Overview

overview

6

Static

static

1

SAP2000v27...up.exe

windows10-2004-x64

6

SAP2000v27...up.exe

windows11-ltsc_2024-x64

6

Analysis

  • max time kernel
    158s
  • max time network
    238s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    10/11/2026, 12:26

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    SAP2000v2710Build3560Setup.exe
  • Size 1136.9MB
  • Sample261110-pmjrtafd39
  • SHA256 ef0525eef5ad41a057d3b8de84c9c6e0576f8e6a81ccf7e4760c53682558007d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
defense_evasiondiscoverypersistenceprivilege_escalationransomwarespywaretrojan

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 6 IoCs
    persistence
  • Badlisted process makes network request 1 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Downloads MZ/PE file 4 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs
    persistence
  • Drops file in System32 directory 21 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks system information in the registry 2 TTPs 14 IoCs

    System information is often read in order to detect sandboxing environments.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 31 IoCs
  • Executes dropped EXE 42 IoCs
  • Loads dropped DLL 32 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 4 IoCs
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 30 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 55 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 41 IoCs
  • System policy modification 1 TTPs 1 IoCs
    defense_evasion
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\SAP2000v2710Build3560Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\SAP2000v2710Build3560Setup.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2756
    • C:\Users\Admin\AppData\Local\Temp\{83961A70-1C49-47C3-8D1D-875692729E1A}\SAP2000v2710Build3560Setup.exe
      C:\Users\Admin\AppData\Local\Temp\{83961A70-1C49-47C3-8D1D-875692729E1A}\SAP2000v2710Build3560Setup.exe /q"C:\Users\Admin\AppData\Local\Temp\SAP2000v2710Build3560Setup.exe" /tempdisk1folder"C:\Users\Admin\AppData\Local\Temp\{83961A70-1C49-47C3-8D1D-875692729E1A}" /IS_temp /waitingforchildprocess
      2⤵
      • Adds Run key to start application
      • Downloads MZ/PE file
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Modifies system certificate store
      • Suspicious use of WriteProcessMemory
      PID:5064
      • C:\Users\Admin\AppData\Local\Temp\{83961A70-1C49-47C3-8D1D-875692729E1A}\{976ADED9-B0C4-4C44-BE06-3B76F14639EB}\VC_redist.x64.exe
        "C:\Users\Admin\AppData\Local\Temp\{83961A70-1C49-47C3-8D1D-875692729E1A}\{976ADED9-B0C4-4C44-BE06-3B76F14639EB}\VC_redist.x64.exe" /install /passive /norestart
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1216
        • C:\Windows\Temp\{27EF39FA-475E-40B0-8FF1-1E59792FE945}\.cr\VC_redist.x64.exe
          "C:\Windows\Temp\{27EF39FA-475E-40B0-8FF1-1E59792FE945}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\{83961A70-1C49-47C3-8D1D-875692729E1A}\{976ADED9-B0C4-4C44-BE06-3B76F14639EB}\VC_redist.x64.exe" -burn.filehandle.attached=592 -burn.filehandle.self=692 /install /passive /norestart
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:5948
          • C:\Windows\Temp\{FEDA5592-40AF-4B18-87BA-314B44A58D62}\.be\VC_redist.x64.exe
            "C:\Windows\Temp\{FEDA5592-40AF-4B18-87BA-314B44A58D62}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{F16DE04A-21AB-432D-8AF1-4E89185CB6A8} {143C920F-3B01-44B1-B394-F5D5CC267EA2} 5948
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3328
      • C:\Users\Admin\AppData\Local\Temp\{83961A70-1C49-47C3-8D1D-875692729E1A}\{95E15BA6-1906-411B-B742-11E52CDA67A6}\VC_redist.x86.exe
        "C:\Users\Admin\AppData\Local\Temp\{83961A70-1C49-47C3-8D1D-875692729E1A}\{95E15BA6-1906-411B-B742-11E52CDA67A6}\VC_redist.x86.exe" /install /passive /norestart
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2872
        • C:\Windows\Temp\{A8BF798F-047A-461E-97E2-16EDB73C93B6}\.cr\VC_redist.x86.exe
          "C:\Windows\Temp\{A8BF798F-047A-461E-97E2-16EDB73C93B6}\.cr\VC_redist.x86.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\{83961A70-1C49-47C3-8D1D-875692729E1A}\{95E15BA6-1906-411B-B742-11E52CDA67A6}\VC_redist.x86.exe" -burn.filehandle.attached=752 -burn.filehandle.self=756 /install /passive /norestart
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:1220
          • C:\Windows\Temp\{BD40E3C9-9ED5-4468-B990-18A8BD362D09}\.be\VC_redist.x86.exe
            "C:\Windows\Temp\{BD40E3C9-9ED5-4468-B990-18A8BD362D09}\.be\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{132DACC4-5B89-4E21-8D9A-75099049D72D} {58112595-7686-478F-9E20-AAA9DC5316D2} 1220
            5⤵
            • Adds Run key to start application
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:2352
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 1220 -s 1056
            5⤵
            • Program crash
            PID:3020
      • C:\Users\Admin\AppData\Local\Temp\{83961A70-1C49-47C3-8D1D-875692729E1A}\{C564D38C-5CFE-47F8-8F04-E7C84987B524}\windowsdesktop-runtime-8.0.20-win-x64.exe
        "C:\Users\Admin\AppData\Local\Temp\{83961A70-1C49-47C3-8D1D-875692729E1A}\{C564D38C-5CFE-47F8-8F04-E7C84987B524}\windowsdesktop-runtime-8.0.20-win-x64.exe" /q /norestart
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1036
        • C:\Windows\Temp\{8F3F7A01-EBDB-43FF-AA11-3F111AB3078D}\.cr\windowsdesktop-runtime-8.0.20-win-x64.exe
          "C:\Windows\Temp\{8F3F7A01-EBDB-43FF-AA11-3F111AB3078D}\.cr\windowsdesktop-runtime-8.0.20-win-x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\{83961A70-1C49-47C3-8D1D-875692729E1A}\{C564D38C-5CFE-47F8-8F04-E7C84987B524}\windowsdesktop-runtime-8.0.20-win-x64.exe" -burn.filehandle.attached=748 -burn.filehandle.self=752 /q /norestart
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:6004
          • C:\Windows\Temp\{43EA72CD-4C81-4AC4-A739-854016F07614}\.be\windowsdesktop-runtime-8.0.20-win-x64.exe
            "C:\Windows\Temp\{43EA72CD-4C81-4AC4-A739-854016F07614}\.be\windowsdesktop-runtime-8.0.20-win-x64.exe" -q -burn.elevated BurnPipe.{17706C1B-96D9-4C27-A929-9F0078CDF179} {185F441D-B2B4-46C7-8DEE-E86A34D0FFE3} 6004
            5⤵
            • Adds Run key to start application
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1620
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 6004 -s 968
            5⤵
            • Program crash
            PID:2440
      • C:\Users\Admin\AppData\Local\Temp\{83961A70-1C49-47C3-8D1D-875692729E1A}\{EF3FC405-FAA8-421C-90FD-F79A30411F9C}\MicrosoftEdgeWebview2Setup.exe
        "C:\Users\Admin\AppData\Local\Temp\{83961A70-1C49-47C3-8D1D-875692729E1A}\{EF3FC405-FAA8-421C-90FD-F79A30411F9C}\MicrosoftEdgeWebview2Setup.exe" /silent /install
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3428
        • C:\Program Files (x86)\Microsoft\Temp\EU7423.tmp\MicrosoftEdgeUpdate.exe
          "C:\Program Files (x86)\Microsoft\Temp\EU7423.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
          4⤵
          • Event Triggered Execution: Image File Execution Options Injection
          • Checks system information in the registry
          • Executes dropped EXE
          • Loads dropped DLL
          • Reads the TCP/IP host and domain name from the registry
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1772
          • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
            "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Reads the TCP/IP host and domain name from the registry
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            PID:2132
          • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
            "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Reads the TCP/IP host and domain name from the registry
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious use of WriteProcessMemory
            PID:4364
            • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.315.17\MicrosoftEdgeUpdateComRegisterShell64.exe
              "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.315.17\MicrosoftEdgeUpdateComRegisterShell64.exe"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Modifies registry class
              PID:1652
            • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.315.17\MicrosoftEdgeUpdateComRegisterShell64.exe
              "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.315.17\MicrosoftEdgeUpdateComRegisterShell64.exe"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Modifies registry class
              PID:2440
            • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.315.17\MicrosoftEdgeUpdateComRegisterShell64.exe
              "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.315.17\MicrosoftEdgeUpdateComRegisterShell64.exe"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Modifies registry class
              PID:1636
          • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
            "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zMTUuMTciIHNoZWxsX3ZlcnNpb249IjEuMy4zMTUuMTciIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NkQ2Rjg4MzAtMkE4RS00OTQwLUE1MjktRDk2ODQyMTMwODkxfSIgdXNlcmlkPSJ7MDdEMjM0NkEtQ0NBQi00QzA4LTkyMjgtNDRGQjEwMkI4MTU3fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins5NjAwMkY3Qi1BREFBLTQxQTEtQTBBOS0wREY4MUMwMkE4MUV9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iMTYiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yNjEwMC4xNzQyIiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iMTkxIiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSJEQURZIiBwcm9kdWN0X25hbWU9IkRhZHkgc3VwZXIgcG93ZXJmdWwgUEMiLz48ZXhwIGV0YWc9IiZxdW90O3M4RmFudndmTWNkNjZnN0xWMlBlYVNSN1dVT3YwbHVGNGh2aWlyVG9rK009JnF1b3Q7Ii8-PGFwcCBhcHBpZD0ie0YzQzRGRTAwLUVGRDUtNDAzQi05NTY5LTM5OEEyMEYxQkE0QX0iIHZlcnNpb249IjEuMy4xOTUuNjUiIG5leHR2ZXJzaW9uPSIxLjMuMzE1LjE3IiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIj48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI3MTkyMjcyMjM5IiBpbnN0YWxsX3RpbWVfbXM9IjEyNTkiLz48L2FwcD48L3JlcXVlc3Q-
            5⤵
            • Checks system information in the registry
            • Executes dropped EXE
            • Loads dropped DLL
            • Reads the TCP/IP host and domain name from the registry
            • System Location Discovery: System Language Discovery
            • System Network Configuration Discovery: Internet Connection Discovery
            PID:1412
          • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
            "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{6D6F8830-2A8E-4940-A529-D96842130891}" /silent
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Reads the TCP/IP host and domain name from the registry
            • System Location Discovery: System Language Discovery
            PID:5860
  • C:\Users\Admin\AppData\Local\Temp\SAP2000v2710Build3560Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\SAP2000v2710Build3560Setup.exe" /waitingforchildprocess"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2232
    • C:\Users\Admin\AppData\Local\Temp\{A21E7D59-3B63-4ED5-B986-B7624C7FCBAA}\SAP2000v2710Build3560Setup.exe
      C:\Users\Admin\AppData\Local\Temp\{A21E7D59-3B63-4ED5-B986-B7624C7FCBAA}\SAP2000v2710Build3560Setup.exe /q"C:\Users\Admin\AppData\Local\Temp\SAP2000v2710Build3560Setup.exe" /tempdisk1folder"C:\Users\Admin\AppData\Local\Temp\{A21E7D59-3B63-4ED5-B986-B7624C7FCBAA}" /waitingforchildprocess" /IS_temp /waitingforchildprocess
      2⤵
      • Adds Run key to start application
      • Downloads MZ/PE file
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2592
      • C:\Users\Admin\AppData\Local\Temp\{A21E7D59-3B63-4ED5-B986-B7624C7FCBAA}\{C564D38C-5CFE-47F8-8F04-E7C84987B524}\windowsdesktop-runtime-8.0.20-win-x64.exe
        "C:\Users\Admin\AppData\Local\Temp\{A21E7D59-3B63-4ED5-B986-B7624C7FCBAA}\{C564D38C-5CFE-47F8-8F04-E7C84987B524}\windowsdesktop-runtime-8.0.20-win-x64.exe" /q /norestart
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5964
        • C:\Windows\Temp\{6431C0AE-03C3-4B66-AE76-562A157B10A3}\.cr\windowsdesktop-runtime-8.0.20-win-x64.exe
          "C:\Windows\Temp\{6431C0AE-03C3-4B66-AE76-562A157B10A3}\.cr\windowsdesktop-runtime-8.0.20-win-x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\{A21E7D59-3B63-4ED5-B986-B7624C7FCBAA}\{C564D38C-5CFE-47F8-8F04-E7C84987B524}\windowsdesktop-runtime-8.0.20-win-x64.exe" -burn.filehandle.attached=752 -burn.filehandle.self=748 /q /norestart
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2620
          • C:\Windows\Temp\{39527707-EA8A-432B-8709-FD5AB01441DD}\.be\windowsdesktop-runtime-8.0.20-win-x64.exe
            "C:\Windows\Temp\{39527707-EA8A-432B-8709-FD5AB01441DD}\.be\windowsdesktop-runtime-8.0.20-win-x64.exe" -q -burn.elevated BurnPipe.{7D109E8A-0F45-45F1-81E5-C95884BF96EF} {D9C425EC-5748-4F16-B56A-DBEA2C020F5F} 2620
            5⤵
            • Adds Run key to start application
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:2952
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2620 -s 1528
            5⤵
            • Program crash
            PID:5860
      • C:\Users\Admin\AppData\Local\Temp\{A21E7D59-3B63-4ED5-B986-B7624C7FCBAA}\{EF3FC405-FAA8-421C-90FD-F79A30411F9C}\MicrosoftEdgeWebview2Setup.exe
        "C:\Users\Admin\AppData\Local\Temp\{A21E7D59-3B63-4ED5-B986-B7624C7FCBAA}\{EF3FC405-FAA8-421C-90FD-F79A30411F9C}\MicrosoftEdgeWebview2Setup.exe" /silent /install
        3⤵
        • Drops file in Program Files directory
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4936
        • C:\Program Files (x86)\Microsoft\Temp\EU7A5D.tmp\MicrosoftEdgeUpdate.exe
          "C:\Program Files (x86)\Microsoft\Temp\EU7A5D.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
          4⤵
          • Checks system information in the registry
          • Executes dropped EXE
          • Loads dropped DLL
          • Reads the TCP/IP host and domain name from the registry
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5112
          • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
            "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /healthcheck
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Reads the TCP/IP host and domain name from the registry
            • System Location Discovery: System Language Discovery
            PID:4884
          • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
            "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zMTUuMTciIHNoZWxsX3ZlcnNpb249IjEuMy4zMTUuMTciIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RTJEMzgwQjEtMkEzRC00QUU0LUIwNTktODYzOTk5OTkyNkVDfSIgdXNlcmlkPSJ7MDdEMjM0NkEtQ0NBQi00QzA4LTkyMjgtNDRGQjEwMkI4MTU3fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins0MzAwMjgwMi0xMEY3LTQ3QTEtQkE2OS00NTI0NzNBMkM5RkN9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iMTYiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yNjEwMC4xNzQyIiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iMTkxIiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSJEQURZIiBwcm9kdWN0X25hbWU9IkRhZHkgc3VwZXIgcG93ZXJmdWwgUEMiLz48ZXhwIGV0YWc9IiZxdW90O3lReGtVUjdQcmZNc2ErUGF0aWdrUUNDRURZQ3FHY2pvWFg3K2twbjh0eTg9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0ie0YzQzRGRTAwLUVGRDUtNDAzQi05NTY5LTM5OEEyMEYxQkE0QX0iIHZlcnNpb249IjEuMy4zMTUuMTciIG5leHR2ZXJzaW9uPSIxLjMuMzE1LjE3IiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIj48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI3MjAxNDQ3NTY3IiBpbnN0YWxsX3RpbWVfbXM9IjgwIi8-PC9hcHA-PC9yZXF1ZXN0Pg
            5⤵
            • Checks system information in the registry
            • Executes dropped EXE
            • Loads dropped DLL
            • Reads the TCP/IP host and domain name from the registry
            • System Location Discovery: System Language Discovery
            • System Network Configuration Discovery: Internet Connection Discovery
            PID:5884
          • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
            "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{E2D380B1-2A3D-4AE4-B059-8639999926EC}" /silent
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Reads the TCP/IP host and domain name from the registry
            • System Location Discovery: System Language Discovery
            PID:5584
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    PID:3708
  • C:\Windows\system32\srtasks.exe
    C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:5980
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Badlisted process makes network request
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5488
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 0564CBD8D27E3BB31900C74C60F79523
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:5688
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 2D04ED948D88C571FA8E34FCF8D5E822
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:5972
  • C:\ProgramData\Package Cache\{47109d57-d746-4f8b-9618-ed6a17cc922b}\VC_redist.x86.exe
    "C:\ProgramData\Package Cache\{47109d57-d746-4f8b-9618-ed6a17cc922b}\VC_redist.x86.exe" /burn.runonce
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:5748
    • C:\ProgramData\Package Cache\{47109d57-d746-4f8b-9618-ed6a17cc922b}\VC_redist.x86.exe
      "C:\ProgramData\Package Cache\{47109d57-d746-4f8b-9618-ed6a17cc922b}\VC_redist.x86.exe" /passive /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261110123510.log" /install
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1408
      • C:\ProgramData\Package Cache\{47109d57-d746-4f8b-9618-ed6a17cc922b}\VC_redist.x86.exe
        "C:\ProgramData\Package Cache\{47109d57-d746-4f8b-9618-ed6a17cc922b}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{47109d57-d746-4f8b-9618-ed6a17cc922b}\VC_redist.x86.exe" -burn.filehandle.attached=556 -burn.filehandle.self=576 /passive /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261110123510.log" /install
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:3372
        • C:\ProgramData\Package Cache\{47109d57-d746-4f8b-9618-ed6a17cc922b}\VC_redist.x86.exe
          "C:\ProgramData\Package Cache\{47109d57-d746-4f8b-9618-ed6a17cc922b}\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{1B9AC83B-0828-4111-ABB9-2D6D776F4CEF} {2513E961-237E-4A28-9638-99FF8B66F93F} 3372
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3432
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1220 -ip 1220
    1⤵
      PID:4912
    • C:\ProgramData\Package Cache\{e033dc24-62c0-4f2c-928e-99122efab19d}\windowsdesktop-runtime-8.0.20-win-x64.exe
      "C:\ProgramData\Package Cache\{e033dc24-62c0-4f2c-928e-99122efab19d}\windowsdesktop-runtime-8.0.20-win-x64.exe" /burn.runonce
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2864
      • C:\ProgramData\Package Cache\{e033dc24-62c0-4f2c-928e-99122efab19d}\windowsdesktop-runtime-8.0.20-win-x64.exe
        "C:\ProgramData\Package Cache\{e033dc24-62c0-4f2c-928e-99122efab19d}\windowsdesktop-runtime-8.0.20-win-x64.exe" /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.20_(x64)_20261110123515.log"
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:6084
        • C:\ProgramData\Package Cache\{e033dc24-62c0-4f2c-928e-99122efab19d}\windowsdesktop-runtime-8.0.20-win-x64.exe
          "C:\ProgramData\Package Cache\{e033dc24-62c0-4f2c-928e-99122efab19d}\windowsdesktop-runtime-8.0.20-win-x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{e033dc24-62c0-4f2c-928e-99122efab19d}\windowsdesktop-runtime-8.0.20-win-x64.exe" -burn.filehandle.attached=560 -burn.filehandle.self=580 /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.20_(x64)_20261110123515.log"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:352
          • C:\ProgramData\Package Cache\{e033dc24-62c0-4f2c-928e-99122efab19d}\windowsdesktop-runtime-8.0.20-win-x64.exe
            "C:\ProgramData\Package Cache\{e033dc24-62c0-4f2c-928e-99122efab19d}\windowsdesktop-runtime-8.0.20-win-x64.exe" -q -burn.elevated BurnPipe.{29864D99-E410-4552-BE58-45CB9DC8381D} {34BDEDAF-9482-4CEA-8576-A02CD0E105DA} 352
            4⤵
            • Adds Run key to start application
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            PID:5920
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 352 -s 1076
            4⤵
            • Program crash
            PID:2292
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k GPSvcGroup
      1⤵
        PID:4012
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 6004 -ip 6004
        1⤵
          PID:1000
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 2620 -ip 2620
          1⤵
            PID:5168
          • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
            "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"
            1⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Reads the TCP/IP host and domain name from the registry
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            • System policy modification
            PID:1128
            • C:\Windows\SysWOW64\wermgr.exe
              "C:\Windows\system32\wermgr.exe" "-outproc" "0" "1128" "896" "820" "900" "0" "0" "0" "0" "0" "0" "0" "0"
              2⤵
              • System Location Discovery: System Language Discovery
              PID:1064
          • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
            "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
            1⤵
            • Checks system information in the registry
            • Executes dropped EXE
            • Loads dropped DLL
            • Reads the TCP/IP host and domain name from the registry
            • System Location Discovery: System Language Discovery
            • Modifies data under HKEY_USERS
            • Suspicious use of WriteProcessMemory
            PID:5408
            • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
              "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zMTUuMTciIHNoZWxsX3ZlcnNpb249IjEuMy4zMTUuMTciIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NkQ2Rjg4MzAtMkE4RS00OTQwLUE1MjktRDk2ODQyMTMwODkxfSIgdXNlcmlkPSJ7MDdEMjM0NkEtQ0NBQi00QzA4LTkyMjgtNDRGQjEwMkI4MTU3fSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7ODcxNDcxOUQtNzEyNS00Qjg3LUJEQ0QtM0FFQzJBRkQzN0NBfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjE2IiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMjYxMDAuMTc0MiIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjE5MSIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iREFEWSIgcHJvZHVjdF9uYW1lPSJEYWR5IHN1cGVyIHBvd2VyZnVsIFBDIi8-PGV4cCBldGFnPSImcXVvdDtzOEZhbnZ3Zk1jZDY2ZzdMVjJQZWFTUjdXVU92MGx1RjRodmlpclRvaytNPSZxdW90OyIvPjxhcHAgYXBwaWQ9Ins4QTY5RDM0NS1ENTY0LTQ2M2MtQUZGMS1BNjlEOUU1MzBGOTZ9IiB2ZXJzaW9uPSIxNDAuMC43MzM5LjgxIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSI1OSIgaW5zdGFsbGRhdGV0aW1lPSIxNzg5MTc1MTg3IiBvb2JlX2luc3RhbGxfdGltZT0iMTM0MzM2NDc1MjY4NzgwMDAwIj48ZXZlbnQgZXZlbnR0eXBlPSIzMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iODM5Njg3OTIiIHN5c3RlbV91cHRpbWVfdGlja3M9IjcxOTg5NTkwNDgiLz48L2FwcD48L3JlcXVlc3Q-
              2⤵
              • Checks system information in the registry
              • Executes dropped EXE
              • Loads dropped DLL
              • Reads the TCP/IP host and domain name from the registry
              • System Location Discovery: System Language Discovery
              • System Network Configuration Discovery: Internet Connection Discovery
              • Modifies data under HKEY_USERS
              PID:4740
            • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
              "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zMTUuMTciIHNoZWxsX3ZlcnNpb249IjEuMy4zMTUuMTciIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RTJEMzgwQjEtMkEzRC00QUU0LUIwNTktODYzOTk5OTkyNkVDfSIgdXNlcmlkPSJ7MDdEMjM0NkEtQ0NBQi00QzA4LTkyMjgtNDRGQjEwMkI4MTU3fSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7MEVGM0JENDctNTE5Mi00RUY5LThDNzktMUQ5QUJEMEExNTNFfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjE2IiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMjYxMDAuMTc0MiIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjE5MSIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iREFEWSIgcHJvZHVjdF9uYW1lPSJEYWR5IHN1cGVyIHBvd2VyZnVsIFBDIi8-PGV4cCBldGFnPSImcXVvdDtIaHZISVdwVU5aVE1uVjJWVDFsZTNmNVlKUTlPU29URDZNeEhEbEE4OVBnPSZxdW90OyIvPjxhcHAgYXBwaWQ9Ins4QTY5RDM0NS1ENTY0LTQ2M2MtQUZGMS1BNjlEOUU1MzBGOTZ9IiB2ZXJzaW9uPSIxNDAuMC43MzM5LjgxIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSI1OSIgaW5zdGFsbGRhdGV0aW1lPSIxNzg5MTc1MTg3IiBvb2JlX2luc3RhbGxfdGltZT0iMTM0MzM2NDc1MjY4NzgwMDAwIj48ZXZlbnQgZXZlbnR0eXBlPSIzMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iODM5Njg3OTIiIHN5c3RlbV91cHRpbWVfdGlja3M9IjcyMDQ1NzkyMzQiLz48L2FwcD48L3JlcXVlc3Q-
              2⤵
              • Checks system information in the registry
              • Executes dropped EXE
              • Loads dropped DLL
              • Reads the TCP/IP host and domain name from the registry
              • System Location Discovery: System Language Discovery
              • System Network Configuration Discovery: Internet Connection Discovery
              PID:2584
            • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{20B9B292-03F2-43FA-B105-B65A6DDCF3B8}\MicrosoftEdge_X64_157.0.4341.46.exe
              "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{20B9B292-03F2-43FA-B105-B65A6DDCF3B8}\MicrosoftEdge_X64_157.0.4341.46.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
              2⤵
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:4884
              • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{20B9B292-03F2-43FA-B105-B65A6DDCF3B8}\EDGEMITMP_3F46C.tmp\setup.exe
                "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{20B9B292-03F2-43FA-B105-B65A6DDCF3B8}\EDGEMITMP_3F46C.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{20B9B292-03F2-43FA-B105-B65A6DDCF3B8}\MicrosoftEdge_X64_157.0.4341.46.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
                3⤵
                • Drops file in Program Files directory
                • Drops file in Windows directory
                • Executes dropped EXE
                PID:4092
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 352 -ip 352
            1⤵
              PID:3328

            Network

                  MITRE ATT&CK Enterprise v16

                  Reconnaissance

                  Resource Development

                  Initial Access

                  Execution

                  Persistence

                  Boot or Logon Autostart Execution

                  1
                  T1547

                  Registry Run Keys / Startup Folder

                  1
                  T1547.001

                  Event Triggered Execution

                  2
                  T1546

                  Component Object Model Hijacking

                  1
                  T1546.015

                  Image File Execution Options Injection

                  1
                  T1546.012

                  Privilege Escalation

                  Boot or Logon Autostart Execution

                  1
                  T1547

                  Registry Run Keys / Startup Folder

                  1
                  T1547.001

                  Event Triggered Execution

                  2
                  T1546

                  Component Object Model Hijacking

                  1
                  T1546.015

                  Image File Execution Options Injection

                  1
                  T1546.012

                  Defense Evasion

                  Modify Registry

                  3
                  T1112

                  Subvert Trust Controls

                  1
                  T1553

                  Install Root Certificate

                  1
                  T1553.004

                  Credential Access

                  Discovery

                  Peripheral Device Discovery

                  2
                  T1120

                  Query Registry

                  4
                  T1012

                  System Information Discovery

                  4
                  T1082

                  System Location Discovery

                  1
                  T1614

                  System Language Discovery

                  1
                  T1614.001

                  System Network Configuration Discovery

                  2
                  T1016

                  Internet Connection Discovery

                  1
                  T1016.001

                  Lateral Movement

                  Collection

                  Command and Control

                  Exfiltration

                  Impact

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  e5b3f3d.rbs
                  • Path C:\Config.Msi\e5b3f3d.rbs
                  • Size 16KB
                  • SHA256 4887cb282f0a56a0b2ac4734d07479dd0e6c5eaf70695699f3c8fe8b4d8dfd81
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  e5b3f42.rbs
                  • Path C:\Config.Msi\e5b3f42.rbs
                  • Size 18KB
                  • SHA256 28e393deaf6f750e011601077b6f840873b8198d694856668d32411b303835cb
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  e5b3f4d.rbs
                  • Path C:\Config.Msi\e5b3f4d.rbs
                  • Size 48KB
                  • SHA256 ce635b006584e9de75cda79a09a47c15ee305dfa738dda0619491449432be403
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  e5b3f51.rbs
                  • Path C:\Config.Msi\e5b3f51.rbs
                  • Size 3KB
                  • SHA256 841b17268e4de1b47b552b353fd6b891c31388c911ff58a621ed3683414fbb67
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  msedge_7z.data
                  • Path C:\Program Files (x86)\Microsoft\EdgeCore\157.0.4341.46\Installer\msedge_7z.data
                  • Size 6KB
                  • SHA256 73af4334e3b59436e9317494f4a8d8ea7c0bb6022c014ba474d0b862caa18007
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  setup.exe
                  • Path C:\Program Files (x86)\Microsoft\EdgeCore\157.0.4341.46\Installer\setup.exe
                  • Size 6.1MB
                  • SHA256 6fe92b5ca87cdfc4d23069552b5be6adc23ef7f2c3a710d1957f550f143bb159
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  MicrosoftEdgeUpdate.exe
                  • Path C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.315.17\MicrosoftEdgeUpdate.exe
                  • Size 203KB
                  • SHA256 24b77e287da93273364769190659db25d64c126da1abaf5106e64fc7897d7b91
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  CopilotUpdate.exe
                  • Path C:\Program Files (x86)\Microsoft\EdgeUpdate\CopilotUpdate.exe
                  • Size 22KB
                  • SHA256 0ebd2ea2b269166c13e8c57fd40823909789b0dcacc6e566c5ebd2334d9e5812
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  MicrosoftEdgeUpdate.log
                  • Path C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log
                  • Size 183KB
                  • SHA256 08aa3c66e1b699ff58e2bc82f121990516ba1fc146935eb070c6ec6e7857c364
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  vcRuntimeAdditional_x86
                  • Path C:\ProgramData\Package Cache\.unverified\vcRuntimeAdditional_x86
                  • Size 180KB
                  • SHA256 be137dc2b1ec7e85ae7a003a09537d3706605e34059361404ea3110874895e3a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  state.rsm
                  • Path C:\ProgramData\Package Cache\{47109d57-d746-4f8b-9618-ed6a17cc922b}\state.rsm
                  • Size 1KB
                  • SHA256 7071e1b358a9effe3247f6476f79e8f90b4c622a03b8de1bf583a69aaaf90958
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  dotnet-hostfxr-8.0.20-win-x64.msi
                  • Path C:\ProgramData\Package Cache\{BB4BB73D-8784-40A3-9888-9BD29EC1B023}v64.80.39230\dotnet-hostfxr-8.0.20-win-x64.msi
                  • Size 776KB
                  • SHA256 18414ef679bfdb2fc95172008a2622862053e8bf77a94e702c48b7a3c2b1dc56
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  state.rsm
                  • Path C:\ProgramData\Package Cache\{e033dc24-62c0-4f2c-928e-99122efab19d}\state.rsm
                  • Size 1KB
                  • SHA256 90f96897068091433aacf52a0945b1b7fbc359231174d2a493c85fca8cf5a05a
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  Microsoft_Windows_Desktop_Runtime_-_8.0.20_(x64)_20261110123515_000_dotnet_runtime_8.0.20_win_x64.msi.log
                  • Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.20_(x64)_20261110123515_000_dotnet_runtime_8.0.20_win_x64.msi.log
                  • Size 4KB
                  • SHA256 edea6f711d55c60b4e3e15ecbf2dbe6d321c818ed1340fdcc06722f281892628
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  Microsoft_Windows_Desktop_Runtime_-_8.0.20_(x64)_20261110123515_000_dotnet_runtime_8.0.20_win_x64.msi.log
                  • Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.20_(x64)_20261110123515_000_dotnet_runtime_8.0.20_win_x64.msi.log
                  • Size 2B
                  • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
                  • MD5 SHA1 SHA512
                  Submit Download

                  Microsoft_Windows_Desktop_Runtime_-_8.0.20_(x64)_20261110123517_000_dotnet_runtime_8.0.20_win_x64.msi.log
                  • Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.20_(x64)_20261110123517_000_dotnet_runtime_8.0.20_win_x64.msi.log
                  • Size 2KB
                  • SHA256 49a7143f89228b0a4d3e5e1061caefe428b5ccf99af1045f9b24d77e50f16f4e
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  dd_vcredist_x86_20261110123510.log
                  • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261110123510.log
                  • Size 13KB
                  • SHA256 f4d02519e29c644ef80db2adc3fb5bb1c5f103d2efb2ee8c5d1e6da60a85f349
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  dd_vcredist_x86_20261110123510_000_vcRuntimeMinimum_x86.log
                  • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261110123510_000_vcRuntimeMinimum_x86.log
                  • Size 2KB
                  • SHA256 3f2ddb3a3650edaec75723656e4ab9ca89a1da3bc1afcdb745e293a1fec17c04
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  0x0409.ini
                  • Path C:\Users\Admin\AppData\Local\Temp\{83961A70-1C49-47C3-8D1D-875692729E1A}\0x0409.ini
                  • Size 22KB
                  • SHA256 cdb316d7f9aa2d854eb28f7a333426a55cc65fa7d31b0bdf8ae108e611583d29
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  Microsoft Visual C++ 2022 Redistributable Package (x64) 14.40.33810.0.prq
                  • Path C:\Users\Admin\AppData\Local\Temp\{83961A70-1C49-47C3-8D1D-875692729E1A}\Microsoft Visual C++ 2022 Redistributable Package (x64) 14.40.33810.0.prq
                  • Size 765B
                  • SHA256 31315e1b30dd5d3cc235c1eee594a2022857fcf1d9d246cffa0fd84b0b3c0637
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  _ISMSIDEL.INI
                  • Path C:\Users\Admin\AppData\Local\Temp\{83961A70-1C49-47C3-8D1D-875692729E1A}\_ISMSIDEL.INI
                  • Size 4KB
                  • SHA256 11eb11070794149486a1bb1f3557b7acd324c54a2b3d370f09a28e4b74ddb6d3
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _ISMSIDEL.INI
                  • Path C:\Users\Admin\AppData\Local\Temp\{83961A70-1C49-47C3-8D1D-875692729E1A}\_ISMSIDEL.INI
                  • Size 676B
                  • SHA256 cd5aa45dba49be5fee4bba9dff583ab9d8a191647aaa741f47aa9c665bbafe65
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  _ISMSIDEL.INI
                  • Path C:\Users\Admin\AppData\Local\Temp\{83961A70-1C49-47C3-8D1D-875692729E1A}\_ISMSIDEL.INI
                  • Size 5KB
                  • SHA256 2bf646273c664831fa28e5b2ed71132804e4d29deb5d6a11bba850ca77cae6cc
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  VC_redist.x86.exe
                  • Path C:\Users\Admin\AppData\Local\Temp\{83961A70-1C49-47C3-8D1D-875692729E1A}\{95E15BA6-1906-411B-B742-11E52CDA67A6}\VC_redist.x86.exe
                  • Size 13.2MB
                  • SHA256 a32dd41eaab0c5e1eaa78be3c0bb73b48593de8d97a7510b97de3fd993538600
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  VC_redist.x64.exe
                  • Path C:\Users\Admin\AppData\Local\Temp\{83961A70-1C49-47C3-8D1D-875692729E1A}\{976ADED9-B0C4-4C44-BE06-3B76F14639EB}\VC_redist.x64.exe
                  • Size 24.2MB
                  • SHA256 3642e3f95d50cc193e4b5a0b0ffbf7fe2c08801517758b4c8aeb7105a091208a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  MicrosoftEdgeWebview2Setup.exe
                  • Path C:\Users\Admin\AppData\Local\Temp\{83961A70-1C49-47C3-8D1D-875692729E1A}\{EF3FC405-FAA8-421C-90FD-F79A30411F9C}\MicrosoftEdgeWebview2Setup.exe
                  • Size 1.8MB
                  • SHA256 cf2f2445fef0c5c14e372045f84998771eeb8bb01d59be4afd00692fa160082e
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  InstallerSplash_800_600.bmp
                  • Path C:\Users\Admin\AppData\Local\Temp\{A21E7D59-3B63-4ED5-B986-B7624C7FCBAA}\InstallerSplash_800_600.bmp
                  • Size 1.4MB
                  • SHA256 88b334003551a47dbcbeaed257d651dde8955666997f9e0216ed474a3061541d
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  Microsoft .NET 8.0 Desktop Runtime 8.0.20 (x64).prq
                  • Path C:\Users\Admin\AppData\Local\Temp\{A21E7D59-3B63-4ED5-B986-B7624C7FCBAA}\Microsoft .NET 8.0 Desktop Runtime 8.0.20 (x64).prq
                  • Size 1KB
                  • SHA256 5e46a629a80ff1b776b8ce97cdbcf9d96902211f72c6336056d2a1e9e5929585
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  Microsoft .NET 8.0 Desktop Runtime 8.0.20 (x86).prq
                  • Path C:\Users\Admin\AppData\Local\Temp\{A21E7D59-3B63-4ED5-B986-B7624C7FCBAA}\Microsoft .NET 8.0 Desktop Runtime 8.0.20 (x86).prq
                  • Size 1KB
                  • SHA256 bde24f09718403d13f45b448397ea4ba22dead71a5bd09a698e7d6e5f21a0aca
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  Microsoft .NET Framework 4.8.1 Full.prq
                  • Path C:\Users\Admin\AppData\Local\Temp\{A21E7D59-3B63-4ED5-B986-B7624C7FCBAA}\Microsoft .NET Framework 4.8.1 Full.prq
                  • Size 1KB
                  • SHA256 d23e7325cf8a0093e850c8ac46d47df38b1caa9c445f65389c4e2f04629abd2f
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  Microsoft Visual C++ 2022 Redistributable Package (x86) 14.40.33810.0.prq
                  • Path C:\Users\Admin\AppData\Local\Temp\{A21E7D59-3B63-4ED5-B986-B7624C7FCBAA}\Microsoft Visual C++ 2022 Redistributable Package (x86) 14.40.33810.0.prq
                  • Size 765B
                  • SHA256 3927f2ee6fab0041ca336ccab3ea40b9ced9c0dc30be563b3ac1381a27f97986
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  WebView2Bootstrapper.prq
                  • Path C:\Users\Admin\AppData\Local\Temp\{A21E7D59-3B63-4ED5-B986-B7624C7FCBAA}\WebView2Bootstrapper.prq
                  • Size 1KB
                  • SHA256 bcf3bd5496bd4b2fa1937049cd19ef0162b65ad67ec8fe86dea9d4564d22a398
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  _ISMSIDEL.INI
                  • Path C:\Users\Admin\AppData\Local\Temp\{A21E7D59-3B63-4ED5-B986-B7624C7FCBAA}\_ISMSIDEL.INI
                  • Size 676B
                  • SHA256 ea122500552214723b8311c0775d67f3b0fb870889b8e884c129a5a85fa4ef90
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  _ISMSIDEL.INI
                  • Path C:\Users\Admin\AppData\Local\Temp\{A21E7D59-3B63-4ED5-B986-B7624C7FCBAA}\_ISMSIDEL.INI
                  • Size 3KB
                  • SHA256 1a1b13718a9fbf44f7a438b1fbf1ee6e635ee4d50892450843f7abea24bae640
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  _ISMSIDEL.INI
                  • Path C:\Users\Admin\AppData\Local\Temp\{A21E7D59-3B63-4ED5-B986-B7624C7FCBAA}\_ISMSIDEL.INI
                  • Size 4KB
                  • SHA256 29b03fc63172fbd43dd13835324a79e7d28555390ec7d8a494fc4e05b563f05e
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  ~8D5E.tmp
                  • Path C:\Users\Admin\AppData\Local\Temp\~8D5E.tmp
                  • Size 6KB
                  • SHA256 2604b4b34f55933a9544854cd96d99dab163b475b873c781346d14792d8d32d7
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  MSI6A42.tmp
                  • Path C:\Windows\Installer\MSI6A42.tmp
                  • Size 219KB
                  • SHA256 2bf33a9b9980e44d21d48f04cc6ac4eed4c68f207bd5990b7d3254a310b944ae
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  VC_redist.x64.exe
                  • Path C:\Windows\Temp\{27EF39FA-475E-40B0-8FF1-1E59792FE945}\.cr\VC_redist.x64.exe
                  • Size 635KB
                  • SHA256 8cd998a0318f07a27f78b75edb19479f44273590e300629eff237d47643c496c
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  bg.png
                  • Path C:\Windows\Temp\{39527707-EA8A-432B-8709-FD5AB01441DD}\.ba\bg.png
                  • Size 4KB
                  • SHA256 9095bf7b6baa0107b40a4a6d727215be077133a190f4ca9bd89a176842141e79
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  wixstdba.dll
                  • Path C:\Windows\Temp\{39527707-EA8A-432B-8709-FD5AB01441DD}\.ba\wixstdba.dll
                  • Size 190KB
                  • SHA256 dcea15f3710822ffc262e62ec04cc7bbbf0f33f5d1a853609fbfb65cb6a45640
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  dotnet_host_8.0.20_win_x64.msi
                  • Path C:\Windows\Temp\{39527707-EA8A-432B-8709-FD5AB01441DD}\dotnet_host_8.0.20_win_x64.msi
                  • Size 708KB
                  • SHA256 e09d2a4555224145397648ff6dc0abb3542362eaf6a598a17c129285c65d6305
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  dotnet_runtime_8.0.20_win_x64.msi
                  • Path C:\Windows\Temp\{39527707-EA8A-432B-8709-FD5AB01441DD}\dotnet_runtime_8.0.20_win_x64.msi
                  • Size 26.2MB
                  • SHA256 fcb26b1cbfee33941e90e25bf9924fedff9494f3e49781af77bc007261b36e87
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  windowsdesktop_runtime_8.0.20_win_x64.msi
                  • Path C:\Windows\Temp\{39527707-EA8A-432B-8709-FD5AB01441DD}\windowsdesktop_runtime_8.0.20_win_x64.msi
                  • Size 29.2MB
                  • SHA256 2da5c1985576249ccc021ffde8728dc2114586504fe0158e8c4a752c984050f8
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  BootstrapperApplicationData.xml
                  • Path C:\Windows\Temp\{43EA72CD-4C81-4AC4-A739-854016F07614}\.ba\BootstrapperApplicationData.xml
                  • Size 7KB
                  • SHA256 2d876e8c7eeb4a2d8be1beb935ef64ec3f6309f272a76a318a6788d4d363a864
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  thm.xml
                  • Path C:\Windows\Temp\{43EA72CD-4C81-4AC4-A739-854016F07614}\.ba\thm.xml
                  • Size 11KB
                  • SHA256 83ca096f7ba2c83fc3b3aeb697b8139a788fa35eb8632943e26bb9fff7c78e63
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  windowsdesktop-runtime-8.0.20-win-x64.exe
                  • Path C:\Windows\Temp\{6431C0AE-03C3-4B66-AE76-562A157B10A3}\.cr\windowsdesktop-runtime-8.0.20-win-x64.exe
                  • Size 608KB
                  • SHA256 22489c7f5423aabe0eaea7dfaccca8c4764b578686069b5f850b1d2ced9d6318
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  VC_redist.x86.exe
                  • Path C:\Windows\Temp\{A8BF798F-047A-461E-97E2-16EDB73C93B6}\.cr\VC_redist.x86.exe
                  • Size 634KB
                  • SHA256 81873c2f6c8bc4acaad66423a1b4d90e70214e59710ea7f11c8aeb069acd4cd0
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  license.rtf
                  • Path C:\Windows\Temp\{BD40E3C9-9ED5-4468-B990-18A8BD362D09}\.ba\license.rtf
                  • Size 9KB
                  • SHA256 8099dc3cf9502c335da829e5c755948a12e3e6de490eb492a99deb673d883d8b
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  thm.wxl
                  • Path C:\Windows\Temp\{BD40E3C9-9ED5-4468-B990-18A8BD362D09}\.ba\thm.wxl
                  • Size 2KB
                  • SHA256 70400f181d00e1769774ff36bcd8b1ab5fbc431418067d31b876d18cc04ef4ce
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  thm.xml
                  • Path C:\Windows\Temp\{BD40E3C9-9ED5-4468-B990-18A8BD362D09}\.ba\thm.xml
                  • Size 8KB
                  • SHA256 f13bae0ec08c91b4a315bb2d86ee48fade597e7a5440dce6f751f98a3a4d6916
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  cab54A5CABBE7274D8A22EB58060AAB7623
                  • Path C:\Windows\Temp\{BD40E3C9-9ED5-4468-B990-18A8BD362D09}\cab54A5CABBE7274D8A22EB58060AAB7623
                  • Size 822KB
                  • SHA256 f4576ef2e843c282d2a932f7c55d71cc3fcbb35b0a17a0a640eb5f21731cc809
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  cabB3E1576D1FEFBB979E13B1A5379E0B16
                  • Path C:\Windows\Temp\{BD40E3C9-9ED5-4468-B990-18A8BD362D09}\cabB3E1576D1FEFBB979E13B1A5379E0B16
                  • Size 4.9MB
                  • SHA256 7327d37634cc8e966342f478168b8850bea36a126d002c38c7438a7bd557c4ca
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  vcRuntimeMinimum_x86
                  • Path C:\Windows\Temp\{BD40E3C9-9ED5-4468-B990-18A8BD362D09}\vcRuntimeMinimum_x86
                  • Size 180KB
                  • SHA256 a2ad58d741be5d40af708e15bf0dd5e488187bf28f0b699d391a9ef96f899886
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  thm.wxl
                  • Path C:\Windows\Temp\{E8FEA2A0-AE2C-48D2-8298-C2565C04950F}\.ba\thm.wxl
                  • Size 5KB
                  • SHA256 81a68046b06e09385be8449373e7ceb9e79f7724c3cf11f0b18a4489a8d4926a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  BootstrapperApplicationData.xml
                  • Path C:\Windows\Temp\{FA2FD750-2C0D-4234-9E64-C25E55A46ED8}\.ba\BootstrapperApplicationData.xml
                  • Size 12KB
                  • SHA256 d9b920b7d734890da5b5c830875a8a47dcdda0027222d0169ba68db769071ded
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  logo.png
                  • Path C:\Windows\Temp\{FEDA5592-40AF-4B18-87BA-314B44A58D62}\.ba\logo.png
                  • Size 1KB
                  • SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  wixstdba.dll
                  • Path C:\Windows\Temp\{FEDA5592-40AF-4B18-87BA-314B44A58D62}\.ba\wixstdba.dll
                  • Size 191KB
                  • SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  memory/1772-1312-0x00000000718D0000-0x0000000071B51000-memory.dmp
                  Download

                  memory/1772-1302-0x0000000000CB0000-0x0000000000CE5000-memory.dmp
                  Download

                  memory/1772-1303-0x00000000718D0000-0x0000000071B51000-memory.dmp
                  Download

                  memory/1772-1317-0x00000000718D0000-0x0000000071B51000-memory.dmp
                  Download

                  memory/4012-1296-0x000001868D0D0000-0x000001868D219000-memory.dmp
                  Download

                  memory/5488-1299-0x0000021194970000-0x0000021195314000-memory.dmp
                  Download

                  memory/5488-662-0x0000021194970000-0x0000021195314000-memory.dmp
                  Download