5b66855b96edf996d990c343867829bc6e81a401c94d91d6083f858a06a81d66

Analysis

user interaction
yes
max time kernel
36s
max time network
38s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/07/2026, 17:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Voidstrap.exe
Size 31.8MB
Sample260701-vxjgpabs2j
SHA256 5b66855b96edf996d990c343867829bc6e81a401c94d91d6083f858a06a81d66
MD5 55c32fe519d5ec6236b72c1f62b16821
SHA1 424d3b5aec15d368ec1c1d3ebf48de5797675177
SHA512 7f348ef7e4ba8357b88c3a83db80aa4cfad2d3dc9a60eba3f9e3ad4b35b70500b51ace4a0aed5fbcbfa498ed40740e1ffe99a9b4226ebc8058246936d88ef0f6
SSDEEP 196608:noo90CFHS3hVvAkCPIqpM8R4ripPK5kWObAbN03qDtIsL7s32vrbObyUIBsPVs:H90CIfoINs4SmtIAO3AIsL7s3GbObw
TLSH
T11D778C0AA3D88621D37B877986765206D672BC266311D7CF268CFA4D1F737C1C9B2623
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
99	556	msedge.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	windowsdesktop-runtime-10.0.9-win-x64.exe

Executes dropped EXE 8 IoCs

pid	Process
4980	windowsdesktop-runtime-10.0.9-win-x64.exe
2324	wixstdba.exe
4588	windowsdesktop-runtime-10.0.9-win-x64.exe
1776	wixstdba.exe
3032	windowsdesktop-runtime-10.0.9-win-x64.exe
2508	windowsdesktop-runtime-10.0.9-win-x64.exe
2372	windowsdesktop-runtime-10.0.9-win-x64.exe
5852	wixstdba.exe

Loads dropped DLL 8 IoCs

pid	Process
5236	MsiExec.exe
5236	MsiExec.exe
5492	MsiExec.exe
5492	MsiExec.exe
5792	MsiExec.exe
5792	MsiExec.exe
5308	MsiExec.exe
5308	MsiExec.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{0B1257AA-9D34-46E7-B27B-07DF8CD5B92C} = "\"C:\\ProgramData\\Package Cache\\{0B1257AA-9D34-46E7-B27B-07DF8CD5B92C}\\windowsdesktop-runtime-10.0.9-win-x64.exe\" /burn.runonce"	windowsdesktop-runtime-10.0.9-win-x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Videos\Captures\desktop.ini	svchost.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.9\System.Text.Encodings.Web.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.9\System.Threading.Tasks.Extensions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.9\System.Diagnostics.Tools.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.9\System.IO.Compression.FileSystem.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.9\System.Reflection.Primitives.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\System.Security.Permissions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\WindowsBase.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.9\Microsoft.CSharp.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.9\System.Memory.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.9\System.Security.Claims.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.9\createdump.exe	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\System.Private.Windows.Core.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\pl\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.9\System.Diagnostics.Contracts.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.9\System.Diagnostics.Process.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.9\System.Drawing.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.9\System.IO.FileSystem.AccessControl.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\es\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\it\WindowsBase.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\ru\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\tr\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.9\System.ComponentModel.EventBasedAsync.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.9\System.ServiceProcess.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.9\System.Xml.Serialization.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\UIAutomationProvider.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\ja\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\ru\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.9\System.Reflection.Emit.Lightweight.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\it\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.9\System.Collections.Concurrent.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.9\System.IO.Compression.Native.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.9\System.Net.NetworkInformation.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.9\System.Runtime.InteropServices.JavaScript.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\fr\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\ja\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\zh-Hans\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.9\System.Security.Cryptography.Cng.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.9\System.Text.Encoding.CodePages.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.9\mscordaccore.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\pl\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\zh-Hant\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\Microsoft.VisualBasic.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\ru\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.9\clrgcexp.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.9\mscorrc.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\pl\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\pt-BR\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.9\System.Globalization.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.9\System.Xml.XmlDocument.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.9\hostpolicy.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\System.Design.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\cs\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\pt-BR\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.9\System.Security.Cryptography.Csp.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\cs\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\de\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\ja\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\tr\WindowsBase.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.9\System.Net.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.9\System.Xml.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\System.IO.Packaging.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\es\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\pl\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\zh-Hans\PresentationFramework.resources.dll	msiexec.exe

Drops file in Windows directory 35 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e588d53.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICE81.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9DD4.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBCCC.tmp	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149\fileCoreHostExe	msiexec.exe
File opened for modification	C:\Windows\Installer\e588d53.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA8E4.tmp	msiexec.exe
File created	C:\Windows\Installer\e588d5c.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9BFF.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA588.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e588d58.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBFDA.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{1BE0093C-57AD-46B8-9781-8437664E9957}	msiexec.exe
File opened for modification	C:\Windows\Installer\e588d4e.msi	msiexec.exe
File created	C:\Windows\Installer\e588d52.msi	msiexec.exe
File created	C:\Windows\Installer\e588d58.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9EC0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBA6A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI99FA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149\fileCoreHostExe	msiexec.exe
File created	C:\Windows\Installer\e588d57.msi	msiexec.exe
File created	C:\Windows\Installer\e588d47.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9575.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{946BA18E-2919-4151-B0AF-54F42D8515A3}	msiexec.exe
File created	C:\Windows\Installer\SourceHash{39F1106B-DDD4-4912-9069-D6491D1142BE}	msiexec.exe
File created	C:\Windows\Installer\SourceHash{B7AC6B1E-81BF-44EB-B1DA-D9F4A255984B}	msiexec.exe
File opened for modification	C:\Windows\Installer\e588d47.msi	msiexec.exe
File created	C:\Windows\Installer\e588d4d.msi	msiexec.exe
File created	C:\Windows\Installer\e588d4e.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9FDA.tmp	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wixstdba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wixstdba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.9-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.9-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.9-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wixstdba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.9-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.9-win-x64.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
556	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 12 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134274001543455956"	msedge.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\FCF16EF4F69552A53562800BB6300BC9\E1B6CA7BFB18BE441BAD9D4F2A5589B4	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E1B6CA7BFB18BE441BAD9D4F2A5589B4\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\windowsdesktop_runtime_80.36.53633_x64	windowsdesktop-runtime-10.0.9-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C3900EB1DA758B647918487366E49975\ProductName = "Microsoft .NET Host - 10.0.9 (x64)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C3900EB1DA758B647918487366E49975\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{1BE0093C-57AD-46B8-9781-8437664E9957}v80.36.53633\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x64	windowsdesktop-runtime-10.0.9-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E81AB649919215140BFA454FD258513A	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E1B6CA7BFB18BE441BAD9D4F2A5589B4	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E1B6CA7BFB18BE441BAD9D4F2A5589B4\Version = "1344590209"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E1B6CA7BFB18BE441BAD9D4F2A5589B4\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_80.36.53633_x64\Dependents\{0B1257AA-9D34-46E7-B27B-07DF8CD5B92C}	windowsdesktop-runtime-10.0.9-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C3900EB1DA758B647918487366E49975\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6011F934DDD219409966D94D11124EB\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_80.36.53633_x64\Version = "80.36.53633"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E1B6CA7BFB18BE441BAD9D4F2A5589B4\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{B7AC6B1E-81BF-44EB-B1DA-D9F4A255984B}v80.36.53633\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C3900EB1DA758B647918487366E49975\Provider	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6011F934DDD219409966D94D11124EB\PackageCode = "7449C1950640F524D8B78366F980D622"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E81AB649919215140BFA454FD258513A\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E81AB649919215140BFA454FD258513A\DeploymentFlags = "3"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E1B6CA7BFB18BE441BAD9D4F2A5589B4\DeploymentFlags = "3"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E81AB649919215140BFA454FD258513A\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A8A84F1AA6E5EFD5BE00C8237B84D6D4\C3900EB1DA758B647918487366E49975	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{90d77843-5fbd-64ef-6bdf-df7574d01646}\Dependents	windowsdesktop-runtime-10.0.9-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E81AB649919215140BFA454FD258513A\MainFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{90d77843-5fbd-64ef-6bdf-df7574d01646}\DisplayName = "Microsoft Windows Desktop Runtime 10.0.9 (x64)"	windowsdesktop-runtime-10.0.9-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E1B6CA7BFB18BE441BAD9D4F2A5589B4\Provider	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E1B6CA7BFB18BE441BAD9D4F2A5589B4\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E81AB649919215140BFA454FD258513A\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6011F934DDD219409966D94D11124EB	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\922561FD73F5E174FCF6848F5B7EB11C\B6011F934DDD219409966D94D11124EB	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{90d77843-5fbd-64ef-6bdf-df7574d01646}	windowsdesktop-runtime-10.0.9-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C3900EB1DA758B647918487366E49975\SourceList\PackageName = "dotnet-host-10.0.9-win-x64.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x64\Dependents\{0B1257AA-9D34-46E7-B27B-07DF8CD5B92C}	windowsdesktop-runtime-10.0.9-win-x64.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E1B6CA7BFB18BE441BAD9D4F2A5589B4\Clients = 3a0000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6011F934DDD219409966D94D11124EB\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6011F934DDD219409966D94D11124EB\SourceList\Media\1 = ";"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E81AB649919215140BFA454FD258513A\Version = "1344590209"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6011F934DDD219409966D94D11124EB\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6011F934DDD219409966D94D11124EB\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{39F1106B-DDD4-4912-9069-D6491D1142BE}v80.36.53633\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C3900EB1DA758B647918487366E49975\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E81AB649919215140BFA454FD258513A\ProductName = "Microsoft .NET Host FX Resolver - 10.0.9 (x64)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E81AB649919215140BFA454FD258513A\PackageCode = "8A5256E12AB125A47A20C5879AB67446"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6011F934DDD219409966D94D11124EB\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E1B6CA7BFB18BE441BAD9D4F2A5589B4\ProductName = "Microsoft Windows Desktop Runtime - 10.0.9 (x64)"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E1B6CA7BFB18BE441BAD9D4F2A5589B4\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E1B6CA7BFB18BE441BAD9D4F2A5589B4\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_80.36.53633_x64\DisplayName = "Microsoft .NET Runtime - 10.0.9 (x64)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E1B6CA7BFB18BE441BAD9D4F2A5589B4\MainFeature	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E1B6CA7BFB18BE441BAD9D4F2A5589B4\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E1B6CA7BFB18BE441BAD9D4F2A5589B4\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{B7AC6B1E-81BF-44EB-B1DA-D9F4A255984B}v80.36.53633\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E81AB649919215140BFA454FD258513A\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x64	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.36.53633_x64	windowsdesktop-runtime-10.0.9-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6011F934DDD219409966D94D11124EB\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\dotnet_runtime_80.36.53633_x64	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C3900EB1DA758B647918487366E49975	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C3900EB1DA758B647918487366E49975\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{1BE0093C-57AD-46B8-9781-8437664E9957}v80.36.53633\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.36.53633_x64\ = "{946BA18E-2919-4151-B0AF-54F42D8515A3}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D0AF4763EE3512D61B28DAA434B2B15C	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B6011F934DDD219409966D94D11124EB\MainFeature	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\FCF16EF4F69552A53562800BB6300BC9	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C3900EB1DA758B647918487366E49975\PackageCode = "6ADCA068A141F9941A0654693A78C453"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1264	msiexec.exe
1264	msiexec.exe
1264	msiexec.exe
1264	msiexec.exe
1264	msiexec.exe
1264	msiexec.exe
1264	msiexec.exe
1264	msiexec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3032	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeIncreaseQuotaPrivilege	3032	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeSecurityPrivilege	1264	msiexec.exe
Token: SeCreateTokenPrivilege	3032	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeAssignPrimaryTokenPrivilege	3032	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeLockMemoryPrivilege	3032	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeIncreaseQuotaPrivilege	3032	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeMachineAccountPrivilege	3032	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeTcbPrivilege	3032	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeSecurityPrivilege	3032	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeTakeOwnershipPrivilege	3032	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeLoadDriverPrivilege	3032	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeSystemProfilePrivilege	3032	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeSystemtimePrivilege	3032	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeProfSingleProcessPrivilege	3032	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeIncBasePriorityPrivilege	3032	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeCreatePagefilePrivilege	3032	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeCreatePermanentPrivilege	3032	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeBackupPrivilege	3032	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeRestorePrivilege	3032	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeShutdownPrivilege	3032	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeDebugPrivilege	3032	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeAuditPrivilege	3032	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeSystemEnvironmentPrivilege	3032	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeChangeNotifyPrivilege	3032	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeRemoteShutdownPrivilege	3032	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeUndockPrivilege	3032	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeSyncAgentPrivilege	3032	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeEnableDelegationPrivilege	3032	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeManageVolumePrivilege	3032	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeImpersonatePrivilege	3032	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeCreateGlobalPrivilege	3032	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeRestorePrivilege	1264	msiexec.exe
Token: SeTakeOwnershipPrivilege	1264	msiexec.exe
Token: SeRestorePrivilege	1264	msiexec.exe
Token: SeTakeOwnershipPrivilege	1264	msiexec.exe
Token: SeRestorePrivilege	1264	msiexec.exe
Token: SeTakeOwnershipPrivilege	1264	msiexec.exe
Token: SeRestorePrivilege	1264	msiexec.exe
Token: SeTakeOwnershipPrivilege	1264	msiexec.exe
Token: SeRestorePrivilege	1264	msiexec.exe
Token: SeTakeOwnershipPrivilege	1264	msiexec.exe
Token: SeRestorePrivilege	1264	msiexec.exe
Token: SeTakeOwnershipPrivilege	1264	msiexec.exe
Token: SeRestorePrivilege	1264	msiexec.exe
Token: SeTakeOwnershipPrivilege	1264	msiexec.exe
Token: SeRestorePrivilege	1264	msiexec.exe
Token: SeTakeOwnershipPrivilege	1264	msiexec.exe
Token: SeRestorePrivilege	1264	msiexec.exe
Token: SeTakeOwnershipPrivilege	1264	msiexec.exe
Token: SeRestorePrivilege	1264	msiexec.exe
Token: SeTakeOwnershipPrivilege	1264	msiexec.exe
Token: SeRestorePrivilege	1264	msiexec.exe
Token: SeTakeOwnershipPrivilege	1264	msiexec.exe
Token: SeRestorePrivilege	1264	msiexec.exe
Token: SeTakeOwnershipPrivilege	1264	msiexec.exe
Token: SeRestorePrivilege	1264	msiexec.exe
Token: SeTakeOwnershipPrivilege	1264	msiexec.exe
Token: SeRestorePrivilege	1264	msiexec.exe
Token: SeTakeOwnershipPrivilege	1264	msiexec.exe
Token: SeRestorePrivilege	1264	msiexec.exe
Token: SeTakeOwnershipPrivilege	1264	msiexec.exe
Token: SeRestorePrivilege	1264	msiexec.exe
Token: SeTakeOwnershipPrivilege	1264	msiexec.exe

Suspicious use of FindShellTrayWindow 13 IoCs

pid	Process
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
1776	wixstdba.exe
1776	wixstdba.exe

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 3968 wrote to memory of 4568	3968	Voidstrap.exe	86
PID 4568 wrote to memory of 4600	4568	msedge.exe	87
PID 4568 wrote to memory of 556	4568	msedge.exe	89
PID 4568 wrote to memory of 1684	4568	msedge.exe	90
PID 4568 wrote to memory of 1684	4568	msedge.exe	90
PID 4568 wrote to memory of 1684	4568	msedge.exe	90
PID 4568 wrote to memory of 2368	4568	msedge.exe	91
PID 4568 wrote to memory of 2368	4568	msedge.exe	91
PID 4568 wrote to memory of 2916	4568	msedge.exe	92
PID 4568 wrote to memory of 2916	4568	msedge.exe	92
PID 4568 wrote to memory of 2916	4568	msedge.exe	92
PID 4568 wrote to memory of 4716	4568	msedge.exe	93
PID 4568 wrote to memory of 4716	4568	msedge.exe	93
PID 4568 wrote to memory of 4716	4568	msedge.exe	93
PID 4568 wrote to memory of 4996	4568	msedge.exe	94
PID 4568 wrote to memory of 3876	4568	msedge.exe	95
PID 4568 wrote to memory of 4996	4568	msedge.exe	94
PID 4568 wrote to memory of 4996	4568	msedge.exe	94
PID 4568 wrote to memory of 3876	4568	msedge.exe	95
PID 4568 wrote to memory of 3876	4568	msedge.exe	95
PID 4568 wrote to memory of 1048	4568	msedge.exe	98
PID 4568 wrote to memory of 1048	4568	msedge.exe	98
PID 4568 wrote to memory of 688	4568	msedge.exe	100
PID 4568 wrote to memory of 688	4568	msedge.exe	100
PID 4568 wrote to memory of 1848	4568	msedge.exe	101
PID 4568 wrote to memory of 2724	4568	msedge.exe	102
PID 4568 wrote to memory of 1848	4568	msedge.exe	101
PID 4568 wrote to memory of 2724	4568	msedge.exe	102
PID 4568 wrote to memory of 4364	4568	msedge.exe	103
PID 4568 wrote to memory of 4364	4568	msedge.exe	103
PID 4568 wrote to memory of 4364	4568	msedge.exe	103
PID 4568 wrote to memory of 4800	4568	msedge.exe	105
PID 4568 wrote to memory of 3020	4568	msedge.exe	106
PID 4568 wrote to memory of 3020	4568	msedge.exe	106
PID 4568 wrote to memory of 1048	4568	msedge.exe	107
PID 4568 wrote to memory of 1048	4568	msedge.exe	107
PID 4568 wrote to memory of 3960	4568	msedge.exe	108
PID 4568 wrote to memory of 3960	4568	msedge.exe	108
PID 4568 wrote to memory of 4732	4568	msedge.exe	109
PID 4568 wrote to memory of 4732	4568	msedge.exe	109
PID 4568 wrote to memory of 2252	4568	msedge.exe	110
PID 4568 wrote to memory of 2252	4568	msedge.exe	110
PID 4568 wrote to memory of 3932	4568	msedge.exe	111
PID 4568 wrote to memory of 3932	4568	msedge.exe	111
PID 4568 wrote to memory of 784	4568	msedge.exe	112
PID 4568 wrote to memory of 784	4568	msedge.exe	112
PID 4568 wrote to memory of 784	4568	msedge.exe	112
PID 4568 wrote to memory of 1428	4568	msedge.exe	113
PID 4568 wrote to memory of 4980	4568	msedge.exe	114
PID 4980 wrote to memory of 2324	4980	windowsdesktop-runtime-10.0.9-win-x64.exe	116
PID 4568 wrote to memory of 4588	4568	msedge.exe	119
PID 4588 wrote to memory of 1776	4588	windowsdesktop-runtime-10.0.9-win-x64.exe	120
PID 4588 wrote to memory of 3032	4588	windowsdesktop-runtime-10.0.9-win-x64.exe	123
PID 2508 wrote to memory of 2372	2508	windowsdesktop-runtime-10.0.9-win-x64.exe	127
PID 1264 wrote to memory of 5236	1264	msiexec.exe	129
PID 1264 wrote to memory of 5492	1264	msiexec.exe	130
PID 1264 wrote to memory of 5792	1264	msiexec.exe	133
PID 2372 wrote to memory of 5852	2372	windowsdesktop-runtime-10.0.9-win-x64.exe	134
PID 1264 wrote to memory of 5308	1264	msiexec.exe	141
PID 4568 wrote to memory of 2324	4568	msedge.exe	142
PID 4568 wrote to memory of 5596	4568	msedge.exe	143
PID 4568 wrote to memory of 5620	4568	msedge.exe	144

C:\Users\Admin\AppData\Local\Temp\Voidstrap.exe
"C:\Users\Admin\AppData\Local\Temp\Voidstrap.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.NETCore.App&framework_version=10.0.0&arch=x64&rid=win-x64&os=win10&gui=true
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2a0,0x2ec,0x7ffe3061c188,0x7ffe3061c194,0x7ffe3061c1a0
    3⤵
    PID:4600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,18044992198726594802,13201159287768336742,524288 --field-trial-handle=2464,i,12445773775320768851,13988689246007079803,262144 --variations-seed-version --mojo-platform-channel-handle=2492 /prefetch:3
    3⤵
    - Downloads MZ/PE file
    - System Time Discovery
    PID:556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1772,i,13018374496593777450,5961688832144462727,262144 --field-trial-handle=2464,i,12445773775320768851,13988689246007079803,262144 --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:2
    3⤵
    PID:1684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2636,i,5174061785596792660,553433633614595468,524288 --field-trial-handle=2464,i,12445773775320768851,13988689246007079803,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:8
    3⤵
    PID:2368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,13627525556614890610,9947649763026907231,2097152 --field-trial-handle=2464,i,12445773775320768851,13988689246007079803,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
    3⤵
    PID:2916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,14754243952406559038,10971382723110576771,2097152 --field-trial-handle=2464,i,12445773775320768851,13988689246007079803,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
    3⤵
    PID:4716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4280,i,15644177751515757221,10387542445757407414,2097152 --field-trial-handle=2464,i,12445773775320768851,13988689246007079803,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:1
    3⤵
    PID:4996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4292,i,9685533551151095279,3999872244349942059,2097152 --field-trial-handle=2464,i,12445773775320768851,13988689246007079803,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:2
    3⤵
    PID:3876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3504,i,15617128219032987422,2803586228215049581,524288 --field-trial-handle=2464,i,12445773775320768851,13988689246007079803,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:8
    3⤵
    PID:1048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,16659559876266022736,4649937768820664705,524288 --field-trial-handle=2464,i,12445773775320768851,13988689246007079803,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:8
    3⤵
    PID:688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5248,i,12356689327034434030,2136023137452095654,524288 --field-trial-handle=2464,i,12445773775320768851,13988689246007079803,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:8
    3⤵
    PID:1848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,11845641871318358930,1080629682371121137,524288 --field-trial-handle=2464,i,12445773775320768851,13988689246007079803,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
    3⤵
    PID:2724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5104,i,13356582929499573570,265573425436158143,2097152 --field-trial-handle=2464,i,12445773775320768851,13988689246007079803,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:1
    3⤵
    PID:4364
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,10742111891098635285,5219847007239480800,524288 --field-trial-handle=2464,i,12445773775320768851,13988689246007079803,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:8
    3⤵
    PID:2188
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,10742111891098635285,5219847007239480800,524288 --field-trial-handle=2464,i,12445773775320768851,13988689246007079803,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:8
    3⤵
    PID:4800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6224,i,10130805485444054095,17830272727176733136,524288 --field-trial-handle=2464,i,12445773775320768851,13988689246007079803,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:8
    3⤵
    PID:3020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6400,i,8566057585090117801,8412049377095598536,524288 --field-trial-handle=2464,i,12445773775320768851,13988689246007079803,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:8
    3⤵
    PID:1048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3592,i,17400741613149650975,7498086052054470141,524288 --field-trial-handle=2464,i,12445773775320768851,13988689246007079803,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:8
    3⤵
    PID:3960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6268,i,3554803939066830429,10342364982373298730,524288 --field-trial-handle=2464,i,12445773775320768851,13988689246007079803,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:8
    3⤵
    PID:4732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6692,i,17505193306413040139,1669094411144233706,524288 --field-trial-handle=2464,i,12445773775320768851,13988689246007079803,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:8
    3⤵
    PID:2252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6324,i,15217852519035325854,13796537415216490071,524288 --field-trial-handle=2464,i,12445773775320768851,13988689246007079803,262144 --variations-seed-version --mojo-platform-channel-handle=6688 /prefetch:8
    3⤵
    PID:3932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6704,i,4909184063333750390,14746735496358855230,2097152 --field-trial-handle=2464,i,12445773775320768851,13988689246007079803,262144 --variations-seed-version --mojo-platform-channel-handle=6728 /prefetch:1
    3⤵
    PID:784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3700,i,4998748356831782597,13343853213729637179,524288 --field-trial-handle=2464,i,12445773775320768851,13988689246007079803,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:8
    3⤵
    PID:1428
- - C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.9-win-x64.exe
    "C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.9-win-x64.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4980
  - - C:\Windows\TEMP\{F20CEEA6-813B-4543-A342-83FABCD0C376}\.ba\wixstdba.exe
      "C:\Windows\TEMP\{F20CEEA6-813B-4543-A342-83FABCD0C376}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{1546AB52-085B-4A33-9FA5-0FFD2A5DE65E} {69F30954-0792-4C40-A335-B75DDC04854A}
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2324
- - C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.9-win-x64.exe
    "C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.9-win-x64.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4588
  - - C:\Windows\TEMP\{BA54BBDE-07D5-41D1-BA3F-B3EA5C600984}\.ba\wixstdba.exe
      "C:\Windows\TEMP\{BA54BBDE-07D5-41D1-BA3F-B3EA5C600984}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{3E21C832-6638-495E-98D5-DBB799D19D47} {EC7DC5B0-DC54-4B92-AC07-B4239512CD86}
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      PID:1776
  - - C:\Windows\TEMP\{BA54BBDE-07D5-41D1-BA3F-B3EA5C600984}\.be\windowsdesktop-runtime-10.0.9-win-x64.exe
      "C:\Windows\TEMP\{BA54BBDE-07D5-41D1-BA3F-B3EA5C600984}\.be\windowsdesktop-runtime-10.0.9-win-x64.exe" -q -burn.elevated BurnPipe.{00F425D0-8A3E-49FC-8164-8254EAAFD602} {C125C36B-B657-461F-97AF-80E1E610D8A3} 4588
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      PID:3032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=120,i,6240656151136021225,18418279942034966510,524288 --field-trial-handle=2464,i,12445773775320768851,13988689246007079803,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:8
    3⤵
    PID:2324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,6220382031462813208,14407425393992700907,524288 --field-trial-handle=2464,i,12445773775320768851,13988689246007079803,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:8
    3⤵
    PID:5596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6052,i,4794047561783512009,12919491963800129563,524288 --field-trial-handle=2464,i,12445773775320768851,13988689246007079803,262144 --variations-seed-version --mojo-platform-channel-handle=1764 /prefetch:8
    3⤵
    PID:5620

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3032

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1264
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding DBB574F38BAEC28F8241506F72750DB7
  2⤵
  - Loads dropped DLL
  PID:5236
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 634ABDC9CD8777B3E127AE7011F2592A
  2⤵
  - Loads dropped DLL
  PID:5492
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 3FD91A4CE90D2847670A276ABF598054
  2⤵
  - Loads dropped DLL
  PID:5792
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding D865B803EE30E1EAF554D3A866D301EB
  2⤵
  - Loads dropped DLL
  PID:5308

C:\ProgramData\Package Cache\{0B1257AA-9D34-46E7-B27B-07DF8CD5B92C}\windowsdesktop-runtime-10.0.9-win-x64.exe
"C:\ProgramData\Package Cache\{0B1257AA-9D34-46E7-B27B-07DF8CD5B92C}\windowsdesktop-runtime-10.0.9-win-x64.exe" /burn.runonce
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2508
- C:\ProgramData\Package Cache\{0B1257AA-9D34-46E7-B27B-07DF8CD5B92C}\windowsdesktop-runtime-10.0.9-win-x64.exe
  "C:\ProgramData\Package Cache\{0B1257AA-9D34-46E7-B27B-07DF8CD5B92C}\windowsdesktop-runtime-10.0.9-win-x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.9_(x64)_20260701182244.log"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2372
- - C:\Windows\TEMP\{7FFD88FD-F5C5-4D09-8DAB-F7E64879A194}\.ba\wixstdba.exe
    "C:\Windows\TEMP\{7FFD88FD-F5C5-4D09-8DAB-F7E64879A194}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{7C62CA1C-5D7E-45BC-8473-5D74F0C85C16} {DAA11CF0-5BA1-4F24-9130-BE8EBD4FB123}
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5852

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Drops desktop.ini file(s)
PID:5380

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e588d4a.rbs

Path C:\Config.Msi\e588d4a.rbs
Size 11KB
SHA256 7fb25a0607fe0efab0b44af8b6e3c7d2f0d5a04707e4755c8972eac94c2d801d
MD5 7b4326a0772ffd8f923804d96cd952d7
SHA1 243f82f9afba3fccab4e77326850717dbb668217
SHA512 21932b673e11f2bd4f12910f53aacfc854a3f8858ed84b07c293f76914ec184ea0f47868b2c49c2713ddfda6d97304c3e908a4b3ab890bd4a363fffba64c5cc3
SSDEEP 192:/jLCfIQbftB5HOHsYe/eWObUIYbUMEEKs9Cdeph:/jLCfIQbtB5H6JbYbsk
TLSH
T1923231456204C6C7F9D64734D3172B21B7B7E2E6A318124F00EDA2359F0B3A52F6A29B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e588d51.rbs

Path C:\Config.Msi\e588d51.rbs
Size 9KB
SHA256 17734b01851990b7cad038b20ddd665a9e05536a83974c8408b8ecfb6c99b7ec
MD5 f858012c661760ff3c6d9e060b888fed
SHA1 fc05af57a940e2f3389690b7971a18bab5bdc6a7
SHA512 9428cc205f185bf8019192efd06f56302b4232b056b7ca5c885eaa23eac97228874e07cd165526a63b7995b24340734743d0db618ad84853c4d20198b0f913b6
SSDEEP 96:vmfD1HojC5PrbcweCUZ1UBeD2RhCsTlkUBeD2RhC6jI74UYsTlSYSj7E5Z7P/5L+:OrGjiD1eFOnUIdnUPQ7E/nvSG2uepd
TLSH
T170121E01B60082E2F99F1B39E7577BA137B792979380639F58EDA0708F4B7C84B94199
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e588d56.rbs

Path C:\Config.Msi\e588d56.rbs
Size 49KB
SHA256 ce6013eeae3c49820595924afa5edd2a42ad497edc054c257a343b274427cb08
MD5 1ed0a09fb811bf2cff97b3fea53169eb
SHA1 455d128ec4542dc5c47547526cc101b4c56fe89d
SHA512 0addb25c71433787ef0385e32420a0d78382b17e0ee47e9ee2cc69a656264fc7b1a8e8b1e7a95f4e770486603ee5105fd2cd242cc746ad500446cc37ee77fccd
SSDEEP 1536:57EkxpNrxEFzaq0BfH8vjUbjvTyUk9ENNzdoKrCSZOnlFaMd2uuRHCoEzaKQKkDw:bUtVF
TLSH
T17433EF58FFC8D1D2FA363DB82761DE053344D9CB272058AD65CE429AAEC26D94EFC484
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e588d5b.rbs

Path C:\Config.Msi\e588d5b.rbs
Size 71KB
SHA256 a1870a2dfd1dfbedf16333c4f1f8b6adab3de1df7029364b926daffe9c249684
MD5 124b1ed0b79ab7c2b1ef3ce5c182e08a
SHA1 d3496c9121fca8f48033d7493c8b9dbcdb5ef9d2
SHA512 382eb33d26cb2bac56b5e2937b5b4d849592b9d3af282fe4db70423d9ecc3f049d6b1a87a27b24f66c982fc505e380df612cdcd34ffe8592168c2c2b6564ba2f
SSDEEP 1536:sCsJtY1z2XlYfypaocNCiOsh18/gd5n9GttC111v7eGHvoOfup2RmRcBi6hhuNWq:x35vym+SeC6GWmiEs+k
TLSH
T17E63E0961B00C2E1BC33AD5C1B6BF9C5FE068D96AB61896E02C85039DD925DF6F7C2C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ThirdPartyNotices.txt

Path C:\Program Files\dotnet\ThirdPartyNotices.txt
Size 77KB
SHA256 deb4427a295e1ed474b0d81c5a0d972c1b550b9a715cda939cdfa9236b1b418f
MD5 0d8867a25ba926e6e40cd52ab3536b5c
SHA1 89390dc8b8318d0bfef1c6a2fb4783537e28a465
SHA512 317ca335405274f4f91b173651ca2826760acb5ba5cf41aff51adc55c2cda9059fb268333665f13f62fa48119e55a303720a780dd58d28dd9967db4c88407d61
SSDEEP 1536:HA9jHwsGfgg39/zwgAVkguQxrDjugtSEGepkWvrpX7anuqdLSVnfiStPq+3LefrL:HA97w/ogz1AVxuMjHtSFULryLOgrGWm+
TLSH
T17773A45F7E45077319E2C3916569A8C5F22FA02E3B6B2A44346EF248133B42DD6FF858
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 163KB
SHA256 a5ccdc3a41d5e5c6014ff64509aed176db39f4f14caffff3dd1997f8907e94d7
MD5 b497651137eb819839df76f909340d9a
SHA1 549dbe63c781ee26d5ebd2ca8f605ce757b3dc21
SHA512 ed4e6f3556c08b832da992ec329610a0cd4671c51da49a81e1e08075036b46ae1951c5caff14789d5faafef84e88d467343ad400a0810522edadcc31141f18f2
SSDEEP 3072:UGgPzwruvTSBbQ/fp4SbDqIG/sk7l55wKGxvu:UGrrubgbQpDvqIwtQG
TLSH
T152F3F61AD65811AAD16E9575CB528941BB337C668BE0E3CB13C0F8BE0F726905EF9703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

state.rsm

Path C:\ProgramData\Package Cache\{0B1257AA-9D34-46E7-B27B-07DF8CD5B92C}\state.rsm
Size 1KB
SHA256 325a948d2f1f7757c2a8c8ad67bc6a91588d42ed0dd6aae2016471015840c8c0
MD5 84ca94a2a83e57d6980a407f7e039351
SHA1 7a94323e68f54be832a68422df0353f626e8b6b4
SHA512 e28f399a2465eb8ae1dfe7fb2035cf6b2fe5220911a2831071e0ad2fe3c94958878148adb2291ce62d5c64181f1b14d1a8d8b20c4b1014d268d07f1d64805d85
TLSH
T19F2181515BFA092DF3F6AB7569F96625543BBC161D24C26E0001318A9E72BD0C874B33
MD5 SHA1 SHA512 TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 9420686d12b2cba6dc69896d607eadac629280a010e5358a4872ab9753f24ed7
MD5 8be6e81804d8b903ae07c11b2e53e3d9
SHA1 817c41cb00b05a8f2040323b93c6416b92dbc01b
SHA512 c2cfff48ebb312975aa2615d841d0badff185589ad3a3f5e8420c2ea0eb5dc0e5354d917cc43d57bec169a63d4fa21d66e91dc3e195592ece23d37fff7c04680
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7R:fwUQC5VwBIiElEd2K57P7R
TLSH
T1CDB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e2b315c59b1bfe8e547b0017a92548af7c81e08409e987a2628ad74667b4fec
MD5 7ab616f55807e9de5195a40c50f65e5b
SHA1 917a7797f800e5f30a1b9b8125127968246d7ce9
SHA512 da10f29803a072f42a2c102da0bee745cf1b1d47836e3d30e38b1e66beeb1abeaf2eb47b6c07b23682098f70fe2a4b29a0777eefa1380d0fff2509ff32d9b356
TLSH
T171D08023771D7182F35B41759053D7025A1680756463B701B325D41C9A740C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b976ac8901ffd41ec02a04aa583bc9d11350f0f9f714fb92d3341bb0bde4629f
MD5 504ce80b644a85a7e68d85bd24169289
SHA1 1f740a722dfa97fc8fb30626b0e3d6217e4a9864
SHA512 9406464a4f6becd85591c12af8a97fdecfa2208649138f347fb50d3e28f1583adec061050924fa0405e46eb75af7e299e6564c2ed039db9d82c50326da32a3c5
TLSH
T19ED08023371D7582F75B41759053D7025A1680756463F701B325D41C9A750C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

348e2330-8c3a-4579-98e3-d9af9b358eec.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\348e2330-8c3a-4579-98e3-d9af9b358eec.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 daf69c1f15fecf4a243d3d91f4029f1f364fac05606a59ba8d4dd355ab9a8c01
MD5 e24fa92ba99c0d5d4fc232e3d9ad9ed5
SHA1 649e246eef9d93db39966cfcb0244f32f37eceae
SHA512 e0c99fe641435530c4747ce2047d797c3f931c6f0d9f48146b3168871dbb8d152a20f79d6ccd4381dd05fc14d930e4f9d64159d564d48edf15282679acfe818c
SSDEEP 96:VtrbyQcoIT/0c3wJVSbn62Zv+/TBKYuPD:VtrbBcTRAJVlZkPD
TLSH
T1E0813E318A66C0B2D7451D7060D12E0D72798AEBF6F31ED227DC46382772B7463E99B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58cc25.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58cc25.TMP
Size 3KB
SHA256 ef26df9414d246de8aba66a90bd346aae3cecf97d325700f8104f1a5f4dea80e
MD5 ee61a06e4675178f16ba98408c90cf0c
SHA1 83ef3efcbb4daa3d97b904b7b7edcd9796470032
SHA512 779049dac44d3ae4b3f42cce93db44b8f7129a75b2b12b78bb1641fb8cac46c80c5942248882c36571ade38da66792fe6b7d17d67cabf18780eaf8eb3793557d
TLSH
T1817140348656C4B2D7461DB050C12D0D727A8AEBFAF31ED6239C4239237277457E99B8
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 ff10168b0ef356d0c0c3ff9680a096e71a3d7d1f021f9eb68d88fad29f11b20c
MD5 3109563b2ce67eb03647647905b927d7
SHA1 fb383ae7f94971288feb9824428f9adc7e05841e
SHA512 252818be00cc1d449bc56e71f16e6013403edcd3092c9008c9d48012f30ec43d4e80ef84834016071182425dbd1d37ea5f75473a6ee26b330ed9c8d7b65744fd
SSDEEP 192:sxZWRYyM/jK1Ml8MzB/fJsw8ASKgRNIdpwhHW6+WNrPM/AwInGmkIg4J:sxZWCLB/fJswf+RuAHbQ/Fc
TLSH
T13F52C812AA345977CCCBE209B955BB53D6F51563A3940E449AFCCA0C05F7AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 dd039acea28aa48e1c90b8d96bbe88c10b97d80d87dfa4512431377533307816
MD5 40ec6521144014bfcdb621015df8b392
SHA1 742ec07c95e0412f78ac4d22358dc6d695b1ad19
SHA512 9dfb08b1ee63e1b4709eba704954356cc8778953994690a6dfe0bb5d55a46c3a3ad0715a115bb51fc09c5a48af7f651767961cbe5bdce36f9f3f268e2272ad63
SSDEEP 192:sxZWRYyM/jK1Ml8MmB/fJsz8ASKgRNIdpwhHW6+WNrPM/AwIntmkIg54J:sxZWCuB/fJszf+RuAHbQ/Q2
TLSH
T12352D816AA345977CCCBD209F955BB53D6F50563A3900E44AAFCCA1C06E7AED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 bf8ace3d2ea5cf4197468532663a160b0a0415f565c8b73a135170e738237b0e
MD5 efb8f936c42494fa20ad7f3852e2bb7a
SHA1 d983cb7fd5f28ae6dceed99fb6a01e07abaebc69
SHA512 c0ba1714460b54d4855b2fb39beda9afcc08b6114fba64c38dbbadedbbc6e0285ed160e29ededa82ace5b5aac356f06679977dd1ab9af1167a6491507871c633
SSDEEP 768:qQsqxM07pLuL7JlWvJD6T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVUcY4Ll6AR95roO:qQsqxM4E7JlWvJD6Tu1jaBcY4LAs9yIF
TLSH
T190F20B3B6D0CCB7E4F844E9CED2A7E8A6DE8018B9698C95447FA844C03C76EB11165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 92f39106a31d4778eba7ea40bfce0a1dae8618fb88d022e278e677e9363c1d8a
MD5 a62432f9fec4aca21eaa740ce10cebdc
SHA1 ddc2a628cf8c6e51831fa1ac009de22eb1cff961
SHA512 fef3d9d42d5a96d3b8098bee37f3bc89f3d1ec061a6ca657a226445c856a84e786348bf7dc43dfad8362e7e862cd923a38a65d468bde352709f668bbd103285d
SSDEEP 96:KYbaKYIKS0QKJ2ihan2K0Isk8I5PWCkK+BWMkyqKZ0L/WKE0K6GMK7SJixiOifiR:Ex7jVjd/0KvWKF
TLSH
T188E11116713F024328BD3818E36686778E4272A73818A5BF7BB840A55B67E125CFDDCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 240d4216333defa714b085af61c72f11705d58e0e92d918f512efd286988e4a6
MD5 887f8d55eee2f80593d18769d7a1aa29
SHA1 d23cf2a20114764eb47430536bd3e54dfd06fb35
SHA512 ceb5aa741d571288a731575f3b28e5f692b929730e800435258fc8e2c45017a7a1cdc6fe22f0b09460d079c951d47b4a1c352285b0e46149044fb857e764aa7f
SSDEEP 192:tONI6JkRtQmiUyeSW+RNMOmEoIh3eRCU6:tONI6UrAW+RNMOKY7U6
TLSH
T1C002EA356D785CB79EE36E09F98737175FA4106BF9852F80D6E81B0C01D765C2347826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 2423f582133044de868cb57fba57bcc51907463d3c2962b151387c530b5997a6
MD5 1bc763b3fe2ccba9ca694609d18aeb85
SHA1 1ae5e987b3ac5031e54551f6814cd4a80dede65c
SHA512 55780b05570e212e88bbb4e602d0b0a924ece7b3859391165a2f6fe29ca21926aa92468093f1ae6ffaa62c185650680c12ba9ad5e4eec4afc9be5d4d12b807d0
SSDEEP 384:nrtNn/s3n9SfsNBp2+AbH1GVRNMOKx9cwX0IidKzvp6Ja:rj+9UAOkHMOKx9cw78Kz0Ja
TLSH
T1B5929D326C358CB74EEA6549F9473B939EB851B7A7852F44E1EC5B0C01C779C230A916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 9a4b812346ecd70d78966e3fa44d476ea4d1eccd269957262a3c2532619f19a6
MD5 e9d27ad53677cdb7a4519d38ce37a517
SHA1 f55efd91ac906a2b11ed2db60453b4f863247ff8
SHA512 6384789f14a9006c003a4aef79213566930fb2f0eed8057da6f83bafc7e4174185db91739659fc53abe9f1d743986a4cb32b062a2600db26988698e403847b7a
SSDEEP 384:ngtNn/s3n9SzsNB92+Abf1GVRNMOKx9cwX0IidKzvp6Ja:gj+9YwkkHMOKx9cw78Kz0Ja
TLSH
T1B6928D326C398CA74DEA9549F9473B939FB851B7A7852F84E1EC5B0C02C779C230A916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 bbb2a25d3ed1b9a2e21d14ac7b4cca4ece320199e14b71cb80f832bf7fb84aff
MD5 94eb332c32851f57bd082490cb9591f9
SHA1 c6d1b38e6cd2cb3ca02d667b38ac88e858b9db68
SHA512 b7c9b389ee90254c6519ea4ac54790882a03228f03681373976ed0239c3ec4b2a73a5e12e5b80e5dcfb80eae57d76d16bd84fe138a282b9c295e72f2dfb18f87
SSDEEP 192:TONk6JkRBQmiUyaSS+RNMOmEo9X9joVc9qWlWU6:TONk6UfaS+RNMOKx97wU6
TLSH
T1A8121A3168389C775EE66905F4C732939EA820B7ED896F80E1D81F0C01D7B9C274F82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

127ccfaa-97fc-41e6-b16f-e8f0c085128a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\127ccfaa-97fc-41e6-b16f-e8f0c085128a.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 8f9e2700c1079abd848a4b3ac0bc0b9d706a1ac740abe4dce68e300544d13ad4
MD5 b1988c34b0c737cd33064fc44c0967b5
SHA1 feb9a3b0c47d877b91a5fb7a635937e02298d9b0
SHA512 9b43d39cda75dac1019a2959713bb49fe9025a889c686560c6530cd1b9235074b9ec3c608d6e2b12e038dc5e53c294415988a7a571568c4b7446d632134df7d9
TLSH
T1D6412958B6EA1148B3B67F56ABF6A96E447F7C672F47D49D00110E4E0623A40C861737
MD5 SHA1 SHA512 TLSH

Submit Download

7cbdd1e3-4735-4d7a-a572-11cde9786e23.tmp

Path C:\Users\Admin\AppData\Local\Temp\7cbdd1e3-4735-4d7a-a572-11cde9786e23.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.9_(x64)_20260701182244_000_DotNetHost.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.9_(x64)_20260701182244_000_DotNetHost.log
Size 3KB
SHA256 06a5b745b653c388662b1024359a2f05de97c5829bb4a394d742dabf8379089e
MD5 c6397581ae24c0d4da354b1d6fccd273
SHA1 be2918af81cca255cea17e2f8b08c370225b0e62
SHA512 f1b8ea6542518731a81a7e311b8706c55789a0084ecfa9047ad4de752e6ee60c86a704136c7b386b02103663a55235c26c663e0026351d6b2bda317c39472fbe
TLSH
T1E9811B691AF50805B2B39747DDF7D4525A33BCC7A834CF4D23C98319029BD06B86CBAA
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.9_(x64)_20260701182244_001_DotNetHostFxr.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.9_(x64)_20260701182244_001_DotNetHostFxr.log
Size 2KB
SHA256 ac45a28f7e246e1df267e2aba8a76a41f69524db955de6e6c660882e25169f48
MD5 97b4d1ef811281583688fecf65e220aa
SHA1 9fde3a2529e5d77ac7c012e8d91b247f71f6f8dc
SHA512 b66fa81814ab2c19268e05c8f8f0b2517330e7c7a3af8639761157c26b1d74dc28b6333e0ec7ace508e20fd7a64a6730ec793dde2b917da14bc561bfff89be51
TLSH
T1284128591AF90844B1B6974BDAF7D052EA33FCC66934CB4C12868319066FD02787CBBE
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.9_(x64)_20260701182244_002_DotNetRuntime.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.9_(x64)_20260701182244_002_DotNetRuntime.log
Size 2KB
SHA256 2516daf7e1aca56cfef605d5db4037172e6d0fcbfa632319ea213550d6321841
MD5 04f34018d4baa623cf41da3b59b7f26a
SHA1 1a3be2b74a08da1c91e1451ea1dfbeedaa719a9a
SHA512 42787cbae66914c014aedadd30d5a155fc0e1b54902c9a282a3df47d44d2d98c642a49dcb8ee2fc67344dde0e42dfd839021edcd53979445c99a2d75b8976ccc
TLSH
T1D2414B691BE80904B1B65767DBF7D0A15A33FCD6A830CF4C13848219466BD0378ACBBE
MD5 SHA1 SHA512 TLSH

Submit Download

a3466d53-147d-4518-8e55-4fb1613ffcee.tmp

Path C:\Users\Admin\AppData\Local\Temp\a3466d53-147d-4518-8e55-4fb1613ffcee.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4568_499742465\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f8dbd0d9-ce9c-46e2-b24f-0e07b4cace92.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4568_634799032\f8dbd0d9-ce9c-46e2-b24f-0e07b4cace92.tmp
Size 152KB
SHA256 f83832c37a0969ce89f77b16eaa07457b03f43029abaec00eaedce2674adbaf5
MD5 d2e80cd29c43ea745d16284dc1f58ea6
SHA1 53fe0165f9f303b333be9284865c8a74f3553c0b
SHA512 375fd3e65b12f80b92a63c1cf6f0ace9fe878c1a0cb5179d869c99aad0cfde14715fd1499eab22a04f353e5f292c19d6a5aeccb43ec2ff5cd6878a5226b005ca
SSDEEP 3072:bHVqfst2F+fBXzSKmg3n0OIH1iCylcLMLgaK9enj59Ah8MuBX8Yk17CF:b1qkfBXG801idlcLMLgaOeV9A2XdBkda
TLSH
T1DBE3E13C3EDACD26C21B20F97F287587C54D8F17A10BA50BE14A84015A76B5E17E2DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetHost

Path C:\Users\Admin\AppData\Local\Temp\{BA54BBDE-07D5-41D1-BA3F-B3EA5C600984}\DotNetHost
Size 1012KB
SHA256 c8fa13b9c79f39d88a324a03ff97c21585643095b32e674fa668c58e1f106ef1
MD5 7bc75d5cc808fcc218f7d03f252db9ba
SHA1 fe59d3c4f3529fd31bdd277fa667eea4ccacc32e
SHA512 e51b451f4a6f7c919a4dbabf52470a3c448d5b9b1740d9e4cc5051310bcfe30b31d95e7c8766e414a5147f82c74b1b79500a9d48a6c7c80c466dced9e995a830
SSDEEP 12288:0N2etgX0xsm7HrObWMInYLE/BbdJ0zErWolCJ9TeWxqYZfUfP3R:I26gG74W6WBbdJwEqECJ9Te7Yxs3R
TLSH
T188256A1BBFA404A9D8B24E75C5B78321EE357C482320969F43A47229DEFB7D0647A7C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetHostFxr

Path C:\Users\Admin\AppData\Local\Temp\{BA54BBDE-07D5-41D1-BA3F-B3EA5C600984}\DotNetHostFxr
Size 1.1MB
SHA256 4edb63c267c96ca5c05f309081b55e3374626e25dddb205cf8b37a42c2438750
MD5 7edeb549573882d34df2df078c7299ce
SHA1 9d889c19de10586f6fb0138030afd519fd40d02c
SHA512 acab3c45b994afbe04d06c58d9d446e1bc10c2bc8e76275a6542f00b86a379cc6fb08dcd1ddb7e51280e5552b823fee64eb7917bf8993b80f82a5a70b14536f0
SSDEEP 24576:f26gG74W6WBbdJwEqECJ9Te7YxkQTbVHmIzOd:f26748BnwEpI9T6YGiVHmI
TLSH
T157357B1BBFA404A9D8A24E75C5B78321EE357C082320969F43A47229DEFB7D0647B7D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetRuntime

Path C:\Users\Admin\AppData\Local\Temp\{BA54BBDE-07D5-41D1-BA3F-B3EA5C600984}\DotNetRuntime
Size 28.1MB
SHA256 076b2f180cc513184db1d41b98ef8cab51a9059ad33a0c64919bac0dc9733775
MD5 4b8531ed0b9364894105ee2d0c2001d8
SHA1 6c0b1a0769fefa49f3ff2dd0918ef3f7f7913578
SHA512 8f823ba69293b3b106e550e5d69be29c8227f63b9edb15c1f753b72cb28d9f0fb7d7b5940d9dd7c3da326996f7a2f7e4dc61b2137ced1732755c497dc8d1fd35
SSDEEP 393216:BGA0lAITbkXCfyp4Q/24AJzL1GCn0LA8RVdhtmrBK6q5rONk/1CubJLetP/oj90x:JCAIkXCqOF4y0jbM1K6qV3lJL30VX
TLSH
T182573357BF9548A9C8624E3888BBD725AA7A3C082720964F5758751CCFF73E012BB7C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsDesktopRuntime

Path C:\Users\Admin\AppData\Local\Temp\{BA54BBDE-07D5-41D1-BA3F-B3EA5C600984}\WindowsDesktopRuntime
Size 28.8MB
SHA256 4d029b3bef558b3232e33e6e7c54f65feada347b99cac142978643cd7cadb12c
MD5 eb6a43971c26a1d58cf47055357f7300
SHA1 a5ac458efb05ca0166fb5b498b48bc6c42c20dd9
SHA512 fe49a258147dbb13cc37d5764e3af27dd424b0d49d2d353c3010f7d4d07495dd373c9a3fcee14696032fefff823f926b6e99a7d69b89154f36530d30d24783f7
SSDEEP 786432:fTxfdq4WD1EQMyoE5mX8/3LBGxTfb+T5Suf+0zkOPQa:7NyBowmXcgT+oe+1YQ
TLSH
T1086733177F9129A9C8AA4EB1C4778325AE313D44272089AF02A4725DEFFB3E4557B7C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\Videos\Captures\desktop.ini
Size 190B
SHA256 86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
MD5 b0d27eaec71f1cd73b015f5ceeb15f9d
SHA1 62264f8b5c2f5034a1e4143df6e8c787165fbc2f
SHA512 7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c
TLSH
T11EC0121892F93224A1728D12BD7460119AB1F4217C16CA9D1380508F08A1601E631B53
MD5 SHA1 SHA512 TLSH

Submit Download

MSI9575.tmp

Path C:\Windows\Installer\MSI9575.tmp
Size 392KB
SHA256 a28ed81b8594774c7e1e82f9bbe858c3b36f0d7a93067001387a5a872288231a
MD5 f1fafe5c54813a5d7b60d08b859bd58b
SHA1 95e6598ce1c02220d68edab5474980b7f0f0a12c
SHA512 6dbc8b10277c6fae8d7ba961a843810df0bb11c9c6e3ba54eea1b24e13b1069e454ef5d76d345839a32f94871855928578a15948ba242d03c990b21d8f845df9
SSDEEP 6144:u/VbdUw0z9ursTolCJSqJiIUk8AeWNxFqYrtUc06N:u/VbdJ0zErWolCJ9TeWxqYZfN
TLSH
T1CC846A29F7E418EDD4B782B6C5A68030FF75754D332095AF8BA845291F3BAA470BB701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BootstrapperApplicationData.xml

Path C:\Windows\TEMP\{F20CEEA6-813B-4543-A342-83FABCD0C376}\.ba\BootstrapperApplicationData.xml
Size 9KB
SHA256 5d0f15575f07c77858f4d2862603a0212eeb2bd7c8ec677f24f9b61c40e4e0ae
MD5 4a6fccfbb948643090ee45d55e11b483
SHA1 8cc055b7d7bc7ff5167ab02537eb334d72ba399c
SHA512 11e8d7dacd303c85c89bf4a071cfc10ae0136f03d1ac74bc40b4a7a3f1cd3741025240647ee432d21149bc5f244357e7b6b15ac5b17c70ce4b21631a862a0400
SSDEEP 96:2bpcBM/En6Yic0wZycLn2Vn6sKj0wFycr4qn6URL0wNycLCXn6fMSJw0wpMdycA7:2+z+TzV/zvI4qn2X5a3a1KcITzsCsysz
TLSH
T1C112D3512BFD0218F0F3AE48EFFAA5555A36BD552E39C82D01201D0F49B2E858962FB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetLogo_256x.png

Path C:\Windows\TEMP\{F20CEEA6-813B-4543-A342-83FABCD0C376}\.ba\DotNetLogo_256x.png
Size 2KB
SHA256 0f571f95d8eab48dbc81b0ec5e9f7225e349e26ef50868bfaab556f3c2443b01
MD5 39aa52615723b782c92dec710caaec7f
SHA1 760b49e256a7979fe50a56a2b1be3688a474b886
SHA512 89d1baa3820154667747b25e9e2fd321bfb2ec71dc309915b0a28dacdc80822a4943b639ebb37c37bd2559d5a4306d2096119cd970c84a0d331f6c68b0456dc9
TLSH
T1534195CF1BFD78D7E6E557918E1A8DD232738483B4B3A42CCE7B10B8274A5642B87940
MD5 SHA1 SHA512 TLSH

Submit Download

dotnet.ico

Path C:\Windows\TEMP\{F20CEEA6-813B-4543-A342-83FABCD0C376}\.ba\dotnet.ico
Size 44KB
SHA256 61a2cbd12868cb9b359e0c78961d409b7875f072eb8e53ea88d3e6bfe2961a18
MD5 b8096652d9ec286709a2c863b244b110
SHA1 b3b7f0f4d608fad7cb59ba499d4d17c2b873a7af
SHA512 492a5aa83220bb77c178b7c5b50bf44968c0427e9e45bb97a33df14d7fb4c667ca7adde0ebb3874c7b6011057b01144e4e6651fbad62c6bcf5e0b93586c4bc7a
SSDEEP 96:r+gfbzo+wHK9NbwOY4tIWQeVlV1W9+H+guapUjFamINUItzf1dBNaIZ:ro5HuNcH4tIzeVlV1WEOFDgUWzf1PIm
TLSH
T1E913EF6DE68547C1C10C2032DB4AC792B5233C72E4DAE0C4F9D4FA7E177906965C6E6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\TEMP\{F20CEEA6-813B-4543-A342-83FABCD0C376}\.ba\thm.wxl
Size 7KB
SHA256 b00edd703dd8a475119d0e4dd70a3aaa47f0e95361af290e76d367a8edef3432
MD5 8b2c667a8bbad3153068c0ed90df7ec4
SHA1 c9e04a3a37e5e6262ab9bfecf78280171b8f7b74
SHA512 5269f00d474acccb4c48cb7bcfdf19e63557a388572d3a6335aa39191319691d924e27f70da3f3495387c319396476c63a8fd7b35835cca0901220e39783847b
SSDEEP 96:HiTgM1+XSNEzA0HtYQstYCpCwZQpCeyk5HQJM9ouvj9urz8:Ew9EmtYQstYCPC9e8
TLSH
T191E1026F68DFDEE03A732651B2B3698D6919C29A136F1CF0F869084B47635016377A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.xml

Path C:\Windows\TEMP\{F20CEEA6-813B-4543-A342-83FABCD0C376}\.ba\thm.xml
Size 11KB
SHA256 dfee8e2d075087227f19c835c145c5bb8e72a46880ea24080bb2472fd3a521be
MD5 4329e418dc56b1386d7ea29a0dcfab5b
SHA1 58387f92e89ca21b4179fb697c7de9675c59142f
SHA512 6934873d27e6efbb94da4f13ee8369b29995490051016fdf82800256b924902306d328bf1d4ebbf266d1a53eb24adb6478d1a67de4ecc3e3bcbe561968f24922
SSDEEP 96:HgvPkoeWEH3IWTaQfSJgHzth5mFahbuB8pR5+Vpwe+UIJLg1gEp+6F5pQnxc:AvoWydmQfVHMyyj5Z
TLSH
T14B42FC6851DC7811C532D702AB9371D3FF12BDA6C6C85A58B48E256B1FF262028B739C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windowsdesktop-runtime-10.0.9-win-x64.exe

Path C:\Windows\Temp\{BA54BBDE-07D5-41D1-BA3F-B3EA5C600984}\.be\windowsdesktop-runtime-10.0.9-win-x64.exe
Size 966KB
SHA256 e2e18ec5b9eba1f7d53f5bbfb68b56d0bb9910abc92d429db538544ac8eb2b10
MD5 b6789f69e59f457288a3c4e37cc5e4ac
SHA1 4c5d5ad73304db60ba0e539f30d0a019621570cb
SHA512 2880a9b5ae09640d444fa888f1b05bba4eece82abbb226e80a0451a38f2892d3d8d525fb63ec38a11159cd1ae51e08c1aca113c84b0afcc5a49f79869c7ed7b2
SSDEEP 12288:SVGWl6qCmyZeU6lqlDjC+fScn6X8GwMgJErEA6Z2E2gh+3+U8FHFJb:SVGWl6qCmyt6UdmcpMzYzkR3+U8/Jb
TLSH
T178256D31A166242BD6F50973F914D2307E2CD7082B5C95BAC6C0D90D39689FA6FFB24B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixstdba.exe

Path C:\Windows\Temp\{F20CEEA6-813B-4543-A342-83FABCD0C376}\.ba\wixstdba.exe
Size 431KB
SHA256 2b1cee5e3e24593247854eb7a7c4308937b9c607754ed2fb83520a8706c26f1e
MD5 0e88ffd2e737ac9b9a4241616838bc23
SHA1 3c8beb465d20bcef0cd6ceca9c60286d1d15cebd
SHA512 169b9e08518834c9bc5adfe4ab7b79e07685b72f30ede1c1a386229668bde8c15da378e1274e4013ad7b84d6f7a5acc64ef0806e3b8a66322861efaa7e26b620
SSDEEP 6144:X9vfS1NP+c3ytxmg4Stlqe3B9m2LSLTwGw7C3ZLaov5xZvSdF:X9v+GIyugllqe3wwGfX5/SdF
TLSH
T129943B3165F04037C6F90572AE14FA31BF69F208231095EBA3C0DD293968AE5BBB7657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1264-863-0x0000025E69200000-0x0000025E69CC1000-memory.dmp

Download