 bc51ed0b00eff71906108351b025ca0b7edc9080c3d3631bb723f9779fdd7793ed892de87e1254e888bfb08f3586878ca92ec266bc094d74c6c46796ad9d96b8
TLSH
T1B411F6A25341A5A0FB166B7439B0FEF06171829053B29D8EF44522DD13D069D9E650A5
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.9_(x64)_20260701235141_000_DotNetHost.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.9_(x64)_20260701235141_000_DotNetHost.log
Size 3KB
SHA256 2ff59c4da392d221be1dfc825832eb8451b82b4eeb6f421591ac8e1a2264b0d3
MD5 a8f86e67f9cd3bce6750d51f6fa9e840
SHA1 81a6beca400261a6f93f631e6c066c6aaf194cd8
SHA512 a5959b32e3ad03664cacb9ba2f05703f4e013f0d6abcd267a1268cf066aecf241226c29a370d8b5867e91730a8820072d8e9e50463f838e71820146d9e9172f0
TLSH
T15C811A241ED40855B2B75B47DDF384265B33BCD3A834CF0D22858319469B90599ACBBE
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.9_(x64)_20260701235141_001_DotNetHostFxr.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.9_(x64)_20260701235141_001_DotNetHostFxr.log
Size 2KB
SHA256 4713de5b24aa7812551d220b5e7007495b7dabd0961bbbbcec5ace22197a149a
MD5 6d20b4ace7e861588b3f5c3ca3464d1c
SHA1 5b93b58a0530ba31e4ccfeb02866750e9bb2c55f
SHA512 911db9e03bf4691f60e9f0a20f872c1e9a7adce44537d3093f35df71649de7761fa908a13c61b277946b7d17501fef337437b15525054f188d0e4f73dea0a772
TLSH
T1C34128191EE40995B1FB5707DAF3C0268A33BC93A830CF4C1399D319066B9096C5CBAE
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.9_(x64)_20260701235141_002_DotNetRuntime.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.9_(x64)_20260701235141_002_DotNetRuntime.log
Size 3KB
SHA256 cda70c599434f7cc1dc9e7a11c3fc5941b66dfb746d4e4c43d3a37d78e029b57
MD5 e19a1de389a43ed70794e317b1185eaa
SHA1 63fff04409bb64d2af686040c17468c38c16a013
SHA512 ca93badea9755abfba6b4a5b1dbe36d2bbdb62bb6c7afd71f2a38ba0064dc039b4bacc35272ae1dcf3f4a10630b01f435a552d76fedcb5c30f131eb08e607a5b
TLSH
T184710D151EE90985B6B6A757DAF3C026AA33FCD7A830CF0C1349431A065BC054D5DBBE
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1180_2108072688\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetHost

Path C:\Users\Admin\AppData\Local\Temp\{40C582CD-575C-4645-81D3-0AF86EFE7574}\DotNetHost
Size 1012KB
SHA256 c8fa13b9c79f39d88a324a03ff97c21585643095b32e674fa668c58e1f106ef1
MD5 7bc75d5cc808fcc218f7d03f252db9ba
SHA1 fe59d3c4f3529fd31bdd277fa667eea4ccacc32e
SHA512 e51b451f4a6f7c919a4dbabf52470a3c448d5b9b1740d9e4cc5051310bcfe30b31d95e7c8766e414a5147f82c74b1b79500a9d48a6c7c80c466dced9e995a830
SSDEEP 12288:0N2etgX0xsm7HrObWMInYLE/BbdJ0zErWolCJ9TeWxqYZfUfP3R:I26gG74W6WBbdJwEqECJ9Te7Yxs3R
TLSH
T188256A1BBFA404A9D8B24E75C5B78321EE357C482320969F43A47229DEFB7D0647A7C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetHostFxr

Path C:\Users\Admin\AppData\Local\Temp\{40C582CD-575C-4645-81D3-0AF86EFE7574}\DotNetHostFxr
Size 1.1MB
SHA256 4edb63c267c96ca5c05f309081b55e3374626e25dddb205cf8b37a42c2438750
MD5 7edeb549573882d34df2df078c7299ce
SHA1 9d889c19de10586f6fb0138030afd519fd40d02c
SHA512 acab3c45b994afbe04d06c58d9d446e1bc10c2bc8e76275a6542f00b86a379cc6fb08dcd1ddb7e51280e5552b823fee64eb7917bf8993b80f82a5a70b14536f0
SSDEEP 24576:f26gG74W6WBbdJwEqECJ9Te7YxkQTbVHmIzOd:f26748BnwEpI9T6YGiVHmI
TLSH
T157357B1BBFA404A9D8A24E75C5B78321EE357C082320969F43A47229DEFB7D0647B7D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetRuntime

Path C:\Users\Admin\AppData\Local\Temp\{40C582CD-575C-4645-81D3-0AF86EFE7574}\DotNetRuntime
Size 28.1MB
SHA256 076b2f180cc513184db1d41b98ef8cab51a9059ad33a0c64919bac0dc9733775
MD5 4b8531ed0b9364894105ee2d0c2001d8
SHA1 6c0b1a0769fefa49f3ff2dd0918ef3f7f7913578
SHA512 8f823ba69293b3b106e550e5d69be29c8227f63b9edb15c1f753b72cb28d9f0fb7d7b5940d9dd7c3da326996f7a2f7e4dc61b2137ced1732755c497dc8d1fd35
SSDEEP 393216:BGA0lAITbkXCfyp4Q/24AJzL1GCn0LA8RVdhtmrBK6q5rONk/1CubJLetP/oj90x:JCAIkXCqOF4y0jbM1K6qV3lJL30VX
TLSH
T182573357BF9548A9C8624E3888BBD725AA7A3C082720964F5758751CCFF73E012BB7C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsDesktopRuntime

Path C:\Users\Admin\AppData\Local\Temp\{40C582CD-575C-4645-81D3-0AF86EFE7574}\WindowsDesktopRuntime
Size 28.8MB
SHA256 4d029b3bef558b3232e33e6e7c54f65feada347b99cac142978643cd7cadb12c
MD5 eb6a43971c26a1d58cf47055357f7300
SHA1 a5ac458efb05ca0166fb5b498b48bc6c42c20dd9
SHA512 fe49a258147dbb13cc37d5764e3af27dd424b0d49d2d353c3010f7d4d07495dd373c9a3fcee14696032fefff823f926b6e99a7d69b89154f36530d30d24783f7
SSDEEP 786432:fTxfdq4WD1EQMyoE5mX8/3LBGxTfb+T5Suf+0zkOPQa:7NyBowmXcgT+oe+1YQ
TLSH
T1086733177F9129A9C8AA4EB1C4778325AE313D44272089AF02A4725DEFFB3E4557B7C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppSettings.json

Path C:\Users\Admin\AppData\Local\Voidstrap\AppSettings.json
Size 2KB
SHA256 f8b97a90defeecd22664f5ed92b35ecda099a843dffbf4c1d603d9f767b95a4f
MD5 0aaa036009d543f8641e9cc1e8d7e6cd
SHA1 a09373afa05cdcf6d0e964221165c44f59bd1c55
SHA512 52768e8e431f57f5708309111ec0611b6fd0b5b0af9a8efc8eb221e6640cfaf805c34ae86cecdcca6806751d896957a7d2034ce67ee9c6e3881cccbd0da3b1f9
TLSH
T16651AE22D91054FE5DBA615CC064D2476B610F2E21345C7FFAFF590E207AB367241F95
MD5 SHA1 SHA512 TLSH

Submit Download

sky512_rt.tex

Path C:\Users\Admin\AppData\Local\Voidstrap\SkyboxPack\ChromaKey\sky512_rt.tex
Size 2KB
SHA256 eeac6dbe921a9841190645bdf545dfa58d5d63b8cb225dc5dd674ad90e9fba9b
MD5 fcadb250780ccb53a0f15d821391d063
SHA1 24d53a65711940bd85f24df96e6fe792cf2569ae
SHA512 f6e222344d5cc6571959830c6a7cd63ebbe04dd989aef49a72f0daaa03290439b8fc7004e6ba26ed91aca733f6d80257c457ead45b66477b519cea4a3879549d
TLSH
T19F41276195A00FA39675C81183834CB1C7F30FE00FA9A3A6C38D5158A24AFA8A88E9C0
MD5 SHA1 SHA512 TLSH

Submit Download

Voidstrap.exe

Path C:\Users\Admin\Downloads\Voidstrap.exe
Size 31.8MB
SHA256 5b66855b96edf996d990c343867829bc6e81a401c94d91d6083f858a06a81d66
MD5 55c32fe519d5ec6236b72c1f62b16821
SHA1 424d3b5aec15d368ec1c1d3ebf48de5797675177
SHA512 7f348ef7e4ba8357b88c3a83db80aa4cfad2d3dc9a60eba3f9e3ad4b35b70500b51ace4a0aed5fbcbfa498ed40740e1ffe99a9b4226ebc8058246936d88ef0f6
SSDEEP 196608:noo90CFHS3hVvAkCPIqpM8R4ripPK5kWObAbN03qDtIsL7s32vrbObyUIBsPVs:H90CIfoINs4SmtIAO3AIsL7s3GbObw
TLSH
T11D778C0AA3D88621D37B877986765206D672BC266311D7CF268CFA4D1F737C1C9B2623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI4EA3.tmp

Path C:\Windows\Installer\MSI4EA3.tmp
Size 392KB
SHA256 a28ed81b8594774c7e1e82f9bbe858c3b36f0d7a93067001387a5a872288231a
MD5 f1fafe5c54813a5d7b60d08b859bd58b
SHA1 95e6598ce1c02220d68edab5474980b7f0f0a12c
SHA512 6dbc8b10277c6fae8d7ba961a843810df0bb11c9c6e3ba54eea1b24e13b1069e454ef5d76d345839a32f94871855928578a15948ba242d03c990b21d8f845df9
SSDEEP 6144:u/VbdUw0z9ursTolCJSqJiIUk8AeWNxFqYrtUc06N:u/VbdJ0zErWolCJ9TeWxqYZfN
TLSH
T1CC846A29F7E418EDD4B782B6C5A68030FF75754D332095AF8BA845291F3BAA470BB701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BootstrapperApplicationData.xml

Path C:\Windows\TEMP\{40C582CD-575C-4645-81D3-0AF86EFE7574}\.ba\BootstrapperApplicationData.xml
Size 9KB
SHA256 5d0f15575f07c77858f4d2862603a0212eeb2bd7c8ec677f24f9b61c40e4e0ae
MD5 4a6fccfbb948643090ee45d55e11b483
SHA1 8cc055b7d7bc7ff5167ab02537eb334d72ba399c
SHA512 11e8d7dacd303c85c89bf4a071cfc10ae0136f03d1ac74bc40b4a7a3f1cd3741025240647ee432d21149bc5f244357e7b6b15ac5b17c70ce4b21631a862a0400
SSDEEP 96:2bpcBM/En6Yic0wZycLn2Vn6sKj0wFycr4qn6URL0wNycLCXn6fMSJw0wpMdycA7:2+z+TzV/zvI4qn2X5a3a1KcITzsCsysz
TLSH
T1C112D3512BFD0218F0F3AE48EFFAA5555A36BD552E39C82D01201D0F49B2E858962FB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetLogo_256x.png

Path C:\Windows\TEMP\{40C582CD-575C-4645-81D3-0AF86EFE7574}\.ba\DotNetLogo_256x.png
Size 2KB
SHA256 0f571f95d8eab48dbc81b0ec5e9f7225e349e26ef50868bfaab556f3c2443b01
MD5 39aa52615723b782c92dec710caaec7f
SHA1 760b49e256a7979fe50a56a2b1be3688a474b886
SHA512 89d1baa3820154667747b25e9e2fd321bfb2ec71dc309915b0a28dacdc80822a4943b639ebb37c37bd2559d5a4306d2096119cd970c84a0d331f6c68b0456dc9
TLSH
T1534195CF1BFD78D7E6E557918E1A8DD232738483B4B3A42CCE7B10B8274A5642B87940
MD5 SHA1 SHA512 TLSH

Submit Download

dotnet.ico

Path C:\Windows\TEMP\{40C582CD-575C-4645-81D3-0AF86EFE7574}\.ba\dotnet.ico
Size 44KB
SHA256 61a2cbd12868cb9b359e0c78961d409b7875f072eb8e53ea88d3e6bfe2961a18
MD5 b8096652d9ec286709a2c863b244b110
SHA1 b3b7f0f4d608fad7cb59ba499d4d17c2b873a7af
SHA512 492a5aa83220bb77c178b7c5b50bf44968c0427e9e45bb97a33df14d7fb4c667ca7adde0ebb3874c7b6011057b01144e4e6651fbad62c6bcf5e0b93586c4bc7a
SSDEEP 96:r+gfbzo+wHK9NbwOY4tIWQeVlV1W9+H+guapUjFamINUItzf1dBNaIZ:ro5HuNcH4tIzeVlV1WEOFDgUWzf1PIm
TLSH
T1E913EF6DE68547C1C10C2032DB4AC792B5233C72E4DAE0C4F9D4FA7E177906965C6E6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\TEMP\{40C582CD-575C-4645-81D3-0AF86EFE7574}\.ba\thm.wxl
Size 7KB
SHA256 b00edd703dd8a475119d0e4dd70a3aaa47f0e95361af290e76d367a8edef3432
MD5 8b2c667a8bbad3153068c0ed90df7ec4
SHA1 c9e04a3a37e5e6262ab9bfecf78280171b8f7b74
SHA512 5269f00d474acccb4c48cb7bcfdf19e63557a388572d3a6335aa39191319691d924e27f70da3f3495387c319396476c63a8fd7b35835cca0901220e39783847b
SSDEEP 96:HiTgM1+XSNEzA0HtYQstYCpCwZQpCeyk5HQJM9ouvj9urz8:Ew9EmtYQstYCPC9e8
TLSH
T191E1026F68DFDEE03A732651B2B3698D6919C29A136F1CF0F869084B47635016377A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.xml

Path C:\Windows\TEMP\{40C582CD-575C-4645-81D3-0AF86EFE7574}\.ba\thm.xml
Size 11KB
SHA256 dfee8e2d075087227f19c835c145c5bb8e72a46880ea24080bb2472fd3a521be
MD5 4329e418dc56b1386d7ea29a0dcfab5b
SHA1 58387f92e89ca21b4179fb697c7de9675c59142f
SHA512 6934873d27e6efbb94da4f13ee8369b29995490051016fdf82800256b924902306d328bf1d4ebbf266d1a53eb24adb6478d1a67de4ecc3e3bcbe561968f24922
SSDEEP 96:HgvPkoeWEH3IWTaQfSJgHzth5mFahbuB8pR5+Vpwe+UIJLg1gEp+6F5pQnxc:AvoWydmQfVHMyyj5Z
TLSH
T14B42FC6851DC7811C532D702AB9371D3FF12BDA6C6C85A58B48E256B1FF262028B739C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixstdba.exe

Path C:\Windows\Temp\{40C582CD-575C-4645-81D3-0AF86EFE7574}\.ba\wixstdba.exe
Size 431KB
SHA256 2b1cee5e3e24593247854eb7a7c4308937b9c607754ed2fb83520a8706c26f1e
MD5 0e88ffd2e737ac9b9a4241616838bc23
SHA1 3c8beb465d20bcef0cd6ceca9c60286d1d15cebd
SHA512 169b9e08518834c9bc5adfe4ab7b79e07685b72f30ede1c1a386229668bde8c15da378e1274e4013ad7b84d6f7a5acc64ef0806e3b8a66322861efaa7e26b620
SSDEEP 6144:X9vfS1NP+c3ytxmg4Stlqe3B9m2LSLTwGw7C3ZLaov5xZvSdF:X9v+GIyugllqe3wwGfX5/SdF
TLSH
T129943B3165F04037C6F90572AE14FA31BF69F208231095EBA3C0DD293968AE5BBB7657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windowsdesktop-runtime-10.0.9-win-x64.exe

Path C:\Windows\Temp\{40C582CD-575C-4645-81D3-0AF86EFE7574}\.be\windowsdesktop-runtime-10.0.9-win-x64.exe
Size 966KB
SHA256 e2e18ec5b9eba1f7d53f5bbfb68b56d0bb9910abc92d429db538544ac8eb2b10
MD5 b6789f69e59f457288a3c4e37cc5e4ac
SHA1 4c5d5ad73304db60ba0e539f30d0a019621570cb
SHA512 2880a9b5ae09640d444fa888f1b05bba4eece82abbb226e80a0451a38f2892d3d8d525fb63ec38a11159cd1ae51e08c1aca113c84b0afcc5a49f79869c7ed7b2
SSDEEP 12288:SVGWl6qCmyZeU6lqlDjC+fScn6X8GwMgJErEA6Z2E2gh+3+U8FHFJb:SVGWl6qCmyt6UdmcpMzYzkR3+U8/Jb
TLSH
T178256D31A166242BD6F50973F914D2307E2CD7082B5C95BAC6C0D90D39689FA6FFB24B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1952-2039-0x0000000000680000-0x0000000000746000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads