hxxps://nightly[.]link/Escartem/AnimeStudio/workflows/build/master/AnimeStudio-net10[.]zip

Analysis

user interaction
yes
max time kernel
149s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/10/2026, 21:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://nightly.link/Escartem/AnimeStudio/workflows/build/master/AnimeStudio-net10.zip
Sample261027-1ccrasf19s

Score

8^/10

discovery persistence

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
123	3404	msedge.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation	windowsdesktop-runtime-10.0.14-win-x64.exe

Executes dropped EXE 6 IoCs

pid	Process
2804	windowsdesktop-runtime-10.0.14-win-x64.exe
380	wixstdba.exe
4476	windowsdesktop-runtime-10.0.14-win-x64.exe
3724	windowsdesktop-runtime-10.0.14-win-x64.exe
3332	windowsdesktop-runtime-10.0.14-win-x64.exe
2468	wixstdba.exe

Loads dropped DLL 54 IoCs

pid	Process
3320	MsiExec.exe
3320	MsiExec.exe
3284	MsiExec.exe
3284	MsiExec.exe
2908	MsiExec.exe
2908	MsiExec.exe
5072	MsiExec.exe
5072	MsiExec.exe
2964	AnimeStudio.GUI.exe
2964	AnimeStudio.GUI.exe
2964	AnimeStudio.GUI.exe
2964	AnimeStudio.GUI.exe
2964	AnimeStudio.GUI.exe
2964	AnimeStudio.GUI.exe
2964	AnimeStudio.GUI.exe
2964	AnimeStudio.GUI.exe
2964	AnimeStudio.GUI.exe
2964	AnimeStudio.GUI.exe
2964	AnimeStudio.GUI.exe
2964	AnimeStudio.GUI.exe
2964	AnimeStudio.GUI.exe
2964	AnimeStudio.GUI.exe
2964	AnimeStudio.GUI.exe
2964	AnimeStudio.GUI.exe
2964	AnimeStudio.GUI.exe
2964	AnimeStudio.GUI.exe
2964	AnimeStudio.GUI.exe
2964	AnimeStudio.GUI.exe
2964	AnimeStudio.GUI.exe
2964	AnimeStudio.GUI.exe
2964	AnimeStudio.GUI.exe
2964	AnimeStudio.GUI.exe
2964	AnimeStudio.GUI.exe
2964	AnimeStudio.GUI.exe
2964	AnimeStudio.GUI.exe
2964	AnimeStudio.GUI.exe
2964	AnimeStudio.GUI.exe
2964	AnimeStudio.GUI.exe
2964	AnimeStudio.GUI.exe
2964	AnimeStudio.GUI.exe
2964	AnimeStudio.GUI.exe
2964	AnimeStudio.GUI.exe
2964	AnimeStudio.GUI.exe
2964	AnimeStudio.GUI.exe
2964	AnimeStudio.GUI.exe
2964	AnimeStudio.GUI.exe
2964	AnimeStudio.GUI.exe
2964	AnimeStudio.GUI.exe
2964	AnimeStudio.GUI.exe
2964	AnimeStudio.GUI.exe
2964	AnimeStudio.GUI.exe
2964	AnimeStudio.GUI.exe
2964	AnimeStudio.GUI.exe
2964	AnimeStudio.GUI.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{29A18B06-B190-4463-9FFC-BC0D70D80B7C} = "\"C:\\ProgramData\\Package Cache\\{29A18B06-B190-4463-9FFC-BC0D70D80B7C}\\windowsdesktop-runtime-10.0.14-win-x64.exe\" /burn.runonce"	windowsdesktop-runtime-10.0.14-win-x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\pl\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\pl\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\tr\WindowsBase.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.14\System.IO.FileSystem.AccessControl.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.14\System.Transactions.Local.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\es\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\es\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.14\System.Runtime.InteropServices.dll	msiexec.exe
File created	C:\Program Files\dotnet\dotnet.exe	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\PresentationFramework-SystemCore.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\cs\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\ja\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.14\System.Globalization.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.14\System.Reflection.Emit.ILGeneration.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.14\System.Security.Principal.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\System.Drawing.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\fr\WindowsBase.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\it\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\it\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\pt-BR\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.14\System.Console.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.14\System.Reflection.Emit.Lightweight.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.14\System.Threading.Tasks.Parallel.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.14\netstandard.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\PresentationFramework.Fluent.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\PresentationUI.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\it\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\pl\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.14\System.Diagnostics.TextWriterTraceListener.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.14\System.IO.Compression.FileSystem.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.14\System.Security.Principal.Windows.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.14\System.Xml.ReaderWriter.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\DirectWriteForwarder.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\System.Diagnostics.PerformanceCounter.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\de\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\ko\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\System.Printing.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\de\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.14\System.Net.Primitives.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\Microsoft.WindowsDesktop.App.runtimeconfig.json	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\pl\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\zh-Hans\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\zh-Hans\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\zh-Hant\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.14\System.Linq.Parallel.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.14\System.Reflection.Extensions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.14\System.Xml.Serialization.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\fr\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.14\WindowsBase.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\it\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.14\System.Runtime.CompilerServices.Unsafe.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.14\System.Runtime.InteropServices.JavaScript.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.14\clrgc.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\cs\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\pt-BR\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\ru\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\tr\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.14\System.Threading.Tasks.Extensions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\zh-Hans\UIAutomationTypes.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.14\System.IO.Pipes.AccessControl.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\System.Formats.Nrbf.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\cs\WindowsBase.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.14\System.Diagnostics.Contracts.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.14\System.Diagnostics.Debug.dll	msiexec.exe

Drops file in Windows directory 35 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI167B.tmp	msiexec.exe
File created	C:\Windows\Installer\e59f70a.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e59f705.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF850.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149\fileCoreHostExe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1168.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{3887007B-C74B-4DF7-8155-F3838C013D2C}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2207.tmp	msiexec.exe
File created	C:\Windows\Installer\e59f6f9.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e59f6f9.msi	msiexec.exe
File created	C:\Windows\Installer\e59f700.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2F67.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2CC6.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{64BFC674-D664-480B-AFF2-D47C5531D6D2}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3DA2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e59f70a.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI32A4.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1C59.tmp	msiexec.exe
File created	C:\Windows\Installer\e59f709.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149\fileCoreHostExe	msiexec.exe
File created	C:\Windows\Installer\e59f6ff.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1580.tmp	msiexec.exe
File created	C:\Windows\Installer\e59f704.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{941B1F64-FCD9-4C40-B927-E75F49DD96D8}	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\SourceHash{7A1A9C6B-1386-478E-9C35-7242968A5634}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI17C4.tmp	msiexec.exe
File created	C:\Windows\Installer\e59f705.msi	msiexec.exe
File created	C:\Windows\Installer\e59f70e.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID12.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149	msiexec.exe
File opened for modification	C:\Windows\Installer\e59f700.msi	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.14-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.14-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.14-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wixstdba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.14-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wixstdba.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3404	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\476CFB46466DB084FA2F4DC755136D2D\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B7007883B47C7FD418553F38C810D3C2\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_80.56.61678_x64\ = "{64BFC674-D664-480B-AFF2-D47C5531D6D2}"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6C9A1A76831E874C953272469A86543\Version = "1345908974"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B7007883B47C7FD418553F38C810D3C2\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\46F1B1499DCF04C49B727EF594DD698D\ProductName = "Microsoft .NET Runtime - 10.0.14 (x64)"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-240542094-4193773837-3211495583-1000\{FA96BABA-A594-4C66-81BA-D87EB3714BEB}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{29A18B06-B190-4463-9FFC-BC0D70D80B7C}\Dependents	windowsdesktop-runtime-10.0.14-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x64\DisplayName = "Microsoft .NET Host - 10.0.14 (x64)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B6C9A1A76831E874C953272469A86543\Provider	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6C9A1A76831E874C953272469A86543\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\46F1B1499DCF04C49B727EF594DD698D\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\476CFB46466DB084FA2F4DC755136D2D\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B6C9A1A76831E874C953272469A86543	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6C9A1A76831E874C953272469A86543\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{7A1A9C6B-1386-478E-9C35-7242968A5634}v80.56.61678\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\46F1B1499DCF04C49B727EF594DD698D	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\476CFB46466DB084FA2F4DC755136D2D\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{29A18B06-B190-4463-9FFC-BC0D70D80B7C}\Dependents\{29A18B06-B190-4463-9FFC-BC0D70D80B7C}	windowsdesktop-runtime-10.0.14-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x64\Version = "80.56.61678"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6C9A1A76831E874C953272469A86543\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B7007883B47C7FD418553F38C810D3C2	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.56.61678_x64\Dependents	windowsdesktop-runtime-10.0.14-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_80.56.61678_x64\DisplayName = "Microsoft Windows Desktop Runtime - 10.0.14 (x64)"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\476CFB46466DB084FA2F4DC755136D2D\Version = "1345908974"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\476CFB46466DB084FA2F4DC755136D2D\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{29A18B06-B190-4463-9FFC-BC0D70D80B7C}\ = "{29A18B06-B190-4463-9FFC-BC0D70D80B7C}"	windowsdesktop-runtime-10.0.14-win-x64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x64	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6C9A1A76831E874C953272469A86543\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x64\Dependents	windowsdesktop-runtime-10.0.14-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.56.61678_x64\Version = "80.56.61678"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B7007883B47C7FD418553F38C810D3C2\ProductName = "Microsoft .NET Host FX Resolver - 10.0.14 (x64)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\476CFB46466DB084FA2F4DC755136D2D\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\476CFB46466DB084FA2F4DC755136D2D\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{64BFC674-D664-480B-AFF2-D47C5531D6D2}v80.56.61678\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\9CB77BF103B5F05757987B6130E13954\B7007883B47C7FD418553F38C810D3C2	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\46F1B1499DCF04C49B727EF594DD698D\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\dotnet_runtime_80.56.61678_x64	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{29A18B06-B190-4463-9FFC-BC0D70D80B7C}	windowsdesktop-runtime-10.0.14-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6C9A1A76831E874C953272469A86543\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B7007883B47C7FD418553F38C810D3C2\Provider	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B7007883B47C7FD418553F38C810D3C2\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{3887007B-C74B-4DF7-8155-F3838C013D2C}v80.56.61678\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\46F1B1499DCF04C49B727EF594DD698D\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\dotnet_runtime_80.56.61678_x64	windowsdesktop-runtime-10.0.14-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x64\ = "{7A1A9C6B-1386-478E-9C35-7242968A5634}"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6C9A1A76831E874C953272469A86543\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6C9A1A76831E874C953272469A86543\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6C9A1A76831E874C953272469A86543\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{7A1A9C6B-1386-478E-9C35-7242968A5634}v80.56.61678\\"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6C9A1A76831E874C953272469A86543\Clients = 3a0000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B7007883B47C7FD418553F38C810D3C2\Version = "1345908974"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B7007883B47C7FD418553F38C810D3C2\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\46F1B1499DCF04C49B727EF594DD698D\MainFeature	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.56.61678_x64	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\windowsdesktop_runtime_80.56.61678_x64	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\476CFB46466DB084FA2F4DC755136D2D\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6C9A1A76831E874C953272469A86543\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.56.61678_x64\DisplayName = "Microsoft .NET Host FX Resolver - 10.0.14 (x64)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_80.56.61678_x64\Version = "80.56.61678"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6C9A1A76831E874C953272469A86543\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B7007883B47C7FD418553F38C810D3C2\MainFeature	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B7007883B47C7FD418553F38C810D3C2\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_80.56.61678_x64\Dependents	windowsdesktop-runtime-10.0.14-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B7007883B47C7FD418553F38C810D3C2\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B7007883B47C7FD418553F38C810D3C2\SourceList\PackageName = "dotnet-hostfxr-10.0.14-win-x64.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\46F1B1499DCF04C49B727EF594DD698D	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\46F1B1499DCF04C49B727EF594DD698D\Version = "1345908974"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5108	msiexec.exe
5108	msiexec.exe
5108	msiexec.exe
5108	msiexec.exe
5108	msiexec.exe
5108	msiexec.exe
5108	msiexec.exe
5108	msiexec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4476	windowsdesktop-runtime-10.0.14-win-x64.exe
Token: SeIncreaseQuotaPrivilege	4476	windowsdesktop-runtime-10.0.14-win-x64.exe
Token: SeSecurityPrivilege	5108	msiexec.exe
Token: SeCreateTokenPrivilege	4476	windowsdesktop-runtime-10.0.14-win-x64.exe
Token: SeAssignPrimaryTokenPrivilege	4476	windowsdesktop-runtime-10.0.14-win-x64.exe
Token: SeLockMemoryPrivilege	4476	windowsdesktop-runtime-10.0.14-win-x64.exe
Token: SeIncreaseQuotaPrivilege	4476	windowsdesktop-runtime-10.0.14-win-x64.exe
Token: SeMachineAccountPrivilege	4476	windowsdesktop-runtime-10.0.14-win-x64.exe
Token: SeTcbPrivilege	4476	windowsdesktop-runtime-10.0.14-win-x64.exe
Token: SeSecurityPrivilege	4476	windowsdesktop-runtime-10.0.14-win-x64.exe
Token: SeTakeOwnershipPrivilege	4476	windowsdesktop-runtime-10.0.14-win-x64.exe
Token: SeLoadDriverPrivilege	4476	windowsdesktop-runtime-10.0.14-win-x64.exe
Token: SeSystemProfilePrivilege	4476	windowsdesktop-runtime-10.0.14-win-x64.exe
Token: SeSystemtimePrivilege	4476	windowsdesktop-runtime-10.0.14-win-x64.exe
Token: SeProfSingleProcessPrivilege	4476	windowsdesktop-runtime-10.0.14-win-x64.exe
Token: SeIncBasePriorityPrivilege	4476	windowsdesktop-runtime-10.0.14-win-x64.exe
Token: SeCreatePagefilePrivilege	4476	windowsdesktop-runtime-10.0.14-win-x64.exe
Token: SeCreatePermanentPrivilege	4476	windowsdesktop-runtime-10.0.14-win-x64.exe
Token: SeBackupPrivilege	4476	windowsdesktop-runtime-10.0.14-win-x64.exe
Token: SeRestorePrivilege	4476	windowsdesktop-runtime-10.0.14-win-x64.exe
Token: SeShutdownPrivilege	4476	windowsdesktop-runtime-10.0.14-win-x64.exe
Token: SeDebugPrivilege	4476	windowsdesktop-runtime-10.0.14-win-x64.exe
Token: SeAuditPrivilege	4476	windowsdesktop-runtime-10.0.14-win-x64.exe
Token: SeSystemEnvironmentPrivilege	4476	windowsdesktop-runtime-10.0.14-win-x64.exe
Token: SeChangeNotifyPrivilege	4476	windowsdesktop-runtime-10.0.14-win-x64.exe
Token: SeRemoteShutdownPrivilege	4476	windowsdesktop-runtime-10.0.14-win-x64.exe
Token: SeUndockPrivilege	4476	windowsdesktop-runtime-10.0.14-win-x64.exe
Token: SeSyncAgentPrivilege	4476	windowsdesktop-runtime-10.0.14-win-x64.exe
Token: SeEnableDelegationPrivilege	4476	windowsdesktop-runtime-10.0.14-win-x64.exe
Token: SeManageVolumePrivilege	4476	windowsdesktop-runtime-10.0.14-win-x64.exe
Token: SeImpersonatePrivilege	4476	windowsdesktop-runtime-10.0.14-win-x64.exe
Token: SeCreateGlobalPrivilege	4476	windowsdesktop-runtime-10.0.14-win-x64.exe
Token: SeRestorePrivilege	5108	msiexec.exe
Token: SeTakeOwnershipPrivilege	5108	msiexec.exe
Token: SeRestorePrivilege	5108	msiexec.exe
Token: SeTakeOwnershipPrivilege	5108	msiexec.exe
Token: SeRestorePrivilege	5108	msiexec.exe
Token: SeTakeOwnershipPrivilege	5108	msiexec.exe
Token: SeRestorePrivilege	5108	msiexec.exe
Token: SeTakeOwnershipPrivilege	5108	msiexec.exe
Token: SeRestorePrivilege	5108	msiexec.exe
Token: SeTakeOwnershipPrivilege	5108	msiexec.exe
Token: SeRestorePrivilege	5108	msiexec.exe
Token: SeTakeOwnershipPrivilege	5108	msiexec.exe
Token: SeRestorePrivilege	5108	msiexec.exe
Token: SeTakeOwnershipPrivilege	5108	msiexec.exe
Token: SeRestorePrivilege	5108	msiexec.exe
Token: SeTakeOwnershipPrivilege	5108	msiexec.exe
Token: SeRestorePrivilege	5108	msiexec.exe
Token: SeTakeOwnershipPrivilege	5108	msiexec.exe
Token: SeRestorePrivilege	5108	msiexec.exe
Token: SeTakeOwnershipPrivilege	5108	msiexec.exe
Token: SeRestorePrivilege	5108	msiexec.exe
Token: SeTakeOwnershipPrivilege	5108	msiexec.exe
Token: SeRestorePrivilege	5108	msiexec.exe
Token: SeTakeOwnershipPrivilege	5108	msiexec.exe
Token: SeRestorePrivilege	5108	msiexec.exe
Token: SeTakeOwnershipPrivilege	5108	msiexec.exe
Token: SeRestorePrivilege	5108	msiexec.exe
Token: SeTakeOwnershipPrivilege	5108	msiexec.exe
Token: SeRestorePrivilege	5108	msiexec.exe
Token: SeTakeOwnershipPrivilege	5108	msiexec.exe
Token: SeRestorePrivilege	5108	msiexec.exe
Token: SeTakeOwnershipPrivilege	5108	msiexec.exe

Suspicious use of FindShellTrayWindow 59 IoCs

pid	Process
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
380	wixstdba.exe
1316	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 1316 wrote to memory of 4152	1316	msedge.exe	86
PID 1316 wrote to memory of 3404	1316	msedge.exe	87
PID 1316 wrote to memory of 1068	1316	msedge.exe	88
PID 1316 wrote to memory of 1068	1316	msedge.exe	88
PID 1316 wrote to memory of 1068	1316	msedge.exe	88
PID 1316 wrote to memory of 4816	1316	msedge.exe	89
PID 1316 wrote to memory of 4816	1316	msedge.exe	89
PID 1316 wrote to memory of 536	1316	msedge.exe	90
PID 1316 wrote to memory of 536	1316	msedge.exe	90
PID 1316 wrote to memory of 536	1316	msedge.exe	90
PID 1316 wrote to memory of 1220	1316	msedge.exe	91
PID 1316 wrote to memory of 1220	1316	msedge.exe	91
PID 1316 wrote to memory of 1220	1316	msedge.exe	91
PID 1316 wrote to memory of 4476	1316	msedge.exe	93
PID 1316 wrote to memory of 4476	1316	msedge.exe	93
PID 1316 wrote to memory of 4476	1316	msedge.exe	93
PID 1316 wrote to memory of 5096	1316	msedge.exe	94
PID 1316 wrote to memory of 5096	1316	msedge.exe	94
PID 1316 wrote to memory of 5096	1316	msedge.exe	94
PID 1316 wrote to memory of 4068	1316	msedge.exe	98
PID 1316 wrote to memory of 2152	1316	msedge.exe	99
PID 1316 wrote to memory of 4068	1316	msedge.exe	98
PID 1316 wrote to memory of 2152	1316	msedge.exe	99
PID 1316 wrote to memory of 1784	1316	msedge.exe	100
PID 1316 wrote to memory of 3320	1316	msedge.exe	101
PID 1316 wrote to memory of 1784	1316	msedge.exe	100
PID 1316 wrote to memory of 3320	1316	msedge.exe	101
PID 1316 wrote to memory of 3320	1316	msedge.exe	101
PID 1316 wrote to memory of 2564	1316	msedge.exe	103
PID 1316 wrote to memory of 2940	1316	msedge.exe	104
PID 1316 wrote to memory of 1052	1316	msedge.exe	114
PID 1316 wrote to memory of 3656	1316	msedge.exe	115
PID 1316 wrote to memory of 4784	1316	msedge.exe	116
PID 1316 wrote to memory of 4436	1316	msedge.exe	117
PID 1316 wrote to memory of 4436	1316	msedge.exe	117
PID 1316 wrote to memory of 4724	1316	msedge.exe	120
PID 1316 wrote to memory of 4724	1316	msedge.exe	120
PID 1960 wrote to memory of 4324	1960	AnimeStudio.GUI.exe	123
PID 4324 wrote to memory of 436	4324	msedge.exe	124
PID 1316 wrote to memory of 4972	1316	msedge.exe	125
PID 1316 wrote to memory of 4972	1316	msedge.exe	125
PID 1316 wrote to memory of 4972	1316	msedge.exe	125
PID 1316 wrote to memory of 2296	1316	msedge.exe	126
PID 1316 wrote to memory of 2296	1316	msedge.exe	126
PID 1316 wrote to memory of 2296	1316	msedge.exe	126
PID 1316 wrote to memory of 3552	1316	msedge.exe	127
PID 1316 wrote to memory of 3552	1316	msedge.exe	127
PID 1316 wrote to memory of 3552	1316	msedge.exe	127
PID 1316 wrote to memory of 1192	1316	msedge.exe	128
PID 1316 wrote to memory of 2804	1316	msedge.exe	129
PID 2804 wrote to memory of 380	2804	windowsdesktop-runtime-10.0.14-win-x64.exe	130
PID 2804 wrote to memory of 4476	2804	windowsdesktop-runtime-10.0.14-win-x64.exe	131
PID 3724 wrote to memory of 3332	3724	windowsdesktop-runtime-10.0.14-win-x64.exe	135
PID 5108 wrote to memory of 3320	5108	msiexec.exe	136
PID 1316 wrote to memory of 3772	1316	msedge.exe	137
PID 1316 wrote to memory of 3772	1316	msedge.exe	137
PID 5108 wrote to memory of 3284	5108	msiexec.exe	138
PID 3332 wrote to memory of 2468	3332	windowsdesktop-runtime-10.0.14-win-x64.exe	139
PID 5108 wrote to memory of 2908	5108	msiexec.exe	140
PID 5108 wrote to memory of 5072	5108	msiexec.exe	141

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://nightly.link/Escartem/AnimeStudio/workflows/build/master/AnimeStudio-net10.zip
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffc0dd6c188,0x7ffc0dd6c194,0x7ffc0dd6c1a0
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1840,i,12082123237858132589,2099799756464644585,524288 --field-trial-handle=2248,i,12335589779508837541,6831599043826167670,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1700,i,14994277884134535696,10104242815635473835,262144 --field-trial-handle=2248,i,12335589779508837541,6831599043826167670,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:2
  2⤵
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2612,i,13876150261687005337,10866238326923645556,524288 --field-trial-handle=2248,i,12335589779508837541,6831599043826167670,262144 --variations-seed-version --mojo-platform-channel-handle=2764 /prefetch:8
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,8228936533218304278,6248254085606107787,2097152 --field-trial-handle=2248,i,12335589779508837541,6831599043826167670,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,3749787391549754399,1507704147429996261,2097152 --field-trial-handle=2248,i,12335589779508837541,6831599043826167670,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4204,i,1765917014946645226,3117672099815899237,2097152 --field-trial-handle=2248,i,12335589779508837541,6831599043826167670,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:1
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4272,i,3448308087926376710,9624956975963298594,2097152 --field-trial-handle=2248,i,12335589779508837541,6831599043826167670,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:2
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,5058124691019450806,8441933460696322905,524288 --field-trial-handle=2248,i,12335589779508837541,6831599043826167670,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,8059178953984096489,6576851761321934464,524288 --field-trial-handle=2248,i,12335589779508837541,6831599043826167670,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5620,i,9236819859170011680,10975472888529189460,524288 --field-trial-handle=2248,i,12335589779508837541,6831599043826167670,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:8
  2⤵
  PID:1784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5676,i,3849852191204981675,15975342692228974423,2097152 --field-trial-handle=2248,i,12335589779508837541,6831599043826167670,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:1
  2⤵
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6300,i,14985658710061169242,189924386595963124,524288 --field-trial-handle=2248,i,12335589779508837541,6831599043826167670,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:8
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6300,i,14985658710061169242,189924386595963124,524288 --field-trial-handle=2248,i,12335589779508837541,6831599043826167670,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:8
  2⤵
  PID:2564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6676,i,3095855394613432073,16637635970852342106,524288 --field-trial-handle=2248,i,12335589779508837541,6831599043826167670,262144 --variations-seed-version --mojo-platform-channel-handle=6728 /prefetch:8
  2⤵
  PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6752,i,243434968370186859,8547053123651562717,524288 --field-trial-handle=2248,i,12335589779508837541,6831599043826167670,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:8
  2⤵
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6848,i,4020722632609826349,10206351689512450061,524288 --field-trial-handle=2248,i,12335589779508837541,6831599043826167670,262144 --variations-seed-version --mojo-platform-channel-handle=6856 /prefetch:8
  2⤵
  PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6868,i,3055275651853662522,4452539877959844557,524288 --field-trial-handle=2248,i,12335589779508837541,6831599043826167670,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:8
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,15388864493326847471,12925488255848207370,524288 --field-trial-handle=2248,i,12335589779508837541,6831599043826167670,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5192,i,186149096670146661,10439133182022097503,524288 --field-trial-handle=2248,i,12335589779508837541,6831599043826167670,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6508,i,13066918276794985350,9800558996328050630,2097152 --field-trial-handle=2248,i,12335589779508837541,6831599043826167670,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=4216,i,1562898599411503885,5734308339513304372,2097152 --field-trial-handle=2248,i,12335589779508837541,6831599043826167670,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:1
  2⤵
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=5992,i,3465099632835371046,14145282130054414932,2097152 --field-trial-handle=2248,i,12335589779508837541,6831599043826167670,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:1
  2⤵
  PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4208,i,14064081602810403380,13531334928300525829,524288 --field-trial-handle=2248,i,12335589779508837541,6831599043826167670,262144 --variations-seed-version --mojo-platform-channel-handle=4132 /prefetch:8
  2⤵
  PID:1192
- C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.14-win-x64.exe
  "C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.14-win-x64.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2804
- - C:\Windows\TEMP\{E3064FF2-47EB-40BA-951A-51066768281E}\.ba\wixstdba.exe
    "C:\Windows\TEMP\{E3064FF2-47EB-40BA-951A-51066768281E}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{CCDBA27E-7D00-4D0B-9F42-0E6ABC642858} {7D403C21-79A0-4D9C-B76E-C8B47F706C9F}
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:380
- - C:\Windows\TEMP\{E3064FF2-47EB-40BA-951A-51066768281E}\.be\windowsdesktop-runtime-10.0.14-win-x64.exe
    "C:\Windows\TEMP\{E3064FF2-47EB-40BA-951A-51066768281E}\.be\windowsdesktop-runtime-10.0.14-win-x64.exe" -q -burn.elevated BurnPipe.{CF723E68-1AF0-461F-98B5-B876D7F23712} {8E4E7182-72FA-4C06-89AA-9708645A20E8} 2804
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7020,i,17142727332818887698,2728110235660910672,524288 --field-trial-handle=2248,i,12335589779508837541,6831599043826167670,262144 --variations-seed-version --mojo-platform-channel-handle=7016 /prefetch:8
  2⤵
  PID:3772

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4420

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3724

C:\Users\Admin\Downloads\AnimeStudio-net10\AnimeStudio-net10-68700c7d885a68a444886bd4b7f7827e77789e12\AnimeStudio.GUI.exe
"C:\Users\Admin\Downloads\AnimeStudio-net10\AnimeStudio-net10-68700c7d885a68a444886bd4b7f7827e77789e12\AnimeStudio.GUI.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.NETCore.App&framework_version=10.0.0&arch=x64&rid=win-x64&os=win10&gui=true
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.NETCore.App&framework_version=10.0.0&arch=x64&rid=win-x64&os=win10&gui=true
    3⤵
    PID:436

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5108
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 6B6D0D24A9534E586DB4738DCFC66BB4
  2⤵
  - Loads dropped DLL
  PID:3320
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 81087F39FEAD7F1B5F2E975CAABFDD6A
  2⤵
  - Loads dropped DLL
  PID:3284
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 4D650B7A245C786AF56A8BF2B645B241
  2⤵
  - Loads dropped DLL
  PID:2908
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 6AE71038BFC151763DA2701B1E0C0041
  2⤵
  - Loads dropped DLL
  PID:5072

C:\ProgramData\Package Cache\{29A18B06-B190-4463-9FFC-BC0D70D80B7C}\windowsdesktop-runtime-10.0.14-win-x64.exe
"C:\ProgramData\Package Cache\{29A18B06-B190-4463-9FFC-BC0D70D80B7C}\windowsdesktop-runtime-10.0.14-win-x64.exe" /burn.runonce
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3724
- C:\ProgramData\Package Cache\{29A18B06-B190-4463-9FFC-BC0D70D80B7C}\windowsdesktop-runtime-10.0.14-win-x64.exe
  "C:\ProgramData\Package Cache\{29A18B06-B190-4463-9FFC-BC0D70D80B7C}\windowsdesktop-runtime-10.0.14-win-x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.14_(x64)_20261027213124.log"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3332
- - C:\Windows\TEMP\{E2AF356A-FD29-4CFD-A131-95522BADB731}\.ba\wixstdba.exe
    "C:\Windows\TEMP\{E2AF356A-FD29-4CFD-A131-95522BADB731}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{2468A4CC-D471-4AD6-A145-93472DEE04A7} {80B1DE81-49DF-4ECD-B7E4-E8EF005E7E3F}
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2468

C:\Users\Admin\Downloads\AnimeStudio-net10\AnimeStudio-net10-68700c7d885a68a444886bd4b7f7827e77789e12\AnimeStudio.GUI.exe
"C:\Users\Admin\Downloads\AnimeStudio-net10\AnimeStudio-net10-68700c7d885a68a444886bd4b7f7827e77789e12\AnimeStudio.GUI.exe"
1⤵
- Loads dropped DLL
PID:2964

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3dc 0x3cc
1⤵
PID:3324

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e59f6fc.rbs

Path C:\Config.Msi\e59f6fc.rbs
Size 11KB
SHA256 83cf8085a10ba7f62e9d9bff641df2ee8b4b60a02d44d5538f9d1fec787acbc6
MD5 ce64f9d0982208a679be80ff71111ddc
SHA1 332091ef1e70606b74ebeff078d4b36165d9d67d
SHA512 016d0337d1c4320dbc21ccbad846298e69228bc526d6b491808d44f7a066baee77255b79666abf1d93b1b24d96e036a7f4974689fd08c55369eed47502be8914
SSDEEP 192:AQZ9fX3LXC8XLXTXbqttW5HPa7R/ehGRmPLvIz7RmPLvCzXEBXgCoLpUAuYSKn6G:AizC0D7mtI5HsfCsCr4
TLSH
T1DD321EA2A601C1E3FA972735CB0B27163F63DB9E8304134F49ACC1259F437992EA55DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59f703.rbs

Path C:\Config.Msi\e59f703.rbs
Size 9KB
SHA256 b427f61d98ea6d8a0a48178453d9845d00e792bb0a98c8e4c8239ed66a2d1797
MD5 3b48476d4de5b22428a10cb75f3b19d3
SHA1 fe1fa062ef33a75f77107ef2cdc864d7a3b399eb
SHA512 5b63be37d189b6750a3c9720bef366aa7e6a0399226581289451253b06248b22c998b40c729fa722ad311408d660bcff8d608c6f7c01d99c179897d2a6dff1ed
SSDEEP 96:rSmwA7ZCVrc2LeOpfpttU9eD2PYCsTl8U9eD2PYC6jiWpUponyTlanEI+E5pl7fm:HNVKXeIGVvIVVvxdEVPkpLpdZ
TLSH
T1501234456A0086E2EC931B34EB432F323F66E39AE344575B1DCE81704F477D85EA929E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59f708.rbs

Path C:\Config.Msi\e59f708.rbs
Size 49KB
SHA256 d1e4aa41c28ae21030bba5a8d679df5b586a066e18459fd488c8399ddc3fb0fa
MD5 e5a574a744e4ec53551b221053c878b1
SHA1 644e5600c6d8341cb2376bfa77d8d7b1d2651271
SHA512 b85673773032edfdd84514d30b11bd8021a952031ae3fa646a665c1e9b632e1cb0b192114f8981f45252ec471999b59926640555e975e4a8d74408bbd1820654
SSDEEP 1536:8pzILbIIwdeizGKApN+B277ffOM9JyZneajISfvz2WJEtPV+Gtig/W5RW3ZVScgR:aL
TLSH
T12633B3A8FF04C2E3F13A7D602761DE04B3158D52D72495AA92CE4319DF4A7D8AEEC1D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59f70d.rbs

Path C:\Config.Msi\e59f70d.rbs
Size 71KB
SHA256 75c4f9a4c11be927d3631d272af30a13bcb7203e6d4269750c9029a54ccd3cd0
MD5 56258996411acd5b52f8088c9b6a5481
SHA1 c39c3b1cf1423c589213b132ad0b764296df40d2
SHA512 093d190d484bfec28d525f56a51a9a92b3bcff45e3b9a423799ca03cea9f3ff3a430ca5d00509baa2a142196337a42237db0b66a3f444b1d82822b326ee7046a
SSDEEP 1536:Craavi1jDWKS0dN97p9t4Gu4C6jLepO4BqH8Zd4WY0fZf8Fmi9xGpD/gsLtdlInj:iLn6ju1WMCy0sKy4WO/h
TLSH
T1466322999748C096FD322990FBBFF604BB119DA2B60E45AA11CCD63DDDE52C61FA4CC0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ThirdPartyNotices.txt

Path C:\Program Files\dotnet\ThirdPartyNotices.txt
Size 77KB
SHA256 deb4427a295e1ed474b0d81c5a0d972c1b550b9a715cda939cdfa9236b1b418f
MD5 0d8867a25ba926e6e40cd52ab3536b5c
SHA1 89390dc8b8318d0bfef1c6a2fb4783537e28a465
SHA512 317ca335405274f4f91b173651ca2826760acb5ba5cf41aff51adc55c2cda9059fb268333665f13f62fa48119e55a303720a780dd58d28dd9967db4c88407d61
SSDEEP 1536:HA9jHwsGfgg39/zwgAVkguQxrDjugtSEGepkWvrpX7anuqdLSVnfiStPq+3LefrL:HA97w/ogz1AVxuMjHtSFULryLOgrGWm+
TLSH
T17773A45F7E45077319E2C3916569A8C5F22FA02E3B6B2A44346EF248133B42DD6FF858
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 163KB
SHA256 1e881ec1786c31ba712d052258b4ad4202ac155df5965794030037878abb822f
MD5 d62fd28f725a7e0200ae19e07c2b2b8f
SHA1 2163a2c5955d66baaa4b7aef85029ba153ca2e60
SHA512 dc86819bf5c0652f7426c4da70858079eb0ec4bf6c2c416b29ad0c0d92057d3baa2d3dcc54472b6577b24ac3858c6e6222eecf256a80cfc81d4167a7370d574f
SSDEEP 3072:JGgPR9lIuvTSBbQ/09n4SbDqIG/0k7l55wK4pQaa:JGalIubgbQoDvqIUtyu
TLSH
T176F3061AD65811AAD06E9575CB528941BB337C668BE0E3CB53C0F8BE0F726905EF9703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetRuntime

Path C:\ProgramData\Package Cache\.unverified\DotNetRuntime
Size 28.1MB
SHA256 36c8067684aeb83228b44ecb3d4c103379017ca87e3e007e51105a91e404d97a
MD5 448a27c46800f17819be6847fb737e07
SHA1 aba29671dc9f147325ddea11ecb3cf909179d92d
SHA512 78ed4db54b0ac78211d9b03d94866a681367d80ef244779cfe60686aafb81795c13120a29baa0967ceeced71ef13e8d0e8c6a24cb4cb055cf9d135dc826fdbf9
SSDEEP 786432:nl9er4PCV9IzzrRov6dz5dcdtDzClZNWYihY:nl9erfqzz1r5SXzCuF
TLSH
T1A557331B7F9204A9D9260EB1C17A8765AB367D082320D2AB47B4711CDEFB3E564F63C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

state.rsm

Path C:\ProgramData\Package Cache\{29A18B06-B190-4463-9FFC-BC0D70D80B7C}\state.rsm
Size 1KB
SHA256 3296f0328f727e192bf47f8eb4bce12615c3aa5000d14f6d265b63ac24de58a9
MD5 aa4e9bdbdbfdf03ed17d9a35c9257706
SHA1 3fdbfb9dcab863b858ab763a0ac9ffa7b53ec522
SHA512 baf04e927b4bfc496cac227bb78a76ea19fd5ded76266bea558717b0edc5501134cc6e2eba0f16f0f7d885886e4a19bd53cf0224346799b8b784d33de11e778f
TLSH
T1A221D1515BF6092DF3F6AB34A9F96725443BBC121C20C16E0001318A9E32BD0CCB4B37
MD5 SHA1 SHA512 TLSH

Submit Download

302000cf-fd1f-42f7-a3a7-bdf2556b108e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\302000cf-fd1f-42f7-a3a7-bdf2556b108e.tmp
Size 21KB
SHA256 48c9e046d424d40bbe4cc33cb5fb5ff7336695b8de58a5a1a5bf45b8f959a7b8
MD5 4582d49e4a474ea905f595495c0906d1
SHA1 1ddae0a6e877ca2f40957dd634e825e8fe1e0168
SHA512 fa5c4a658f5dfaf8688507db1d7ae0efec5a92bee656bcca1a1d2482cbf83283f083bf7d1c69cddf1db455f9f5001bf5f4ff73aa9d9684f6ebe79f5b652c175f
SSDEEP 384:BiFgQkUSvuYsNL8TUNTUlIlncZCqt2HX58Ef8PJjWXi+2mg4vaTZc7btjIIl7:oFIBiwgSftQaAilp4vaTZctjL5
TLSH
T115A25B3298A8DD3B9EF6DA41F55E3203CEF18157CAD56FA4E7DD9E1C008A19C134AC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

434b1712-5f48-471a-be91-d79b81cb88fc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\434b1712-5f48-471a-be91-d79b81cb88fc.tmp
Size 18KB
SHA256 2c682697e6b5e4589bf2aad3a8dfc0dc48809771b282a132befa43b7a0903f80
MD5 2584fd5b51de32bd42a1a9d4cc7ca78c
SHA1 55b6fc3cb090bd6d5b318275f0409652b66ee235
SHA512 6c3f219b771a505e166fa9ded00d327b9698d9a5117a989769d277b2fb25a9945dd2ed91ca2522c5f67589cae473f2498df0d93c497e94edda91dba760532af7
SSDEEP 384:SQkUSvfsNpOcZTxcHX58Ef8PJjWXi+2mS4vaTZc7btjIIl7:Kf8PCaAil14vaTZctjL5
TLSH
T1C8826C36E8ADAC2B4DE2E141B15E3603DFF49117DAC51F94D6ED9B2C01CE298234ED16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6bc3353f-0a89-4343-b84d-b71c8d5434e9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6bc3353f-0a89-4343-b84d-b71c8d5434e9.tmp
Size 21KB
SHA256 8fa19604cbad7c9740529ba091aee39f14621bb10decb783962a518ad61722cb
MD5 748db4f5502cdc6743486c01f5bb8a22
SHA1 d871a6e7a9600c99f27961b425454f7df4ca8e07
SHA512 72a9fc20abf879b02ff9ab33dde5a5850553b2f9f0f587bd5dca4e1eaefb02216f5d75e66a639891555b215ccb3ef860c54369096b269516c14ce7d43a3572b9
SSDEEP 384:BiFhQkUSvuqsNs8TUNTUlIlncZdbqt2HX58Ef8PJjWXi+2mg4vaTZc7btjIIl7:oFTHDwgSqtQaAilp4vaTZctjL5
TLSH
T16CA25A3298A8DD3B9EE6DA41F55E3203CFF18157CAD56FA4E7DD9E1C008A19C134AC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7c0447f9-b5ab-4644-9bf8-17ef4b38e1ba.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7c0447f9-b5ab-4644-9bf8-17ef4b38e1ba.tmp
Size 25KB
SHA256 98982cb2339806dfa263ec42f123f07c22a944b04366394fa60b99473993a846
MD5 3936dc41ff4346c685ab9e3ee850bca8
SHA1 b16e8cf2d0b0fbbd3f49f9319732505fb228a59b
SHA512 0bde360495c301f28096162d7a614632e083e0e9b247c7c1fae87d358ff760c7844d81eed5e40f5396743333def3c4bc25af47efcd9bab3fa26f81cf0cc6f6b2
SSDEEP 768:oF0H+wgSoktQaAil8+tSy6KwIr+/vaTZctjL5:FH1oc16KwIa/yIjF
TLSH
T1FBC249B6D8D89DFB49A6D6C1A54AF203AEB04177C6885B5CD2FDB938308F1F8135AC11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

94fa7217-ed5e-44fd-9c0c-2181a8a37f7e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\94fa7217-ed5e-44fd-9c0c-2181a8a37f7e.tmp
Size 21KB
SHA256 95c41c51cb60b13192b9463b64e430b476b7f50c2fac85b70d287fb772f47807
MD5 1d8cded2a69a254127c1c45bc60154c0
SHA1 92bcd7c877d33142fdc261076088021425380637
SHA512 3ba1acc288635df193ffd8132f90bc550753b18e88d6aa5d48efa7b417cfd7af77b5ffc695d697803d35d4b331a770085a7a59bbf4fd64ffdfed1944e6f01932
SSDEEP 384:BiFiQkUSvuYsNL8TUNTUlIlncZTxcHX58Ef8PJjWXi+2m54vaTZc7btjIIl7:oFaBiwgSPCaAilI4vaTZctjL5
TLSH
T1D9A25A3298A8DD3B9EF69A41F15E3203CFF18157CAD56FA4E7DD9E2C008A19C134AC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9d153cfa-3c6e-4ace-bd66-847027f0e2e5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9d153cfa-3c6e-4ace-bd66-847027f0e2e5.tmp
Size 8KB
SHA256 f9b52c38677b974241456b048e1a7a98c56df10bce8eb8e3ac3a6f753596bfe6
MD5 28f32d13d5f6bc321e420a99ee7e049b
SHA1 52936f62332f0834cd2987b7a1b8225f6725e6f7
SHA512 6baea2b47d7c62c55dbe468bcf408fdffc322701979121a2626403f30cc8c3618334e58e4826241708e877c54c218e2d7ead4f19a601b3b538ede01f8a4e750c
SSDEEP 192:1ONb6wlDgQmiUyXwW4X58gZXjzorPJjADlaRU6:1ONb6kgnW4X58Ef8PJj0eU6
TLSH
T10A02F935E9687C6B8EF3AE09B48B27139FE5112BE6552F54C6E80B2D00D765C130AD23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 58b461967016818ce2213ba739aa830e079c4747cc98baea5feaffc8b09c915d
MD5 8800a672498272bad98dd79644e30101
SHA1 14a42c33d6271869cc680cadc5ae061e7092e3ae
SHA512 a17f90c73859841f3e0a3211d7f8d1027a7f8ec3a4ef87ddc96b1a39e0b52bc65decb3dd694a7092e22f06f2124864535e2e8632387dd42184abe2d3e22d7e12
TLSH
T135D022F2F32200E8C8C02A3C20030B080208C8000C833220C832C0C23ECCBC0A88F08C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 49ad6872da0e53fa2156de2ab29aae15d756e399214100166ee3b981776c9e71
MD5 ec47d7bcfb6fcae0bf0c2b01172a50ce
SHA1 20474467d868ddc238b4a6f05bd8c60a9a69235e
SHA512 38fc241b6dcada0c5d074fcd3a03d2786292deff2b4e86af77e745f823ab3f7a20920fec3c454838305c94f586355a5c360fd844cb107f4a9279878245548c61
TLSH
T19FD0807175273DFDD19D667C05515A405104CE53595115108A134D551E9C6C27CD3EDC
MD5 SHA1 SHA512 TLSH

Submit Download

38052b83-5d98-42a6-9a68-1af4f2d553bd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\38052b83-5d98-42a6-9a68-1af4f2d553bd.tmp
Size 27KB
SHA256 cb33af261025becae12ddeab860d3eb3c5e514c7ae7c606ff34ff99884818e2b
MD5 aafa9e8101af8344c862c5cd7f6a2d17
SHA1 304ef03894ec1a19d17bcdd9edf6af605c859660
SHA512 50d2b1630b9c7359ff4ba7781d849fc5db82e62642d4d8652db8a45336002c9b38e32f55bb3d284209a865b0ac78f94cd43e494e355ac25809c44d4dfd6d6192
SSDEEP 768:MZy4J/DWvbtBh8F1+UoAYDCx9Tuqh0VfUC9xbog/OVCiLlc2TbTroRmJI:MZy4J/DWvbtBhu1jajiLm0bgkC
TLSH
T15EC20B3B684CCA7E4FC00A9DDD5E6FD73E9802C79A948D4047FA994C02C77EA91264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5cd0c82d-08b0-4701-9ce0-5c673fd6d7f1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5cd0c82d-08b0-4701-9ce0-5c673fd6d7f1.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

6699cac2-b239-400d-a357-4060a8ba8a59.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6699cac2-b239-400d-a357-4060a8ba8a59.tmp
Size 11KB
SHA256 8525dd8ad953287b515835f205645d20022a7e936aa73c3c37b46deec62efa4a
MD5 d20fc998c0b3d4442478a078b0f00b83
SHA1 fbe8b05b9a9cce33c7f1fc0fc1b3cb3672b70815
SHA512 90272ad95913ac9eb11db5069f8015d480a93f886f4bd6d744fc2862c377a86a1297a79b31bd40847a4b0ec1d1fb4d74ebf953ac1c1efa7d6ecf88ce781c61a3
SSDEEP 192:sxZURNnr/f3s1WpVpDMIdp60HW6+WNINdF/YrTAsA9IgbShJ:sxZUrr/f3s1WvJVrHbM/Wko
TLSH
T1E042D951AD38AD7B8CC7D20DBA29BF53E6F91032A5D11E48AAFC891C15E77DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6aa15a7f-76e2-492c-864a-8f85940db886.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6aa15a7f-76e2-492c-864a-8f85940db886.tmp
Size 9KB
SHA256 55de15cae78399a8e76fb4b8abc99a64a2738279958c2e49e5729a0701c7c4ce
MD5 ac9b742320c70d6a212aa9c7aa3d86df
SHA1 c7664959832fc5184c8705a1f0f4c3688f7a71b5
SHA512 06648d8bc550b31107b4e42c5781a56ee07b415088047bd4fa652875f00233af348db22b6e0e7ad9a77be544b6170958878b9d90c0ba9cbbe6d82c17de7f4dc2
SSDEEP 192:sxZURPnr/f3sHDfIdpJHW6+WNGYr1NqrIgrJ:sxZUxr/f3sjQJHbGT9
TLSH
T12B22A8526E38A97B8CC7D20DBB69BF53D6F95032A5D41D48E6FC861C08E6ADD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

741f7dcc-4a2c-4c6a-868d-525e0c6c4f48.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\741f7dcc-4a2c-4c6a-868d-525e0c6c4f48.tmp
Size 10KB
SHA256 e2597f45d4bd2ec8761f9c76455d17d510cca3811bc4180d900f5827dbce5b85
MD5 387ac7d754caf3fe006e7c25d1120eaf
SHA1 8d94a9d54ac479d18e74a3b1a9f9331273cad989
SHA512 98e5c71c956550d7085610326e967de90ddfb531d84e5e0388c099f293138482e4bf36923e2b74f68dd4321ad310ae06f33b247ec2da77a79742b68a3a143bd9
SSDEEP 192:sxZURPnr/f3soDfIdpLHW6+WNGYrQAqrrIg5ShJ:sxZUxr/f3sWQLHbGH7G
TLSH
T18B22DA526E38693B8CC7D20DBA69BF53E6F95032A5D41E48A6FC8A1C15E7ACD120740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9d963a40-d1ab-4d3b-b5c7-a96452d459bd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9d963a40-d1ab-4d3b-b5c7-a96452d459bd.tmp
Size 10KB
SHA256 6e7c39c59d0073ded44a65c3f2ff8045913a9e7b2103472e2b6734c12b0ff0be
MD5 4bd1cdc7ecca54c08f840591aa6aeb94
SHA1 25976659a3f13e8481b678ba062f2df87cac192b
SHA512 09f2e97b0bf122e3e32107cb8bd9cb7b83e69683f7c06e0407324d45a9f1770ba291691a8168c72911ab34ffaa6f4790b5dd5b87f780158ebaef1950a4aceb9d
SSDEEP 192:sxZURPnr/f3soDfIdpJHW6+WNGYr1PqrIg5STJ:sxZUxr/f3sWQJHbGnM
TLSH
T17322B8516E38A93B8CC7D20DBB69BF53E6F95032A5D41E48A6FC861C05E6ADD120740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 99709b7e0f448e5cf313859572464af3cc6c4706d61dbe37c68fa21092b73a8a
MD5 bc9b86842ba7863c4873f2e32bc7e468
SHA1 a5165d31b1be28b3e631b24a8ab97389a383689c
SHA512 45fa4c6d03cf7e37329001548d1f71ffd81ff471602866a238f2faa98564ec8e2c5033096bdf274cfb77cc5b6d14844eeabda2d607b3aa581e40cc02a2b385b6
TLSH
T138E0208886CBC33FD11974470154434CD3C2365FD2C4AE1D1700D585B247540F2855B6
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 f70404c332d70c2bfc82d88bda195b9ddca51bb01f1461c4d1192f29512b92e0
MD5 6d21400e7ca46b224f73b511326f3a26
SHA1 8382ab69475c98ec821007fc91fe8e3e2ef94c16
SHA512 19daa6718e3836364cef1f15004e63c3fad1fbdf3ae55d7d7517a2fbff8484fee9b8d6aed897b6928c77993d3d4c6a4f2282603e7812b9aaa8290ce644473cbc
TLSH
T14DE026C9C5CAC33FE208E44B016D974C83D2261EE3C0AD5E2704C5C8B246940E387AF8
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 fa68278643b9d390e560beaa8f729bcf40bbf28bf9bba01178731682e927668b
MD5 cf0b060b23edb44effeea88bbeafb711
SHA1 a788b47c8ce8818102fbe943aa25a9582e6b6ee0
SHA512 049b74a74f17a9dc4f356af276116ac490d55e171d86c9c3988193f3fdb02aef2ffaf6c316eff3d1a88c93d70d31e1106874be2c1da2bc257e6741ac13aff324
TLSH
T1BB5197B0BFA89764E7ABFC70B5D2178B36F7657201472EA61694C9BB4B0B3750124C34
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 b74e44c17bf3cf7a4852e6812f6b3bca8220d6697d8d5b2f21ce8784700980a0
MD5 92dd568439c4bf663c8f91630bfd5543
SHA1 7686a77e06a64285ed9fbe09614c0bd9ce86f7cb
SHA512 75040fbbb23d4c4ca8d7694ef051670d6e10e4ab3cdbb3a5193b18b92da9b29e7de722d615a9f9715a5b4912a8d72e142c055e7724cb50ebc00c48b346250ac8
TLSH
T1655175B0BFA883A5D7ABFD70B1E1138B36F7697151436EA60694C9BB8B073344128C74
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 0b450ab743de74345fac5cf8a40cbb1edaa03c107ad98004447d212aea9ec0bc
MD5 d04e5ca794f71aa098f06aeb81f3b390
SHA1 7560d1001a86dbac5d736ebf67786a6ece259945
SHA512 5930d110388725a77e04c7c7c2461d971daf2c67503ca2ae4dd3e971dcf6d80c8bbd380fce6606b546b78df493a0aca33af146ba1e937ca67a5e3a52f2c6b42d
SSDEEP 3:MsEllllkEthXllkl2zESkVi:/M/xT02zL
TLSH
T10A4404047FD40C05FD0010344415C3540370D4150733D757345104375DD75C01C04000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2ee6fc0c-f6e2-4202-a951-da0714af87cb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\2ee6fc0c-f6e2-4202-a951-da0714af87cb.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

0fd1458b-ca58-4644-b178-2e4d2ae2e95c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\0fd1458b-ca58-4644-b178-2e4d2ae2e95c.tmp
Size 2KB
SHA256 bf5b161f22460b941ad2a7df73ceec24c4795ca10884de2a5f29330612046bf1
MD5 b7bcdbeef9beb2134a5d4b5ce287c837
SHA1 7a8ebec7bc67dcb8aea83adc4cc10a901374ef66
SHA512 54e4d69b375d92f6c58ecf5077b8c3744e65027c0f272b77ebab19bc49b32978b4fac774cbb1505d4e6369605e80becdfcc2b821f832baa523f9be02bc5b6a4e
TLSH
T140417CF747B1856ECA10AAF09A18DE2FDF2C0216435C782989D4EE33D7B3472E00265B
MD5 SHA1 SHA512 TLSH

Submit Download

4f8de8af-a171-4946-8649-5748f96fc9c3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\4f8de8af-a171-4946-8649-5748f96fc9c3.tmp
Size 949B
SHA256 357bd97d33cd35fe544d1eed2102ad44628174022993da9c70c73ce694807edc
MD5 42535703bebfbd32bd558252cbcaebd2
SHA1 d6104d5c207ed3be41fc8bda24488b1711e767a2
SHA512 e7acd5fb1787a8ecb4ce6d8d6cb101d341fb7c8c16e12519d77a48975eb900a3402d5ee72dae5b4a10c2016d429bb41f77cd496a22880be120bb82421ccd1235
TLSH
T1D4117AF3C7D5956E890156F05A28AE2BCE2D0606422C7C1AC9D8EF2BD3E3476E10295B
MD5 SHA1 SHA512 TLSH

Submit Download

52d8376e-04ff-4cad-b530-01eec695cb4f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\52d8376e-04ff-4cad-b530-01eec695cb4f.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

b0832641-c8fd-4eb0-b9cf-045737c4d2e8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\b0832641-c8fd-4eb0-b9cf-045737c4d2e8.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 7KB
SHA256 fff419ec734c3adc32abeeb1feae622656c8a18faf75d649cd3b7bd7420953de
MD5 402eb52a0e41e840680f371aa8a30523
SHA1 5032ffe59b00dcbbc099919b886d072ef42e03b2
SHA512 ee55cd9c9784c1e86cedd5845d84cfc75aedaa60cc4d5add0c693af41a834b126647b3684df0894f6d2e48615e58cf591c1fb2cf0f8f7d505b5bfdde859af789
SSDEEP 96:KIDCKs0+KsgKtu+i+VNqKGk6iS8KDKIZGKSsyg:E5LXw9vutg
TLSH
T103F13151B1BB461138BE264C81B5D62B425335B37119EA3B7FBD84A28E2FE041DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c0307cbe-c16b-4025-8afc-96028a2738dd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c0307cbe-c16b-4025-8afc-96028a2738dd.tmp
Size 10KB
SHA256 648bd93da3eae585a6b313c050d0088ef5342f2e8a13fe79d92cda26d9d968a6
MD5 219db632bdd49d328f5e570a3c38494c
SHA1 3c90c18f15d00e42bf66a090fa0ac476a470e597
SHA512 8ae5a69296f5cb1edca298fa7989f1bcb076dd421d3175e6e10d51295a995e88a45d7fe61ca91d246ddf73fb27a7fb3d26cc307bddbf19ae66951f192640b9e6
SSDEEP 192:sxZURPnr/f3soDfIdpJHW6+WNGYryFqrIg5ShJ:sxZUxr/f3sWQJHbGuG
TLSH
T19522C9516E38A93B8CC7D20DBB69BF53E6F95032A5D41E48A6FC8A1C05E7ACD120740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c4cea4bf-580f-4005-b5f9-9f7bc8abd33e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c4cea4bf-580f-4005-b5f9-9f7bc8abd33e.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5187453-ef12-4973-aef6-f80f25cbc38d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e5187453-ef12-4973-aef6-f80f25cbc38d.tmp
Size 11KB
SHA256 75050b726d0f766fdb2a0666a086e5883b35bf40e30fc93907eb420f77579eec
MD5 5b986348a7dcafbfac8bf9111c3fa6fc
SHA1 234a775defa86bd6958fac1c45be1f5734aeb0ad
SHA512 2157340f4f709afe0deda1ca4cd34b96649741539de77f4fa98df736c44c67d58a12ba2ccf1abd82f8f1636c43f53d932907de701247636eca100e9fd4678914
SSDEEP 192:sxZURPnr/f3soDtIdp60HW6+WNrdF/YrPAqrrIg5ShJ:sxZUxr/f3sWOrHbz/A7G
TLSH
T1CA32EC516D38AD3B8CC7D20DBA69BF53E6F95032A1D41E48AAFC8A1C15E77DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2cdff39a-e98a-47c3-84dd-d22f3e48e6ad.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\2cdff39a-e98a-47c3-84dd-d22f3e48e6ad.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

cd6d85dd-53bd-4a4f-b2ac-86b263aebb34.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\cd6d85dd-53bd-4a4f-b2ac-86b263aebb34.tmp
Size 8KB
SHA256 2e25126074bdc0da72130297e4f97e8109f31033abe59142c01ce4b1c8680293
MD5 bc208fe22cfeb24d7e78862f71b35de7
SHA1 fc090d1d9e2487120da172e2fa63deaf9df8421f
SHA512 3c65176cf4bbeb846652301dfac55777ef84167903c1e7d409eb747196b1a445d058e6c97b692f2cdc15d68f136986a9042598b210f0065733f3fe875a0ed9c7
SSDEEP 192:ZONc6wlD/QmiUyOwM4X58gZXjzorPJjWXm7R+2mHve0qmU6:ZONc6kB8M4X58Ef8PJjWXi+2mW4U6
TLSH
T1C6120835E8A8AC2B5DE2E545B08B35039FE55117EA8A6F90C6EC1E1C01DF6AC530ED13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

de41be9f-8016-4e78-99d4-aa8f4aba9dc7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\de41be9f-8016-4e78-99d4-aa8f4aba9dc7.tmp
Size 18KB
SHA256 dca34d6b15a8b34f30f741cbfafb34c7ad1ad5ac323295f337e9d14de9f4903f
MD5 2db5ff46734a1a5c583d290ce9247c37
SHA1 6e7d8844e9bf7508b0ce3ff5dfd5ab740042da92
SHA512 a4f678842074a181658adbd2ee864ba62568b504805799e7f52180bbf2a17e081687568611bb7d23dc9f898a42b2279b45ab21e408d80c03b4242344e485eae6
SSDEEP 384:jQkUSvfsNpKcZTxcHX58Ef8PJjWXi+2mS4vaTZc7btjIIl7:NfsPCaAil14vaTZctjL5
TLSH
T1B9826C35E8ADAC2B4DE2E241B15E36039FF49117DAC52F94D6ED9B2C01CE298234ED16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eea5c466-447b-4d80-9487-43c4802adf2e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\eea5c466-447b-4d80-9487-43c4802adf2e.tmp
Size 18KB
SHA256 46ae28181f7e825dda6e2a13a792afa347187bffb7f45f79bccf19490b7afc8a
MD5 73fbabe5e24c0b2267709d25bb29017c
SHA1 cc0bb9569c74289b2cc7d5e3aedf720816d267da
SHA512 f5218d961a718818af864ed636d73bc008d2cc8f1d9a9cf338df2f5fd33247ca89ad02efca414bdd4a0a4310c1c5d3218d92337830d6900a6524544b82e4d6dd
SSDEEP 384:9QkUSvfsNpncZTxcHX58Ef8PJjWXi+2mS4vaTZc7btjIIl7:nf/PCaAil14vaTZctjL5
TLSH
T1B0826C36E8ADAC2B4DE2E141B15E3603DFF49117DAC91F94D6ED9B2C01CE298234ED16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b465da8e-d11d-445a-a5b6-26bddac83fe8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\b465da8e-d11d-445a-a5b6-26bddac83fe8.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 8c8ea5f27b908ace5c3c5aec1167dd54a574d3ffa5dda9deae478acfc312d655
MD5 3cf8a0fec5803797bfa3a1d13e668056
SHA1 fd1a6e9aaeedd088ae6587e98f84986428aa6cdc
SHA512 70a3866a2c74828932044d542168ef7610ccb48991649c17c46f58057fccc0981919b69814b74581c54c4541c3a6d3bee3d5ff99634e7193b209cabfb23b2e79
TLSH
T16441275CA7FA1148B3B77F5A9FF2A8AD44BE78772E4AD45D10110D4E0A32B40C861B37
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.14_(x64)_20261027213124_000_DotNetHost.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.14_(x64)_20261027213124_000_DotNetHost.log
Size 2KB
SHA256 9067e619308df9b9994e6468dbe2a99bb6dfc0b795b2d69a796550a782d88500
MD5 bdfa385012c4d52f38370612e17f5fdb
SHA1 886a116383c7fcf93647ee3ff9ca307f2269b3d7
SHA512 8cb3dcdcaa42e80208a5f025017c4f69e94c372292d893b66de3bea58f77bd875299824ffc23bf655156b14f59accbe8fb700f470f769a4e192def4384a95f7e
TLSH
T1D641E8692EE50915B1B7964799F3C4331E33FCE6A934CF0C22C48369066790469E9BFA
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.14_(x64)_20261027213124_001_DotNetHostFxr.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.14_(x64)_20261027213124_001_DotNetHostFxr.log
Size 2KB
SHA256 42633ee485da25ade3f6adc994c5a1537ad555c68562a5a67160619723fbbb36
MD5 b227223c55c0aeea9ea0e1ab546bc93f
SHA1 bae7216457f7006c5040e7aeb9b137093895a1e0
SHA512 ad0157b8055175992a0a88a8ec52f2c3952021e31627eccad45035c474de462a63f12f6668981207ce61fd6c48a3bae2067b5fc5470b5ae9e157b438b085abcf
TLSH
T139412C381AE80D05B1F297479AF3C8210E33FCE6A830CF4C13844219066BD066DE5BBE
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.14_(x64)_20261027213124_002_DotNetRuntime.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.14_(x64)_20261027213124_002_DotNetRuntime.log
Size 2KB
SHA256 1984a80195c885f99a61e3377550755587568559295dd4fcb79e787209657ce1
MD5 15546b06528c941373ea9312e0665b95
SHA1 19044ea6a0497f1aa18a7b5495c08d8c9d89c8aa
SHA512 93b76a256984f03564f8165cf46073c71b1484a5536a0feeafe5538e762e0da0bec9543f50bae9ccbc361d96445a9be49a4a21c4dbbd07cd47314d75fc6b1b2a
TLSH
T1AD411A241EE40D05B1F75757E9F3C5625E33FCEAA834CF0C1384825906ABD0669A8BBE
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.14_(x64)_20261027213124_003_WindowsDesktopRuntime.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.14_(x64)_20261027213124_003_WindowsDesktopRuntime.log
Size 2KB
SHA256 224a2b42e0b5c10ca79e76dd252f8280a158ffe689e3467bfceb4a852199feb1
MD5 78b9431a80b7bd4326590d12d1b9e38b
SHA1 8bf10b61282d551cf3930d1b7f12f60f05820379
SHA512 ea955860ca38e9a9d609fc2736918cb9598928753e1d8fe2c9dcc244726705fa2211743aa1c337dbd73701c43b0a5f59cb868bf9284bf80d64618c996cb96995
TLSH
T13E412A942BE40D06B1F25747AEF3C0657E33FCEA7834CF0C52854259466BD0499A9BBE
MD5 SHA1 SHA512 TLSH

Submit Download

DotNetHost

Path C:\Users\Admin\AppData\Local\Temp\{E3064FF2-47EB-40BA-951A-51066768281E}\DotNetHost
Size 848KB
SHA256 abf9056691ac5c463120c59943bcc7b3ff8cc45e9430f5260d6383108f0f2839
MD5 533c8600ced609c8c4293ffcf5795817
SHA1 a7cc343e6a9e2d2eecaf468d19b99d2f35de768e
SHA512 d0a4a2ee79d39cd9f7a910d7d5f3f86e47cbf41ae8bf7a963fd1dfebc83455eea346174719127549f9e67bb2618e24613a94c9d4928e73c7e9af4f33c7fbd675
SSDEEP 12288:eBGQ4cABdUb/aVo/2WCsT7pXJS5qgBwhYysWPuoi:6GyASwoO2T7RgZMYnGi
TLSH
T157055A1BBF9414A9D8A24EB1C4B78721FE357C082320959F46A4B12CDEFB6E4647B7C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetHostFxr

Path C:\Users\Admin\AppData\Local\Temp\{E3064FF2-47EB-40BA-951A-51066768281E}\DotNetHostFxr
Size 920KB
SHA256 b26eb4b947543ee2becaf5f71d8736f5bbdcb340eb1259856bdaf64bc11c7782
MD5 db32bbb9ac147022d38539d078207f81
SHA1 3f896332365a4ae79b8aeb632a1a66e4f1a323eb
SHA512 940497d8c9316abf312a32a1ad06fe3a8a6cbb498bf9c2c461f28871b0488f2295d77d0aaa3699ce16bb873234dd4ab58f17d0e91c34f7433f3b185c41478162
SSDEEP 12288:lBGQ4cABdUb/aVo/2WCsT7pXJS5qgBwhYPVJTJ+VDD:TGyASwoO2T7RgZMYPVJTJ+VD
TLSH
T17D156B1B7FA404A9D8A24EB1C5B78321EE357C082320959F47A4B12DDEFB6E4647B7C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsDesktopRuntime

Path C:\Users\Admin\AppData\Local\Temp\{E3064FF2-47EB-40BA-951A-51066768281E}\WindowsDesktopRuntime
Size 28.7MB
SHA256 cd1659987ad005184e83139f89fd0f073005916311f3426ae2152e0fc942a2c9
MD5 0b2ce5df5008f401e907bf1e6cfa29f5
SHA1 c89c7788f505ec043ffc7501c88c1cbe0c7f431a
SHA512 325d3d756a05c96bd78558daf998a9c4a4df47f6e1c1cd5c6b426e7942a25be6c46b8dc13d1581942097b2889dd6ec79af14e6b5fc9ef57b1caab932f85ae1c5
SSDEEP 786432:rS0wapy/3xUTNEO3BpWyEtxhzdlR8vQdVl5cSpxf4WCy5UgmHM5:m0wX3mTOQcvtHzdz3VxAkvmo
TLSH
T1A967332B7FA1189AD5778EB584BB9314AE3A3C082700954B4268B54CEFFB3E41577BC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

164d5fe2-ed17-4310-913d-f7ea04f0b783.tmp

Path C:\Users\Admin\Downloads\164d5fe2-ed17-4310-913d-f7ea04f0b783.tmp
Size 14KB
SHA256 c3893551fe0897515e1c9e8261383a1461733968fcc055560282aa4db2e7b6fc
MD5 d9de4c086aee37eb517d34034512bfc1
SHA1 ad71458f5e08a6499e86a68f47c9e87705a60307
SHA512 840e7729e12952432de1467ac187e8a6ab25c18dbc9260382c711775b98a40eea657e9d1149f6eadc698ad16543ae97ed102b182e824c34fbd272ee555a1989d
SSDEEP 384:vO+H8EirVeUVi055HJRk7TJrhd/kq97galVTcziGIInZURV:7HbirdlHJiSqz0ziGIWZURV
TLSH
T16D62E08F5571491B8B3ACAF1414371D1A4BF72FDD81D58CA9540930924CED88EEAD43F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AnimeStudio-net10.zip.crdownload

Path C:\Users\Admin\Downloads\AnimeStudio-net10.zip.crdownload
Size 14.1MB
SHA256 385c06d9c3f65b79b939c85740e553fe0dc185f0876190ad96fadf27175f6421
MD5 28048dc4d7f14572a8c275c03c374903
SHA1 be326696bdfe720b46184f539b28a86cd31faeae
SHA512 77be160399f3b27d4cbd70b1bce4b6485b762bb001c6ce9abe4e934981aed4f72613b90ec884040758b452bde3aa59e1594a03794f48ba1d531400e6906240c6
SSDEEP 393216:xezNsDaKWsbCnBeYEC+4JN0MPTP+fn/wEyPyJ8IQ6aN:xexsDnZCn6nwP+HwZj6w
TLSH
T1C2E633E286C84D14FC4C31F9B4BE5AA1079EAA3DADF2B7D54C0233DB93B26D23511592
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a6f86511-9ebb-4828-a0d0-5401d36c7235.tmp

Path C:\Users\Admin\Downloads\a6f86511-9ebb-4828-a0d0-5401d36c7235.tmp
Size 15KB
SHA256 c9cbdccb55fc36776b886428475a90116f49f5aa8fe2fbdc9f5d79a57b4ce975
MD5 4986d7e691d69f470ebf58a119a001be
SHA1 f77d56fda9ed9c65ef1a03f061cf4a516042aae3
SHA512 24efa4a72d02d1cdb8f7aa14dbd045defe5ad6da7a6c3dc4f280a607d2d62d457d7e322166569d96b864065f70ff7f810ecd757ae920e52a11b223aff86c8eab
SSDEEP 384:a2/F48MgevVPi/gol7IU83c95B+N0qa2bYDJ/tS17:VFgJVPizl7IU831N0q7bYdc
TLSH
T1D1621A12FCA3D572DBD23233ED776F2075CF6D1090E9D2569744880238E27D29AA7B1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIF850.tmp

Path C:\Windows\Installer\MSIF850.tmp
Size 411KB
SHA256 ac54078e0387d2a8ddcdbee3967da6ea6ec6508172505aca3d27a75fa43ce34f
MD5 1981cd407f5b5e81c70ba2729c56b381
SHA1 e0b6d311930ab3557d5a0a8769edefb49c32aa3f
SHA512 3b7c18ca780cf05a01062661156d71e0a4626469f28040e46f07c7deb8f9a643b838bbc88eda515362c5895171a337a3f5d9b8e321e539408fc1ae47e6ae4181
SSDEEP 6144:GDvoaVoIMrKAzCsTI+q6JL9eZYr1JJS5qZ47BwhYjzmHim:QvoaVo/2WCsT7pXJS5qgBwhYg
TLSH
T135947B29B3E418EDD4B682B6C5A78430FF75744D332095AF8BA4916D1F3BAA470BB701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BootstrapperApplicationData.xml

Path C:\Windows\TEMP\{E3064FF2-47EB-40BA-951A-51066768281E}\.ba\BootstrapperApplicationData.xml
Size 9KB
SHA256 2994ce2de1b0a3527527b3e0e914d389fd9f4d9dbc1e22f30b1f385c8565e525
MD5 43522e625b3970b2941b2d9f89b389e1
SHA1 e342fb9b2bd871fd620ed1dcff9aa29573b3bf0f
SHA512 8b62ff64eef47e1c7cbc16a9c1f51500481be0442cfbf0640abf3f5a353635c49e79d3779dd63db36c406ef38eb625d3305c8fa311a79514ffacac37d9a440dc
SSDEEP 192:aTzanZTH49/rvBnAXzaHatVA8ff6TsCsysR:JnNJJQsCsysR
TLSH
T15C12D6513BFD0219F0F35F88EBF6A5556A3ABD552E39C82D01201D0F49B2E818962FB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetLogo_256x.png

Path C:\Windows\TEMP\{E3064FF2-47EB-40BA-951A-51066768281E}\.ba\DotNetLogo_256x.png
Size 2KB
SHA256 0f571f95d8eab48dbc81b0ec5e9f7225e349e26ef50868bfaab556f3c2443b01
MD5 39aa52615723b782c92dec710caaec7f
SHA1 760b49e256a7979fe50a56a2b1be3688a474b886
SHA512 89d1baa3820154667747b25e9e2fd321bfb2ec71dc309915b0a28dacdc80822a4943b639ebb37c37bd2559d5a4306d2096119cd970c84a0d331f6c68b0456dc9
TLSH
T1534195CF1BFD78D7E6E557918E1A8DD232738483B4B3A42CCE7B10B8274A5642B87940
MD5 SHA1 SHA512 TLSH

Submit Download

dotnet.ico

Path C:\Windows\TEMP\{E3064FF2-47EB-40BA-951A-51066768281E}\.ba\dotnet.ico
Size 44KB
SHA256 61a2cbd12868cb9b359e0c78961d409b7875f072eb8e53ea88d3e6bfe2961a18
MD5 b8096652d9ec286709a2c863b244b110
SHA1 b3b7f0f4d608fad7cb59ba499d4d17c2b873a7af
SHA512 492a5aa83220bb77c178b7c5b50bf44968c0427e9e45bb97a33df14d7fb4c667ca7adde0ebb3874c7b6011057b01144e4e6651fbad62c6bcf5e0b93586c4bc7a
SSDEEP 96:r+gfbzo+wHK9NbwOY4tIWQeVlV1W9+H+guapUjFamINUItzf1dBNaIZ:ro5HuNcH4tIzeVlV1WEOFDgUWzf1PIm
TLSH
T1E913EF6DE68547C1C10C2032DB4AC792B5233C72E4DAE0C4F9D4FA7E177906965C6E6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\TEMP\{E3064FF2-47EB-40BA-951A-51066768281E}\.ba\thm.wxl
Size 7KB
SHA256 b00edd703dd8a475119d0e4dd70a3aaa47f0e95361af290e76d367a8edef3432
MD5 8b2c667a8bbad3153068c0ed90df7ec4
SHA1 c9e04a3a37e5e6262ab9bfecf78280171b8f7b74
SHA512 5269f00d474acccb4c48cb7bcfdf19e63557a388572d3a6335aa39191319691d924e27f70da3f3495387c319396476c63a8fd7b35835cca0901220e39783847b
SSDEEP 96:HiTgM1+XSNEzA0HtYQstYCpCwZQpCeyk5HQJM9ouvj9urz8:Ew9EmtYQstYCPC9e8
TLSH
T191E1026F68DFDEE03A732651B2B3698D6919C29A136F1CF0F869084B47635016377A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.xml

Path C:\Windows\TEMP\{E3064FF2-47EB-40BA-951A-51066768281E}\.ba\thm.xml
Size 11KB
SHA256 dfee8e2d075087227f19c835c145c5bb8e72a46880ea24080bb2472fd3a521be
MD5 4329e418dc56b1386d7ea29a0dcfab5b
SHA1 58387f92e89ca21b4179fb697c7de9675c59142f
SHA512 6934873d27e6efbb94da4f13ee8369b29995490051016fdf82800256b924902306d328bf1d4ebbf266d1a53eb24adb6478d1a67de4ecc3e3bcbe561968f24922
SSDEEP 96:HgvPkoeWEH3IWTaQfSJgHzth5mFahbuB8pR5+Vpwe+UIJLg1gEp+6F5pQnxc:AvoWydmQfVHMyyj5Z
TLSH
T14B42FC6851DC7811C532D702AB9371D3FF12BDA6C6C85A58B48E256B1FF262028B739C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixstdba.exe

Path C:\Windows\Temp\{E3064FF2-47EB-40BA-951A-51066768281E}\.ba\wixstdba.exe
Size 431KB
SHA256 e9aad13949cd910523bf9547fc5c23bd2c26595e024809a9f8fa866c8d8e555b
MD5 14e0c606e68508fa618bd5c514015577
SHA1 f8c28db9d2810e872f6ffe7607019851f250c5f9
SHA512 c29fedca692ca2f9c5e63f360aeb95399f2f15f1576a0d06fcf9f0919f6b658329973803bc870b0b1e954b0105757630ca3f4b3ac64f4b80e91742d612fd5b73
SSDEEP 6144:N7lQcp03E0PKVMP/PwMFJ3zdoZmb8LSQsCjzYkffTTp6EoNXJrprSU0e:Np6mM/wML3/QsJDLXJrow
TLSH
T16D942A3165F04023D6F94572E915FA30AF39F208670085EBA3C0DD297968AE6A7FB357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windowsdesktop-runtime-10.0.14-win-x64.exe

Path C:\Windows\Temp\{E3064FF2-47EB-40BA-951A-51066768281E}\.be\windowsdesktop-runtime-10.0.14-win-x64.exe
Size 968KB
SHA256 4234cb04b518dd990fd7053a16584dc37400465686ec0ef288d410e3ba304f17
MD5 381fc2e7514b8ea1ec9e03e3d1a67621
SHA1 348068dde0267de196d91f143db25b7f7064c4f7
SHA512 f3c8fe2b69c6a64a3cdbcbbbd2c5f5d93290f1f5b00ba10cb3a8755b0341e3739f8d0a70652a5f1d3234755d730c76c326cf58a57bab0e9c1a598731073a0e0c
SSDEEP 12288:C/hzPsOEX5eZbWC1I0iqm+4/Pm0zykD7x4zKoM0zpC6jUywy:CZzPRq5eZbpTh47zykJiG6gW
TLSH
T193256D31A166242BE6F40973F914D6307E28E7082B5C55B6C6D0DD0C39A89FA6FF724B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5108-684-0x000001EE7D520000-0x000001EE7DFE1000-memory.dmp

Download

memory/5108-1200-0x000001EE7D520000-0x000001EE7DFE1000-memory.dmp

Download