693f56b15b47bb4254a1087a29b059132c1711d85d7c6c98f875caf4fd34ae5f

Analysis

user interaction
yes
max time kernel
239s
max time network
239s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
30/10/2026, 14:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Voidstrap.exe
Size 35.6MB
Sample261030-sbhbdset3l
SHA256 693f56b15b47bb4254a1087a29b059132c1711d85d7c6c98f875caf4fd34ae5f
MD5 3136bdd3655d09cce2a67e17ffe33f6a
SHA1 5a0630364ced2f591fef40f1f5cbeee9bc6887fb
SHA512 1b407b2be82fe62e1f3b08ecabf216f3ebc9b709a47578d82b5227e0e3104184cea4b6ee2a567a3477433e822128f73e9b1195c81934edbbccd859fbe3970dfc
SSDEEP 196608:ZvsTpPQAK7xeQgt3+WUqfhgjXZUZRdQQq1UTVfN0iRboGE6ocXqJ2lpBK6gOeuhZ:OsE6qfmf1UTYiRboLJDlrXjQ/qk
TLSH
T11687481163F94719F1FB4B75AA71A2418A76BC16EA21D39E264C606D0FB3B40CE60F73
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery persistence ransomware

Malware Config

Signatures

Downloads MZ/PE file 2 IoCs

flow	pid	Process
302	4720	firefox.exe
91	4844	msedge.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\Control Panel\International\Geo\Nation	windowsdesktop-runtime-10.0.14-win-x64.exe
Key value queried	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\Control Panel\International\Geo\Nation	Voidstrap.exe
Key value queried	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\Control Panel\International\Geo\Nation	Voidstrap.exe
Key value queried	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\Control Panel\International\Geo\Nation	windowsdesktop-runtime-10.0.14-win-x64.exe

Executes dropped EXE 9 IoCs

pid	Process
1904	windowsdesktop-runtime-10.0.14-win-x64.exe
1792	wixstdba.exe
4948	windowsdesktop-runtime-10.0.14-win-x64.exe
4900	windowsdesktop-runtime-10.0.14-win-x64.exe
3204	windowsdesktop-runtime-10.0.14-win-x64.exe
5060	wixstdba.exe
1196	windowsdesktop-runtime-10.0.14-win-x64.exe
5956	Voidstrap.exe
5648	Voidstrap.exe

Loads dropped DLL 64 IoCs

pid	Process
4220	MsiExec.exe
4220	MsiExec.exe
2312	MsiExec.exe
2312	MsiExec.exe
3416	MsiExec.exe
3416	MsiExec.exe
4992	MsiExec.exe
4992	MsiExec.exe
3612	MsiExec.exe
3612	MsiExec.exe
5092	MsiExec.exe
5092	MsiExec.exe
5956	Voidstrap.exe
5956	Voidstrap.exe
5956	Voidstrap.exe
5956	Voidstrap.exe
5956	Voidstrap.exe
5956	Voidstrap.exe
5956	Voidstrap.exe
5956	Voidstrap.exe
5956	Voidstrap.exe
5956	Voidstrap.exe
5956	Voidstrap.exe
5956	Voidstrap.exe
5956	Voidstrap.exe
5956	Voidstrap.exe
5956	Voidstrap.exe
5956	Voidstrap.exe
5956	Voidstrap.exe
5956	Voidstrap.exe
5956	Voidstrap.exe
5956	Voidstrap.exe
5956	Voidstrap.exe
5956	Voidstrap.exe
5956	Voidstrap.exe
5956	Voidstrap.exe
5956	Voidstrap.exe
5956	Voidstrap.exe
5956	Voidstrap.exe
5956	Voidstrap.exe
5956	Voidstrap.exe
5956	Voidstrap.exe
5956	Voidstrap.exe
5956	Voidstrap.exe
5956	Voidstrap.exe
5956	Voidstrap.exe
5956	Voidstrap.exe
5956	Voidstrap.exe
5956	Voidstrap.exe
5956	Voidstrap.exe
5956	Voidstrap.exe
5956	Voidstrap.exe
5956	Voidstrap.exe
5956	Voidstrap.exe
5956	Voidstrap.exe
5956	Voidstrap.exe
5956	Voidstrap.exe
5956	Voidstrap.exe
5956	Voidstrap.exe
5956	Voidstrap.exe
5956	Voidstrap.exe
5956	Voidstrap.exe
5956	Voidstrap.exe
5956	Voidstrap.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{29A18B06-B190-4463-9FFC-BC0D70D80B7C} = "\"C:\\ProgramData\\Package Cache\\{29A18B06-B190-4463-9FFC-BC0D70D80B7C}\\windowsdesktop-runtime-10.0.14-win-x64.exe\" /burn.runonce"	windowsdesktop-runtime-10.0.14-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{29A18B06-B190-4463-9FFC-BC0D70D80B7C} = "\"C:\\ProgramData\\Package Cache\\{29A18B06-B190-4463-9FFC-BC0D70D80B7C}\\windowsdesktop-runtime-10.0.14-win-x64.exe\" /burn.runonce"	windowsdesktop-runtime-10.0.14-win-x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Contacts third-party web service commonly abused for C2 1 TTPs 16 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
295	raw.githubusercontent.com
271	raw.githubusercontent.com
277	camo.githubusercontent.com
280	raw.githubusercontent.com
296	camo.githubusercontent.com
274	camo.githubusercontent.com
276	camo.githubusercontent.com
279	camo.githubusercontent.com
282	camo.githubusercontent.com
283	raw.githubusercontent.com
297	camo.githubusercontent.com
275	camo.githubusercontent.com
278	camo.githubusercontent.com
281	raw.githubusercontent.com
311	raw.githubusercontent.com
272	camo.githubusercontent.com

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\PresentationFramework-SystemXml.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\PresentationFramework.Aero2.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.14\System.Diagnostics.Tools.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.14\System.ServiceProcess.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\tr\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.14\System.Runtime.Serialization.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\ja\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\ko\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.14\System.Security.Cryptography.Encoding.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.14\System.Collections.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.14\System.Net.Http.Json.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.14\System.Runtime.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\PresentationFramework.Luna.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\ja\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\cs\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\pt-BR\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.14\System.AppContext.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\PresentationFramework.Fluent.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\zh-Hant\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.14\System.Core.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.14\System.Data.DataSetExtensions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.14\System.Data.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.14\System.Security.Cryptography.Cng.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.14\clretwrc.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\cs\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\de\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.14\System.Private.CoreLib.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\PresentationFramework.Aero.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\System.Formats.Nrbf.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\cs\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\es\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\zh-Hans\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.14\System.Reflection.Emit.Lightweight.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\pl\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\zh-Hans\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.14\System.Transactions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\zh-Hant\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.14\System.Diagnostics.FileVersionInfo.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.14\System.Net.Mail.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.14\System.Numerics.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\WindowsBase.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\cs\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\fr\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.14\System.Collections.Specialized.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.14\System.Security.Cryptography.Primitives.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.14\System.Net.ServerSentEvents.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\System.Resources.Extensions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\it\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.14\System.ServiceModel.Web.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.14\Microsoft.DiaSymReader.Native.amd64.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\System.IO.Packaging.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\de\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\fr\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\fr\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\ru\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.14\mscorlib.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\System.Windows.Presentation.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.14\Microsoft.Win32.Registry.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\es\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\ko\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\pl\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.14\System.Xml.ReaderWriter.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\.version	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\fr\UIAutomationClient.resources.dll	msiexec.exe

Drops file in Windows directory 42 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI33B4.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3B78.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\e58f10e.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI36E1.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4384_659029224\manifest.json	msedge.exe
File opened for modification	C:\Windows\Installer\e58f102.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3A2F.tmp	msiexec.exe
File created	C:\Windows\Installer\e58f102.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3F52.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1	msiexec.exe
File created	C:\Windows\Installer\e58f109.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFEA2.tmp	msiexec.exe
File created	C:\Windows\Installer\e58f10d.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e58f10e.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI666.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI39B1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3EE4.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{941B1F64-FCD9-4C40-B927-E75F49DD96D8}	msiexec.exe
File created	C:\Windows\Installer\e58f117.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF7F7.tmp	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149\fileCoreHostExe	msiexec.exe
File created	C:\Windows\Installer\SourceHash{3887007B-C74B-4DF7-8155-F3838C013D2C}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI105.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1701.tmp	msiexec.exe
File created	C:\Windows\Installer\e58f113.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e58f113.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{7A1A9C6B-1386-478E-9C35-7242968A5634}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF9CD.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFCAD.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3B5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI19F0.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{64BFC674-D664-480B-AFF2-D47C5531D6D2}	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149\fileCoreHostExe	msiexec.exe
File created	C:\Windows\Installer\e58f108.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e58f109.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFFAC.tmp	msiexec.exe
File created	C:\Windows\Installer\e58f112.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1D8B.tmp	msiexec.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\Downloads\Voidstrap.exe:Zone.Identifier	firefox.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Voidstrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Voidstrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Voidstrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Voidstrap.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.14-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.14-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wixstdba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.14-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.14-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.14-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wixstdba.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4844	msedge.exe

Checks processor information in registry 2 TTPs 28 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 13 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2B	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2C	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2d	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\46F1B1499DCF04C49B727EF594DD698D\SourceList\PackageName = "dotnet-runtime-10.0.14-win-x64.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_80.56.61678_x64\DisplayName = "Microsoft Windows Desktop Runtime - 10.0.14 (x64)"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000_Classes\roblox\ = "URL:Roblox Protocol"	Voidstrap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000_Classes\roblox\URL Protocol	Voidstrap.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B7007883B47C7FD418553F38C810D3C2\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{29A18B06-B190-4463-9FFC-BC0D70D80B7C}\Dependents\{29A18B06-B190-4463-9FFC-BC0D70D80B7C}	windowsdesktop-runtime-10.0.14-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.56.61678_x64\Dependents\{29A18B06-B190-4463-9FFC-BC0D70D80B7C}	windowsdesktop-runtime-10.0.14-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\E722D4588785E715C945C436088B77AA	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-686476835-2493921010-524562731-1000\{ABCF37AD-7902-4D65-BAE0-8E00A2FC4E65}	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A8A84F1AA6E5EFD5BE00C8237B84D6D4\B6C9A1A76831E874C953272469A86543	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x64\Dependents\{29A18B06-B190-4463-9FFC-BC0D70D80B7C}	windowsdesktop-runtime-10.0.14-win-x64.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B7007883B47C7FD418553F38C810D3C2\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\46F1B1499DCF04C49B727EF594DD698D\Provider	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\windowsdesktop_runtime_80.56.61678_x64	windowsdesktop-runtime-10.0.14-win-x64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000_Classes\roblox\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Voidstrap\\Voidstrap.exe\" -player \"%1\""	Voidstrap.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000_Classes\roblox-player\DefaultIcon	Voidstrap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B7007883B47C7FD418553F38C810D3C2\Provider	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\476CFB46466DB084FA2F4DC755136D2D\Language = "1033"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000_Classes\roblox-player\shell\open	Voidstrap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000_Classes\roblox-player\ = "URL:Roblox Protocol"	Voidstrap.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000_Classes\roblox-studio\shell\open\command	Voidstrap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000_Classes\roblox-player\ = "URL:Roblox Protocol"	Voidstrap.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B7007883B47C7FD418553F38C810D3C2\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B7007883B47C7FD418553F38C810D3C2\SourceList\PackageName = "dotnet-hostfxr-10.0.14-win-x64.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\dotnet_runtime_80.56.61678_x64	windowsdesktop-runtime-10.0.14-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{29A18B06-B190-4463-9FFC-BC0D70D80B7C}\DisplayName = "Microsoft Windows Desktop Runtime 10.0.14 (x64)"	windowsdesktop-runtime-10.0.14-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\476CFB46466DB084FA2F4DC755136D2D\MainFeature	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000_Classes\roblox\shell	Voidstrap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000_Classes\roblox-studio\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Voidstrap\\Voidstrap.exe\" -studio \"%1\""	Voidstrap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x64\Version = "80.56.61678"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6C9A1A76831E874C953272469A86543\ProductName = "Microsoft .NET Host - 10.0.14 (x64)"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6C9A1A76831E874C953272469A86543\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000_Classes\roblox	Voidstrap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000_Classes\roblox-studio\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Voidstrap\\Voidstrap.exe\",0"	Voidstrap.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x64\Dependents	windowsdesktop-runtime-10.0.14-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\46F1B1499DCF04C49B727EF594DD698D\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000_Classes\roblox\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Voidstrap\\Voidstrap.exe\",0"	Voidstrap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000_Classes\roblox-player\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Voidstrap\\Voidstrap.exe\" -player \"%1\""	Voidstrap.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{29A18B06-B190-4463-9FFC-BC0D70D80B7C}	windowsdesktop-runtime-10.0.14-win-x64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000_Classes\roblox-studio-auth\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Voidstrap\\Voidstrap.exe\" -studio \"%1\""	Voidstrap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000_Classes\roblox-player\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Voidstrap\\Voidstrap.exe\",0"	Voidstrap.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\windowsdesktop_runtime_80.56.61678_x64	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6C9A1A76831E874C953272469A86543\PackageCode = "CD19619DF89F04047AC05659CEA24831"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6C9A1A76831E874C953272469A86543\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.56.61678_x64\ = "{3887007B-C74B-4DF7-8155-F3838C013D2C}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\46F1B1499DCF04C49B727EF594DD698D\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000_Classes\Local Settings	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000_Classes\roblox-studio\ = "URL:Roblox Studio Protocol"	Voidstrap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000_Classes\roblox-studio-auth\ = "URL:Roblox Studio Auth Protocol"	Voidstrap.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\46F1B1499DCF04C49B727EF594DD698D\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{29A18B06-B190-4463-9FFC-BC0D70D80B7C}\Version = "10.0.14.50000"	windowsdesktop-runtime-10.0.14-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\9CB77BF103B5F05757987B6130E13954\B7007883B47C7FD418553F38C810D3C2	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B6C9A1A76831E874C953272469A86543\Provider	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6C9A1A76831E874C953272469A86543\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.56.61678_x64	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B7007883B47C7FD418553F38C810D3C2\MainFeature	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\476CFB46466DB084FA2F4DC755136D2D\Version = "1345908974"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\46F1B1499DCF04C49B727EF594DD698D\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\46F1B1499DCF04C49B727EF594DD698D\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\46F1B1499DCF04C49B727EF594DD698D\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_80.56.61678_x64\Dependents\{29A18B06-B190-4463-9FFC-BC0D70D80B7C}	windowsdesktop-runtime-10.0.14-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B7007883B47C7FD418553F38C810D3C2\Version = "1345908974"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x64	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6C9A1A76831E874C953272469A86543\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{7A1A9C6B-1386-478E-9C35-7242968A5634}v80.56.61678\\"	msiexec.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\Voidstrap.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\AppData\Local\Voidstrap\Voidstrap.exe\:Zone.Identifier:$DATA	Voidstrap.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
2208	msiexec.exe
2208	msiexec.exe
2208	msiexec.exe
2208	msiexec.exe
2208	msiexec.exe
2208	msiexec.exe
2208	msiexec.exe
2208	msiexec.exe
2208	msiexec.exe
2208	msiexec.exe
2208	msiexec.exe
2208	msiexec.exe
5648	Voidstrap.exe
5648	Voidstrap.exe
5648	Voidstrap.exe
5648	Voidstrap.exe
5648	Voidstrap.exe
5648	Voidstrap.exe
5648	Voidstrap.exe
5648	Voidstrap.exe
5648	Voidstrap.exe
5648	Voidstrap.exe
5648	Voidstrap.exe
5648	Voidstrap.exe
5648	Voidstrap.exe
5648	Voidstrap.exe
5648	Voidstrap.exe
5648	Voidstrap.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4948	windowsdesktop-runtime-10.0.14-win-x64.exe
Token: SeIncreaseQuotaPrivilege	4948	windowsdesktop-runtime-10.0.14-win-x64.exe
Token: SeSecurityPrivilege	2208	msiexec.exe
Token: SeCreateTokenPrivilege	4948	windowsdesktop-runtime-10.0.14-win-x64.exe
Token: SeAssignPrimaryTokenPrivilege	4948	windowsdesktop-runtime-10.0.14-win-x64.exe
Token: SeLockMemoryPrivilege	4948	windowsdesktop-runtime-10.0.14-win-x64.exe
Token: SeIncreaseQuotaPrivilege	4948	windowsdesktop-runtime-10.0.14-win-x64.exe
Token: SeMachineAccountPrivilege	4948	windowsdesktop-runtime-10.0.14-win-x64.exe
Token: SeTcbPrivilege	4948	windowsdesktop-runtime-10.0.14-win-x64.exe
Token: SeSecurityPrivilege	4948	windowsdesktop-runtime-10.0.14-win-x64.exe
Token: SeTakeOwnershipPrivilege	4948	windowsdesktop-runtime-10.0.14-win-x64.exe
Token: SeLoadDriverPrivilege	4948	windowsdesktop-runtime-10.0.14-win-x64.exe
Token: SeSystemProfilePrivilege	4948	windowsdesktop-runtime-10.0.14-win-x64.exe
Token: SeSystemtimePrivilege	4948	windowsdesktop-runtime-10.0.14-win-x64.exe
Token: SeProfSingleProcessPrivilege	4948	windowsdesktop-runtime-10.0.14-win-x64.exe
Token: SeIncBasePriorityPrivilege	4948	windowsdesktop-runtime-10.0.14-win-x64.exe
Token: SeCreatePagefilePrivilege	4948	windowsdesktop-runtime-10.0.14-win-x64.exe
Token: SeCreatePermanentPrivilege	4948	windowsdesktop-runtime-10.0.14-win-x64.exe
Token: SeBackupPrivilege	4948	windowsdesktop-runtime-10.0.14-win-x64.exe
Token: SeRestorePrivilege	4948	windowsdesktop-runtime-10.0.14-win-x64.exe
Token: SeShutdownPrivilege	4948	windowsdesktop-runtime-10.0.14-win-x64.exe
Token: SeDebugPrivilege	4948	windowsdesktop-runtime-10.0.14-win-x64.exe
Token: SeAuditPrivilege	4948	windowsdesktop-runtime-10.0.14-win-x64.exe
Token: SeSystemEnvironmentPrivilege	4948	windowsdesktop-runtime-10.0.14-win-x64.exe
Token: SeChangeNotifyPrivilege	4948	windowsdesktop-runtime-10.0.14-win-x64.exe
Token: SeRemoteShutdownPrivilege	4948	windowsdesktop-runtime-10.0.14-win-x64.exe
Token: SeUndockPrivilege	4948	windowsdesktop-runtime-10.0.14-win-x64.exe
Token: SeSyncAgentPrivilege	4948	windowsdesktop-runtime-10.0.14-win-x64.exe
Token: SeEnableDelegationPrivilege	4948	windowsdesktop-runtime-10.0.14-win-x64.exe
Token: SeManageVolumePrivilege	4948	windowsdesktop-runtime-10.0.14-win-x64.exe
Token: SeImpersonatePrivilege	4948	windowsdesktop-runtime-10.0.14-win-x64.exe
Token: SeCreateGlobalPrivilege	4948	windowsdesktop-runtime-10.0.14-win-x64.exe
Token: SeRestorePrivilege	2208	msiexec.exe
Token: SeTakeOwnershipPrivilege	2208	msiexec.exe
Token: SeRestorePrivilege	2208	msiexec.exe
Token: SeTakeOwnershipPrivilege	2208	msiexec.exe
Token: SeRestorePrivilege	2208	msiexec.exe
Token: SeTakeOwnershipPrivilege	2208	msiexec.exe
Token: SeRestorePrivilege	2208	msiexec.exe
Token: SeTakeOwnershipPrivilege	2208	msiexec.exe
Token: SeRestorePrivilege	2208	msiexec.exe
Token: SeTakeOwnershipPrivilege	2208	msiexec.exe
Token: SeRestorePrivilege	2208	msiexec.exe
Token: SeTakeOwnershipPrivilege	2208	msiexec.exe
Token: SeRestorePrivilege	2208	msiexec.exe
Token: SeTakeOwnershipPrivilege	2208	msiexec.exe
Token: SeRestorePrivilege	2208	msiexec.exe
Token: SeTakeOwnershipPrivilege	2208	msiexec.exe
Token: SeRestorePrivilege	2208	msiexec.exe
Token: SeTakeOwnershipPrivilege	2208	msiexec.exe
Token: SeRestorePrivilege	2208	msiexec.exe
Token: SeTakeOwnershipPrivilege	2208	msiexec.exe
Token: SeRestorePrivilege	2208	msiexec.exe
Token: SeTakeOwnershipPrivilege	2208	msiexec.exe
Token: SeRestorePrivilege	2208	msiexec.exe
Token: SeTakeOwnershipPrivilege	2208	msiexec.exe
Token: SeRestorePrivilege	2208	msiexec.exe
Token: SeTakeOwnershipPrivilege	2208	msiexec.exe
Token: SeRestorePrivilege	2208	msiexec.exe
Token: SeTakeOwnershipPrivilege	2208	msiexec.exe
Token: SeRestorePrivilege	2208	msiexec.exe
Token: SeTakeOwnershipPrivilege	2208	msiexec.exe
Token: SeRestorePrivilege	2208	msiexec.exe
Token: SeTakeOwnershipPrivilege	2208	msiexec.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
1792	wixstdba.exe
5060	wixstdba.exe
4384	msedge.exe
4720	firefox.exe
4720	firefox.exe
4720	firefox.exe
4720	firefox.exe
4720	firefox.exe
4720	firefox.exe
4720	firefox.exe
4720	firefox.exe
4720	firefox.exe
5648	Voidstrap.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4720	firefox.exe
4720	firefox.exe
4720	firefox.exe
4720	firefox.exe
5956	Voidstrap.exe
5648	Voidstrap.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2728 wrote to memory of 4384	2728	Voidstrap.exe	90
PID 4384 wrote to memory of 5008	4384	msedge.exe	91
PID 4384 wrote to memory of 820	4384	msedge.exe	92
PID 4384 wrote to memory of 4844	4384	msedge.exe	93
PID 4384 wrote to memory of 820	4384	msedge.exe	92
PID 4384 wrote to memory of 820	4384	msedge.exe	92
PID 4384 wrote to memory of 1724	4384	msedge.exe	94
PID 4384 wrote to memory of 1724	4384	msedge.exe	94
PID 4384 wrote to memory of 3956	4384	msedge.exe	95
PID 4384 wrote to memory of 972	4384	msedge.exe	96
PID 4384 wrote to memory of 3956	4384	msedge.exe	95
PID 4384 wrote to memory of 3956	4384	msedge.exe	95
PID 4384 wrote to memory of 972	4384	msedge.exe	96
PID 4384 wrote to memory of 972	4384	msedge.exe	96
PID 4384 wrote to memory of 1688	4384	msedge.exe	97
PID 4384 wrote to memory of 1688	4384	msedge.exe	97
PID 4384 wrote to memory of 1688	4384	msedge.exe	97
PID 4384 wrote to memory of 696	4384	msedge.exe	98
PID 4384 wrote to memory of 696	4384	msedge.exe	98
PID 4384 wrote to memory of 696	4384	msedge.exe	98
PID 4384 wrote to memory of 4872	4384	msedge.exe	101
PID 4384 wrote to memory of 4872	4384	msedge.exe	101
PID 4384 wrote to memory of 4604	4384	msedge.exe	104
PID 4384 wrote to memory of 4604	4384	msedge.exe	104
PID 4384 wrote to memory of 3372	4384	msedge.exe	107
PID 4384 wrote to memory of 3372	4384	msedge.exe	107
PID 4384 wrote to memory of 3372	4384	msedge.exe	107
PID 4384 wrote to memory of 224	4384	msedge.exe	108
PID 4384 wrote to memory of 4848	4384	msedge.exe	109
PID 4384 wrote to memory of 224	4384	msedge.exe	108
PID 4384 wrote to memory of 4848	4384	msedge.exe	109
PID 4384 wrote to memory of 1880	4384	msedge.exe	111
PID 4384 wrote to memory of 3340	4384	msedge.exe	112
PID 4384 wrote to memory of 2184	4384	msedge.exe	113
PID 4384 wrote to memory of 3340	4384	msedge.exe	112
PID 4384 wrote to memory of 2184	4384	msedge.exe	113
PID 4384 wrote to memory of 2640	4384	msedge.exe	114
PID 4384 wrote to memory of 4320	4384	msedge.exe	115
PID 4384 wrote to memory of 2640	4384	msedge.exe	114
PID 4384 wrote to memory of 4320	4384	msedge.exe	115
PID 4384 wrote to memory of 4160	4384	msedge.exe	116
PID 4384 wrote to memory of 4160	4384	msedge.exe	116
PID 4384 wrote to memory of 4572	4384	msedge.exe	117
PID 4384 wrote to memory of 972	4384	msedge.exe	118
PID 4384 wrote to memory of 4572	4384	msedge.exe	117
PID 4384 wrote to memory of 972	4384	msedge.exe	118
PID 4384 wrote to memory of 972	4384	msedge.exe	118
PID 4384 wrote to memory of 2516	4384	msedge.exe	119
PID 4384 wrote to memory of 1904	4384	msedge.exe	120
PID 1904 wrote to memory of 1792	1904	windowsdesktop-runtime-10.0.14-win-x64.exe	122
PID 1904 wrote to memory of 4948	1904	windowsdesktop-runtime-10.0.14-win-x64.exe	123
PID 4900 wrote to memory of 3204	4900	windowsdesktop-runtime-10.0.14-win-x64.exe	128
PID 2208 wrote to memory of 4220	2208	msiexec.exe	129
PID 2208 wrote to memory of 2312	2208	msiexec.exe	130
PID 2208 wrote to memory of 3416	2208	msiexec.exe	131
PID 3204 wrote to memory of 5060	3204	windowsdesktop-runtime-10.0.14-win-x64.exe	132
PID 4384 wrote to memory of 1200	4384	msedge.exe	133
PID 4384 wrote to memory of 3476	4384	msedge.exe	134
PID 4384 wrote to memory of 2832	4384	msedge.exe	135
PID 2208 wrote to memory of 4992	2208	msiexec.exe	136
PID 4384 wrote to memory of 4496	4384	msedge.exe	137
PID 4384 wrote to memory of 4496	4384	msedge.exe	137
PID 3204 wrote to memory of 1196	3204	windowsdesktop-runtime-10.0.14-win-x64.exe	138
PID 2208 wrote to memory of 3612	2208	msiexec.exe	139

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\Voidstrap.exe
"C:\Users\Admin\AppData\Local\Temp\Voidstrap.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.NETCore.App&framework_version=10.0.0&arch=x64&rid=win-x64&os=win10&gui=true
  2⤵
  - Drops file in Windows directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x328,0x7ffdf215c188,0x7ffdf215c194,0x7ffdf215c1a0
    3⤵
    PID:5008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1720,i,16611372366607323994,5121262164622900708,262144 --field-trial-handle=2132,i,3243264322505914849,4139106208878325518,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:2
    3⤵
    PID:820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1976,i,16888182443757496474,717644689282603708,524288 --field-trial-handle=2132,i,3243264322505914849,4139106208878325518,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:3
    3⤵
    - Downloads MZ/PE file
    - System Time Discovery
    PID:4844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1852,i,4773409727708973860,16630045642833335461,524288 --field-trial-handle=2132,i,3243264322505914849,4139106208878325518,262144 --variations-seed-version --mojo-platform-channel-handle=2728 /prefetch:8
    3⤵
    PID:1724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3412,i,11400856833956896555,14111546895005389934,2097152 --field-trial-handle=2132,i,3243264322505914849,4139106208878325518,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
    3⤵
    PID:3956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3416,i,9992676840677623797,6922720485677974914,2097152 --field-trial-handle=2132,i,3243264322505914849,4139106208878325518,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
    3⤵
    PID:972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4220,i,2162081209617921487,1623596820938083113,2097152 --field-trial-handle=2132,i,3243264322505914849,4139106208878325518,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:1
    3⤵
    PID:1688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4240,i,3581393831728110309,2955723519237119607,2097152 --field-trial-handle=2132,i,3243264322505914849,4139106208878325518,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:2
    3⤵
    PID:696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5076,i,2118014674976195910,12021318081879591854,524288 --field-trial-handle=2132,i,3243264322505914849,4139106208878325518,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:8
    3⤵
    PID:4872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,10376667645630040916,11437717507605432441,524288 --field-trial-handle=2132,i,3243264322505914849,4139106208878325518,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:8
    3⤵
    PID:4604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5304,i,9734246165360837482,10531819363293136139,2097152 --field-trial-handle=2132,i,3243264322505914849,4139106208878325518,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:1
    3⤵
    PID:3372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3704,i,2799036036409886502,2655783968461010289,524288 --field-trial-handle=2132,i,3243264322505914849,4139106208878325518,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:8
    3⤵
    PID:224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5424,i,648331092834194987,5502173581458358326,524288 --field-trial-handle=2132,i,3243264322505914849,4139106208878325518,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:8
    3⤵
    PID:4848
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5768,i,11618714158918214986,1158742270041171871,524288 --field-trial-handle=2132,i,3243264322505914849,4139106208878325518,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:8
    3⤵
    PID:996
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5768,i,11618714158918214986,1158742270041171871,524288 --field-trial-handle=2132,i,3243264322505914849,4139106208878325518,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:8
    3⤵
    PID:1880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6036,i,14627984319322034363,17258527600993182321,524288 --field-trial-handle=2132,i,3243264322505914849,4139106208878325518,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:8
    3⤵
    PID:3340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,13556954935715049934,5566171686485132408,524288 --field-trial-handle=2132,i,3243264322505914849,4139106208878325518,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:8
    3⤵
    PID:2184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6056,i,10370635763936903719,15715697430964037669,524288 --field-trial-handle=2132,i,3243264322505914849,4139106208878325518,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:8
    3⤵
    PID:2640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6048,i,4317418992914325813,10492784809039353552,524288 --field-trial-handle=2132,i,3243264322505914849,4139106208878325518,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:8
    3⤵
    PID:4320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5624,i,3513068808866441289,13330978742625215011,524288 --field-trial-handle=2132,i,3243264322505914849,4139106208878325518,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:8
    3⤵
    PID:4160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5624,i,13657760081049629713,18420920433671333398,524288 --field-trial-handle=2132,i,3243264322505914849,4139106208878325518,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:8
    3⤵
    PID:4572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6256,i,8423455570274297706,340034224732884267,2097152 --field-trial-handle=2132,i,3243264322505914849,4139106208878325518,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:1
    3⤵
    PID:972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7104,i,829483335933579357,4464850013698320676,524288 --field-trial-handle=2132,i,3243264322505914849,4139106208878325518,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:8
    3⤵
    PID:2516
- - C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.14-win-x64.exe
    "C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.14-win-x64.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1904
  - - C:\Windows\TEMP\{41784213-E3F4-4163-87B6-DCA72709F3CC}\.ba\wixstdba.exe
      "C:\Windows\TEMP\{41784213-E3F4-4163-87B6-DCA72709F3CC}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{E61781A9-1222-4FFD-AE43-FBBE996C385C} {7D5E008E-F46E-4120-9D7B-75F5040B5E69}
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      PID:1792
  - - C:\Windows\TEMP\{41784213-E3F4-4163-87B6-DCA72709F3CC}\.be\windowsdesktop-runtime-10.0.14-win-x64.exe
      "C:\Windows\TEMP\{41784213-E3F4-4163-87B6-DCA72709F3CC}\.be\windowsdesktop-runtime-10.0.14-win-x64.exe" -q -burn.elevated BurnPipe.{33949D7D-8F17-4754-B773-ABB365B33422} {818AC6EF-DF98-4042-9845-A144C6AC892B} 1904
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      PID:4948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4380,i,9488104213713627910,11404485486958315934,524288 --field-trial-handle=2132,i,3243264322505914849,4139106208878325518,262144 --variations-seed-version --mojo-platform-channel-handle=3404 /prefetch:8
    3⤵
    PID:1200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4332,i,9164550477900421769,14932122614595034154,524288 --field-trial-handle=2132,i,3243264322505914849,4139106208878325518,262144 --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:8
    3⤵
    PID:3476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4372,i,2887160847124599018,2254637669412783854,524288 --field-trial-handle=2132,i,3243264322505914849,4139106208878325518,262144 --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:8
    3⤵
    PID:2832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3692,i,7191801163986021316,7748692532634795306,524288 --field-trial-handle=2132,i,3243264322505914849,4139106208878325518,262144 --variations-seed-version --mojo-platform-channel-handle=3148 /prefetch:8
    3⤵
    PID:4496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6844,i,4021309189530943859,12584973403989627200,524288 --field-trial-handle=2132,i,3243264322505914849,4139106208878325518,262144 --variations-seed-version --mojo-platform-channel-handle=6840 /prefetch:8
    3⤵
    PID:2488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5168,i,17319616472689918743,4585475966298899118,524288 --field-trial-handle=2132,i,3243264322505914849,4139106208878325518,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:8
    3⤵
    PID:2612

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1092

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 24A837330F96932270022D422CD81AFB
  2⤵
  - Loads dropped DLL
  PID:4220
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 785F3F02557240A1C192BC2E8CF4E7A1
  2⤵
  - Loads dropped DLL
  PID:2312
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 3645C9274074767890967B5510BE7EB7
  2⤵
  - Loads dropped DLL
  PID:3416
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 9C80A7DD10105D637102A2B050B25248
  2⤵
  - Loads dropped DLL
  PID:4992
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding F64682A7CFF342B7E5ADC0C638C75A1B
  2⤵
  - Loads dropped DLL
  PID:3612
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding CAF1F6907E991DEE99FEA91597C45879
  2⤵
  - Loads dropped DLL
  PID:5092

C:\ProgramData\Package Cache\{29A18B06-B190-4463-9FFC-BC0D70D80B7C}\windowsdesktop-runtime-10.0.14-win-x64.exe
"C:\ProgramData\Package Cache\{29A18B06-B190-4463-9FFC-BC0D70D80B7C}\windowsdesktop-runtime-10.0.14-win-x64.exe" /burn.runonce
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4900
- C:\ProgramData\Package Cache\{29A18B06-B190-4463-9FFC-BC0D70D80B7C}\windowsdesktop-runtime-10.0.14-win-x64.exe
  "C:\ProgramData\Package Cache\{29A18B06-B190-4463-9FFC-BC0D70D80B7C}\windowsdesktop-runtime-10.0.14-win-x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.14_(x64)_20261030145733.log"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3204
- - C:\Windows\TEMP\{990FEA38-5A3B-456E-8A1D-86BFF9F17762}\.ba\wixstdba.exe
    "C:\Windows\TEMP\{990FEA38-5A3B-456E-8A1D-86BFF9F17762}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{C721A44E-325A-43E8-9B76-6FF197E5BEAB} {E4F31522-CFA4-47F4-A478-B7FA45F8F82E}
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:5060
- - C:\ProgramData\Package Cache\{29A18B06-B190-4463-9FFC-BC0D70D80B7C}\windowsdesktop-runtime-10.0.14-win-x64.exe
    "C:\ProgramData\Package Cache\{29A18B06-B190-4463-9FFC-BC0D70D80B7C}\windowsdesktop-runtime-10.0.14-win-x64.exe" -q -burn.elevated BurnPipe.{EE1E35BA-61A8-4EEB-BBAC-6DF1CF894D51} {423853A7-6188-46A0-B642-3D8D0CFB0815} 3204
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:1196

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3240

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:3452
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Downloads MZ/PE file
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:4720
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1992 -prefsLen 27100 -prefMapHandle 1996 -prefMapSize 270279 -ipcHandle 2084 -initialChannelId {64c18cc7-9e63-4035-8036-e68e13f69850} -parentPid 4720 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4720" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:2892
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2448 -prefsLen 27136 -prefMapHandle 2452 -prefMapSize 270279 -ipcHandle 2460 -initialChannelId {13de4a94-f358-4a69-92e5-51e338a0d629} -parentPid 4720 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4720" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:1368
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3868 -prefsLen 27277 -prefMapHandle 3872 -prefMapSize 270279 -jsInitHandle 3876 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3884 -initialChannelId {4fcbc7e8-ca94-42c4-8340-87c7ed39ff6b} -parentPid 4720 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4720" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:2488
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4064 -prefsLen 27277 -prefMapHandle 4068 -prefMapSize 270279 -ipcHandle 4132 -initialChannelId {a52ff8d3-96ab-423e-9aec-ad43ea637acf} -parentPid 4720 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4720" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:4364
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2936 -prefsLen 34776 -prefMapHandle 3156 -prefMapSize 270279 -jsInitHandle 2636 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4452 -initialChannelId {9d1f65a6-cf15-45cb-b9f3-73e0150a3ff0} -parentPid 4720 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4720" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:3400
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4976 -prefsLen 35013 -prefMapHandle 5008 -prefMapSize 270279 -ipcHandle 2952 -initialChannelId {fdbea8f6-b163-4918-95b8-c229b4b06c33} -parentPid 4720 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4720" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:6096
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5200 -prefsLen 32952 -prefMapHandle 5204 -prefMapSize 270279 -jsInitHandle 5208 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5216 -initialChannelId {ebcacd3b-082d-4a61-8bb1-ac80f01ba059} -parentPid 4720 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4720" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:6120
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5236 -prefsLen 32952 -prefMapHandle 5240 -prefMapSize 270279 -jsInitHandle 5244 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5252 -initialChannelId {33a444b3-12d6-4a7a-a331-304b9b5a12ac} -parentPid 4720 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4720" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:6136
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5596 -prefsLen 32952 -prefMapHandle 5600 -prefMapSize 270279 -jsInitHandle 5604 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5612 -initialChannelId {7022bcc3-32cb-491f-8618-880d58a10f2b} -parentPid 4720 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4720" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:4496
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6112 -prefsLen 33071 -prefMapHandle 6116 -prefMapSize 270279 -jsInitHandle 6120 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6128 -initialChannelId {95904c0c-b69e-4b24-b44b-ecf74cf3cb01} -parentPid 4720 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4720" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:5740
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5876 -prefsLen 34662 -prefMapHandle 5808 -prefMapSize 270279 -jsInitHandle 6740 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5852 -initialChannelId {9b4e5469-aa25-4d53-9da8-6d6546dbbb3e} -parentPid 4720 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4720" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:5992

C:\Users\Admin\Downloads\Voidstrap.exe
"C:\Users\Admin\Downloads\Voidstrap.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Modifies registry class
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5956
- C:\Users\Admin\AppData\Local\Voidstrap\Voidstrap.exe
  "C:\Users\Admin\AppData\Local\Voidstrap\Voidstrap.exe" -player
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:5648
- - C:\Windows\system32\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /Delete /TN Voidstrap\AssetWarpCleanup /F
    3⤵
    PID:6136

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e58f105.rbs

Path C:\Config.Msi\e58f105.rbs
Size 11KB
SHA256 10773a8ba64b2c1eea0cd954965537489bc59c6ea83e7c05c1a1fcd9af55c1e1
MD5 3d11d936142b79a890d270d136408214
SHA1 fd854ca870c9ad54efb582e6639d191c35e5ef7b
SHA512 e8ae6609de2ac32b332d8f19ea2191ce69a44bbebacde558d724451ef69ec7896db595898a0a53db333b39c4269f81d1184362126be645894bf533a57c077eb9
SSDEEP 192:8QZ9fX3LXC8XLXTXbMtJW5HDa7R/ePGVmPLvIz7VmPLvCzXEBXgCoLpUAuYSKn6G:8izC0D7gtM5Hgl2s2r4
TLSH
T12E322FA2A701C1E3FA972735CB0B27263F63979E8304134F49ACC1259F437D92EA55DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58f10c.rbs

Path C:\Config.Msi\e58f10c.rbs
Size 9KB
SHA256 4b955bdcbca12591fd978a7240878f8e4e0b1462d44c37fa9ca7c1e84feb4afd
MD5 e661939e8493e575c9d9d8ce01dc77c7
SHA1 6f2b86910e590df42e6090459890d55baa48803f
SHA512 b3e3c6cd8e3681821e596efb5baeb04f43acc13f2ef3083f05c992e33b1ebaa040ef4851fc3d83b47a09b564e5d47612fb04d964f31cab7a66f9fe2e1d853c94
SSDEEP 96:BmwA7ZCVrc2LeCpipttUxeD2PYCsTl8UxeD2PYC6jiWpUponyTlanEI+E5pl7fQ3:8NVKXejGhvIVhvxdEVPkpLpdZ
TLSH
T1FC1234456A0086E2EC931B34EA032F323F66E39AE344571B1DCE81745F477D85EB929E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58f111.rbs

Path C:\Config.Msi\e58f111.rbs
Size 49KB
SHA256 449137e8e4fab527a60bfb7efd20c9f79b7b2fa1e469cfcaca63e31587357c2e
MD5 272d1fa51121835f4510242dc5f9a2ca
SHA1 3317a8f957390b96526be19b9c275c6c1f52efc7
SHA512 85c147b6dba6026e509d614e5493b3e77d888379cb3408c932f2985e79f498e483aed35dd918175255b77b896435fd66b2bff53d5c9a99db664502f0b675efeb
SSDEEP 1536:bpzILbIIwdeizGKApN+B277ffOM9JyZneajISfvz2WJEtPV+Gtig/W5RW3ZVScgY:gL
TLSH
T16833B3A8FF04C2E3F17A7D602361DE04B3158D52D72495AA92CE4319DF4A7D8AEEC1D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58f116.rbs

Path C:\Config.Msi\e58f116.rbs
Size 71KB
SHA256 4e19f3505cdad8435bd6b3bb58329145993b4c2675d4a5e46dd02ee5c42a077d
MD5 9b209ed29f21ff88e75ddde52d742fa1
SHA1 ff42086295dd6a16a5922643b6f229f50383b10d
SHA512 6f00a0f56e733b34fadc2dcaafd9daaa21fc3690b14b06f1ba5210786c6a1221d8eed1eee2d7d06935f9c9491134b0299b5bd1b2a3487549b67c748f2369f17a
SSDEEP 1536:kraavi1jDWKS0dN97p9t4Gu4C6jLepO4BqH8Zd4WY0fZf8Fmi9xGpD/gsLtdlInB:wLn6ju1WMCy0sKy4WOZh
TLSH
T1176322999748C096FD322990FBBFF604BB119DA2B60E45AA11CCD63DDDE52C61FA4CC0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58f11a.rbs

Path C:\Config.Msi\e58f11a.rbs
Size 3KB
SHA256 79744151531b7778cfb2681ff60f5615a76f3017fd0c0da2435e0555d2845d6b
MD5 c09a19c67c119a909cdc0a9c302e57ab
SHA1 126cecd795428e44237f6abe62c3068577f26d24
SHA512 441b26916d1b5a1be706e6551022d1f9e9a11aa1d7bdadd2d01092ba558af6adb30a321811fb9c86d94abc0d6a9c40e84dd313539a8b514288e8b4a878e255c5
TLSH
T137717842DA00D2D3ECA62B31CA171B113377D7EAD724879B018D92741E477C5DEEA286
MD5 SHA1 SHA512 TLSH

Submit Download

e58f11d.rbs

Path C:\Config.Msi\e58f11d.rbs
Size 3KB
SHA256 60b223e8d29d7340c966e8df088d2bb38781bf8668f27bc0800a77a4e69428ae
MD5 a22d9e116c96d63c3db2d6679cf882a3
SHA1 16b3680f7daf717e6805023a0156ec140d585efa
SHA512 682d47cebf58a4a8f7b5403185b7b469998c486cd191e30020345f110a9adf4839f4bad6482adbf0ae30e8cfe662fdd2fe18147d6a7bfa7e6cdebc1746b4edbb
TLSH
T1B2819C03AA44E283ECA21B30CE2F57127377D7DAD719438704CCD1310D877C9AE9A685
MD5 SHA1 SHA512 TLSH

Submit Download

ThirdPartyNotices.txt

Path C:\Program Files\dotnet\ThirdPartyNotices.txt
Size 77KB
SHA256 deb4427a295e1ed474b0d81c5a0d972c1b550b9a715cda939cdfa9236b1b418f
MD5 0d8867a25ba926e6e40cd52ab3536b5c
SHA1 89390dc8b8318d0bfef1c6a2fb4783537e28a465
SHA512 317ca335405274f4f91b173651ca2826760acb5ba5cf41aff51adc55c2cda9059fb268333665f13f62fa48119e55a303720a780dd58d28dd9967db4c88407d61
SSDEEP 1536:HA9jHwsGfgg39/zwgAVkguQxrDjugtSEGepkWvrpX7anuqdLSVnfiStPq+3LefrL:HA97w/ogz1AVxuMjHtSFULryLOgrGWm+
TLSH
T17773A45F7E45077319E2C3916569A8C5F22FA02E3B6B2A44346EF248133B42DD6FF858
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 163KB
SHA256 1e881ec1786c31ba712d052258b4ad4202ac155df5965794030037878abb822f
MD5 d62fd28f725a7e0200ae19e07c2b2b8f
SHA1 2163a2c5955d66baaa4b7aef85029ba153ca2e60
SHA512 dc86819bf5c0652f7426c4da70858079eb0ec4bf6c2c416b29ad0c0d92057d3baa2d3dcc54472b6577b24ac3858c6e6222eecf256a80cfc81d4167a7370d574f
SSDEEP 3072:JGgPR9lIuvTSBbQ/09n4SbDqIG/0k7l55wK4pQaa:JGalIubgbQoDvqIUtyu
TLSH
T176F3061AD65811AAD06E9575CB528941BB337C668BE0E3CB53C0F8BE0F726905EF9703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetRuntime

Path C:\ProgramData\Package Cache\.unverified\DotNetRuntime
Size 28.1MB
SHA256 36c8067684aeb83228b44ecb3d4c103379017ca87e3e007e51105a91e404d97a
MD5 448a27c46800f17819be6847fb737e07
SHA1 aba29671dc9f147325ddea11ecb3cf909179d92d
SHA512 78ed4db54b0ac78211d9b03d94866a681367d80ef244779cfe60686aafb81795c13120a29baa0967ceeced71ef13e8d0e8c6a24cb4cb055cf9d135dc826fdbf9
SSDEEP 786432:nl9er4PCV9IzzrRov6dz5dcdtDzClZNWYihY:nl9erfqzz1r5SXzCuF
TLSH
T1A557331B7F9204A9D9260EB1C17A8765AB367D082320D2AB47B4711CDEFB3E564F63C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

state.rsm

Path C:\ProgramData\Package Cache\{29A18B06-B190-4463-9FFC-BC0D70D80B7C}\state.rsm
Size 1KB
SHA256 3296f0328f727e192bf47f8eb4bce12615c3aa5000d14f6d265b63ac24de58a9
MD5 aa4e9bdbdbfdf03ed17d9a35c9257706
SHA1 3fdbfb9dcab863b858ab763a0ac9ffa7b53ec522
SHA512 baf04e927b4bfc496cac227bb78a76ea19fd5ded76266bea558717b0edc5501134cc6e2eba0f16f0f7d885886e4a19bd53cf0224346799b8b784d33de11e778f
TLSH
T1A221D1515BF6092DF3F6AB34A9F96725443BBC121C20C16E0001318A9E32BD0CCB4B37
MD5 SHA1 SHA512 TLSH

Submit Download

52a8788d-2bf9-4ce6-acf4-92ddc056efbb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\52a8788d-2bf9-4ce6-acf4-92ddc056efbb.tmp
Size 33KB
SHA256 6f15563d0d753b7c0c035c8597f1e64f327fb09f1499f32026dd35acd4fa799b
MD5 b36b349dff18b26bb9f7212a002b4c22
SHA1 6bc508aa4577b54c738e36f68ed50a27fa3d47bf
SHA512 1376b9e1ffb11c226fe19348044f101b0014b4b3074ecceeac586b1a76a2e22d4a2a41e180c0c2512965174b5aae88108a0e04ada798fc55f548b2cb2f36934b
SSDEEP 768:9F7KHEwgh8SAc/3F0HEF+LQPbthK4bQW59L2:vKHdSAfQD/KYQWTK
TLSH
T111F26FF99CE7993AD8AE6747633D6D5289BCC127F5A44984F7841E0CCCA61BFE306801
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8d8d3c06-ddfa-4d70-a9c4-112dc6b74763.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8d8d3c06-ddfa-4d70-a9c4-112dc6b74763.tmp
Size 8KB
SHA256 28f88adc016e125247201c8aa5d792d89be4f479f191ca63d7def7d1e5365018
MD5 1ca8ad432cf7efc6ed31eb8595f8cf87
SHA1 a07005a14a7d5a84715752349844e2b08a627801
SHA512 a3a1cb1ce30c19032d2f6c29a5cfa3c1036c2bb928a4b7a92eb7ae4e047550c4f6a23cbb90df5169123a78609e2bf28711dfd7a4d363a4b253291651cdb19f26
SSDEEP 192:kONl6xG/QmiUyDEkgD0hZ/1ZEEjzo4kbuXZFp23Ewq9EU6:kONl6UB2bgD0hZfEUmbuXZFSE0U6
TLSH
T1CB1209316878EC675DE6B144B58726A39EA42077D949AF80E6EC1F1C00CB79C2B5EC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

91507857-bc90-4312-a2a4-8866c2fc5b9d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\91507857-bc90-4312-a2a4-8866c2fc5b9d.tmp
Size 28KB
SHA256 3a01a120ad6cf94ebde955493602b921d4dc578d7d6fe3ba9b6930525a494881
MD5 75ed69427cf0e2404c5d84c496813826
SHA1 2f36adbaf25d12f6ec813456b0b8ae194fdc2b3b
SHA512 e72a82b119ff34ff991b1b524f69f6d0d6b7a5e608cd3944bed10cd81c5ffad13d742d4f7fa2f6ebac013942fb63934a83f8065a014c111a991aeef89a6832ca
SSDEEP 384:nWiF7+QkUSvlXsNM8TUNTUlIlA34/LYwBPbm/du4DfYF0hZfEUmbuXZF93E02I9K:9F7uh1wgh8Szm/WF0HEF+L93E059L2
TLSH
T1D5D2B4F598E79937D8AE5383A33E6D828EBCD153B5884A84F7851D0CCC861BFD70A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

96d9aae3-bad4-4f37-82c2-f2a2be815e5d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\96d9aae3-bad4-4f37-82c2-f2a2be815e5d.tmp
Size 8KB
SHA256 2e52f4ff9ceed32a5c0ebe635fcfe44b595e4fcd31c0ed9a38e4420be864f892
MD5 de6f33b7c345a1a30b297bd1f5d45070
SHA1 a1e557e17449eaad205f53771243a79a062296e5
SHA512 c50052e03f9e0da5a1f288935449546ca2c37757631d81325049669d881693b12ece0a1308c2079d30a5b3d653ad1074408d832959fec8f23343a97ea384db98
SSDEEP 192:ZONY6xGuQmiUyhk1D0hZ/1ZEEjzo4kPicE06U6:ZONY6Uq11D0hZfEUmzE3U6
TLSH
T1D602C8356C686C7B9EF26E49B58B2B139FE4102BA5956F80D6E82E1C01CB69C1316C37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0244bc61dde55fcd918694918a767bd2faec2cca31af64104add2fca07838111
MD5 81f33669ee5ad44d7d9f2a5d0bb833b1
SHA1 942c8609f177b5ee33851f58d99a3a58f3aba945
SHA512 f6f7e43fecab4e5f8878f19b6838ac30ba4733568e9727a82044df770bfe3f902d9a9e660afea24f7a1509cb4f61e4240e17fa239acd3c5950e3757a4939edf1
TLSH
T17ED0801076177DE8C15EA1BC1B908F405948DE13451151034B570D545D94AD254D1EE8
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3a6eb5861393f83eb8b8016687c085da7ebeddb12e0086793cdaa97de2bf4d89
MD5 8f87b0f71fdb0e4babafb4d64f50918b
SHA1 ef9954a611e31dc1fc21cf5cdda9b032620389c3
SHA512 80b6b9a9ac529a7fa05c075fcb3af3a9438a9aa4a8462d2e9843ebf64816a6abb19f112e682567ce8c0abf07c734928796f290fd602cffbf3df31d92dc5eb530
TLSH
T1F5D02220B3038C80C8CCA0BC0F208B002E0EEC080022E2038AF000C0ACC2FF080C20E0
MD5 SHA1 SHA512 TLSH

Submit Download

407fd025-64f8-4f61-87f4-f7b2d36a0f14.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\407fd025-64f8-4f61-87f4-f7b2d36a0f14.tmp
Size 12KB
SHA256 2db054a3c012f612d21db0d5f788f070e18e4203679408bc06aa38490afc0321
MD5 456ac48e73c3039aebf7807cee784c3b
SHA1 88e94f0fe325982473b664c64bea174f03fdd07f
SHA512 d90ce2cffd111905600059bcbd23fe58812cdea50c246c9ad134c24add154ed13ee193e7bdc3cc6a7b925f44b961171015549095aa2eafc1efc8381f35c02178
SSDEEP 192:sxZ0RI8z/fAsHWpVw+y7Idp6GHW6+WNbI5+/AKr7aUJn54IgbTJ:sxZ0bz/fAsHWvwrktHbL/lahB
TLSH
T13A42B712AD34A97B9CCBE21DFA55BF63D2F9103391911E44AAFC851C05FBADD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5c9dd8d1-0bfc-4504-9be0-753d26dc58a5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5c9dd8d1-0bfc-4504-9be0-753d26dc58a5.tmp
Size 10KB
SHA256 f4df94228fefcd1065f02240434d1aad93db523ff6320f796103e0a04bb3c192
MD5 969ae4e04d4d03fa1f4580f60a71a8e9
SHA1 da3348a0e497b9f03ad54583ea2d3b59267be0d7
SHA512 540f47e055ed756aad9e2395faa617ff9220e1b3d09afafb198d1bc35db2fed7c0b8e4d7abe22d0a27faae23646fa10ed8f2dbad8a8ea2ec980a1a9599b728fb
SSDEEP 192:sxZ0RJVz/fAsX+M7IdpwGHW6+WNr5+/AKrCnIr4Ig4J:sxZ0Nz/fAsX1k/Hbc/oc
TLSH
T10732B9516E34A97B8CCBE21DBB19BB53D6F9503291D11D48AAFC851C05FBADD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5cc04508-c9f9-48b5-ae1e-b3a6838dcd40.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5cc04508-c9f9-48b5-ae1e-b3a6838dcd40.tmp
Size 32KB
SHA256 c2260131fa166edfbda9c21cff13742a725d22de85e2737522614bee04062527
MD5 cf68d021ffdae91dea45c3e5328f26c6
SHA1 e985bf3da88450292bf1cc59c49097c87b8c4880
SHA512 b1fc7eac5b7ed5d5f42dc2f0186037379ffcd23f691afc0c2f16a81d8eae36f4d275ad68951bd55f8f40c4b547ee79124e7590b561d913b9f5f3749587792523
SSDEEP 768:/WqqHXm7pLuLjRlWvdD/T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVC7F4LliA1n3rog:/WqqHXGEjRlWvdD/Tu1jaf7F4LYsnkg
TLSH
T135E2FA7B284CCA7E4FC00ADCDD6A7F9A6DA802DBA698C94047F9845C02C77EE51174DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 f13c91314865f54540ffcf3feeeb2d01c6dc3c56954cc102f9fa21e121963e93
MD5 9cd5f408e2aaaea1daaeb263e48504e0
SHA1 f1118f2e00439f6ad93a257566e35e9d5f623ac5
SHA512 b48a3fc8c0682e2091b538e50201fdf8ef7a7595100e2b71bae3b2b2645a6c2d9f397785b50f3d525d1ed038735ef2a1d9db8171d42212ed78004a5a3f68faf3
TLSH
T1E9E02685C7CAC3AEE30CA487027CA74C83A1272BDAC0790F3704CDC870052C0B2827D8
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 e1ce2199a492dfa30538609e0855603127d7a073489cfcbae9aabbf543238456
MD5 8e001b79245335363c5a73f3b7f86c11
SHA1 79c0e1f1564222dc1b12f6ebca9f4532b7d7046f
SHA512 b1fbed5d3cdd95d0e36c2733893a31751d9684ca1e62e28616c7cdbdf74e40823470f68a8d46f4b7a70d8dd8f3f76cadc8a09f9911d7461ac3eb630969161f5c
TLSH
T13771D7546180DDF5CBA804729EED0C83FA300C81B0B72F3E21A5EDB79BA7367548C905
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 2854f46d280a0398c7ab6964a1d1e912a2b3b4d56109db64244eec3156576008
MD5 dfe8d94e20e57f0322c1b424081b6b32
SHA1 50e7a7b4469da0ab8198bf812286b9b520f10618
SHA512 6e4f66a96292493fd9a36632646e7fb2fd9fab77937b34db7f6a9675100116e441ec6f95a286bcc8b49f61fe470178d93dff662c76eb69acb26484652be8da16
SSDEEP 3:MsEllllkEthXllkl2zE/lFnl:/M/xT02zGnl
TLSH
T1CB440204AB840846C5041135409193911370D5101A335783349144339C957400D00002
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6ace381a-5017-4796-88d7-4bf2356b811c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\6ace381a-5017-4796-88d7-4bf2356b811c.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.111.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

1051d36c-1dd7-4ac9-92a2-9f7148c8dc18.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\1051d36c-1dd7-4ac9-92a2-9f7148c8dc18.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

9bf6667a-647a-4885-9ed7-c87e23f357bd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\9bf6667a-647a-4885-9ed7-c87e23f357bd.tmp
Size 3KB
SHA256 b77e162042c0c3305385bc2aa08ed58a8733279ff3cb395f480146623e5cf96b
MD5 afa1e3bc30dd472e4344435d4bfbd818
SHA1 f77cf9fca8979cfa9450dca5e00d7ee8f8c5eccd
SHA512 5991215513b8bc59aca781990c175efe46d526dfb0f8538e4caf9889cfdfa454032d98e38850abeaaf853e8f72fcbd8b4dc0c014735219fb10c228cfcc155ec3
TLSH
T18B619CF787B4856E8A1196F0AA18EE2FDF2D0615431C3C6989D4EE27D3F3472E10265B
MD5 SHA1 SHA512 TLSH

Submit Download

cd2df58b-f874-49b0-9a61-62e16e5c4e24.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\cd2df58b-f874-49b0-9a61-62e16e5c4e24.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

fa97b577-459a-4c52-bf5a-ee6d1508a049.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\fa97b577-459a-4c52-bf5a-ee6d1508a049.tmp
Size 3KB
SHA256 53000831c8f0102ec955a668f4ba747daa9a93225f084a26bdeb912cb50fc5c3
MD5 24fa280fa527980e1c459932e8c2e26e
SHA1 3bf38e2651ed8986117784e856ed2b02c2f8da56
SHA512 5163afd99a58fbd233e5d86197e53bcd025c59f45e07ef988de3a21d57748fa03ced73eb8f7b63e614223ab17e13daf6177ad42507ba953972fd2e106cc714b0
TLSH
T101619CF787B4856E8A1196F0AA18EE2FDF2D0615431C3C6989D4EE27D3F3472E10265B
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 edf352b2d92c5ae47a3713f1c1fa7227bb413208e7b1d45b7cfc49b0efbf49ed
MD5 e3b63a97a2c13debd11d235efc09a8a8
SHA1 8b5ad1c977431a869458cbc836ab495c32f566ba
SHA512 e8ec3782b921024f3ae4609fdc3445a855eede94ad19611c65d731ebe3ebdcbac75fa6a531b3fc61349df24f642a00199de6427fb698ae3681836d28d4ce4536
SSDEEP 96:KQ7+Kko2CCoKfaYD+KUwefgN0wamCc62fHsIcKUJsicl:YVHS1fgN0wamCz2fMIsJsiU
TLSH
T191A14111B27B8A40383E2D1841B9CA5F56563173305DAA6FBBBD66F95E2EE000DFC4C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bd0e1db1-851f-42b1-839e-a5d25e7ed6ac.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\bd0e1db1-851f-42b1-839e-a5d25e7ed6ac.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

d0fa557a-4ef6-4659-9f33-fd8edae725c7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d0fa557a-4ef6-4659-9f33-fd8edae725c7.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dfc8b2f6-c98f-462e-8e2a-ab1b42b99926.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\dfc8b2f6-c98f-462e-8e2a-ab1b42b99926.tmp
Size 11KB
SHA256 6912c781f502982cf6dd29dd9880c5cd01df381807a005e9f6d71670c0754f86
MD5 6ab6852fb4098a8fb7ed07da0fa279f4
SHA1 33252d96ace2c03af3def7bec6bf6a88bf6bfbe5
SHA512 29339fd6432b0764ae2d2d7cdaec1543430feb9f3085f824bdee11fc45a1db65df1f14a5deda413753206b8165131e1456d5009943133a1c0aada90b6f454972
SSDEEP 192:sxZ0RJ8z/fAsv+M7IdpwGHW6+WNr5+/AKrC9Ir4Ig5lJ:sxZ0kz/fAsv1k/Hbc/yx
TLSH
T11432C951AE34A93B8CCBD21DFA55BB53D6F9103291D11E48BAFC851C05EBADD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e4337041-b99b-4d27-92f5-1285a510f955.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e4337041-b99b-4d27-92f5-1285a510f955.tmp
Size 11KB
SHA256 c750651a8d65b82a48ab315c681befd95ff1739d35f1a47ddc068896a4a4c773
MD5 bc379c826432fbab7fdab026c451d555
SHA1 0c3479f1281f7cd61b5588985a536e93ebee245a
SHA512 65ccf215bf786792e370921ec0bf415bf684d5d631349f5db850add43f40ba444969e1a6b82fbbe4d050f020e2972343899db55c9093e505f4ead0b3d184710c
SSDEEP 192:sxZ0RJ8z/fAsZ+M7IdpwGHW6+WNr5+/AKr6UbIr4Ig5TJ:sxZ0kz/fAsZ1k/Hbc/EaD
TLSH
T13632C911AD34A93B8CCBE21DFA55BF53D6F9103291911E44BAFC861C05EBADD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

09b61af6-46da-453f-9ad5-a9ac76b4d64b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\09b61af6-46da-453f-9ad5-a9ac76b4d64b.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 71d2490178491a16ca1194c8d5b114a8f968e295c911b3a4807535e72358f8d3
MD5 0ac0d1c53d74cf24d265dc04fd62ea7c
SHA1 7a362f75facf4dfb0763ea4149eb6163e90f7016
SHA512 6b7c39ce48ffbe57e274cafb30c05c9437a3d1df5dd609b47244358ebd61f2643f84a938eecdd9e76735d8d2184d5bf8ac24996b935225617921003e2064affe
SSDEEP 384:n5+QkUSv4sNEA34/LYwBPbW/duS0hZfEUmbuXZFh7E02I9IIlU:5u4D8SzW/Z0HEF+Lh7E059L2
TLSH
T141827C316C78AC2399FAA201F14A36D3CFA42067D5994F84E6D96F1C01CE2DC275BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

43599863-84f6-412a-97e3-a7cb9ced0887.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\43599863-84f6-412a-97e3-a7cb9ced0887.tmp
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

f0a13177-6573-4f98-9d80-c6c6beb5d6f5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f0a13177-6573-4f98-9d80-c6c6beb5d6f5.tmp
Size 18KB
SHA256 7d271078f5cc20cd94b3c6947db3a1d4d81462815b7ac5df342dffe4d6109af4
MD5 13c4b969cd6647342a6be657559149bc
SHA1 d73103c9a873a7097e260c7fe041aacf97d27cab
SHA512 b5e7fe80e7af213b0d62a3b98c7b5c2eaeb6713d89bfa8164c3e29008e9ef1f60112ce035aa0f137f02a3ee6c60a2a820f59e7ed3744bdb11587eabb1ca57873
SSDEEP 384:nR+QkUSv4sNEAC4/LYwBPbW/duS0hZfEUmbuXZFh7E02I9IIlU:Ru4a8SzW/Z0HEF+Lh7E059L2
TLSH
T1EA827C31AC78AC2399FAA201F14A3693CFA42067D5995F84E6D96F1C01CE2DC275BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f41fa2c9-e4fd-40ae-aa55-7363a22d3b51.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f41fa2c9-e4fd-40ae-aa55-7363a22d3b51.tmp
Size 18KB
SHA256 3ea5970bee390316ff099c3962ade47c08b9ec14bac8413e35e77f559bffecc2
MD5 b3f110ba08d330e931433d6acd626c2f
SHA1 d47f379fd89ba8d54fd5ad533399d496a4cb0c0f
SHA512 24d0d0611c013e59c57f808ea1c36fc0a8d18bc644e2075b6c472f6b40ca710e2e847200e711cf54309f07f6e67be8715631d156866c017e4483ab03397121b6
SSDEEP 384:n1QkUSv0sNEkC4/LYwBsbW/duS0hZfEUmbuXZFh7E02I9IIlU:P0m8S4W/Z0HEF+Lh7E059L2
TLSH
T160827C31AC78AC2399FAA200F14A3693CFA42077D5995F84E6D96F1C01CE2DC275BD13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 6e49fd34c3d763484ca3b062788b9aefdafef084091d93336f7377745190d791
MD5 65514b28839306748057a6860a5c7f2f
SHA1 365b5f101bfb02b19467a060f3918981f3ef49bf
SHA512 8f33f92dfde613675a127849714b2a634e25f7860d50bd95608520c1b7023ddd338fbf6faf698368c85b6f2c8ba3a8ae58b78d97a54a54a7e9527d04fc1499a3
TLSH
T1F6411858AAEE1108B3B76E5A9BF6986D947FBC772E56D55E00110E4F0673E00C4B2B33
MD5 SHA1 SHA512 TLSH

Submit Download

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\z1fa97cg.default-release\activity-stream.contile.json
Size 4KB
SHA256 abd33eb4037c7650ffd647d0decc226a1c679b1a1f671ef93f285ca9d50afd17
MD5 2d042a24380de918c84e122b25520438
SHA1 df68adf12db1bca43c287176e99bc5c03a839b3f
SHA512 e2379c2f621eb3c894f9f6587db9b0df951182a28e57ad09ccffe5cc3d86f2e89fce3906d24f8cd2f0dc94f4f14861dd68456e972a3a5911a7ed9a3bb21e2627
SSDEEP 96:THqIMqrRHHmVbH4/T+mRqZnXR4jU9cq5Slz:dMiHHc4CmRqZ6jUuq5SF
TLSH
T12F91A65F847598232730EAD5AC4F3268F1177009DDE4DBAC71B95C61866C3EF81CBA89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\z1fa97cg.default-release\activity-stream.discovery_stream.json
Size 75KB
SHA256 93d14844c47a150b86fca52289d0df2bd82e979f333ea1448df9d8c8f3b2f980
MD5 a63697c3dcaef36c85692248e0d044ed
SHA1 9dfaa5b853402024e2864a62518d0eff793939c0
SHA512 f568d4300b58fc6c6b37e1f4a3a6ecd118f0a19e24d1d8b20a3e9eb9f80f1729eb3616e3ad771f50fb5b49ced15ca5bb27fdf5c8ecfdb706da24e3aa1e9deaef
SSDEEP 768:igyJSOr1z4L033p0X51MKfiUU6+OmMuJm84+L+GG35ALsrQ:i7JRdg033pwOKfPU6+OY4+yGi2H
TLSH
T183730AA3D6E8B1BB0B9137C72C0F7A57A6920186E38605CDFDEDC91D81CD655023B6AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\z1fa97cg.default-release\activity-stream.discovery_stream.json
Size 75KB
SHA256 9551ad7b6913c2f74976ea7eb8c45a278ef5dae5844ad0c3b702d2f8a1650935
MD5 aa636b76f373040fe2f7cc63602f9f57
SHA1 ad6e6d18189e2decc96ee8455db1e786bbc43b06
SHA512 95e8682f643f6659722fc0bdf45f71870e964b9e7aed45595e63a809b878bc86c7f4efe5eec520abe1315ed4665ec6872a23a37f022758958dba57f807e60ce2
SSDEEP 1536:i7GuOPhFSSqpP/Q4uSF6gkIlvz5F3/4qGtXg8MwNaf9G+DNaoJFAwwJAUO9eVi3T:oXiyvzv/P4V+3uijh
TLSH
T1F1732AA396FCB1BB2F9177D72C0B795766D50196E34502C8FCEECA1E80CD654023A6AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.weather_feed.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\z1fa97cg.default-release\activity-stream.weather_feed.json
Size 14B
SHA256 1bead770ec2d7afc6ec1e9d35383f40ef676591e079dece21c38db17c5c24a20
MD5 3ea4da2ce03c4204ffe9b30074d62fac
SHA1 b6b82844f7ce93098971fea6f2559b220be08e2d
SHA512 dbbbee11f26deb954124b96d0fb7748ad170d9bab095f79691c83fb1dcfe57b453cd4ffd6a367c701d86bd676d40aabde7a390ecc57e2fcbd0c545d9940a41f2
MD5 SHA1 SHA512

Submit Download

16629

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\z1fa97cg.default-release\cache2\doomed\16629
Size 7KB
SHA256 e6ffa854e0b4c3d24ed7b11bcceefdfde60dad77e8fa61bf6f4165b8d863595f
MD5 bcc2b611294b035a407c91c375a1db9c
SHA1 32c8ff391f72c77b5db10b8a3991493be8e770f5
SHA512 c9b3c07bfa56ff1524f35737b82065f4e6f3f685ab77d52dbaf7a29d5421b11437e3152a1a677662e20ec122089b07b254d77f54a3d8579a3aefcf747fe3e4a3
SSDEEP 96:EMHSttoRgbxV3pkYctoRgbxV3SivjCfgp+fY3GqJmIGLx7JmIGLxKoeujm:2YRg7C0Rg7CWXp+fY3NJBOx7JBOxKFua
TLSH
T18EF13B3F4E0530051AD78AD1C00A364E6C51BB47EDCB99EE92882793DDC46B06AAD1EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

29341

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\z1fa97cg.default-release\cache2\doomed\29341
Size 7KB
SHA256 1b005306372ed93b12ff1d7ced4e5e756fc3f90869f725174554bec6dbb7278b
MD5 856f9a671e97a779f34bfd156830d2db
SHA1 965f587be578a5377e4842654f9f9c48d3ef27ed
SHA512 7ca4e28605fc56f54e023bb6764bd380838cb222ba88ad6ae277901381bac75f8ab6ff858698addfd327f8ca6d110192ce36d90cfb741f09de8248fd283935d5
SSDEEP 192:eFmlr8HpJdfQLNgihAGXmapAjMJfiJzhwUykUK9deA3deAe:8XJJhQLRADMlszPy+n0
TLSH
T12DE129BB2A1420E40FD21D92DD79E78A6C11EA47D45B91FAF85033C482C8BB1B0C26CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3897

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\z1fa97cg.default-release\cache2\doomed\3897
Size 253KB
SHA256 3a6a524038f3ca71cdf8d1ef8f2ca9a10ab5d61016cb11815dd23c62b5c09e5c
MD5 f82bb5d375bcfe453c2730e9e349a08f
SHA1 0083987acc95defa0e6bc95c7e9ae6514ffcecd0
SHA512 ee38ceae54855222434c4a4a193b3131f415bfd67fc7ab1575272a567bc0b28e8c6c2e41e648d8116494a586821d14c68d5b1da4cb4d2e043652b590c587aa53
SSDEEP 3072:rKHfmaK5SY/Bc1gG1BTLGEUQOBy9+6TLyBVr0:eHfmaK5bc6dy9t
TLSH
T13C44F7F3D6AC30FB1B5287DC6C0D72CB62AF4179DB5209DAFC6C8148C2C9A6510B6799
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4180

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\z1fa97cg.default-release\cache2\doomed\4180
Size 14KB
SHA256 8f82afe496adc760f8580a9c0a0815610ce08901885f9d6fa01bd6d9f63d18bf
MD5 f8284192844e84b5e84830d122c9e905
SHA1 3214a2ad00c11b2741e47e6dd2c4c18ed1694db8
SHA512 e19192f7741965f5ebf2cd5a9582956cca4f7d8c5c55dd3b56da276dc7800dd3bdf0d3091fb7040e974bf856123115292815b5070f213cbfa11c6bc760b6865e
SSDEEP 192:Elr8HpJdfQLNgihAGXmapAjMJfiJzhwUykUKuHS34gLblS34gLbl:lJJhQLRADMlszPypHS3DS3D
TLSH
T1316232E5A822255C0B334D11E93E33D928349157D485ECEEC439A2ADE9E073772C67ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4496

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\z1fa97cg.default-release\cache2\doomed\4496
Size 52B
SHA256 78b516e50d6e0abf8992c308d9ac41e3d806c54cf0af0968b812a95c522ab34b
MD5 af0f4fa0492bea5230b9f4bacfbf9cd2
SHA1 88b1145bdedf5aadc2179135ad3307413864e597
SHA512 8c9ce8f13138f1703c4da2975b7903c7b2f087bf69e3ab4dd437f6e7fd96983e25fbc651c6f63e5a88bf5a679ee77b172aa1968b5cf1ba45720f446af0aee197
TLSH
T1869004444F51D701D355C3F51D11C0F714D43D0044C003137FD11F510F154F34001144
MD5 SHA1 SHA512 TLSH

Submit Download

8414

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\z1fa97cg.default-release\cache2\doomed\8414
Size 256KB
SHA256 ef2214d693be7160fcbaf39296f15db39ef813be5e1a77fa59cf43cbfa0e1c29
MD5 d76adcb9e45b1c00d75f711fe2615a76
SHA1 7b03f7fc1f4d647c26dd0eefcd6900ccfec26305
SHA512 29447f60f489ccb7b080328f11121d82c3b157fc4fd5f61259c7d77ef4f4c0860a3f00aa2621d3f9a049d0a4928f26f1f0fe6e91e4a9ce4ba694a11f1a1dfd72
SSDEEP 3072:NKHfmaK5SY/Bc1gG1BTLGEUQOBy9+6TK2Zj3+:4HfmaK5bc6dy94
TLSH
T1984407F7D6AC30FB1B5287DC6C0D72CB62AF417ADB5209DAFC6C8148C2C9A651076789
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

06A6D86B39A0E3DCE68006525D21C3AAB6C8E0B4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\z1fa97cg.default-release\cache2\entries\06A6D86B39A0E3DCE68006525D21C3AAB6C8E0B4
Size 16KB
SHA256 ed7c182cfbec0901f36ae683037f7ee3f62e7d6d277fa85fe24c9aee4f6b7d92
MD5 0c0f5b541bdbb2900b8d5970c022dfa0
SHA1 0c9f733376f8b84e687b6f19d51919dc75c6ce83
SHA512 7756b15405eac01b8b1d2ac026eac2a61ecbb595778e5c9af25a39d46686f49c13ff67054fb5668d6de7449fdb7c6700a9284030e89091ddcbe9e0100e2d8467
SSDEEP 384:HXwIiO024YyWTT78XJWTT78gB7SOEAd9KVRaAcP+AWRMAbQ+rl:36ZYyWTToXJWTTogB7S/AmVAf+hRMUxh
TLSH
T1B0728D7D9F013CAC176790E8C8B983558D1CB2ABDFF5C06D259C3E09CA8865670F985E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DF9C2F64DE858672749721C1F688EB8DC4D3B4F6

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\z1fa97cg.default-release\cache2\entries\DF9C2F64DE858672749721C1F688EB8DC4D3B4F6
Size 354KB
SHA256 64e2fc791400fdb370c69d6cac86ce50273f993236e40ae6f22cc4b0100a526d
MD5 1adf4660903fd81232780ee05ae92094
SHA1 ee424e6761c09bb1ded11493bc447f1fd4bbc0f0
SHA512 5a06177f568938ade8ec1c1f0958a06d2bf09a1770c71bbd2a5970454b1327b75a314bffbbfa980a73e478c18c0be3976bba6e612a50677d1fccfc07cbe078d2
SSDEEP 6144:lydQII9pOs9yUxtm8wdzKNt6tpTqH9qQSemZEQySrLOgSaKOywujg:cI92Uxad+XHlSemwOOg3uM
TLSH
T1EA7423F4793A842280F8D4D72E3A27933450A26678FFCAA552D8230ED2ED34C5755E7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E9338C5CCF1E2FCF149487351399F198A4F9FCD6

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\z1fa97cg.default-release\cache2\entries\E9338C5CCF1E2FCF149487351399F198A4F9FCD6
Size 16KB
SHA256 3f556fe3b7a767fe341f9aa187c485651164571538ba7b032397047a6e76716b
MD5 ae7b8f0457f04537d095138ef9efce82
SHA1 9ac5d76e311670299f52c61d0d4df8ea53dbd6b1
SHA512 65311afbff3e655660c0c37911ca72eab41fa0c11a68c80ea8a26b7c73f6b065ca338e69c1ba8ed61a7ebac1090dd795d1738a424129e373ab5c14ac994c40ff
SSDEEP 384:HGNQiO024YPWTT78XJWTT78gB7SOEAd9KVRaAcP+AWRMAU:mDZYPWTToXJWTTogB7S/AmVAf+hRMB
TLSH
T167729E3D8F013CAD175790E8C8B683598D18B6A7DFB6C06D16CC3D09CA8492A71FA44F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\z1fa97cg.default-release\startupCache\webext.sc.lz4
Size 105KB
SHA256 f8045547ddc87fafb36a9aed7866c463f9aa4ced8acca9f4a8b971af606441ed
MD5 cff5825de7cfa33bea81614d57a61255
SHA1 5376a3e21d0727b314650ca5f883ee144c44e932
SHA512 e030274a773661238e36a0e6f1109832affe483b9c172247758710d037cfc05bff33952e7840680f13264f1f3df6a8bed4d16dbf0683b339f033bfd13ed154c1
SSDEEP 1536:XTrli8KNw0eKKkRqEzQr3QaI1huwbu4yD5H3OpT/4n4a0dgs5IaKSh+tecvJ0nnv:X3liRqEErtvdD5H3OTdHFKNt9+2lTjXu
TLSH
T1F2B3AEB7DFA28D3D69FFD42C6BC2843EFD222414B3A73019C963265062C7B646679648
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\z1fa97cg.default-release\startupCache\webext.sc.lz4
Size 104KB
SHA256 a2b297c8f3efba4a9bf7c229197c71d24bc7eb8fab31404329d462795a0ec0da
MD5 5e7981911514fb36c50dcda7de920467
SHA1 a2d3c85a3091e64b3551f1c4ad4c1a7971373006
SHA512 fb834eb9abcf979322b984e31ab63292653657d00ebbf93ae044258e7c4be6be3d928965ba655dbc2d1a17b5fdf32d32c1e5a47b204d49ff822a0e1a5bb47131
SSDEEP 1536:jTrli8KNw0eKKkRqEQLj1cK3UouIlP/pD5H3OpT/4n4a0dgs5IaKSh+tecvJ0nnN:j3liRqEkOJ4D5H3OTdHFKNt9+2lTjXY
TLSH
T12DA3AEB6DFA28D3D69FFD42C6BC2C43EFD262414B3A73009C963275062C6F646679648
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7fac1a5c-9323-41c1-a9e5-84ffb95eeadd.tmp

Path C:\Users\Admin\AppData\Local\Temp\7fac1a5c-9323-41c1-a9e5-84ffb95eeadd.tmp
Size 158KB
SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
MD5 9c18c4721b560ec55f0d5de055144d5c
SHA1 6af37a3bda916cac276ad5879c9f61262d9ae523
SHA512 51466928eb8d3cf7b917919c98bd8168453583d2c3dc5836036d87ffd0d2c732ab8450212a880fc6de199ea569a96993ba0d250a5012160d2d72211880695f92
SSDEEP 3072:5ZwEurOxn8zXnHc2qHNYEU/rUHCVJWGdi0Ha5HnXk9TFzBsuht7yGik:5ZwPOx8D85UIHEI0HaZ09JzKStjik
TLSH
T1CFF3E13E7EDE891AD80B10BB7F16B18BD80D8E0B460AB44B769D80155B3668D1BD1CFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9f097a02-33c5-42e6-b61a-8eb9741ba6f5.tmp

Path C:\Users\Admin\AppData\Local\Temp\9f097a02-33c5-42e6-b61a-8eb9741ba6f5.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.14_(x64)_20261030145733_000_DotNetHost.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.14_(x64)_20261030145733_000_DotNetHost.log
Size 4KB
SHA256 e046f35047776de9df7ff0b9cb11154cd75345f09d908446b0234647cdaa5b8f
MD5 920b7007a3b5a72a6ee6458078dd8f2f
SHA1 d76d18c5baaf5ac4cbd671ecac9b6e551c74a9cd
SHA512 765cf7db6335f193251639be2ae1cb177adf152435a1b0342beb07a90e200add288397589418bfb739043d47e3dcfcd7beab1f41d01833cafba912f3dcd83440
SSDEEP 96:Y++UPsTcqRuWahOlTC/Cn6VfviRuWHz6RuWF5MKFMw:71Eo7ThOlTcs6Z2jKFJ
TLSH
T126813D251AE40946B1BB6747DFF38012AB73FCD5A934CF4C2346821A065B80598BCB7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.14_(x64)_20261030145733_001_DotNetHostFxr.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.14_(x64)_20261030145733_001_DotNetHostFxr.log
Size 2KB
SHA256 9a0de6242b2226e2f99e11c031eaec5dcbc2c9e84d5b4f9f76e1ec123820c0ae
MD5 aae25a048103087d29838aa828b48144
SHA1 34deeabccc84a6c252379770db2a7a4a9477e9bc
SHA512 8e9c5ddd232248721d2c3eb0e8925e3b000bcbfa1a3d4e1cfa26e82d193d856df3b3fbdf1cacb66cf6984db5a9c3d3e9f5d33186e699a6ddba8dc7a7b548b039
TLSH
T17F413A211BE5090BB2B66747DEF3C1128A77FCC96874CB4D2246821A066BD019CBCB7F
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.14_(x64)_20261030145733_002_DotNetRuntime.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.14_(x64)_20261030145733_002_DotNetRuntime.log
Size 2KB
SHA256 d7caa80afb5033b330eba78a2cafa8ae5ac28b93ebbfea994ab74c337e5ef407
MD5 3ab7ab87d29fcab80939068e51d2a6b8
SHA1 43cbf5446d4c67c54875840c61244eae48fae3a9
SHA512 4ca64ddc7b5c6c6526c773a1d757f296212eb81e13f107e66bfa87716dbf8d9f25ab8c8d2d0ca6f09b2add8b70bc142e2d2a3d6dde19eb43cdb1d5ec48697d1d
TLSH
T18341DA661BE40906B1F7A757DEF3C1119A73BCC99838CF8C1346811946A7D01ACBCB6E
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.14_(x64)_20261030145733_003_WindowsDesktopRuntime.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.14_(x64)_20261030145733_003_WindowsDesktopRuntime.log
Size 2KB
SHA256 8b006e0ec5d7b47dfebd959d2fcf8bd2ac8eefc46873aae5ef345257c362e096
MD5 dffefcd51874d64209828709563e4d87
SHA1 02f45a875f67a16d175a5e00041518ab55e5f3f1
SHA512 f4dd458065e63cb9b4dffe98b31660b88a7a1740564307d3861b1f25ac36f5000632ad27af6944e2eb0d8f893fb45fbdcaae73e739d1afd9afeba8dd7b0f1117
TLSH
T14B413B111AE4094AB1BB6753DAF3C022DA73FC956830CF5C12478219066BD005DBCBAF
MD5 SHA1 SHA512 TLSH

Submit Download

b05df755-926a-4e5e-bfb4-fbab11af5a9f.tmp

Path C:\Users\Admin\AppData\Local\Temp\b05df755-926a-4e5e-bfb4-fbab11af5a9f.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4384_1877257753\CRX_INSTALL\_locales\en_CA\messages.json
Size 711B
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
TLSH
T1460197136240AF18470BF05BB9023442A0B44AC62384E0B775EC982C6656DAFB20B3B0
MD5 SHA1 SHA512 TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4384_947997296\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 21.9MB
SHA256 1090c5d6881985c042370d506e15f1db1d0a88bfb7e9602a9202fac421098eb3
MD5 322a050bc53af9aad7a659054354862d
SHA1 44dec61c400db851b57e4e2645fb253609db7d1d
SHA512 ae8624becb7619dd9602f416203c54096ae0e23c4c2574c8069e633f9682b0b9bf5bbb95e94fca6610b9581746d5ed648fd41c47d762b174bd5d632937df6689
SSDEEP 393216:vKuarWwW0LmrEr38dudevJCJU2kpq1gL2aVRHA:wWCmz0dwJIkpqCs
TLSH
T16337E14AE35310E9E81ECDF4866E9A62E4343C4E03319BEF17D47A355A727C42A39F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetHost

Path C:\Users\Admin\AppData\Local\Temp\{41784213-E3F4-4163-87B6-DCA72709F3CC}\DotNetHost
Size 848KB
SHA256 abf9056691ac5c463120c59943bcc7b3ff8cc45e9430f5260d6383108f0f2839
MD5 533c8600ced609c8c4293ffcf5795817
SHA1 a7cc343e6a9e2d2eecaf468d19b99d2f35de768e
SHA512 d0a4a2ee79d39cd9f7a910d7d5f3f86e47cbf41ae8bf7a963fd1dfebc83455eea346174719127549f9e67bb2618e24613a94c9d4928e73c7e9af4f33c7fbd675
SSDEEP 12288:eBGQ4cABdUb/aVo/2WCsT7pXJS5qgBwhYysWPuoi:6GyASwoO2T7RgZMYnGi
TLSH
T157055A1BBF9414A9D8A24EB1C4B78721FE357C082320959F46A4B12CDEFB6E4647B7C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetHostFxr

Path C:\Users\Admin\AppData\Local\Temp\{41784213-E3F4-4163-87B6-DCA72709F3CC}\DotNetHostFxr
Size 920KB
SHA256 b26eb4b947543ee2becaf5f71d8736f5bbdcb340eb1259856bdaf64bc11c7782
MD5 db32bbb9ac147022d38539d078207f81
SHA1 3f896332365a4ae79b8aeb632a1a66e4f1a323eb
SHA512 940497d8c9316abf312a32a1ad06fe3a8a6cbb498bf9c2c461f28871b0488f2295d77d0aaa3699ce16bb873234dd4ab58f17d0e91c34f7433f3b185c41478162
SSDEEP 12288:lBGQ4cABdUb/aVo/2WCsT7pXJS5qgBwhYPVJTJ+VDD:TGyASwoO2T7RgZMYPVJTJ+VD
TLSH
T17D156B1B7FA404A9D8A24EB1C5B78321EE357C082320959F47A4B12DDEFB6E4647B7C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsDesktopRuntime

Path C:\Users\Admin\AppData\Local\Temp\{41784213-E3F4-4163-87B6-DCA72709F3CC}\WindowsDesktopRuntime
Size 28.7MB
SHA256 cd1659987ad005184e83139f89fd0f073005916311f3426ae2152e0fc942a2c9
MD5 0b2ce5df5008f401e907bf1e6cfa29f5
SHA1 c89c7788f505ec043ffc7501c88c1cbe0c7f431a
SHA512 325d3d756a05c96bd78558daf998a9c4a4df47f6e1c1cd5c6b426e7942a25be6c46b8dc13d1581942097b2889dd6ec79af14e6b5fc9ef57b1caab932f85ae1c5
SSDEEP 786432:rS0wapy/3xUTNEO3BpWyEtxhzdlR8vQdVl5cSpxf4WCy5UgmHM5:m0wX3mTOQcvtHzdz3VxAkvmo
TLSH
T1A967332B7FA1189AD5778EB584BB9314AE3A3C082700954B4268B54CEFFB3E41577BC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppSettings.json

Path C:\Users\Admin\AppData\Local\Voidstrap\Config\AppSettings.json
Size 12KB
SHA256 108e70889f3bb54501dd7220c6c5da5039a123a721f020373ae6247e26689a28
MD5 9dac6b1e7523c678fd38a92b9099f6bd
SHA1 69ddb2d83e25fb2b68c1099c97d372611d77129a
SHA512 0189073899d8598251e072620d34a90fe6e296c84419e7210912e84ff3f38fbceffa4cb6ae8a958fab1d8c6155d5df48e5b706b00ec3823b5d0dd1c1bcb8d16f
SSDEEP 192:ebyCTNirbELBNoRIkSVSot8Feb/1lBvZyPd4jS1qtpNABJMY/FPm287cwvIXl:7CAELLI+Zuuu1liY/kh30
TLSH
T1CA42DC21C81449FE29FEE11C946D9243AB654F2721340C6FF6FB2A0D1776A373181F9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppSettings.json

Path C:\Users\Admin\AppData\Local\Voidstrap\Config\AppSettings.json
Size 12KB
SHA256 3460766e4e2f31cbeb727d71809874f95aa7399f003148b8467fc754666b5abb
MD5 daa3e93763d7bb99e3d76bad4c226257
SHA1 c432ead4c4c6d28f6fb7487e1c7b93119bf466bf
SHA512 3e239eee6d93ce44591855b2f7f5d0c893dcce9a2d62c416d990a3d4574034095e776ab37b8709a76d77a22f4663acd90783eb130e0cc6f29252a002dcd66549
SSDEEP 192:ebyCZpBpPepVNirbELBNoRIkSVSot8Feb/1lBvZyPd4jS1qtpNABJMY/FPm287ch:7CHnELLI+Zuuu1liY/kh30
TLSH
T19A42DD22C81449FE29FEA11C946D9243AB654F2721340C6FF6FF2A0D1776A3B3581F99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppSettings.json

Path C:\Users\Admin\AppData\Local\Voidstrap\Config\AppSettings.json
Size 12KB
SHA256 a8dadba52c60022777d37be48ecb9e98ff3ac388e56d2a45bc28e09320edcc8b
MD5 76cf5814e06fef295d7a37448fce5384
SHA1 db7cd88d906ce5ef46d4cb135c69c3cd0063bcb4
SHA512 701c5d28714fb0d5e9902acdc86a379a74be20f480ca6954cb2d6d75e4e6b38757b68e62503d25c942ec1287d99322b321a544ff492a3557074e1c4985e5dd56
SSDEEP 192:ebyCZpBpPepQNirbELBNoRIkSVSot8Feb/1lBvZyPd4jS1qtpNA2JMY/FPm287ch:7CH2ELLI+Zuuu1SiY/kh30
TLSH
T16C42DD22C81449FE29FEA11C946D9243AB654F2721340C6FF6FF2A0D1776A3B3581F99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DownloadStats.json

Path C:\Users\Admin\AppData\Local\Voidstrap\Config\DownloadStats.json
Size 62B
SHA256 9a6b96581ab83f8b22258b2abac541976d07cee9cd3d8720148a28236cef5864
MD5 566603cf7ef5cad897edaf02f798cb3d
SHA1 2a6391ca90008f897930c379e64ee227acd71f6a
SHA512 48646d57eeb7b6446ead14cb8b0be32ad3bc2d4304d75b9fe0bd78705a2cf183af28438c761244d83aa7a19c4f2759093af29f7612301cbe7423f8e6ad8f7387
TLSH
T164A0026F3947971D20A52184150D119005860852736075D94BB1264A8571C300060B03
MD5 SHA1 SHA512 TLSH

Submit Download

RobloxState.json

Path C:\Users\Admin\AppData\Local\Voidstrap\Config\RobloxState.json
Size 637B
SHA256 91d2a011c3d861aefa1730442b8a40f65891ff5cff36248b3fd9f9261d0f53df
MD5 6e96472f1666dfac6a5c18c017373a66
SHA1 13438bcbd98672c4ea14b3b1fb314c596e76b947
SHA512 a39776deede83c6928572e467cf1d1bbd2cc34d73d9d0d1b537033f488c5fe6960ba0aa83e8974d1003e0ce04bd29400ee87870ac6c72bfd85ebfc2b142b5cef
TLSH
T15AF04F02CE6A1CB722B17216783E3653FA90879B12500D8BBA72AA1C0F7747851E49B6
MD5 SHA1 SHA512 TLSH

Submit Download

State.json

Path C:\Users\Admin\AppData\Local\Voidstrap\Config\State.json
Size 1KB
SHA256 561c832e4e9518faacc6fb801ad1d164433047e83fb3e3b2bdd6d7f32d34349a
MD5 14c81baf8028dafc8b3bf9afd07f3f8b
SHA1 d0934e88333047265397587eb352616467405fef
SHA512 74c2810bfb91b7a11f3ca7a391c0d2e1a904c2c046ad0bcaacfe35047dbbfb6a834beed824f5b2830c45bd8353c7cd3ca02096a9ad0e2a32da1195e29b2cb310
TLSH
T15F410A11DE651CFB62B422297C3D7753FA904B8722600C8BBBBB6A1C1F7753811E4BA5
MD5 SHA1 SHA512 TLSH

Submit Download

State.json

Path C:\Users\Admin\AppData\Local\Voidstrap\Config\State.json
Size 1KB
SHA256 3e3862b75449fbf8447a09a08d6f05be7695c1bb5a350329074d186050e4a597
MD5 7d555af88fd046c933c94286583a53c6
SHA1 559e33f719fd2fe8608d1fcf5dd5aac6fdc2e69f
SHA512 0fe970927022cc3254733a620a7b19c677762296d885a8de441762f9c295022cb28e5397c3430c0d0e90089e47dc6d619a0a57ed10b8424f5628e520ac98f2a1
TLSH
T151410A11DE651CFB62B422297C3D7753FA904B8722600C8BBBBB6A1C0F7753811E4BA5
MD5 SHA1 SHA512 TLSH

Submit Download

State.json

Path C:\Users\Admin\AppData\Local\Voidstrap\Config\State.json
Size 1KB
SHA256 b5817f30db00675543e9507f0f61cbec44248b2f3488b1c02c169090c1849c96
MD5 62ca357f89b90582f3e3e3f8e2f366bc
SHA1 629a3bec61f06574f25562b56ea746921e6348f7
SHA512 d63d627459a6c775bbf5a306dfce1d0be6a623f3ccd94c674965dbc27ec36d2cb4314d26ca79b7977aa36e11459e3ba08bed37e4e8b094eea4b68bcefef81209
TLSH
T18B410A11DE551CFB22B422297C3D7753F6904B8722600C8BBBBB6A1C1F7753821E4BA5
MD5 SHA1 SHA512 TLSH

Submit Download

State.json

Path C:\Users\Admin\AppData\Local\Voidstrap\Config\State.json
Size 1KB
SHA256 026795527be3aa2999927877c808ef742c9e9a18d77eb686ca53b45618783c18
MD5 7d663fe3c2f64002e612dccfbec39f77
SHA1 00547517c2337aea8a883c9174fd2e9fb7543ebd
SHA512 cec25c2d0fbf776f76a274685d6f652ecdf3da9f939dd1cff49ab3336c6a6c6c61eee676e21f55b74fa0cf7877c3184bb5b973be7af53ba15d52a5950b0822c1
TLSH
T167410A11DE651CFB62B422297C3D7753FA904B8722600C8BBBBB6A1C0F7753811E4BA5
MD5 SHA1 SHA512 TLSH

Submit Download

Index.json

Path C:\Users\Admin\AppData\Local\Voidstrap\Data\ManagedMods\Index.json
Size 35B
SHA256 e3855dbcaf260658816c8eefd431af03ffd4637187d2595333b06d7b8f329264
MD5 ce83dc7fe490c3577c65c196503846a9
SHA1 2042b7f1eea936256574c0f1c58bc4745e0b2595
SHA512 63b30ea420cf9f166b87d9d2cf479aade601ad8812c43ee1a5804e137d8ca96c276913d18fe47a685fdfa9ef0f8a3178f74726f7ec82ad8a68c30104a4bfb58c
MD5 SHA1 SHA512

Submit Download

ServerLocations.json

Path C:\Users\Admin\AppData\Local\Voidstrap\Data\ServerLocations.json
Size 7KB
SHA256 c0ce67ad2b75d45e176ee92e5e8dc44eb30ca812e1938b53deeea67b6a55b3ff
MD5 50c4f9e285c3cb8cf95dac4972ee6271
SHA1 c58db4b3d8501881688fd4b356e381970632e9f2
SHA512 40a909a913f89cf84674879e3effd7fef71398fdca1c0c4fca0a5afa92c7cbe87c10dfda491d753c9dc0d16d83ce0c8f0b7bb58dc28f6d3d184586c5f19f2726
SSDEEP 96:Zcmb+8NXorFiM+dVKUo5wCsFyMkQbVPiYrD4UmiN60C1itF4vglnI5MgarDwvJoz:TOZzx8
TLSH
T1D7F15A18D1B41FA7905A9194356B4D0231641BFF2DA47AB93F4E325C8F4C23F78BAA2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Translations.json

Path C:\Users\Admin\AppData\Local\Voidstrap\Data\Translations.json
Size 7.1MB
SHA256 cb4caa54bd6113b8f8223be71c233a135bce640bb10d17469690477673ccb611
MD5 397255b2641195c7d0d6c9412785120b
SHA1 c3f3e4372f4f5150bd808eba676eb8c589591c3d
SHA512 8e22bdf48416ece484a676fd98947dc19355cc428158efb900cda610ff9c3c3f7c9d890974e949f0b2f92a96d4e57cb8d6a841e7b70f515079f9a035388ae4ff
SSDEEP 49152:9mv6+CJ15R+y5NElflAV5mjDoeSUfxJodQLQWNeWRyfNbp3Ad3q4LdzjwDPhLDpv:5
TLSH
T118760A36696102730AE19518322A6A427A19CC276301F9FE5BFFD149138D65703BFBEF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ArrowFarCursor.png

Path C:\Users\Admin\AppData\Local\Voidstrap\VoidstrapMods\content\textures\Cursors\KeyboardMouse\ArrowFarCursor.png
Size 736B
SHA256 510e646b3fbf966ef9d4191293c4b0e60df17d55210d1e1d638b54f02482a68a
MD5 5c5b0877195352380bf809230a8ca4b9
SHA1 43127fa6fe5c1e096ee90c487ce07d972a6cec13
SHA512 38972e73511178cf46755e40fc3494c3492f57574057b54fd4d8524f98471206c58315051475fe2d312077dd8037bd53143245e6af1e90d1d704c6079b4952b6
TLSH
T1660199461338FCC024031BF10260794464776CC5C0D41FBC9E00BB3CC6D1D6267D854E
MD5 SHA1 SHA512 TLSH

Submit Download

Voidstrap.lnk.e9b7f462e82241d194a8541f4bfdbf2a.tmp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Voidstrap.lnk.e9b7f462e82241d194a8541f4bfdbf2a.tmp
Size 1KB
SHA256 acb34548ced56cfde173a6266c7f47d492ff5b52c67f05dbdd960ad4463c597c
MD5 a7bb1dbd2a97361f6edfb9dd461029b2
SHA1 cb445ec287362efb9517a541f78e24582a4b70bf
SHA512 ad179ef677ebda3edd3779a0f4a05133e814a838ad5973fed9fef631bea88131dea54726b1e3f6fb426682a071dbfb2d2e386bf1aa41d29baba9cd71af6ca85d
TLSH
T1B5313700BBF59600DBFBBE7166B25984457AB4201F06E50C43098A4C0E71B1DD931757
MD5 SHA1 SHA512 TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z1fa97cg.default-release\AlternateServices.bin
Size 8KB
SHA256 f4083d06c55cb6c93fc4728423e98a765615ea32bbbfe1879d53378f2cafb778
MD5 32dac172af2577c8e31b26ac7a2f11cc
SHA1 5e1e7e85e31bd82a35c3e869fe1928fe713e3664
SHA512 2dc8a985aa9bc0d13fe32ef9881f964226a6a549df37a4a5d24591c0087ad8cbf1878c212b401171f74009a3c8be734f9a79cc385135cb52b1b170efd80038c8
SSDEEP 24:TuhMZ+ikt91QkNb9BA1kNkd9x6ikNz5q9F55A51+kNAN9Vv6+kNmd9ly+kN:Mn9N5C6NkXsN9I56rNKBYNmXiN
TLSH
T1500286F31B76B073F0928FF08099B14C9C370335167C91A4DA44A8F342D2AA991BEB78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z1fa97cg.default-release\AlternateServices.bin
Size 13KB
SHA256 670ac6c3ba8006f80dee2178c5c5560dd13ec0c7662b0ab952548bb93d1328e7
MD5 5c153998f8633aafd7ed0c702aa96e34
SHA1 ab47faf44ad906fadbf7cf984ee86f6fec5e9bbb
SHA512 8820808bad9923243431e008f29937a2509c1a929bdd217258579299b49ec5b5f0baa8373a7dcc3c711a8cebed72c8afb20364fcc7a88898ebd298cee7c01dc0
SSDEEP 96:8n07YNf/ZNAbCNsI56oNNiCBDNNpRNNh4YXM/pqNFnNe4LO2x:8nKY5ZaCZN1NNNBXQQHP
TLSH
T101524FF72B756063F0928FB18058708CAC371339567CD198CA55A8E742D2BA990BFF78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

addonStartup.json.lz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z1fa97cg.default-release\addonStartup.json.lz4
Size 4KB
SHA256 0960d4945ac1fd86ba5bdcc82af5261c1a0a2a23f5aec275713bbfa5ac15af65
MD5 5136755e99efb6c857abfa0fc355c415
SHA1 19db0d27fcefce4de517bc6cf9d2ffc6e757e23d
SHA512 b7e15c326c763bfc1d27f2c62d28da28cdc2bdcb5b5a901dac64b05704f09c803ff1235b1dd5004e75bdbbc0ba47e1867bc051c1ff5f7bb3f727ff15cbbeb744
SSDEEP 96:NvWO4sHNw6M2xWGhD41MgGvmHhF+rUpO1LnOYvhQhIRhN:NvI52xxhD8rGvm6ApwnHUuhN
TLSH
T178A17DBAD541EFA1FD32C04388D97FB2EAA6AB7424B9C4D4F1AFB1194C64A735705340
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

store.json.mozlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z1fa97cg.default-release\crashes\store.json.mozlz4
Size 66B
SHA256 078648c042b9b08483ce246b7f01371072541a2e90d1beb0c8009a6118cbd965
MD5 a6338865eb252d0ef8fcf11fa9af3f0d
SHA1 cecdd4c4dcae10c2ffc8eb938121b6231de48cd3
SHA512 d950227ac83f4e8246d73f9f35c19e88ce65d0ca5f1ef8ccbb02ed6efc66b1b7e683e2ba0200279d7ca4b49831fd8c3ceb0584265b10accff2611ec1ca8c0c6c
TLSH
T175A022C28E0C83BACF000833008AF00300E83B020B8B0F882AC2AEF8200200C8082082
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z1fa97cg.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 4aa3f0b244a979583cbb153c0e0ba07fa55acb89e381b2d180e37bd2a8516bba
MD5 44f19b877ecdfa983617419ae0e095e8
SHA1 4daf94e91b9c1695c1e2c8d6e72f055aa42c9fd1
SHA512 87da9990f3b7e55e9a9ce1a0d9947f80961e486b49bc46682da7502376ae0d8550bce8534186ade05337ae8a69755d487c27ef9709ee13115a16bf5d6fdb90d1
SSDEEP 192:zOv5zboAj+Iyjnc81TJ1d66Joz1zgCl6mc0dz:cboo+Iyjrd66Joz1zgC1jd
TLSH
T184F1FF64F628863FD408037BCCA61F450F39395A988E7F19359C655C2C9B2DE368E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z1fa97cg.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 e9c7d9141c77e27741048fff68eb8c903f849f9272843fe3e26b4cec30b5ae29
MD5 ab5a1be60195f5ab2e2e03e9554922f7
SHA1 d65ec16915b8811f72ebf8c1fef0b92b0367ac4c
SHA512 0daa7675d5575fc2c5d9c1bd9147cdfd2535b3afbb23fe0f1bc1a3db0284f9e95ac2ed1cd5dedb00efd5d87b73fb3daf5f9fb54f4e906f63aaaa62d4b5b99f4e
SSDEEP 192:SOv5zboYb+IyjncO1TT1d66Joz1zgCl6mc0dV:RboYb+Iyjrd66Joz1zgC1jr
TLSH
T135E1FD64E628863BD408437BCDA61F410F39395B984E3F1A369D65482C5B2DE378D1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z1fa97cg.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 0f772315d9cbe07f5a48a3ded434aabc4596ea4fca0119b8ee6c9aa4df15a4f1
MD5 b0d725714c793babacae5197d65a3d01
SHA1 901f9f969bd32470980bda7819bc08c3b8f87204
SHA512 375a7897e6286bd9b8ef931572d0b48e926b38bbaea232a78288e54b1994f02c382cfd9f729204cea8a36a6738552fce08ab7946a8e6763430b14ee1c7ed18ce
SSDEEP 192:oOv5zboAgZ+IyjncO1TT1d66Joz1zgCl6mc0dz:TboRZ+Iyjrd66Joz1zgC1jd
TLSH
T165E1FD64E628863BD408037BCDA61F410F39395A984E3F19369C655C2C572DE378E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z1fa97cg.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 68b48307b4aec77c5feb02112fe9834fb5e6a09e5e3045ee3386f687fef0cb54
MD5 aac0d2a3b9541e5cac21d9ee9810e78a
SHA1 27f0a88a87a83c0eb76c81e06aeb2989ddd5e49c
SHA512 7c777f45aae1f7755ba10ca8f37231eadffd371c0e9d68d97b628e350336d9628d2562de906612028c27500aa077e54003f2cc1cee8837e1c058d98a857f0570
SSDEEP 192:r1TT1d66Joz1zgCl6mc0dXOv5zboAj+Iyjncs:jd66Joz1zgC1jWboo+IyjP
TLSH
T140E1FD64E628863FD408037BCDA61B450F3A395A988E3F19369C655C2C572DE378E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z1fa97cg.default-release\datareporting\glean\events\events
Size 1KB
SHA256 97d5c79840261fac0378a43af3e8604b38e36180d0988050856a69370345676a
MD5 a77b62d46c62d5985fa7e08027fd9da2
SHA1 783871e16512bcf120742a3f62bbcfa4293117e8
SHA512 203fca7868aa99ef9d2600b8cce79e8899151c0da81deb9ccefdcfd9d06a8a551f2659c2347302e0b6b6f3a2a4ce2a8d241714ac5fc90bd9dc2637850ca893e4
TLSH
T16A217B5C3DB84D5AB8C7EAAC7481118E93D04E4A459B1C430E42EE8ECD916D932AD438
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z1fa97cg.default-release\datareporting\glean\events\events
Size 4KB
SHA256 e289a80cbc2e8fc749be1c05686ed8e5f32e82894c029adb2292cc1f88c40f51
MD5 35e108cce1fcf240058f16413286b7d7
SHA1 d76fe93de70194c2082cfc3b5c44d6210a272aea
SHA512 ae3a3993cfae490d50e07f5f0308140390f73ffd330fed3c9f404ebc74afb8f5c4fc2bfa75dd0c4f9385d5900717d93f381a4f091765af60dd2af35602ded3dc
SSDEEP 96:aD5ONkf29PdKeLbGBEJ+Lmbx4r6uyYmd4+v7sOobMKNvdt268:aD5ONkf29PgnBSlI6u4drDlobMKNFt25
TLSH
T148A1122C39B80C7E39CBD6ADB441428D87DD4B16D68B1C478CDBEE4BCC45A99329E438
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

13e854a5-117e-42e5-ab26-4d127d1229a9

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z1fa97cg.default-release\datareporting\glean\pending_pings\13e854a5-117e-42e5-ab26-4d127d1229a9
Size 15KB
SHA256 db258de67273718ff1ce65bbd09b8092f1daf8e90802c6be4ece46dc539b1c5e
MD5 ba011d9a8bc53f0dbf29aeb0c219d4b2
SHA1 bf6aedcec29eea35d535f56695e3479e640274a0
SHA512 1edab04792f83d218799ac03b5df7663c8f00ce10c716ca157f3b32cc64752881eeca3f7f3410b538570b8ee7a780decf30f09961c9561753d228b2cc3a7ab69
SSDEEP 192:YziFZwaXLPnjyFEb4g6krZOpuwBbJ9yFq8FYmbpJRatbNyzHSrET11T3BrPPn:YWoiLPneFqbsIwLeJRatbMbSrOT39
TLSH
T18872C9562860497AC291E3A9D4FCBFC3E6F528CB4C415FCA97E4BD085DDE0AE112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

19f84133-40b8-44e7-8f9b-22c86866c607

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z1fa97cg.default-release\datareporting\glean\pending_pings\19f84133-40b8-44e7-8f9b-22c86866c607
Size 886B
SHA256 8d19e0923b04bbf77f6182ffc1ff0c93bdf6f6aa047f2a925d6485ca14e8889c
MD5 a43c88d311fb65cdf30f3679ddd2f550
SHA1 3ce05955206b995a20af1b789fd87d59d9473709
SHA512 d8ee2570f2b9dbdf9828ee21ed817abf391d8d733d57de1cd6471e0cdf9988750630f7265a1569dc5bafa0c47c4d9129d6c740fd2caebe49586fe56729554b4e
TLSH
T16C1123508674F9B2DC78825B86E1B74647F87023C0CE69187EA09F1C0DFA25E6367247
MD5 SHA1 SHA512 TLSH

Submit Download

2df3f683-987d-48ad-bdf2-2fb42f746c37

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z1fa97cg.default-release\datareporting\glean\pending_pings\2df3f683-987d-48ad-bdf2-2fb42f746c37
Size 883B
SHA256 5049839abe78552490572fd99500091586204b0c08bf6f7cacb5dbb1a79d3dc2
MD5 9a7b109b6e28e1eb9c5a29ecc5d449c2
SHA1 9ca853a27973426533c1dd89a48dcf7b14626ec3
SHA512 5a1ba297309dfb807ed00cfb1d61b4e50570bb00ce23db4fac8baff88460aae73845251294208939557e0e090c6fd90320612e420a08537eac7af31113abc6f6
TLSH
T1A811C080A774B9B2DC78924BC9A57B064BF8752380CAA5183DE19B080C7E61D63BA247
MD5 SHA1 SHA512 TLSH

Submit Download

3572d6df-1d48-48a3-9f9a-10ee2ba714ab

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z1fa97cg.default-release\datareporting\glean\pending_pings\3572d6df-1d48-48a3-9f9a-10ee2ba714ab
Size 26KB
SHA256 d85ba2b49d7bc12f76fe46a05837123149a699d281fc87efcce7d8acc7a6ad7a
MD5 a8cc05c2c5dd68d11d04a615617f0173
SHA1 e492ebb4cde4427c889492f6ee304cfe2b322604
SHA512 fcbb4784484bbb2d556a2229e4c3ef11e1cfb31cd2e08fb95d8cdf3998be58e02bba51353200d303f9ace4f629a20db62ea46692fbd081a143d717ee68a6edef
SSDEEP 768:doMcLF1Un8zD1m9TnDH5FUADT75JdS/RS1Yvtsq7rFGU0FN:L7r5FlDpJdwJ1Jn0FN
TLSH
T106C2E8FDCD1240473E65E52EF2E9ADAB2017183209CDC7DD69FE483A26C69BB1527318
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

94fb8c74-c52e-4191-a193-1bed52e0e43a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z1fa97cg.default-release\datareporting\glean\pending_pings\94fb8c74-c52e-4191-a193-1bed52e0e43a
Size 235B
SHA256 4f5c48d6d40a88b3a2d9dff32b68a2b524fd8bdc3dbb60014854b57be60126aa
MD5 575c31adc9072d636a104fdbf0606f50
SHA1 f03126bdc97728cf68491211a43f16becbbb0225
SHA512 7eb6ebc0b575c206bf2216b049449e1bfa0128f4b0714a308c7aaf1fdf9d81814fec644a8c875aa15b21c36eac7ce43a611b29d92f527af087ccab85c81e1ccc
TLSH
T1D0D0978024C8632D18080F0BF2E028C6308A8C375861A81499B18535DAFDEC90121806
MD5 SHA1 SHA512 TLSH

Submit Download

d01bea20-bb6f-4d4d-b27e-26a777c23ca6

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z1fa97cg.default-release\datareporting\glean\pending_pings\d01bea20-bb6f-4d4d-b27e-26a777c23ca6
Size 235B
SHA256 80abd5aef456a787f685bbfdb055628cc2ceb4238f112e2a06618015369faf42
MD5 bf0942f7212024fea828a89bf1f0780f
SHA1 a40505811d586f84f4e49844654080816226e94f
SHA512 718ea8254dbb756cb00afb47a66375a8da28d2cb91d38f457a4419b7d30b9fe467d5f2ff0fad1ff572670f2633d3fbc8ab94c9ddb1d02076eded7af28192a410
TLSH
T1A0D0978198C8272D18111F06F0B0A8D630884C3320B5989089A10578CAFCDC8829188B
MD5 SHA1 SHA512 TLSH

Submit Download

f941023b-8532-4476-afbb-5a3c70ed1703

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z1fa97cg.default-release\datareporting\glean\pending_pings\f941023b-8532-4476-afbb-5a3c70ed1703
Size 2KB
SHA256 52d76b56bffb809f9275eeca59911aa47a9c98e8eadb637ff92a0f2510cf31af
MD5 c64a226513d19e915ead97714d9eea3a
SHA1 6cf166aaf4fd7fe23ad06d5c6626c2cad0487828
SHA512 51cf69e31cda769d631252ea6e82751ebab33e9dd78e8e419d75900af5bc418c2dfddd7860be0a822444ea071cbed80370b679460bb8fab7508521bc79ea3de1
TLSH
T16441675875B88C765CC7E55D9482234E93B48E1350CA28436F41EF4C8DA66DD736A01B
MD5 SHA1 SHA512 TLSH

Submit Download

downloads.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z1fa97cg.default-release\downloads.json
Size 1KB
SHA256 5538106139e8267043163d6f402bc774fcf88d7bd95f77ce6a3bf818d5fd35d0
MD5 b50f45bfaecab39740ab2501ce05c9ea
SHA1 b24cb547f5c34d164f5591cb4ceb47f9d9cee623
SHA512 1c9c0bba8a19979ee34d1db3c9d4cb20eee656b555e28cf2addc40c623f977f65d98a0b987f67055aefff3778a8cf8c137f5a5eb25736a13e8d31b68f3609331
TLSH
T1CD3186F2C007D9EB1E09BE10592C6F5F4C36B06345454639239AD2C8C1C817A21B66BB
MD5 SHA1 SHA512 TLSH

Submit Download

extension-preferences.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z1fa97cg.default-release\extension-preferences.json
Size 942B
SHA256 aecfc11c0db969b2c79da2144415a8859c77d66fbfc37ca4924ac58a0ff29834
MD5 20357ec0806e9826d6daf456b6b16bd8
SHA1 7d5d7a921213989294eb5cea2ee760e562ce5293
SHA512 2333fde606ee727a6b6d9812ed40e56e5d0dba4ec35abcc11b67f8ad61d1d3d4af5db699d29b3ed6b459b9e142badae69ffbebf18974b5a1c72e45ecc8cf93cf
TLSH
T17211F13A640B6EB01E8E5625FE384A92E791111B50B7F2E47E69934A13D3970C1ED39C
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z1fa97cg.default-release\extensions.json
Size 14KB
SHA256 a374cbc354f55ba404ff5192a1a909d0307dc708b369aed7c9c3a8ad9b2f9607
MD5 303048f80de4b0447ecfd68940475cab
SHA1 4e7e886b5299de4e9424cb3a88f98072965983f4
SHA512 f994f8704944dbf95d1c47829dc8b9eb50054f53556ca4c9042fb1ac62ec5b3c04aa878703b2412a0fbd483245f6b7284276c42af999935c96b1c5b218bc0ea8
SSDEEP 384:mkI4vAUmldvw8dhWV94z996ooZL4HWL4PUL4H8L4HAL4HC:pI4oRfpX8436NR4842424C4i
TLSH
T1BA62421545148EB8298FA78BEA367D02C37D473BA0445C78F4DD8FC842FA5B902BB61B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z1fa97cg.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z1fa97cg.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z1fa97cg.default-release\gmp-widevinecdm\4.10.3112.0\LICENSE
Size 473B
SHA256 20de375707692099b3132084695377ce5fec0aec05813dedcce094b8eda44386
MD5 7406820f5d56fda6baffa951c60679d2
SHA1 e7d4894993e506e235d55b3e47aed019d0584148
SHA512 e70868507c08436b51bb4fd7a582ec0bf81ae0fb5d3d3f20374f584574e54eca81f3cb0530fddcf2d1773c33774f5df58f55ed2a45149c86d33e1e50f64c1d36
TLSH
T13AF0DC7ABA23532245D603C7011450D53B270BF4F25422D0E3E881E5336B178C1FE084
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z1fa97cg.default-release\gmp-widevinecdm\4.10.3112.0\manifest.json
Size 1005B
SHA256 1cc15465230ffb75fd028ee3b2189c8774f56bc7dee8dd17b952e6ca92144004
MD5 58954048e70c81669675d4f87ab50af1
SHA1 8ab675ea31801bbb91c33fd381f4c202bfd7882e
SHA512 f9b8c236c9404936b93ba92550c21a0344b657c42cd98e091cda32e33fed860d59ac0cb97451ca61b2d8e6a943a983ded569b1d7ecd541e832e3ca87b39ecbd0
TLSH
T161115E00DD384DD326D4B6A21CC6580957661DAF5CC27E54379E161D4F1C8AB927376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z1fa97cg.default-release\gmp-widevinecdm\4.10.3112.0\widevinecdm.dll
Size 21.9MB
SHA256 7b44e84403fbb3faee15ca2d56eb8432fdf4eb68812c4460abdd20972528e825
MD5 5614c2225ece73a37e47894ff3c19aa3
SHA1 df3aadd22db3b5841fe488c985365269709b4b27
SHA512 8b8e55347a7a496cfe52222670781654ada20accf21f3e2dd88847e0a7a00cb083609a5f3907bcc1f927c1227de20373a744028466663c5389ad286a46fc3286
SSDEEP 393216:SKuarWwW0LmrEr38dudevJCJU2kpq1gL2aVRHy:dWCmz0dwJIkpqCW
TLSH
T1CC37E14AE35350E9E81ECDF4826E9A62E4343C4E03319BEF17D47A355A727C42A39F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

widevinecdm.dll.sig

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z1fa97cg.default-release\gmp-widevinecdm\4.10.3112.0\widevinecdm.dll.sig
Size 1KB
SHA256 f9f160cb5ca37ef81a3aa80eeb7fef8b302e18c82d92c34f42503e0ab085ada5
MD5 a0dd5d559b24af4590e5cae3ac11a0fd
SHA1 04b83b414c36ab24fd27fe432a690de636bd2996
SHA512 2d69ea26916ed156f214c17d57c158cb680f1119849b8dd1f7315fd3fa6981c9d6ec2026b494d8e2e70e969205f063979287265a94e73704fe392884e8b4e4ac
TLSH
T1DE21E9DD697012242880793E5FEDF016FD3325C2AA3014FF456B65C2BCE376018C462E
MD5 SHA1 SHA512 TLSH

Submit Download

places.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z1fa97cg.default-release\places.sqlite
Size 5.0MB
SHA256 921d1b6d27657cb91c9bfdffa4977344f5b8329118b8222f5886b63ac29e715b
MD5 5b43369e4d53bd4dc5f72d1a0ecc6257
SHA1 31edbe74c027dd9e5bc634c0ef4e2e971153b96a
SHA512 347459a0a6cfd1d39ea66bbc725b168b181f54a9a201bf55cc3512575426d52871840f2ffcc544bd65578949d63b0ba9d3943846eb3027bc0d6982a810d4d12d
SSDEEP 768:rqVW3o5IvhSUUM1RXORwPzZxeyWBArGgH9k3:rOW3oiSUTHXORwPzZx5WBArGgH9k3
TLSH
T18F36B89B7A214045CCDAA231BDE26B195C3F7416C53BB6C33A94256E4DE0B23752CCBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z1fa97cg.default-release\prefs-1.js
Size 6KB
SHA256 a41bc468a88ad76c9cc2f713fb692b6b9d25dc47ae778a28322f9cba5b88b0aa
MD5 a685d4ba000cf1a263a84639d2374d90
SHA1 ff66d4dd66a202e7286a38f794d65bd03adb295f
SHA512 342cd9bd886d6cbb5e2d90c505f32eadb29689a90ad58ca5556d0243f9dcf28b748361e7f6c27834e24b4d80bed0e72f279993118331d5bb1c781b4d56cf063a
SSDEEP 96:xHIUTUQqGqSfU0P01zSIv/SSlkdv9jsn1NHQBw88P8L4cnKHU:yrRSfU0P0/v/SSJQBw88Q
TLSH
T120E11E789508CF6F74B6776CAC6888316AB2013BBBBF28C750B95485051CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z1fa97cg.default-release\prefs-1.js
Size 7KB
SHA256 49758ec6278548a6cdb864e32c905412f70cdf2ef7a483b2827ca6480625b126
MD5 a358220d9f8b44639863ad5983eb8c1a
SHA1 1522539fbd80aa56dc5c1526ecec9c452a9930ec
SHA512 29800b4649e78b1192e051328444a76f2be89be6164a730af216008101df30e434622b1d753e0c26e340c8c79cd4d50d3698447d7a960e6c0d91c8606f3bb861
SSDEEP 96:xHIUTUQqGqSfU0P0NbzSIv/SSlkdv9jin1NHQBw88P8L4cnKHRGS:yrRSfU0P0Lv/SS3QBw883
TLSH
T12DE11F7895088F7F78B6766CAC6888316AB2013BBBBF68C750B554C4051CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z1fa97cg.default-release\prefs.js
Size 6KB
SHA256 914d9d27ce2899a123abecd19a6672f6b530a2fdfe5ee6722daf11e54f7c405a
MD5 378b0502592a0f1d1f1d0f0bffbeb88d
SHA1 41a217574fdfc400b4d95627a452c0365c264878
SHA512 a3823f8f4df9433725bad3fa9b2c1809def2f61a0ef4f987d0c34ad4eb6c5e5e4f4add83622d10aad204a17db14472a729650278a60567f9bb15737d09fd4458
SSDEEP 96:xHIUTUQqGqSfU0P0kzSIv/SSlkdv9jin1NHQBw88P8L4cnKHRGS:yrRSfU0P0iv/SS3QBw883
TLSH
T192E11F7894488F7F74B6766CAC6888716AB2013B7BBF68C750B55484051CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z1fa97cg.default-release\prefs.js
Size 7KB
SHA256 b84d62c51b046fa18a57946f29981985d4abaf8583725e9df31f9513b03f93a9
MD5 a737856cd22acb90d9d720e0c595fe7b
SHA1 741404e0c3f61ce9503a99bc23997d2882273826
SHA512 f1cc40216c3274c4f2585b60a76560b2cf88f6f5a33ac3903ba0a182e18022db0c53fb2cb4c18f6acbe951e733e5b6e0e5d91105d2ced516bf6de0a91be459cf
SSDEEP 192:yIqLWwAhRSfZY0P0Lv/SS3KvPBw88w/DwY:hqLWwA+BT0vxKvJwA/DwY
TLSH
T166F1FC789404CB7F74B276BDAC6849315AA2013BBBBF68C350B958C5051CF3842E96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z1fa97cg.default-release\prefs.js
Size 12KB
SHA256 de63bd085646174970cbbe503d4a1684c4472d46125071b8938cb5c193460076
MD5 164122e8515cc45b71be696f3ab89f96
SHA1 b9d92be51f9f9078d72aa55cfe833a49831ebe9b
SHA512 ed297083439d8f672ac39090460b5b270d5bd06fd6f04a9674a39feb4d0c2f5f6afcd2a64b3b1f5d906c686333c1dbb00c31928bc0ad915de48051046ddaecb3
SSDEEP 384:hqLWwAFBT0vPR92sIvF3YwrQqQxmNVFBg0X//DwEa+OC6FzJo8CISvH2RgqX7BLG:hqLWwA3T0vPR92sqF3HQqQxmNVFBg0Xj
TLSH
T1C242CC3854518A3F20F2327EAC255AA119A5013B7B7FBCD249FC98C3445DF2445E6AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z1fa97cg.default-release\prefs.js
Size 6KB
SHA256 a9186b24442c45f57f7027ec905d11781e5d70d4ad4c816478d7d0c129f1be31
MD5 657f99ddf8eabf490533f35d658b5219
SHA1 f0ddd185d8278aafe88456d5da4352b444fcb765
SHA512 de1d55fe0cd2eea9ffda0558c666be6e922c12b056348760e7e745230bbc03ff7325fb069cd97cc520f3b7e94ab6ced920a4839c79ee7ebbd1c59e7ceea9dabf
SSDEEP 96:xHIUTUQqGqSfUqJ1zSESSlkdv9jsn1NHQBw88P8L4cnKHU:yrRSfUqJRSSJQBw88Q
TLSH
T1CAE1FE789548CF7F64B6766CAC688831AAB2013BB6BF68C750B95484051CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z1fa97cg.default-release\sessionCheckpoints.json
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
TLSH
T10190024AC8590431DE42251823647B90A61E04A254250101526CBC88046B0155486483
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z1fa97cg.default-release\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
TLSH
T1D4B01205C8181030CD43140873743B429B2E00B231500100317CF88C203B0134556883
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z1fa97cg.default-release\sessionCheckpoints.json
Size 122B
SHA256 72d74b596f7fc079d15431b51ce565a6465a40f5897682a94a3f1dd19b07959a
MD5 99601438ae1349b653fcd00278943f90
SHA1 8958d05e9362f6f0f3b616f7bfd0aeb5d37967c9
SHA512 ffa863d5d6af4a48aadc5c92df4781d3aacbf5d91b43b5e68569952ffec513ff95655b3e54c2161fe27d2274dd4778bad517c7a3972f206381ef292808628c55
TLSH
T14DB09296895A1070CE83259D73A47B92AE3E14F676A1164471ACA98C24BB0278657883
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z1fa97cg.default-release\sessionCheckpoints.json
Size 146B
SHA256 7343d5a46e2fca762305a4f85c45484a49c1607ede8e8c4bd12bedd2327edb8d
MD5 65690c43c42921410ec8043e34f09079
SHA1 362add4dbd0c978ae222a354a4e8d35563da14b4
SHA512 c0208d51cf1586e75f22764b82c48ecbb42c1ff54aa412a85af13d686e0119b4e49e98450d25c70e3792d3b9c2cda0c5ab0c6931ebaf548693bb970a35ae62b9
TLSH
T1C9C02BC385460070CEC3229D33A07F92AE3F00FB37B10604706CA54C14770278203443
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z1fa97cg.default-release\sessionCheckpoints.json
Size 228B
SHA256 db037b650f36ff45da5df59bc07b0c5948f9e9b7b148ead4454ab84cb04fd0e2
MD5 a0821bc1a142e3b5bca852e1090c9f2c
SHA1 e51beb8731e990129d965ddb60530d198c73825f
SHA512 997528e2ecd24a7e697d95cd1a2a7de46a3d80b37fd67fac4fb0da0db756b60a24648b7074255dc38f7651302f70894a53c3d789f3d7cd9f80fb91bd0cade4be
TLSH
T14ED0A783C6055075CE83696CB39C7B519E3E04F672640245B1AC954C187F027414B843
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z1fa97cg.default-release\sessionCheckpoints.json
Size 193B
SHA256 ecb4133a183cb6c533a1c4ded26b663e2232af77db1a379f9bd68840127c7933
MD5 2ad4fe43dc84c6adbdfd90aaba12703f
SHA1 28a6c7eff625a2da72b932aa00a63c31234f0e7f
SHA512 2ee947dcf3eb05258c7a8c45cb60082a697dbe6d683152fe7117d20f7d3eb2beaaf5656154b379193cdc763d7f2f3b114cf61b4dd0f8a65326e662165ccf89cc
TLSH
T165C012C2C6565071CF8365ADB26C7B659E3E04F67665064470ACD54C147B027421B443
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z1fa97cg.default-release\sessionCheckpoints.json
Size 259B
SHA256 50a670fb78ff2712aae2c16d9499e01c15fddf24e229330d02a69b0527a38092
MD5 e6c20f53d6714067f2b49d0e9ba8030e
SHA1 f516dc1084cdd8302b3e7f7167b905e603b6f04f
SHA512 462415b8295c1cdcac0a7cb16bb8a027ef36ae2ce0b061071074ac3209332a7eae71de843af4b96bbbd6158ca8fd5c18147bf9a79b8a7768a9a35edce8b784bf
TLSH
T18ED02E83C209507ACE836E68B39CBB508E3F00F372240202B2AC888C183F023418F803
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z1fa97cg.default-release\sessionCheckpoints.json
Size 288B
SHA256 2fca1f29b73dd5b4159fa1eb16e69276482f5224ba7d2219a547039129a51f0e
MD5 948a7403e323297c6bb8a5c791b42866
SHA1 88a555717e8a4a33eccfb7d47a2a4aa31038f9c0
SHA512 17e2f65c33f47c8bb4beca31db2aff3d4bbb6c2d36924057f9f847e207bdcb85ffcbb32c80dd06862ffc9b7f0bd3f5e2e65b48bb1bc3363732751101d5596b1a
TLSH
T1A5D08C83C10950BACE826A58B398BB509E3E00F271140142B6AC888C183F023418B803
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z1fa97cg.default-release\sessionstore-backups\recovery.jsonlz4
Size 3KB
SHA256 d6b3838ca17f4c757dfd29bf799738bee7a749f7be409189b18289c177836674
MD5 a22ca547d3ed0475f5199197d97955eb
SHA1 719ae1ca18fd8e7d19a8147fde863160b4f14d0d
SHA512 84ac5afe3197ff02149c445c1f6a191233da225f58ee468b730b0af115b66e104571ee27160e8713dcb66b2d0f8005243f7a7255f63b8044f8e6883eca04e6ad
TLSH
T1C3816D75DD2C6C83FDF8A57620D108D2DB7B640157E6E448AD550137C98B3C637C86B6
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z1fa97cg.default-release\sessionstore-backups\recovery.jsonlz4
Size 4KB
SHA256 188310a707b62f7ebf5bd0d0c432b2c48f6158bb968305438536e4d232b2eace
MD5 26a6a776f2bccb82228f68aa731cb624
SHA1 e51a84fa37177ca6002093493dc8460ada199a49
SHA512 395df03884b1e27a583378046b7f4bf277abaafcd475b71ffc10c05c465b4d04d4c640cb614f3bb38a6eeb266e9a66ff6ecf7621a7d7171d6ad7f2720db5a066
SSDEEP 96:r2qtJsjda9GNHttXIuZCd01VrqM4EcZZi6rLKJyYq:rztJs49GlDX5i0v/4d
TLSH
T18FA16E636C2B98AB2969C564DC9F0F99C0F12004EDF801AC7F1A573281AC70EE8187D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z1fa97cg.default-release\sessionstore-backups\recovery.jsonlz4
Size 10KB
SHA256 bb4cbdf47b23648f89668fbc1e295f38dea5e9ba4b927d8e1594819fd40ae01f
MD5 a17e5b1eeb9939dc2e9f7815718494b2
SHA1 7384ecc65c3728c2a0da04e2ac396336e7ebe07b
SHA512 631b25f404fca39965882edb771cc0f89f03a36476747760be57404e2b19123ac8441447b70e579ce75270899ba96ed3e8b19d4f6a11eb8758b14783014c3222
SSDEEP 192:eztJs49GZCzR/sVR0w6vOwtSw6bLIB+IcRAlEjstNPacWjQGnAVUKGVLfYRQ+q:EI44CNERH8JtSdbL0TeAejsnPMQGAVUt
TLSH
T1C4229FB6F22A7CEA0C2C794814DDA986A1B2941EBFF404DDEC1D6A31D1D060A5F3D28D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionstore.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z1fa97cg.default-release\sessionstore.jsonlz4
Size 10KB
SHA256 5a4525d7d93a0e78799e784e44009f7415693997c3b1a99a2908eda98bdd706a
MD5 2d0f2bd7bc2745c7f1345c336391ff38
SHA1 d9feeaf6056c140b32f0de56f29eec06575b0e76
SHA512 30206c3b8ffc5f1229603710b060268f32938b5b6071eac865d5e5eb7a3c01ee53ba4f8bfc1affa96a646a4f071bd3ccf6969edeed37149ccc2599506233a41a
SSDEEP 192:VztJs49GZCzR/sVR0w6vOwtSvtByla/jBr3qG7pdH73hYRQ+hm:xI44CNERH8JtSvry4L1qG7p13+yd
TLSH
T10B22AFB5F56B7CAA1C2D744810CDFD46A2A2841E9BF404DDE9192932D1E2A0A1F7D38D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download