Analysis
- max time kernel
149s - max time network
158s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/08/2026, 16:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Slurp Launcher_0.3.0_x64_en-US.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
Slurp Launcher_0.3.0_x64_en-US.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
19 signatures
150 seconds
General
- Target Slurp Launcher_0.3.0_x64_en-US.msi
- Size 136.3MB
- Sample260809-t9cdgasaqa
- SHA256 398437277a676257180876c4b4751b8036b7bdc5024468af387ce0e7df218030
- MD5 0696acaf05362985bf3452f69519f5c1
- SHA1 f9cbfe56b7acc95c1367477229e2efad493e020e
- SHA512 dce67b5bb0e4dfcebf7e9993ea7522f03859ddfec1a5bafe1b2b70aea11ec45664987e76fa91237bcbf3ef148c6adc9a2dbed34dd98d66e2f79ef78f504c8990
- SSDEEP 3145728:n6VrQ47w93K9bOV2yeYQhU38jrDe0k1+Bv1DT9jVY2qfXnM15nPQ/:n6VrF7w93KP3Yj3MImDT9LnP
- TLSH T1786833B73D8DCF3DE9382C39D476672C4A2438218419A448D2997E74C1FBAE3A876CD5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3488 launcher.exe - Loads dropped DLL 1 IoCs
pid Process 4796 MsiExec.exe - Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA launcher.exe - Enumerates connected drives 3 TTPs 47 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\F: launcher.exe File opened (read-only) \??\K: msiexec.exe - Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\Slurp Launcher\launcher.exe msiexec.exe File created C:\Program Files\Slurp Launcher\Uninstall Slurp Launcher.lnk msiexec.exe - Drops file in Windows directory 14 IoCs
description ioc Process File created C:\Windows\SystemTemp\~DFD9976DAE3E5DAFE0.TMP msiexec.exe File created C:\Windows\SystemTemp\~DFC5A7F67C4E95325C.TMP msiexec.exe File created C:\Windows\Installer\e5aaf6b.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DF9EB8D4C28E5EBA6E.TMP msiexec.exe File created C:\Windows\Installer\SourceHash{C117B17C-50D4-4647-9186-184C3C07968B} msiexec.exe File opened for modification C:\Windows\Installer\MSIC219.tmp msiexec.exe File opened for modification C:\Windows\Installer\{C117B17C-50D4-4647-9186-184C3C07968B}\ProductIcon msiexec.exe File opened for modification C:\Windows\Installer\e5aaf6b.msi msiexec.exe File created C:\Windows\SystemTemp\~DF26F26E3DAA10D536.TMP msiexec.exe File created C:\Windows\Installer\{C117B17C-50D4-4647-9186-184C3C07968B}\ProductIcon msiexec.exe File created C:\Windows\Installer\e5aaf6d.msi msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000081a973cadba16b310000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380181a973ca0000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410181a973ca000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e381a973ca00000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e681a973ca00000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedgewebview2.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedgewebview2.exe - Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe - Modifies registry class 37 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\com.epicgames.fortnite\shell\open\command msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\com.epicgames.fortnite\shell\open\command\ = "\"C:\\PROGRA~1\\SLURPL~1\\launcher.exe\" \"%1\"" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C71B711C4D057464196881C4C37069B8\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\com.epicgames.fortnite msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\com.epicgames.fortnite\shell\open\command msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C71B711C4D057464196881C4C37069B8 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C71B711C4D057464196881C4C37069B8\Version = "196608" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C71B711C4D057464196881C4C37069B8\ProductIcon = "C:\\Windows\\Installer\\{C117B17C-50D4-4647-9186-184C3C07968B}\\ProductIcon" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\59E0719E6A4E13557AF41229EA6B66E2\C71B711C4D057464196881C4C37069B8 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C71B711C4D057464196881C4C37069B8\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\com.epicgames.fortnite\ = "URL: protocol" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C71B711C4D057464196881C4C37069B8\External msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C71B711C4D057464196881C4C37069B8\Language = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C71B711C4D057464196881C4C37069B8\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C71B711C4D057464196881C4C37069B8\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C71B711C4D057464196881C4C37069B8\SourceList\PackageName = "Slurp Launcher_0.3.0_x64_en-US.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C71B711C4D057464196881C4C37069B8\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C71B711C4D057464196881C4C37069B8\MainProgram msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\com.epicgames.fortnite\DefaultIcon msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\com.epicgames.fortnite\DefaultIcon\ = "\"C:\\PROGRA~1\\SLURPL~1\\launcher.exe\",0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C71B711C4D057464196881C4C37069B8\PackageCode = "E2C6A0FB654C9BA4D9FD5A539B8BB75C" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C71B711C4D057464196881C4C37069B8\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C71B711C4D057464196881C4C37069B8\ShortcutsFeature = "MainProgram" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C71B711C4D057464196881C4C37069B8\InstanceType = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C71B711C4D057464196881C4C37069B8\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C71B711C4D057464196881C4C37069B8\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\com.epicgames.fortnite msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\com.epicgames.fortnite\shell msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C71B711C4D057464196881C4C37069B8\ProductName = "Slurp Launcher" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C71B711C4D057464196881C4C37069B8\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\com.epicgames.fortnite\URL Protocol msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C71B711C4D057464196881C4C37069B8\Assignment = "1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\59E0719E6A4E13557AF41229EA6B66E2 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C71B711C4D057464196881C4C37069B8\SourceList\Media\1 = ";" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\com.epicgames.fortnite\shell\open msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C71B711C4D057464196881C4C37069B8\Environment = "MainProgram" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C71B711C4D057464196881C4C37069B8 msiexec.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2812 msiexec.exe 2812 msiexec.exe 3488 launcher.exe 3488 launcher.exe 3488 launcher.exe 3488 launcher.exe 3488 launcher.exe 3488 launcher.exe 3488 launcher.exe 3488 launcher.exe 3488 launcher.exe 3488 launcher.exe 3488 launcher.exe 3488 launcher.exe 3488 launcher.exe 3488 launcher.exe 3488 launcher.exe 3488 launcher.exe 3488 launcher.exe 3488 launcher.exe 3488 launcher.exe 3488 launcher.exe 3488 launcher.exe 3488 launcher.exe 3488 launcher.exe 3488 launcher.exe 3488 launcher.exe 3488 launcher.exe 3488 launcher.exe 3488 launcher.exe 3488 launcher.exe 3488 launcher.exe 3488 launcher.exe 3488 launcher.exe 3488 launcher.exe 3488 launcher.exe 3488 launcher.exe 3488 launcher.exe 3488 launcher.exe 3488 launcher.exe 3488 launcher.exe 3488 launcher.exe 3488 launcher.exe 3488 launcher.exe 3488 launcher.exe 3488 launcher.exe 3488 launcher.exe 3488 launcher.exe 3488 launcher.exe 3488 launcher.exe 3488 launcher.exe 3488 launcher.exe 3488 launcher.exe 3488 launcher.exe 3488 launcher.exe 3488 launcher.exe 3488 launcher.exe 3488 launcher.exe 3488 launcher.exe 3488 launcher.exe 3488 launcher.exe 3488 launcher.exe 3488 launcher.exe 3488 launcher.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
pid Process 4176 msedgewebview2.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1996 msiexec.exe Token: SeIncreaseQuotaPrivilege 1996 msiexec.exe Token: SeSecurityPrivilege 2812 msiexec.exe Token: SeCreateTokenPrivilege 1996 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1996 msiexec.exe Token: SeLockMemoryPrivilege 1996 msiexec.exe Token: SeIncreaseQuotaPrivilege 1996 msiexec.exe Token: SeMachineAccountPrivilege 1996 msiexec.exe Token: SeTcbPrivilege 1996 msiexec.exe Token: SeSecurityPrivilege 1996 msiexec.exe Token: SeTakeOwnershipPrivilege 1996 msiexec.exe Token: SeLoadDriverPrivilege 1996 msiexec.exe Token: SeSystemProfilePrivilege 1996 msiexec.exe Token: SeSystemtimePrivilege 1996 msiexec.exe Token: SeProfSingleProcessPrivilege 1996 msiexec.exe Token: SeIncBasePriorityPrivilege 1996 msiexec.exe Token: SeCreatePagefilePrivilege 1996 msiexec.exe Token: SeCreatePermanentPrivilege 1996 msiexec.exe Token: SeBackupPrivilege 1996 msiexec.exe Token: SeRestorePrivilege 1996 msiexec.exe Token: SeShutdownPrivilege 1996 msiexec.exe Token: SeDebugPrivilege 1996 msiexec.exe Token: SeAuditPrivilege 1996 msiexec.exe Token: SeSystemEnvironmentPrivilege 1996 msiexec.exe Token: SeChangeNotifyPrivilege 1996 msiexec.exe Token: SeRemoteShutdownPrivilege 1996 msiexec.exe Token: SeUndockPrivilege 1996 msiexec.exe Token: SeSyncAgentPrivilege 1996 msiexec.exe Token: SeEnableDelegationPrivilege 1996 msiexec.exe Token: SeManageVolumePrivilege 1996 msiexec.exe Token: SeImpersonatePrivilege 1996 msiexec.exe Token: SeCreateGlobalPrivilege 1996 msiexec.exe Token: SeCreateTokenPrivilege 1996 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1996 msiexec.exe Token: SeLockMemoryPrivilege 1996 msiexec.exe Token: SeIncreaseQuotaPrivilege 1996 msiexec.exe Token: SeMachineAccountPrivilege 1996 msiexec.exe Token: SeTcbPrivilege 1996 msiexec.exe Token: SeSecurityPrivilege 1996 msiexec.exe Token: SeTakeOwnershipPrivilege 1996 msiexec.exe Token: SeLoadDriverPrivilege 1996 msiexec.exe Token: SeSystemProfilePrivilege 1996 msiexec.exe Token: SeSystemtimePrivilege 1996 msiexec.exe Token: SeProfSingleProcessPrivilege 1996 msiexec.exe Token: SeIncBasePriorityPrivilege 1996 msiexec.exe Token: SeCreatePagefilePrivilege 1996 msiexec.exe Token: SeCreatePermanentPrivilege 1996 msiexec.exe Token: SeBackupPrivilege 1996 msiexec.exe Token: SeRestorePrivilege 1996 msiexec.exe Token: SeShutdownPrivilege 1996 msiexec.exe Token: SeDebugPrivilege 1996 msiexec.exe Token: SeAuditPrivilege 1996 msiexec.exe Token: SeSystemEnvironmentPrivilege 1996 msiexec.exe Token: SeChangeNotifyPrivilege 1996 msiexec.exe Token: SeRemoteShutdownPrivilege 1996 msiexec.exe Token: SeUndockPrivilege 1996 msiexec.exe Token: SeSyncAgentPrivilege 1996 msiexec.exe Token: SeEnableDelegationPrivilege 1996 msiexec.exe Token: SeManageVolumePrivilege 1996 msiexec.exe Token: SeImpersonatePrivilege 1996 msiexec.exe Token: SeCreateGlobalPrivilege 1996 msiexec.exe Token: SeCreateTokenPrivilege 1996 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1996 msiexec.exe Token: SeLockMemoryPrivilege 1996 msiexec.exe - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 1996 msiexec.exe 1996 msiexec.exe 3488 launcher.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1996 msiexec.exe 2812 msiexec.exe 4796 MsiExec.exe - Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 2812 wrote to memory of 4796 2812 msiexec.exe 90 PID 2812 wrote to memory of 4140 2812 msiexec.exe 96 PID 1996 wrote to memory of 3488 1996 msiexec.exe 99 PID 3488 wrote to memory of 4176 3488 launcher.exe 100 PID 4176 wrote to memory of 3496 4176 msedgewebview2.exe 101 PID 4176 wrote to memory of 892 4176 msedgewebview2.exe 102 PID 4176 wrote to memory of 892 4176 msedgewebview2.exe 102 PID 4176 wrote to memory of 892 4176 msedgewebview2.exe 102 PID 4176 wrote to memory of 892 4176 msedgewebview2.exe 102 PID 4176 wrote to memory of 4588 4176 msedgewebview2.exe 103 PID 4176 wrote to memory of 2524 4176 msedgewebview2.exe 104 PID 4176 wrote to memory of 2524 4176 msedgewebview2.exe 104 PID 4176 wrote to memory of 2524 4176 msedgewebview2.exe 104 PID 4176 wrote to memory of 4108 4176 msedgewebview2.exe 105 PID 4176 wrote to memory of 4108 4176 msedgewebview2.exe 105 PID 4176 wrote to memory of 4108 4176 msedgewebview2.exe 105 PID 4176 wrote to memory of 4108 4176 msedgewebview2.exe 105 PID 4176 wrote to memory of 4108 4176 msedgewebview2.exe 105 PID 4176 wrote to memory of 4956 4176 msedgewebview2.exe 106 PID 4176 wrote to memory of 4956 4176 msedgewebview2.exe 106 PID 4176 wrote to memory of 4956 4176 msedgewebview2.exe 106 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\Slurp Launcher_0.3.0_x64_en-US.msi"1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Program Files\Slurp Launcher\launcher.exe"C:\Program Files\Slurp Launcher\launcher.exe"2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=launcher.exe --webview-exe-version=0.3.0 --user-data-dir="C:\Users\Admin\AppData\Local\SlurpLauncher\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=3488.5368.2653035171405877977 /pfhostedapp:8036d908ef75132494a5c077a7bc8bc45cd2cade3⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\SlurpLauncher\EBWebView /prefetch:4 /pfhostedapp:8036d908ef75132494a5c077a7bc8bc45cd2cade --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\SlurpLauncher\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x184,0x198,0x7ff9d0af5fd8,0x7ff9d0af5fe4,0x7ff9d0af5ff04⤵PID:3496
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\SlurpLauncher\EBWebView" --webview-exe-name=launcher.exe --webview-exe-version=0.3.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1716 --field-trial-handle=1732,i,18096276545458608041,16119804438840632860,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:8036d908ef75132494a5c077a7bc8bc45cd2cade4⤵PID:892
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\SlurpLauncher\EBWebView" --webview-exe-name=launcher.exe --webview-exe-version=0.3.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2036 --field-trial-handle=1732,i,18096276545458608041,16119804438840632860,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:8036d908ef75132494a5c077a7bc8bc45cd2cade4⤵PID:4588
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\SlurpLauncher\EBWebView" --webview-exe-name=launcher.exe --webview-exe-version=0.3.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2432 --field-trial-handle=1732,i,18096276545458608041,16119804438840632860,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:8036d908ef75132494a5c077a7bc8bc45cd2cade4⤵PID:2524
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\SlurpLauncher\EBWebView" --webview-exe-name=launcher.exe --webview-exe-version=0.3.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3308 --field-trial-handle=1732,i,18096276545458608041,16119804438840632860,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:8036d908ef75132494a5c077a7bc8bc45cd2cade /prefetch:14⤵PID:4108
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\SlurpLauncher\EBWebView" --webview-exe-name=launcher.exe --webview-exe-version=0.3.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4448 --field-trial-handle=1732,i,18096276545458608041,16119804438840632860,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:8036d908ef75132494a5c077a7bc8bc45cd2cade4⤵PID:4956
-
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 01A5F42F79DFD2C18640B02CD87148B3 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4796
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:4140
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:5044
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e5aaf6c.rbs
- Size 10KB
- SHA256 6494f08c14eda6934f8dfd890dd5ea35a9d5890586c8df5ee2ac437eda1751ad
- MD5 2327a036b8ad53d1e6ae65aa6414e780
- SHA1 4c7b4504488e74e095fe4b14317badee827189a7
- SHA512 a81b4f9777406e3c5f5a80fbffba3275fde6ab28ba476a82751f7c10177f0248b9fb52b6fba199e37d47509e46071c18ea8ebed5888ddd74fe998728a9c611b5
- SSDEEP 192:t2RLNd+FYhUoCXUs8V/Gps8V/VwKlIGRWPi5Rtpl:tYLNd+FYhfl0lZ3bN
- TLSH T1B7224F82A64082C2EE922736E7571B6537F3EBD9D310634B08CD91789F0B3882F5568F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Slurp Launcher\Slurp Launcher.lnk
- Size 2KB
- SHA256 3336153343721041be4fe01cb62b761f643b00e5ac4c865aec2f458e7f632328
- MD5 bd36f97b17609f0de44dde7bd6c1ceb7
- SHA1 381de8bb244a12bf885474cc9a977bd61f859dfb
- SHA512 721881ee17b20ed2df82532be4f91d6230bb27a6eaf97e72c09087d5c4bc1ec711cba09c16fb8fd2f4daae58ef67f3a0810420746a50c28334f12b133573e640
- TLSH T1B9419E1097D6166AF3714736AA3615665B73FC0AB6388F6F4188C2824875600AE68F7E
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Slurp Launcher\Slurp Launcher.lnk~RFe5ac5a3.TMP
- Size 1KB
- SHA256 a180fa32afbb542db0ffbf28697134f65511f8c546b98ec485854adba6b82ed6
- MD5 36cf68adad6b3fbd41f39ae59c729ed0
- SHA1 b82690891e2603a5e48d548b7ee94050f872d02c
- SHA512 b7ae5dfdbfbb82218b73b54238bd910c0b01ac833422e294e9fd4b0a06996a63c7089cc09f789072b7e5a9dd02b845aec1d5cf6573666e5d68c735bab7d35e96
- TLSH T15941E21057E5166FF37107397A3605625B73FC0AB6388F6F41C882824875600AE68F7E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\SlurpLauncher\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 ebe8e4c7315a8d25a9710dccb61f1501ff53e0b55c7e80de94268811af138ba7
- MD5 87f82b07740514485c4d5e877330ecde
- SHA1 3d7928d5975a7ad165697d9204ab4b0c658c72cc
- SHA512 c11b1ad77e7b45b3d7b2f0ea08d55ef421348419e2e0bcefc1ba7115b713e8f9cef9d7c0c9e9bb363158dfe455d7140ecfb2b8314056f01fc1245ca9440e4e10
- TLSH T13ED0047C73000054D14550314570C1D50540C510147311100151715D044403005C1040
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\SlurpLauncher\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 629ea0c514b68a99e9cc17f7b1ff4b08b506cd5b68c0a8813fa9ca3756efbced
- MD5 6915317641bc7d10c439ee803b1cae22
- SHA1 e4d5c24c6de48be2fe857a11ed51fe85b21f3021
- SHA512 79b65b7b5447f2f446ba01f4d192acf2ef31f2c811a38c26465e537004c98861d5fee1cba91604e48cdfb06111204c1e34eda7a85f38fa41d1fcb98bf69f4abb
- TLSH T178D0122A33010178C01020330552A18D0840C21B405640005429E66E1A080700E42481
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\SlurpLauncher\EBWebView\Crashpad\throttle_store.dat
- Size 20B
- SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
- MD5 9e4e94633b73f4a7680240a0ffd6cd2c
- SHA1 e68e02453ce22736169a56fdb59043d33668368f
- SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\SlurpLauncher\EBWebView\Default\878eba32-70c2-4fa8-9e96-1bd668d6e6f2.tmp
- Size 6KB
- SHA256 f58992ed91dda979bdc5218c761aef4d792960ce222b3f2c6102a4ff3b445240
- MD5 ec7d84f12afab7f2a79b2213b7f52b32
- SHA1 02fe6bee09acd3b9e9237fa0760470d35a79f0d8
- SHA512 e4afa4763c0a89c8795db1c704d7e3f85703bcd9ea20e2d92a620eed4b1617074344f0ddaac0634f4afc4543eb340d9c816efcffed7f86acd9d16852a669dfd1
- SSDEEP 96:st7/dZszFmb9Ikeo5h16Z0Es7/x+6MhmuecJI21ejegK+gA28XM1C7K:stDjSn9onEsV+FdI2Qj0GG6K
- TLSH T109D184015E28B97B8CC7F119FA397A13E2F56072A4951E58EBF8962C04D76CC630790B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\SlurpLauncher\EBWebView\Default\Code Cache\js\index-dir\the-real-index
- Size 72B
- SHA256 a8d3312c00cf75feee6cd5191f5eb62b2c4ea4a869c457a70fefbe0badcf76b3
- MD5 df8138f18be9bf5d03c098674f8a8cb3
- SHA1 28372f50830fe3444d569cc0e645257337bcf968
- SHA512 6c0e70324c1adaa29c97e1bf9202e3d9adc9dd9ba1d0fb569ff6ac5d2d7dd4d51649ceb3e3d1ff4e829596fc0075e9238dc0fc370f6585df853e0bfbacb2bd31
- TLSH T170A00259075D2062E5444FB114C555C93AB14C584B030E1243B09EA89890F515599D01
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\SlurpLauncher\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe5b2bcf.TMP
- Size 48B
- SHA256 03ad70dc9b91ca64393ac493081651574ab9daab0aaf8a8699d5816453704798
- MD5 f5a55efe8f99b3f622a30a3c6309f8a5
- SHA1 6a41135e71ed1adf36b4bd37b4532be5621d8c4f
- SHA512 ac79a10c37b503e8da6cafd25b339aa023cc9c0af3faca46259471e31509e101b306636ad381a20ce58ad2e3cf20b39f2c5b3642db8aaa8cd1faf756102c55a9
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\SlurpLauncher\EBWebView\Default\Network\Network Persistent State
- Size 962B
- SHA256 e9128b238b05c35940c61484397b6937cbc1378f5c5211bae4acc38d1943108c
- MD5 deeae26e4872b91b19e71c5e91759240
- SHA1 f0441347c18c473ad382e1918d3e5fdb15542359
- SHA512 684dcc9b040a461868763c11e7b11a8ea47198a32a7c19353abb0ce86d8ef36347a9c8c986ea99ae2b64a61571cae528aaead09e68ae5f77117a8f77f7df7928
- TLSH T1D511B1A2C2E4C67D8B0126E427307817CC2E051A93286E3ACDFAFB9D97E1075D11050F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\SlurpLauncher\EBWebView\Default\Network\Network Persistent State~RFe5beee1.TMP
- Size 59B
- SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
- MD5 2800881c775077e1c4b6e06bf4676de4
- SHA1 2873631068c8b3b9495638c865915be822442c8b
- SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
- TLSH T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\SlurpLauncher\EBWebView\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\SlurpLauncher\EBWebView\Default\Site Characteristics Database\000001.dbtmp
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\SlurpLauncher\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
- Size 41B
- SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
- MD5 5af87dfd673ba2115e2fcf5cfdb727ab
- SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
- SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\SlurpLauncher\EBWebView\GraphiteDawnCache\data_0
- Size 8KB
- SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
- MD5 cf89d16bb9107c631daabf0c0ee58efb
- SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
- SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
- SSDEEP 3:MsFl:/F
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\SlurpLauncher\EBWebView\GraphiteDawnCache\data_2
- Size 8KB
- SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
- MD5 0962291d6d367570bee5454721c17e11
- SHA1 59d10a893ef321a706a9255176761366115bedcb
- SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
- SSDEEP 3:MsHlDll:/H
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\SlurpLauncher\EBWebView\GraphiteDawnCache\data_3
- Size 8KB
- SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
- MD5 41876349cb12d6db992f1309f22df3f0
- SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
- SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
- SSDEEP 3:MsGl3ll:/y
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\SlurpLauncher\EBWebView\Local State
- Size 2KB
- SHA256 acfdaed44c527a7a178e91393dd709e77ab5906cdc570775efe3811a47f7efa5
- MD5 1d8f1de7cf54c54c077eeee2c316c413
- SHA1 13c155fe26c7e63b7e62b2d4b38f342f8257e987
- SHA512 3cf6e48d3340c7f7f44874d7b6176305b00116dd8c5c01dc353bab568a71db51903c2755ea183cee3b2868a7bbf421528772514d14f6e3fb3608cc71baaa5559
- TLSH T1BE514533A919AB37D5E39618B94B3F239E7560E6EA922F2496DC1B1800D719C1346C37
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\SlurpLauncher\EBWebView\Local State
- Size 3KB
- SHA256 4c32bb7534fd6f60592bf3a68b2c3776aeccee667288b0c4200a107446a53cdf
- MD5 8fd9194902dc66b48990cb36c1ee0ac9
- SHA1 e66834e43120841bd635a7739e6c292fc199754d
- SHA512 3878a9da5b6aed6e2df1ed07edddfd1ef3b5bda969356b262ed6d6e14a94154de0d63403343adcb51b2fd9a15b75c00729546b3128a9e18bad9c7a86e9dcdcf8
- TLSH T12F618433A965EA379AF3D604B88A2F17ABA55063E9913F65D6EC1F0C01D72D81342C27
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\SlurpLauncher\EBWebView\Local State
- Size 15KB
- SHA256 6bcac6eea7e112132063d48934d5a6a8833a40b0e0edce5f9723d0f4da3b3a48
- MD5 6ba8c5dab5b3f7dc43442abb58662d52
- SHA1 0a9d832cf4a5994349f50763ff1e3dc6cce643d8
- SHA512 85cdfb9dd57f8f204d9909d693d1d7f8e8f5956cdb767c7634e28080f6b601e6a3091879260eab859b470862573b31ddbc03dbb1986fa8b46f9deec3706dc5e0
- SSDEEP 384:k+aQikB+z/xvxjg/qhEzNBSSS0ggnSAVdpt99zM:D/UxvxjgC+7LSUHFM
- TLSH T1A472AE27552E7E23A6F7FA05794D0B5BCAB894F294C16EB84ABD6F0902C73D81342C16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\SlurpLauncher\EBWebView\Local State~RFe5ad9e6.TMP
- Size 1KB
- SHA256 88ed7bb123fa670bc0db38a2c11328a6bf4da7026e7ea295d8de9920149fc25a
- MD5 2fa8064c7b09727ea2eeb16a0fc111a0
- SHA1 a6cbac05efe2a65fb9b00ae5d2bd5cf5da0b1dd4
- SHA512 34610518198f959a58a2c22a0eb840c62774420e59350aeffa01c8e78dc04511b9412738f48e932cffbba7f70727c157ce3600f8e1de65d17ac21d9cddfe1fcd
- TLSH T142216573D5295B32E8A2A21A614B3F275E7110E7D1508F04A1DC1B2801F71DC526BC33
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSIE49A.tmp
- Size 132KB
- SHA256 7f47d98ab25cfea9b3a2e898c3376cc9ba1cd893b4948b0c27caa530fd0e34cc
- MD5 cfbb8568bd3711a97e6124c56fcfa8d9
- SHA1 d7a098ae58bdd5e93a3c1b04b3d69a14234d5e57
- SHA512 860cbf3286ac4915580cefaf56a9c3d48938eb08e3f31b7f024c4339c037d7c8bdf16e766d08106505ba535be4922a87dc46bd029aae99a64ea2fc02cf3aec04
- SSDEEP 3072:Kx2YbpcgwmiTPJDnCO+DATkURBnrskNwPj2:XXgwmY1CPx2XG2
- TLSH T1DBD39D02B5D0C473D9BE09390870DB229F7EB930DF909EDB636856699E702C19E35A37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 1cb68d426fe5091ffec66a4e9fb57f9226627906f3dbeb6f7091221aef7d53e1
- MD5 3ab361c15e73795eafc835b16e5f2f78
- SHA1 d667ad53095e5b1b7ae8796285c0ad7e1429afe0
- SHA512 a3f723b8d66b36a5078d1ae3b0cfe0b6db574bf994c7ab447e9564f335d9cd12fc10dd426d152ee5891ec23649f9062296011fbdc48edf16f8617a8505c581ec
- SSDEEP 24576:yFo3DMPAdoO/vvTL/CwF1yFQPrOfebSmUYjHdIrtDQrKJykVM4RWVsfURed:fHA
- TLSH T1D457162436F92110E7F39E3DA8F46A234D397D579C16DE8C05425B8D0922FB1E872F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{ca73a981-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{fc35c3d5-05c8-49db-9133-c4b0f605453f}_OnDiskSnapshotProp
- Size 6KB
- SHA256 f53cd8197e7c90fa1a449af937dd4d31362d8fe67b10506684e30e296315ffc6
- MD5 4100700110d2371443d668266bdb9257
- SHA1 1beef3a10cc2a34bef133ef329b7f0c2d3adfb41
- SHA512 f0f1613b13e4afc9b542552510c602a0cb58af4b7926e717579c6ae9a472f9fc003c48224af91dc7dcf6fc172a908c24aa58324927a3aecb07386c90411fb612
- SSDEEP 96:FpHXhnvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:bdb++uVm
- TLSH T1E1D199181AF54711E2B3AB3268F14557A877B911EF33CB8E0198638E6630910F975F6F
- MD5 SHA1 SHA512 SSDEEP TLSH