8b54ab75c1c9d5f8e23940e277420b9fdeee927e8db034dfa88b446df7f43f88

Analysis

max time kernel
150s
max time network
156s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 00:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
splicedd_1.1.1_x64_en-US.msi
Size 4.3MB
Sample261027-bbef3azyh1
SHA256 8b54ab75c1c9d5f8e23940e277420b9fdeee927e8db034dfa88b446df7f43f88
MD5 2eff0d03509d361c810b777c45351a6f
SHA1 769842fe06ffabe8da02a5408a8d16e71f724f34
SHA512 ad10f682f9a4763989a2324b186569b8d5c36ef8ca81afab389b75ad599c9b410c3a817c7d4bdc10e6fdef6bf125b3e917ac6c1a1037266a4b77d94ba0747a2c
SSDEEP 98304:m4oDim7+wdpWz2nKJvoO5lFScNWgBbfl5/GHZAYytE3FQjZ8v8m:rud7+OQ0OdqgBjl5/GHZApt4Sl
TLSH
T1212622137E809536E9AA3CB2D9FAD370BA3CBD281A54C7475380766EDDF00C05A716DA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence privilege_escalation ransomware trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5848	splicedd.exe

Loads dropped DLL 2 IoCs

pid	Process
2864	MsiExec.exe
2864	MsiExec.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	splicedd.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\splicedd\Uninstall splicedd.lnk	msiexec.exe
File created	C:\Program Files\splicedd\splicedd.exe	msiexec.exe

Drops file in Windows directory 27 IoCs

description	ioc	Process
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFB368096075B917C3.TMP	msiexec.exe
File created	C:\Windows\Installer\{929F3FC0-AEC1-4C96-A829-5092BB37DC40}\ProductIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\{929F3FC0-AEC1-4C96-A829-5092BB37DC40}\ProductIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\e5a136a.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{929F3FC0-AEC1-4C96-A829-5092BB37DC40}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI181D.tmp	msiexec.exe
File created	C:\Windows\Installer\e5a136c.msi	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4948_2119038238\male_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4948_2119038238\ranked_dicts	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4948_2119038238\us_tv_and_film.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4948_2119038238\manifest.fingerprint	msedgewebview2.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\SystemTemp\~DF77FA6DA569BF9FF8.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4948_2119038238\english_wikipedia.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4948_2119038238\passwords.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4948_2119038238\female_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4948_2119038238\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4948_2119038238\model.markov	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4948_2119038238\surnames.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4948_2119038238\test.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4948_1700460491\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4948_1700460491\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\~DF2A91B38613115EA7.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF19707BD1E0F4557F.TMP	msiexec.exe
File created	C:\Windows\Installer\e5a136a.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
4164	msiexec.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	splicedd.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	splicedd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000000b9902af51b2dc4c0000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c01200000000000000000000000027010100008838010b9902af0000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e841010b9902af000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e30b9902af00000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e60b9902af00000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 26 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0CF3F9291CEA69C48A920529BB73CD04\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0CF3F9291CEA69C48A920529BB73CD04\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0CF3F9291CEA69C48A920529BB73CD04\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\0CF3F9291CEA69C48A920529BB73CD04\Environment = "MainProgram"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0CF3F9291CEA69C48A920529BB73CD04\Language = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0CF3F9291CEA69C48A920529BB73CD04\Version = "16842753"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0CF3F9291CEA69C48A920529BB73CD04\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0CF3F9291CEA69C48A920529BB73CD04\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0CF3F9291CEA69C48A920529BB73CD04\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0CF3F9291CEA69C48A920529BB73CD04\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0CF3F9291CEA69C48A920529BB73CD04\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0CF3F9291CEA69C48A920529BB73CD04\ProductIcon = "C:\\Windows\\Installer\\{929F3FC0-AEC1-4C96-A829-5092BB37DC40}\\ProductIcon"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\0CF3F9291CEA69C48A920529BB73CD04	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\0CF3F9291CEA69C48A920529BB73CD04\ShortcutsFeature = "MainProgram"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\0CF3F9291CEA69C48A920529BB73CD04\External	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0CF3F9291CEA69C48A920529BB73CD04	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0CF3F9291CEA69C48A920529BB73CD04\ProductName = "splicedd"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\FDFBC7553941CD459B698C6EF525F828\0CF3F9291CEA69C48A920529BB73CD04	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0CF3F9291CEA69C48A920529BB73CD04\SourceList\PackageName = "splicedd_1.1.1_x64_en-US.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\0CF3F9291CEA69C48A920529BB73CD04\MainProgram	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0CF3F9291CEA69C48A920529BB73CD04\PackageCode = "D5DEAA65702085749BFF3DF98F81DC87"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\FDFBC7553941CD459B698C6EF525F828	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0CF3F9291CEA69C48A920529BB73CD04\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0CF3F9291CEA69C48A920529BB73CD04\SourceList\Media\1 = ";"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0CF3F9291CEA69C48A920529BB73CD04\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0CF3F9291CEA69C48A920529BB73CD04\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1420	msiexec.exe
1420	msiexec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
4948	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4164	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4164	msiexec.exe
Token: SeSecurityPrivilege	1420	msiexec.exe
Token: SeCreateTokenPrivilege	4164	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4164	msiexec.exe
Token: SeLockMemoryPrivilege	4164	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4164	msiexec.exe
Token: SeMachineAccountPrivilege	4164	msiexec.exe
Token: SeTcbPrivilege	4164	msiexec.exe
Token: SeSecurityPrivilege	4164	msiexec.exe
Token: SeTakeOwnershipPrivilege	4164	msiexec.exe
Token: SeLoadDriverPrivilege	4164	msiexec.exe
Token: SeSystemProfilePrivilege	4164	msiexec.exe
Token: SeSystemtimePrivilege	4164	msiexec.exe
Token: SeProfSingleProcessPrivilege	4164	msiexec.exe
Token: SeIncBasePriorityPrivilege	4164	msiexec.exe
Token: SeCreatePagefilePrivilege	4164	msiexec.exe
Token: SeCreatePermanentPrivilege	4164	msiexec.exe
Token: SeBackupPrivilege	4164	msiexec.exe
Token: SeRestorePrivilege	4164	msiexec.exe
Token: SeShutdownPrivilege	4164	msiexec.exe
Token: SeDebugPrivilege	4164	msiexec.exe
Token: SeAuditPrivilege	4164	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4164	msiexec.exe
Token: SeChangeNotifyPrivilege	4164	msiexec.exe
Token: SeRemoteShutdownPrivilege	4164	msiexec.exe
Token: SeUndockPrivilege	4164	msiexec.exe
Token: SeSyncAgentPrivilege	4164	msiexec.exe
Token: SeEnableDelegationPrivilege	4164	msiexec.exe
Token: SeManageVolumePrivilege	4164	msiexec.exe
Token: SeImpersonatePrivilege	4164	msiexec.exe
Token: SeCreateGlobalPrivilege	4164	msiexec.exe
Token: SeCreateTokenPrivilege	4164	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4164	msiexec.exe
Token: SeLockMemoryPrivilege	4164	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4164	msiexec.exe
Token: SeMachineAccountPrivilege	4164	msiexec.exe
Token: SeTcbPrivilege	4164	msiexec.exe
Token: SeSecurityPrivilege	4164	msiexec.exe
Token: SeTakeOwnershipPrivilege	4164	msiexec.exe
Token: SeLoadDriverPrivilege	4164	msiexec.exe
Token: SeSystemProfilePrivilege	4164	msiexec.exe
Token: SeSystemtimePrivilege	4164	msiexec.exe
Token: SeProfSingleProcessPrivilege	4164	msiexec.exe
Token: SeIncBasePriorityPrivilege	4164	msiexec.exe
Token: SeCreatePagefilePrivilege	4164	msiexec.exe
Token: SeCreatePermanentPrivilege	4164	msiexec.exe
Token: SeBackupPrivilege	4164	msiexec.exe
Token: SeRestorePrivilege	4164	msiexec.exe
Token: SeShutdownPrivilege	4164	msiexec.exe
Token: SeDebugPrivilege	4164	msiexec.exe
Token: SeAuditPrivilege	4164	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4164	msiexec.exe
Token: SeChangeNotifyPrivilege	4164	msiexec.exe
Token: SeRemoteShutdownPrivilege	4164	msiexec.exe
Token: SeUndockPrivilege	4164	msiexec.exe
Token: SeSyncAgentPrivilege	4164	msiexec.exe
Token: SeEnableDelegationPrivilege	4164	msiexec.exe
Token: SeManageVolumePrivilege	4164	msiexec.exe
Token: SeImpersonatePrivilege	4164	msiexec.exe
Token: SeCreateGlobalPrivilege	4164	msiexec.exe
Token: SeCreateTokenPrivilege	4164	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4164	msiexec.exe
Token: SeLockMemoryPrivilege	4164	msiexec.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4164	msiexec.exe
4164	msiexec.exe
5848	splicedd.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4164	msiexec.exe
1420	msiexec.exe
2864	MsiExec.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1420 wrote to memory of 2864	1420	msiexec.exe	90
PID 1420 wrote to memory of 4388	1420	msiexec.exe	96
PID 2864 wrote to memory of 5848	2864	MsiExec.exe	99
PID 5848 wrote to memory of 4948	5848	splicedd.exe	100
PID 4948 wrote to memory of 988	4948	msedgewebview2.exe	101
PID 4948 wrote to memory of 2540	4948	msedgewebview2.exe	102
PID 4948 wrote to memory of 2540	4948	msedgewebview2.exe	102
PID 4948 wrote to memory of 2540	4948	msedgewebview2.exe	102
PID 4948 wrote to memory of 2540	4948	msedgewebview2.exe	102
PID 4948 wrote to memory of 4784	4948	msedgewebview2.exe	103
PID 4948 wrote to memory of 4092	4948	msedgewebview2.exe	104
PID 4948 wrote to memory of 4092	4948	msedgewebview2.exe	104
PID 4948 wrote to memory of 4092	4948	msedgewebview2.exe	104
PID 4948 wrote to memory of 5340	4948	msedgewebview2.exe	105
PID 4948 wrote to memory of 5340	4948	msedgewebview2.exe	105
PID 4948 wrote to memory of 5340	4948	msedgewebview2.exe	105
PID 4948 wrote to memory of 5340	4948	msedgewebview2.exe	105
PID 4948 wrote to memory of 5340	4948	msedgewebview2.exe	105
PID 4948 wrote to memory of 4104	4948	msedgewebview2.exe	108
PID 4948 wrote to memory of 4104	4948	msedgewebview2.exe	108
PID 4948 wrote to memory of 4104	4948	msedgewebview2.exe	108
PID 4948 wrote to memory of 1112	4948	msedgewebview2.exe	109
PID 4948 wrote to memory of 1112	4948	msedgewebview2.exe	109
PID 4948 wrote to memory of 1112	4948	msedgewebview2.exe	109

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\splicedd_1.1.1_x64_en-US.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4164

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1420
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 1EC82684B6E84DBD055F855484892C5A C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2864
- - C:\Program Files\splicedd\splicedd.exe
    "C:\Program Files\splicedd\splicedd.exe"
    3⤵
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5848
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=splicedd.exe --webview-exe-version=1.1.1 --user-data-dir="C:\Users\Admin\AppData\Local\dev.ascpixi.splicedd\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=5848.3880.16912991849193051300 /pfhostedapp:a52457f5dc10e87b9f16c00c8ccb22ab0e7f7488
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of WriteProcessMemory
      PID:4948
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\dev.ascpixi.splicedd\EBWebView /prefetch:4 /pfhostedapp:a52457f5dc10e87b9f16c00c8ccb22ab0e7f7488 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\dev.ascpixi.splicedd\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffc45835fd8,0x7ffc45835fe4,0x7ffc45835ff0
        5⤵
        
        PID:988
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dev.ascpixi.splicedd\EBWebView" --webview-exe-name=splicedd.exe --webview-exe-version=1.1.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1760 --field-trial-handle=1780,i,13979719834308746405,9648615613322749131,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:a52457f5dc10e87b9f16c00c8ccb22ab0e7f7488
        5⤵
        
        PID:2540
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dev.ascpixi.splicedd\EBWebView" --webview-exe-name=splicedd.exe --webview-exe-version=1.1.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2248 --field-trial-handle=1780,i,13979719834308746405,9648615613322749131,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:a52457f5dc10e87b9f16c00c8ccb22ab0e7f7488
        5⤵
        
        PID:4784
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dev.ascpixi.splicedd\EBWebView" --webview-exe-name=splicedd.exe --webview-exe-version=1.1.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2308 --field-trial-handle=1780,i,13979719834308746405,9648615613322749131,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:a52457f5dc10e87b9f16c00c8ccb22ab0e7f7488
        5⤵
        
        PID:4092
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dev.ascpixi.splicedd\EBWebView" --webview-exe-name=splicedd.exe --webview-exe-version=1.1.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3528 --field-trial-handle=1780,i,13979719834308746405,9648615613322749131,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:a52457f5dc10e87b9f16c00c8ccb22ab0e7f7488 /prefetch:1
        5⤵
        
        PID:5340
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dev.ascpixi.splicedd\EBWebView" --webview-exe-name=splicedd.exe --webview-exe-version=1.1.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4468 --field-trial-handle=1780,i,13979719834308746405,9648615613322749131,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:a52457f5dc10e87b9f16c00c8ccb22ab0e7f7488
        5⤵
        
        PID:4104
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dev.ascpixi.splicedd\EBWebView" --webview-exe-name=splicedd.exe --webview-exe-version=1.1.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4460 --field-trial-handle=1780,i,13979719834308746405,9648615613322749131,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:a52457f5dc10e87b9f16c00c8ccb22ab0e7f7488
        5⤵
        
        PID:1112
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4388

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:3760

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5a136b.rbs

Path C:\Config.Msi\e5a136b.rbs
Size 9KB
SHA256 532036a4f38ef92104b73ef9b0496a035a43ca20e2532e303176209f4c7f67d0
MD5 4e472de5113a837c5eea621eacc1aaaa
SHA1 05b07420c716fe92f8794be16b91f13e843be010
SHA512 50c676f0faf16e8d18196840e27b5fbd03bfdb84202142eb2b36c780c98e81ae3cd6294cb349059fb372191600523e843f820d6667db5b8cdcf3b7ce30238458
SSDEEP 192:Gy9SXRnCDDlOWXGxWXA+kV6xRi7MIRKaR3aWR9imyrvCupph041R2veA1:Gy9SXRfWAWlW
TLSH
T166221F01BB4082F6FE921736C65757213BE2D2999314674F15CDA5288F43B88AE6A3CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

splicedd.exe

Path C:\Program Files\splicedd\splicedd.exe
Size 9.3MB
SHA256 7d50d76bdba659ab35031ac39dc93be4de16f061ee66272686b0cf6d0732e232
MD5 bd6f20a1df45f55cb02931b7e36d407e
SHA1 17a292f57fa1f0bb01faa48dcb8de2cf820d832c
SHA512 f9d35e251347565306135d9254a7b74527f2ffeb94f6d3236cc09d367102adfa37a98fe60d2c31679d0567379359da6eace35da03e1b919124d0ab3aa1516f1d
SSDEEP 98304:R1IjS4LepGjmbwB31Ybi/VSvWPFM9fIGe+9jlHSjLvT:FpG8itSCFMJIW9Bi
TLSH
T155A62A257B5A99ADC05AC07082464B725A317CCB0B35BAFF4494B6783F7AAF41F3C258
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

splicedd.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\splicedd\splicedd.lnk
Size 1KB
SHA256 5bf733e1973116a56a50110710b03ab866fbe85c04677032335a316506e3d8ab
MD5 274a8b65512043c501418e5a2d9141af
SHA1 e039d5e67278e9b9d233f694680bee82bba6a88c
SHA512 ee384baa0f2f33a9473c936e6a8e87666c9bf9064f1354173ec7c7db9d858254ecc0f17e7b7bc02c363edb701afb333bd5132dafcadcf9671b05713400799555
TLSH
T1BF4172141BE40B2DF375877E3DB246218E36F811F6688F6E42C441821CA5764E97DFBA
MD5 SHA1 SHA512 TLSH

Submit Download

~plicedd.tmp

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\splicedd\~plicedd.tmp
Size 1KB
SHA256 725e4a1fe2f9bb4d4f604139c9a42816f037695809c1c6ab140381182e9cd32f
MD5 8feab9d676069200a6e6b7c97d5338f7
SHA1 c17a03d10d0bb25780f7943807910904eddc8688
SHA512 a3aa6154f8ab5a47940fcb43abd67d5c1c82c5b9c59bd9da52af53254772f4c6261da8dba46d8fd7c81eb12539a110efdc6994be78a9f5de2c654d4ac8a2c0e6
TLSH
T14E41D3141BD01B2DF375877E3DB246214D36F811F6688F6E42C441821CA5750E9BCFBA
MD5 SHA1 SHA512 TLSH

Submit Download

MSI1ED5.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI1ED5.tmp
Size 234KB
SHA256 78860e15e474cc2af7ad6e499a8971b6b8197afb8e49a1b9eaaa392e4378f3a5
MD5 8edc1557e9fc7f25f89ad384d01bcec4
SHA1 98e64d7f92b8254fe3f258e3238b9e0f033b5a9c
SHA512 d26c9dce3c3d17583ffb5dbcd3989f93b096a7f64a37a2701a474c1bf4b8c8b1e922c352d33f24e411f1c793e1b4af11a3aec1de489087d481b1b636df2050cd
SSDEEP 3072:5XiqyhTO8W0iEa8LW0bEC9hvZpC01v+eUKflQnZl+T+J7g6EsNr7wyy/IP3:5qhy8VKU3hvZUy+ppHEsuB/
TLSH
T159348D217494547EEBFF0832953AD671AE3DF2380B90C96EC384581E6D618C1A7B7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIB869.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSIB869.tmp
Size 132KB
SHA256 7f47d98ab25cfea9b3a2e898c3376cc9ba1cd893b4948b0c27caa530fd0e34cc
MD5 cfbb8568bd3711a97e6124c56fcfa8d9
SHA1 d7a098ae58bdd5e93a3c1b04b3d69a14234d5e57
SHA512 860cbf3286ac4915580cefaf56a9c3d48938eb08e3f31b7f024c4339c037d7c8bdf16e766d08106505ba535be4922a87dc46bd029aae99a64ea2fc02cf3aec04
SSDEEP 3072:Kx2YbpcgwmiTPJDnCO+DATkURBnrskNwPj2:XXgwmY1CPx2XG2
TLSH
T1DBD39D02B5D0C473D9BE09390870DB229F7EB930DF909EDB636856699E702C19E35A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

11959c0c-eedb-460e-952c-d2e73cfca7e7.tmp

Path C:\Users\Admin\AppData\Local\dev.ascpixi.splicedd\EBWebView\11959c0c-eedb-460e-952c-d2e73cfca7e7.tmp
Size 2KB
SHA256 a7fe2e4c13520245e975f4f287864ef8db38abb13f262da19d1f8047e0e4ed75
MD5 34ee621dd7a3a1c7af96ce0dfa12e8c2
SHA1 34ff178f4b45b780d7b5df08b837d1ff85f40e5f
SHA512 6d7e5afe769faf657ec298153b3565bfa5b65b4f99e4612c0bdb7a7f7faf9a3914875f0c7fce0676e7896e08ab9c61799d1145615b3d3dd610270d25fbec6b61
TLSH
T122515173A9246F32DAE68B48B94A3B63CE39D165AE612F21CDDD0B1C01D719D2342C27
MD5 SHA1 SHA512 TLSH

Submit Download

15588ca0-4306-4854-b4c2-5058a05f70cf.tmp

Path C:\Users\Admin\AppData\Local\dev.ascpixi.splicedd\EBWebView\15588ca0-4306-4854-b4c2-5058a05f70cf.tmp
Size 3KB
SHA256 8429991b95b7e9cffcf89543ac1bae15714ffe76895e6e31de0fc6ac7ce26f2f
MD5 a2a0077e461ce34a363db8b337e19f53
SHA1 1b9f0fd572b8101a10710b9bfb7ed7fe9b8da002
SHA512 3a219a2e0be9f7c746e8e8f101540980dd38b2d0ade78cd0d47239b14495bfdcd14d7b144ac2cd312b62619d91e719d4aa3c74a8d7d737114303557ea18ae2fb
TLSH
T1056175776974AA378EE6CB05B9863B12EA65D127F9953F65C9EC0F0C01D72882342C17
MD5 SHA1 SHA512 TLSH

Submit Download

619b795f-793a-4af0-abbf-af8f4b9a26db.tmp

Path C:\Users\Admin\AppData\Local\dev.ascpixi.splicedd\EBWebView\619b795f-793a-4af0-abbf-af8f4b9a26db.tmp
Size 15KB
SHA256 65beefb12ee50b957063a3dbb04c2a9fe98599ccc43f5898814840e984639ff2
MD5 b9c72e73574efbe33ddda9e860cfbc34
SHA1 6a59aceda7b01992352fd8506b0eedb559839ab5
SHA512 01e153dfe8fb90927ebd02c3553c98b341cc8cab27f96f6343aedcb51a49ae38a5b63ce9aca7129009846319b37b892c9a03effe5d3ed4634bdeb40e1c54bb5e
SSDEEP 384:3+OBqImmJvGBLx3NaFMJFNNBSxfYBSrXdg6rZ:GcvGtlNIgaXn9
TLSH
T18872AE7729756E636CEBCA09BE897747CB64A293C4D47BE4DCEC9F0F112B0841352805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\dev.ascpixi.splicedd\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 3e38c2122b40f2fe35d32c9d715734808c300b045cac4892eed57bbe622dbdc6
MD5 1c0301b2afbcf8b9c581c26acdac0c6d
SHA1 a7ff8fa86eaedf14d60dd8dc01f9b76309f072dc
SHA512 c0c58b9b894341878786c014b97fab29a97c31619fe9e761d3b72206259b8b67943c2ef598f5e1c2feaa2e3b38237e5f17e9a03e2fcc73b275f766501f5b9115
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\dev.ascpixi.splicedd\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 009c32d0e0827d3d83a92ebf46e5064c3d056f8982d785465fc4d80b099e9918
MD5 f1fa9997dac650bf19f4d9c920a0755d
SHA1 e26789ebd827d3b6894bd9b1040e578c6b7100fc
SHA512 2b63dc7498b9e9a5df981286ebdecf8188ba75578db2aec1c2c138fdd476693b03038d70fa175e9dfbc90b74db49f3b5185662c8ea4210785337a740fc2ccbd9
TLSH
T10DD01223F3414138C42061330013F5480540C60B440641045838AA1E3A080500D02462
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\dev.ascpixi.splicedd\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

78e358a5-13d1-4b77-b831-a4d3c0c60f41.tmp

Path C:\Users\Admin\AppData\Local\dev.ascpixi.splicedd\EBWebView\Default\78e358a5-13d1-4b77-b831-a4d3c0c60f41.tmp
Size 6KB
SHA256 0bcf13a885943b5b29b98226de6fff7140a8dc18c231a98738a4836923470405
MD5 060379b20af01f0be28017988b0dd4ca
SHA1 a36a99c464dcb998b50ba6d4c4f8080205e7a64b
SHA512 cc16fc6f6bdcba2f1cd32ed2daead032f648ea9cdbb17e6e836615d4ffd7bb6d01b6b533030f3da14315729ed178ea1d4539707fd27ebd5fe26af7417255de78
SSDEEP 96:st2/dRapMb9Wkao5h16ZPus7/x+6MhmuecpqZS1ejeyK+gFc28XM1C7K:stuL+to+usV+FNqIQj6sG6K
TLSH
T16CD196025E246D7B8CCAE608FA357A56E2F9A03275D51D58EBFC462C14D66DC630780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\dev.ascpixi.splicedd\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 72B
SHA256 3d7be74c379373a80285234683403d67e9737c62265925356fe04b6b38502e72
MD5 ccde84c2c224e663a0724a82cad9d05f
SHA1 f7ee04170177377b7744620354adca47644edb13
SHA512 7afb6a4a9ad58fff98f494a228664308161dac939c8f308a39afdcbc59c025c5f652859dc6cb56a9b94ea6fdd40e0d98f241d03270a3221137287aec275269ec
TLSH
T17CA0021816C41443C195C77161C282507376C9101207471591E11574A8D4BC45501450
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\dev.ascpixi.splicedd\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 4b8d10a53a67cf0512ab895ff454c9824ab41c8335a34f9d41445c000c6c151d
MD5 c64d165476fef58d548f140ccc6b7440
SHA1 a95a5a25937f9befe32b1d73adc2632be573d2e5
SHA512 57c20565256c8bd6f02b7cbe09e79ed675bfc598533e7e1a1d8e449ab1e55069ee8ecae67ad913846bd6fefb1312946b3e90220f9f1522940f48aa1d72c33955
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\dev.ascpixi.splicedd\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\dev.ascpixi.splicedd\EBWebView\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\dev.ascpixi.splicedd\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

cf8ec6f4-7298-4713-8bf6-d43444b1b76a.tmp

Path C:\Users\Admin\AppData\Local\dev.ascpixi.splicedd\EBWebView\Default\Network\cf8ec6f4-7298-4713-8bf6-d43444b1b76a.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\dev.ascpixi.splicedd\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\dev.ascpixi.splicedd\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\dev.ascpixi.splicedd\EBWebView\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\dev.ascpixi.splicedd\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\dev.ascpixi.splicedd\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\dev.ascpixi.splicedd\EBWebView\Local State
Size 1KB
SHA256 6977435fa11c549702109e196b17db0f5cb2d684a8ba35246f62093da66c1d94
MD5 3e455f749a203a4adac9dfa1d5d379ad
SHA1 92ca70e73b5c09964eed9f6d73d50f387e276274
SHA512 a270555668b4e42cb23cfe833d8086a97117f9d0b5355cd03d54022088f9637ab4d35ab7011eab31123c047af4b73bc54ed73321b219cfd38a5dcf6f4dbc4121
TLSH
T19A2195F3E5702F32EDC1934A35567BA39D20C07AAA604E0088DD4B0C12F308DA656C32
MD5 SHA1 SHA512 TLSH

Submit Download

e5a136c.msi

Path C:\Windows\Installer\e5a136c.msi
Size 4.3MB
SHA256 8b54ab75c1c9d5f8e23940e277420b9fdeee927e8db034dfa88b446df7f43f88
MD5 2eff0d03509d361c810b777c45351a6f
SHA1 769842fe06ffabe8da02a5408a8d16e71f724f34
SHA512 ad10f682f9a4763989a2324b186569b8d5c36ef8ca81afab389b75ad599c9b410c3a817c7d4bdc10e6fdef6bf125b3e917ac6c1a1037266a4b77d94ba0747a2c
SSDEEP 98304:m4oDim7+wdpWz2nKJvoO5lFScNWgBbfl5/GHZAYytE3FQjZ8v8m:rud7+OQ0OdqgBjl5/GHZApt4Sl
TLSH
T1212622137E809536E9AA3CB2D9FAD370BA3CBD281A54C7475380766EDDF00C05A716DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4948_1700460491\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4948_2119038238\manifest.json
Size 69B
SHA256 c0622dadf4ec10ce5f4a64e3f24956b750345dcc194d0bd3ff73cfce1bf6081e
MD5 fb0d9796a86299d3689982f7a949dc6e
SHA1 6179cd612ac0dcc44d0659c7c99d1e0aecbf206e
SHA512 e3e1a18be661da9d450a30a37d24dc08dc8de628a104ce0f4197214ce6f27a2bf9de3eca1c1697fcfa3c601787ca7a6b5e30a5fe3d6ae3b2c10f1ab34af22fd0
TLSH
T141A022200C2088FFF200E3CC0020E380CF28A300A2088C0A022220002280CB80200320
MD5 SHA1 SHA512 TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 9bad3f0b59400ff5f4af9d8dbcdc571f2012967ad3a88f9a1b8b3ca25fd30f62
MD5 edc5d958b35e9957b2c1d832cea3a499
SHA1 4ef4734c6fbc4a9e1cea048f9f4cadb42258e2e8
SHA512 806d2e9be6b5c537b8ec8683978f0b326a84b38e60e60caf9b81b3b534a044d280a09d845784f692fc677a53f7638b6db1f44ebffe64f4f8f81e8e29668a2153
SSDEEP 24576:oFo3DMPUdoO/vvTL/iQNtS1wv7u3WLqO0AbvtwTFbIDqZK8t8YxG9EXc5+1:JHQ
TLSH
T1CE57B22836F92250E7F79E3CA8F06A63493A7D5B9C15DE8D05411B4E0822F71E872F67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{69c13aa2-1dd8-482c-9cf0-ae4c722e94aa}_OnDiskSnapshotProp

Path \??\Volume{af02990b-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{69c13aa2-1dd8-482c-9cf0-ae4c722e94aa}_OnDiskSnapshotProp
Size 6KB
SHA256 a93a3b5c194455f164bd08c20d33b32ea205a1063be4c7befe5880e619c01178
MD5 5c63665a7f7eace0994989170a3b9f30
SHA1 92749ce2c1560c8cad1c499951e1efba0f290989
SHA512 aa76090cd000b650e7456514de685716a05672d2aaff832cc2dce91a9b513b626731879bbfe2d5e26fcbdf72332dc0d099084829c0b1bbf0d744df089aed84b2
SSDEEP 96:F8q2wBvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpuN:imb++uVmN
TLSH
T1F4D1891C5AF54711E2B3AB3129F18557A877B911EF33CB8E0198238E2670910F975F5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2540-73-0x00007FFC690D0000-0x00007FFC690D1000-memory.dmp

Download

memory/2540-245-0x0000023A3C860000-0x0000023A3C908000-memory.dmp

Download

memory/4104-302-0x00007FFC68900000-0x00007FFC68901000-memory.dmp

Download

memory/4104-301-0x00007FFC686F0000-0x00007FFC686F1000-memory.dmp

Download

memory/5340-158-0x00007FFC690D0000-0x00007FFC690D1000-memory.dmp

Download