6199c3dc99922803723badb51db4b115c0e81afb8c85b64954390a2d2b340e72

Analysis

user interaction
yes
max time kernel
101s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/09/2026, 23:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Voidstrap (1).exe
Size 27.7MB
Sample260922-3ndtvaaa49
SHA256 6199c3dc99922803723badb51db4b115c0e81afb8c85b64954390a2d2b340e72
MD5 e72c060bbacce4d9197ca6f8bb6f9726
SHA1 69921cc4fc959da3a31ecd2d6841fc33a541aee4
SHA512 0c63158bca89813ed725a15dcb29763d124dbdca2a754e2faf3cca43084ff36edc501792ee5851fd26cc0538a2ada964e3a1f235e31a5a9296685187de3d2374
SSDEEP 196608:VqIzrhhRBN3juZ30YZiLvX4B7Qq1UTLfN06K6naJ2lptK6gOeuhbaGlX8KzlrXwO:oIzto30sf1UTOfJ+lrXjQrC
TLSH
T197578D1163FC4B16E5FF1B35A87141144AB2BC1AAA32D38E764CB5AD1F727808D61BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Control Panel\International\Geo\Nation	windowsdesktop-runtime-10.0.12-win-x64.exe
Key value queried	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Control Panel\International\Geo\Nation	windowsdesktop-runtime-10.0.12-win-x64.exe

Executes dropped EXE 9 IoCs

pid	Process
5832	windowsdesktop-runtime-10.0.12-win-x64.exe
5956	windowsdesktop-runtime-10.0.12-win-x64.exe
5128	wixstdba.exe
2104	wixstdba.exe
5624	windowsdesktop-runtime-10.0.12-win-x64.exe
4684	windowsdesktop-runtime-10.0.12-win-x64.exe
2396	windowsdesktop-runtime-10.0.12-win-x64.exe
5712	wixstdba.exe
4208	windowsdesktop-runtime-10.0.12-win-x64.exe

Loads dropped DLL 12 IoCs

pid	Process
5924	MsiExec.exe
5924	MsiExec.exe
5780	MsiExec.exe
5780	MsiExec.exe
5604	MsiExec.exe
5604	MsiExec.exe
896	MsiExec.exe
896	MsiExec.exe
4344	MsiExec.exe
4344	MsiExec.exe
6004	MsiExec.exe
6004	MsiExec.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2} = "\"C:\\ProgramData\\Package Cache\\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}\\windowsdesktop-runtime-10.0.12-win-x64.exe\" /burn.runonce"	windowsdesktop-runtime-10.0.12-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2} = "\"C:\\ProgramData\\Package Cache\\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}\\windowsdesktop-runtime-10.0.12-win-x64.exe\" /burn.runonce"	windowsdesktop-runtime-10.0.12-win-x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\tr\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\ThirdPartyNotices.txt	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Net.NameResolution.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\System.Security.Cryptography.Pkcs.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\fr\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\zh-Hans\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Collections.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Net.WebSockets.Client.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\WindowsBase.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\fr\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Buffers.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.IO.FileSystem.AccessControl.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\de\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\Microsoft.CSharp.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.IO.Compression.Brotli.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\PresentationUI.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\de\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Diagnostics.FileVersionInfo.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Net.Ping.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\clrjit.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\cs\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\tr\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.AppContext.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.IO.Compression.FileSystem.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Text.Encodings.Web.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Threading.Tasks.Parallel.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Diagnostics.Process.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Reflection.Emit.Lightweight.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Resources.Reader.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\pt-BR\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\tr\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.ObjectModel.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\de\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\ko\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Diagnostics.TextWriterTraceListener.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Runtime.Intrinsics.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\netstandard.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\System.IO.Packaging.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\UIAutomationProvider.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\pl\WindowsBase.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\Microsoft.Win32.Primitives.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\es\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\ja\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\ko\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\pl\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3516_1762515601\manifest.json	msedge.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Diagnostics.Contracts.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\zh-Hant\UIAutomationTypes.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\Microsoft.WindowsDesktop.App.deps.json	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\System.Private.Windows.Core.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\it\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\ko\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Xml.ReaderWriter.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\PresentationFramework.Luna.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\es\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\ko\WindowsBase.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.ComponentModel.TypeConverter.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.IO.Compression.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\cs\WindowsBase.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\it\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\pt-BR\UIAutomationTypes.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Net.WebHeaderCollection.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\fr\UIAutomationProvider.resources.dll	msiexec.exe

Drops file in Windows directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI8B89.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6BA9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\e5936ec.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4EA7.tmp	msiexec.exe
File created	C:\Windows\Installer\e5936f0.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4FF0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7158.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI94D4.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149	msiexec.exe
File created	C:\Windows\Installer\e5936f1.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5C08.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5936f6.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{8C704AC7-A0DB-44DD-A1F3-F0FBDF1FF693}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9542.tmp	msiexec.exe
File created	C:\Windows\Installer\e5936e5.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5936e5.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149\fileCoreHostExe	msiexec.exe
File created	C:\Windows\Installer\e5936fa.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8F63.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI90FB.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{17D94539-A423-48D9-BD4A-69A9186C5B66}	msiexec.exe
File created	C:\Windows\Installer\e5936eb.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4D6D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI483B.tmp	msiexec.exe
File created	C:\Windows\Installer\e5936ec.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{E358F0F7-0226-419D-85E6-D45A08BF195F}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI56C7.tmp	msiexec.exe
File created	C:\Windows\Installer\e5936f6.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6D8E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7C75.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4220.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5936f1.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{902710DF-F5E0-42EB-8959-ECC10CC368DF}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8EE5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149\fileCoreHostExe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4B3A.tmp	msiexec.exe
File created	C:\Windows\Installer\e5936f5.msi	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.12-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.12-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.12-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.12-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.12-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wixstdba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.12-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wixstdba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wixstdba.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2976	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2B	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2d	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2C	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134345940320514153"	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\7F0F853E6220D914586E4DA580FB91F5\MainFeature	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD0172090E5FBE249895CE1CC03C86FD	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_80.48.58476_x64\DisplayName = "Microsoft Windows Desktop Runtime - 10.0.12 (x64)"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-524788801-3318743092-4051225893-1000\{E4743409-C303-412A-B68F-7D522EBA5599}	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}\Version = "10.0.12.50000"	windowsdesktop-runtime-10.0.12-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\93549D71324A9D84DBA4969A81C6B566\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{17D94539-A423-48D9-BD4A-69A9186C5B66}v80.48.58476\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7F0F853E6220D914586E4DA580FB91F5\Version = "1345381484"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\FD0172090E5FBE249895CE1CC03C86FD\Provider	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\7CA407C8BD0ADD441A3F0FBFFDF16F39	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\2939A0641A55C25433FD7E322A7159A9	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7CA407C8BD0ADD441A3F0FBFFDF16F39\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.48.58476_x64\DisplayName = "Microsoft .NET Host FX Resolver - 10.0.12 (x64)"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7CA407C8BD0ADD441A3F0FBFFDF16F39	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7CA407C8BD0ADD441A3F0FBFFDF16F39\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{8C704AC7-A0DB-44DD-A1F3-F0FBDF1FF693}v80.48.58476\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\windowsdesktop_runtime_80.48.58476_x64	windowsdesktop-runtime-10.0.12-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\93549D71324A9D84DBA4969A81C6B566\MainFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\93549D71324A9D84DBA4969A81C6B566\ProductName = "Microsoft .NET Host - 10.0.12 (x64)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.48.58476_x64\ = "{E358F0F7-0226-419D-85E6-D45A08BF195F}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\245448558535FDC5C8905F329F49898C\7F0F853E6220D914586E4DA580FB91F5	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7F0F853E6220D914586E4DA580FB91F5\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{E358F0F7-0226-419D-85E6-D45A08BF195F}v80.48.58476\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\dotnet_runtime_80.48.58476_x64	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_80.48.58476_x64\Dependents\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}	windowsdesktop-runtime-10.0.12-win-x64.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\93549D71324A9D84DBA4969A81C6B566\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7F0F853E6220D914586E4DA580FB91F5\ProductName = "Microsoft .NET Host FX Resolver - 10.0.12 (x64)"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.48.58476_x64\Dependents\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}	windowsdesktop-runtime-10.0.12-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_80.48.58476_x64\Dependents\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}	windowsdesktop-runtime-10.0.12-win-x64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x64	windowsdesktop-runtime-10.0.12-win-x64.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD0172090E5FBE249895CE1CC03C86FD\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}\Dependents\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}	windowsdesktop-runtime-10.0.12-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x64\Version = "80.48.58476"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\93549D71324A9D84DBA4969A81C6B566\PackageCode = "F51312C54E22CEC4182D8D57784720B0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\93549D71324A9D84DBA4969A81C6B566\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7F0F853E6220D914586E4DA580FB91F5\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.48.58476_x64	windowsdesktop-runtime-10.0.12-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD0172090E5FBE249895CE1CC03C86FD\PackageCode = "1996005C24BB6ED459236374EB503368"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD0172090E5FBE249895CE1CC03C86FD\Version = "1345381484"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\245448558535FDC5C8905F329F49898C	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD0172090E5FBE249895CE1CC03C86FD\ProductName = "Microsoft .NET Runtime - 10.0.12 (x64)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\5840E2420625E5A4B03C0089F5778860\FD0172090E5FBE249895CE1CC03C86FD	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\windowsdesktop_runtime_80.48.58476_x64	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\7CA407C8BD0ADD441A3F0FBFFDF16F39\MainFeature	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\5840E2420625E5A4B03C0089F5778860	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}	windowsdesktop-runtime-10.0.12-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\7F0F853E6220D914586E4DA580FB91F5\Provider	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7CA407C8BD0ADD441A3F0FBFFDF16F39\Version = "1345381484"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}	windowsdesktop-runtime-10.0.12-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7F0F853E6220D914586E4DA580FB91F5\SourceList\PackageName = "dotnet-hostfxr-10.0.12-win-x64.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\7CA407C8BD0ADD441A3F0FBFFDF16F39\Provider	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7CA407C8BD0ADD441A3F0FBFFDF16F39\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\93549D71324A9D84DBA4969A81C6B566\SourceList\PackageName = "dotnet-host-10.0.12-win-x64.msi"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7CA407C8BD0ADD441A3F0FBFFDF16F39\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.48.58476_x64\Version = "80.48.58476"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7F0F853E6220D914586E4DA580FB91F5\PackageCode = "A67E422DCB5A6B244B1F3508AB24FAC5"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7F0F853E6220D914586E4DA580FB91F5\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.48.58476_x64\Dependents	windowsdesktop-runtime-10.0.12-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_80.48.58476_x64\ = "{902710DF-F5E0-42EB-8959-ECC10CC368DF}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_80.48.58476_x64\Version = "80.48.58476"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7CA407C8BD0ADD441A3F0FBFFDF16F39\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}\DisplayName = "Microsoft Windows Desktop Runtime 10.0.12 (x64)"	windowsdesktop-runtime-10.0.12-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\93549D71324A9D84DBA4969A81C6B566\Version = "1345381484"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7F0F853E6220D914586E4DA580FB91F5\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}\Version = "10.0.12.50000"	windowsdesktop-runtime-10.0.12-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x64\Dependents\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}	windowsdesktop-runtime-10.0.12-win-x64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.48.58476_x64	windowsdesktop-runtime-10.0.12-win-x64.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
5232	msiexec.exe
5232	msiexec.exe
5232	msiexec.exe
5232	msiexec.exe
5232	msiexec.exe
5232	msiexec.exe
5232	msiexec.exe
5232	msiexec.exe
5232	msiexec.exe
5232	msiexec.exe
5232	msiexec.exe
5232	msiexec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5624	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeIncreaseQuotaPrivilege	5624	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeSecurityPrivilege	5232	msiexec.exe
Token: SeCreateTokenPrivilege	5624	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeAssignPrimaryTokenPrivilege	5624	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeLockMemoryPrivilege	5624	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeIncreaseQuotaPrivilege	5624	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeMachineAccountPrivilege	5624	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeTcbPrivilege	5624	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeSecurityPrivilege	5624	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeTakeOwnershipPrivilege	5624	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeLoadDriverPrivilege	5624	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeSystemProfilePrivilege	5624	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeSystemtimePrivilege	5624	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeProfSingleProcessPrivilege	5624	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeIncBasePriorityPrivilege	5624	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeCreatePagefilePrivilege	5624	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeCreatePermanentPrivilege	5624	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeBackupPrivilege	5624	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeRestorePrivilege	5624	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeShutdownPrivilege	5624	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeDebugPrivilege	5624	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeAuditPrivilege	5624	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeSystemEnvironmentPrivilege	5624	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeChangeNotifyPrivilege	5624	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeRemoteShutdownPrivilege	5624	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeUndockPrivilege	5624	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeSyncAgentPrivilege	5624	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeEnableDelegationPrivilege	5624	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeManageVolumePrivilege	5624	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeImpersonatePrivilege	5624	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeCreateGlobalPrivilege	5624	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeRestorePrivilege	5232	msiexec.exe
Token: SeTakeOwnershipPrivilege	5232	msiexec.exe
Token: SeRestorePrivilege	5232	msiexec.exe
Token: SeTakeOwnershipPrivilege	5232	msiexec.exe
Token: SeRestorePrivilege	5232	msiexec.exe
Token: SeTakeOwnershipPrivilege	5232	msiexec.exe
Token: SeRestorePrivilege	5232	msiexec.exe
Token: SeTakeOwnershipPrivilege	5232	msiexec.exe
Token: SeRestorePrivilege	5232	msiexec.exe
Token: SeTakeOwnershipPrivilege	5232	msiexec.exe
Token: SeRestorePrivilege	5232	msiexec.exe
Token: SeTakeOwnershipPrivilege	5232	msiexec.exe
Token: SeRestorePrivilege	5232	msiexec.exe
Token: SeTakeOwnershipPrivilege	5232	msiexec.exe
Token: SeRestorePrivilege	5232	msiexec.exe
Token: SeTakeOwnershipPrivilege	5232	msiexec.exe
Token: SeRestorePrivilege	5232	msiexec.exe
Token: SeTakeOwnershipPrivilege	5232	msiexec.exe
Token: SeRestorePrivilege	5232	msiexec.exe
Token: SeTakeOwnershipPrivilege	5232	msiexec.exe
Token: SeRestorePrivilege	5232	msiexec.exe
Token: SeTakeOwnershipPrivilege	5232	msiexec.exe
Token: SeRestorePrivilege	5232	msiexec.exe
Token: SeTakeOwnershipPrivilege	5232	msiexec.exe
Token: SeRestorePrivilege	5232	msiexec.exe
Token: SeTakeOwnershipPrivilege	5232	msiexec.exe
Token: SeRestorePrivilege	5232	msiexec.exe
Token: SeTakeOwnershipPrivilege	5232	msiexec.exe
Token: SeRestorePrivilege	5232	msiexec.exe
Token: SeTakeOwnershipPrivilege	5232	msiexec.exe
Token: SeRestorePrivilege	5232	msiexec.exe
Token: SeTakeOwnershipPrivilege	5232	msiexec.exe

Suspicious use of FindShellTrayWindow 13 IoCs

pid	Process
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
2104	wixstdba.exe
5712	wixstdba.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1224 wrote to memory of 3516	1224	Voidstrap (1).exe	94
PID 3516 wrote to memory of 3256	3516	msedge.exe	95
PID 3516 wrote to memory of 2976	3516	msedge.exe	96
PID 3516 wrote to memory of 4240	3516	msedge.exe	97
PID 3516 wrote to memory of 4240	3516	msedge.exe	97
PID 3516 wrote to memory of 4240	3516	msedge.exe	97
PID 3516 wrote to memory of 4380	3516	msedge.exe	98
PID 3516 wrote to memory of 4380	3516	msedge.exe	98
PID 3516 wrote to memory of 2024	3516	msedge.exe	100
PID 3516 wrote to memory of 2024	3516	msedge.exe	100
PID 3516 wrote to memory of 2024	3516	msedge.exe	100
PID 3516 wrote to memory of 1448	3516	msedge.exe	101
PID 3516 wrote to memory of 1448	3516	msedge.exe	101
PID 3516 wrote to memory of 1448	3516	msedge.exe	101
PID 3516 wrote to memory of 4248	3516	msedge.exe	102
PID 3516 wrote to memory of 2348	3516	msedge.exe	103
PID 3516 wrote to memory of 4248	3516	msedge.exe	102
PID 3516 wrote to memory of 4248	3516	msedge.exe	102
PID 3516 wrote to memory of 2348	3516	msedge.exe	103
PID 3516 wrote to memory of 2348	3516	msedge.exe	103
PID 3516 wrote to memory of 3620	3516	msedge.exe	106
PID 3516 wrote to memory of 3620	3516	msedge.exe	106
PID 3516 wrote to memory of 984	3516	msedge.exe	108
PID 3516 wrote to memory of 984	3516	msedge.exe	108
PID 3516 wrote to memory of 1676	3516	msedge.exe	109
PID 3516 wrote to memory of 3520	3516	msedge.exe	110
PID 3516 wrote to memory of 1676	3516	msedge.exe	109
PID 3516 wrote to memory of 3520	3516	msedge.exe	110
PID 3516 wrote to memory of 1476	3516	msedge.exe	114
PID 3516 wrote to memory of 2376	3516	msedge.exe	115
PID 3516 wrote to memory of 2376	3516	msedge.exe	115
PID 3516 wrote to memory of 4680	3516	msedge.exe	116
PID 3516 wrote to memory of 4680	3516	msedge.exe	116
PID 3516 wrote to memory of 2688	3516	msedge.exe	117
PID 3516 wrote to memory of 2688	3516	msedge.exe	117
PID 3516 wrote to memory of 2860	3516	msedge.exe	118
PID 3516 wrote to memory of 2860	3516	msedge.exe	118
PID 3516 wrote to memory of 5352	3516	msedge.exe	119
PID 3516 wrote to memory of 5352	3516	msedge.exe	119
PID 3516 wrote to memory of 5640	3516	msedge.exe	120
PID 3516 wrote to memory of 5640	3516	msedge.exe	120
PID 3516 wrote to memory of 5640	3516	msedge.exe	120
PID 3516 wrote to memory of 5312	3516	msedge.exe	122
PID 3516 wrote to memory of 5308	3516	msedge.exe	123
PID 3516 wrote to memory of 5312	3516	msedge.exe	122
PID 3516 wrote to memory of 5308	3516	msedge.exe	123
PID 3516 wrote to memory of 5308	3516	msedge.exe	123
PID 3516 wrote to memory of 5676	3516	msedge.exe	124
PID 3516 wrote to memory of 5832	3516	msedge.exe	126
PID 3516 wrote to memory of 5956	3516	msedge.exe	128
PID 5832 wrote to memory of 5128	5832	windowsdesktop-runtime-10.0.12-win-x64.exe	130
PID 5956 wrote to memory of 2104	5956	windowsdesktop-runtime-10.0.12-win-x64.exe	131
PID 3516 wrote to memory of 2688	3516	msedge.exe	133
PID 3516 wrote to memory of 4680	3516	msedge.exe	134
PID 3516 wrote to memory of 2876	3516	msedge.exe	135
PID 5956 wrote to memory of 5624	5956	windowsdesktop-runtime-10.0.12-win-x64.exe	136
PID 3516 wrote to memory of 684	3516	msedge.exe	139
PID 3516 wrote to memory of 684	3516	msedge.exe	139
PID 4684 wrote to memory of 2396	4684	windowsdesktop-runtime-10.0.12-win-x64.exe	141
PID 5232 wrote to memory of 5924	5232	msiexec.exe	142
PID 5232 wrote to memory of 5780	5232	msiexec.exe	144
PID 5232 wrote to memory of 5604	5232	msiexec.exe	146
PID 2396 wrote to memory of 5712	2396	windowsdesktop-runtime-10.0.12-win-x64.exe	147
PID 5232 wrote to memory of 896	5232	msiexec.exe	149

C:\Users\Admin\AppData\Local\Temp\Voidstrap (1).exe
"C:\Users\Admin\AppData\Local\Temp\Voidstrap (1).exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.NETCore.App&framework_version=10.0.0&arch=x64&rid=win-x64&os=win10&gui=true
  2⤵
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2ec,0x7ffbbd3fc188,0x7ffbbd3fc194,0x7ffbbd3fc1a0
    3⤵
    PID:3256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1860,i,9177358191248675838,20499565655984736,524288 --field-trial-handle=2280,i,3102769255151520989,1888430541898522727,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:3
    3⤵
    - System Time Discovery
    PID:2976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,18073960653414294151,751073848767635475,262144 --field-trial-handle=2280,i,3102769255151520989,1888430541898522727,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:2
    3⤵
    PID:4240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2656,i,10428736344746632749,13113937072279564038,524288 --field-trial-handle=2280,i,3102769255151520989,1888430541898522727,262144 --variations-seed-version --mojo-platform-channel-handle=2792 /prefetch:8
    3⤵
    PID:4380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,9497251200544244508,5107541252367317511,2097152 --field-trial-handle=2280,i,3102769255151520989,1888430541898522727,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
    3⤵
    PID:2024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,8452435716146641118,13020014771308161803,2097152 --field-trial-handle=2280,i,3102769255151520989,1888430541898522727,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
    3⤵
    PID:1448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4252,i,7961472745255188333,8558504326551667934,2097152 --field-trial-handle=2280,i,3102769255151520989,1888430541898522727,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:1
    3⤵
    PID:4248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4268,i,4847380105344448891,15808851517596842706,2097152 --field-trial-handle=2280,i,3102769255151520989,1888430541898522727,262144 --variations-seed-version --mojo-platform-channel-handle=3424 /prefetch:2
    3⤵
    PID:2348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,1360475619191539801,8878616608717365566,524288 --field-trial-handle=2280,i,3102769255151520989,1888430541898522727,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:8
    3⤵
    PID:3620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,5815363035438029124,6718589672887222189,524288 --field-trial-handle=2280,i,3102769255151520989,1888430541898522727,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:8
    3⤵
    PID:984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5328,i,1613040628135800471,8108059299677748068,524288 --field-trial-handle=2280,i,3102769255151520989,1888430541898522727,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:8
    3⤵
    PID:1676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5332,i,8612698592187844967,2043519889973581193,524288 --field-trial-handle=2280,i,3102769255151520989,1888430541898522727,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:8
    3⤵
    PID:3520
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5960,i,5242343205869002903,11648951227685956030,524288 --field-trial-handle=2280,i,3102769255151520989,1888430541898522727,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:8
    3⤵
    PID:4404
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5960,i,5242343205869002903,11648951227685956030,524288 --field-trial-handle=2280,i,3102769255151520989,1888430541898522727,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:8
    3⤵
    PID:1476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,4715324357243800989,2504518627396656393,524288 --field-trial-handle=2280,i,3102769255151520989,1888430541898522727,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:8
    3⤵
    PID:2376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6264,i,18435227312551880142,3144303210328048799,524288 --field-trial-handle=2280,i,3102769255151520989,1888430541898522727,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:8
    3⤵
    PID:4680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6240,i,6304740366670517608,7830877874895488688,524288 --field-trial-handle=2280,i,3102769255151520989,1888430541898522727,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:8
    3⤵
    PID:2688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6664,i,17375600961900119357,10835313599300382849,524288 --field-trial-handle=2280,i,3102769255151520989,1888430541898522727,262144 --variations-seed-version --mojo-platform-channel-handle=6660 /prefetch:8
    3⤵
    PID:2860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6680,i,14313752685730671757,171544840416531972,524288 --field-trial-handle=2280,i,3102769255151520989,1888430541898522727,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:8
    3⤵
    PID:5352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6412,i,18178875996437410602,12893586988028737355,2097152 --field-trial-handle=2280,i,3102769255151520989,1888430541898522727,262144 --variations-seed-version --mojo-platform-channel-handle=6756 /prefetch:1
    3⤵
    PID:5640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6536,i,2761509190029463374,16610581040787391945,524288 --field-trial-handle=2280,i,3102769255151520989,1888430541898522727,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:8
    3⤵
    PID:5312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6868,i,8289586472184784210,5031124781396113133,2097152 --field-trial-handle=2280,i,3102769255151520989,1888430541898522727,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:1
    3⤵
    PID:5308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3456,i,16924768060000994447,10474820536612256815,524288 --field-trial-handle=2280,i,3102769255151520989,1888430541898522727,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:8
    3⤵
    PID:5676
- - C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.12-win-x64.exe
    "C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.12-win-x64.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5832
  - - C:\Windows\TEMP\{B651D8C0-51D5-4692-B608-BFA4BD5CE936}\.ba\wixstdba.exe
      "C:\Windows\TEMP\{B651D8C0-51D5-4692-B608-BFA4BD5CE936}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{2A4DCA64-B319-48C9-9BEA-840043264626} {3D86566A-973E-4C79-B074-D52B846D4034}
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5128
- - C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.12-win-x64.exe
    "C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.12-win-x64.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5956
  - - C:\Windows\TEMP\{1AF10A49-79C6-44C8-8520-99AE84473483}\.ba\wixstdba.exe
      "C:\Windows\TEMP\{1AF10A49-79C6-44C8-8520-99AE84473483}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{1A375417-4B4D-4072-A74C-B6E0B8F4CE9E} {8883DB16-8194-43A1-B990-5440BCB018C3}
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      PID:2104
  - - C:\Windows\TEMP\{1AF10A49-79C6-44C8-8520-99AE84473483}\.be\windowsdesktop-runtime-10.0.12-win-x64.exe
      "C:\Windows\TEMP\{1AF10A49-79C6-44C8-8520-99AE84473483}\.be\windowsdesktop-runtime-10.0.12-win-x64.exe" -q -burn.elevated BurnPipe.{4781426C-939C-49C1-8973-D1E87688FE25} {A66297F7-DF20-4C43-B1AD-D6B8C8271825} 5956
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      PID:5624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5996,i,6918024838354931673,389117050424889842,524288 --field-trial-handle=2280,i,3102769255151520989,1888430541898522727,262144 --variations-seed-version --mojo-platform-channel-handle=6728 /prefetch:8
    3⤵
    PID:2688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,6307369397929307282,9312040583475954400,524288 --field-trial-handle=2280,i,3102769255151520989,1888430541898522727,262144 --variations-seed-version --mojo-platform-channel-handle=6740 /prefetch:8
    3⤵
    PID:4680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6308,i,9770794880735061959,922499923217152133,524288 --field-trial-handle=2280,i,3102769255151520989,1888430541898522727,262144 --variations-seed-version --mojo-platform-channel-handle=6716 /prefetch:8
    3⤵
    PID:2876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,12112332073384367554,2856134890947389189,524288 --field-trial-handle=2280,i,3102769255151520989,1888430541898522727,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:8
    3⤵
    PID:684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6156,i,12698055709617475554,14161201494624098880,524288 --field-trial-handle=2280,i,3102769255151520989,1888430541898522727,262144 --variations-seed-version --mojo-platform-channel-handle=6904 /prefetch:8
    3⤵
    PID:3936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,11079704321486783291,2674211968594830767,524288 --field-trial-handle=2280,i,3102769255151520989,1888430541898522727,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:8
    3⤵
    PID:5500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6564,i,3704145722148263774,2798068148834941486,524288 --field-trial-handle=2280,i,3102769255151520989,1888430541898522727,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:8
    3⤵
    PID:5384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=888,i,12387348192113163238,4162021073583524357,524288 --field-trial-handle=2280,i,3102769255151520989,1888430541898522727,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:8
    3⤵
    PID:4160

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:548

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5232
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding BE4D76E76EAAC0BCC79327FCF90787F8
  2⤵
  - Loads dropped DLL
  PID:5924
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 4E4C0B5F8EB95A6E874B34BE3458462C
  2⤵
  - Loads dropped DLL
  PID:5780
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 2AC2CB30883B465FD20F74AD00FBDEC0
  2⤵
  - Loads dropped DLL
  PID:5604
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 2B0F128B01D1E72E6D405C56778881D3
  2⤵
  - Loads dropped DLL
  PID:896
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 1D76B3D05412B4D8C7084A04E5C787E9
  2⤵
  - Loads dropped DLL
  PID:4344
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding A13BF6CE7FAC9C6189F47B33B90F437A
  2⤵
  - Loads dropped DLL
  PID:6004

C:\ProgramData\Package Cache\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}\windowsdesktop-runtime-10.0.12-win-x64.exe
"C:\ProgramData\Package Cache\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}\windowsdesktop-runtime-10.0.12-win-x64.exe" /burn.runonce
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4684
- C:\ProgramData\Package Cache\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}\windowsdesktop-runtime-10.0.12-win-x64.exe
  "C:\ProgramData\Package Cache\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}\windowsdesktop-runtime-10.0.12-win-x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.12_(x64)_20260923004052.log"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2396
- - C:\Windows\TEMP\{BF41FEA8-93F2-4EDE-A040-3B29B9905DF2}\.ba\wixstdba.exe
    "C:\Windows\TEMP\{BF41FEA8-93F2-4EDE-A040-3B29B9905DF2}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{D2A77B7D-087A-47F3-8594-B47046AF95CE} {425A0E6F-5E44-4D00-B5C2-D7CD50A744E3}
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:5712
- - C:\ProgramData\Package Cache\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}\windowsdesktop-runtime-10.0.12-win-x64.exe
    "C:\ProgramData\Package Cache\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}\windowsdesktop-runtime-10.0.12-win-x64.exe" -q -burn.elevated BurnPipe.{0B5351A8-412C-4D9C-A70A-07B45D4F0578} {C5B3601A-7097-49C9-9FCD-21758AF6EF0E} 2396
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4208

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5936e8.rbs

Path C:\Config.Msi\e5936e8.rbs
Size 11KB
SHA256 e4546163ff0357182396e4f28be75fa61606963b6aa9aec15cc5166388b8b44c
MD5 66e0a53e01434dee600ef266bb9b33fb
SHA1 041cf167da46283e1392116e68b4398d6f00bb0a
SHA512 1d56661be274322e80c934db6542e1f3e880ca534898a35240bbd34c09942174cd7ca8070e2721b7200cd1cf8c87a7fe402aab0a4161225871048874f9929d9e
SSDEEP 192:AKvwTCNyab9tH5HrSX/e95VKnIlVKn7jEy8FCPePp/K:AcwTCNyaJtH5HmSVKuVK3W8
TLSH
T199326192660182D3E9962B75C70F2B357B73D2DA934CA79F09CDC0245F273CA0F6519A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5936ef.rbs

Path C:\Config.Msi\e5936ef.rbs
Size 9KB
SHA256 1f4cbc36f0a3a0f884991541e7bc9aaab1cbebb559cde2a49f3480bcbc953313
MD5 a01d0c371cdd3cbfb904d4860d325a41
SHA1 e2cb985951164f00a39d8ad8157eb9bca0fb0f14
SHA512 b979c24734398e28ea35b56667dd75ed1d966a5619298aeded70bfd1d96a303855ac89b5b48d75e762074613c0cbca1e0b6dc327cf5aee17e8c0e8a3cd320936
SSDEEP 96:dm0B0yiChrE0NeC3VGUzUeD2KPKACsTlHUzUeD2KPKAC6jfsQnUTl+nKLE5t7J/d:AY0SjeM5rKnI6rKnjZEHRvaePpx
TLSH
T1D7123101660487D3F9A26B38DB1727743F76E3DAD214179B089C93748F0B7892F6A19B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5936f4.rbs

Path C:\Config.Msi\e5936f4.rbs
Size 49KB
SHA256 828e2a0a13c9441cf25773c307449a9da419fbb3cb287ca88ff9bbaffa0dee7a
MD5 05e75977a002e48bbbd179eb5b68e4d8
SHA1 a87838b1236ee2ba67c691701c592db68e97e4e4
SHA512 c739c1b3d50a78926d3d221b0df2e166defe4fc0606d1e09464c26cc6bf5b645b65e8c706665f75c41664c418b7fd1a8f0e9c456dcb8b362dabb71405802a4c0
SSDEEP 1536:o4OMFA4VnTxhBGGNpC14R9poCUv/X9u7DwzqWQn6XnbrFZeEB3tve9wN1E6sLYei:y6/w
TLSH
T122331E38FB80C1E6F633B9A9B330D9447349CB8597198D9917CE0509CE8679D6FA83D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5936f9.rbs

Path C:\Config.Msi\e5936f9.rbs
Size 71KB
SHA256 c98b6e43dbd4b139c6e2a8eb0558a11d87d6c6533b3cee8c61886c1e78f095d2
MD5 59576f8d16526b8c3742f2e01799d14e
SHA1 d2abcc6ee5bd8fd2290731256f08dd89cafb6c95
SHA512 ee0a5a5720acbd5060491b39ff59eabd0919d529d4e1684f5b450ce0eb283fc9844d94b06ab9799686bd4b633c06d325f6faf1385c1c1b47f89f6f71dcf80545
SSDEEP 1536:G+0pVuVCQUF3YJvOOfcVvQHNxaeeskGWcgayskAKwVxNbTO8E2fu/ocV4qBgpdWW:rh0Z7Aj6s4Se9eIOm0i6z
TLSH
T10B63EEEB5610C5C1E8322A5813FBFE48AAD9CD67B344463D00C5332ADEB79C6DF68991
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5936fd.rbs

Path C:\Config.Msi\e5936fd.rbs
Size 3KB
SHA256 00ac4aa61dff5e1777222a3d61f16780180f9696a94ea78ac40ad932e1fcf034
MD5 657f632f2f7f4ea33e9fecca7ea38158
SHA1 ce5e4d77bfe2c6216a32e4c12ba971e2032a1dbe
SHA512 9bd63dae9c259abff71f9da1f018b38e0f9de2c2eada193872fbe7e89c08c1f9c5bcc0b35760aed6a87bb44afb7ccbf3025320290f4ece284b3e427e72ba6e2d
TLSH
T10B71BE02DA40C6D3DDA22B35CE271B6133BBD3DA9724878705DCA5340E4778AAFF9246
MD5 SHA1 SHA512 TLSH

Submit Download

e593700.rbs

Path C:\Config.Msi\e593700.rbs
Size 3KB
SHA256 c2cdccb11b605c453a955222e2275e2edb58d501de9e99a56cb18333478d0d64
MD5 61901e17abcc5f3109700cfaa0b58e0f
SHA1 d60dc1fe8459319dc262f4570c5178005a6ee0bf
SHA512 dd86c336a5d27dff17927788a96d0c7cc8df097ae99e474d496d75a255b6dc3c0b322fbc8b807d00db2b4e94bd86870b52d9c0dbd331684b7c2ca7aa9f70416a
TLSH
T1C381BE43AA00D6C3ECA31B34C9171B2173B7D6D7A364434B00CCA2714D6BBC69FEA686
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3516_1689536471\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3516_1762515601\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

ThirdPartyNotices.txt

Path C:\Program Files\dotnet\ThirdPartyNotices.txt
Size 77KB
SHA256 deb4427a295e1ed474b0d81c5a0d972c1b550b9a715cda939cdfa9236b1b418f
MD5 0d8867a25ba926e6e40cd52ab3536b5c
SHA1 89390dc8b8318d0bfef1c6a2fb4783537e28a465
SHA512 317ca335405274f4f91b173651ca2826760acb5ba5cf41aff51adc55c2cda9059fb268333665f13f62fa48119e55a303720a780dd58d28dd9967db4c88407d61
SSDEEP 1536:HA9jHwsGfgg39/zwgAVkguQxrDjugtSEGepkWvrpX7anuqdLSVnfiStPq+3LefrL:HA97w/ogz1AVxuMjHtSFULryLOgrGWm+
TLSH
T17773A45F7E45077319E2C3916569A8C5F22FA02E3B6B2A44346EF248133B42DD6FF858
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 163KB
SHA256 21a46f1e5235cf4e844b9de5429f0e198b9c97a41f0503a66442f1d639ca3ee6
MD5 522dca4be4f99d21ad35ebc3bb24a066
SHA1 5fa4dba916a6bc846eb6001e7f6a468d04c2be04
SHA512 3d65cd300176d21c95c2ff5a75cea9b478c505dd42bf95d45a0b2486d544096791eafb04aaf3d42bfc4e731ec4320b47cd2ae3b57c5a760f6a89645ce11ef98b
SSDEEP 3072:nGgPR9lIuvTSBbQ/09n4SbDqIG/Tk7l55wKjpFF:nGalIubgbQoDvqIrthr
TLSH
T19FF3071AD65811AAD16E9575CB528941BB337C668BE0E3CB13C0F8BE0F726905EF9703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

state.rsm

Path C:\ProgramData\Package Cache\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}\state.rsm
Size 1KB
SHA256 24c268e18fe2fa61b9bfbbec2d225fd38e22f293041cb50f40dd503a0d1b8828
MD5 04262cac692c70373b5c576a90c78848
SHA1 f7033084aebcabed10adc9ae1009d7b9518e8353
SHA512 7e67a7d1bc66b427f121fda5840e5938a40c7f3b99a03842a3041aaae213fba6e17b824d8ea2312c9fab1c8f554d206faa38eb1b3298352e8827dbd847a12627
TLSH
T14921D1515BF6092CF3F6AB3469F96625443BBC121C20C16E0001318A9E32BD0CCB0B37
MD5 SHA1 SHA512 TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c904cde2439d0f658b6928376273908e18874923ffb5ab0253d91ef97d247274
MD5 71592819d06ab9dfd94505cef3db0b85
SHA1 fa4c610ce7419e5f934db322abc11ec563259b9b
SHA512 f0dccb656458e10495c6728811a1fad970a69f8abb5ce8e9bcba9e93f496cd66fb3ce8ce1065b946203d7912789774c609787e85dd5139479b2562b6f05cfae0
TLSH
T16BD002F8BB950515C5C970F7713BDB8143B6EB218246265D64F21E082D747B23606895
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ad9341a3ad2b263d2be4ffd8a97b10f49a2c167d02a5b66182496dee5e8cf827
MD5 8f79499bd1d234dc030ef99e2f850e0e
SHA1 4dd7c44b8570ce93f3db7df7fe1188f189fa82fa
SHA512 d06aa3eb27c999ba47fce9a170740591ef6bacf188a5d364ad9a567936919e24290b5c0c3a8ad16cae1e37c71c2364d9db3ba42e5914a96b0f1f732c29ff5945
TLSH
T199D022F83BC00800C8C830F3303ACB8003B2EB208202230E20F20E080C303F23202880
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 1528a14e59c16f883e7878da708c09e5486285467e658ceb072615f7385ca94a
MD5 6cd42968f0429bc6e94e88c3b811e543
SHA1 ba72af9ece2b38a3dbaba20ad1fc59f151742c7a
SHA512 bd4ddb3ca4d67f08f9de5e54b4127dee085a7d7fa7bf0b9d266a889a2bf54ca4c738d49509089ed8c71c7e3ec9f7a5877b1fcce8ee539e408a747564ad88524b
TLSH
T1FD61C9C4EDA50390FB952F78C2D805CF3AB867A9A647DF3D2A9DF479584AF58500C304
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe594116.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe594116.TMP
Size 3KB
SHA256 61e094fdb49a3036eca2b58650e4be19f209d49a9792c3a299102440d2e0d4ca
MD5 40435cd8944f0ededbbf8f8fa8b85fb2
SHA1 7b7b2c0f6828bafde587dbb4c5874628e832adff
SHA512 411d6748e9d9abd3e4e551829a30e53d732b221972f79fae315562443e68f551f72592769000d8176dd7933a0a9ac6ba35e639273b49bc5f3fd9d9f348b4cb84
TLSH
T19351F7C4CCB14354FB990F79D2D801CF36B86BA1668BDF3E1A9DE8B9580AF19500C348
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 0419b8848b9fe8d6fbd31a3bc7c9a0bed782f0b670ba3bec016230b8b3eec62b
MD5 fb4fd77e609f8bc0867d60770ef9d960
SHA1 4facb9eff103f0f0e0f2fe1abd2fde3b19f6b7c6
SHA512 edfed9e3f6c00feee71cc28b39986189797c4b72de5dbeb8f730609575ba329fc397f3d8f7cf6d0c1b5a5050df1bc465b27698db2e0422d79685f53f009648e0
TLSH
T164617AF787B4856ECA019AF09A18EE2FDF2D0615431C786989D4AE27D3E3472E00265F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 002d4bb23634a174923eaee3327c56d95681514ec789ec170a50ae78986a7628
MD5 5bbe778dae1f06d5e5b87376f3797112
SHA1 606d04aaf54c0057b15287771784ddda1f2f93d0
SHA512 88ce0983e5d5fc6e8da49063a20d9d95849fc11ae9dab824a301729aff54ec335dfccebf6541ad7172e3372f5ca9fd9c89287dfe3a649e44cb625558a2ea0bda
SSDEEP 192:sxZGReV8/fJsjjsZzfIdpwEHW6+WNrwu/AnRP/ESIg4J:sxZGI8/fJsjQZzQZHb5/K5c
TLSH
T1AB22B916AE34A97B8CC7E21DBA15BF13E6F9403291D11E48AAFC861C05EA6DD630740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 7dc463570a2d23e5ea3787e686e41ac44e5a4e6b4e2e2289197383de3a6c8639
MD5 19febe2ee002943d93ec03d2c76c8094
SHA1 96a657229db02333dfb496bf3fe4dec96af71396
SHA512 3f79b24c7e3bcbd80c5346092d9fd7856719a0d1b8dd9ad59d2c10a25a3d44ed986733cc8a9e93329066e442d77466c7d688507471b6899f4bc229f83229feb6
SSDEEP 192:sxZGRe88/fJsojsZzfIdpwEHW6+WNr9KXAnRP8ESIg5KJ:sxZGV8/fJsoQZzQZHbYXKKY
TLSH
T12932D916BE34A97B4CCBE219BA55BF53E6F9403291D01E48AAFC861C05EA6DD230740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 07aa4d164645ab6b1c2d3b047b3bc180a22dfa06c0dce206cd0c2cc3872f5a4c
MD5 27d4860d1bb88811d486d2946260a8a2
SHA1 69380e20f69ebd96579471931b2bf6203e333e85
SHA512 8b8e2b26027de62fbeff3ccd9d140636a80fed337fa56d18328da9258e8f78142377d68729b0cfeec5a08260520b59bcd19e5602d7bf5a6b40edf7d6e60b63f9
SSDEEP 192:sxZGRe88/fJsxjsZzfIdpwEHW6+WNr9KXAnRPlESIg5sJ:sxZGV8/fJsxQZzQZHbYXK/W
TLSH
T1AB32D816BE34A97B8CCBE219BA55BF53E6F9403251D01E48AAFCC61C05EA6DD230340B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 0ac58f60e7cf1365d64b3faa77c5a31aac2c7a061442e687ef3025f3dffa8a9e
MD5 5b93f3570915c853c1e0fb0beb4f8329
SHA1 f75eb15cb3adefa9d55406eeecd5865294403e10
SHA512 b14dc3801e3877616b2cd6e806680337f1f561889c28298567888bb72866cfa4bab3d6de5a8600bfd412e5690441c6cfc0773c4d6bc374260b0f6014ce080ca1
SSDEEP 768:BlK9uaZ7pLuLbwYWvcQWs8F1+UoAYDCx9Tuqh0VfUC9xbog/OVAn0HLlh7k36roz:BlK9uavEbwYWvcQWsu1ja1n0HL7Q3xga
TLSH
T168E20B3F780CCB7F4FC00A9DDC5A7F9A6EA8029B96988D5047FA945C02C67EE51160DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

27467318-5d50-498b-9e4e-e2688fe65302.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\27467318-5d50-498b-9e4e-e2688fe65302.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 665195fec23198718861d4202b4661269241a3232ea0153c24f7416748115ccf
MD5 06f89d05d1d86aea665ea2140b03daa1
SHA1 bb5c8e705b5ff568e605de581ad6ab86fa1afebb
SHA512 8280b799198e468054b4cba179b85d6e98436be983823ab0515eb297ac0fd9256e54b7719ffd19b6c30fbb4e9df36c0e49cd60f97b967a6e1b82ddf6146cdb36
SSDEEP 192:SONa6ygpQmiUymZmmtOCTVg9l+FdV0R0rNzPZA0U6:SONa6lHBomtOCTVu6diGrBZ1U6
TLSH
T11502C835AC683CBB8DF3AE06F48736139FD4117BDA552B94D9E81B1C01D765C2346826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 4562f807749581411da7cb50ac60fc89c82e68a5a54378fcc66125976ca10f81
MD5 ce8ef25f2f0df3a189c56fdb89b7bab2
SHA1 939dc30ba3ac8f9bc9cad272c5dcca4ef6bc33f1
SHA512 90c9186374f92a2ccd963bce113d198a0bd53a239c6ab7bc5739ebb485bc5e085afd0e7ff837651e3a1216af9eff35448c367daf5dd8dc59dfc3de1c8511a5bb
SSDEEP 384:n7ZcIgsNElw2q8Ho52cjIX4OjTVu6diGrnRwJrgZZ0/upa7dLKkl4oG:jgRGXjIXLnbNihgZZ0Sa7dLKkl4d
TLSH
T136826C759C789C7754FBB205F48B3643DFB880B799852F84D9E98B0D01D66A8270BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 58f1aafee7e7221ab997ce8f3716383b5201f674f4c396ea29b2aa2f1a8407ed
MD5 4ab704a275e60902f4c73ce442ba8e0b
SHA1 832d83038be41864bb6d3fbdcb7c3484bb552ee8
SHA512 101af4752875faa616a18529e2c32da99bda334836a3c629b4c13e867893352bd1cb21e356d453e26903a81039ecfd7de1f41b988cfa259bc38822c94af01ef8
SSDEEP 384:nSZcIhsNE+w2q8Ho5rcjIX4OjTVu6diGrnRwJrgZZ0/upa7dLKkl4oG:ghyGGjIXLnbNihgZZ0Sa7dLKkl4d
TLSH
T143827D719C785C7758FBB205F48B35439FF880B799952F84E8E9CB0D01D66A8270BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 3e683103e917310b42e3a9c5a66638b5fc8408f088f695e60183655fa7d646c8
MD5 f43f273a67ebe66b520ce8e95d621083
SHA1 dc86a709e07f0aa5f9e3f4b7a82873db9cc266b3
SHA512 3773c7d2f271a5a796a2282bfcf050cb0caa1b800b60d58e2a700e859f31cf9cb975e9538099e953effb443d6925b68b70e5e73cea617b6673e898fc60977a90
SSDEEP 192:SONt6y6QmiUymPmmYOCTVg9l+FdV0R0rnhxFJSJrN3UZWr/sNU6:SONt6xBumYOCTVu6diGrnRwJreZZU6
TLSH
T1B0120734A8686C7789E3B502F48B36539FA410B7DD862F94E5E84F1C00D77AC374AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 609aad54268d2ec176773ea301d15e815c601e30fdbcb37007a3d919c29197e3
MD5 82021140190904d75e187cc1b15c73c0
SHA1 36d92eee50c0c782dc0a65f02be34d8e25e34f22
SHA512 6362434027fc6a2bbc6d5eecc76ecd978143a2022eb694912c19cd009a14b6e3584fb7e34c24e394eee22c9849b13165938df9a49e4f6d545ed917d0702397dc
SSDEEP 768:SFktxwgDGXMIXLTgbNihAZZ0Sa7dLKkl4d:VtSXMIUP0T4d
TLSH
T153D2C5F588E78977D8AE5383A73E6D429EBCC063B5885984B7D94E0CCD821BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

d56e23f7-dda8-4976-92e6-d67a422caa72.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d56e23f7-dda8-4976-92e6-d67a422caa72.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 1aa15e201bd9d8405e18ded3a0426d9e78a6de9ddf2bbbcd4f7f14ef30027ba5
MD5 6b040f8825f2e356a6c4e7794010a581
SHA1 ad8d40b5f16003547c3b84de7df74bbbabafeec0
SHA512 7778d0c57b2968290ad4933fbabef429681985a18b93bbf4760df6a87e7d73d7e779cd01c6365976d039a01b3d673f5084c02a25c6c19b8068fdbb5453711279
TLSH
T124412A9CB6FA1058B3B36F5AABF7686E447ABD772E46D09D10110E4E0A23B40C971733
MD5 SHA1 SHA512 TLSH

Submit Download

0dfb2b58-1cd7-40c0-8add-2c904f3f8225.tmp

Path C:\Users\Admin\AppData\Local\Temp\0dfb2b58-1cd7-40c0-8add-2c904f3f8225.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.12_(x64)_20260923004052_000_DotNetHost.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.12_(x64)_20260923004052_000_DotNetHost.log
Size 4KB
SHA256 0ce7414363bbb95ce7e1f217536ce2a5bc207b8498d572961446f284ae24c5c1
MD5 0ab9d166ac51968d8388fc8eaf12ffb7
SHA1 785a3a672ed670baead6f941ce6bb4290a83de9d
SHA512 243e10d3fc334d3a4fd35d4bce858490d8fd2af8c0425c8145653172bf8a8d78bf224a03d5d69966f5d100bb37cc1b25b9fd5c1835ec8fcdcbff908ed2397a45
TLSH
T166810D161EE80946B2B357579EF38033AB73BDE16C75CB8C2345431906A7C05D8A8B7E
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.12_(x64)_20260923004052_001_DotNetHostFxr.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.12_(x64)_20260923004052_001_DotNetHostFxr.log
Size 2KB
SHA256 fee8cee3b37b81c676d45025ea17f2ef17622117da66026d531fe29698d3a9f9
MD5 7fc36e7b5b4d8af589eb773170af954c
SHA1 44e28fcc3e53d00a82b7e81f01bd704ec5d58768
SHA512 76bc66776d6bd7f8011079f7e9deacdd0cc0eba21ef4ce505c3c417ab8d290216e904b340156e62b1c3ca501fbc041833de3ea7a6325d95e0c2aa04031e7a516
TLSH
T1E1414F251EE50A05B1B69707DEF3C1239B33FDD5A834CF4C238843290667D02D998BBA
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.12_(x64)_20260923004052_002_DotNetRuntime.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.12_(x64)_20260923004052_002_DotNetRuntime.log
Size 2KB
SHA256 5da24eeb9c82604059079c605736940b853d861b3d9930475ab22fe5aac322ec
MD5 a19934bb78ba1cde090b6abe587555bf
SHA1 37edca4e3035bad5dd032e06fccc1db651f1c628
SHA512 c4b3c2b1788a8d9a7c76651555e671f9f5bbd07e176b0fdf99b0d84601f9dacf7171fc74adc1755243a2c2ea66aec9913c57cc283984ca1593851eb697458c9a
TLSH
T1764126122EF50A05B1F25747EEF3C0634A33FC926974CF4C2344436A466BD0288ADB7A
MD5 SHA1 SHA512 TLSH

Submit Download

e58188be-91c2-4219-9328-f2f6e77b6af1.tmp

Path C:\Users\Admin\AppData\Local\Temp\e58188be-91c2-4219-9328-f2f6e77b6af1.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3516_145055582\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

da200c85-a3ec-4be8-83b7-eea5387eb9c7.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3516_945563177\da200c85-a3ec-4be8-83b7-eea5387eb9c7.tmp
Size 157KB
SHA256 e03138d37406c2bedec93e5a7c44a457a6b19cf4fee5dfe5a46450fcea1bf85e
MD5 088d09e1a5cd1db2f55a4f5131b75b3b
SHA1 4e017079555c92f2f9419a53ab89aae7c5425550
SHA512 f8e7a1652d20778af9e0aefef0f24bb477260eefd5c6cecd3b4e17276b7d6c8d79554e850b9a9fdd9c65095ae16dad8868df304ee7a057ec7cea5a35b9e526ad
SSDEEP 3072:sA30KAb7L7nAnBPxnb8b4HpQgHY15vClaH4d6r1tx:sAkKAb7L0Qb4HpQgoq8tx
TLSH
T182F3E1AD2FEE891ACD0B50BD3B04B38BC90A8F07820A655F735F8015997475D17A2DFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetHost

Path C:\Users\Admin\AppData\Local\Temp\{1AF10A49-79C6-44C8-8520-99AE84473483}\DotNetHost
Size 848KB
SHA256 f59a0c4177cd57a71c99b22009131a3bdf898ee6db62ef0415f056c4b26bb53c
MD5 57a71197c3da73f5088600fe1315f870
SHA1 5ee2d560c4d70756e29cd7d065cb38fd8a750ac3
SHA512 df44b6deb6c72b0bf8de820767041a378e97e4994e95ce00b675676b3892803620d94373492a04a598dfef334f135152b267b175ca3148af10f8341a88024927
SSDEEP 12288:LBGQ4cABdUb/aVo/2WCsT7pXJS5qgBwhYA3hy6J:dGyASwoO2T7RgZMY0hy2
TLSH
T119055A1BBF9414A9D8A24EB1C5B78321FE357C082320959F46A4B12DDEFB6E0647B7C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetHostFxr

Path C:\Users\Admin\AppData\Local\Temp\{1AF10A49-79C6-44C8-8520-99AE84473483}\DotNetHostFxr
Size 920KB
SHA256 ff33e8f0a6f4624f8c160f96aa8066eeb86bcc6e608fe258deeea13bbd18e82f
MD5 0dbebff80e13ff5ab5de800e763e5b37
SHA1 e044e032e89bbdededce81d655ae84e3123d367d
SHA512 6a4d2f9d8c713aa4abb3281904a61a0be2241d1bd419d97b8650d2398925f169a85dbcf2467653fcd624127df74cc2c8f4025c70a222f47bd91cc0e3e2cab8f9
SSDEEP 12288:CBGQ4cABdUb/aVo/2WCsT7pXJS5qgBwhYY1a3rHLf:GGyASwoO2T7RgZMYF7
TLSH
T171157B1B7F9014A9D8A24EB5C5BB8321EE357C082320959F47A4B12DDEFB6E0647B7C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetRuntime

Path C:\Users\Admin\AppData\Local\Temp\{1AF10A49-79C6-44C8-8520-99AE84473483}\DotNetRuntime
Size 28.1MB
SHA256 22319614080d76c82a33b196c5765ca70ff1f38041e907c7d5ed8775f6c5f3f6
MD5 4d24332e3f8bc0e2b708e5ef1a77c7bc
SHA1 c5719df9a461dbe3fcdc98fa124233c2ab9c40d7
SHA512 40b135e2e289067cbfb90f7f26cde73342411faa028533fb969effe688734c88ba19e2083040e62309011f81eb964c18b6017929a3a04b145c7677160163173b
SSDEEP 393216:H4lM4oYejHXelWkVUhg75WNLimpDkyBKuy75k9PX17foSjUQaoMU+//+tFwA/T/g:N487t5DkD+VJnixU+nuFP/mP1QgRvx
TLSH
T1C95733637FC419B9D8625FB6C0FB8751AE353C44236055AB42947269EEFA3E024BB3C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsDesktopRuntime

Path C:\Users\Admin\AppData\Local\Temp\{1AF10A49-79C6-44C8-8520-99AE84473483}\WindowsDesktopRuntime
Size 28.7MB
SHA256 1a20c13d8103d83ada5db2f9b380f69273cb17766c6e5ca954ecb93230f218e2
MD5 6712931c838d7173b4fe90e26cf3b44a
SHA1 f84ec5355723e6ec63fbae066c1279c343da0450
SHA512 a52a9a6f8a93fad3b2bab1abab55cec643b1b5f32a40ac11a89c36fc79a7fc1603c58de7883adad7730a6790eaae831a8c4a556cf5f09f4588f1be0a4e116c43
SSDEEP 786432:6BL3xuy6hjEjqDpD2dSNcZojdjc6uAkCt/BDmR+Wbv:6BL3xuysjRV2dSqGlMAkApDKb
TLSH
T1FC6733577E8209FAD8264E71C4FB9364EA393C4C6310659F02A4741AEEFB7D0627A3C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI4220.tmp

Path C:\Windows\Installer\MSI4220.tmp
Size 411KB
SHA256 ac54078e0387d2a8ddcdbee3967da6ea6ec6508172505aca3d27a75fa43ce34f
MD5 1981cd407f5b5e81c70ba2729c56b381
SHA1 e0b6d311930ab3557d5a0a8769edefb49c32aa3f
SHA512 3b7c18ca780cf05a01062661156d71e0a4626469f28040e46f07c7deb8f9a643b838bbc88eda515362c5895171a337a3f5d9b8e321e539408fc1ae47e6ae4181
SSDEEP 6144:GDvoaVoIMrKAzCsTI+q6JL9eZYr1JJS5qZ47BwhYjzmHim:QvoaVo/2WCsT7pXJS5qgBwhYg
TLSH
T135947B29B3E418EDD4B682B6C5A78430FF75744D332095AF8BA4916D1F3BAA470BB701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BootstrapperApplicationData.xml

Path C:\Windows\TEMP\{B651D8C0-51D5-4692-B608-BFA4BD5CE936}\.ba\BootstrapperApplicationData.xml
Size 9KB
SHA256 0da13bd67e88529919a3d066aa6767188b7b2b97e5dd1df2e3e1a83970c25111
MD5 6134cde82dee63b5cdfc38e7686622f9
SHA1 fcb0ab62a70f76f8ac704027ad1676080055edde
SHA512 f365db6d84c137b2257996bab84a923f7d90464416cb7605a80539fbc446e72511c7946fcb0eb496e790ce505c29d8ac5469fa6f047acf786149f07315b6fb85
SSDEEP 192:iFzanZTl6/wvRSn9Xta+ai2fZ8SsCsysz:3nFptsCsysz
TLSH
T10812E5512BFD0219F0F3AF48EFF6A4155A3ABD152E39C92D01211D0F49B2E819962FB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetLogo_256x.png

Path C:\Windows\TEMP\{B651D8C0-51D5-4692-B608-BFA4BD5CE936}\.ba\DotNetLogo_256x.png
Size 2KB
SHA256 0f571f95d8eab48dbc81b0ec5e9f7225e349e26ef50868bfaab556f3c2443b01
MD5 39aa52615723b782c92dec710caaec7f
SHA1 760b49e256a7979fe50a56a2b1be3688a474b886
SHA512 89d1baa3820154667747b25e9e2fd321bfb2ec71dc309915b0a28dacdc80822a4943b639ebb37c37bd2559d5a4306d2096119cd970c84a0d331f6c68b0456dc9
TLSH
T1534195CF1BFD78D7E6E557918E1A8DD232738483B4B3A42CCE7B10B8274A5642B87940
MD5 SHA1 SHA512 TLSH

Submit Download

dotnet.ico

Path C:\Windows\TEMP\{B651D8C0-51D5-4692-B608-BFA4BD5CE936}\.ba\dotnet.ico
Size 44KB
SHA256 61a2cbd12868cb9b359e0c78961d409b7875f072eb8e53ea88d3e6bfe2961a18
MD5 b8096652d9ec286709a2c863b244b110
SHA1 b3b7f0f4d608fad7cb59ba499d4d17c2b873a7af
SHA512 492a5aa83220bb77c178b7c5b50bf44968c0427e9e45bb97a33df14d7fb4c667ca7adde0ebb3874c7b6011057b01144e4e6651fbad62c6bcf5e0b93586c4bc7a
SSDEEP 96:r+gfbzo+wHK9NbwOY4tIWQeVlV1W9+H+guapUjFamINUItzf1dBNaIZ:ro5HuNcH4tIzeVlV1WEOFDgUWzf1PIm
TLSH
T1E913EF6DE68547C1C10C2032DB4AC792B5233C72E4DAE0C4F9D4FA7E177906965C6E6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\TEMP\{B651D8C0-51D5-4692-B608-BFA4BD5CE936}\.ba\thm.wxl
Size 7KB
SHA256 b00edd703dd8a475119d0e4dd70a3aaa47f0e95361af290e76d367a8edef3432
MD5 8b2c667a8bbad3153068c0ed90df7ec4
SHA1 c9e04a3a37e5e6262ab9bfecf78280171b8f7b74
SHA512 5269f00d474acccb4c48cb7bcfdf19e63557a388572d3a6335aa39191319691d924e27f70da3f3495387c319396476c63a8fd7b35835cca0901220e39783847b
SSDEEP 96:HiTgM1+XSNEzA0HtYQstYCpCwZQpCeyk5HQJM9ouvj9urz8:Ew9EmtYQstYCPC9e8
TLSH
T191E1026F68DFDEE03A732651B2B3698D6919C29A136F1CF0F869084B47635016377A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.xml

Path C:\Windows\TEMP\{B651D8C0-51D5-4692-B608-BFA4BD5CE936}\.ba\thm.xml
Size 11KB
SHA256 dfee8e2d075087227f19c835c145c5bb8e72a46880ea24080bb2472fd3a521be
MD5 4329e418dc56b1386d7ea29a0dcfab5b
SHA1 58387f92e89ca21b4179fb697c7de9675c59142f
SHA512 6934873d27e6efbb94da4f13ee8369b29995490051016fdf82800256b924902306d328bf1d4ebbf266d1a53eb24adb6478d1a67de4ecc3e3bcbe561968f24922
SSDEEP 96:HgvPkoeWEH3IWTaQfSJgHzth5mFahbuB8pR5+Vpwe+UIJLg1gEp+6F5pQnxc:AvoWydmQfVHMyyj5Z
TLSH
T14B42FC6851DC7811C532D702AB9371D3FF12BDA6C6C85A58B48E256B1FF262028B739C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{1AF10A49-79C6-44C8-8520-99AE84473483}\.ba\1028\thm.wxl
Size 7KB
SHA256 43e1e134d0591532323dfcd138ac8f5e99096cb6cb0213a486bbb3ecc5c47aad
MD5 2d7b0d29deaa836b538baaae8378ba48
SHA1 85d86c566f601ad6e22301183771b9cc7e5062e9
SHA512 ecc84dafe21bf858eb4693fd7c0802cf28dc5fcaf43eccc4ded3c4a83bd550e3dbf58012be695cf267917c39f6047eac89fd0cdec090e253c283783d01d8a916
SSDEEP 96:E5TrTfb5joKvyvOj8USd4sZij7N4WoWKWvsNMNizchn/hD2Rd0E/aQpSK1nuQKbm:4r5owj7NgwsNMNSiK1gd6r
TLSH
T1ECE10F5F7CEFCED46A332A0176B32989191DD28A13AE6CF4F5580C478B634216B73A07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{1AF10A49-79C6-44C8-8520-99AE84473483}\.ba\1029\thm.wxl
Size 7KB
SHA256 2f174b5eed2a84e43396f3cae2e6521c9247bb0deccb16e7f9b461233c363534
MD5 f483510f350ad116c5c81468ad609bdf
SHA1 5343a3a695e6149c7a7ba831be75a91138763e44
SHA512 a39f3ebedb06361d95c39e4b7c5020d70be0e1e4654d5d5dfe254b44a7fa3a9c9c02659a28acc7ea8294620aa77818fb53609d7a2f6c9b6ae8d9adf9f2ac844c
SSDEEP 192:qxwpVLBj5iGRxrFe+4Lzv3zLfqRBxOTyv354+F:qxwNj5RxrF2PbLfWBETyv354S
TLSH
T17AF1FF1F58DFEED07B33194572B36A88681AC292035FACF5F8AE085787235059677E03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{1AF10A49-79C6-44C8-8520-99AE84473483}\.ba\1031\thm.wxl
Size 7KB
SHA256 2589887424dd4b0b27d36f7aa36d07fb6fa8d1c4dbe50059248a24823c742f92
MD5 4e98d12cfce46c393dcdf2736a2bda95
SHA1 aaf6a00e50cdf19f1c4fc6256ac040a750ca97af
SHA512 314d712f8fcb2a44abe1920aa9f44d2fef626732397d3d77e4ad0ea6a003b0ea38e361c96515c8e6f8cf7d61ab96de9a349a228522a9f4b81d82c8a8f1962662
SSDEEP 96:jgl95EIQ8+nPQP6Zc0y7jOROgYmwitzvzB5xz2kSl+ACIw052Q/LKtkCGpUvgd/q:jEpcoPWc0y7jGhYmdtzvzr8/oa/Lt/hQ
TLSH
T134F1425BA8EFDAD077332611B3736989791AD2C6136F1DF4F8A9480B8763501537BA03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{1AF10A49-79C6-44C8-8520-99AE84473483}\.ba\1036\thm.wxl
Size 8KB
SHA256 ecdd5f7b7ed65bef8e3eec00537da44939b8e8f8f604e9b39329b45ec210efde
MD5 7673a053117454b94ff8155b9f06da1e
SHA1 2143896f16e8ec6d52eecb773e99d9a2f9daa4b9
SHA512 0d20a4d6819fc64e36cfcd9c029542d6ef834faa3c74dd636bc1b6697f92d8822cd19c1692c500956fdfe69a3278a84c0545c799878107d0d56520053b9ae266
SSDEEP 96:lsZt1vwZI+XNHwt/o5HezMxzMEy0vBW4eAQf49QcyhZpuWcK61xrG32gUgGv:o1wPWto5+zwzvWhvgYUgg
TLSH
T1E202105F58DBCFE06BB31717B6639589A839C286235F58E4F86B08078763914D337A43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{1AF10A49-79C6-44C8-8520-99AE84473483}\.ba\1040\thm.wxl
Size 7KB
SHA256 c536f3f85936f6b38782df30a7bf88c7e7e66fa1e3257b20b75f9a4f0112b184
MD5 21fe14f06f2e38ca565581045a67eaba
SHA1 fe56b260ea7986f6234aeaa9f3adb010b01a0ff5
SHA512 a87e53dbcab33b95d78f67c7e62f0c3fa50711f54b11efee890b749dd21f42e68db185dc5a99160dd37403612abb9609d311dea1254c126b1e96ecf7aab67051
SSDEEP 96:p0NpgwGrmKmuaXo+Hnxy7McLi4vgjzH9euz3KLrQTNRREhZDWDIQ0gwZKWakCRos:wNBoJvUzH9euz3tTDCnZKWzDU+c
TLSH
T1BFF1EF7B68DFDDD0BA332748B2B3B589B51ED586235F19E0F4AA094B4753500A27BA03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{1AF10A49-79C6-44C8-8520-99AE84473483}\.ba\1041\thm.wxl
Size 8KB
SHA256 000e1508d9bacb7156951988ba1d6dc36165facd2163352a93b9a66e8c642089
MD5 e29c1d15cf0eeb5fb10a6f0e92b041fc
SHA1 68cd096f0135524d5d07a9ec1fbcb69e1a1084de
SHA512 47d3acdafbc3dc960d569976fe3c635613608f08102a6cd0c246f8ebe0f3343e73fc9d87a673035a46fbc4de21c59b97054dfd596dde2f5f6eea25f6ff7b7d96
SSDEEP 96:/x55EeSXkI6+QsPIVLYitzzus2iK5EmV26W/0zYe9YQfNpYjruBzUYwvdCz1Q:/BQFPIVLYszzutz8yzYUO/CxQ
TLSH
T1B702102EA5DB89E06A331611756776C8680BCC85DBAB1CF0B07DC817977341DE237A32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{1AF10A49-79C6-44C8-8520-99AE84473483}\.ba\1042\thm.wxl
Size 7KB
SHA256 09c51c910f7142ab7f73db8e826f3daff1525eea765d03bcd934cba53bc689d3
MD5 095c8d4db15a85c0c62842d0192202ad
SHA1 d703ab6b95a8190a3187a65ba1b779d856eff7b8
SHA512 86860b18e9101c2d27359e53e21c7f2fe939031850387a6a55c12d23b7dbe4133722b5fdf4364dc896d5aac5744b470b45198a47da6912a4827b88f433a79796
SSDEEP 96:YWnvHZWx805aEfLW344uU5OsW+yvuE4uU5J+jpD2kUcdkAdiY10IHDWw/fPb8Qhk:kjcuYhu5jx2kP1/3bmk9d4
TLSH
T1E8F1429B78EFDED026732C413AF36A95591AC2DA235B08F0F9254C878B738114637E27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{1AF10A49-79C6-44C8-8520-99AE84473483}\.ba\1045\thm.wxl
Size 7KB
SHA256 209911674536ad5976dad21ae1e96a9fdfa61270120a94bbe0e8ae32a67239a2
MD5 4e407f5d7e06084cb9ec7b41b1f4b992
SHA1 0aa44f39e522935de900449937af13df18a6ef44
SHA512 926daa3c9d92b7f0e910101d6482ce6e153af13dd3f59236d3418df4a158857f00ea565869312f35c0bf6e689b6f1a0bead71f54e77783d65311838dc980c996
SSDEEP 96:vz5E6U+A8fOIZcvYqUC/W5TqUbFaOa0Q9zSzfmZ5AKgY1ou5DQ7JPy+u1/8X3vCH:ln9BmNUCqeUJaOaHNCPA/zGYP
TLSH
T1D5F1005FA4EFCED127331A45B6B369C9680AC5CA136F1CE4F8AE081B87675019337A43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{1AF10A49-79C6-44C8-8520-99AE84473483}\.ba\1046\thm.wxl
Size 7KB
SHA256 7b095c32d1fbdd924d710d18d51a88a710bc152c8b30c6051524583bfabe38c0
MD5 13d65c9d4996d93edafb2696cc2a90b3
SHA1 80047984b6cee842764b24ef33a5c67eaabab2f3
SHA512 14ceaf26e16cfd039e18614d40148c44e09cc2e7130b19a3024aabb46bac77c1445cd7de84ef46577ae1ab4cf15cd0152a3ccd6fe070ee0a34b06f8f29ba0af0
SSDEEP 96:TD5ED4lH+wLwdBc7tlqIz5Vv0gpK0rD45g5q8MSQ7EugTuo6RADvAbK:Z1kvg7xlVv0gpXMfgLGK
TLSH
T1D9F1121F68DFDED037331A42B2B36A8A6509C2C5135F5DF4F8AA494B87A3500A637A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{1AF10A49-79C6-44C8-8520-99AE84473483}\.ba\1049\thm.wxl
Size 9KB
SHA256 3c911848f83d269fa2cd64bbfd7b5e88eb3a621bdd42c564c69100a8e8a40494
MD5 7904c2832b3cedabcdf0ec49dd8040ba
SHA1 2a7f428568ab6ea5fd54bb80376c552d80a0e7a3
SHA512 3c881efc2b611bda02b290bc79948818ce6e6a495dcf2dc938047875f301f18f9eae37ba109fd9b453504173cb9209192e0d2cd4603c7bf105042bc9775829e0
SSDEEP 96:C7lv+VxxVUC7bqFdwkd/XQF+L++qFQEemLq9OJRgcnZKQ8VXoshXuOxMvlmV3p/n:zVPVU//y+L++9wpZ/oRZ1
TLSH
T1A022FD2615EFA8D81222B117E9626E0E3C5B81FF3B6B5BF174641C6F76B3000833B606
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{1AF10A49-79C6-44C8-8520-99AE84473483}\.ba\1055\thm.wxl
Size 7KB
SHA256 56d76adc63b71879e3291f0f306e54081e9e80f463fcb41dc6896ecd2298deae
MD5 e2fabe4eb312645c1231029191458f7e
SHA1 f9f143535ba48d9aeb791c62e79ed687911927b1
SHA512 ddf60df1ee2f00561bc806e384478b105182a4bec673b5eb26b1db7f88adb297af80b7bdfeecd5e0aefc3579bf20a84bc9bacdcfb727b9d1af2865cdcdc48a37
SSDEEP 96:YMANNFTFhC4h4bNReiNxfufGzzzSkbAS37lsu+wzPwQT8gpwMu7kVS0uuM/r+9Hc:YlFJydNxfu+zzzgoZ7Twh/6H/0
TLSH
T1DCF1231F78DFEDD467332A56B2B3268CB84EC382132A9CE0F52944479BA351152B7B07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{1AF10A49-79C6-44C8-8520-99AE84473483}\.ba\2052\thm.wxl
Size 7KB
SHA256 340154c87016bd6af740e6a91ea86d722817f6dc2bc675c33133901443658179
MD5 e89b4290f9255b428cc21e217dc8e5e7
SHA1 84f78df432e53426412e2123c1990acfb743f6c9
SHA512 b313de643859aca6b9b2f05f88efd130c900065c08d2279af6f7d8dd0301a7a762ee0e051ccc76c737c68c86e51decd48287529e7fc9a25c0cb1228151447105
SSDEEP 96:dLf2DllNpoNWZd9rCfE4d57afwUtn93K248RYCPr/I5Qqj9BQru0iCiBkz6/3PPx:d0Np6fHGwMn93MRoL+u0x
TLSH
T11EE1119F78EFCEE02A332A5132B325CC2819D28957AB5DF0F4641C4B8B634205777A07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{1AF10A49-79C6-44C8-8520-99AE84473483}\.ba\3082\thm.wxl
Size 7KB
SHA256 2416f9a3daa6767f418c5ab94edb8a83dc9326fcaf13de1186e61b5248349edc
MD5 65b3aa6dd10a5b8db1b7f7faa4c4c7e1
SHA1 ca32c8b853681960c86d19d533dff4ff1137a1c6
SHA512 d7fce89011c24d0c3928807293d42a3f694ef4357d3c42a84d9294de000b291279671e2059e063ac58806b8e718654260ce5c9ae8c748d3a0a8c9ce0e23ac55a
SSDEEP 96:oEBx4+Ck8rL6j+zTnnq6LuSznTUzO1GKW+gepaU5/QxANuRypklEDhmh8asuBtz:aX6qfxLzznAzO1G0ERdiu/z
TLSH
T132F1412F68CFDEE27B73194472F3958DA808C295235ECDE0F468085B8793905D637A83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BootstrapperExtensionData.xml

Path C:\Windows\Temp\{1AF10A49-79C6-44C8-8520-99AE84473483}\.ba\BootstrapperExtensionData.xml
Size 276B
SHA256 258fac237622533e7f9ec3f95bcec8abcc31ae87e2017e5717af0841c61e9df4
MD5 240bac991e5860465ce0dfd580ea7cb3
SHA1 a352934cbb14ab877883ac219ceb78c92e27f495
SHA512 67ff8063a071436ae7dca8ee12ad1991bb70752dcc63f00f129f38dffa1aaf9299fff591fc67dbf4d2fdc57a9242831b149d575181b84857cd4f22463076f315
TLSH
T1DAD05E432FBE2304F1B30F49A6BA94102475BE009D78CC6D0228080C0573D92C8B2F77
MD5 SHA1 SHA512 TLSH

Submit Download

license.rtf

Path C:\Windows\Temp\{1AF10A49-79C6-44C8-8520-99AE84473483}\.ba\license.rtf
Size 215B
SHA256 75cf03762aea3f3ef6ae0dc0290c4426052549a0b4335bcc3ba9ca30391e0751
MD5 5f5db41d3f86258e4b6f8b08ef870d0a
SHA1 3c02aea43c2bc7dff281ec8e5ad01abf058c1ed6
SHA512 26344831d563e95a26126f2d99ce9b773017596001fbf3d7f56b9a84c77a69240640b7bb191ec8ec7fa66d424134805113be8b9503adae19554aaba6c98223ee
TLSH
T19BD022EA15CC11AA3FB80A8CEB04D029ED7E419DBC41D682B1313A90F81192DB2C76A2
MD5 SHA1 SHA512 TLSH

Submit Download

logo.png

Path C:\Windows\Temp\{1AF10A49-79C6-44C8-8520-99AE84473483}\.ba\logo.png
Size 852B
SHA256 cd2e8ed1fbb308d9d166f49794d323a9b22efba1033cdf906d1f4b030319e01b
MD5 8346e21859a269dccf1e408dc7593cca
SHA1 239f10674bf6022854c1f1bf7c91955bde34d3e4
SHA512 de9a54e7067fe4feade10f48d7c2bb4169f50efa0b06d3310421376690712af4d55dbc24dc5accc5013379b11abb59cc8c85896fe9f2a7c6a7ea2e28f6feac9f
TLSH
T16B0152E8C16455ACA24E76BA91F32450B653B46010C5CD8EBE00DF3442F4522AB976A6
MD5 SHA1 SHA512 TLSH

Submit Download

windowsdesktop-runtime-10.0.12-win-x64.exe

Path C:\Windows\Temp\{1AF10A49-79C6-44C8-8520-99AE84473483}\.be\windowsdesktop-runtime-10.0.12-win-x64.exe
Size 968KB
SHA256 08a7e2db64e2ed8f0c0476d4463af75e691d1db571a05de6e161ce0178fbce90
MD5 95f7a028a67ce1c82bc647d02e1f2d0d
SHA1 6facfe6e1234168184b3ffb62189e608040fd65b
SHA512 07c388e66f7c6d9e9c257fc595c6eb9da5f9b1647a52fa10c81e72a49ce2b714eaeae9b7a604fbda61ca7f1aa1ae6a9781c50d8ce5259164ce27b81281cea773
SSDEEP 12288://hzPsOEX5eZbWC1I0iqm+4/Pm0zykD7xd5DWs2DuHxXQPE4Z8ob:/ZzPRq5eZbpTh47zykJnDWs5NQ84Zl
TLSH
T1CA256D31A566242BE6F40973F914D6307E28E7082B1C45B6C6D0DD0C79A89FA6FF724B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixstdba.exe

Path C:\Windows\Temp\{B651D8C0-51D5-4692-B608-BFA4BD5CE936}\.ba\wixstdba.exe
Size 431KB
SHA256 e9aad13949cd910523bf9547fc5c23bd2c26595e024809a9f8fa866c8d8e555b
MD5 14e0c606e68508fa618bd5c514015577
SHA1 f8c28db9d2810e872f6ffe7607019851f250c5f9
SHA512 c29fedca692ca2f9c5e63f360aeb95399f2f15f1576a0d06fcf9f0919f6b658329973803bc870b0b1e954b0105757630ca3f4b3ac64f4b80e91742d612fd5b73
SSDEEP 6144:N7lQcp03E0PKVMP/PwMFJ3zdoZmb8LSQsCjzYkffTTp6EoNXJrprSU0e:Np6mM/wML3/QsJDLXJrow
TLSH
T16D942A3165F04023D6F94572E915FA30AF39F208670085EBA3C0DD297968AE6A7FB357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5232-1316-0x000001C1414E0000-0x000001C141FA1000-memory.dmp

Download

memory/5232-761-0x000001C1414E0000-0x000001C141FA1000-memory.dmp

Download

memory/5232-1273-0x000001C1414E0000-0x000001C141FA1000-memory.dmp

Download