8b54ab75c1c9d5f8e23940e277420b9fdeee927e8db034dfa88b446df7f43f88

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/10/2026, 00:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
splicedd_1.1.1_x64_en-US.msi
Size 4.3MB
Sample261027-bbef3azyh1
SHA256 8b54ab75c1c9d5f8e23940e277420b9fdeee927e8db034dfa88b446df7f43f88
MD5 2eff0d03509d361c810b777c45351a6f
SHA1 769842fe06ffabe8da02a5408a8d16e71f724f34
SHA512 ad10f682f9a4763989a2324b186569b8d5c36ef8ca81afab389b75ad599c9b410c3a817c7d4bdc10e6fdef6bf125b3e917ac6c1a1037266a4b77d94ba0747a2c
SSDEEP 98304:m4oDim7+wdpWz2nKJvoO5lFScNWgBbfl5/GHZAYytE3FQjZ8v8m:rud7+OQ0OdqgBjl5/GHZApt4Sl
TLSH
T1212622137E809536E9AA3CB2D9FAD370BA3CBD281A54C7475380766EDDF00C05A716DA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence privilege_escalation ransomware trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2316	splicedd.exe

Loads dropped DLL 2 IoCs

pid	Process
3264	MsiExec.exe
3264	MsiExec.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	splicedd.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4268_373853823\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4268_373853823\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4268_556751265\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4268_556751265\protocols.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4268_941238128\manifest.json	msedgewebview2.exe
File created	C:\Program Files\splicedd\Uninstall splicedd.lnk	msiexec.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4268_556751265\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4268_941238128\Microsoft.CognitiveServices.Speech.core.dll	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4268_941238128\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\splicedd\splicedd.exe	msiexec.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\{929F3FC0-AEC1-4C96-A829-5092BB37DC40}\ProductIcon	msiexec.exe
File created	C:\Windows\Installer\e590a39.msi	msiexec.exe
File created	C:\Windows\Installer\e590a37.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e590a37.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{929F3FC0-AEC1-4C96-A829-5092BB37DC40}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB22.tmp	msiexec.exe
File created	C:\Windows\Installer\{929F3FC0-AEC1-4C96-A829-5092BB37DC40}\ProductIcon	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
4608	msiexec.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	splicedd.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	splicedd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000721441820b46a3f70000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000721441820000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff00000000070001000068090072144182000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a72144182000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d72144182000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 26 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\0CF3F9291CEA69C48A920529BB73CD04\External	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0CF3F9291CEA69C48A920529BB73CD04	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0CF3F9291CEA69C48A920529BB73CD04\ProductName = "splicedd"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0CF3F9291CEA69C48A920529BB73CD04\PackageCode = "D5DEAA65702085749BFF3DF98F81DC87"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0CF3F9291CEA69C48A920529BB73CD04\Language = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0CF3F9291CEA69C48A920529BB73CD04\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0CF3F9291CEA69C48A920529BB73CD04\ProductIcon = "C:\\Windows\\Installer\\{929F3FC0-AEC1-4C96-A829-5092BB37DC40}\\ProductIcon"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0CF3F9291CEA69C48A920529BB73CD04\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\0CF3F9291CEA69C48A920529BB73CD04\ShortcutsFeature = "MainProgram"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\0CF3F9291CEA69C48A920529BB73CD04\MainProgram	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0CF3F9291CEA69C48A920529BB73CD04\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\FDFBC7553941CD459B698C6EF525F828\0CF3F9291CEA69C48A920529BB73CD04	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0CF3F9291CEA69C48A920529BB73CD04\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0CF3F9291CEA69C48A920529BB73CD04\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0CF3F9291CEA69C48A920529BB73CD04\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\0CF3F9291CEA69C48A920529BB73CD04	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\FDFBC7553941CD459B698C6EF525F828	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0CF3F9291CEA69C48A920529BB73CD04\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0CF3F9291CEA69C48A920529BB73CD04\SourceList\Media\1 = ";"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0CF3F9291CEA69C48A920529BB73CD04\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\0CF3F9291CEA69C48A920529BB73CD04\Environment = "MainProgram"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0CF3F9291CEA69C48A920529BB73CD04\Version = "16842753"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0CF3F9291CEA69C48A920529BB73CD04\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0CF3F9291CEA69C48A920529BB73CD04\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0CF3F9291CEA69C48A920529BB73CD04\SourceList\PackageName = "splicedd_1.1.1_x64_en-US.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0CF3F9291CEA69C48A920529BB73CD04\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3452	msiexec.exe
3452	msiexec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
4268	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4608	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4608	msiexec.exe
Token: SeSecurityPrivilege	3452	msiexec.exe
Token: SeCreateTokenPrivilege	4608	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4608	msiexec.exe
Token: SeLockMemoryPrivilege	4608	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4608	msiexec.exe
Token: SeMachineAccountPrivilege	4608	msiexec.exe
Token: SeTcbPrivilege	4608	msiexec.exe
Token: SeSecurityPrivilege	4608	msiexec.exe
Token: SeTakeOwnershipPrivilege	4608	msiexec.exe
Token: SeLoadDriverPrivilege	4608	msiexec.exe
Token: SeSystemProfilePrivilege	4608	msiexec.exe
Token: SeSystemtimePrivilege	4608	msiexec.exe
Token: SeProfSingleProcessPrivilege	4608	msiexec.exe
Token: SeIncBasePriorityPrivilege	4608	msiexec.exe
Token: SeCreatePagefilePrivilege	4608	msiexec.exe
Token: SeCreatePermanentPrivilege	4608	msiexec.exe
Token: SeBackupPrivilege	4608	msiexec.exe
Token: SeRestorePrivilege	4608	msiexec.exe
Token: SeShutdownPrivilege	4608	msiexec.exe
Token: SeDebugPrivilege	4608	msiexec.exe
Token: SeAuditPrivilege	4608	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4608	msiexec.exe
Token: SeChangeNotifyPrivilege	4608	msiexec.exe
Token: SeRemoteShutdownPrivilege	4608	msiexec.exe
Token: SeUndockPrivilege	4608	msiexec.exe
Token: SeSyncAgentPrivilege	4608	msiexec.exe
Token: SeEnableDelegationPrivilege	4608	msiexec.exe
Token: SeManageVolumePrivilege	4608	msiexec.exe
Token: SeImpersonatePrivilege	4608	msiexec.exe
Token: SeCreateGlobalPrivilege	4608	msiexec.exe
Token: SeCreateTokenPrivilege	4608	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4608	msiexec.exe
Token: SeLockMemoryPrivilege	4608	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4608	msiexec.exe
Token: SeMachineAccountPrivilege	4608	msiexec.exe
Token: SeTcbPrivilege	4608	msiexec.exe
Token: SeSecurityPrivilege	4608	msiexec.exe
Token: SeTakeOwnershipPrivilege	4608	msiexec.exe
Token: SeLoadDriverPrivilege	4608	msiexec.exe
Token: SeSystemProfilePrivilege	4608	msiexec.exe
Token: SeSystemtimePrivilege	4608	msiexec.exe
Token: SeProfSingleProcessPrivilege	4608	msiexec.exe
Token: SeIncBasePriorityPrivilege	4608	msiexec.exe
Token: SeCreatePagefilePrivilege	4608	msiexec.exe
Token: SeCreatePermanentPrivilege	4608	msiexec.exe
Token: SeBackupPrivilege	4608	msiexec.exe
Token: SeRestorePrivilege	4608	msiexec.exe
Token: SeShutdownPrivilege	4608	msiexec.exe
Token: SeDebugPrivilege	4608	msiexec.exe
Token: SeAuditPrivilege	4608	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4608	msiexec.exe
Token: SeChangeNotifyPrivilege	4608	msiexec.exe
Token: SeRemoteShutdownPrivilege	4608	msiexec.exe
Token: SeUndockPrivilege	4608	msiexec.exe
Token: SeSyncAgentPrivilege	4608	msiexec.exe
Token: SeEnableDelegationPrivilege	4608	msiexec.exe
Token: SeManageVolumePrivilege	4608	msiexec.exe
Token: SeImpersonatePrivilege	4608	msiexec.exe
Token: SeCreateGlobalPrivilege	4608	msiexec.exe
Token: SeCreateTokenPrivilege	4608	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4608	msiexec.exe
Token: SeLockMemoryPrivilege	4608	msiexec.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4608	msiexec.exe
2316	splicedd.exe
4608	msiexec.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 3452 wrote to memory of 3264	3452	msiexec.exe	93
PID 3452 wrote to memory of 2560	3452	msiexec.exe	99
PID 3264 wrote to memory of 2316	3264	MsiExec.exe	102
PID 2316 wrote to memory of 4268	2316	splicedd.exe	103
PID 4268 wrote to memory of 4392	4268	msedgewebview2.exe	104
PID 4268 wrote to memory of 992	4268	msedgewebview2.exe	105
PID 4268 wrote to memory of 992	4268	msedgewebview2.exe	105
PID 4268 wrote to memory of 992	4268	msedgewebview2.exe	105
PID 4268 wrote to memory of 3944	4268	msedgewebview2.exe	106
PID 4268 wrote to memory of 4996	4268	msedgewebview2.exe	107
PID 4268 wrote to memory of 4996	4268	msedgewebview2.exe	107
PID 4268 wrote to memory of 2676	4268	msedgewebview2.exe	108
PID 4268 wrote to memory of 2676	4268	msedgewebview2.exe	108
PID 4268 wrote to memory of 2676	4268	msedgewebview2.exe	108
PID 4268 wrote to memory of 3972	4268	msedgewebview2.exe	113
PID 4268 wrote to memory of 3972	4268	msedgewebview2.exe	113
PID 4268 wrote to memory of 3252	4268	msedgewebview2.exe	114
PID 4268 wrote to memory of 3252	4268	msedgewebview2.exe	114
PID 4268 wrote to memory of 2468	4268	msedgewebview2.exe	115
PID 4268 wrote to memory of 2468	4268	msedgewebview2.exe	115

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\splicedd_1.1.1_x64_en-US.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4608

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3452
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 4BD0CCC0871AFA0D90724EEEA8A2B510 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3264
- - C:\Program Files\splicedd\splicedd.exe
    "C:\Program Files\splicedd\splicedd.exe"
    3⤵
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2316
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=splicedd.exe --webview-exe-version=1.1.1 --user-data-dir="C:\Users\Admin\AppData\Local\dev.ascpixi.splicedd\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=2316.4764.12517733388927725718
      4⤵
      Drops file in Program Files directory
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of WriteProcessMemory
      PID:4268
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\dev.ascpixi.splicedd\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\dev.ascpixi.splicedd\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x170,0x174,0x178,0x14c,0x78,0x7ffb417db078,0x7ffb417db084,0x7ffb417db090
        5⤵
        
        PID:4392
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dev.ascpixi.splicedd\EBWebView" --webview-exe-name=splicedd.exe --webview-exe-version=1.1.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1720,i,9300453051275849465,6867678354531216190,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1696 /prefetch:2
        5⤵
        
        PID:992
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dev.ascpixi.splicedd\EBWebView" --webview-exe-name=splicedd.exe --webview-exe-version=1.1.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1900,i,9300453051275849465,6867678354531216190,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1912 /prefetch:3
        5⤵
        
        PID:3944
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dev.ascpixi.splicedd\EBWebView" --webview-exe-name=splicedd.exe --webview-exe-version=1.1.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2376,i,9300453051275849465,6867678354531216190,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2384 /prefetch:8
        5⤵
        
        PID:4996
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dev.ascpixi.splicedd\EBWebView" --webview-exe-name=splicedd.exe --webview-exe-version=1.1.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3612,i,9300453051275849465,6867678354531216190,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
        5⤵
        
        PID:2676
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dev.ascpixi.splicedd\EBWebView" --webview-exe-name=splicedd.exe --webview-exe-version=1.1.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=3912,i,9300453051275849465,6867678354531216190,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:8
        5⤵
        
        PID:3972
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dev.ascpixi.splicedd\EBWebView" --webview-exe-name=splicedd.exe --webview-exe-version=1.1.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4500,i,9300453051275849465,6867678354531216190,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4628 /prefetch:8
        5⤵
        
        PID:3252
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dev.ascpixi.splicedd\EBWebView" --webview-exe-name=splicedd.exe --webview-exe-version=1.1.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4628,i,9300453051275849465,6867678354531216190,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:8
        5⤵
        
        PID:2468
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:2560

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:1708

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e590a38.rbs

Path C:\Config.Msi\e590a38.rbs
Size 9KB
SHA256 42811bc1d9680840da7a64d3b5a2185e1f968a4a37fd2bc9e1e7781cb7076dee
MD5 69c2c4a897496d5df118143daaf21461
SHA1 ff2a25a23258b0d4c7f2e6d3d4f427893cb837a0
SHA512 231c9c2352c33c2f4558dca87bbec271508eae51eb101127e815083f56e855c45ab322d732ecfbb50d9b8f44fc4404598322f6af60aaf5d79fc7f767ea750b53
SSDEEP 192:i39SXRKe27lOWXGxWXA+kVKxRi7MIRKaR3aWR9imyrvCupph041R2veA1:i39SXRdWAWTW
TLSH
T166221F01BA4082E6FE92173AC65757213BE3C2999314674F15CDA5288F43B88AE663CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.CognitiveServices.Speech.core.dll

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4268_941238128\Microsoft.CognitiveServices.Speech.core.dll
Size 2.6MB
SHA256 62a13d8459e0992c311dc3551bf3c2d1ce167ea7fa40f0ec62193f3bd760b36e
MD5 0ee2b50c85a110689352fccfa77b5b18
SHA1 d9ecc4b12d2d50e3cbce40e75edad804c9988b25
SHA512 a4f94a05a69b5ae3a0ecf8bdb7592f698d0df81e2f1fae679f38890ad04a2384883837bc792c73848955ff4af7afed49d38839f7ab174454e61919ed78655bff
SSDEEP 49152:NodIJ85qaIU7ui8DDR5s8L0Oty8CvFqwsNcrCY2/YUZzQ7L9qhV6O8mOn0k10:gEDRwrcAwDl
TLSH
T188C54C1FA64951E6C07AD138C543550BE2B27C60CB7263CB1BA7038A1FA37E2557FB92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.fingerprint

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4268_941238128\manifest.fingerprint
Size 66B
SHA256 22b55f5d9b1bafb80e00c1304cf5e0d6057a304a2e8757b4f021b416f4397297
MD5 5bbd09242392aacbb5fac763f9e3bd4e
SHA1 14bb7b23b459ce30193742ed1901a17b4dcf9645
SHA512 541e4c7998e91a5113f627c2c44e32b54878fe225b3b9476572f025f51f2b4ec4a44b102498adcc22b8fe388970645bacfafb6e7fc8a216df4d7bbfc8b0ff670
TLSH
T1CEA0026342648D9FBC1C042BD478A69DCD9115B088492445A925C75BB14203389F49A1
MD5 SHA1 SHA512 TLSH

Submit Download

splicedd.exe

Path C:\Program Files\splicedd\splicedd.exe
Size 9.3MB
SHA256 7d50d76bdba659ab35031ac39dc93be4de16f061ee66272686b0cf6d0732e232
MD5 bd6f20a1df45f55cb02931b7e36d407e
SHA1 17a292f57fa1f0bb01faa48dcb8de2cf820d832c
SHA512 f9d35e251347565306135d9254a7b74527f2ffeb94f6d3236cc09d367102adfa37a98fe60d2c31679d0567379359da6eace35da03e1b919124d0ab3aa1516f1d
SSDEEP 98304:R1IjS4LepGjmbwB31Ybi/VSvWPFM9fIGe+9jlHSjLvT:FpG8itSCFMJIW9Bi
TLSH
T155A62A257B5A99ADC05AC07082464B725A317CCB0B35BAFF4494B6783F7AAF41F3C258
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

splicedd.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\splicedd\splicedd.lnk
Size 1KB
SHA256 5f69af909baec5d4b33fb472f5f0336366500dd4f1d88eb6c17c10c28319b8d3
MD5 e6480d0c4b16878cdf0f97d9b8cb0550
SHA1 0b94abb05f097349a6c351b55534ef0dbcb56b4c
SHA512 09a3d494f68d1e3c037c4546b199bd7a308b3cdfdbf90a977d4e95da980126dc5e68c0d7eaba2c29a7249f7ee98106145653dad41411daf685193dcffe43f56b
TLSH
T18D41CA102BD41B2DE3664B7E39B217114E7BF802E6698F2A42C8468208F4750E93DF7A
MD5 SHA1 SHA512 TLSH

Submit Download

~plicedd.tmp

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\splicedd\~plicedd.tmp
Size 1KB
SHA256 4d47c805c35d38ae947ae79e74f6e65ec7814a26b6ece00fe8ded685c0af13d7
MD5 a8bdaa5ca48b7f8d933c0704ba5e3976
SHA1 e16849185e2b262b9222902632d475aa86f5e413
SHA512 d9513696bdb5ce3546aa9050967aa8addfe516eec9bb22b8356664439e6e068286418e87b20adb6fa7a06a55743a51c2d6b4d893abfcaee0dfa766512da60e68
TLSH
T15541BB102AD51B2DF3794B7E39B217114E7BF802E6688F2A86C846810CF4750E97CF7A
MD5 SHA1 SHA512 TLSH

Submit Download

MSI1B8E.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI1B8E.tmp
Size 234KB
SHA256 78860e15e474cc2af7ad6e499a8971b6b8197afb8e49a1b9eaaa392e4378f3a5
MD5 8edc1557e9fc7f25f89ad384d01bcec4
SHA1 98e64d7f92b8254fe3f258e3238b9e0f033b5a9c
SHA512 d26c9dce3c3d17583ffb5dbcd3989f93b096a7f64a37a2701a474c1bf4b8c8b1e922c352d33f24e411f1c793e1b4af11a3aec1de489087d481b1b636df2050cd
SSDEEP 3072:5XiqyhTO8W0iEa8LW0bEC9hvZpC01v+eUKflQnZl+T+J7g6EsNr7wyy/IP3:5qhy8VKU3hvZUy+ppHEsuB/
TLSH
T159348D217494547EEBFF0832953AD671AE3DF2380B90C96EC384581E6D618C1A7B7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIBA04.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSIBA04.tmp
Size 132KB
SHA256 7f47d98ab25cfea9b3a2e898c3376cc9ba1cd893b4948b0c27caa530fd0e34cc
MD5 cfbb8568bd3711a97e6124c56fcfa8d9
SHA1 d7a098ae58bdd5e93a3c1b04b3d69a14234d5e57
SHA512 860cbf3286ac4915580cefaf56a9c3d48938eb08e3f31b7f024c4339c037d7c8bdf16e766d08106505ba535be4922a87dc46bd029aae99a64ea2fc02cf3aec04
SSDEEP 3072:Kx2YbpcgwmiTPJDnCO+DATkURBnrskNwPj2:XXgwmY1CPx2XG2
TLSH
T1DBD39D02B5D0C473D9BE09390870DB229F7EB930DF909EDB636856699E702C19E35A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2527fe87-2978-4bf7-b714-1061f45ba12c.tmp

Path C:\Users\Admin\AppData\Local\dev.ascpixi.splicedd\EBWebView\2527fe87-2978-4bf7-b714-1061f45ba12c.tmp
Size 1KB
SHA256 033fbdc055ea9ad0e5e104be84574f05e53e13421d1de8ecaeef3dead6f93cc0
MD5 00761ea375c1b13f0b38f8b4df4dfd80
SHA1 a3ae13e3d0381ab21a215128b290b04bd0f891d5
SHA512 975ddd3014345175a2d461af3cb1ecd8c41989976d420846ae9ab20d4a11e126adae80acf48f66d717d136f5b8eb7eb066e19601bd0e1b08c285ed1e9f69ebe5
TLSH
T1B2316573E0A02F769CC19645B656BF839E15906AD0544E4CE9EC0A3C13EB6CC5266C32
MD5 SHA1 SHA512 TLSH

Submit Download

98bc9223-592e-4d4b-a550-4a9a41debda1.tmp

Path C:\Users\Admin\AppData\Local\dev.ascpixi.splicedd\EBWebView\98bc9223-592e-4d4b-a550-4a9a41debda1.tmp
Size 16KB
SHA256 b5ca22f853e052c6635b55f1057c18d088af175bcc99b327537c9fb56bdef6a1
MD5 c8738bcd3baf1d368c5943e580e2abfb
SHA1 b8bb10f760dd703e86c12ce17d20cdb2aa2737fd
SHA512 620bea7cdbeaaa06c85471d65eda5b7faa42acc6d0b842dc8b1791ac4f7d5ecf2fd68adde5ec4d93743012ca1247f418397b1e08c05d7d846ef47b3ae517731b
SSDEEP 384:zr+OBqImmJvGBLx3NaFMJFNNbTMhM1SFg6r8:OcvGtlNI214o
TLSH
T13272AF6618751E232CE7C509BA8E7B47D725A297C0D57BE4CCEC4F1E122B1842392D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\dev.ascpixi.splicedd\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 c5cdad1fda6f71691adae3a117cd945957f36a8a6623e403d7c200616dc74188
MD5 6ab08b562776b6ed474df58f45252404
SHA1 ad310205002cec20ba65abdfc2c731e62533876f
SHA512 2c8dc640530ff5089041263a668fa89a3924a8b6b365b4c67a07abfbd9963b801fb51c753be35ac199c4f3ce83047faf192d643e353f5a816da7d1c5e63f979a
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\dev.ascpixi.splicedd\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 d189f0a50be8ceb9a1287ac695d11ea6517b204e56be5d6009badd5eb2a738b5
MD5 ee823f2d318e0eaad54854fae09533eb
SHA1 cf703a6c0ffd69e5d0dfc11c07348b0f957729a0
SHA512 7be660b6f7be28edca8f05689b08f1f52d943bec159bc43e158ec489d6bb4cb0555032b68d0ba2c29ac675ad52ca47ce82a2a5494bb630912cea2655f27825fe
TLSH
T114D0121336030134C42020330802A18C0400E11FC18A81019C28D55D9BA81E41D02495
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\dev.ascpixi.splicedd\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\dev.ascpixi.splicedd\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 72B
SHA256 d2b119e44be30836efe79c72ac4bb99a2978ac12f32004819bca2cd8997dfef3
MD5 8436ad18180e1dc6c74aa1d5f622553e
SHA1 ea2c7c89825a96c472ed9ab1079909cff3406d19
SHA512 b6485b31e908b9918b3b2e67bae5d1707196d11c91f3bc09e587961e131db8bcfb6656cf1e2107d74b2f848a2bbef0e3bd5aa971bf0a4312ef24545703819a48
TLSH
T125A0022859694842D152C7B514D295447231AA7013170F0D809415B4A8A83908107040
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\dev.ascpixi.splicedd\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 05bf022d1bc6b055b9c4735168b35ab54d9029a144b48b63f11e3c8b99342943
MD5 ce38977e7deb92eefd21a30d9ffbd4a1
SHA1 dce410e1a331dcd23dde4fcb836922269de19689
SHA512 879219b062b92c560e0f790e4f790e6e9b398b53de20def577daaba6176ec2b5a2aad5232b719e791c1b2f5cac788ac6b033d3d7606c7dc704b94482840eedd5
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\dev.ascpixi.splicedd\EBWebView\Default\DawnGraphiteCache\index
Size 256KB
SHA256 2098a4a79c7492c007caf6329f554562e61681711011d6ed0ec2a582b904e547
MD5 53742de2a6b6b6a380f7daf2923342d7
SHA1 3f2c9a151d96d3bd0a724206163b73a8c1f5b6d0
SHA512 3456f71c3be678eb7eeb2c3370dbfcd9df017f2a0802508358ba2425ee0f5ab3bf7e8d08cb8b63cf2e3bdf6e97ab0c2f9c52774563784ef20b58aa327ed0b8f6
SSDEEP 3:LstlNllkll/lGl:LsX3lEtG
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\dev.ascpixi.splicedd\EBWebView\Default\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\dev.ascpixi.splicedd\EBWebView\Default\GPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\dev.ascpixi.splicedd\EBWebView\Default\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\dev.ascpixi.splicedd\EBWebView\Default\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

7c77c177-57e0-4e93-84ce-f1e713687e88.tmp

Path C:\Users\Admin\AppData\Local\dev.ascpixi.splicedd\EBWebView\Default\Network\7c77c177-57e0-4e93-84ce-f1e713687e88.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\dev.ascpixi.splicedd\EBWebView\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\dev.ascpixi.splicedd\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\dev.ascpixi.splicedd\EBWebView\Default\Preferences
Size 6KB
SHA256 cf610b9f5ca236e6dbb4431b6a1dac990574bb053864ee301f03a9e758f19533
MD5 99fea479edeeca3e942d915c14314ada
SHA1 362b4101a9a52b2f7e21e17b3208d04f79b61cb2
SHA512 52be0f0efbfa1a272a33180b76ebaade2068ece6e004684883f05c2b0b5ef324833694e76b950b7e222f3d93f93a28d9451dc9a8101d1bd83be6f3c233af3a97
SSDEEP 96:st4805/f9Ib9pffrZ8i0vhEEkUMm/7qx+WVHMSm+uecpAJ1idQjy+gEWMEB:st4805UfjZ8pa+V/S+Wi7AJwdrCWM8
TLSH
T1E8D197035E387D778CCBE219BA35BB56D2FA506265D50E58EFFC852C08E66DC220790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\dev.ascpixi.splicedd\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\dev.ascpixi.splicedd\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

dda64630-864f-45a4-9f1c-9e2803b87dac.tmp

Path C:\Users\Admin\AppData\Local\dev.ascpixi.splicedd\EBWebView\Default\dda64630-864f-45a4-9f1c-9e2803b87dac.tmp
Size 6KB
SHA256 74ebe31093ae61e23ef99045eedc3dd34d2f447e98e909606ec2555bd688fe9f
MD5 15614cbedd73d1b77999a0d59bf2033f
SHA1 34ca2290327d93c225bdea17870f57e3078eda46
SHA512 171c09189f86ce8ca0ca0e41cb4eaa0348ea3eb5135df93bad515ae31d0e05eef1fd0ff3b6cb235737f56f916445ab8fdac79ed322a53a212cb7c55b576c4bea
SSDEEP 96:st4805/f9Ib9zffrZ8i0vhEEkUMm/7qx+WVHMSm+uecpAJ1idQjy+gpWMOB:st4805mfjZ8pa+V/S+Wi7AJwdrjWMC
TLSH
T163D1A8025E387D778CCBF619BA35BF56E2FA502255D50E58EBFC862C05E66CD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\dev.ascpixi.splicedd\EBWebView\Local State
Size 1KB
SHA256 067719b6df9dc2bad95efb5d7275d870ef4daf8c6a120ced0d605b7c694c0694
MD5 db7d6ba19f66db5e3b6a48fe45203c46
SHA1 9caae8bf7f74a69d45de929036837e3ff2aec207
SHA512 2c1ac0d746168ae0d94ffddc83f330e4816e04436d923d210accd0f381cca7b2415dead7b73cab92b675da74524a2d3dba4a898f64fe5a80cc38f18850d5ebfc
TLSH
T163214273D0A02F76A9C58A14F526BF835E14907ED1588A0CE9EC063C139BAC85262C32
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.fingerprint

Path C:\Users\Admin\AppData\Local\dev.ascpixi.splicedd\EBWebView\OriginTrials\0.0.1.7\manifest.fingerprint
Size 66B
SHA256 946f3a9e019b0d80f5671de782f295132341f663f74aebad7628f22e528d6d52
MD5 3fb5233616491df0ec229ba9f42efdb8
SHA1 18a8116e2df9805accd7901d2321c3fa92da1af4
SHA512 e9b17ac626bf6508db9a686825411e90d316a0f1dacbf63dbec5baaaf6b96af4dbc9a7332975b6d5c16c43757d79fddca6b888ea97bc07a8dffb1b3a06366b4d
TLSH
T1F8A022A0C302202228A00E0A82E20223200EA80CE880002328AC8E2A080833B00A8200
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\dev.ascpixi.splicedd\EBWebView\OriginTrials\0.0.1.7\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\dev.ascpixi.splicedd\EBWebView\Speech Recognition\1.15.0.1\manifest.json
Size 76B
SHA256 0d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11
MD5 ba25fcf816a017558d3434583e9746b8
SHA1 be05c87f7adf6b21273a4e94b3592618b6a4a624
SHA512 3763bd77675221e323faa5502023dc677c08911a673db038e4108a2d4d71b1a6c0727a65128898bb5dfab275e399f4b7ed19ca2194a8a286e8f9171b3536546f
TLSH
T170A022833A0EC03B008283B0202383C08BBCAA28380E080E082338C0CAC2BB80000B28
MD5 SHA1 SHA512 TLSH

Submit Download

b679b1bb-e527-4dc1-ba27-8ca8080a5b76.tmp

Path C:\Users\Admin\AppData\Local\dev.ascpixi.splicedd\EBWebView\b679b1bb-e527-4dc1-ba27-8ca8080a5b76.tmp
Size 2KB
SHA256 6bcd2e93d42fc24d529e005574d70c80083690cde1b4201875dab8b3c3c5f418
MD5 739a93e696209e131f85f376ea347161
SHA1 9fc38e0087384d264502243304cc68073537c100
SHA512 ed87126a3916797b7a84477abeba845e64dc706b1e8d900432d00dc7cc4972f63990dfd148f77c5aad1208f2908811054dbd8952d2d1401f3185df0977bc7c76
TLSH
T16751B633A8246E77C9D28A04BD0A7F43DA3A906A95551F54DDEC0B2C01DB6CC2342C36
MD5 SHA1 SHA512 TLSH

Submit Download

e1d10374-7e2f-4e85-ab77-0688debdc020.tmp

Path C:\Users\Admin\AppData\Local\dev.ascpixi.splicedd\EBWebView\e1d10374-7e2f-4e85-ab77-0688debdc020.tmp
Size 3KB
SHA256 66809c88e7ef324910ab78ef31ce5286a7724fc60fe86b12cf3ef61ad1ad3082
MD5 a5b935910076e0052ab09cac55f0a776
SHA1 5cb882733aa9bc075421312fc6decb11ec36d4e3
SHA512 7e90886756df44068d636989cce698e4d0e934d8fe3f86a163cd0d156d45051dd6ca762fad3c865944d51ad7aa0bf1ecf1229e252e45383a6a82deb7359e1f7c
TLSH
T15A717522A474AA778DE2DA04BD853F42F766912BE4957F98D9EC0F1C02DB3C82381C17
MD5 SHA1 SHA512 TLSH

Submit Download

e590a39.msi

Path C:\Windows\Installer\e590a39.msi
Size 4.3MB
SHA256 8b54ab75c1c9d5f8e23940e277420b9fdeee927e8db034dfa88b446df7f43f88
MD5 2eff0d03509d361c810b777c45351a6f
SHA1 769842fe06ffabe8da02a5408a8d16e71f724f34
SHA512 ad10f682f9a4763989a2324b186569b8d5c36ef8ca81afab389b75ad599c9b410c3a817c7d4bdc10e6fdef6bf125b3e917ac6c1a1037266a4b77d94ba0747a2c
SSDEEP 98304:m4oDim7+wdpWz2nKJvoO5lFScNWgBbfl5/GHZAYytE3FQjZ8v8m:rud7+OQ0OdqgBjl5/GHZApt4Sl
TLSH
T1212622137E809536E9AA3CB2D9FAD370BA3CBD281A54C7475380766EDDF00C05A716DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.1MB
SHA256 61615eb663f107d410442389023ac545b81c7a42fca5749609a5d146c139c2a9
MD5 1a1feb5a0effc62ac9621bc89399d834
SHA1 1b8917ca4cc4a07df88f5216cb667c6a0b8e407d
SHA512 733b1f91453cc670ea0399ee6b578b175def3c2f13cdf80cb2ea2efad25bb74a6bde91074ad4ebff179852bd3fdde64b9fbc17e7256b447524447b165a0f1b1a
SSDEEP 24576:Du8m+1zBdoO/vvTLb2KePmKObjEjyFay2MG9YlbVy067OdDnYvFDi8BB/:5
TLSH
T10947D52836F92100E7F7DE3CA8F06A2389797D5B9C159E8D05851F4E0921BB1E872F5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{3d38706d-e1e6-4f03-8272-eb2d38f1d37c}_OnDiskSnapshotProp

Path \??\Volume{82411472-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{3d38706d-e1e6-4f03-8272-eb2d38f1d37c}_OnDiskSnapshotProp
Size 6KB
SHA256 8c9c1154c44a86973e85261f42dca623d8963fcbfc17dbfaa997a780579c8e8a
MD5 391cff26dc29807bb63774c992ee3a2c
SHA1 80b2096e65692625f00357b126513fad90ff2936
SHA512 c58c8cf400e28f661e19ac8f24f7a87336ae153f5d9cf5bf4d96a1dd91065635373647608c77d1d9f73fc4d7e51ae3051dce65291946c2e54671b4a827fbe944
SSDEEP 96:FplH2mv4uYvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:RHOb++ZVmN
TLSH
T16AD1881C5AE54711E2B3AB7228F14557A877B811EF33CB8E0298638E6671A10F835F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/992-72-0x00007FFB61460000-0x00007FFB61461000-memory.dmp

Download

memory/2676-198-0x00007FFB61460000-0x00007FFB61461000-memory.dmp

Download

memory/4996-100-0x00007FFB60B00000-0x00007FFB60B01000-memory.dmp

Download

memory/4996-99-0x00007FFB61460000-0x00007FFB61461000-memory.dmp

Download