Overview

overview

8

Static

static

1

wiresock-s....1.exe

windows10-2004-x64

8

wiresock-s....1.exe

windows11-ltsc_2024-x64

6

Analysis

  • user interaction
    yes
  • max time kernel
    47s
  • max time network
    82s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    23/10/2026, 17:42

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    wiresock-secure-connect-x64-3.7.2.1.exe
  • Size 16.9MB
  • Sample261023-v98mcaft6j
  • SHA256 d0419d58487ed5491b2ce44a97f32af58e80138800da52f5debaaae8f58b0516
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Manipulates Digital Signatures 1 TTPs 1 IoCs

    Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Badlisted process makes network request 3 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops file in System32 directory 26 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 54 IoCs
  • Executes dropped EXE 14 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Loads dropped DLL 20 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 2 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 26 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\wiresock-secure-connect-x64-3.7.2.1.exe
    "C:\Users\Admin\AppData\Local\Temp\wiresock-secure-connect-x64-3.7.2.1.exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • Reads the TCP/IP host and domain name from the registry
    • Suspicious use of WriteProcessMemory
    PID:4876
    • C:\Windows\TEMP\{C8C799F8-29B8-4087-805C-8296720BC097}\.ba\wixstdba.exe
      "C:\Windows\TEMP\{C8C799F8-29B8-4087-805C-8296720BC097}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{FBAAA181-F11A-4801-AFAE-9B3DA26BBA1D} {0385D9DD-B630-4670-A272-5ECC7BA90B71}
      2⤵
      • Executes dropped EXE
      • Suspicious use of FindShellTrayWindow
      PID:5924
    • C:\Windows\TEMP\{C8C799F8-29B8-4087-805C-8296720BC097}\.ba\Wix4NetfxBootstrapperExtension_X64\x64\netcoresearch.exe
      "C:\Windows\TEMP\{C8C799F8-29B8-4087-805C-8296720BC097}\.ba\Wix4NetfxBootstrapperExtension_X64\x64\netcoresearch.exe" runtime 10 Microsoft.WindowsDesktop.App
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Time Discovery
      PID:4084
    • C:\Windows\TEMP\{C8C799F8-29B8-4087-805C-8296720BC097}\.be\wiresock-secure-connect.exe
      "C:\Windows\TEMP\{C8C799F8-29B8-4087-805C-8296720BC097}\.be\wiresock-secure-connect.exe" -q -burn.elevated BurnPipe.{BEAAC5FC-C5B8-4A58-8048-12305EC7B82C} {FD8FCD75-09BC-4E23-A29B-9310FC18A405} 4876
      2⤵
      • Adds Run key to start application
      • Executes dropped EXE
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:5420
      • C:\ProgramData\Package Cache\0b907e9312867172a4eb82f4b5ab3f7c2d25e27d8349546d77eeb5d5b8cbecab\windowsdesktop-runtime-10.0.12-win-x64.exe
        "C:\ProgramData\Package Cache\0b907e9312867172a4eb82f4b5ab3f7c2d25e27d8349546d77eeb5d5b8cbecab\windowsdesktop-runtime-10.0.12-win-x64.exe" windowsdesktop-runtime-10.0.12-win-x64.exe /install /quiet /norestart
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4828
        • C:\Windows\TEMP\{7F3CE7FC-2CA2-4B88-A723-C1E89EEEEC1B}\.ba\wixstdba.exe
          "C:\Windows\TEMP\{7F3CE7FC-2CA2-4B88-A723-C1E89EEEEC1B}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{3ED328E4-B07E-49B1-B5F7-CF6B544AE2B8} {6034563F-8908-4A96-B654-DC8CA4037ACD}
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4312
        • C:\Windows\TEMP\{7F3CE7FC-2CA2-4B88-A723-C1E89EEEEC1B}\.be\windowsdesktop-runtime-10.0.12-win-x64.exe
          "C:\Windows\TEMP\{7F3CE7FC-2CA2-4B88-A723-C1E89EEEEC1B}\.be\windowsdesktop-runtime-10.0.12-win-x64.exe" -q -burn.elevated BurnPipe.{0BA3C6FA-25D5-4487-9E7F-D5645DA299EF} {975B9384-C39E-426A-9C93-C6DBE874F6EE} 4828
          4⤵
          • Adds Run key to start application
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          PID:876
  • C:\ProgramData\Package Cache\{B2C2B368-871A-42B8-A057-48B83B1DD0B9}\wiresock-secure-connect.exe
    "C:\ProgramData\Package Cache\{B2C2B368-871A-42B8-A057-48B83B1DD0B9}\wiresock-secure-connect.exe" /burn.runonce
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:1020
    • C:\ProgramData\Package Cache\{B2C2B368-871A-42B8-A057-48B83B1DD0B9}\wiresock-secure-connect.exe
      "C:\ProgramData\Package Cache\{B2C2B368-871A-42B8-A057-48B83B1DD0B9}\wiresock-secure-connect.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\WireSock_Secure_Connect_20261023184234.log"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:512
      • C:\Windows\TEMP\{832C779F-5491-4EF8-9AB0-D3BEFD03BE9F}\.ba\wixstdba.exe
        "C:\Windows\TEMP\{832C779F-5491-4EF8-9AB0-D3BEFD03BE9F}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{883F8DF0-02EB-484B-870E-63C248F36942} {89690A5D-5FFA-4713-9CF9-86FCD7094349}
        3⤵
        • Executes dropped EXE
        PID:1996
      • C:\Windows\TEMP\{832C779F-5491-4EF8-9AB0-D3BEFD03BE9F}\.ba\Wix4NetfxBootstrapperExtension_X64\x64\netcoresearch.exe
        "C:\Windows\TEMP\{832C779F-5491-4EF8-9AB0-D3BEFD03BE9F}\.ba\Wix4NetfxBootstrapperExtension_X64\x64\netcoresearch.exe" runtime 10 Microsoft.WindowsDesktop.App
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Time Discovery
        PID:5480
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Badlisted process makes network request
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2472
    • C:\Windows\System32\MsiExec.exe
      C:\Windows\System32\MsiExec.exe -Embedding 23A188621ABF5E6808C6AE7807903B6B
      2⤵
      • Loads dropped DLL
      PID:1268
    • C:\Windows\System32\MsiExec.exe
      C:\Windows\System32\MsiExec.exe -Embedding 95FA52A9091F78E53DF5541B9A961F82
      2⤵
      • Loads dropped DLL
      PID:3552
    • C:\Windows\System32\MsiExec.exe
      C:\Windows\System32\MsiExec.exe -Embedding AB4444053650F712CE6BA3359877C161
      2⤵
      • Loads dropped DLL
      PID:3232
    • C:\Windows\System32\MsiExec.exe
      C:\Windows\System32\MsiExec.exe -Embedding 555753FA9D1D693CA7EC1B692A9056C3
      2⤵
      • Loads dropped DLL
      PID:5208
    • C:\Windows\System32\MsiExec.exe
      C:\Windows\System32\MsiExec.exe -Embedding 7C603181133319D567FCA1ADD28079EE
      2⤵
      • Loads dropped DLL
      PID:5540
    • C:\Windows\System32\MsiExec.exe
      C:\Windows\System32\MsiExec.exe -Embedding 21F31457AFAE2F818D25C21C6E449FF8
      2⤵
      • Loads dropped DLL
      PID:2096
    • C:\Windows\System32\MsiExec.exe
      C:\Windows\System32\MsiExec.exe -Embedding 14B35FD721BBB7C280DC94DDA6109DCA
      2⤵
      • Loads dropped DLL
      PID:3972
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding A280BBE67E11A95A5FD972AD3B9C577D E Global\MSI0000
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3044
      • C:\Windows\system32\certutil.exe
        "C:\Windows\system32\certutil.exe" -addstore -f "TrustedPublisher" "C:\Program Files\WireSock Secure Connect\certificates\rootac.cer"
        3⤵
        • Manipulates Digital Signatures
        • Modifies data under HKEY_USERS
        PID:1980
      • C:\Windows\system32\sc.exe
        "C:\Windows\system32\sc.exe" query ndiswgc
        3⤵
        • Launches sc.exe
        PID:5084
      • C:\Windows\system32\netcfg.exe
        "C:\Windows\system32\netcfg.exe" -v -l "C:\Program Files\WireSock Secure Connect\drivers\ndiswgc_lwf.inf" -c s -i nt_ndiswgc
        3⤵
        • Drops file in System32 directory
        • Drops file in Windows directory
        PID:5380
  • C:\ProgramData\Package Cache\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}\windowsdesktop-runtime-10.0.12-win-x64.exe
    "C:\ProgramData\Package Cache\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}\windowsdesktop-runtime-10.0.12-win-x64.exe" /burn.runonce
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4884
    • C:\ProgramData\Package Cache\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}\windowsdesktop-runtime-10.0.12-win-x64.exe
      "C:\ProgramData\Package Cache\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}\windowsdesktop-runtime-10.0.12-win-x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.12_(x64)_20261023184252.log" /quiet windowsdesktop-runtime-10.0.12-win-x64.exe /install /norestart
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4396
      • C:\Windows\TEMP\{D5D5238B-0E65-4ACE-A046-CF56712DA595}\.ba\wixstdba.exe
        "C:\Windows\TEMP\{D5D5238B-0E65-4ACE-A046-CF56712DA595}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{DEBFB8AD-46C7-4B8F-A337-81B88C444C1F} {5517285B-3951-44C0-BFC4-2AB30707A635}
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:3944
      • C:\ProgramData\Package Cache\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}\windowsdesktop-runtime-10.0.12-win-x64.exe
        "C:\ProgramData\Package Cache\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}\windowsdesktop-runtime-10.0.12-win-x64.exe" -q -burn.elevated BurnPipe.{4B73EFA0-CD5F-4509-BF28-C313FB1E7592} {E12A96F8-B7DF-4A40-AC47-67B01CCC9373} 4396
        3⤵
        • Adds Run key to start application
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        PID:3756
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
    1⤵
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Suspicious use of WriteProcessMemory
    PID:5032
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "4" "1" "C:\Program Files\WireSock Secure Connect\drivers\ndiswgc_lwf.inf" "9" "4a6f4393f" "000000000000014C" "WinSta0\Default" "000000000000015C" "208" "C:\Program Files\WireSock Secure Connect\drivers"
      2⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Modifies data under HKEY_USERS
      PID:1960

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        e5902f7.rbs
        • Path C:\Config.Msi\e5902f7.rbs
        • Size 11KB
        • SHA256 417b6c2f3167bbb6017853c0cc7105f59f052a8efde24a749d9ddf6a5ea0bbc5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        e5902fe.rbs
        • Path C:\Config.Msi\e5902fe.rbs
        • Size 9KB
        • SHA256 2707d7ec92389c2d87de1008c80de306337a31f27664ad41c9238ee52a0a520e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        e590303.rbs
        • Path C:\Config.Msi\e590303.rbs
        • Size 49KB
        • SHA256 b030c865f7d27364b95701860de54a4e39504a11ad0a0250a1c72137b5a6c8a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        e590307.rbs
        • Path C:\Config.Msi\e590307.rbs
        • Size 3KB
        • SHA256 0a67c3fc1876bc34d71e3332d1b89eaf0bd15da0c0c628ff7ee133612883497f
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        e59030b.rbs
        • Path C:\Config.Msi\e59030b.rbs
        • Size 71KB
        • SHA256 cf93cb6f11c0a14138b9fc5033b52b8a4a49e84de8e8587d143d4c214efcc71f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        e59030f.rbs
        • Path C:\Config.Msi\e59030f.rbs
        • Size 3KB
        • SHA256 ae034cd88ab01312bebc0510c1d7040d2b19214bdc669fb9cc4363f4425cc0a0
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        rootac.cer
        • Path C:\Program Files\WireSock Secure Connect\certificates\rootac.cer
        • Size 2KB
        • SHA256 7d2642e86a896474a21549ca12caa87bf2fef3f8fd010252e6102de7390d776e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        devcon.exe
        • Path C:\Program Files\WireSock Secure Connect\wiresock-adapter\devcon.exe
        • Size 81KB
        • SHA256 aca1bda08690dcca930254f96f9185c776671a85a58ffa1b59cf16017546f218
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ThirdPartyNotices.txt
        • Path C:\Program Files\dotnet\ThirdPartyNotices.txt
        • Size 77KB
        • SHA256 deb4427a295e1ed474b0d81c5a0d972c1b550b9a715cda939cdfa9236b1b418f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 163KB
        • SHA256 21a46f1e5235cf4e844b9de5429f0e198b9c97a41f0503a66442f1d639ca3ee6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        state.rsm
        • Path C:\ProgramData\Package Cache\{B2C2B368-871A-42B8-A057-48B83B1DD0B9}\state.rsm
        • Size 1KB
        • SHA256 687930f863b37155dc7c82aa7380d64dcaca2c33671082c46ee00dc84cda0f5e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        state.rsm
        • Path C:\ProgramData\Package Cache\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}\state.rsm
        • Size 1KB
        • SHA256 faf9a755d235871f89638a7567b440e207036f557135072e97abb8a17eb427ef
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Microsoft_Windows_Desktop_Runtime_10.0.12_(x64)_20261023184252_000_DotNetHost.log
        • Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.12_(x64)_20261023184252_000_DotNetHost.log
        • Size 2KB
        • SHA256 deaf6af757d461c1153df13f87c42c164b1fe3d1bb09dccb93db7d9339776977
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Microsoft_Windows_Desktop_Runtime_10.0.12_(x64)_20261023184252_001_DotNetHostFxr.log
        • Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.12_(x64)_20261023184252_001_DotNetHostFxr.log
        • Size 2KB
        • SHA256 4391f779e904a3b73353f9854e6cdcdbbdf4c60819da8f8e50d399233bd010d4
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Microsoft_Windows_Desktop_Runtime_10.0.12_(x64)_20261023184252_002_DotNetRuntime.log
        • Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.12_(x64)_20261023184252_002_DotNetRuntime.log
        • Size 2KB
        • SHA256 1c7b046204ffc382fc0681a02cb3adeacd19b5b04af83078001594cae6c33ad2
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        DotNetHost
        • Path C:\Users\Admin\AppData\Local\Temp\{7F3CE7FC-2CA2-4B88-A723-C1E89EEEEC1B}\DotNetHost
        • Size 848KB
        • SHA256 f59a0c4177cd57a71c99b22009131a3bdf898ee6db62ef0415f056c4b26bb53c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DotNetHostFxr
        • Path C:\Users\Admin\AppData\Local\Temp\{7F3CE7FC-2CA2-4B88-A723-C1E89EEEEC1B}\DotNetHostFxr
        • Size 920KB
        • SHA256 ff33e8f0a6f4624f8c160f96aa8066eeb86bcc6e608fe258deeea13bbd18e82f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DotNetRuntime
        • Path C:\Users\Admin\AppData\Local\Temp\{7F3CE7FC-2CA2-4B88-A723-C1E89EEEEC1B}\DotNetRuntime
        • Size 28.1MB
        • SHA256 22319614080d76c82a33b196c5765ca70ff1f38041e907c7d5ed8775f6c5f3f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WindowsDesktopRuntime
        • Path C:\Users\Admin\AppData\Local\Temp\{7F3CE7FC-2CA2-4B88-A723-C1E89EEEEC1B}\WindowsDesktopRuntime
        • Size 28.7MB
        • SHA256 1a20c13d8103d83ada5db2f9b380f69273cb17766c6e5ca954ecb93230f218e2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WireSockKernel
        • Path C:\Users\Admin\AppData\Local\Temp\{C8C799F8-29B8-4087-805C-8296720BC097}\WireSockKernel
        • Size 2.0MB
        • SHA256 d1d84892f80fc252581f5d56b364a347923a33cda5ca1774982bed8334eae173
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WireSockMSI
        • Path C:\Users\Admin\AppData\Local\Temp\{C8C799F8-29B8-4087-805C-8296720BC097}\WireSockMSI
        • Size 15.0MB
        • SHA256 0ef78403520737c0e4d2d6985a2f6d91302016c62c64ebddde8aa89f0945cb27
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSI40D.tmp
        • Path C:\Windows\Installer\MSI40D.tmp
        • Size 411KB
        • SHA256 ac54078e0387d2a8ddcdbee3967da6ea6ec6508172505aca3d27a75fa43ce34f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSI4F06.tmp
        • Path C:\Windows\Installer\MSI4F06.tmp
        • Size 365KB
        • SHA256 6c2af70e8f5483ac3a8fdf68bb0157efd68cbf3e90b51416ad26198515ccd269
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SET5039.tmp
        • Path C:\Windows\System32\DriverStore\Temp\{643299ca-1ff9-304a-9836-25484df7d1b4}\SET5039.tmp
        • Size 2KB
        • SHA256 8d0648d7276a88036cea7075bd28e827ad8f1d4068644e232d2786c708e41b00
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        SET504A.tmp
        • Path C:\Windows\System32\DriverStore\Temp\{643299ca-1ff9-304a-9836-25484df7d1b4}\SET504A.tmp
        • Size 11KB
        • SHA256 95e90a40cc1e028c31077d638cfb137aa3c4327deaf654fce4d8fb12b062d040
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SET504B.tmp
        • Path C:\Windows\System32\DriverStore\Temp\{643299ca-1ff9-304a-9836-25484df7d1b4}\SET504B.tmp
        • Size 67KB
        • SHA256 ad7b31dea0b3e5fc9afa86bf2bac12cea478878926fd18890144d52677f9339a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        BootstrapperApplicationData.xml
        • Path C:\Windows\TEMP\{7F3CE7FC-2CA2-4B88-A723-C1E89EEEEC1B}\.ba\BootstrapperApplicationData.xml
        • Size 9KB
        • SHA256 0da13bd67e88529919a3d066aa6767188b7b2b97e5dd1df2e3e1a83970c25111
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DotNetLogo_256x.png
        • Path C:\Windows\TEMP\{7F3CE7FC-2CA2-4B88-A723-C1E89EEEEC1B}\.ba\DotNetLogo_256x.png
        • Size 2KB
        • SHA256 0f571f95d8eab48dbc81b0ec5e9f7225e349e26ef50868bfaab556f3c2443b01
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        dotnet.ico
        • Path C:\Windows\TEMP\{7F3CE7FC-2CA2-4B88-A723-C1E89EEEEC1B}\.ba\dotnet.ico
        • Size 44KB
        • SHA256 61a2cbd12868cb9b359e0c78961d409b7875f072eb8e53ea88d3e6bfe2961a18
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        thm.wxl
        • Path C:\Windows\TEMP\{7F3CE7FC-2CA2-4B88-A723-C1E89EEEEC1B}\.ba\thm.wxl
        • Size 7KB
        • SHA256 b00edd703dd8a475119d0e4dd70a3aaa47f0e95361af290e76d367a8edef3432
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        thm.xml
        • Path C:\Windows\TEMP\{7F3CE7FC-2CA2-4B88-A723-C1E89EEEEC1B}\.ba\thm.xml
        • Size 11KB
        • SHA256 dfee8e2d075087227f19c835c145c5bb8e72a46880ea24080bb2472fd3a521be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        thm.wxl
        • Path C:\Windows\TEMP\{C8C799F8-29B8-4087-805C-8296720BC097}\.ba\1033\thm.wxl
        • Size 8KB
        • SHA256 a76c45fa6dbe297f7942feb1e66e0c2996d4f68cda1896b2cf97bba539f5e47a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        BootstrapperApplicationData.xml
        • Path C:\Windows\TEMP\{C8C799F8-29B8-4087-805C-8296720BC097}\.ba\BootstrapperApplicationData.xml
        • Size 11KB
        • SHA256 be51db60832657239566597715529611d019a7774b577203fcdc2861ec78e275
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        hostfxr.dll
        • Path C:\Windows\TEMP\{C8C799F8-29B8-4087-805C-8296720BC097}\.ba\Wix4NetfxBootstrapperExtension_X64\x64\hostfxr.dll
        • Size 366KB
        • SHA256 cbde5e0bb9260e4ceeb0c7d774cb3aba0f885f150c9c8fe3922da4c71125f628
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        thm.xml
        • Path C:\Windows\TEMP\{C8C799F8-29B8-4087-805C-8296720BC097}\.ba\thm.xml
        • Size 9KB
        • SHA256 c16ea9b2ddc6923f88e221f8d7885710bbf06cad100ef699e2cc5517a37a8999
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wixstdba.exe
        • Path C:\Windows\Temp\{7F3CE7FC-2CA2-4B88-A723-C1E89EEEEC1B}\.ba\wixstdba.exe
        • Size 431KB
        • SHA256 e9aad13949cd910523bf9547fc5c23bd2c26595e024809a9f8fa866c8d8e555b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        windowsdesktop-runtime-10.0.12-win-x64.exe
        • Path C:\Windows\Temp\{7F3CE7FC-2CA2-4B88-A723-C1E89EEEEC1B}\.be\windowsdesktop-runtime-10.0.12-win-x64.exe
        • Size 968KB
        • SHA256 08a7e2db64e2ed8f0c0476d4463af75e691d1db571a05de6e161ce0178fbce90
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        thm.xml
        • Path C:\Windows\Temp\{832C779F-5491-4EF8-9AB0-D3BEFD03BE9F}\.ba\1049\thm.xml
        • Size 9KB
        • SHA256 a85e2d8dc5484bc79de3dddca683eaadd3dc41a465406ded2b2fa5547537f026
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        thm.xml
        • Path C:\Windows\Temp\{832C779F-5491-4EF8-9AB0-D3BEFD03BE9F}\.ba\1055\thm.xml
        • Size 9KB
        • SHA256 e9bc981b0ef4d92f37c7a274e107850d5b9782473758505a7bd8effdc75e7505
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        BootstrapperExtensionData.xml
        • Path C:\Windows\Temp\{832C779F-5491-4EF8-9AB0-D3BEFD03BE9F}\.ba\BootstrapperExtensionData.xml
        • Size 880B
        • SHA256 babe786aa9f0036c735ff4f3562ac037407aa08349f81d1d58117ca54208fb5f
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        thm.wxl
        • Path C:\Windows\Temp\{832C779F-5491-4EF8-9AB0-D3BEFD03BE9F}\.ba\thm.wxl
        • Size 8KB
        • SHA256 0aa6638843c8d09a405e6b3fe2b66b123d67c764c4ccf6eab1e20f20ab6cb329
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        icon.ico
        • Path C:\Windows\Temp\{C8C799F8-29B8-4087-805C-8296720BC097}\.ba\1036\icon.ico
        • Size 465KB
        • SHA256 f7a7aa48644508a9c624f4b9acdc8d03031bfd45097d93d7ac3337f34300ab6a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        logo.png
        • Path C:\Windows\Temp\{C8C799F8-29B8-4087-805C-8296720BC097}\.ba\1049\logo.png
        • Size 213KB
        • SHA256 e627a5a1d090adc3f85eb6c52dbcb6bd8b7b07b6395ebbf7f281235c929d7be2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        netfxbe.dll
        • Path C:\Windows\Temp\{C8C799F8-29B8-4087-805C-8296720BC097}\.ba\Wix4NetfxBootstrapperExtension_X64\netfxbe.dll
        • Size 188KB
        • SHA256 1292f29490e906e0f209396f6947b001618662996e96794ba1fc629cca72e58f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        netcoresearch.exe
        • Path C:\Windows\Temp\{C8C799F8-29B8-4087-805C-8296720BC097}\.ba\Wix4NetfxBootstrapperExtension_X64\x64\netcoresearch.exe
        • Size 161KB
        • SHA256 13c2f45ec7339d7aaa819a89dd2409885e225fadad1d91a02e9fad47e1d41b04
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wixstdba.exe
        • Path C:\Windows\Temp\{C8C799F8-29B8-4087-805C-8296720BC097}\.ba\wixstdba.exe
        • Size 495KB
        • SHA256 9eeaa3b84d2c7e1603780ad29b18c14c95f6ffa35ec63c59018160f71ba70267
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wiresock-secure-connect.exe
        • Path C:\Windows\Temp\{C8C799F8-29B8-4087-805C-8296720BC097}\.be\wiresock-secure-connect.exe
        • Size 2.5MB
        • SHA256 e4f1cd7406ebc9d51f2e0e4fba34330fcd63c1eccf7a6208e91f9a9112b58970
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        thm.wxl
        • Path C:\Windows\Temp\{D5D5238B-0E65-4ACE-A046-CF56712DA595}\.ba\1028\thm.wxl
        • Size 7KB
        • SHA256 43e1e134d0591532323dfcd138ac8f5e99096cb6cb0213a486bbb3ecc5c47aad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        thm.wxl
        • Path C:\Windows\Temp\{D5D5238B-0E65-4ACE-A046-CF56712DA595}\.ba\1029\thm.wxl
        • Size 7KB
        • SHA256 2f174b5eed2a84e43396f3cae2e6521c9247bb0deccb16e7f9b461233c363534
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        thm.wxl
        • Path C:\Windows\Temp\{D5D5238B-0E65-4ACE-A046-CF56712DA595}\.ba\1031\thm.wxl
        • Size 7KB
        • SHA256 2589887424dd4b0b27d36f7aa36d07fb6fa8d1c4dbe50059248a24823c742f92
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        thm.wxl
        • Path C:\Windows\Temp\{D5D5238B-0E65-4ACE-A046-CF56712DA595}\.ba\1036\thm.wxl
        • Size 8KB
        • SHA256 ecdd5f7b7ed65bef8e3eec00537da44939b8e8f8f604e9b39329b45ec210efde
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        thm.wxl
        • Path C:\Windows\Temp\{D5D5238B-0E65-4ACE-A046-CF56712DA595}\.ba\1040\thm.wxl
        • Size 7KB
        • SHA256 c536f3f85936f6b38782df30a7bf88c7e7e66fa1e3257b20b75f9a4f0112b184
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        thm.wxl
        • Path C:\Windows\Temp\{D5D5238B-0E65-4ACE-A046-CF56712DA595}\.ba\1041\thm.wxl
        • Size 8KB
        • SHA256 000e1508d9bacb7156951988ba1d6dc36165facd2163352a93b9a66e8c642089
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        thm.wxl
        • Path C:\Windows\Temp\{D5D5238B-0E65-4ACE-A046-CF56712DA595}\.ba\1042\thm.wxl
        • Size 7KB
        • SHA256 09c51c910f7142ab7f73db8e826f3daff1525eea765d03bcd934cba53bc689d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        thm.wxl
        • Path C:\Windows\Temp\{D5D5238B-0E65-4ACE-A046-CF56712DA595}\.ba\1045\thm.wxl
        • Size 7KB
        • SHA256 209911674536ad5976dad21ae1e96a9fdfa61270120a94bbe0e8ae32a67239a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        thm.wxl
        • Path C:\Windows\Temp\{D5D5238B-0E65-4ACE-A046-CF56712DA595}\.ba\1046\thm.wxl
        • Size 7KB
        • SHA256 7b095c32d1fbdd924d710d18d51a88a710bc152c8b30c6051524583bfabe38c0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        thm.wxl
        • Path C:\Windows\Temp\{D5D5238B-0E65-4ACE-A046-CF56712DA595}\.ba\1049\thm.wxl
        • Size 9KB
        • SHA256 3c911848f83d269fa2cd64bbfd7b5e88eb3a621bdd42c564c69100a8e8a40494
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        thm.wxl
        • Path C:\Windows\Temp\{D5D5238B-0E65-4ACE-A046-CF56712DA595}\.ba\1055\thm.wxl
        • Size 7KB
        • SHA256 56d76adc63b71879e3291f0f306e54081e9e80f463fcb41dc6896ecd2298deae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        thm.wxl
        • Path C:\Windows\Temp\{D5D5238B-0E65-4ACE-A046-CF56712DA595}\.ba\2052\thm.wxl
        • Size 7KB
        • SHA256 340154c87016bd6af740e6a91ea86d722817f6dc2bc675c33133901443658179
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        thm.wxl
        • Path C:\Windows\Temp\{D5D5238B-0E65-4ACE-A046-CF56712DA595}\.ba\3082\thm.wxl
        • Size 7KB
        • SHA256 2416f9a3daa6767f418c5ab94edb8a83dc9326fcaf13de1186e61b5248349edc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        BootstrapperExtensionData.xml
        • Path C:\Windows\Temp\{D5D5238B-0E65-4ACE-A046-CF56712DA595}\.ba\BootstrapperExtensionData.xml
        • Size 276B
        • SHA256 258fac237622533e7f9ec3f95bcec8abcc31ae87e2017e5717af0841c61e9df4
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        license.rtf
        • Path C:\Windows\Temp\{D5D5238B-0E65-4ACE-A046-CF56712DA595}\.ba\license.rtf
        • Size 215B
        • SHA256 75cf03762aea3f3ef6ae0dc0290c4426052549a0b4335bcc3ba9ca30391e0751
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        logo.png
        • Path C:\Windows\Temp\{D5D5238B-0E65-4ACE-A046-CF56712DA595}\.ba\logo.png
        • Size 852B
        • SHA256 cd2e8ed1fbb308d9d166f49794d323a9b22efba1033cdf906d1f4b030319e01b
        • MD5 SHA1 SHA512 TLSH
        Submit Download