5b66855b96edf996d990c343867829bc6e81a401c94d91d6083f858a06a81d66

Resubmissions

08/08/2026, 22:02

260808-1x8pgavgpb8

08/08/2026, 21:58

260808-1vnlhsfe858

Analysis

user interaction
yes
max time kernel
112s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/08/2026, 21:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Voidstrap.exe
Size 31.8MB
Sample260808-1vnlhsfe85
SHA256 5b66855b96edf996d990c343867829bc6e81a401c94d91d6083f858a06a81d66
MD5 55c32fe519d5ec6236b72c1f62b16821
SHA1 424d3b5aec15d368ec1c1d3ebf48de5797675177
SHA512 7f348ef7e4ba8357b88c3a83db80aa4cfad2d3dc9a60eba3f9e3ad4b35b70500b51ace4a0aed5fbcbfa498ed40740e1ffe99a9b4226ebc8058246936d88ef0f6
SSDEEP 196608:noo90CFHS3hVvAkCPIqpM8R4ripPK5kWObAbN03qDtIsL7s32vrbObyUIBsPVs:H90CIfoINs4SmtIAO3AIsL7s3GbObw
TLSH
T11D778C0AA3D88621D37B877986765206D672BC266311D7CF268CFA4D1F737C1C9B2623
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware discovery persistence spyware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
90	1700	msedge.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	windowsdesktop-runtime-10.0.10-win-x64.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	windowsdesktop-runtime-10.0.10-win-x64.exe

Executes dropped EXE 7 IoCs

pid	Process
2944	windowsdesktop-runtime-10.0.10-win-x64.exe
2772	wixstdba.exe
2920	windowsdesktop-runtime-10.0.10-win-x64.exe
1952	windowsdesktop-runtime-10.0.10-win-x64.exe
3236	windowsdesktop-runtime-10.0.10-win-x64.exe
5772	wixstdba.exe
652	windowsdesktop-runtime-10.0.10-win-x64.exe

Loads dropped DLL 12 IoCs

pid	Process
5304	MsiExec.exe
5304	MsiExec.exe
5720	MsiExec.exe
5720	MsiExec.exe
5992	MsiExec.exe
5992	MsiExec.exe
5684	MsiExec.exe
5684	MsiExec.exe
5132	MsiExec.exe
5132	MsiExec.exe
5300	MsiExec.exe
5300	MsiExec.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{866BECDA-F284-473A-9E84-0CCE816BF06F} = "\"C:\\ProgramData\\Package Cache\\{866BECDA-F284-473A-9E84-0CCE816BF06F}\\windowsdesktop-runtime-10.0.10-win-x64.exe\" /burn.runonce"	windowsdesktop-runtime-10.0.10-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{866BECDA-F284-473A-9E84-0CCE816BF06F} = "\"C:\\ProgramData\\Package Cache\\{866BECDA-F284-473A-9E84-0CCE816BF06F}\\windowsdesktop-runtime-10.0.10-win-x64.exe\" /burn.runonce"	windowsdesktop-runtime-10.0.10-win-x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Diagnostics.FileVersionInfo.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\ru\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Xml.XmlDocument.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\es\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\tr\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\ThirdPartyNotices.txt	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Net.Quic.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.ObjectModel.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Runtime.InteropServices.RuntimeInformation.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\Microsoft.VisualBasic.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\ja\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\pt-BR\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\ru\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Drawing.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\PenImc_cor3.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\cs\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\it\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Resources.Reader.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\PresentationFramework.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\tr\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\zh-Hant\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\System.Windows.Forms.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\ko\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\ko\UIAutomationTypes.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Xml.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\UIAutomationClientSideProviders.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\zh-Hant\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\System.Security.Cryptography.Pkcs.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\System.Security.Permissions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\System.Windows.Extensions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Diagnostics.Tools.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Threading.Channels.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\zh-Hans\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\System.Formats.Nrbf.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\de\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\ko\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Reflection.TypeExtensions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Diagnostics.Contracts.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.IO.FileSystem.DriveInfo.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\System.Printing.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.IO.Pipes.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Security.Cryptography.OpenSsl.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Security.Cryptography.X509Certificates.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Xml.XPath.XDocument.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\Microsoft.NETCore.App.runtimeconfig.json	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Net.Requests.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\cs\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\de\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\es\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\pt-BR\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\System.Resources.Extensions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\ko\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\ru\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.IO.MemoryMappedFiles.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Threading.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\PresentationFramework.Fluent.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\System.Drawing.Design.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Data.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\System.Windows.Input.Manipulations.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\it\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\pt-BR\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.IO.Compression.Native.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.IO.Pipes.AccessControl.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\tr\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe

Drops file in Windows directory 41 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e58a0d5.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC3B0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID6CC.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI15FB.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2235.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e58a0d6.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID4A9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1E6B.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{8A8CC49F-7D1E-45DC-B7B5-35FF61A2C25E}	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1	msiexec.exe
File created	C:\Windows\Installer\SourceHash{F0BCFB2E-4878-4F6E-BD5D-3ABFF264829E}	msiexec.exe
File opened for modification	C:\Windows\Installer\e58a0db.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAE2E.tmp	msiexec.exe
File created	C:\Windows\Installer\e58a0d6.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB6AE.tmp	msiexec.exe
File created	C:\Windows\Installer\e58a0e0.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1CD3.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1C46.tmp	msiexec.exe
File created	C:\Windows\Installer\e58a0cf.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{DA493AF2-5A21-4D85-BB57-757D7525EB73}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDAD5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA7B5.tmp	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149\fileCoreHostExe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB526.tmp	msiexec.exe
File created	C:\Windows\Installer\e58a0da.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{441FCDB0-A03A-4130-A1D5-FFD8C53CFF6B}	msiexec.exe
File created	C:\Windows\Installer\e58a0df.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE620.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC073.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e58a0cf.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB1C9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB43B.tmp	msiexec.exe
File created	C:\Windows\Installer\e58a0db.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e58a0e0.msi	msiexec.exe
File created	C:\Windows\Installer\e58a0e4.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI21B7.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149\fileCoreHostExe	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.10-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wixstdba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.10-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.10-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.10-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wixstdba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.10-win-x64.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1700	msedge.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Software\Microsoft\Internet Explorer\TypedURLs	taskmgr.exe

Modifies data under HKEY_USERS 16 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2B\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2d	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134306999455718225"	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2C	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E2BFCB0F8784E6F4DBD5A3FB2F4628E9\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{F0BCFB2E-4878-4F6E-BD5D-3ABFF264829E}v80.40.55332\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F94CC8A8E1D7CD547B5B53FF162A2CE5\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F94CC8A8E1D7CD547B5B53FF162A2CE5\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{8A8CC49F-7D1E-45DC-B7B5-35FF61A2C25E}v80.40.55332\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.40.55332_x64\Version = "80.40.55332"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2FA394AD12A558D4BB7557D75752BE37\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{DA493AF2-5A21-4D85-BB57-757D7525EB73}v80.40.55332\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_80.40.55332_x64\Dependents\{866BECDA-F284-473A-9E84-0CCE816BF06F}	windowsdesktop-runtime-10.0.10-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F94CC8A8E1D7CD547B5B53FF162A2CE5\Provider	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F94CC8A8E1D7CD547B5B53FF162A2CE5\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2FA394AD12A558D4BB7557D75752BE37\MainFeature	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\5D9ADA2B34E5318566B5BBB43BFD9EF6	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2FA394AD12A558D4BB7557D75752BE37\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E2BFCB0F8784E6F4DBD5A3FB2F4628E9	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2FA394AD12A558D4BB7557D75752BE37\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0BDCF144A30A03141A5DFF8D5CC3FFB6\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E2BFCB0F8784E6F4DBD5A3FB2F4628E9\ProductName = "Microsoft Windows Desktop Runtime - 10.0.10 (x64)"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E2BFCB0F8784E6F4DBD5A3FB2F4628E9\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E2BFCB0F8784E6F4DBD5A3FB2F4628E9\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_80.40.55332_x64\Dependents\{866BECDA-F284-473A-9E84-0CCE816BF06F}	windowsdesktop-runtime-10.0.10-win-x64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x64	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F94CC8A8E1D7CD547B5B53FF162A2CE5\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_80.40.55332_x64\Version = "80.40.55332"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E2BFCB0F8784E6F4DBD5A3FB2F4628E9\MainFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{866BECDA-F284-473A-9E84-0CCE816BF06F}\Version = "10.0.10.50000"	windowsdesktop-runtime-10.0.10-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2FA394AD12A558D4BB7557D75752BE37\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{DA493AF2-5A21-4D85-BB57-757D7525EB73}v80.40.55332\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.40.55332_x64\Dependents\{866BECDA-F284-473A-9E84-0CCE816BF06F}	windowsdesktop-runtime-10.0.10-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\0BDCF144A30A03141A5DFF8D5CC3FFB6\Provider	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0BDCF144A30A03141A5DFF8D5CC3FFB6\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0BDCF144A30A03141A5DFF8D5CC3FFB6\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E2BFCB0F8784E6F4DBD5A3FB2F4628E9\PackageCode = "FE4ED37A1EA6D14448ACD5426BC2F2A1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x64\DisplayName = "Microsoft .NET Host - 10.0.10 (x64)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_80.40.55332_x64\Version = "80.40.55332"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E2BFCB0F8784E6F4DBD5A3FB2F4628E9\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{866BECDA-F284-473A-9E84-0CCE816BF06F}\DisplayName = "Microsoft Windows Desktop Runtime 10.0.10 (x64)"	windowsdesktop-runtime-10.0.10-win-x64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\windowsdesktop_runtime_80.40.55332_x64	windowsdesktop-runtime-10.0.10-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.40.55332_x64\DisplayName = "Microsoft .NET Host FX Resolver - 10.0.10 (x64)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\9309C9E278150CC5452917C0EA916C61\2FA394AD12A558D4BB7557D75752BE37	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2FA394AD12A558D4BB7557D75752BE37\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0BDCF144A30A03141A5DFF8D5CC3FFB6\ProductName = "Microsoft .NET Runtime - 10.0.10 (x64)"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E2BFCB0F8784E6F4DBD5A3FB2F4628E9\SourceList\Media	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F94CC8A8E1D7CD547B5B53FF162A2CE5\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E2BFCB0F8784E6F4DBD5A3FB2F4628E9\SourceList\PackageName = "windowsdesktop-runtime-10.0.10-win-x64.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.40.55332_x64	windowsdesktop-runtime-10.0.10-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F94CC8A8E1D7CD547B5B53FF162A2CE5	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F94CC8A8E1D7CD547B5B53FF162A2CE5\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2FA394AD12A558D4BB7557D75752BE37	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2FA394AD12A558D4BB7557D75752BE37\PackageCode = "BA29397271C91884FB92390B1C9257AB"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2FA394AD12A558D4BB7557D75752BE37\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0BDCF144A30A03141A5DFF8D5CC3FFB6\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{441FCDB0-A03A-4130-A1D5-FFD8C53CFF6B}v80.40.55332\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_80.40.55332_x64\Dependents	windowsdesktop-runtime-10.0.10-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x64\Version = "80.40.55332"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{866BECDA-F284-473A-9E84-0CCE816BF06F}\DisplayName = "Microsoft Windows Desktop Runtime 10.0.10 (x64)"	windowsdesktop-runtime-10.0.10-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x64\Dependents\{866BECDA-F284-473A-9E84-0CCE816BF06F}	windowsdesktop-runtime-10.0.10-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0BDCF144A30A03141A5DFF8D5CC3FFB6\SourceList\PackageName = "dotnet-runtime-10.0.10-win-x64.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{866BECDA-F284-473A-9E84-0CCE816BF06F}	windowsdesktop-runtime-10.0.10-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F94CC8A8E1D7CD547B5B53FF162A2CE5\Version = "1344854052"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F94CC8A8E1D7CD547B5B53FF162A2CE5\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2FA394AD12A558D4BB7557D75752BE37\Provider	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_80.40.55332_x64\DisplayName = "Microsoft .NET Runtime - 10.0.10 (x64)"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E2BFCB0F8784E6F4DBD5A3FB2F4628E9\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.40.55332_x64\ = "{DA493AF2-5A21-4D85-BB57-757D7525EB73}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2FA394AD12A558D4BB7557D75752BE37\SourceList\PackageName = "dotnet-hostfxr-10.0.10-win-x64.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\0BDCF144A30A03141A5DFF8D5CC3FFB6\MainFeature	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0BDCF144A30A03141A5DFF8D5CC3FFB6\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x64	windowsdesktop-runtime-10.0.10-win-x64.exe

Suspicious behavior: EnumeratesProcesses 45 IoCs

pid	Process
4028	msiexec.exe
4028	msiexec.exe
4028	msiexec.exe
4028	msiexec.exe
4028	msiexec.exe
4028	msiexec.exe
4028	msiexec.exe
4028	msiexec.exe
4028	msiexec.exe
4028	msiexec.exe
4028	msiexec.exe
4028	msiexec.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2920	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeIncreaseQuotaPrivilege	2920	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeSecurityPrivilege	4028	msiexec.exe
Token: SeCreateTokenPrivilege	2920	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeAssignPrimaryTokenPrivilege	2920	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeLockMemoryPrivilege	2920	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeIncreaseQuotaPrivilege	2920	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeMachineAccountPrivilege	2920	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeTcbPrivilege	2920	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeSecurityPrivilege	2920	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeTakeOwnershipPrivilege	2920	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeLoadDriverPrivilege	2920	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeSystemProfilePrivilege	2920	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeSystemtimePrivilege	2920	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeProfSingleProcessPrivilege	2920	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeIncBasePriorityPrivilege	2920	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeCreatePagefilePrivilege	2920	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeCreatePermanentPrivilege	2920	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeBackupPrivilege	2920	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeRestorePrivilege	2920	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeShutdownPrivilege	2920	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeDebugPrivilege	2920	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeAuditPrivilege	2920	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeSystemEnvironmentPrivilege	2920	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeChangeNotifyPrivilege	2920	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeRemoteShutdownPrivilege	2920	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeUndockPrivilege	2920	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeSyncAgentPrivilege	2920	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeEnableDelegationPrivilege	2920	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeManageVolumePrivilege	2920	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeImpersonatePrivilege	2920	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeCreateGlobalPrivilege	2920	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeRestorePrivilege	4028	msiexec.exe
Token: SeTakeOwnershipPrivilege	4028	msiexec.exe
Token: SeRestorePrivilege	4028	msiexec.exe
Token: SeTakeOwnershipPrivilege	4028	msiexec.exe
Token: SeRestorePrivilege	4028	msiexec.exe
Token: SeTakeOwnershipPrivilege	4028	msiexec.exe
Token: SeRestorePrivilege	4028	msiexec.exe
Token: SeTakeOwnershipPrivilege	4028	msiexec.exe
Token: SeRestorePrivilege	4028	msiexec.exe
Token: SeTakeOwnershipPrivilege	4028	msiexec.exe
Token: SeRestorePrivilege	4028	msiexec.exe
Token: SeTakeOwnershipPrivilege	4028	msiexec.exe
Token: SeRestorePrivilege	4028	msiexec.exe
Token: SeTakeOwnershipPrivilege	4028	msiexec.exe
Token: SeRestorePrivilege	4028	msiexec.exe
Token: SeTakeOwnershipPrivilege	4028	msiexec.exe
Token: SeRestorePrivilege	4028	msiexec.exe
Token: SeTakeOwnershipPrivilege	4028	msiexec.exe
Token: SeRestorePrivilege	4028	msiexec.exe
Token: SeTakeOwnershipPrivilege	4028	msiexec.exe
Token: SeRestorePrivilege	4028	msiexec.exe
Token: SeTakeOwnershipPrivilege	4028	msiexec.exe
Token: SeRestorePrivilege	4028	msiexec.exe
Token: SeTakeOwnershipPrivilege	4028	msiexec.exe
Token: SeRestorePrivilege	4028	msiexec.exe
Token: SeTakeOwnershipPrivilege	4028	msiexec.exe
Token: SeRestorePrivilege	4028	msiexec.exe
Token: SeTakeOwnershipPrivilege	4028	msiexec.exe
Token: SeRestorePrivilege	4028	msiexec.exe
Token: SeTakeOwnershipPrivilege	4028	msiexec.exe
Token: SeRestorePrivilege	4028	msiexec.exe
Token: SeTakeOwnershipPrivilege	4028	msiexec.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2772	wixstdba.exe
2772	wixstdba.exe
5772	wixstdba.exe
2392	msedge.exe
5772	wixstdba.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe

Suspicious use of SendNotifyMessage 59 IoCs

pid	Process
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4700 wrote to memory of 2392	4700	Voidstrap.exe	85
PID 2392 wrote to memory of 4448	2392	msedge.exe	86
PID 2392 wrote to memory of 1700	2392	msedge.exe	87
PID 2392 wrote to memory of 2184	2392	msedge.exe	88
PID 2392 wrote to memory of 2184	2392	msedge.exe	88
PID 2392 wrote to memory of 2184	2392	msedge.exe	88
PID 2392 wrote to memory of 3128	2392	msedge.exe	89
PID 2392 wrote to memory of 3128	2392	msedge.exe	89
PID 2392 wrote to memory of 2736	2392	msedge.exe	90
PID 2392 wrote to memory of 2716	2392	msedge.exe	91
PID 2392 wrote to memory of 2736	2392	msedge.exe	90
PID 2392 wrote to memory of 2736	2392	msedge.exe	90
PID 2392 wrote to memory of 2716	2392	msedge.exe	91
PID 2392 wrote to memory of 2716	2392	msedge.exe	91
PID 2392 wrote to memory of 3716	2392	msedge.exe	92
PID 2392 wrote to memory of 3716	2392	msedge.exe	92
PID 2392 wrote to memory of 3716	2392	msedge.exe	92
PID 2392 wrote to memory of 3832	2392	msedge.exe	93
PID 2392 wrote to memory of 3832	2392	msedge.exe	93
PID 2392 wrote to memory of 3832	2392	msedge.exe	93
PID 2392 wrote to memory of 1872	2392	msedge.exe	97
PID 2392 wrote to memory of 1872	2392	msedge.exe	97
PID 2392 wrote to memory of 3780	2392	msedge.exe	98
PID 2392 wrote to memory of 3780	2392	msedge.exe	98
PID 2392 wrote to memory of 1092	2392	msedge.exe	100
PID 2392 wrote to memory of 1092	2392	msedge.exe	100
PID 2392 wrote to memory of 1092	2392	msedge.exe	100
PID 2392 wrote to memory of 4816	2392	msedge.exe	101
PID 2392 wrote to memory of 1428	2392	msedge.exe	102
PID 2392 wrote to memory of 4816	2392	msedge.exe	101
PID 2392 wrote to memory of 1428	2392	msedge.exe	102
PID 2392 wrote to memory of 1188	2392	msedge.exe	104
PID 2392 wrote to memory of 4744	2392	msedge.exe	105
PID 2392 wrote to memory of 4744	2392	msedge.exe	105
PID 2392 wrote to memory of 4496	2392	msedge.exe	106
PID 2392 wrote to memory of 4496	2392	msedge.exe	106
PID 2392 wrote to memory of 3112	2392	msedge.exe	107
PID 2392 wrote to memory of 1108	2392	msedge.exe	110
PID 2392 wrote to memory of 3112	2392	msedge.exe	107
PID 2392 wrote to memory of 1108	2392	msedge.exe	110
PID 2392 wrote to memory of 1004	2392	msedge.exe	109
PID 2392 wrote to memory of 1004	2392	msedge.exe	109
PID 2392 wrote to memory of 1108	2392	msedge.exe	110
PID 2392 wrote to memory of 1108	2392	msedge.exe	110
PID 2392 wrote to memory of 3940	2392	msedge.exe	111
PID 2392 wrote to memory of 3940	2392	msedge.exe	111
PID 2392 wrote to memory of 3940	2392	msedge.exe	111
PID 2392 wrote to memory of 1724	2392	msedge.exe	112
PID 2392 wrote to memory of 2944	2392	msedge.exe	120
PID 2944 wrote to memory of 2772	2944	windowsdesktop-runtime-10.0.10-win-x64.exe	122
PID 2944 wrote to memory of 2920	2944	windowsdesktop-runtime-10.0.10-win-x64.exe	125
PID 1952 wrote to memory of 3236	1952	windowsdesktop-runtime-10.0.10-win-x64.exe	129
PID 4028 wrote to memory of 5304	4028	msiexec.exe	131
PID 2392 wrote to memory of 5444	2392	msedge.exe	132
PID 2392 wrote to memory of 5452	2392	msedge.exe	133
PID 2392 wrote to memory of 5460	2392	msedge.exe	134
PID 4028 wrote to memory of 5720	4028	msiexec.exe	135
PID 3236 wrote to memory of 5772	3236	windowsdesktop-runtime-10.0.10-win-x64.exe	136
PID 4028 wrote to memory of 5992	4028	msiexec.exe	137
PID 2392 wrote to memory of 6036	2392	msedge.exe	138
PID 2392 wrote to memory of 6036	2392	msedge.exe	138
PID 4028 wrote to memory of 5684	4028	msiexec.exe	139
PID 3236 wrote to memory of 652	3236	windowsdesktop-runtime-10.0.10-win-x64.exe	142
PID 4028 wrote to memory of 5132	4028	msiexec.exe	143

C:\Users\Admin\AppData\Local\Temp\Voidstrap.exe
"C:\Users\Admin\AppData\Local\Temp\Voidstrap.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.NETCore.App&framework_version=10.0.0&arch=x64&rid=win-x64&os=win10&gui=true
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2ec,0x7ffe6e01c188,0x7ffe6e01c194,0x7ffe6e01c1a0
    3⤵
    PID:4448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1972,i,9864195179075944425,6438836100947389359,524288 --field-trial-handle=2168,i,2244077180139515805,8821646690319504355,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:3
    3⤵
    - Downloads MZ/PE file
    - System Time Discovery
    PID:1700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1772,i,9310813175703271370,13085318351317310415,262144 --field-trial-handle=2168,i,2244077180139515805,8821646690319504355,262144 --variations-seed-version --mojo-platform-channel-handle=2164 /prefetch:2
    3⤵
    PID:2184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2588,i,8011645880353279789,13837773553189301656,524288 --field-trial-handle=2168,i,2244077180139515805,8821646690319504355,262144 --variations-seed-version --mojo-platform-channel-handle=2744 /prefetch:8
    3⤵
    PID:3128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,7033091008023255823,8984366338128930395,2097152 --field-trial-handle=2168,i,2244077180139515805,8821646690319504355,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
    3⤵
    PID:2736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,534612220106269878,6850705646030758468,2097152 --field-trial-handle=2168,i,2244077180139515805,8821646690319504355,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
    3⤵
    PID:2716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4220,i,7056648974556244170,10193521725073458827,2097152 --field-trial-handle=2168,i,2244077180139515805,8821646690319504355,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:1
    3⤵
    PID:3716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4256,i,4899011956588664460,8289370873692710427,2097152 --field-trial-handle=2168,i,2244077180139515805,8821646690319504355,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:2
    3⤵
    PID:3832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3616,i,5650042802744207603,485517156235516642,524288 --field-trial-handle=2168,i,2244077180139515805,8821646690319504355,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:8
    3⤵
    PID:1872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5252,i,16247385052795122378,14171296232723074744,524288 --field-trial-handle=2168,i,2244077180139515805,8821646690319504355,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:8
    3⤵
    PID:3780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5244,i,15442783549468384987,14884139390136715767,2097152 --field-trial-handle=2168,i,2244077180139515805,8821646690319504355,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:1
    3⤵
    PID:1092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3608,i,13423560182596722691,2145970128205152481,524288 --field-trial-handle=2168,i,2244077180139515805,8821646690319504355,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:8
    3⤵
    PID:4816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3484,i,15564399729075220499,9008922616240935724,524288 --field-trial-handle=2168,i,2244077180139515805,8821646690319504355,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:8
    3⤵
    PID:1428
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,14608865198036843277,6582888632314324629,524288 --field-trial-handle=2168,i,2244077180139515805,8821646690319504355,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
    3⤵
    PID:3380
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,14608865198036843277,6582888632314324629,524288 --field-trial-handle=2168,i,2244077180139515805,8821646690319504355,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
    3⤵
    PID:1188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,14101608951933270908,14343012989597317770,524288 --field-trial-handle=2168,i,2244077180139515805,8821646690319504355,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:8
    3⤵
    PID:4744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6272,i,1208886329389659944,17515231987843648322,524288 --field-trial-handle=2168,i,2244077180139515805,8821646690319504355,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:8
    3⤵
    PID:4496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6188,i,5159642084935130655,7732163997208061528,524288 --field-trial-handle=2168,i,2244077180139515805,8821646690319504355,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:8
    3⤵
    PID:3112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6164,i,12859385167568376046,10842408878715313262,524288 --field-trial-handle=2168,i,2244077180139515805,8821646690319504355,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:8
    3⤵
    PID:1108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,10114647145155019590,5460023941237839372,524288 --field-trial-handle=2168,i,2244077180139515805,8821646690319504355,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:8
    3⤵
    PID:1004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6712,i,18353284923889447459,3529122814525708449,524288 --field-trial-handle=2168,i,2244077180139515805,8821646690319504355,262144 --variations-seed-version --mojo-platform-channel-handle=6720 /prefetch:8
    3⤵
    PID:1108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6716,i,11381360486153624977,5597358634979698630,2097152 --field-trial-handle=2168,i,2244077180139515805,8821646690319504355,262144 --variations-seed-version --mojo-platform-channel-handle=6736 /prefetch:1
    3⤵
    PID:3940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7088,i,11141492454220247252,5876845106417235491,524288 --field-trial-handle=2168,i,2244077180139515805,8821646690319504355,262144 --variations-seed-version --mojo-platform-channel-handle=7100 /prefetch:8
    3⤵
    PID:1724
- - C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.10-win-x64.exe
    "C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.10-win-x64.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2944
  - - C:\Windows\TEMP\{17F76D5D-D515-4DB7-A402-E799BE3E4171}\.ba\wixstdba.exe
      "C:\Windows\TEMP\{17F76D5D-D515-4DB7-A402-E799BE3E4171}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{7545C7B5-A3C9-466D-AA8E-3621799903DB} {7D9085C3-1BF2-4F8D-8ABC-07C7FC040337}
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      PID:2772
  - - C:\Windows\TEMP\{17F76D5D-D515-4DB7-A402-E799BE3E4171}\.be\windowsdesktop-runtime-10.0.10-win-x64.exe
      "C:\Windows\TEMP\{17F76D5D-D515-4DB7-A402-E799BE3E4171}\.be\windowsdesktop-runtime-10.0.10-win-x64.exe" -q -burn.elevated BurnPipe.{0F24F7AE-687D-44A7-A4DE-6E9A320CC094} {2C1787AD-A438-4355-B7E2-B7B769480C8E} 2944
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      PID:2920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,7676968049332225156,6154944636092885590,524288 --field-trial-handle=2168,i,2244077180139515805,8821646690319504355,262144 --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:8
    3⤵
    PID:5444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5956,i,12130145054151874524,10131394342961313684,524288 --field-trial-handle=2168,i,2244077180139515805,8821646690319504355,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:8
    3⤵
    PID:5452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4532,i,18016028958474733910,4688433180815127288,524288 --field-trial-handle=2168,i,2244077180139515805,8821646690319504355,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:8
    3⤵
    PID:5460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3484,i,7661247781098250546,13024953386035578623,524288 --field-trial-handle=2168,i,2244077180139515805,8821646690319504355,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:8
    3⤵
    PID:6036

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2824

C:\ProgramData\Package Cache\{866BECDA-F284-473A-9E84-0CCE816BF06F}\windowsdesktop-runtime-10.0.10-win-x64.exe
"C:\ProgramData\Package Cache\{866BECDA-F284-473A-9E84-0CCE816BF06F}\windowsdesktop-runtime-10.0.10-win-x64.exe" /burn.runonce
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1952
- C:\ProgramData\Package Cache\{866BECDA-F284-473A-9E84-0CCE816BF06F}\windowsdesktop-runtime-10.0.10-win-x64.exe
  "C:\ProgramData\Package Cache\{866BECDA-F284-473A-9E84-0CCE816BF06F}\windowsdesktop-runtime-10.0.10-win-x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.10_(x64)_20260808225922.log"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3236
- - C:\Windows\TEMP\{D68D736F-9ABC-4D93-AB1B-07D44D02E4D3}\.ba\wixstdba.exe
    "C:\Windows\TEMP\{D68D736F-9ABC-4D93-AB1B-07D44D02E4D3}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{4D8099C8-0A46-484F-89ED-BA74CA273898} {0C7C93C5-6172-411C-A824-626F085BB269}
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:5772
- - C:\ProgramData\Package Cache\{866BECDA-F284-473A-9E84-0CCE816BF06F}\windowsdesktop-runtime-10.0.10-win-x64.exe
    "C:\ProgramData\Package Cache\{866BECDA-F284-473A-9E84-0CCE816BF06F}\windowsdesktop-runtime-10.0.10-win-x64.exe" -q -burn.elevated BurnPipe.{F77EF7F1-EA39-4CED-B058-0318D6CB28C8} {DF76FF3C-C490-4492-95E7-1A6C27F3FFFF} 3236
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:652

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4028
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 12EEF15559DF6BBCE646C756DB37F56F
  2⤵
  - Loads dropped DLL
  PID:5304
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 5B5589E4D0E3A992D8BA2F7A79C0F799
  2⤵
  - Loads dropped DLL
  PID:5720
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 3460D4184CEAA1CB7CF7638DF2AE00CD
  2⤵
  - Loads dropped DLL
  PID:5992
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 1E4B21E2A0C0185044E7BB7FEF0BA064
  2⤵
  - Loads dropped DLL
  PID:5684
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding E416B83E6F8E9A9BF84A4DB2C1386756
  2⤵
  - Loads dropped DLL
  PID:5132
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 74200341816BBDAF042A85477393D396
  2⤵
  - Loads dropped DLL
  PID:5300

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:6028

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e58a0d2.rbs

Path C:\Config.Msi\e58a0d2.rbs
Size 11KB
SHA256 e2173a1866c7b9037811d3c643b415597f15a03c1bdc4b811536dfc896d847a2
MD5 e60201643becdbe78138433089c8ccf0
SHA1 4546f8a2f2d3b135144b28aac6e449652ec78c70
SHA512 d8a111221e9eb4cec661d852ccfbee3ba36044e93f1a3cef7c9908c0b7e8c61c9a4e858f3f56d148ac5b23c341624cf983e412cf26df22414ae5127f9a9338ae
SSDEEP 192:nrKHCR6Cbftz5HhAl/ecxrZRI1rZRl1E+o5Ca35pbM:nrKHCR6Cbtz5HKPrZorZ9aM
TLSH
T1363242416614D2D7E9DB2B38D71727703B73D3AA9314665F05CCC22C4F8B7884E68AAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58a0d9.rbs

Path C:\Config.Msi\e58a0d9.rbs
Size 9KB
SHA256 6c585310157a35dfcd8bdd55999989c29b2671543ecf787d565a0cab570baabd
MD5 b3928455f3204336d8bfc91df0662712
SHA1 d1dd385c092ef0fbd6f0beb0bca8f4c8c1348fd5
SHA512 a3f3c61f36a97a2b85616b0bd61aa0ce46b03ff5cc5cb79b36093e48623d39dcd234dca80508e512efa93662830a84a09b3ebb0e6b5f8eac8b50a36ca70004fb
SSDEEP 96:FmSDTTClrWS/eS1FeUrUeD2AyCsTlyyUrUeD2AyC6jMlN8gnuTlyfnAP7E5d7P/i:ICnSFeWxrVRIIrVRP017EbnKCCi5pu3
TLSH
T1CA120F12750081E2E9921B39C6173B223BBAD3D99315265F48CDF9F41E03BD52FA91DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58a0de.rbs

Path C:\Config.Msi\e58a0de.rbs
Size 49KB
SHA256 e533fe5ef79b58c715aae66e5903150551b8b94f1f66cf7f364d89faeb6a2e6d
MD5 e4674c865005a83fdd5e5853e36b6a68
SHA1 32325eb6a4220757502f5f393a50334643a0157d
SHA512 d3ef5a2ee25c458af790882d45d51cfd2998067c595fdf70b247a30d14dfe4e9cd4ef4111dd4479a18b6a09127f13525088ec728a07d33f9218d3304dcc5e796
SSDEEP 1536:mHZgOohW4wN5RaHB/LyM/ajqmuUHr92ha8u3tn2N8zRM9Wc/hihbZGXEpp4IQPDi:TNgeE+kD
TLSH
T13D335461DB08C0F2F9333DA26770F8847719C99AE34095AD16D60144CEA6EEEDEBD1E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58a0e3.rbs

Path C:\Config.Msi\e58a0e3.rbs
Size 71KB
SHA256 b592170092e58c9047d450f3cec7e4d5f927941a251fb4e21234c5f428a1da74
MD5 d4a35207b23a239f13528925a136a063
SHA1 2237f22901f8f01c4f9e661dee95d6e1c0679003
SHA512 387253771cac2db3fe205874b5f2de7a3198c714b74fbd6ef210b7601794ba976025629f4f185e1adefb4fe31e76f2c272d2c2558d5104067e114a236765c17c
SSDEEP 1536:ZlTX+EvElgJPlhUR+6svby5ybcmb/WrPMmq0mgG2WdDfbH9cMWmHDCaJVZ/KoLHH:Fu2z+LmEEiycECCoeW4
TLSH
T14D6325BA7A14D1C1BC732DD457BBE916AD054C7393608D2E63CC4029CDD2A86EFB86E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58a0e7.rbs

Path C:\Config.Msi\e58a0e7.rbs
Size 3KB
SHA256 41f22dcff8eef592d1c40db11d0c9ff58c485bf83b8aa7a5673a329aa5b81371
MD5 622324564d80c5687b0b900ce107310a
SHA1 57266f4d782e75db231af3f40c8d9f48184db47a
SHA512 1d2fbe8a1f585ddc280623dccf14fb85ae14565a75f79349bef4f53a07873ef4891e8341b31bb3235eecb8a9851f74c2d7e52b248197146938cc7f5848898bc9
TLSH
T15C715843D604C6D3EDA22B31DD271B50377BD6DAD315438B04CC91701E57BD69EEA28A
MD5 SHA1 SHA512 TLSH

Submit Download

e58a0ea.rbs

Path C:\Config.Msi\e58a0ea.rbs
Size 3KB
SHA256 b292e5abf7b9dce353d74a34c2f264bd98574aa098e4f4cc8cbc6bfbae37e55f
MD5 61f3a5a973605c9f075876c6d41be94c
SHA1 ad4b48ccab968183dfead226a751b1bee3a3862c
SHA512 a6e7c7c7a11d5eb7289fad5974a038bf4ed335aa4bfb1e623039a8f5576fa0f96a821c378122692b5092cfb0a3de39e8e48cdce3b60e7ce28f81e31e2f62757e
TLSH
T12B81AD03AA04E6D3ECE31B30CD5B17233777C6E69361474B45CC81741E87B89AEE9689
MD5 SHA1 SHA512 TLSH

Submit Download

ThirdPartyNotices.txt

Path C:\Program Files\dotnet\ThirdPartyNotices.txt
Size 77KB
SHA256 deb4427a295e1ed474b0d81c5a0d972c1b550b9a715cda939cdfa9236b1b418f
MD5 0d8867a25ba926e6e40cd52ab3536b5c
SHA1 89390dc8b8318d0bfef1c6a2fb4783537e28a465
SHA512 317ca335405274f4f91b173651ca2826760acb5ba5cf41aff51adc55c2cda9059fb268333665f13f62fa48119e55a303720a780dd58d28dd9967db4c88407d61
SSDEEP 1536:HA9jHwsGfgg39/zwgAVkguQxrDjugtSEGepkWvrpX7anuqdLSVnfiStPq+3LefrL:HA97w/ogz1AVxuMjHtSFULryLOgrGWm+
TLSH
T17773A45F7E45077319E2C3916569A8C5F22FA02E3B6B2A44346EF248133B42DD6FF858
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 163KB
SHA256 4377f10c78400f0370b88156773de9843c07f14e65b3232005ec3179ef38d463
MD5 363603c51aa522bf21b2e8320a51c54e
SHA1 b4dba9e0d47c9fd4636549d5a23fe1a96faf9b1f
SHA512 b2b045ad8538416bd81753359ca86ba956f2ac99befeb89c7c03993741411703e03f4373d11cb94992cb93ed569d6741954111f4ad519daebcb18138800877ce
SSDEEP 3072:oGgPYwruvTSBbQ/fp4SbDqIG/vk7l55wK9vLPg:oG4rubgbQpDvqIbt10
TLSH
T1A6F3F61AD65811AAD06E9575CB428941BB337C668BE0E3CB53C0F9BE0F726905EF9703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

state.rsm

Path C:\ProgramData\Package Cache\{866BECDA-F284-473A-9E84-0CCE816BF06F}\state.rsm
Size 1KB
SHA256 b6e130620798f7bd39306cfbc54f351c279631f45fbd737ce808a23cae1ed732
MD5 4cc167ee5e80c908f3cec20447c9e1c6
SHA1 da9a58fa7558f93c2d9a332255b892eabbf1d56f
SHA512 24ad1747636e8100341677bdd1dc3cc29a3722aa47797be0284996f908f4c7e83255d72063dee7528eae646fb148d4b9b6fc5194212c6bd600ff7a418a8b6984
TLSH
T18321D1515BF6092CF3F6AB3469F96665443BBC121C24C26E0001318A9E32BD0CCB0B37
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c756e7f0173c2e46dad26d72efbfb0a42b35deefa8d8ed2308e4410b46b600ee
MD5 509bff51589c8be5e43f296423d20aac
SHA1 bd50ef22bf1362528eb591a13feb31f3231bdc04
SHA512 0a6364f7f6dcf2e0b00fd8e5b79f4583839b1b3e47f62102d14f4cf4f19c507ca7d7aa64e2f107b5f954db5341186688dd1fa2c0c0a1fc1e46de166184e5949d
TLSH
T1ACD02370B53577D2D21F007D44706B015515817772B7B7517166680DDF70085F1DF9E5
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e2b315c59b1bfe8e547b0017a92548af7c81e08409e987a2628ad74667b4fec
MD5 7ab616f55807e9de5195a40c50f65e5b
SHA1 917a7797f800e5f30a1b9b8125127968246d7ce9
SHA512 da10f29803a072f42a2c102da0bee745cf1b1d47836e3d30e38b1e66beeb1abeaf2eb47b6c07b23682098f70fe2a4b29a0777eefa1380d0fff2509ff32d9b356
TLSH
T171D08023771D7182F35B41759053D7025A1680756463B701B325D41C9A740C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b976ac8901ffd41ec02a04aa583bc9d11350f0f9f714fb92d3341bb0bde4629f
MD5 504ce80b644a85a7e68d85bd24169289
SHA1 1f740a722dfa97fc8fb30626b0e3d6217e4a9864
SHA512 9406464a4f6becd85591c12af8a97fdecfa2208649138f347fb50d3e28f1583adec061050924fa0405e46eb75af7e299e6564c2ed039db9d82c50326da32a3c5
TLSH
T19ED08023371D7582F75B41759053D7025A1680756463F701B325D41C9A750C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 c49b9ba47379e1ed5666e4a7fd920ed38db8c0abb3b65a63114c5bf4a777a034
MD5 8824c2c1bb5abfe92723fd9f81f73575
SHA1 9ac7e70d542be57d64ab36ce17f65826cb816d29
SHA512 613dfa1a02e9aa7db45db57d94f15e584fcf65192c5be9937f1cf58930a190bbfdd99480211ea15060ba1915163985da16a7b294687e4413784062febb637b16
TLSH
T13C813E302206C06DD3A3C632B6E16EF3707540DAF65FAE7151946DB83482B92DD1D5E9
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b8eb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58b8eb.TMP
Size 3KB
SHA256 1172df4b69c0b0bca5c2a5e1317f3b7796f9607a38c8035e6a8ad36e63e8ce17
MD5 9e76c17ff8ec93e307607b0687493cf0
SHA1 40f76c20d0eef010cb7f6d52183cf5b2f5694e55
SHA512 f11b6d237bc8853f59a3fca7ced67cd182fa7f7540899616b3d3a2f71f74dbb12c27c40d4fdf671966c5aa74dbce60ed6a98a5fd6ddb34cf0cecd654d9ba12fc
TLSH
T17C713B302206C46DD3B3C23274E22EF3B07540CAF9AFAE7150A4AD783481B91AC1E9D9
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 f08a9cff7d252b114ff60117599dc6c1b8a40b769f80c7d29c5054aeda9145bf
MD5 90bc7c5b96d2ceefb1d3cb1524b2e77b
SHA1 bc878d4317fdbf08716385bfeeb731058beabcea
SHA512 0548d1385b4ce7ae39be3de3f3452f573af79f2f4b5cfdb717cd50a8e0b42b44ca4caf5689e49abb4e5938cfd0ac234d346708b424b7486b6527dfcc0d169ae1
SSDEEP 3:MsEllllkEthXllkl2zEklextl:/M/xT02znextl
TLSH
T1D74404047FC04405C70150704011C3510370D7500711574734511C535CC7540CC04000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 9d5b8f97fb3d618ca02cab463435af7d2b1dc8ebbf6e6717c8017ddf29dedbae
MD5 11b4618b82142e51e92341917b46b5f2
SHA1 c7709bbfafc77e23756e446d7cc27d67411f0b91
SHA512 d8d5f5466d7add439ffbdd3f76afac688e1133731a45a1ba557536c3c811784bcd0c04aee2144732e627281989b0eed71a7145ad6ef1548ea206a5f8f309d7ef
TLSH
T16451AFF783E4856E8A1196F0A618AE2FDF2D0615431C3C6A89D4EE27D3F3472E10265F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 1627d1b0998a4a85916f6bacd63d8e4740279c35048087028b442a76ee1bc9f3
MD5 ca7bc49a13b3b76cc080ad9403ddcf1a
SHA1 edc700ff13e809d7ce0aacc11cc9e4824820acb6
SHA512 6280e7056276b3d24c9fd467e5087081593eed2ffd7a4f87bb4b3ae778fbb9d61933fb67bdfdb726f6b16a986d82fb5a3180e841dcdda154953ec72dcafc91b7
SSDEEP 192:sxZ5RQyM/jK1Ml8Mzk/f+sLpJrKCIdpwJHW6+WNrGF/AaI2kSRIg4J:sxZ5qLk/f+sLpJWrcHbg/Fc
TLSH
T1F952F805AA34A977CCDBD20DFA457B53E6F50562A5804E449AFCDA1C04E6BED2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 d30262ed6c94b76297c5fd01082ab965b29d9e32a6523129856a2d2c75a3db86
MD5 adeaaabeaf6238d398d274e6ad2b990a
SHA1 2061a5f01a8714c2a76278e30e1005c689cea386
SHA512 c5aba7b0a1d37e53a1a745fc7335c36eae66b9ae14afbc8de1dd1fdce680122bc3c816d0bc4825d09e014a49eb7cfd1988a89654ea1fa2d4d92eaef601be4396
SSDEEP 192:sxZ5RQyM/jK1Ml8wmk/f+sqWpVkperKKIdpwJHW6+WN93GF/AaAD41F3IgbHJ:sxZ5qIk/f+sqWvkpeWDcHb6/oU9
TLSH
T18762E706AA34697BCCDBD20DFA457F53E6F9046295904E549AFCDA1C04E6BEC2203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 4e4209876404bafffeea58efe357c71aeed67b5fc29ca1663d64957abcfaeb1f
MD5 c59ef158fc02823cff79060b39998d11
SHA1 57b3e7c4fef1920bb2bbba0a3f145680c68c0eeb
SHA512 7fd0e5a8c8fa865869b049c463e19872eaab424cb0c55bc4bfb4dae9ce6412dc8c1c50dbc6a67e7f5404b44c451d779d880633f98539a6b6ded26d86cc0f9631
SSDEEP 192:sxZ5RQyM/jK1Ml8Mmk/f+s0pJrKCIdpwJHW6+WNrGF/AaI2kSRIg5pJ:sxZ5quk/f+s0pJWrcHbg/Fp
TLSH
T14352F905AA3469778CDBD20DFA457B53E6F5046291904E549AFCDA1C04E6BEC2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 93f6b641ac924b9345d1a9978640ea26909dac07cad2a735b892f32fc48c2da7
MD5 56e2a9353b6b02921b03563f057e60f7
SHA1 f785f320c983cad1169e41451d661656bea28141
SHA512 d9e6f6c500ba15048406f498160eb72c24d12ef396ef59099bbfe1996d4f7aa8c195b44e94802d34031395eea13fe14d171bdc83cb3d66554453282e30fd5da6
SSDEEP 768:NdsqxSo7pLuLfJlWvJD6T8F1+UoAYDCx9Tuqh0VfUC9xbog/OViX54Ll6AR9mroS:NdsqxSUEfJlWvJD6Tu1jaDX54LAs9dYV
TLSH
T178F20B3B6D0CCB7E4F804E9CED2A7E9A6DE8018B96D8C95447FA840C03C66EB15165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 ac94b4c1458d107215f2b4752b568624fe35817e1f94f8869f0088f22f93d996
MD5 0677002154638f6aa394b3aab3904c94
SHA1 ba2435ea138bc5228bb951f7da682dd4985c0ae4
SHA512 e9ca54f9647c8ea2f24f0e4b56ba3f2b2fc125d6b36d02cc6c000c311333544406c5dadb07f82cd7f034b4ee56ac95eadbac72fbe767d882ac5c168d725dd369
SSDEEP 96:KYbaKYIKGG0Kra2qyQKXqgPSKA0uSMAKhmKivQcigK:ExTjHOJzhivQcigK
TLSH
T109E19B16313A465239BE28A8B3A685771F4235633108B46F3FB840B54E6FE125DFC8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5b1bab1c1f81bde50573c09fcc7c176b5c1246599a18be5779ba7902af992e86
MD5 c0466d152c7a3a93603435462a3280f9
SHA1 a28919f3b774ca158ddc4cfd99014f0036f96c01
SHA512 d9e5ed40958c6215a61964c2ee1634f706046e548cff32853574dfb874d0f642543f2b1cfd8bf3b340fbef118035fe1c7d75fe13529c9a9e8c11a3c5e34f195a
SSDEEP 192:tONnd6JkRtQmiUyEoW+RNEOmAeR1h3PNRAU6:tONd6UrYW+RNEOzoP8U6
TLSH
T16D02E835AD386C7B9EF3AE0AB58B27175FE4207BA9856F80DAD81F0C01D765C1346836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 6de85d17eee8de4439ce5312a6b9c18aa6a1ad29cc7aa0635909b9a33ffe5c84
MD5 4d7e3f6e83780c592833f7346684955d
SHA1 b4a32a6c1a549bb8ce1dfb1a44a17982fa26b05f
SHA512 52241f4f2a09a716bf31372bd27438596f87b3228a14ca10f3c7c03498d26acc98a1ac8bf4c08c6757dbfbd3a30362cfc1ab192e40def4212446da8110892520
SSDEEP 192:uuaLsNEdQME6kRbmWQmiU1wyq4VRNEOmAeRi99a8SRPODqJ4jqCvZ:n4sNEdlE1bDR1VRNEOz/9aDPW3vZ
TLSH
T1F44238316C789C3759F7A109F6873743AEF820B799845F58D2D98F1C05CB69C230AD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 17KB
SHA256 fb3694f8db53f77de60a66178faef6283a72e4c480041596faa9f064359a98bb
MD5 df0c6198ab0558e48f806994d772bbfc
SHA1 e8f22d5dac89227d564f06c10d038acb51ee923c
SHA512 bb9c9b5c0cd9d28542e367dd90d1a540fd3f9f04502f50e044361fa47a5846d75c507f0f2d2a3775222e8100336e713abbc5786f8a5518d68858019c7c1248cc
SSDEEP 192:uuaB+xasuheOwQxMxsNEY7QME6kRbmEQmiU1wyq4VRNEOmAeRi99a8SRPODqJ4jn:n8ZcIGsNEklE1blR1VRNEOz/9aDPW3v7
TLSH
T1CA727B316C789C3769FBA009F98736135EF820B7A9C45F98D1E99F1D05CA69C170AC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2492a2da8c27de289fa429b0c51c9f1f17a563c98826dbd1f34afa2e7182db92
MD5 b6a75a406234b98a8dc80475de8ce3e6
SHA1 a0bebbdc269156441ea3015563bfe4fa2c7201f7
SHA512 a5ff486c120add77460d06901e6c1fe0cb0ac1f1f82200f15b25c4d4c60e7416b7c6c36657e565282fedaea7b965d3359399ad91dd3b1d2425c2d48eb21992d5
SSDEEP 192:UONV6JkRBQmiUy0oH+RNEOmAeRi99akVcPODqJ4U6:UONV6UfKH+RNEOz/9aTPWU6
TLSH
T1E61219357938AC375EE7A409F58733575EA820B7ED85AF80E1D44F1C01DBA9C270E826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 ef5b278150234a7947bdab6f4c206f6c2d37c1bf2fdf9ca40921634677fd2b81
MD5 e6fb153f551eaa039e45ac51e305b5fb
SHA1 bfdfcc3ac7a157e4685567caff765f55ff43aa2a
SHA512 0b5b6f1db16d31d7d255162a2a7ac91df5c1dd3af799fb442aca81ff48d61cb02c8c509a338935f90f63b6bd736c800d43c97a2142f223126e4e66e24ee3a5e1
SSDEEP 384:nVZcIGsNlklE1bjAt1VRNEOz/9a5W6vKASBN9/sH9VkcD3v7:tG1pbHEOj9a5ptSWH9vD3j
TLSH
T1ADB26CB0E8644CE744E6E5C9B686F5072DB80133C9898E1CE2F8BA3D349F5B81716C66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 17KB
SHA256 93e6b6a5db2de3b90930f032c651ea475b136b492f695f92c573864e16058cd5
MD5 79eaa094af125e8637e966e1f06111d4
SHA1 64be2118dd17b6589ca56579a76d7460e1a17164
SHA512 8d1abb3f0080d15c4818867fcf971e14ad53b26eadf67689bdbd7160d2e1de57876ab79c5bde7a5a411f468e76e64064e3d947b1cdb35954bd1ee3e586162a32
SSDEEP 192:uuVB+xasuheOwQxMxsNEY7QME6kRbmEQmiU1wyq4VRNEOmAeRi99a8SRPODqJ4jn:nFZcIGsNEklE1blR1VRNEOz/9aDPW3v7
TLSH
T15E726B316C789C3769FBA009F98736135EF820B7A9C45F94D1E99F1D04CA69C170AC3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a898959-81b4-49d9-96eb-a35116c41f6c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\5a898959-81b4-49d9-96eb-a35116c41f6c.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 f653ddea93cfb879c24f18439bcff4f8faac1d5781cf1af25c0597217d5135b0
MD5 082cc479eef750a9622651c7a7d530ea
SHA1 31893ba4fee5bfa9a9d21dc03bf43db2ad5744c6
SHA512 694a7370f50f38b7de2fe47e7ea57a03921f1401dafc526c79b84610110531e95e0427f88ae89b2a20a974208147df51cfe6ca801bdb54b7862fffd969eb9dcf
TLSH
T1C4410798AAE91158B3B77F5A9BF6985D447EBC772E07945D00020D4F0A62B41C861737
MD5 SHA1 SHA512 TLSH

Submit Download

46ed0cf3-02fc-47af-abe3-5a87fca90e4c.tmp

Path C:\Users\Admin\AppData\Local\Temp\46ed0cf3-02fc-47af-abe3-5a87fca90e4c.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5bfd75ae-2647-4d1c-ba07-7e748652dcba.tmp

Path C:\Users\Admin\AppData\Local\Temp\5bfd75ae-2647-4d1c-ba07-7e748652dcba.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.10_(x64)_20260808225922_000_DotNetHost.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.10_(x64)_20260808225922_000_DotNetHost.log
Size 2KB
SHA256 43cf56b30b4855bc3887fb086038103385d67d1892a690ca85c8d87a81510396
MD5 fdd4a6191dea66fe08faa1ddf2d524a3
SHA1 1b0156e0974f1f32048b54cf2271c0b533de0624
SHA512 9d4d48929708c00b98a3c5048eec9a36103a67fd6a77bf95c30be6acca1755f16fad644bda2d27ed93d32c81aa37c17e110527e45379262da8bedd0ecaaa5fad
TLSH
T11741286E1EE40944B1B7D603DAF3C0519A33BCD1A835CB4C13C5829A056BC067998BEE
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.10_(x64)_20260808225922_001_DotNetHostFxr.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.10_(x64)_20260808225922_001_DotNetHostFxr.log
Size 2KB
SHA256 2be916835dfa65e2faef950e5c82653e00c3cfb329b42257f6e40e55fc7f2628
MD5 01048cde28ee950c05786344e97b6d56
SHA1 d5076557a2284e988103ad535fce51679fe46559
SHA512 bbd5ac1d6c626c66529bbd490dc047a5a2f6ea342c6c243fadf9b633ff5bd269879b4cb2f1e0be73f9b5b75df3fee6a74b232bea9e044db00880a7dacdc8ad70
TLSH
T189411B181AE50D45F2F39707AAF3C0619A33FCD2A835CF0C23C54299466BD056958BAE
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.10_(x64)_20260808225922_002_DotNetRuntime.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.10_(x64)_20260808225922_002_DotNetRuntime.log
Size 2KB
SHA256 c340d60fd8646328205a52d2623f485fc23917a27fc7e900076e196c1f0f7c5a
MD5 d95482de0f91b9c8ca0f56d68aacd9b3
SHA1 046719f97e894ad4e5aba2ecf60d2013100fdd75
SHA512 0531bb3eec32c53ea0d8885b9dc1b87d2d09d318c9a43034fec896437bb1b13e86a9cf5418c296b9d9f253a318ba2a0ab8c0aae1f7f9c984d9a90f34e59480ce
TLSH
T1D84139291BE54846B2B79707DEF3C0525A33FCD7A835CF4C13C54359066BC066C68BAA
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2392_1925204691\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8b10f5bb-b36a-4305-8e38-08d5632873e4.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2392_601296373\8b10f5bb-b36a-4305-8e38-08d5632873e4.tmp
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetHost

Path C:\Users\Admin\AppData\Local\Temp\{17F76D5D-D515-4DB7-A402-E799BE3E4171}\DotNetHost
Size 1012KB
SHA256 03eb33e8eb7746542febda19278dde1c7bd496396a69a9d625a05f9506a1c3ee
MD5 667bbe018d9a8052f0ed4d4b44a02ec8
SHA1 9af6e69d606a4741ada8a58f36b9c06c9cf22626
SHA512 5e07d476569a3c7bf938278adb2b710be015698e5c3f01a5aab2db319d07b8ea675758aeb201577d3d51394550c313dc4bf401397c44f846154fcec9a445c073
SSDEEP 12288:SN2etgX0xsm7HrObWMInYLE/BbdJ0zErWolCJ9TeWxqYZfDvXNM:i26gG74W6WBbdJwEqECJ9Te7YxDXN
TLSH
T1A2256A1BBFA404A9D8B24E75C5B78321EE357C482320969F43A47229DEFB7D0647A7C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetHostFxr

Path C:\Users\Admin\AppData\Local\Temp\{17F76D5D-D515-4DB7-A402-E799BE3E4171}\DotNetHostFxr
Size 1.1MB
SHA256 da12be59d35710ff0082f3506e84d741c00816290ac1d3093078e7c7b4ec2d51
MD5 ecd6f2e85cdb3623db79832c198448b2
SHA1 48580a0e26d28d8c3ec0c0418e1896eb70448285
SHA512 4764485b64fb4bb7e3c4e28678e172c84cf9f67a23a905a0cca8f9c4522cf404be3a5dd6cc23d3dd6fb96ea2bd7dae425ca36adb80324ec795ce560806575fa7
SSDEEP 24576:626gG74W6WBbdJwEqECJ9Te7YxM6fA9Ac:626748BnwEpI9T6Yu6lc
TLSH
T134357B1BBFA404A9D8A24EB5C5B78321FE357C082320959F43A47229DEFB7D0647A7C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetRuntime

Path C:\Users\Admin\AppData\Local\Temp\{17F76D5D-D515-4DB7-A402-E799BE3E4171}\DotNetRuntime
Size 28.2MB
SHA256 4af98ab9168f319b9d026e01bd6e9df577799a222b04454579053a5a00abd555
MD5 8fe07617a818797bf2170e4ca5f4bb95
SHA1 126523726901f0a1129d9066c369f963f1ef5854
SHA512 75544a3a9bff83e7fed005ecfd0847ce32442e82c53879097518fd03ef4f6d8364bd5400912613d1eb33f6ae1e262bd1a61087960fbc6655ecd03260072bdaea
SSDEEP 786432:Tg+OS4VhnxfDEAOZGc3PHDOsz1tHDypQp:TF43nxfYnvDOsqu
TLSH
T12A573397BFA408A9D4A24E71C5B78325EF313C182721C59B42607669EFFB3D464BA7C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsDesktopRuntime

Path C:\Users\Admin\AppData\Local\Temp\{17F76D5D-D515-4DB7-A402-E799BE3E4171}\WindowsDesktopRuntime
Size 28.8MB
SHA256 024753cf71ec777cf38c82c29bfaae467ab554086d1cf6b34f5d850f61a16c28
MD5 b76d067851e1d31cc6c6f00bd68d078b
SHA1 1a83f1fca787b802f03b12c60cea0306b64eda1e
SHA512 c1551bc40c04b552b6925675180fdb69bd00e4282bbe5c3ac6db13fa49a2786f430171ed7379f7bbdfbecb998297fff54ecb77db6c58feb9f8a1196d112d155a
SSDEEP 786432:Kl8TBZmSPFbeIQhCxCLWcSEDm03uCoE7WOF:KlGZmiFbVQsECcSEdfS
TLSH
T19B673367BF9018A9D87B4E78C4B783649E317C192320AAAB47607619DEF73D451BB3C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIA7B5.tmp

Path C:\Windows\Installer\MSIA7B5.tmp
Size 392KB
SHA256 a28ed81b8594774c7e1e82f9bbe858c3b36f0d7a93067001387a5a872288231a
MD5 f1fafe5c54813a5d7b60d08b859bd58b
SHA1 95e6598ce1c02220d68edab5474980b7f0f0a12c
SHA512 6dbc8b10277c6fae8d7ba961a843810df0bb11c9c6e3ba54eea1b24e13b1069e454ef5d76d345839a32f94871855928578a15948ba242d03c990b21d8f845df9
SSDEEP 6144:u/VbdUw0z9ursTolCJSqJiIUk8AeWNxFqYrtUc06N:u/VbdJ0zErWolCJ9TeWxqYZfN
TLSH
T1CC846A29F7E418EDD4B782B6C5A68030FF75754D332095AF8BA845291F3BAA470BB701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BootstrapperApplicationData.xml

Path C:\Windows\TEMP\{17F76D5D-D515-4DB7-A402-E799BE3E4171}\.ba\BootstrapperApplicationData.xml
Size 9KB
SHA256 b1eda1e98d843eef81232344754cdc0973d9dda1c1790a91a352c167c9a64ca5
MD5 5b54f26d64fb1f7e82bec5b4ff190ba2
SHA1 11d8be75fdb2bded9b835a2d0f6e5bf1848e0ce6
SHA512 3418f51296007c704600edc69c91e26c23e8e159e0a20aadeae06d010c80cb85cb4d86517d9fcf6ec5b150578311cb57592eb220ba0f93c7512d812e29b83fb6
SSDEEP 192:2/zaT1c/ovY9qnpijXjamaD0QP7XsCsysz:9sCsysz
TLSH
T1A912D4112BFD0218F0F3AE48EFF6A4555A3ABD552E39C92D01301D0F49B2E819962FB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetLogo_256x.png

Path C:\Windows\TEMP\{17F76D5D-D515-4DB7-A402-E799BE3E4171}\.ba\DotNetLogo_256x.png
Size 2KB
SHA256 0f571f95d8eab48dbc81b0ec5e9f7225e349e26ef50868bfaab556f3c2443b01
MD5 39aa52615723b782c92dec710caaec7f
SHA1 760b49e256a7979fe50a56a2b1be3688a474b886
SHA512 89d1baa3820154667747b25e9e2fd321bfb2ec71dc309915b0a28dacdc80822a4943b639ebb37c37bd2559d5a4306d2096119cd970c84a0d331f6c68b0456dc9
TLSH
T1534195CF1BFD78D7E6E557918E1A8DD232738483B4B3A42CCE7B10B8274A5642B87940
MD5 SHA1 SHA512 TLSH

Submit Download

dotnet.ico

Path C:\Windows\TEMP\{17F76D5D-D515-4DB7-A402-E799BE3E4171}\.ba\dotnet.ico
Size 44KB
SHA256 61a2cbd12868cb9b359e0c78961d409b7875f072eb8e53ea88d3e6bfe2961a18
MD5 b8096652d9ec286709a2c863b244b110
SHA1 b3b7f0f4d608fad7cb59ba499d4d17c2b873a7af
SHA512 492a5aa83220bb77c178b7c5b50bf44968c0427e9e45bb97a33df14d7fb4c667ca7adde0ebb3874c7b6011057b01144e4e6651fbad62c6bcf5e0b93586c4bc7a
SSDEEP 96:r+gfbzo+wHK9NbwOY4tIWQeVlV1W9+H+guapUjFamINUItzf1dBNaIZ:ro5HuNcH4tIzeVlV1WEOFDgUWzf1PIm
TLSH
T1E913EF6DE68547C1C10C2032DB4AC792B5233C72E4DAE0C4F9D4FA7E177906965C6E6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\TEMP\{17F76D5D-D515-4DB7-A402-E799BE3E4171}\.ba\thm.wxl
Size 7KB
SHA256 b00edd703dd8a475119d0e4dd70a3aaa47f0e95361af290e76d367a8edef3432
MD5 8b2c667a8bbad3153068c0ed90df7ec4
SHA1 c9e04a3a37e5e6262ab9bfecf78280171b8f7b74
SHA512 5269f00d474acccb4c48cb7bcfdf19e63557a388572d3a6335aa39191319691d924e27f70da3f3495387c319396476c63a8fd7b35835cca0901220e39783847b
SSDEEP 96:HiTgM1+XSNEzA0HtYQstYCpCwZQpCeyk5HQJM9ouvj9urz8:Ew9EmtYQstYCPC9e8
TLSH
T191E1026F68DFDEE03A732651B2B3698D6919C29A136F1CF0F869084B47635016377A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.xml

Path C:\Windows\TEMP\{17F76D5D-D515-4DB7-A402-E799BE3E4171}\.ba\thm.xml
Size 11KB
SHA256 dfee8e2d075087227f19c835c145c5bb8e72a46880ea24080bb2472fd3a521be
MD5 4329e418dc56b1386d7ea29a0dcfab5b
SHA1 58387f92e89ca21b4179fb697c7de9675c59142f
SHA512 6934873d27e6efbb94da4f13ee8369b29995490051016fdf82800256b924902306d328bf1d4ebbf266d1a53eb24adb6478d1a67de4ecc3e3bcbe561968f24922
SSDEEP 96:HgvPkoeWEH3IWTaQfSJgHzth5mFahbuB8pR5+Vpwe+UIJLg1gEp+6F5pQnxc:AvoWydmQfVHMyyj5Z
TLSH
T14B42FC6851DC7811C532D702AB9371D3FF12BDA6C6C85A58B48E256B1FF262028B739C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixstdba.exe

Path C:\Windows\Temp\{17F76D5D-D515-4DB7-A402-E799BE3E4171}\.ba\wixstdba.exe
Size 431KB
SHA256 2b1cee5e3e24593247854eb7a7c4308937b9c607754ed2fb83520a8706c26f1e
MD5 0e88ffd2e737ac9b9a4241616838bc23
SHA1 3c8beb465d20bcef0cd6ceca9c60286d1d15cebd
SHA512 169b9e08518834c9bc5adfe4ab7b79e07685b72f30ede1c1a386229668bde8c15da378e1274e4013ad7b84d6f7a5acc64ef0806e3b8a66322861efaa7e26b620
SSDEEP 6144:X9vfS1NP+c3ytxmg4Stlqe3B9m2LSLTwGw7C3ZLaov5xZvSdF:X9v+GIyugllqe3wwGfX5/SdF
TLSH
T129943B3165F04037C6F90572AE14FA31BF69F208231095EBA3C0DD293968AE5BBB7657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windowsdesktop-runtime-10.0.10-win-x64.exe

Path C:\Windows\Temp\{17F76D5D-D515-4DB7-A402-E799BE3E4171}\.be\windowsdesktop-runtime-10.0.10-win-x64.exe
Size 967KB
SHA256 47b74e25c31fceb862dcc4496af4dcce01823094997aba1e88eb936013ffc2f8
MD5 0f57602b1b78b077a5b0e996ef306a7d
SHA1 4c86ca072878cf03f66be4dc721a02d5c6fe76d2
SHA512 b28e50f9ef8debb5e25af797cc9a7ed6882f08425c595ce36eb6d48e0b703c17f619151d84a6d1b8dd8b5f7affc231c19790c46d6224b94279de5a5c568aa1a2
SSDEEP 12288:OVGWl6qCmyZeU6lqlDjC+fScn6X8GwMgJEkqd68Wr//f0ZoiDqIMjFqs:OVGWl6qCmyt6UdmcpMzrI58lDqPxr
TLSH
T1B4257D31A166242BD6F50973F914D2307E28D7082B5C99B6C6C0DD0D39689FA6FFB24B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2920-1271-0x0000000000470000-0x0000000000536000-memory.dmp

Download

memory/4028-1268-0x000001FD7D290000-0x000001FD7DD51000-memory.dmp

Download

memory/4028-1278-0x000001FD7D290000-0x000001FD7DD51000-memory.dmp

Download

memory/4028-746-0x000001FD7D290000-0x000001FD7DD51000-memory.dmp

Download

memory/4028-1410-0x000001FD7D290000-0x000001FD7DD51000-memory.dmp

Download

memory/6028-1413-0x00000280C27A0000-0x00000280C27A1000-memory.dmp

Download

memory/6028-1412-0x00000280C27A0000-0x00000280C27A1000-memory.dmp

Download

memory/6028-1411-0x00000280C27A0000-0x00000280C27A1000-memory.dmp

Download

memory/6028-1420-0x00000280C27A0000-0x00000280C27A1000-memory.dmp

Download

memory/6028-1423-0x00000280C27A0000-0x00000280C27A1000-memory.dmp

Download

memory/6028-1422-0x00000280C27A0000-0x00000280C27A1000-memory.dmp

Download

memory/6028-1421-0x00000280C27A0000-0x00000280C27A1000-memory.dmp

Download

memory/6028-1419-0x00000280C27A0000-0x00000280C27A1000-memory.dmp

Download

memory/6028-1418-0x00000280C27A0000-0x00000280C27A1000-memory.dmp

Download

memory/6028-1417-0x00000280C27A0000-0x00000280C27A1000-memory.dmp

Download