ea1b14a999e6a5930374a30fb689d8c1c1c842790eb8e8305b43988f76f199b2

Analysis

user interaction
yes
max time kernel
898s
max time network
479s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/11/2026, 15:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
P2BL_2.0.31-11.4.802.SETUP.exe
Size 17.2MB
Sample261113-sysqmsds3n
SHA256 ea1b14a999e6a5930374a30fb689d8c1c1c842790eb8e8305b43988f76f199b2
MD5 98f9860aa4a90053112b3e6e719c0460
SHA1 4741c41afc1dac0b31e0646b8f65dd2cb3024c3e
SHA512 61a2b351fcc1f378f2cc2b289274043da836ac5288d0df76487ad671654660b9465f0eab5c8f5c234d5d40bf7970ab702ec092b49d7fec8670943f50ce85808b
SSDEEP 393216:VRpN/jpSDILtdKGREhc3mhHdCaoWLOKB+UDwSDHgVO:zpR1UGRYAAfLOE+UD3DHKO
TLSH
T10007333F728B753EE56A1A3A7AB2A214543F7B21A5128C4696F0C44CCF295701E3F787
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery installer persistence

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
87	4400	msedge.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\International\Geo\Nation	Portal2BetaLauncher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\International\Geo\Nation	windowsdesktop-runtime-10.0.15-win-x64.exe

Executes dropped EXE 11 IoCs

pid	Process
4292	P2BL_2.0.31-11.4.802.SETUP.tmp
1784	Portal2BetaLauncher.exe
5252	windowsdesktop-runtime-10.0.15-win-x64.exe
5392	windowsdesktop-runtime-10.0.15-win-x64.exe
5616	wixstdba.exe
5688	wixstdba.exe
5760	windowsdesktop-runtime-10.0.15-win-x64.exe
1708	windowsdesktop-runtime-10.0.15-win-x64.exe
1536	windowsdesktop-runtime-10.0.15-win-x64.exe
5960	wixstdba.exe
5572	Portal2BetaLauncher.exe

Loads dropped DLL 64 IoCs

pid	Process
2264	MsiExec.exe
2264	MsiExec.exe
5356	MsiExec.exe
5356	MsiExec.exe
5644	MsiExec.exe
5644	MsiExec.exe
5580	MsiExec.exe
5580	MsiExec.exe
5572	Portal2BetaLauncher.exe
5572	Portal2BetaLauncher.exe
5572	Portal2BetaLauncher.exe
5572	Portal2BetaLauncher.exe
5572	Portal2BetaLauncher.exe
5572	Portal2BetaLauncher.exe
5572	Portal2BetaLauncher.exe
5572	Portal2BetaLauncher.exe
5572	Portal2BetaLauncher.exe
5572	Portal2BetaLauncher.exe
5572	Portal2BetaLauncher.exe
5572	Portal2BetaLauncher.exe
5572	Portal2BetaLauncher.exe
5572	Portal2BetaLauncher.exe
5572	Portal2BetaLauncher.exe
5572	Portal2BetaLauncher.exe
5572	Portal2BetaLauncher.exe
5572	Portal2BetaLauncher.exe
5572	Portal2BetaLauncher.exe
5572	Portal2BetaLauncher.exe
5572	Portal2BetaLauncher.exe
5572	Portal2BetaLauncher.exe
5572	Portal2BetaLauncher.exe
5572	Portal2BetaLauncher.exe
5572	Portal2BetaLauncher.exe
5572	Portal2BetaLauncher.exe
5572	Portal2BetaLauncher.exe
5572	Portal2BetaLauncher.exe
5572	Portal2BetaLauncher.exe
5572	Portal2BetaLauncher.exe
5572	Portal2BetaLauncher.exe
5572	Portal2BetaLauncher.exe
5572	Portal2BetaLauncher.exe
5572	Portal2BetaLauncher.exe
5572	Portal2BetaLauncher.exe
5572	Portal2BetaLauncher.exe
5572	Portal2BetaLauncher.exe
5572	Portal2BetaLauncher.exe
5572	Portal2BetaLauncher.exe
5572	Portal2BetaLauncher.exe
5572	Portal2BetaLauncher.exe
5572	Portal2BetaLauncher.exe
5572	Portal2BetaLauncher.exe
5572	Portal2BetaLauncher.exe
5572	Portal2BetaLauncher.exe
5572	Portal2BetaLauncher.exe
5572	Portal2BetaLauncher.exe
5572	Portal2BetaLauncher.exe
5572	Portal2BetaLauncher.exe
5572	Portal2BetaLauncher.exe
5572	Portal2BetaLauncher.exe
5572	Portal2BetaLauncher.exe
5572	Portal2BetaLauncher.exe
5572	Portal2BetaLauncher.exe
5572	Portal2BetaLauncher.exe
5572	Portal2BetaLauncher.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{B198B6E8-FF66-4131-ACFF-BEAEAF82FF84} = "\"C:\\ProgramData\\Package Cache\\{B198B6E8-FF66-4131-ACFF-BEAEAF82FF84}\\windowsdesktop-runtime-10.0.15-win-x64.exe\" /burn.runonce"	windowsdesktop-runtime-10.0.15-win-x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.15\zh-Hant\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.15\System.Diagnostics.Tools.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.15\System.Threading.Channels.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.15\fr\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.15\System.Data.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.15\ja\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.15\ko\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.15\pl\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.15\System.Collections.Concurrent.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.15\System.Memory.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.15\System.Threading.Tasks.Dataflow.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.15\de\WindowsBase.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.15\ko\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.15\pl\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.15\System.Security.SecureString.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.15\Microsoft.VisualBasic.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.15\ko\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.15\pl\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.15\pt-BR\UIAutomationClient.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\LICENSE.txt	msiexec.exe
File opened for modification	C:\Program Files\dotnet\ThirdPartyNotices.txt	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.15\System.IO.UnmanagedMemoryStream.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.15\System.ServiceModel.Web.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.15\zh-Hant\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.15\System.Console.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.15\System.Diagnostics.DiagnosticSource.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.15\System.Private.Windows.Core.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.15\System.IO.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.15\System.Private.Uri.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.15\System.Resources.ResourceManager.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.15\de\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.15\ja\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.15\mscorlib.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.15\System.Security.Cryptography.ProtectedData.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.15\ru\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.15\zh-Hans\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.15\zh-Hans\WindowsBase.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.15\zh-Hant\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.15\System.IO.IsolatedStorage.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.15\System.Security.Cryptography.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.15\de\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.15\it\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.15\pl\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.15\System.Net.Primitives.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.15\System.Reflection.Emit.Lightweight.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.15\System.Text.Json.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.15\wpfgfx_cor3.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.15\it\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.15\pt-BR\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.15\tr\UIAutomationTypes.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.15\de\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.15\System.Drawing.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.15\es\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.15\es\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.15\fr\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.15\ja\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.15\System.Runtime.Intrinsics.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.15\System.Windows.Extensions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.15\ru\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.15\zh-Hans\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.15\zh-Hant\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.15\System.Reflection.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.15\pl\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.15\tr\PresentationFramework.resources.dll	msiexec.exe

Drops file in Windows directory 35 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\e5900d1.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149\fileCoreHostExe	msiexec.exe
File created	C:\Windows\Installer\SourceHash{6B9BDE96-B5FE-47CF-BBA2-B0C0FED0B12A}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1DE4.tmp	msiexec.exe
File created	C:\Windows\Installer\e5900e2.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5900e2.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149\fileCoreHostExe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3B15.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI95D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9FA.tmp	msiexec.exe
File created	C:\Windows\Installer\e5900dc.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI20F2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI245E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI34CA.tmp	msiexec.exe
File created	C:\Windows\Installer\e5900d1.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{BD0EEAB8-3491-4132-A440-8A5900C1C691}	msiexec.exe
File created	C:\Windows\Installer\e5900d7.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1B80.tmp	msiexec.exe
File created	C:\Windows\Installer\e5900dd.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI36A0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1CC9.tmp	msiexec.exe
File created	C:\Windows\Installer\e5900e1.msi	msiexec.exe
File created	C:\Windows\Installer\e5900e6.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149	msiexec.exe
File created	C:\Windows\Installer\e5900d8.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5900dd.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{D5FC86EF-1345-42F1-8C61-EE5BC9ECDED1}	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB62.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5900d8.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{888E927F-F300-4F16-882A-B9A04F9513FB}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4651.tmp	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.15-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.15-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	P2BL_2.0.31-11.4.802.SETUP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wixstdba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.15-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wixstdba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	P2BL_2.0.31-11.4.802.SETUP.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.15-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.15-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wixstdba.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4400	msedge.exe

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/memory/4376-0-0x0000000000C00000-0x0000000000D0E000-memory.dmp	innosetup
behavioral1/memory/4376-7-0x0000000000C00000-0x0000000000D0E000-memory.dmp	innosetup
behavioral1/memory/4376-379-0x0000000000C00000-0x0000000000D0E000-memory.dmp	innosetup

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{B198B6E8-FF66-4131-ACFF-BEAEAF82FF84}	windowsdesktop-runtime-10.0.15-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{B198B6E8-FF66-4131-ACFF-BEAEAF82FF84}\ = "{B198B6E8-FF66-4131-ACFF-BEAEAF82FF84}"	windowsdesktop-runtime-10.0.15-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\69EDB9B6EF5BFC74BB2A0B0CEF0D1BA2\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FE68CF5D54311F24C816EEB59CCEED1D\SourceList\PackageName = "dotnet-runtime-10.0.15-win-x64.msi"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FE68CF5D54311F24C816EEB59CCEED1D\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.60.61788_x64\ = "{6B9BDE96-B5FE-47CF-BBA2-B0C0FED0B12A}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\dotnet_runtime_80.60.61788_x64	windowsdesktop-runtime-10.0.15-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F729E888003F61F488A29B0AF45931BF\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F729E888003F61F488A29B0AF45931BF\SourceList	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\69EDB9B6EF5BFC74BB2A0B0CEF0D1BA2\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F729E888003F61F488A29B0AF45931BF\Provider	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8BAEE0DB194323144A04A895001C6C19\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\69EDB9B6EF5BFC74BB2A0B0CEF0D1BA2\MainFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\69EDB9B6EF5BFC74BB2A0B0CEF0D1BA2\SourceList\Media\1 = ";"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F729E888003F61F488A29B0AF45931BF\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8BAEE0DB194323144A04A895001C6C19\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\69EDB9B6EF5BFC74BB2A0B0CEF0D1BA2\Provider	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_80.60.61788_x64\DisplayName = "Microsoft .NET Runtime - 10.0.15 (x64)"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FE68CF5D54311F24C816EEB59CCEED1D\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FE68CF5D54311F24C816EEB59CCEED1D\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F729E888003F61F488A29B0AF45931BF\Version = "1346171228"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F729E888003F61F488A29B0AF45931BF\SourceList\PackageName = "windowsdesktop-runtime-10.0.15-win-x64.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8BAEE0DB194323144A04A895001C6C19	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FE68CF5D54311F24C816EEB59CCEED1D\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_80.60.61788_x64\Dependents\{B198B6E8-FF66-4131-ACFF-BEAEAF82FF84}	windowsdesktop-runtime-10.0.15-win-x64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Portal2BETALauncher.exe\DefaultIcon	P2BL_2.0.31-11.4.802.SETUP.tmp
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8BAEE0DB194323144A04A895001C6C19\Version = "1346171228"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8BAEE0DB194323144A04A895001C6C19\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x64\Dependents	windowsdesktop-runtime-10.0.15-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F729E888003F61F488A29B0AF45931BF\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.60.61788_x64	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.60.61788_x64\Version = "80.60.61788"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\FE68CF5D54311F24C816EEB59CCEED1D\MainFeature	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FE68CF5D54311F24C816EEB59CCEED1D	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Portal2BETALauncher.exe\ = "Portal 2 BETA Launcher"	P2BL_2.0.31-11.4.802.SETUP.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8BAEE0DB194323144A04A895001C6C19\SourceList\PackageName = "dotnet-host-10.0.15-win-x64.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8BAEE0DB194323144A04A895001C6C19\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{BD0EEAB8-3491-4132-A440-8A5900C1C691}v80.60.61788\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\69EDB9B6EF5BFC74BB2A0B0CEF0D1BA2	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F729E888003F61F488A29B0AF45931BF\ProductName = "Microsoft Windows Desktop Runtime - 10.0.15 (x64)"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Portal2BETALauncher.exe\shell\open\command	P2BL_2.0.31-11.4.802.SETUP.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x64\DisplayName = "Microsoft .NET Host - 10.0.15 (x64)"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\B8CB600BD905AC44CFA75351F4B6A051	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F729E888003F61F488A29B0AF45931BF	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F729E888003F61F488A29B0AF45931BF\PackageCode = "8FD73DF6D2969444DB7F96F10BB8FFD0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F729E888003F61F488A29B0AF45931BF\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Portal2BETALauncher.exe\DefaultIcon\ = "C:\\P2BL\\Portal 2 BETA Launcher\\Portal2BetaLauncher.exe,0"	P2BL_2.0.31-11.4.802.SETUP.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{B198B6E8-FF66-4131-ACFF-BEAEAF82FF84}\Dependents	windowsdesktop-runtime-10.0.15-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F729E888003F61F488A29B0AF45931BF\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F729E888003F61F488A29B0AF45931BF\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{888E927F-F300-4F16-882A-B9A04F9513FB}v80.60.61788\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\windowsdesktop_runtime_80.60.61788_x64	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8BAEE0DB194323144A04A895001C6C19	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\69EDB9B6EF5BFC74BB2A0B0CEF0D1BA2\SourceList	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8BAEE0DB194323144A04A895001C6C19\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8BAEE0DB194323144A04A895001C6C19\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8BAEE0DB194323144A04A895001C6C19\SourceList\Media	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\69EDB9B6EF5BFC74BB2A0B0CEF0D1BA2\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x64\ = "{BD0EEAB8-3491-4132-A440-8A5900C1C691}"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8BAEE0DB194323144A04A895001C6C19\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_80.60.61788_x64\ = "{888E927F-F300-4F16-882A-B9A04F9513FB}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Portal2BETALauncher.exe\shell\open	P2BL_2.0.31-11.4.802.SETUP.tmp
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\69EDB9B6EF5BFC74BB2A0B0CEF0D1BA2\Version = "1346171228"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.60.61788_x64	windowsdesktop-runtime-10.0.15-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FE68CF5D54311F24C816EEB59CCEED1D\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{D5FC86EF-1345-42F1-8C61-EE5BC9ECDED1}v80.60.61788\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Portal2BETALauncher.exe\shell\open\command	P2BL_2.0.31-11.4.802.SETUP.tmp

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4292	P2BL_2.0.31-11.4.802.SETUP.tmp
4292	P2BL_2.0.31-11.4.802.SETUP.tmp
5884	msiexec.exe
5884	msiexec.exe
5884	msiexec.exe
5884	msiexec.exe
5884	msiexec.exe
5884	msiexec.exe
5884	msiexec.exe
5884	msiexec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5760	windowsdesktop-runtime-10.0.15-win-x64.exe
Token: SeIncreaseQuotaPrivilege	5760	windowsdesktop-runtime-10.0.15-win-x64.exe
Token: SeSecurityPrivilege	5884	msiexec.exe
Token: SeCreateTokenPrivilege	5760	windowsdesktop-runtime-10.0.15-win-x64.exe
Token: SeAssignPrimaryTokenPrivilege	5760	windowsdesktop-runtime-10.0.15-win-x64.exe
Token: SeLockMemoryPrivilege	5760	windowsdesktop-runtime-10.0.15-win-x64.exe
Token: SeIncreaseQuotaPrivilege	5760	windowsdesktop-runtime-10.0.15-win-x64.exe
Token: SeMachineAccountPrivilege	5760	windowsdesktop-runtime-10.0.15-win-x64.exe
Token: SeTcbPrivilege	5760	windowsdesktop-runtime-10.0.15-win-x64.exe
Token: SeSecurityPrivilege	5760	windowsdesktop-runtime-10.0.15-win-x64.exe
Token: SeTakeOwnershipPrivilege	5760	windowsdesktop-runtime-10.0.15-win-x64.exe
Token: SeLoadDriverPrivilege	5760	windowsdesktop-runtime-10.0.15-win-x64.exe
Token: SeSystemProfilePrivilege	5760	windowsdesktop-runtime-10.0.15-win-x64.exe
Token: SeSystemtimePrivilege	5760	windowsdesktop-runtime-10.0.15-win-x64.exe
Token: SeProfSingleProcessPrivilege	5760	windowsdesktop-runtime-10.0.15-win-x64.exe
Token: SeIncBasePriorityPrivilege	5760	windowsdesktop-runtime-10.0.15-win-x64.exe
Token: SeCreatePagefilePrivilege	5760	windowsdesktop-runtime-10.0.15-win-x64.exe
Token: SeCreatePermanentPrivilege	5760	windowsdesktop-runtime-10.0.15-win-x64.exe
Token: SeBackupPrivilege	5760	windowsdesktop-runtime-10.0.15-win-x64.exe
Token: SeRestorePrivilege	5760	windowsdesktop-runtime-10.0.15-win-x64.exe
Token: SeShutdownPrivilege	5760	windowsdesktop-runtime-10.0.15-win-x64.exe
Token: SeDebugPrivilege	5760	windowsdesktop-runtime-10.0.15-win-x64.exe
Token: SeAuditPrivilege	5760	windowsdesktop-runtime-10.0.15-win-x64.exe
Token: SeSystemEnvironmentPrivilege	5760	windowsdesktop-runtime-10.0.15-win-x64.exe
Token: SeChangeNotifyPrivilege	5760	windowsdesktop-runtime-10.0.15-win-x64.exe
Token: SeRemoteShutdownPrivilege	5760	windowsdesktop-runtime-10.0.15-win-x64.exe
Token: SeUndockPrivilege	5760	windowsdesktop-runtime-10.0.15-win-x64.exe
Token: SeSyncAgentPrivilege	5760	windowsdesktop-runtime-10.0.15-win-x64.exe
Token: SeEnableDelegationPrivilege	5760	windowsdesktop-runtime-10.0.15-win-x64.exe
Token: SeManageVolumePrivilege	5760	windowsdesktop-runtime-10.0.15-win-x64.exe
Token: SeImpersonatePrivilege	5760	windowsdesktop-runtime-10.0.15-win-x64.exe
Token: SeCreateGlobalPrivilege	5760	windowsdesktop-runtime-10.0.15-win-x64.exe
Token: SeRestorePrivilege	5884	msiexec.exe
Token: SeTakeOwnershipPrivilege	5884	msiexec.exe
Token: SeRestorePrivilege	5884	msiexec.exe
Token: SeTakeOwnershipPrivilege	5884	msiexec.exe
Token: SeRestorePrivilege	5884	msiexec.exe
Token: SeTakeOwnershipPrivilege	5884	msiexec.exe
Token: SeRestorePrivilege	5884	msiexec.exe
Token: SeTakeOwnershipPrivilege	5884	msiexec.exe
Token: SeRestorePrivilege	5884	msiexec.exe
Token: SeTakeOwnershipPrivilege	5884	msiexec.exe
Token: SeRestorePrivilege	5884	msiexec.exe
Token: SeTakeOwnershipPrivilege	5884	msiexec.exe
Token: SeRestorePrivilege	5884	msiexec.exe
Token: SeTakeOwnershipPrivilege	5884	msiexec.exe
Token: SeRestorePrivilege	5884	msiexec.exe
Token: SeTakeOwnershipPrivilege	5884	msiexec.exe
Token: SeRestorePrivilege	5884	msiexec.exe
Token: SeTakeOwnershipPrivilege	5884	msiexec.exe
Token: SeRestorePrivilege	5884	msiexec.exe
Token: SeTakeOwnershipPrivilege	5884	msiexec.exe
Token: SeRestorePrivilege	5884	msiexec.exe
Token: SeTakeOwnershipPrivilege	5884	msiexec.exe
Token: SeRestorePrivilege	5884	msiexec.exe
Token: SeTakeOwnershipPrivilege	5884	msiexec.exe
Token: SeRestorePrivilege	5884	msiexec.exe
Token: SeTakeOwnershipPrivilege	5884	msiexec.exe
Token: SeRestorePrivilege	5884	msiexec.exe
Token: SeTakeOwnershipPrivilege	5884	msiexec.exe
Token: SeRestorePrivilege	5884	msiexec.exe
Token: SeTakeOwnershipPrivilege	5884	msiexec.exe
Token: SeRestorePrivilege	5884	msiexec.exe
Token: SeTakeOwnershipPrivilege	5884	msiexec.exe

Suspicious use of FindShellTrayWindow 16 IoCs

pid	Process
4292	P2BL_2.0.31-11.4.802.SETUP.tmp
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
5688	wixstdba.exe
5688	wixstdba.exe
1928	msedge.exe
5572	Portal2BetaLauncher.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4292	P2BL_2.0.31-11.4.802.SETUP.tmp

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4376 wrote to memory of 4292	4376	P2BL_2.0.31-11.4.802.SETUP.exe	83
PID 4292 wrote to memory of 1784	4292	P2BL_2.0.31-11.4.802.SETUP.tmp	93
PID 1784 wrote to memory of 1928	1784	Portal2BetaLauncher.exe	94
PID 1928 wrote to memory of 5116	1928	msedge.exe	95
PID 1928 wrote to memory of 4400	1928	msedge.exe	96
PID 1928 wrote to memory of 2952	1928	msedge.exe	97
PID 1928 wrote to memory of 2952	1928	msedge.exe	97
PID 1928 wrote to memory of 2952	1928	msedge.exe	97
PID 1928 wrote to memory of 3264	1928	msedge.exe	98
PID 1928 wrote to memory of 3264	1928	msedge.exe	98
PID 1928 wrote to memory of 3916	1928	msedge.exe	99
PID 1928 wrote to memory of 1704	1928	msedge.exe	100
PID 1928 wrote to memory of 3916	1928	msedge.exe	99
PID 1928 wrote to memory of 3916	1928	msedge.exe	99
PID 1928 wrote to memory of 1704	1928	msedge.exe	100
PID 1928 wrote to memory of 1704	1928	msedge.exe	100
PID 1928 wrote to memory of 4200	1928	msedge.exe	102
PID 1928 wrote to memory of 4200	1928	msedge.exe	102
PID 1928 wrote to memory of 4200	1928	msedge.exe	102
PID 1928 wrote to memory of 3740	1928	msedge.exe	103
PID 1928 wrote to memory of 3740	1928	msedge.exe	103
PID 1928 wrote to memory of 3740	1928	msedge.exe	103
PID 1928 wrote to memory of 5036	1928	msedge.exe	105
PID 1928 wrote to memory of 5036	1928	msedge.exe	105
PID 1928 wrote to memory of 4956	1928	msedge.exe	107
PID 1928 wrote to memory of 4956	1928	msedge.exe	107
PID 1928 wrote to memory of 4956	1928	msedge.exe	107
PID 1928 wrote to memory of 4468	1928	msedge.exe	108
PID 1928 wrote to memory of 4468	1928	msedge.exe	108
PID 1928 wrote to memory of 4604	1928	msedge.exe	109
PID 1928 wrote to memory of 4604	1928	msedge.exe	109
PID 1928 wrote to memory of 4100	1928	msedge.exe	112
PID 1928 wrote to memory of 3340	1928	msedge.exe	113
PID 1928 wrote to memory of 3340	1928	msedge.exe	113
PID 1928 wrote to memory of 1288	1928	msedge.exe	114
PID 1928 wrote to memory of 1288	1928	msedge.exe	114
PID 1928 wrote to memory of 2040	1928	msedge.exe	115
PID 1928 wrote to memory of 3144	1928	msedge.exe	116
PID 1928 wrote to memory of 2040	1928	msedge.exe	115
PID 1928 wrote to memory of 3144	1928	msedge.exe	116
PID 1928 wrote to memory of 3144	1928	msedge.exe	116
PID 1928 wrote to memory of 4224	1928	msedge.exe	117
PID 1928 wrote to memory of 4224	1928	msedge.exe	117
PID 1928 wrote to memory of 4364	1928	msedge.exe	118
PID 1928 wrote to memory of 4364	1928	msedge.exe	118
PID 1928 wrote to memory of 4036	1928	msedge.exe	119
PID 1928 wrote to memory of 4036	1928	msedge.exe	119
PID 1928 wrote to memory of 4036	1928	msedge.exe	119
PID 1928 wrote to memory of 668	1928	msedge.exe	120
PID 1928 wrote to memory of 5480	1928	msedge.exe	122
PID 1928 wrote to memory of 5480	1928	msedge.exe	122
PID 1928 wrote to memory of 1816	1928	msedge.exe	123
PID 1928 wrote to memory of 1816	1928	msedge.exe	123
PID 1928 wrote to memory of 1816	1928	msedge.exe	123
PID 1928 wrote to memory of 2948	1928	msedge.exe	124
PID 1928 wrote to memory of 2948	1928	msedge.exe	124
PID 1928 wrote to memory of 5252	1928	msedge.exe	126
PID 1928 wrote to memory of 5392	1928	msedge.exe	128
PID 5392 wrote to memory of 5616	5392	windowsdesktop-runtime-10.0.15-win-x64.exe	129
PID 5252 wrote to memory of 5688	5252	windowsdesktop-runtime-10.0.15-win-x64.exe	130
PID 5252 wrote to memory of 5760	5252	windowsdesktop-runtime-10.0.15-win-x64.exe	131
PID 5884 wrote to memory of 2264	5884	msiexec.exe	134
PID 1708 wrote to memory of 1536	1708	windowsdesktop-runtime-10.0.15-win-x64.exe	136
PID 5884 wrote to memory of 5356	5884	msiexec.exe	137

C:\Users\Admin\AppData\Local\Temp\P2BL_2.0.31-11.4.802.SETUP.exe
"C:\Users\Admin\AppData\Local\Temp\P2BL_2.0.31-11.4.802.SETUP.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4376
- C:\Users\Admin\AppData\Local\Temp\is-O6DT6DIT0K.tmp\P2BL_2.0.31-11.4.802.SETUP.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-O6DT6DIT0K.tmp\P2BL_2.0.31-11.4.802.SETUP.tmp" /SL5="$C01BC,16412518,1048064,C:\Users\Admin\AppData\Local\Temp\P2BL_2.0.31-11.4.802.SETUP.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4292
- - C:\P2BL\Portal 2 BETA Launcher\Portal2BetaLauncher.exe
    "C:\P2BL\Portal 2 BETA Launcher\Portal2BetaLauncher.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.NETCore.App&framework_version=10.0.0&arch=x64&rid=win-x64&os=win10&gui=true
      4⤵
      Checks processor information in registry
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:1928
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2d4,0x7ff950c0c188,0x7ff950c0c194,0x7ff950c0c1a0
        5⤵
        
        PID:5116
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1956,i,8458621233561803886,1154742056736335510,524288 --field-trial-handle=2280,i,1370770633734211091,1163078229738772487,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:3
        5⤵
        Downloads MZ/PE file
        System Time Discovery
        
        PID:4400
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1748,i,707483950136262956,11387880084212446344,262144 --field-trial-handle=2280,i,1370770633734211091,1163078229738772487,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:2
        5⤵
        
        PID:2952
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2592,i,9728223761177488368,6476185162605058523,524288 --field-trial-handle=2280,i,1370770633734211091,1163078229738772487,262144 --variations-seed-version --mojo-platform-channel-handle=2584 /prefetch:8
        5⤵
        
        PID:3264
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,4002425769549315519,12606825550309279964,2097152 --field-trial-handle=2280,i,1370770633734211091,1163078229738772487,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
        5⤵
        
        PID:3916
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,12058391400670678515,6785676044145150749,2097152 --field-trial-handle=2280,i,1370770633734211091,1163078229738772487,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
        5⤵
        
        PID:1704
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4240,i,7553044385566455168,9665578879666426850,2097152 --field-trial-handle=2280,i,1370770633734211091,1163078229738772487,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:1
        5⤵
        
        PID:4200
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4260,i,16918080529341555461,1024035641327131958,2097152 --field-trial-handle=2280,i,1370770633734211091,1163078229738772487,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:2
        5⤵
        
        PID:3740
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3648,i,12702593939365892622,14815918051457365675,524288 --field-trial-handle=2280,i,1370770633734211091,1163078229738772487,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:8
        5⤵
        
        PID:5036
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5100,i,9453351590416154393,9844639933265828835,2097152 --field-trial-handle=2280,i,1370770633734211091,1163078229738772487,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:1
        5⤵
        
        PID:4956
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3576,i,17052251084599006167,16563011652727589785,524288 --field-trial-handle=2280,i,1370770633734211091,1163078229738772487,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:8
        5⤵
        
        PID:4468
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3600,i,12737967963554051630,7614125931532484590,524288 --field-trial-handle=2280,i,1370770633734211091,1163078229738772487,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:8
        5⤵
        
        PID:4604
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,10056463210787060542,8170931083739219269,524288 --field-trial-handle=2280,i,1370770633734211091,1163078229738772487,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:8
        5⤵
        
        PID:656
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,10056463210787060542,8170931083739219269,524288 --field-trial-handle=2280,i,1370770633734211091,1163078229738772487,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:8
        5⤵
        
        PID:4100
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6032,i,926039062203282590,14041089773384608575,524288 --field-trial-handle=2280,i,1370770633734211091,1163078229738772487,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:8
        5⤵
        
        PID:3340
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,1985982392706689755,335064202264992561,524288 --field-trial-handle=2280,i,1370770633734211091,1163078229738772487,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:8
        5⤵
        
        PID:1288
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6528,i,6533891325619102222,4448785049095764513,524288 --field-trial-handle=2280,i,1370770633734211091,1163078229738772487,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:8
        5⤵
        
        PID:2040
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6540,i,4891660066567077432,12939381879339482693,2097152 --field-trial-handle=2280,i,1370770633734211091,1163078229738772487,262144 --variations-seed-version --mojo-platform-channel-handle=6600 /prefetch:1
        5⤵
        
        PID:3144
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6396,i,9656780044948042344,6806056407536174972,524288 --field-trial-handle=2280,i,1370770633734211091,1163078229738772487,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:8
        5⤵
        
        PID:4224
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6412,i,8495197387618064228,10776069824822164620,524288 --field-trial-handle=2280,i,1370770633734211091,1163078229738772487,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:8
        5⤵
        
        PID:4364
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6356,i,4447583531860694396,286899486472642058,2097152 --field-trial-handle=2280,i,1370770633734211091,1163078229738772487,262144 --variations-seed-version --mojo-platform-channel-handle=7104 /prefetch:1
        5⤵
        
        PID:4036
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7416,i,14604806750096525365,5914361740292173880,524288 --field-trial-handle=2280,i,1370770633734211091,1163078229738772487,262144 --variations-seed-version --mojo-platform-channel-handle=7432 /prefetch:8
        5⤵
        
        PID:668
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6976,i,101138528467389098,6319448882223346827,524288 --field-trial-handle=2280,i,1370770633734211091,1163078229738772487,262144 --variations-seed-version --mojo-platform-channel-handle=6972 /prefetch:8
        5⤵
        
        PID:5480
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6580,i,7746322586837054347,1025980843364640729,2097152 --field-trial-handle=2280,i,1370770633734211091,1163078229738772487,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:1
        5⤵
        
        PID:1816
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7256,i,14850521834768663427,9649614949912559681,524288 --field-trial-handle=2280,i,1370770633734211091,1163078229738772487,262144 --variations-seed-version --mojo-platform-channel-handle=7204 /prefetch:8
        5⤵
        
        PID:2948
    - - C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.15-win-x64.exe
        
        "C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.15-win-x64.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5252
      - C:\Windows\TEMP\{6E96E2F3-12FF-404B-A058-4144B26F41EB}\.ba\wixstdba.exe
        
        "C:\Windows\TEMP\{6E96E2F3-12FF-404B-A058-4144B26F41EB}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{068F2D80-A7CA-4480-8D26-5145CD9F94FB} {9BFBEE77-7682-4E94-80A1-EDA7D8310FD6}
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        
        PID:5688
      - C:\Windows\TEMP\{6E96E2F3-12FF-404B-A058-4144B26F41EB}\.be\windowsdesktop-runtime-10.0.15-win-x64.exe
        
        "C:\Windows\TEMP\{6E96E2F3-12FF-404B-A058-4144B26F41EB}\.be\windowsdesktop-runtime-10.0.15-win-x64.exe" -q -burn.elevated BurnPipe.{868A4CE2-9413-4C21-8338-6380C233F47A} {C0B3A0E8-7B92-48A8-B36A-B99CCF4DC459} 5252
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:5760
    - - C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.15-win-x64.exe
        
        "C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.15-win-x64.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5392
      - C:\Windows\TEMP\{C1F6B74C-FA3F-4C14-9F78-B2D549AF54A0}\.ba\wixstdba.exe
        
        "C:\Windows\TEMP\{C1F6B74C-FA3F-4C14-9F78-B2D549AF54A0}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{94F62C54-B679-4AD8-917E-422B3E85764E} {12A74864-6032-485A-8850-A7A8F63836CA}
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5616
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,12593584938597479483,8141682234948206411,524288 --field-trial-handle=2280,i,1370770633734211091,1163078229738772487,262144 --variations-seed-version --mojo-platform-channel-handle=6756 /prefetch:8
        5⤵
        
        PID:5700
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6004,i,1598248165345697770,191429473078849902,524288 --field-trial-handle=2280,i,1370770633734211091,1163078229738772487,262144 --variations-seed-version --mojo-platform-channel-handle=6736 /prefetch:8
        5⤵
        
        PID:5736
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,17945039586868653317,8635345790002109196,524288 --field-trial-handle=2280,i,1370770633734211091,1163078229738772487,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:8
        5⤵
        
        PID:5744

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1096

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5884
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 53091FFB8E2C72BE2DD32CDDC460F412
  2⤵
  - Loads dropped DLL
  PID:2264
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 731B68A301BEDADC920E3A517E665957
  2⤵
  - Loads dropped DLL
  PID:5356
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 25B6095847E3083581AB160F5ECA5F36
  2⤵
  - Loads dropped DLL
  PID:5644
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 21358699D344A50B0247F14C67CE2D20
  2⤵
  - Loads dropped DLL
  PID:5580

C:\ProgramData\Package Cache\{B198B6E8-FF66-4131-ACFF-BEAEAF82FF84}\windowsdesktop-runtime-10.0.15-win-x64.exe
"C:\ProgramData\Package Cache\{B198B6E8-FF66-4131-ACFF-BEAEAF82FF84}\windowsdesktop-runtime-10.0.15-win-x64.exe" /burn.runonce
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1708
- C:\ProgramData\Package Cache\{B198B6E8-FF66-4131-ACFF-BEAEAF82FF84}\windowsdesktop-runtime-10.0.15-win-x64.exe
  "C:\ProgramData\Package Cache\{B198B6E8-FF66-4131-ACFF-BEAEAF82FF84}\windowsdesktop-runtime-10.0.15-win-x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.15_(x64)_20261113153314.log"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1536
- - C:\Windows\TEMP\{6821EEB0-489E-4126-8810-02870BA5C840}\.ba\wixstdba.exe
    "C:\Windows\TEMP\{6821EEB0-489E-4126-8810-02870BA5C840}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{7E841663-0B12-4B30-A844-A65380B7A33C} {4278D9EE-082B-4E6F-A7A8-B5E46FE7C5CF}
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5960

C:\P2BL\Portal 2 BETA Launcher\Portal2BetaLauncher.exe
"C:\P2BL\Portal 2 BETA Launcher\Portal2BetaLauncher.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
PID:5572

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5900d4.rbs

Path C:\Config.Msi\e5900d4.rbs
Size 11KB
SHA256 34dcefd106f7ec077504aef4fc681d26a00f3710cafc38533d5026627e545723
MD5 83c447f7574a51ccf5ba0658de8c6c72
SHA1 847248f962c737910896c82075447016294ddb07
SHA512 f61a182380eb01697ff784d28eb285accb1d723f997e2efade3ea502b9fa62f7d6bf5dd8a48026e4e97f77f34ee1cc8a9c4f070e198f2415475b250f024a6e48
SSDEEP 192:ldzCQT7bAtq5HNrmS/eqbXWEIaXWENsE1XMCwupMb:ldzCQT7Mtq5HkoWyWeI
TLSH
T10F323581A600D5D3EAE617B4CB131F613B77D39E6305538B45DEA2288F073CA2E6C799
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5900db.rbs

Path C:\Config.Msi\e5900db.rbs
Size 9KB
SHA256 b14c6ef4499c24e403a0a2024ab1d61ccf204f58e16e70254519f87fe66c39bd
MD5 3bba917c833621c11d5429698718da33
SHA1 1dd8daf4ca21514cf7cd602675e150c6a8be5138
SHA512 163b3947a9fd9639341aa3b902438208e2184c5104a2785546c4aff54b901a8e20660f8457621f35580d46758d4a8f75d53aa98ec852f9f6ba21f560fc5da520
SSDEEP 96:Nm9wiZTCnrYYb6ea2Om1NIb4UCeD2TxCsTl74UCeD2TxC6j5hLnVTl7nRaE5I7KM:QaQTcYneVSbXsEIFXsE+CEoi6jupI
TLSH
T14A123001B660C2D3FC561B74C35B97663BB3E3859340578F098E51249F1738A5FB92AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5900e0.rbs

Path C:\Config.Msi\e5900e0.rbs
Size 49KB
SHA256 f519101924d843f2808ffdce551f262a80b85645916dedae1520500cbc52d4bf
MD5 c4e5c2756087deecd6eae84001dd6ef9
SHA1 98a1932bc0077bdc516a2af18c11035f86a344de
SHA512 e68e2e5277b98c0696396efdcb4948b16a11b1b5224e850ca32caec01de0d87e78be40e5fa90941dffaf8a91227b0309edb3fd744e581f30c7df20d1488786b2
SSDEEP 1536:mkiWK6fxNPlQ0drMG6i01t5Dqq+NpoG53Na/Io8+T/vVOwLCyFFluRYJOmhV4DTe:ShTr
TLSH
T1E233DE60EB04C2D3F63278705361EF893714DB72AB445AAE31CE421ACDD569ADFEC285
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5900e5.rbs

Path C:\Config.Msi\e5900e5.rbs
Size 71KB
SHA256 4a2ea59cbd9dfe3d3c4ffa5f7c563c258a61b36cb51f609f5a95f59a1e617182
MD5 0acd85d43d9ca817c6e5ecd67ed22a98
SHA1 c1fa1612d13c97a917f8f39aa404bc1e5f5f5329
SHA512 d74f8e60e3b097e157ab91d8bedb45504183856bcb71e35bd81707c73aeb741db4056bedbaefdbd9bdac4796cc88ba6c4fcf96cc22fbae7807b7316eef85c765
SSDEEP 1536:X4pRCQ+wMg+YlS2u/SccYpPGRpniZPaJEie28TuSiyg4qnUxq9XTZXMCt0tUa+fU:CfytFPk2GMc66G0m6Kh
TLSH
T1696312D65700C0D3AC333BA11F77FA089E968C76E241E51E16C9512BDEE66C6AF6D8C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Portal2BetaLauncher.exe

Path C:\P2BL\Portal 2 BETA Launcher\Portal2BetaLauncher.exe
Size 364KB
SHA256 42c7453e174d46b0a7a4e04d8e148fc1bb7813784f6833e92edaefc1ff838e4e
MD5 b6c53a797a907062e1638acd8a5d7d82
SHA1 6e10604b76c123892bb0a1eda95ad1861150fed5
SHA512 9070b9b8236d124d52762a50887a20b7273f79cc2811bf33d684b8692819ac0b621b7ccb1d2328c66458e80d6c5eeda73e7980dae087fe09fa30fc9b4c6aa9d2
SSDEEP 6144:fHRu7F1nQnB8yxGOwQfTqlHZBnzsvaQ0srDiLeHwg6UBh3lyZgCX6Ue:fxOF1JyjfkHZBuzrDMetb9ly
TLSH
T15E84C013A26951BEE1B3D639C9D24941FB7278694772A7CF03504AB60F77BD0AE39302
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-HL2EZ3UZH6.tmp

Path C:\P2BL\Portal 2 BETA Launcher\Resources\EULAS\3rd-Party\is-HL2EZ3UZH6.tmp
Size 5KB
SHA256 3a184aa13dc8ad30734e28ff901b478ccbcb5b41be52427a5e7609c8fd9e5ddb
MD5 8a255a02f29cbe9dded12f94d09df0ad
SHA1 118252b759f42a6f2fc7c218f7a299e54e1c3527
SHA512 fd2dc1d725a8a1b4aa6606dbb9fb985f234fe0c1c3c8283acf4830fba7b513cb99b0351ca06076c4008ba6001eaba69ddb15a680c5f07474e1cc43ca90df6fa1
SSDEEP 96:dGlju+xpEYNPOrLJIJzDJu3S3zVSrOrLJIJzAu3S3zVSw7Edxb1wp:AjuoDNPOrNcXJu3S3JSrOrNccu3S3JSE
TLSH
T14FC1456E1E0953B355F2C6812A45A5CEF35DD02E7A2F290638BED34C5B3B429C5FE188
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-LD17FSW2TK.tmp

Path C:\P2BL\Portal 2 BETA Launcher\Resources\SavedData\is-LD17FSW2TK.tmp
Size 26B
SHA256 b7c0189be483e2fcddf1326590220ccd8523922694ecd5957903c2e64fb3b0f5
MD5 6e518c56a183a12438810391985c1c0c
SHA1 1b0701acbfa72200fad772d242b6f0a8f2239ae9
SHA512 0d545f6d16ad1a5e702cc6af275e76ea2454bf376286b510e19b3885c34a7673f9252ba60368cd070d6d25ff190e8e0f8d9208f8b3441aa47c51166c0807be85
MD5 SHA1 SHA512

Submit Download

is-GILJZKNCRH.tmp

Path C:\P2BL\Portal 2 BETA Launcher\Resources\Theme\IconPNG\is-GILJZKNCRH.tmp
Size 305B
SHA256 c09815d388fd477e123f403965c9e415ac587bd9a9f319651a1ade2c55ec88ab
MD5 58b5108085d6e19771987024c832bb20
SHA1 d9b1e3471c6f0016dd822eadeb847178942fe76f
SHA512 7bca29a35e5c19e92af9fe2b61ce8ee79efbbfe5775c148737d58b626e4c4ea9ba53d1964ecc5fc1f0c718ec489fbbc1173c57593dfb08b701a2f0752566cf9c
TLSH
T131E07DE7A0D28CAA969C62171A08ACF2911B4EB241404ACF0042883513A88E990CF533
MD5 SHA1 SHA512 TLSH

Submit Download

is-LCUN6XSIIL.tmp

Path C:\P2BL\Portal 2 BETA Launcher\Resources\Theme\IconPNG\is-LCUN6XSIIL.tmp
Size 352B
SHA256 fce0761e8b79bb9907dd9d4133bd6d859d2d950166bbcbe50f7dd9c2adcdf8ed
MD5 49477026339678ebbcfe76675bf51543
SHA1 09bb3774fedca4eb53cab2cabaa10640d303ff16
SHA512 7b1a40f28d7c4ab3fdacde1a4216b24769f428c98f61199989487fc773f8b65c87760d8c760c37f4f947eed5a285cf744beb148899025a8a292ba4c41b40b62d
TLSH
T153E028FF13B749FD97042C35215748A4CC2316F2FA1484047401F53F5946675A5E5513
MD5 SHA1 SHA512 TLSH

Submit Download

is-DFLA4XOO52.tmp

Path C:\P2BL\Portal 2 BETA Launcher\Resources\Theme\IconSVG\is-DFLA4XOO52.tmp
Size 243B
SHA256 7a8958bff997998a30d94f244fa8ba9819911c945c04b9c8d6df02799b8eb743
MD5 31e88195d539badb51a11a3f96fa606e
SHA1 728e26d49ca4d1b8eec82bf3164b91a1174a4939
SHA512 80123023fad33018ba320142838aa05f33e8f26a318f6e9169b98234773d67af723c2c8fb57d907162c1f1bd28c71fe4ddf14155e608626ec84747b3a201e262
TLSH
T1F6D0A759830C1D2CBD294660EBB87734103A1142065E11BCF872363166086DFBC7BDD8
MD5 SHA1 SHA512 TLSH

Submit Download

is-I1ZRBIV4C9.tmp

Path C:\P2BL\Portal 2 BETA Launcher\Resources\Theme\IconSVG\is-I1ZRBIV4C9.tmp
Size 258B
SHA256 64f884c7a6729f4614b51f85ba07068a2044167b0e73e5e1337db7777b090538
MD5 51c7a572a1f6f6f0cfed05f45709d256
SHA1 7ee123d9be61a776f2b6c5e137eaf8854d958498
SHA512 3f7a54030c560aed0d5e6fdb3e821d202b72aef0aa6e4266a2fe0adae270528baa757180feccd6a2704a3b2443437ae0b533a52975a2645d08fbf8343fc58554
TLSH
T167D02E18830C4C3CBE2A4A20EB68B27020AA2201130E919CF9322230130864EBCBBDE8
MD5 SHA1 SHA512 TLSH

Submit Download

is-U4041LQ8JK.tmp

Path C:\P2BL\Portal 2 BETA Launcher\bin\is-U4041LQ8JK.tmp
Size 399B
SHA256 3e965cd7cfd553c2ff4e842d8d8019aaae2da0a21d92ff85a87573dd8d1b95c6
MD5 d5f65728c12e9dc937413d59189cdd26
SHA1 1568cbc947762a8bd7ec71cb5c5f1148ea22411a
SHA512 87597110342a80414f5b51caa3f61269c897ff82b622d782e422c0cdd6cb38b7e8f843467f5c47381c3a84bd804aa85a5029999286a1595f6bae717366bd5f0d
TLSH
T167E02218CA102DA704B932BAD121C083EA30A32710142882B4FC080C2F776A52102F95
MD5 SHA1 SHA512 TLSH

Submit Download

unins000.exe

Path C:\P2BL\Portal 2 BETA Launcher\unins000.exe
Size 4.9MB
SHA256 4983322743aae99dfe9501468912ba73dc905b545428977e93c96c1aa2af534e
MD5 035c4cd9cf98ba2567c52eb019960f1c
SHA1 7a477c4bae2b68bf9dc9ce3031d8e82e070aeadd
SHA512 a40dbe3a4d346556041dbb2bea70e76afa1fba2468bd1a9aa4d29fc022bbfb8bb96af6d7875b400b66fcbf20d7aeb451b3fda48107f220dc0a4bc73aba329a91
SSDEEP 98304:m5+Nx4SiGOLsxlCU2OvxcgcpzvJ3335nXDN:RNqClCKZSzvXZ
TLSH
T18C369E23B384A53EE4671B3A687FA649583F7A203A26CD476BF40D5C4F396402D3A747
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ThirdPartyNotices.txt

Path C:\Program Files\dotnet\ThirdPartyNotices.txt
Size 77KB
SHA256 deb4427a295e1ed474b0d81c5a0d972c1b550b9a715cda939cdfa9236b1b418f
MD5 0d8867a25ba926e6e40cd52ab3536b5c
SHA1 89390dc8b8318d0bfef1c6a2fb4783537e28a465
SHA512 317ca335405274f4f91b173651ca2826760acb5ba5cf41aff51adc55c2cda9059fb268333665f13f62fa48119e55a303720a780dd58d28dd9967db4c88407d61
SSDEEP 1536:HA9jHwsGfgg39/zwgAVkguQxrDjugtSEGepkWvrpX7anuqdLSVnfiStPq+3LefrL:HA97w/ogz1AVxuMjHtSFULryLOgrGWm+
TLSH
T17773A45F7E45077319E2C3916569A8C5F22FA02E3B6B2A44346EF248133B42DD6FF858
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 163KB
SHA256 0a1b7ca731245de1f267a9c3c4d1ef8705e0821923fcdd6e0d61c31132f51240
MD5 f8c05ec8d2b45d00e3cb33ca2391a6eb
SHA1 b5f63597d98f3373170026f3ccab7f13b12a9dbc
SHA512 3ab355535b0aed35d1b98b8f418858585c5b08ba2a9da1506f694d744ed944144ac03108856356bf0913d19231eaf71e727467c42308a7aa8f8ea2f01bf56cf5
SSDEEP 3072:PGgPYwruvTSBbQ/fp4SbDqIG/ik7l55wKLA5u:PG4rubgbQpDvqIqtAQ
TLSH
T1FFF3061AD65811AAD16E9575CB528941BB337C668BE0E3CB13C0F8BE0F726905EF9703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetRuntime

Path C:\ProgramData\Package Cache\.unverified\DotNetRuntime
Size 28.1MB
SHA256 0dfa6da3496ee4b23d90934cad98c464a5eeebcdab33075e28b581a2b20a44a0
MD5 f5d81318a5e8b3b47e308f9ff37b4923
SHA1 630e8600e00f23e26d469b6447b4cd02162865c8
SHA512 c1d4797ba86f387b822153a4201b14b844270b7752ba397be13d4223d0cc80fd95448f9a57e0ffaa1943a7f6d1a03ba493272a65ff88e7bb9914eafe913a5a60
SSDEEP 393216:kBbX1LICUlshUhnXUklRL6p+w4PLl/2UA0iFXuukR0F8rJ3wFpqATLxRowBDJc2R:kBbuMcnXUaL67yHtu6xrJ9yRocJc2B
TLSH
T1835733077FD109AAD4324EB9887A8722EB747D142720994F6760B628CEFB7E4147B3C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

42f66da7-3e7b-4f8a-907d-202e489b1c02.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\42f66da7-3e7b-4f8a-907d-202e489b1c02.tmp
Size 8KB
SHA256 0d9a9effdea9e83c62f1555acfa9a6107508e8aa47fb3da00c6af6fc6653b383
MD5 48a56c8971c2a376d536dc4a3a0d25d5
SHA1 997f69c7a4260dbc178e124757876765d8908240
SHA512 1e82b70599fbe3f1df7079f845def43a77898246bf2b5f9a00be956fa1ad57e13b3af58229091540da33a2af29b3b4e16e7aa5488a8de1938936389f0d760fae
SSDEEP 192:LJONC6DphmqQmiUy4aq8wGYX59ezHC6mEkk7paU6:lONC619WRwGYX5EG6MU6
TLSH
T19E02D939ECB87C7B4DE3AE45B54B3B135FA8212BEA916F84D6E81A1D00D764C1307927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

59e2eea4-131a-4ca1-a225-a2a7fa43505c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\59e2eea4-131a-4ca1-a225-a2a7fa43505c.tmp
Size 18KB
SHA256 0bdc7676a9faafb6ffc0b19bcce62e858a59037b4e2d1926704ac2a3ae2796f3
MD5 4461fe99eb511699922ec622d3e02733
SHA1 f5229d373fdc8144a476dc2ee443b68f1f309c9e
SHA512 30c1718bdfe628bb823292f02dabbe379d0ec04d43e9913e3c1c3d2143947c6126b7c1f63fcf0360fde4b355f80151f0ddc084bb7252116b6cf12a2db11c10da
SSDEEP 384:n9QkUSvdsNgPBo5V6zBGYX5EGQUFiqH7vBE+XDIIlt:nd2K9GYuGQvqH75E+XDLr
TLSH
T123827C74E8B9AC3B09E7A515F14A3A539FB86037DAC51F50E5E98F1C00C72C8270B92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7ec9f3225a36b6095e8a072aff3977b6c72c6f861a6c339c4c341dbacfcabd0c
MD5 e099eb95a648ea38aff2773c3580afa6
SHA1 b16d4ca0fc492601803a2b8a12e254385f767f7e
SHA512 95eaa01bc1a2e460b0214a4a48369f37b222bf53e085bb61210a0f6e3ccc4421b5ec242c42f8a8098383d4db3086bbcdb25ce0d03ede13027668e705420b97f0
TLSH
T168D0802165753FDDD12F5035041585844E44CA3356001115571F1D2D16944D62D61DD4
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d1cc89f8f1c9f75d127814445edc4d6d9314209d3b11e5a2b4cc826747683f30
MD5 3bc9cc32c2de3150dc7916bb61984962
SHA1 d75ba9bc7ad74cb95dcb4ec6de6e6b18f5813a04
SHA512 fd090e624e91a98337689ed57390fc5813fab21acd3af426c9de6566ea4d92a7875c4f92a1b64d547eaf9ce40cad3d8a85472a30cf521aea6198cf74b69805ac
TLSH
T12ED02232ABF00E82C80B0032082082880F08C03C0800B323A23C20AE2A82CEC2E23000
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a62a1faeaaa56a5f5375b4d4921e6b263c0bc10a5ecc1f991894c66c32a88aef
MD5 64fcd85513a139bcf5844ab49aea8206
SHA1 3c834eccb77da48c4abac17c440971305fd9b653
SHA512 cd1b39ff43d56158fbb01c5408a5bf247d5bd82279b205a914ab4cdccfece77a5399e430bb26db6f7d10e70dc3503c3bf37c5de59e23cb8f62d6337066c4114f
TLSH
T15DD02232EBF00E82C00B0032082282880F08C03C08003222A23C20AE3A80CEC2E23000
MD5 SHA1 SHA512 TLSH

Submit Download

2d0e0a0f-fa1b-4f1f-9169-36f2eb0fa28b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2d0e0a0f-fa1b-4f1f-9169-36f2eb0fa28b.tmp
Size 12KB
SHA256 aa391c32762b8cdf01e4671c07a982ecbff5c376356b397903ee9333581e2bf6
MD5 90fad605a446bb8b3ac97b155dbd002e
SHA1 cb84c0a808466a2d6fa96eb7e0b60532f3c4df0a
SHA512 0aba5ae4d74b84e0aefe0289625bb9327c1db8bd2273d7ec5c8f67bbe7e90d103baf4ef189ea9859d1cfb2122eb4b0991227fcbe8fe83d7bf661e685ed1dd791
SSDEEP 192:sxZiR/85/fFsfWpVfm/tVIdpwtHW6+WNcO3XL/ADYucQOMIgbsJ:sxZiq5/fFsfWvfA8gHbRL/szc
TLSH
T18042C856A964A97B8CD7D21DFA15BF13E6FD203290D11E84AAFC8E1C05E77DD120380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2d5dc852-8296-4515-a006-f48a561d0bcc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2d5dc852-8296-4515-a006-f48a561d0bcc.tmp
Size 11KB
SHA256 95ef9bd719d172ab107aff1b2005092b4d4cc01367803da1a4dccd5481f1e86b
MD5 b05b89aa6d6ffe576c56c0c61dbdc2c4
SHA1 7b42ecbb6d6180e7908eef6c6daefc5a1ea35317
SHA512 a344bda0c6d11cbd90ecb5ead7ed0c91fb2b8fc29d8c3e6d2918696a2d0110d84ae698129200626d07464224f5e1e2734e34181238eafe50e983a2fee1eb8ab6
SSDEEP 192:sxZiRS85/fFsYm/tpIdpwtHW6+WNrXL/ADg4cK3aIg5sJ:sxZi15/fFsYAUgHb3/iu2
TLSH
T12132C956AD28697B8CCBE20DBA55BF53E6FD503290D11E48A7FC8A1C05E7ADD120380F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 a3805fb74873726e17911b4cf5a5bd7a25d4a90b544b5aa028d2a4820a8875b6
MD5 8f760efe85ec23c23821a0890e5ddd51
SHA1 32243d9bcc94262d9c5c903a909b91f5f49843c9
SHA512 3d48b42eb76aa0448ab30ed53ad8f33a3714c97439a90836fb2564a08bac0ade8c7ea24d5f0f52b764f4a47316ce3e15408b3e51410f69069580ee7bbcd85ea8
TLSH
T11371D980729B83B9F773647441CA11CF3A3658C9148B2F22C4D5E578B9CF794A36A11B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 86fe21fdea6d2568b84b00b181765d3e35d917673fa9c206423947790cefac6d
MD5 3afd57cc7297375925cbaebb770f878b
SHA1 08d2239e63bd42fded46f5046f094291647a315c
SHA512 ce308927f67b07ebedd4a86e22fc07de0111c20adc3e0d66c716bc53d574792184cbdaa41efb712e1ef06731d2e1e3b63a0de7ca6d33418f79d851a1bac8cad0
TLSH
T1EE61B4812287837EF7B7647481DE11CF3A3458C9188B2F22C0E5D578B88F765A31811B
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 da59a981ef213c574dc8f0b65a05fbe15560844bbd5591e1b32cb52f912fe94b
MD5 9fb6a45e3cfeffaab6d88e86ba1142aa
SHA1 7648785cb5b964db3174145767bf606b4853f1b3
SHA512 6e4b990e89f67a213585eaf7eb8d0a314ddd79bfb613fafcbfbd420cfccf53f7ee47b83b62023cfb1790486cde1280f2764c6787b94fab4c7d52f9b0d76dcfdd
SSDEEP 3:MsEllllkEthXllkl2zEklNull:/M/xT02znNu/
TLSH
T18E4404447FC40445C50010304115C35003F1D41015555753755114177DC75400C11011
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

68ccecde-2d93-481f-a7e4-814184da4202.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\68ccecde-2d93-481f-a7e4-814184da4202.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.111.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

38982681-00e1-47cd-ae35-4bdb45f0ea00.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\38982681-00e1-47cd-ae35-4bdb45f0ea00.tmp
Size 3KB
SHA256 12e1ecda323fafc6e8fd63327ec49a1ae804ba2dcf1eeec8c77cd24a2174938b
MD5 b877665e139c2b29c07a4993aabe9329
SHA1 81f16705072a281e8a3e0105154b90a1e2c18117
SHA512 88593f20ccff197e65072e44b039cf5734d2b65261d172036deba3b67aadf2eaa455bc0f6b1bbb95500080308f0222c3381f20d2d9e51f38816acb250cfc555e
TLSH
T18661ABF787A4856E8E009AF09A18EE2FDF2C0615431C3C6989D4EE27D7E3472E10265F
MD5 SHA1 SHA512 TLSH

Submit Download

58011bde-ad7c-4561-acd0-e8e79bf0a03e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\58011bde-ad7c-4561-acd0-e8e79bf0a03e.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

d27328f7-21aa-40ae-a417-8a3c53f332ce.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\d27328f7-21aa-40ae-a417-8a3c53f332ce.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 609B
SHA256 33fd5237205a8808a330965f1dd7d87ecfeede7e6fdee040a1198cc7309a386b
MD5 6cf67c39c637f6f1c5364b55f3460561
SHA1 dc6ea73f97ae67f420953dbad8243f39e58469c1
SHA512 b986ed5892c6e1d29d16372b9fd95a3b41f2e21e9f90288eb7630446dd194193a591c2b9867f615b3887b1ab78d671963a3e64beb5a85a414a7f9be9d255699d
TLSH
T166F07D20309F02572AFEA54440FB8516824121B376EEF56E77A5C0D909B7F118DFC59D
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 1KB
SHA256 9d10f0dbccb3b466873ef6ac0670981c6c252ee7195071a985ffbeda27d28989
MD5 8ce2596f186012f1ca622fcea688ab84
SHA1 6402f81dfb10c3e4f26c8a5a8c584f459c843115
SHA512 810441d98eb9347b8859b5c743fc1d0185b73c507000a5c75982704a592d30fb14626ce6ea0c989530aaadb75770a723039b1050029403465bf372cbd516d9f6
TLSH
T1AF215C21319F02572AFEA50441EB8416824131B376EEF56E77A9C0E909B7F218DFC5CD
MD5 SHA1 SHA512 TLSH

Submit Download

c5a8ed90-ec39-4358-ad60-6f0828e1c3a6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c5a8ed90-ec39-4358-ad60-6f0828e1c3a6.tmp
Size 27KB
SHA256 cc40c2e01f9c41cc1776c732cc59a977fce281d143b36833f23e289d0f90d2cf
MD5 00d47e6129ae289958ee223fa733de3c
SHA1 845ee67f9f1fa38a7dd859ca88d1c8ae7fa19b06
SHA512 ca372360a7ae38077dc1a231043f437fd027f2d0331367dec74aa343c036b29ca000d19fdb12a67dcd435b37cb18530b2d3522e2c60a0d920048785143f0d2a9
SSDEEP 768:EdichkPWvPZpl8F1+UoAYDCx9Tuqh0VfUC9xbog/OV0+LlEKXz1rotGO1H:EdichkPWvPZplu1jaL+LKgzOt55
TLSH
T15EC2F93F640CCA7E4FC01E9DDD5A6F9A7EA802C7A6588D4047FA984C02C77EE51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d5ddb4d9-50b3-4cb5-b3a0-198bd6a8134c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d5ddb4d9-50b3-4cb5-b3a0-198bd6a8134c.tmp
Size 9KB
SHA256 3dd32e0cd4d780e099c9828be4d1ae612c082c26df2e9cd6aad529c05ad2a2ab
MD5 91cae28299292057698db9b23f2b291e
SHA1 e90be8b127e86556178e2f43603e236b3b5bf424
SHA512 2c961ca28a7a771b0edc304d6ecf4155ce1ae031f02b96f5de71b9ca28f40b3b327c95faf4f431855c46344c1433573adf970061f3a1fa1086fd8e12d256f97b
SSDEEP 192:sxZiReV5/fFsehEdpwtHW6+WNrXL/ADgWY3aIg4J:sxZiw5/fFseqgHb3/Yc
TLSH
T1B422B8566E34A97B8CCBD61DBA14BF13E6F9103291D11E48E6FC8A1C04E7ADD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ed0dccf0-9f8a-4296-a4fe-6e8e645e29c4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ed0dccf0-9f8a-4296-a4fe-6e8e645e29c4.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f8d7b09f-8212-4a66-9fc0-ea7fe3c289c2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f8d7b09f-8212-4a66-9fc0-ea7fe3c289c2.tmp
Size 11KB
SHA256 b5056bf9cf07d5a1a847663a7fedfc9ca2596e907b5ff49fab06b9f5b1353e5f
MD5 045f5c3c9e271eeb11f22987079125d8
SHA1 930a54cbd610caf926be3b1b74977afd651323a5
SHA512 a4f866e483880b6e5e5c58a37ff20301c8030581a74c992b6ad3433f5f75733a128ee43ffdcc9c85d4280617a16af2529c156dce6e04eb5a7d22e03b63caee85
SSDEEP 192:sxZiRS85/fFsTm/tpIdpwtHW6+WNrXL/ADgWC3aIg5KJ:sxZi15/fFsTAUgHb3/U4
TLSH
T16132CA56AE34A97B8CCBD21DBA55BF53E6FD503191D11E88A6FC8A1C04E7ADD120380F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a73192e0-5206-4dca-b409-4a0b5737d622.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a73192e0-5206-4dca-b409-4a0b5737d622.tmp
Size 18KB
SHA256 eff34ac85a9b012ef84eeb83a60049e1cf0f0242127795c14e3ad42ef7dac3b2
MD5 6aeda4d502b87c481773e532b04b140a
SHA1 f5c2394c0717c0a13168e1240f841f3c9e006233
SHA512 4b0b178777dc6cda91388f02a116ad04f15da28fe7ce6c6fef97452084512d004bc2f800a7621c57350e97c7031e79cffd7ead6845344a38440a77658c096278
SSDEEP 384:nVQkUSv0sNgDBo5M6zBGYX5EGQUF5qH7vBE+XDIIlt:v0ap9GYuGQaqH75E+XDLr
TLSH
T11E827C74E8B9AC3B09E7A515F14A3A539FB8603BDAC51F54E5E98F1C00C72C8270B91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

09c0dad3-6345-40e9-a38f-3f4f99d5f80a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\09c0dad3-6345-40e9-a38f-3f4f99d5f80a.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

d62a673b-c156-467e-93ba-b722c67f917e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d62a673b-c156-467e-93ba-b722c67f917e.tmp
Size 8KB
SHA256 b8fc789d96691eb6cd2513cf25d91ee3dcea090002c99d3670405f05e14b0ada
MD5 75d0c83c20faaf8589dac45ede8dd68e
SHA1 d6ea3750b3d3bc623cfce77d73dd3988b0c29a26
SHA512 54573577a7c35bf39a1ffda4add03fd303aa743fd4f7feba8fce7fd7956fc5ed89f39c99a723179f4efcfe2f5f96673ef8fe5db32ee68c19229858d4700e5495
SSDEEP 192:mONZ6DphbqQmiUywahwGYX59ezHC6m4Une+nkIITq5Al2U6:mONZ61QohwGYX5EGQUFQqU6
TLSH
T168120974E8B8FC2B0DD7A855B48B3A535FA82137DE856F44D6E81A1C00D728C270B92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e40cace4-accf-46a7-b5c0-d0a6da6c60eb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e40cace4-accf-46a7-b5c0-d0a6da6c60eb.tmp
Size 23KB
SHA256 a5a46a780786be74945afa51fc2adb35e8e953d212410bc90acf53faac9c421e
MD5 79ceb7abf0b5ce30d19fe9db7480cb1f
SHA1 6c187fa072b9c6df2fea4bb69c52c9d3d05dfb84
SHA512 22841672de54c1d8e30e3c481721ea11913b409896be8aac32bde1d4a7ade59f7c28d00d0b49463e9978c54fe6a1d2c52a06e8a7ffde3299e814d0efe7039eec
SSDEEP 384:n2PQkUSvnsNuaBo5D/zBGYX5EGQUF6vQuv6A4BRE0sCkkr+iYH7vBE+XDIIlt:2Rnll9GYuGQTvXd4aCkkr+iYH75E+XD3
TLSH
T1CBB26DB4D8E55CFB04A6E4C1A146FA136EA85137C6881F5CE5F8BA3C308F5F82717929
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f67818b0-e82d-4019-a140-fe166bfb418f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f67818b0-e82d-4019-a140-fe166bfb418f.tmp
Size 18KB
SHA256 ca2d811b7df761eab21fe089e16ca5b83fd0ef5bcf40292c2f3302eb5d815008
MD5 748e23917d436c6fbb9c562d2cd76b0a
SHA1 f569975847edbc98d6b74f36c600d913bc31a2cf
SHA512 00faa1ed4a3590145a452ceed75b59991bca1d8cada221cfebca109ba6e462db24a22687ed38b6c6caf6a8861f61b50218ebceae3bf4d70085e2e94909149057
SSDEEP 384:n8QkUSvdsNgaBo5V6zBGYX5EGQUFiqH7vBE+XDIIlt:8dnK9GYuGQvqH75E+XDLr
TLSH
T151826C74E8B9AC3B49E7A515F14A3A539FB86037DAC51F50D5E98F1C00C72CC270B92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 914f7b93702b0d38c75cdbc6802030c4dd54749e42ab44724d231e6db722606e
MD5 ed26dc69815f6abc832b66ef2ba542f1
SHA1 58ccc2166614a11c809a7451ac22f8c2897c4b71
SHA512 ed5c4e9a9db7cfd07b1f4509985f08aa39e1439b23e16ffcdcaac6423ea29dbf95fefceb65e06a03f5ce21fbd3a288cc823a60331997d322b9d7e269b17e6a89
TLSH
T13A41076DA6FA1148B3B76F169BF2B86E447BBC772E06D15D10010E4E0A27A44C8B2737
MD5 SHA1 SHA512 TLSH

Submit Download

607e2acd-da75-4106-9178-04f2e472e65d.tmp

Path C:\Users\Admin\AppData\Local\Temp\607e2acd-da75-4106-9178-04f2e472e65d.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

6b0ba34d-c90d-4b87-9925-b9393641edea.tmp

Path C:\Users\Admin\AppData\Local\Temp\6b0ba34d-c90d-4b87-9925-b9393641edea.tmp
Size 158KB
SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
MD5 9c18c4721b560ec55f0d5de055144d5c
SHA1 6af37a3bda916cac276ad5879c9f61262d9ae523
SHA512 51466928eb8d3cf7b917919c98bd8168453583d2c3dc5836036d87ffd0d2c732ab8450212a880fc6de199ea569a96993ba0d250a5012160d2d72211880695f92
SSDEEP 3072:5ZwEurOxn8zXnHc2qHNYEU/rUHCVJWGdi0Ha5HnXk9TFzBsuht7yGik:5ZwPOx8D85UIHEI0HaZ09JzKStjik
TLSH
T1CFF3E13E7EDE891AD80B10BB7F16B18BD80D8E0B460AB44B769D80155B3668D1BD1CFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.15_(x64)_20261113153314_000_DotNetHost.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.15_(x64)_20261113153314_000_DotNetHost.log
Size 4KB
SHA256 4f94ef3b49eddfdea0dd25fa805aea121e11c7b5a573bcab17551aa2a730ded0
MD5 7c33d20af2bf083051d0ad333f1d5882
SHA1 14e67d35bdb714a38321653e4877afd3f032c120
SHA512 3d8823a6234def5efea7bfd840a7e2883786ab09045246a45d5335bcd79adc77f51633fd2a60c40ff37af92ba3aad2332a1c421d996297606d5c2a8309ad1dcd
SSDEEP 48:Yc00U+oSEJC1JzdjaJ/fYFORL8j/Ac/aqcN1+djaJ/kJB1JAdjaJ/fe1JN6fiQKw:Yv+ozWhj0iOG0f3ij0Il4j0ionKFMj
TLSH
T18081E8251AE50D04B6B397479EF3D013AA73FCD6A930DF4C2345831946AB80A986DF6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.15_(x64)_20261113153314_001_DotNetHostFxr.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.15_(x64)_20261113153314_001_DotNetHostFxr.log
Size 2KB
SHA256 f353f27392fd4f78bcd077ffebb8769daa29429b3267291515dc210994fae2ce
MD5 11c517db4912358fa57985cffb495053
SHA1 b26e4138b34aaaf685a47dde4be0d7a6ae866b32
SHA512 1b6bc5feb0546e720fca3304ccea6b2256c4884c51369bdb71e4e329cc556946b0d69b53341c0cb8d00776d32c6a2aac24bf1c8cfa72df02012b6e3aa8fe3e09
TLSH
T16D4117191BF50945B2B3970799F3C0525A73BCD76930CF4C52C44319466FD06ACB8BAA
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.15_(x64)_20261113153314_002_DotNetRuntime.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.15_(x64)_20261113153314_002_DotNetRuntime.log
Size 2KB
SHA256 33c16f8f39f4eb4f716f18fee70cc95db9ad574acc93da62c1e7bc024f7daf22
MD5 7462e9cb7fcc8f848fffd0c7525aad65
SHA1 2e9ef2a47b689ee4e0cefc40c27abb3583f60275
SHA512 02ba7be93f64eff3f53eecfa6cf50bb6379758b76acb214e22d0beed65672c2fa6cd383ef378c62711ad7a01ee49b68396f6f043fedd75ca8417b10888a1c5ff
TLSH
T1C6413D151AE90C06B2B39707DEF3D052AA73FDD66834CF4D5345421A066BD056C68BBE
MD5 SHA1 SHA512 TLSH

Submit Download

P2BL_2.0.31-11.4.802.SETUP.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-O6DT6DIT0K.tmp\P2BL_2.0.31-11.4.802.SETUP.tmp
Size 4.9MB
SHA256 aba4a3d584307a3e2092621c14fa9770a63051913bb6919d6847fa9dcbe37ee9
MD5 67099e3fd614e06ed6eb9c9fea54f54a
SHA1 4668c9a43ecd2aa8f849c54000704a209c249449
SHA512 65d58b13372d1531580400580183360b58cf5ad8b1b0d27afb3548c263c54da3d2e08f39417e318ed0f0e68bb72875e82c397b97403d0651983f8f9c8b0dfccf
SSDEEP 98304:e5+Nx4SiGOLsxlCU2OvxcgcpzvJ3335nXDW:ZNqClCKZSzvXq
TLSH
T18D369E23B344A53ED4671E3A687FA649583F7A203A268D476BF40D5C4F396402D3B78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1928_2066983523\CRX_INSTALL\_locales\en_CA\messages.json
Size 711B
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
TLSH
T1460197136240AF18470BF05BB9023442A0B44AC62384E0B775EC982C6656DAFB20B3B0
MD5 SHA1 SHA512 TLSH

Submit Download

840c5d69-ceb6-499a-a0cf-6731f63290a7.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1928_578485404\840c5d69-ceb6-499a-a0cf-6731f63290a7.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1928_578485404\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetHost

Path C:\Users\Admin\AppData\Local\Temp\{6E96E2F3-12FF-404B-A058-4144B26F41EB}\DotNetHost
Size 848KB
SHA256 7a912989902a5ffacb8f432e15e810f75e1adb7d99264a2b3d4a325baa77b2fc
MD5 d0efd79dc892494a2bc445fa019e793b
SHA1 4f0dffcae1965975e056fa8d020cb1a341e43ddc
SHA512 38c985a1eb49580ddba3cd843edd15de94589a3f3c1c2db1271efcce103edc8275f3a6afd9468f1562367d2723d3cb51523ce35e2fb6932b913b3803ed18f166
SSDEEP 12288:XBGQ4cABdUb/aVo/2WCsT7pXJS5qgBwhYPGNP5h:xGyASwoO2T7RgZMYsP/
TLSH
T1B4055A1BBF9414A9D8A24EB1C5B78321EE357C082320959F46A4B12DDFFB6E0647B7C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetHostFxr

Path C:\Users\Admin\AppData\Local\Temp\{6E96E2F3-12FF-404B-A058-4144B26F41EB}\DotNetHostFxr
Size 920KB
SHA256 563d8ae7197d83a16e91c9f79590757a99e930e5a58a3caa58fff2a4541af58f
MD5 8e0bb5c2191f01c129aca675f0c2ef20
SHA1 8a85cb7bfdd8d9fb872049aba7b500401233dd48
SHA512 c8a9c1007b6daad516cf21708ee78709d5c43ddafa7c0959aba4bded0d86d77dcefbddd1c93c10739339de6ebd0ae3d90913db7d6e56798e0d8e8f4a01ae610e
SSDEEP 12288:DBGQ4cABdUb/aVo/2WCsT7pXJS5qgBwhYU6uzovKecmjw1j5onzn:VGyASwoO2T7RgZMYDCdWRz
TLSH
T1F2157B1BBF9014A9D8A24EB1C5B78721EE357C082320959F46A4B12DDEFB7E0647B7C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsDesktopRuntime

Path C:\Users\Admin\AppData\Local\Temp\{6E96E2F3-12FF-404B-A058-4144B26F41EB}\WindowsDesktopRuntime
Size 28.7MB
SHA256 28a8a18157b4555626e93c1ea13d34e405e9731d0d7d68e6849eb847f07e407b
MD5 962b0c11277324983932a2afa3f9fd62
SHA1 43d0b11c6dcb2303eefd66cef016867caf86c217
SHA512 27f3a922bf1ff8e15e29c202232704cd524df47e1aab5263b004bde879768cb1947342e77bd5f6fde9252d4a995e6195b5fcc347724c5e9ed6d628f90dc30902
SSDEEP 786432:7a9ZMG/0rG6AxSaAzS/94O1mgKl88YmGu5qPv:mDMGcq6sPeO1le8ln
TLSH
T18967331BBF910CA9D8638E76C4B79321AB393C046320956E4A94B62DCEF73E456777C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e8528c68-33be-4ac8-91a8-3631a2ccc1fc.tmp

Path C:\Users\Admin\Downloads\e8528c68-33be-4ac8-91a8-3631a2ccc1fc.tmp
Size 15KB
SHA256 3692a4f8750b4d46d58614ab6c8639a31e629d8d10dfab5378f4be51f597df6e
MD5 14ee60572b199be42f6ba2590086fa19
SHA1 a752c13075061f48479bd397d296230e6b0c8743
SHA512 d8acc5ef7ea28a416ec9edd2b857c78caa757340d1f56a0d323b9f98432c90dff75497cb1ceca2d906de125ce7bcb260406cdf6e1f707914ada322f8cc4c25b6
SSDEEP 384:aC/F48MgevVPi/gol7IU83c95B+N0qa2bYDJ/tSk:tFgJVPizl7IU831N0q7bYdP
TLSH
T156620B12FCA3D572DFD23233ED776F2075CE6D1090E9C6569744880238E27D29AA7B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI95D.tmp

Path C:\Windows\Installer\MSI95D.tmp
Size 411KB
SHA256 ac54078e0387d2a8ddcdbee3967da6ea6ec6508172505aca3d27a75fa43ce34f
MD5 1981cd407f5b5e81c70ba2729c56b381
SHA1 e0b6d311930ab3557d5a0a8769edefb49c32aa3f
SHA512 3b7c18ca780cf05a01062661156d71e0a4626469f28040e46f07c7deb8f9a643b838bbc88eda515362c5895171a337a3f5d9b8e321e539408fc1ae47e6ae4181
SSDEEP 6144:GDvoaVoIMrKAzCsTI+q6JL9eZYr1JJS5qZ47BwhYjzmHim:QvoaVo/2WCsT7pXJS5qgBwhYg
TLSH
T135947B29B3E418EDD4B682B6C5A78430FF75744D332095AF8BA4916D1F3BAA470BB701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BootstrapperApplicationData.xml

Path C:\Windows\TEMP\{C1F6B74C-FA3F-4C14-9F78-B2D549AF54A0}\.ba\BootstrapperApplicationData.xml
Size 9KB
SHA256 494949874db9060f5cb44b95159ebe483d0d1d3607d4db43ac6859f565194dec
MD5 1fc7816646df295a9de08891a50e76db
SHA1 84a8b2b6c0b5155fc626f386881fc67709ad6525
SHA512 b01dd53a57a5ae25e4a6c5e614ae847672a58d9866e51fafbc254af45e50130aa5d361a8e466244f730b250ddf43fe78f3ace112c9dbb1c9878bca25c14ca915
SSDEEP 192:UwzanZTak/wvAnvXXea5alvfM5EsCsysR:sn2zsCsysR
TLSH
T12412D5512BFD0218F0F39F88EFF6A4555A3ABD552E39C92D01301D0E49B2E858962FB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetLogo_256x.png

Path C:\Windows\TEMP\{C1F6B74C-FA3F-4C14-9F78-B2D549AF54A0}\.ba\DotNetLogo_256x.png
Size 2KB
SHA256 0f571f95d8eab48dbc81b0ec5e9f7225e349e26ef50868bfaab556f3c2443b01
MD5 39aa52615723b782c92dec710caaec7f
SHA1 760b49e256a7979fe50a56a2b1be3688a474b886
SHA512 89d1baa3820154667747b25e9e2fd321bfb2ec71dc309915b0a28dacdc80822a4943b639ebb37c37bd2559d5a4306d2096119cd970c84a0d331f6c68b0456dc9
TLSH
T1534195CF1BFD78D7E6E557918E1A8DD232738483B4B3A42CCE7B10B8274A5642B87940
MD5 SHA1 SHA512 TLSH

Submit Download

dotnet.ico

Path C:\Windows\TEMP\{C1F6B74C-FA3F-4C14-9F78-B2D549AF54A0}\.ba\dotnet.ico
Size 44KB
SHA256 61a2cbd12868cb9b359e0c78961d409b7875f072eb8e53ea88d3e6bfe2961a18
MD5 b8096652d9ec286709a2c863b244b110
SHA1 b3b7f0f4d608fad7cb59ba499d4d17c2b873a7af
SHA512 492a5aa83220bb77c178b7c5b50bf44968c0427e9e45bb97a33df14d7fb4c667ca7adde0ebb3874c7b6011057b01144e4e6651fbad62c6bcf5e0b93586c4bc7a
SSDEEP 96:r+gfbzo+wHK9NbwOY4tIWQeVlV1W9+H+guapUjFamINUItzf1dBNaIZ:ro5HuNcH4tIzeVlV1WEOFDgUWzf1PIm
TLSH
T1E913EF6DE68547C1C10C2032DB4AC792B5233C72E4DAE0C4F9D4FA7E177906965C6E6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\TEMP\{C1F6B74C-FA3F-4C14-9F78-B2D549AF54A0}\.ba\thm.wxl
Size 7KB
SHA256 b00edd703dd8a475119d0e4dd70a3aaa47f0e95361af290e76d367a8edef3432
MD5 8b2c667a8bbad3153068c0ed90df7ec4
SHA1 c9e04a3a37e5e6262ab9bfecf78280171b8f7b74
SHA512 5269f00d474acccb4c48cb7bcfdf19e63557a388572d3a6335aa39191319691d924e27f70da3f3495387c319396476c63a8fd7b35835cca0901220e39783847b
SSDEEP 96:HiTgM1+XSNEzA0HtYQstYCpCwZQpCeyk5HQJM9ouvj9urz8:Ew9EmtYQstYCPC9e8
TLSH
T191E1026F68DFDEE03A732651B2B3698D6919C29A136F1CF0F869084B47635016377A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.xml

Path C:\Windows\TEMP\{C1F6B74C-FA3F-4C14-9F78-B2D549AF54A0}\.ba\thm.xml
Size 11KB
SHA256 dfee8e2d075087227f19c835c145c5bb8e72a46880ea24080bb2472fd3a521be
MD5 4329e418dc56b1386d7ea29a0dcfab5b
SHA1 58387f92e89ca21b4179fb697c7de9675c59142f
SHA512 6934873d27e6efbb94da4f13ee8369b29995490051016fdf82800256b924902306d328bf1d4ebbf266d1a53eb24adb6478d1a67de4ecc3e3bcbe561968f24922
SSDEEP 96:HgvPkoeWEH3IWTaQfSJgHzth5mFahbuB8pR5+Vpwe+UIJLg1gEp+6F5pQnxc:AvoWydmQfVHMyyj5Z
TLSH
T14B42FC6851DC7811C532D702AB9371D3FF12BDA6C6C85A58B48E256B1FF262028B739C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windowsdesktop-runtime-10.0.15-win-x64.exe

Path C:\Windows\Temp\{6E96E2F3-12FF-404B-A058-4144B26F41EB}\.be\windowsdesktop-runtime-10.0.15-win-x64.exe
Size 968KB
SHA256 4f990be81da93d7df233e77eac04d3766ff4e2188b0a3a2743755bf456d07f2c
MD5 7cf46a3d2bfc54b7dc2e02099ea10834
SHA1 aa2c4b2f51ddbcefc73785ab31f9ace18264570a
SHA512 760ac33de190244a4dc6bd81c1e7226aa15f522827ead5a245a0532fa506b94a4d8a892b4c35e91aab58ba93a80ea0b66f9f9ebefc11cdf720df1b883ed1696a
SSDEEP 12288:E/hzPsOEX5eZbWC1I0iqm+4/Pm0zykD7xUWRj4YQkGKMnQxER2Lh+AtO:EZzPRq5eZbpTh47zykJLxvNzs2vO
TLSH
T1EE256D31A566241BE6F40973F914D6307E28E7082B1C55B6C6D0DD0C39A89FA6FFB24B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{C1F6B74C-FA3F-4C14-9F78-B2D549AF54A0}\.ba\1028\thm.wxl
Size 7KB
SHA256 43e1e134d0591532323dfcd138ac8f5e99096cb6cb0213a486bbb3ecc5c47aad
MD5 2d7b0d29deaa836b538baaae8378ba48
SHA1 85d86c566f601ad6e22301183771b9cc7e5062e9
SHA512 ecc84dafe21bf858eb4693fd7c0802cf28dc5fcaf43eccc4ded3c4a83bd550e3dbf58012be695cf267917c39f6047eac89fd0cdec090e253c283783d01d8a916
SSDEEP 96:E5TrTfb5joKvyvOj8USd4sZij7N4WoWKWvsNMNizchn/hD2Rd0E/aQpSK1nuQKbm:4r5owj7NgwsNMNSiK1gd6r
TLSH
T1ECE10F5F7CEFCED46A332A0176B32989191DD28A13AE6CF4F5580C478B634216B73A07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{C1F6B74C-FA3F-4C14-9F78-B2D549AF54A0}\.ba\1029\thm.wxl
Size 7KB
SHA256 2f174b5eed2a84e43396f3cae2e6521c9247bb0deccb16e7f9b461233c363534
MD5 f483510f350ad116c5c81468ad609bdf
SHA1 5343a3a695e6149c7a7ba831be75a91138763e44
SHA512 a39f3ebedb06361d95c39e4b7c5020d70be0e1e4654d5d5dfe254b44a7fa3a9c9c02659a28acc7ea8294620aa77818fb53609d7a2f6c9b6ae8d9adf9f2ac844c
SSDEEP 192:qxwpVLBj5iGRxrFe+4Lzv3zLfqRBxOTyv354+F:qxwNj5RxrF2PbLfWBETyv354S
TLSH
T17AF1FF1F58DFEED07B33194572B36A88681AC292035FACF5F8AE085787235059677E03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{C1F6B74C-FA3F-4C14-9F78-B2D549AF54A0}\.ba\1031\thm.wxl
Size 7KB
SHA256 2589887424dd4b0b27d36f7aa36d07fb6fa8d1c4dbe50059248a24823c742f92
MD5 4e98d12cfce46c393dcdf2736a2bda95
SHA1 aaf6a00e50cdf19f1c4fc6256ac040a750ca97af
SHA512 314d712f8fcb2a44abe1920aa9f44d2fef626732397d3d77e4ad0ea6a003b0ea38e361c96515c8e6f8cf7d61ab96de9a349a228522a9f4b81d82c8a8f1962662
SSDEEP 96:jgl95EIQ8+nPQP6Zc0y7jOROgYmwitzvzB5xz2kSl+ACIw052Q/LKtkCGpUvgd/q:jEpcoPWc0y7jGhYmdtzvzr8/oa/Lt/hQ
TLSH
T134F1425BA8EFDAD077332611B3736989791AD2C6136F1DF4F8A9480B8763501537BA03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{C1F6B74C-FA3F-4C14-9F78-B2D549AF54A0}\.ba\1036\thm.wxl
Size 8KB
SHA256 ecdd5f7b7ed65bef8e3eec00537da44939b8e8f8f604e9b39329b45ec210efde
MD5 7673a053117454b94ff8155b9f06da1e
SHA1 2143896f16e8ec6d52eecb773e99d9a2f9daa4b9
SHA512 0d20a4d6819fc64e36cfcd9c029542d6ef834faa3c74dd636bc1b6697f92d8822cd19c1692c500956fdfe69a3278a84c0545c799878107d0d56520053b9ae266
SSDEEP 96:lsZt1vwZI+XNHwt/o5HezMxzMEy0vBW4eAQf49QcyhZpuWcK61xrG32gUgGv:o1wPWto5+zwzvWhvgYUgg
TLSH
T1E202105F58DBCFE06BB31717B6639589A839C286235F58E4F86B08078763914D337A43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{C1F6B74C-FA3F-4C14-9F78-B2D549AF54A0}\.ba\1040\thm.wxl
Size 7KB
SHA256 c536f3f85936f6b38782df30a7bf88c7e7e66fa1e3257b20b75f9a4f0112b184
MD5 21fe14f06f2e38ca565581045a67eaba
SHA1 fe56b260ea7986f6234aeaa9f3adb010b01a0ff5
SHA512 a87e53dbcab33b95d78f67c7e62f0c3fa50711f54b11efee890b749dd21f42e68db185dc5a99160dd37403612abb9609d311dea1254c126b1e96ecf7aab67051
SSDEEP 96:p0NpgwGrmKmuaXo+Hnxy7McLi4vgjzH9euz3KLrQTNRREhZDWDIQ0gwZKWakCRos:wNBoJvUzH9euz3tTDCnZKWzDU+c
TLSH
T1BFF1EF7B68DFDDD0BA332748B2B3B589B51ED586235F19E0F4AA094B4753500A27BA03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{C1F6B74C-FA3F-4C14-9F78-B2D549AF54A0}\.ba\1041\thm.wxl
Size 8KB
SHA256 000e1508d9bacb7156951988ba1d6dc36165facd2163352a93b9a66e8c642089
MD5 e29c1d15cf0eeb5fb10a6f0e92b041fc
SHA1 68cd096f0135524d5d07a9ec1fbcb69e1a1084de
SHA512 47d3acdafbc3dc960d569976fe3c635613608f08102a6cd0c246f8ebe0f3343e73fc9d87a673035a46fbc4de21c59b97054dfd596dde2f5f6eea25f6ff7b7d96
SSDEEP 96:/x55EeSXkI6+QsPIVLYitzzus2iK5EmV26W/0zYe9YQfNpYjruBzUYwvdCz1Q:/BQFPIVLYszzutz8yzYUO/CxQ
TLSH
T1B702102EA5DB89E06A331611756776C8680BCC85DBAB1CF0B07DC817977341DE237A32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{C1F6B74C-FA3F-4C14-9F78-B2D549AF54A0}\.ba\1042\thm.wxl
Size 7KB
SHA256 09c51c910f7142ab7f73db8e826f3daff1525eea765d03bcd934cba53bc689d3
MD5 095c8d4db15a85c0c62842d0192202ad
SHA1 d703ab6b95a8190a3187a65ba1b779d856eff7b8
SHA512 86860b18e9101c2d27359e53e21c7f2fe939031850387a6a55c12d23b7dbe4133722b5fdf4364dc896d5aac5744b470b45198a47da6912a4827b88f433a79796
SSDEEP 96:YWnvHZWx805aEfLW344uU5OsW+yvuE4uU5J+jpD2kUcdkAdiY10IHDWw/fPb8Qhk:kjcuYhu5jx2kP1/3bmk9d4
TLSH
T1E8F1429B78EFDED026732C413AF36A95591AC2DA235B08F0F9254C878B738114637E27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{C1F6B74C-FA3F-4C14-9F78-B2D549AF54A0}\.ba\1045\thm.wxl
Size 7KB
SHA256 209911674536ad5976dad21ae1e96a9fdfa61270120a94bbe0e8ae32a67239a2
MD5 4e407f5d7e06084cb9ec7b41b1f4b992
SHA1 0aa44f39e522935de900449937af13df18a6ef44
SHA512 926daa3c9d92b7f0e910101d6482ce6e153af13dd3f59236d3418df4a158857f00ea565869312f35c0bf6e689b6f1a0bead71f54e77783d65311838dc980c996
SSDEEP 96:vz5E6U+A8fOIZcvYqUC/W5TqUbFaOa0Q9zSzfmZ5AKgY1ou5DQ7JPy+u1/8X3vCH:ln9BmNUCqeUJaOaHNCPA/zGYP
TLSH
T1D5F1005FA4EFCED127331A45B6B369C9680AC5CA136F1CE4F8AE081B87675019337A43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{C1F6B74C-FA3F-4C14-9F78-B2D549AF54A0}\.ba\1046\thm.wxl
Size 7KB
SHA256 7b095c32d1fbdd924d710d18d51a88a710bc152c8b30c6051524583bfabe38c0
MD5 13d65c9d4996d93edafb2696cc2a90b3
SHA1 80047984b6cee842764b24ef33a5c67eaabab2f3
SHA512 14ceaf26e16cfd039e18614d40148c44e09cc2e7130b19a3024aabb46bac77c1445cd7de84ef46577ae1ab4cf15cd0152a3ccd6fe070ee0a34b06f8f29ba0af0
SSDEEP 96:TD5ED4lH+wLwdBc7tlqIz5Vv0gpK0rD45g5q8MSQ7EugTuo6RADvAbK:Z1kvg7xlVv0gpXMfgLGK
TLSH
T1D9F1121F68DFDED037331A42B2B36A8A6509C2C5135F5DF4F8AA494B87A3500A637A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{C1F6B74C-FA3F-4C14-9F78-B2D549AF54A0}\.ba\1049\thm.wxl
Size 9KB
SHA256 3c911848f83d269fa2cd64bbfd7b5e88eb3a621bdd42c564c69100a8e8a40494
MD5 7904c2832b3cedabcdf0ec49dd8040ba
SHA1 2a7f428568ab6ea5fd54bb80376c552d80a0e7a3
SHA512 3c881efc2b611bda02b290bc79948818ce6e6a495dcf2dc938047875f301f18f9eae37ba109fd9b453504173cb9209192e0d2cd4603c7bf105042bc9775829e0
SSDEEP 96:C7lv+VxxVUC7bqFdwkd/XQF+L++qFQEemLq9OJRgcnZKQ8VXoshXuOxMvlmV3p/n:zVPVU//y+L++9wpZ/oRZ1
TLSH
T1A022FD2615EFA8D81222B117E9626E0E3C5B81FF3B6B5BF174641C6F76B3000833B606
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{C1F6B74C-FA3F-4C14-9F78-B2D549AF54A0}\.ba\1055\thm.wxl
Size 7KB
SHA256 56d76adc63b71879e3291f0f306e54081e9e80f463fcb41dc6896ecd2298deae
MD5 e2fabe4eb312645c1231029191458f7e
SHA1 f9f143535ba48d9aeb791c62e79ed687911927b1
SHA512 ddf60df1ee2f00561bc806e384478b105182a4bec673b5eb26b1db7f88adb297af80b7bdfeecd5e0aefc3579bf20a84bc9bacdcfb727b9d1af2865cdcdc48a37
SSDEEP 96:YMANNFTFhC4h4bNReiNxfufGzzzSkbAS37lsu+wzPwQT8gpwMu7kVS0uuM/r+9Hc:YlFJydNxfu+zzzgoZ7Twh/6H/0
TLSH
T1DCF1231F78DFEDD467332A56B2B3268CB84EC382132A9CE0F52944479BA351152B7B07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{C1F6B74C-FA3F-4C14-9F78-B2D549AF54A0}\.ba\2052\thm.wxl
Size 7KB
SHA256 340154c87016bd6af740e6a91ea86d722817f6dc2bc675c33133901443658179
MD5 e89b4290f9255b428cc21e217dc8e5e7
SHA1 84f78df432e53426412e2123c1990acfb743f6c9
SHA512 b313de643859aca6b9b2f05f88efd130c900065c08d2279af6f7d8dd0301a7a762ee0e051ccc76c737c68c86e51decd48287529e7fc9a25c0cb1228151447105
SSDEEP 96:dLf2DllNpoNWZd9rCfE4d57afwUtn93K248RYCPr/I5Qqj9BQru0iCiBkz6/3PPx:d0Np6fHGwMn93MRoL+u0x
TLSH
T11EE1119F78EFCEE02A332A5132B325CC2819D28957AB5DF0F4641C4B8B634205777A07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{C1F6B74C-FA3F-4C14-9F78-B2D549AF54A0}\.ba\3082\thm.wxl
Size 7KB
SHA256 2416f9a3daa6767f418c5ab94edb8a83dc9326fcaf13de1186e61b5248349edc
MD5 65b3aa6dd10a5b8db1b7f7faa4c4c7e1
SHA1 ca32c8b853681960c86d19d533dff4ff1137a1c6
SHA512 d7fce89011c24d0c3928807293d42a3f694ef4357d3c42a84d9294de000b291279671e2059e063ac58806b8e718654260ce5c9ae8c748d3a0a8c9ce0e23ac55a
SSDEEP 96:oEBx4+Ck8rL6j+zTnnq6LuSznTUzO1GKW+gepaU5/QxANuRypklEDhmh8asuBtz:aX6qfxLzznAzO1G0ERdiu/z
TLSH
T132F1412F68CFDEE27B73194472F3958DA808C295235ECDE0F468085B8793905D637A83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BootstrapperExtensionData.xml

Path C:\Windows\Temp\{C1F6B74C-FA3F-4C14-9F78-B2D549AF54A0}\.ba\BootstrapperExtensionData.xml
Size 276B
SHA256 258fac237622533e7f9ec3f95bcec8abcc31ae87e2017e5717af0841c61e9df4
MD5 240bac991e5860465ce0dfd580ea7cb3
SHA1 a352934cbb14ab877883ac219ceb78c92e27f495
SHA512 67ff8063a071436ae7dca8ee12ad1991bb70752dcc63f00f129f38dffa1aaf9299fff591fc67dbf4d2fdc57a9242831b149d575181b84857cd4f22463076f315
TLSH
T1DAD05E432FBE2304F1B30F49A6BA94102475BE009D78CC6D0228080C0573D92C8B2F77
MD5 SHA1 SHA512 TLSH

Submit Download

license.rtf

Path C:\Windows\Temp\{C1F6B74C-FA3F-4C14-9F78-B2D549AF54A0}\.ba\license.rtf
Size 215B
SHA256 75cf03762aea3f3ef6ae0dc0290c4426052549a0b4335bcc3ba9ca30391e0751
MD5 5f5db41d3f86258e4b6f8b08ef870d0a
SHA1 3c02aea43c2bc7dff281ec8e5ad01abf058c1ed6
SHA512 26344831d563e95a26126f2d99ce9b773017596001fbf3d7f56b9a84c77a69240640b7bb191ec8ec7fa66d424134805113be8b9503adae19554aaba6c98223ee
TLSH
T19BD022EA15CC11AA3FB80A8CEB04D029ED7E419DBC41D682B1313A90F81192DB2C76A2
MD5 SHA1 SHA512 TLSH

Submit Download

logo.png

Path C:\Windows\Temp\{C1F6B74C-FA3F-4C14-9F78-B2D549AF54A0}\.ba\logo.png
Size 852B
SHA256 cd2e8ed1fbb308d9d166f49794d323a9b22efba1033cdf906d1f4b030319e01b
MD5 8346e21859a269dccf1e408dc7593cca
SHA1 239f10674bf6022854c1f1bf7c91955bde34d3e4
SHA512 de9a54e7067fe4feade10f48d7c2bb4169f50efa0b06d3310421376690712af4d55dbc24dc5accc5013379b11abb59cc8c85896fe9f2a7c6a7ea2e28f6feac9f
TLSH
T16B0152E8C16455ACA24E76BA91F32450B653B46010C5CD8EBE00DF3442F4522AB976A6
MD5 SHA1 SHA512 TLSH

Submit Download

wixstdba.exe

Path C:\Windows\Temp\{C1F6B74C-FA3F-4C14-9F78-B2D549AF54A0}\.ba\wixstdba.exe
Size 431KB
SHA256 e9aad13949cd910523bf9547fc5c23bd2c26595e024809a9f8fa866c8d8e555b
MD5 14e0c606e68508fa618bd5c514015577
SHA1 f8c28db9d2810e872f6ffe7607019851f250c5f9
SHA512 c29fedca692ca2f9c5e63f360aeb95399f2f15f1576a0d06fcf9f0919f6b658329973803bc870b0b1e954b0105757630ca3f4b3ac64f4b80e91742d612fd5b73
SSDEEP 6144:N7lQcp03E0PKVMP/PwMFJ3zdoZmb8LSQsCjzYkffTTp6EoNXJrprSU0e:Np6mM/wML3/QsJDLXJrow
TLSH
T16D942A3165F04023D6F94572E915FA30AF39F208670085EBA3C0DD297968AE6A7FB357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4292-378-0x0000000000240000-0x0000000000752000-memory.dmp

Download

memory/4292-8-0x0000000000240000-0x0000000000752000-memory.dmp

Download

memory/4292-9-0x0000000000BB0000-0x0000000000BB1000-memory.dmp

Download

memory/4292-5-0x0000000000BB0000-0x0000000000BB1000-memory.dmp

Download

memory/4376-0-0x0000000000C00000-0x0000000000D0E000-memory.dmp

Download

memory/4376-379-0x0000000000C00000-0x0000000000D0E000-memory.dmp

Download

memory/4376-7-0x0000000000C00000-0x0000000000D0E000-memory.dmp

Download