4ba3a8a29a4adaf21f304239e3c769d4f8da809106e01caef80945fd604b0076

Resubmissions

20/04/2026, 15:01

260420-sd558sdy3p8

20/04/2026, 00:51

260420-a7ldtaay5s8

Analysis

user interaction
yes
max time kernel
197s
max time network
195s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/04/2026, 15:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Velocity.zip
Size 12.5MB
Sample260420-sd558sdy3p
SHA256 4ba3a8a29a4adaf21f304239e3c769d4f8da809106e01caef80945fd604b0076
MD5 69c1ec1744daf4c5dea14f428621dbce
SHA1 a01c9792d87a5ee761f1953794e5f08cfa3f600d
SHA512 743cd36db333c7412c9581245c7c570313791ac9c2c3311bd5d5cf425a7a0b47751b469b88e7c5216acb6afca8b1385c9ab0d32f7d49985195de3e748df1120b
SSDEEP 196608:VsI43uQZN/rzCs2jNH1CKuXYAISerbwoCFWOB3sMXcz0hNRcY8m/gSTu/gjwGN:VztWN/rzCVNE1YbjC8jMXc4Vv5Y4V7N
TLSH
T155D633DD9EA26F6DD17F3873501859CC4FAD296AE5ED012630A8E0C96AC35FC7C80C66
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence

Malware Config

Signatures

Downloads MZ/PE file 2 IoCs

flow	pid	Process
148	5560	Velocity.exe
113	2252	msedge.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\Control Panel\International\Geo\Nation	Velocity.exe
Key value queried	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\Control Panel\International\Geo\Nation	windowsdesktop-runtime-10.0.6-win-x86.exe
Key value queried	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\Control Panel\International\Geo\Nation	windowsdesktop-runtime-10.0.6-win-x86.exe

Executes dropped EXE 10 IoCs

pid	Process
2772	Velocity.exe
4196	windowsdesktop-runtime-10.0.6-win-x86.exe
3976	wixstdba.exe
748	windowsdesktop-runtime-10.0.6-win-x86.exe
2056	windowsdesktop-runtime-10.0.6-win-x86.exe
4460	windowsdesktop-runtime-10.0.6-win-x86.exe
5656	wixstdba.exe
5668	windowsdesktop-runtime-10.0.6-win-x86.exe
5560	Velocity.exe
5992	Decompiler.exe

Loads dropped DLL 64 IoCs

pid	Process
5412	MsiExec.exe
5564	MsiExec.exe
5408	MsiExec.exe
5816	MsiExec.exe
5960	MsiExec.exe
5380	MsiExec.exe
5560	Velocity.exe
5560	Velocity.exe
5560	Velocity.exe
5560	Velocity.exe
5560	Velocity.exe
5560	Velocity.exe
5560	Velocity.exe
5560	Velocity.exe
5560	Velocity.exe
5560	Velocity.exe
5560	Velocity.exe
5560	Velocity.exe
5560	Velocity.exe
5560	Velocity.exe
5560	Velocity.exe
5560	Velocity.exe
5560	Velocity.exe
5560	Velocity.exe
5560	Velocity.exe
5560	Velocity.exe
5560	Velocity.exe
5560	Velocity.exe
5560	Velocity.exe
5560	Velocity.exe
5560	Velocity.exe
5560	Velocity.exe
5560	Velocity.exe
5560	Velocity.exe
5560	Velocity.exe
5560	Velocity.exe
5560	Velocity.exe
5560	Velocity.exe
5560	Velocity.exe
5560	Velocity.exe
5560	Velocity.exe
5560	Velocity.exe
5560	Velocity.exe
5560	Velocity.exe
5560	Velocity.exe
5560	Velocity.exe
5560	Velocity.exe
5560	Velocity.exe
5560	Velocity.exe
5560	Velocity.exe
5560	Velocity.exe
5560	Velocity.exe
5560	Velocity.exe
5560	Velocity.exe
5560	Velocity.exe
5560	Velocity.exe
5560	Velocity.exe
5560	Velocity.exe
5560	Velocity.exe
5560	Velocity.exe
5560	Velocity.exe
5560	Velocity.exe
5560	Velocity.exe
5560	Velocity.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{470716B6-F2D6-4BB5-A865-70471E521D9B} = "\"C:\\ProgramData\\Package Cache\\{470716B6-F2D6-4BB5-A865-70471E521D9B}\\windowsdesktop-runtime-10.0.6-win-x86.exe\" /burn.runonce"	windowsdesktop-runtime-10.0.6-win-x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{470716B6-F2D6-4BB5-A865-70471E521D9B} = "\"C:\\ProgramData\\Package Cache\\{470716B6-F2D6-4BB5-A865-70471E521D9B}\\windowsdesktop-runtime-10.0.6-win-x86.exe\" /burn.runonce"	windowsdesktop-runtime-10.0.6-win-x86.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
153	discord.com
156	discord.com

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.6\System.Reflection.Emit.ILGeneration.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.6\System.Xml.XmlDocument.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.6\pt-BR\WindowsBase.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.6\System.Security.Principal.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.6\mscorrc.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.6\System.Design.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.6\zh-Hant\WindowsBase.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.6\.version	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.6\System.Xaml.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.6\ja\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.6\zh-Hans\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.6\System.Xml.XPath.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.6\mscorlib.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.6\pt-BR\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.6\System.Security.Cryptography.X509Certificates.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.6\ru\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.6\zh-Hant\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.6\.version	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.6\cs\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.6\pl\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.6\System.Text.Encodings.Web.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.6\de\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\dotnet.exe	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.6\System.Reflection.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.6\pt-BR\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.6\System.Runtime.Serialization.Formatters.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.6\PresentationFramework.Luna.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.6\pl\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.6\System.Data.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.6\System.IO.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.6\System.Net.WebProxy.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.6\UIAutomationClient.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.6\de\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.6\pl\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.6\pt-BR\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.6\pt-BR\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.6\ko\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.6\ru\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.6\zh-Hans\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.6\System.IO.Pipes.AccessControl.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.6\System.Security.Claims.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.6\System.Xml.XDocument.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.6\de\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.6\de\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.6\it\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.6\pl\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.6\System.Runtime.InteropServices.RuntimeInformation.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.6\Accessibility.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.6\Microsoft.VisualBasic.Forms.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.6\pl\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.6\System.Printing.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.6\zh-Hant\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.6\System.Diagnostics.Debug.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.6\System.Web.HttpUtility.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.6\WindowsBase.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.6\de\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.6\System.Dynamic.Runtime.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.6\Microsoft.WindowsDesktop.App.runtimeconfig.json	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.6\it\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.6\tr\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.6\zh-Hant\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\swidtag\Microsoft Windows Desktop Runtime 10.0.6 (x86).swidtag	windowsdesktop-runtime-10.0.6-win-x86.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.6\System.Linq.Queryable.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.6\PresentationFramework.Fluent.dll	msiexec.exe

Drops file in Windows directory 31 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e591aff.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{AFA72DC2-9EE0-4B83-A04A-255F24009BCC}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2801.tmp	msiexec.exe
File created	C:\Windows\Installer\e591b00.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI66A9.tmp	msiexec.exe
File created	C:\Windows\Installer\e591af6.msi	msiexec.exe
File created	C:\Windows\Installer\e591afb.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{638E1FA6-35F8-491B-9CA3-BCD1083F7D10}	msiexec.exe
File opened for modification	C:\Windows\Installer\e591af1.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI25BE.tmp	msiexec.exe
File created	C:\Windows\Installer\e591afa.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI44A5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4B8C.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{2309F3D6-5213-432B-AD98-7261C8F07839}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3850.tmp	msiexec.exe
File created	C:\Windows\Installer\e591b04.msi	msiexec.exe
File created	C:\Windows\Installer\e591af5.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2BFA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2D43.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e591b00.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6E2C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e591af6.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e591afb.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{5C8A8EA1-8A8A-4C47-AE1C-C0495518B3CA}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5939.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI662B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6DDD.tmp	msiexec.exe
File created	C:\Windows\Installer\e591af1.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Velocity.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.6-win-x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wixstdba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Velocity.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.6-win-x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wixstdba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.6-win-x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.6-win-x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.6-win-x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

System Time Discovery 1 TTPs 5 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2812	msedge.exe
2252	msedge.exe
5236	msedge.exe
5540	msedge.exe
3372	msedge.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 17 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2C	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134211710007614964"	msedge.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2d	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2B	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_80.24.50533_x86\DisplayName = "Microsoft Windows Desktop Runtime - 10.0.6 (x86)"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1AE8A8C5A8A874C4EAC10C9455813BAC\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.24.50533_x86\ = "{2309F3D6-5213-432B-AD98-7261C8F07839}"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{0f62ff89-5cc3-5dfe-ec82-db9d826b6527}\ = "{470716B6-F2D6-4BB5-A865-70471E521D9B}"	windowsdesktop-runtime-10.0.6-win-x86.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.24.50533_x86	windowsdesktop-runtime-10.0.6-win-x86.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\windowsdesktop_runtime_80.24.50533_x86	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2CD27AFA0EE938B40AA452F54200B9CC\ProductName = "Microsoft .NET Host - 10.0.6 (x86)"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D8ED1F2020156916DE6D585BBB091026	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x86\DisplayName = "Microsoft .NET Host - 10.0.6 (x86)"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2CD27AFA0EE938B40AA452F54200B9CC\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6D3F90323125B234DA8927168C0F8793\ProductName = "Microsoft .NET Host FX Resolver - 10.0.6 (x86)"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1AE8A8C5A8A874C4EAC10C9455813BAC\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\6D3F90323125B234DA8927168C0F8793\MainFeature	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x86\Dependents\{470716B6-F2D6-4BB5-A865-70471E521D9B}	windowsdesktop-runtime-10.0.6-win-x86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_80.24.50533_x86\Dependents\{470716B6-F2D6-4BB5-A865-70471E521D9B}	windowsdesktop-runtime-10.0.6-win-x86.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-745935970-1373868228-562466063-1000\{50022F32-8D91-4847-BEAF-CE4025F20A22}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2CD27AFA0EE938B40AA452F54200B9CC	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2CD27AFA0EE938B40AA452F54200B9CC\SourceList	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6AF1E8368F53B194C93ACB1D80F3D701\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_80.24.50533_x86\Dependents	windowsdesktop-runtime-10.0.6-win-x86.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\windowsdesktop_runtime_80.24.50533_x86	windowsdesktop-runtime-10.0.6-win-x86.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6D3F90323125B234DA8927168C0F8793\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\dotnet_runtime_80.24.50533_x86	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_80.24.50533_x86\Version = "80.24.50533"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{0f62ff89-5cc3-5dfe-ec82-db9d826b6527}\Dependents	windowsdesktop-runtime-10.0.6-win-x86.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2CD27AFA0EE938B40AA452F54200B9CC\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6D3F90323125B234DA8927168C0F8793\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6AF1E8368F53B194C93ACB1D80F3D701\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{638E1FA6-35F8-491B-9CA3-BCD1083F7D10}v80.24.50533\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.24.50533_x86\Dependents\{470716B6-F2D6-4BB5-A865-70471E521D9B}	windowsdesktop-runtime-10.0.6-win-x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1AE8A8C5A8A874C4EAC10C9455813BAC\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{5C8A8EA1-8A8A-4C47-AE1C-C0495518B3CA}v80.24.50533\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6AF1E8368F53B194C93ACB1D80F3D701\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{638E1FA6-35F8-491B-9CA3-BCD1083F7D10}v80.24.50533\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\dotnet_runtime_80.24.50533_x86	windowsdesktop-runtime-10.0.6-win-x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{0f62ff89-5cc3-5dfe-ec82-db9d826b6527}\DisplayName = "Microsoft Windows Desktop Runtime 10.0.6 (x86)"	windowsdesktop-runtime-10.0.6-win-x86.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2CD27AFA0EE938B40AA452F54200B9CC\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2CD27AFA0EE938B40AA452F54200B9CC\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{AFA72DC2-9EE0-4B83-A04A-255F24009BCC}v80.24.50533\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6D3F90323125B234DA8927168C0F8793	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6D3F90323125B234DA8927168C0F8793\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_80.24.50533_x86\DisplayName = "Microsoft .NET Runtime - 10.0.6 (x86)"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6AF1E8368F53B194C93ACB1D80F3D701\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\6AF1E8368F53B194C93ACB1D80F3D701	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.24.50533_x86\Version = "80.24.50533"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{0f62ff89-5cc3-5dfe-ec82-db9d826b6527}\DisplayName = "Microsoft Windows Desktop Runtime 10.0.6 (x86)"	windowsdesktop-runtime-10.0.6-win-x86.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1AE8A8C5A8A874C4EAC10C9455813BAC\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1AE8A8C5A8A874C4EAC10C9455813BAC\SourceList\PackageName = "windowsdesktop-runtime-10.0.6-win-x86.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1AE8A8C5A8A874C4EAC10C9455813BAC\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\2CB1631F46953A26E5B75D8F162EF3B8\6AF1E8368F53B194C93ACB1D80F3D701	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1AE8A8C5A8A874C4EAC10C9455813BAC\ProductName = "Microsoft Windows Desktop Runtime - 10.0.6 (x86)"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1AE8A8C5A8A874C4EAC10C9455813BAC\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\07ECA01EA5C53154E373126BB0ADFF47	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-745935970-1373868228-562466063-1000\{5A570506-6AB2-40D2-A87B-57F022FFF930}	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2CD27AFA0EE938B40AA452F54200B9CC\MainFeature	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x86	windowsdesktop-runtime-10.0.6-win-x86.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x86	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x86\Version = "80.24.50533"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x86\Dependents	windowsdesktop-runtime-10.0.6-win-x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D8ED1F2020156916DE6D585BBB091026\6D3F90323125B234DA8927168C0F8793	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6D3F90323125B234DA8927168C0F8793\SourceList	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1AE8A8C5A8A874C4EAC10C9455813BAC\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x86\ = "{AFA72DC2-9EE0-4B83-A04A-255F24009BCC}"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1AE8A8C5A8A874C4EAC10C9455813BAC\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_80.24.50533_x86\Dependents\{470716B6-F2D6-4BB5-A865-70471E521D9B}	windowsdesktop-runtime-10.0.6-win-x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6D3F90323125B234DA8927168C0F8793\PackageCode = "8F1E6E80D6852BC4F8CBD9A90FB2A670"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
5164	msiexec.exe
5164	msiexec.exe
5164	msiexec.exe
5164	msiexec.exe
5164	msiexec.exe
5164	msiexec.exe
5164	msiexec.exe
5164	msiexec.exe
5164	msiexec.exe
5164	msiexec.exe
5164	msiexec.exe
5164	msiexec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	2444	7zG.exe
Token: 35	2444	7zG.exe
Token: SeSecurityPrivilege	2444	7zG.exe
Token: SeSecurityPrivilege	2444	7zG.exe
Token: SeShutdownPrivilege	748	windowsdesktop-runtime-10.0.6-win-x86.exe
Token: SeIncreaseQuotaPrivilege	748	windowsdesktop-runtime-10.0.6-win-x86.exe
Token: SeSecurityPrivilege	5164	msiexec.exe
Token: SeCreateTokenPrivilege	748	windowsdesktop-runtime-10.0.6-win-x86.exe
Token: SeAssignPrimaryTokenPrivilege	748	windowsdesktop-runtime-10.0.6-win-x86.exe
Token: SeLockMemoryPrivilege	748	windowsdesktop-runtime-10.0.6-win-x86.exe
Token: SeIncreaseQuotaPrivilege	748	windowsdesktop-runtime-10.0.6-win-x86.exe
Token: SeMachineAccountPrivilege	748	windowsdesktop-runtime-10.0.6-win-x86.exe
Token: SeTcbPrivilege	748	windowsdesktop-runtime-10.0.6-win-x86.exe
Token: SeSecurityPrivilege	748	windowsdesktop-runtime-10.0.6-win-x86.exe
Token: SeTakeOwnershipPrivilege	748	windowsdesktop-runtime-10.0.6-win-x86.exe
Token: SeLoadDriverPrivilege	748	windowsdesktop-runtime-10.0.6-win-x86.exe
Token: SeSystemProfilePrivilege	748	windowsdesktop-runtime-10.0.6-win-x86.exe
Token: SeSystemtimePrivilege	748	windowsdesktop-runtime-10.0.6-win-x86.exe
Token: SeProfSingleProcessPrivilege	748	windowsdesktop-runtime-10.0.6-win-x86.exe
Token: SeIncBasePriorityPrivilege	748	windowsdesktop-runtime-10.0.6-win-x86.exe
Token: SeCreatePagefilePrivilege	748	windowsdesktop-runtime-10.0.6-win-x86.exe
Token: SeCreatePermanentPrivilege	748	windowsdesktop-runtime-10.0.6-win-x86.exe
Token: SeBackupPrivilege	748	windowsdesktop-runtime-10.0.6-win-x86.exe
Token: SeRestorePrivilege	748	windowsdesktop-runtime-10.0.6-win-x86.exe
Token: SeShutdownPrivilege	748	windowsdesktop-runtime-10.0.6-win-x86.exe
Token: SeDebugPrivilege	748	windowsdesktop-runtime-10.0.6-win-x86.exe
Token: SeAuditPrivilege	748	windowsdesktop-runtime-10.0.6-win-x86.exe
Token: SeSystemEnvironmentPrivilege	748	windowsdesktop-runtime-10.0.6-win-x86.exe
Token: SeChangeNotifyPrivilege	748	windowsdesktop-runtime-10.0.6-win-x86.exe
Token: SeRemoteShutdownPrivilege	748	windowsdesktop-runtime-10.0.6-win-x86.exe
Token: SeUndockPrivilege	748	windowsdesktop-runtime-10.0.6-win-x86.exe
Token: SeSyncAgentPrivilege	748	windowsdesktop-runtime-10.0.6-win-x86.exe
Token: SeEnableDelegationPrivilege	748	windowsdesktop-runtime-10.0.6-win-x86.exe
Token: SeManageVolumePrivilege	748	windowsdesktop-runtime-10.0.6-win-x86.exe
Token: SeImpersonatePrivilege	748	windowsdesktop-runtime-10.0.6-win-x86.exe
Token: SeCreateGlobalPrivilege	748	windowsdesktop-runtime-10.0.6-win-x86.exe
Token: SeRestorePrivilege	5164	msiexec.exe
Token: SeTakeOwnershipPrivilege	5164	msiexec.exe
Token: SeRestorePrivilege	5164	msiexec.exe
Token: SeTakeOwnershipPrivilege	5164	msiexec.exe
Token: SeRestorePrivilege	5164	msiexec.exe
Token: SeTakeOwnershipPrivilege	5164	msiexec.exe
Token: SeRestorePrivilege	5164	msiexec.exe
Token: SeTakeOwnershipPrivilege	5164	msiexec.exe
Token: SeRestorePrivilege	5164	msiexec.exe
Token: SeTakeOwnershipPrivilege	5164	msiexec.exe
Token: SeRestorePrivilege	5164	msiexec.exe
Token: SeTakeOwnershipPrivilege	5164	msiexec.exe
Token: SeRestorePrivilege	5164	msiexec.exe
Token: SeTakeOwnershipPrivilege	5164	msiexec.exe
Token: SeRestorePrivilege	5164	msiexec.exe
Token: SeTakeOwnershipPrivilege	5164	msiexec.exe
Token: SeRestorePrivilege	5164	msiexec.exe
Token: SeTakeOwnershipPrivilege	5164	msiexec.exe
Token: SeRestorePrivilege	5164	msiexec.exe
Token: SeTakeOwnershipPrivilege	5164	msiexec.exe
Token: SeRestorePrivilege	5164	msiexec.exe
Token: SeTakeOwnershipPrivilege	5164	msiexec.exe
Token: SeRestorePrivilege	5164	msiexec.exe
Token: SeTakeOwnershipPrivilege	5164	msiexec.exe
Token: SeRestorePrivilege	5164	msiexec.exe
Token: SeTakeOwnershipPrivilege	5164	msiexec.exe
Token: SeRestorePrivilege	5164	msiexec.exe
Token: SeTakeOwnershipPrivilege	5164	msiexec.exe

Suspicious use of FindShellTrayWindow 29 IoCs

pid	Process
2444	7zG.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
3976	wixstdba.exe
5656	wixstdba.exe
2812	msedge.exe
5656	wixstdba.exe
5560	Velocity.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe

Suspicious use of SendNotifyMessage 8 IoCs

pid	Process
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2772	Velocity.exe
5560	Velocity.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2772 wrote to memory of 3372	2772	Velocity.exe	101
PID 3372 wrote to memory of 2812	3372	msedge.exe	102
PID 2812 wrote to memory of 2012	2812	msedge.exe	103
PID 2812 wrote to memory of 2252	2812	msedge.exe	104
PID 2812 wrote to memory of 2904	2812	msedge.exe	105
PID 2812 wrote to memory of 2904	2812	msedge.exe	105
PID 2812 wrote to memory of 2904	2812	msedge.exe	105
PID 2812 wrote to memory of 364	2812	msedge.exe	106
PID 2812 wrote to memory of 364	2812	msedge.exe	106
PID 2812 wrote to memory of 1312	2812	msedge.exe	108
PID 2812 wrote to memory of 4888	2812	msedge.exe	109
PID 2812 wrote to memory of 1312	2812	msedge.exe	108
PID 2812 wrote to memory of 1312	2812	msedge.exe	108
PID 2812 wrote to memory of 4888	2812	msedge.exe	109
PID 2812 wrote to memory of 4888	2812	msedge.exe	109
PID 2812 wrote to memory of 716	2812	msedge.exe	110
PID 2812 wrote to memory of 716	2812	msedge.exe	110
PID 2812 wrote to memory of 716	2812	msedge.exe	110
PID 2812 wrote to memory of 2544	2812	msedge.exe	111
PID 2812 wrote to memory of 2544	2812	msedge.exe	111
PID 2812 wrote to memory of 2544	2812	msedge.exe	111
PID 2812 wrote to memory of 1116	2812	msedge.exe	114
PID 2812 wrote to memory of 1116	2812	msedge.exe	114
PID 2812 wrote to memory of 2528	2812	msedge.exe	116
PID 2812 wrote to memory of 1912	2812	msedge.exe	117
PID 2812 wrote to memory of 2528	2812	msedge.exe	116
PID 2812 wrote to memory of 1912	2812	msedge.exe	117
PID 2812 wrote to memory of 4148	2812	msedge.exe	119
PID 2812 wrote to memory of 2436	2812	msedge.exe	120
PID 2812 wrote to memory of 2436	2812	msedge.exe	120
PID 2812 wrote to memory of 4504	2812	msedge.exe	121
PID 2812 wrote to memory of 4504	2812	msedge.exe	121
PID 2812 wrote to memory of 1116	2812	msedge.exe	122
PID 2812 wrote to memory of 1116	2812	msedge.exe	122
PID 2812 wrote to memory of 828	2812	msedge.exe	123
PID 2812 wrote to memory of 828	2812	msedge.exe	123
PID 2812 wrote to memory of 5060	2812	msedge.exe	124
PID 2812 wrote to memory of 5060	2812	msedge.exe	124
PID 2812 wrote to memory of 1892	2812	msedge.exe	125
PID 2812 wrote to memory of 1892	2812	msedge.exe	125
PID 2812 wrote to memory of 1892	2812	msedge.exe	125
PID 2812 wrote to memory of 4508	2812	msedge.exe	126
PID 2812 wrote to memory of 4508	2812	msedge.exe	126
PID 2812 wrote to memory of 2300	2812	msedge.exe	127
PID 2812 wrote to memory of 2300	2812	msedge.exe	127
PID 2812 wrote to memory of 2300	2812	msedge.exe	127
PID 2812 wrote to memory of 868	2812	msedge.exe	128
PID 2812 wrote to memory of 4196	2812	msedge.exe	129
PID 4196 wrote to memory of 3976	4196	windowsdesktop-runtime-10.0.6-win-x86.exe	130
PID 4196 wrote to memory of 748	4196	windowsdesktop-runtime-10.0.6-win-x86.exe	131
PID 2056 wrote to memory of 4460	2056	windowsdesktop-runtime-10.0.6-win-x86.exe	134
PID 5164 wrote to memory of 5412	5164	msiexec.exe	136
PID 5164 wrote to memory of 5564	5164	msiexec.exe	137
PID 4460 wrote to memory of 5656	4460	windowsdesktop-runtime-10.0.6-win-x86.exe	138
PID 5164 wrote to memory of 5408	5164	msiexec.exe	139
PID 2812 wrote to memory of 5508	2812	msedge.exe	140
PID 2812 wrote to memory of 5520	2812	msedge.exe	141
PID 2812 wrote to memory of 5528	2812	msedge.exe	142
PID 4460 wrote to memory of 5668	4460	windowsdesktop-runtime-10.0.6-win-x86.exe	143
PID 5164 wrote to memory of 5816	5164	msiexec.exe	144
PID 5164 wrote to memory of 5960	5164	msiexec.exe	145
PID 5164 wrote to memory of 5380	5164	msiexec.exe	146
PID 5560 wrote to memory of 5992	5560	Velocity.exe	149
PID 5560 wrote to memory of 6072	5560	Velocity.exe	151

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\Velocity.zip
1⤵
PID:4320

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1064

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\Velocity\" -spe -an -ai#7zMap24929:74:7zEvent6647
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2444

C:\Users\Admin\Desktop\Velocity\Velocity.exe
"C:\Users\Admin\Desktop\Velocity\Velocity.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=x86&rid=win-x86&os=win10&apphost_version=10.0.0&gui=true
  2⤵
  - System Time Discovery
  - Suspicious use of WriteProcessMemory
  PID:3372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=x86&rid=win-x86&os=win10&apphost_version=10.0.0&gui=true
    3⤵
    - System Time Discovery
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x250,0x7ff949fcc188,0x7ff949fcc194,0x7ff949fcc1a0
      4⤵
      PID:2012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1824,i,2966194299204158564,5668807201321370638,524288 --field-trial-handle=2236,i,10460036014545567786,5050647522879568124,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:3
      4⤵
      Downloads MZ/PE file
      System Time Discovery
      PID:2252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,10409942791836935788,6857778483725177172,262144 --field-trial-handle=2236,i,10460036014545567786,5050647522879568124,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:2
      4⤵
      PID:2904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2608,i,7716611708270095384,6300095375726533744,524288 --field-trial-handle=2236,i,10460036014545567786,5050647522879568124,262144 --variations-seed-version --mojo-platform-channel-handle=2612 /prefetch:8
      4⤵
      PID:364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3532,i,5543549648081682081,9731173673318398845,2097152 --field-trial-handle=2236,i,10460036014545567786,5050647522879568124,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
      4⤵
      PID:1312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3552,i,6449624115466019750,3769064209287977361,2097152 --field-trial-handle=2236,i,10460036014545567786,5050647522879568124,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
      4⤵
      PID:4888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4312,i,812634408745052134,16449931231406970456,2097152 --field-trial-handle=2236,i,10460036014545567786,5050647522879568124,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:1
      4⤵
      PID:716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4368,i,10960489807679851743,16776384247564846533,2097152 --field-trial-handle=2236,i,10460036014545567786,5050647522879568124,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:2
      4⤵
      PID:2544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4332,i,5216557897513753553,15382677896208977902,524288 --field-trial-handle=2236,i,10460036014545567786,5050647522879568124,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:8
      4⤵
      PID:1116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,9702753538761353966,639647552499768373,524288 --field-trial-handle=2236,i,10460036014545567786,5050647522879568124,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:8
      4⤵
      PID:2528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5256,i,15299043843357458714,6944476313805998363,524288 --field-trial-handle=2236,i,10460036014545567786,5050647522879568124,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:8
      4⤵
      PID:1912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,11557145214253156256,11086327480221951578,524288 --field-trial-handle=2236,i,10460036014545567786,5050647522879568124,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
      4⤵
      PID:2432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,11557145214253156256,11086327480221951578,524288 --field-trial-handle=2236,i,10460036014545567786,5050647522879568124,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
      4⤵
      PID:4148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,14410476616485467894,13708423389064139113,524288 --field-trial-handle=2236,i,10460036014545567786,5050647522879568124,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:8
      4⤵
      PID:2436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6240,i,10234636810506340827,17453960928929747471,524288 --field-trial-handle=2236,i,10460036014545567786,5050647522879568124,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:8
      4⤵
      PID:4504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6256,i,10968085374153506141,11124655779739571078,524288 --field-trial-handle=2236,i,10460036014545567786,5050647522879568124,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:8
      4⤵
      PID:1116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6344,i,5250310581829685503,3841890441425014823,524288 --field-trial-handle=2236,i,10460036014545567786,5050647522879568124,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:8
      4⤵
      PID:828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6360,i,439995087500107267,16261418949941228269,524288 --field-trial-handle=2236,i,10460036014545567786,5050647522879568124,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:8
      4⤵
      PID:5060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5020,i,3863979335691659549,15441444526395657573,2097152 --field-trial-handle=2236,i,10460036014545567786,5050647522879568124,262144 --variations-seed-version --mojo-platform-channel-handle=6576 /prefetch:1
      4⤵
      PID:1892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,15764962544643759804,2296136134544433545,524288 --field-trial-handle=2236,i,10460036014545567786,5050647522879568124,262144 --variations-seed-version --mojo-platform-channel-handle=6540 /prefetch:8
      4⤵
      PID:4508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6448,i,2459755037496701554,16434874829471325778,2097152 --field-trial-handle=2236,i,10460036014545567786,5050647522879568124,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:1
      4⤵
      PID:2300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6868,i,11825496148540186484,6756102123474530552,524288 --field-trial-handle=2236,i,10460036014545567786,5050647522879568124,262144 --variations-seed-version --mojo-platform-channel-handle=6844 /prefetch:8
      4⤵
      PID:868
  - - C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.6-win-x86.exe
      "C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.6-win-x86.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4196
    - - C:\Windows\TEMP\{B2A4D9F1-38A4-410C-A413-E5F450A72910}\.ba\wixstdba.exe
        
        "C:\Windows\TEMP\{B2A4D9F1-38A4-410C-A413-E5F450A72910}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{A6B8998A-A476-4749-A10E-41A98AA77C7E} {4CB0D410-6FCA-4F07-ABA6-A4EBE6ECD203}
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        
        PID:3976
    - - C:\Windows\TEMP\{B2A4D9F1-38A4-410C-A413-E5F450A72910}\.be\windowsdesktop-runtime-10.0.6-win-x86.exe
        
        "C:\Windows\TEMP\{B2A4D9F1-38A4-410C-A413-E5F450A72910}\.be\windowsdesktop-runtime-10.0.6-win-x86.exe" -q -burn.elevated BurnPipe.{54D9A072-6929-4670-AEDC-6E5930B06AB0} {5B9E0287-50EA-4766-8C99-ED9B229629D8} 4196
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4820,i,14146578513851576419,10533036287480377816,524288 --field-trial-handle=2236,i,10460036014545567786,5050647522879568124,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:8
      4⤵
      PID:5508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4916,i,7629210533107053320,18217405445337377257,524288 --field-trial-handle=2236,i,10460036014545567786,5050647522879568124,262144 --variations-seed-version --mojo-platform-channel-handle=3780 /prefetch:8
      4⤵
      PID:5520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5984,i,16592414705080991191,196733085105611458,524288 --field-trial-handle=2236,i,10460036014545567786,5050647522879568124,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:8
      4⤵
      PID:5528

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:544

C:\ProgramData\Package Cache\{470716B6-F2D6-4BB5-A865-70471E521D9B}\windowsdesktop-runtime-10.0.6-win-x86.exe
"C:\ProgramData\Package Cache\{470716B6-F2D6-4BB5-A865-70471E521D9B}\windowsdesktop-runtime-10.0.6-win-x86.exe" /burn.runonce
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2056
- C:\ProgramData\Package Cache\{470716B6-F2D6-4BB5-A865-70471E521D9B}\windowsdesktop-runtime-10.0.6-win-x86.exe
  "C:\ProgramData\Package Cache\{470716B6-F2D6-4BB5-A865-70471E521D9B}\windowsdesktop-runtime-10.0.6-win-x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.6_(x86)_20260420160331.log"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4460
- - C:\Windows\TEMP\{65B0BB6E-B7C8-4B3D-AF28-8E4CF35A3CCE}\.ba\wixstdba.exe
    "C:\Windows\TEMP\{65B0BB6E-B7C8-4B3D-AF28-8E4CF35A3CCE}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{02E199A8-718E-49F2-8392-CC40AD579B86} {D42D1987-6B4A-45C8-8994-202C1A796811}
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:5656
- - C:\ProgramData\Package Cache\{470716B6-F2D6-4BB5-A865-70471E521D9B}\windowsdesktop-runtime-10.0.6-win-x86.exe
    "C:\ProgramData\Package Cache\{470716B6-F2D6-4BB5-A865-70471E521D9B}\windowsdesktop-runtime-10.0.6-win-x86.exe" -q -burn.elevated BurnPipe.{164530E6-BFD3-4EE1-9A8E-CA6F03F02450} {5F70E77C-B22C-45EA-A8B2-93C1D465446E} 4460
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:5668

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5164
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 88A5D8BE85708DAF57115D3B7523DD58
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5412
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 7991988B5CE3B8EF3FF64B5AB89357FE
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5564
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 2FE9525C1E725D1E4BCE94BFB2D07BA2
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5408
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 6AA737785A8FC86EF306C45B6E06B4A2
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5816
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding CCF17AC049FB2AE857A694C017B03867
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5960
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding A9C088F0769C45C59097A9773FBA6134
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5380

C:\Users\Admin\Desktop\Velocity\Velocity.exe
"C:\Users\Admin\Desktop\Velocity\Velocity.exe"
1⤵
- Downloads MZ/PE file
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5560
- C:\Users\Admin\Desktop\Velocity\Bin\Decompiler.exe
  "Bin\Decompiler.exe"
  2⤵
  - Executes dropped EXE
  PID:5992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.com/invite/velocityide
  2⤵
  PID:6072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://discord.com/invite/velocityide
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x284,0x7ff949fcc188,0x7ff949fcc194,0x7ff949fcc1a0
      4⤵
      PID:2304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1724,i,3685661218892447178,5662953063401353887,262144 --field-trial-handle=2264,i,8321404979265501415,17790725020253340643,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:2
      4⤵
      PID:3688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1944,i,10979777631329197351,14280644094597247342,524288 --field-trial-handle=2264,i,8321404979265501415,17790725020253340643,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:3
      4⤵
      System Time Discovery
      PID:5236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2572,i,6132921874280271343,12810368844092358995,524288 --field-trial-handle=2264,i,8321404979265501415,17790725020253340643,262144 --variations-seed-version --mojo-platform-channel-handle=2728 /prefetch:8
      4⤵
      PID:4180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,255485303617337480,8177233027421690795,2097152 --field-trial-handle=2264,i,8321404979265501415,17790725020253340643,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
      4⤵
      PID:3908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,17267160069267815970,15071168922880354516,2097152 --field-trial-handle=2264,i,8321404979265501415,17790725020253340643,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
      4⤵
      PID:972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4908,i,16559622636611831571,802896553766112659,2097152 --field-trial-handle=2264,i,8321404979265501415,17790725020253340643,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:1
      4⤵
      PID:3308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4736,i,14135311722082175941,14752440538424849658,524288 --field-trial-handle=2264,i,8321404979265501415,17790725020253340643,262144 --variations-seed-version --mojo-platform-channel-handle=3732 /prefetch:8
      4⤵
      PID:968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5036,i,1002738634075293035,1821942474479559336,524288 --field-trial-handle=2264,i,8321404979265501415,17790725020253340643,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:8
      4⤵
      Modifies registry class
      PID:4520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5800,i,37388507912531416,8645659837735467567,524288 --field-trial-handle=2264,i,8321404979265501415,17790725020253340643,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:8
      4⤵
      PID:1684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,8291644030094200167,12837841175390217897,524288 --field-trial-handle=2264,i,8321404979265501415,17790725020253340643,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:8
      4⤵
      PID:4204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,11908104903795369026,3609734718790478340,524288 --field-trial-handle=2264,i,8321404979265501415,17790725020253340643,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:8
      4⤵
      PID:1036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,11908104903795369026,3609734718790478340,524288 --field-trial-handle=2264,i,8321404979265501415,17790725020253340643,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:8
      4⤵
      PID:4676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6440,i,135083854236133909,12794420305095759593,2097152 --field-trial-handle=2264,i,8321404979265501415,17790725020253340643,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:1
      4⤵
      PID:748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6580,i,17266571772555219430,3619991737412183614,524288 --field-trial-handle=2264,i,8321404979265501415,17790725020253340643,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:8
      4⤵
      PID:6036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6576,i,14357498944376212777,14765977213450563097,524288 --field-trial-handle=2264,i,8321404979265501415,17790725020253340643,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:8
      4⤵
      PID:5276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6572,i,9510420154309599840,4532416250536538141,524288 --field-trial-handle=2264,i,8321404979265501415,17790725020253340643,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:8
      4⤵
      PID:1036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5688,i,1512401064546000237,16801845523200592002,524288 --field-trial-handle=2264,i,8321404979265501415,17790725020253340643,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:8
      4⤵
      PID:4984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6816,i,13604806960521487636,2256552639874017187,524288 --field-trial-handle=2264,i,8321404979265501415,17790725020253340643,262144 --variations-seed-version --mojo-platform-channel-handle=2128 /prefetch:8
      4⤵
      PID:5984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
      4⤵
      Checks processor information in registry
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      PID:32
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff949fcc188,0x7ff949fcc194,0x7ff949fcc1a0
        5⤵
        
        PID:4996
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2024,i,3604317772980122484,10252468206508859038,524288 --field-trial-handle=2244,i,1308625499042722855,6253938575721498907,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:3
        5⤵
        System Time Discovery
        
        PID:5540
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1876,i,7276978640843312050,824241910865079187,262144 --field-trial-handle=2244,i,1308625499042722855,6253938575721498907,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:2
        5⤵
        
        PID:1248
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2560,i,4857063914197422654,14883440113814196074,524288 --field-trial-handle=2244,i,1308625499042722855,6253938575721498907,262144 --variations-seed-version --mojo-platform-channel-handle=2748 /prefetch:8
        5⤵
        
        PID:3376
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4520,i,16380080694559270955,5938796388722729980,524288 --field-trial-handle=2244,i,1308625499042722855,6253938575721498907,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:8
        5⤵
        
        PID:2600
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4520,i,16380080694559270955,5938796388722729980,524288 --field-trial-handle=2244,i,1308625499042722855,6253938575721498907,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:8
        5⤵
        
        PID:5764

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4336

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2604

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3608

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e591af4.rbs

Path C:\Config.Msi\e591af4.rbs
Size 10KB
SHA256 54a0922401cabb6546781c4c9074fd606ef4109dbea487a715c2dc7cde37c86a
MD5 df8445f5f5c4ff62f577f5a8ab1d722d
SHA1 993e21a1786f7ef86860f5c6b90a5d7dfd09d1fe
SHA512 86828cd47c62ed3e6f2c926302cde11b7c449318ea3bbae0f2335dca9d8d5f349e594bee29f2414799db44218f768f6e75baaf351c282a35f493552762cb45b0
SSDEEP 192:yqvPD0O35mtU5yes3uWIdIuWwVEnzP1URuMpt:yqvPD0O3gttuXIuwE
TLSH
T10C222042A60083D3E5A61B70E7472B20BFA7CBE67350634B158CD524DF12BD85E7A8DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e591af9.rbs

Path C:\Config.Msi\e591af9.rbs
Size 8KB
SHA256 f31b2da55bd54519ddf420d0c290fda2fc0d5ad671a1ccaf0a4b910e12db08ee
MD5 3a33802ae32d1e24a067c7daa807fe6a
SHA1 3b552ec2b10c0bbe44b59d5ba0a20217f3b28888
SHA512 901505c88d866f5a09eac37c0504d6ca71017df6a5f9492f4b2bcae9b5f36bd1f97aa98caa012e25f5c094f4bc9f76ea50d4eba8a568575a847db3a26c24216c
SSDEEP 192:yyu1hU/ejTM3VWIkVWlB4us1zESWeNS5D8LJ2oMpyB0i1boXIuY:yylVeV8969
TLSH
T12F125041730197D2E9966F34C3432BE53BB6E3F99301571B098E92344F43B992F660AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e591afe.rbs

Path C:\Config.Msi\e591afe.rbs
Size 49KB
SHA256 c0b818a98c274066ba5eb062d7f7326cc21ec2f7544e84afa40579b41c07853f
MD5 844ded8507988e710b08d8f293c7c6e2
SHA1 740673f0bcce44f7f4f14ac84dcf647911001e23
SHA512 9fb140f67d77d2b296f39bcc9072793f530750cc93f9a9f6ff51a6af81945c9f9e5d42bc3110d62512553e091013001e578aecb0e6b22b7a61ad1eb1afd7fb4f
SSDEEP 384:UgLngUmGoLj8UuZ2YNQQ8j96aw3UEWG6/vdhJRCvYHEfiCmswr4iWASWnoWn92S+:UGngU4SZ2YNQPbnWASWoW9cZAMB
TLSH
T1E033FD16AB40C1E3F2613E7073B59E14B696CE52A78444AD51CAC18387EBEDC6FEC0D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e591b03.rbs

Path C:\Config.Msi\e591b03.rbs
Size 72KB
SHA256 623aef73eded5c206d526bc8816231e2c95882b1541cd98e6c5d1696a69d3c3d
MD5 3d9a520f8e14b56d8deed7eb0eef12f3
SHA1 3f6dcb1c7c32fa4b5cc7b7d6d38faa1292f51eac
SHA512 b04c91943d80c0257646c235835720be09c9f950efdbfc6832285c8bd64cff8b248b54098e98a5d9741d09e2d89eb19b765f7cd94a875b66103cdcd6fe7faf23
SSDEEP 1536:QTHTCatyEwHivLPHT6GKWmi2e2CaAw8Ggpy:0/IEJDT6GKWmi2e2CaAnbc
TLSH
T1FC73D0965720D0D1DD3139A12B7BED0CD9068DBB7386A51E04C828B6CEB35C67FBC5A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e591b07.rbs

Path C:\Config.Msi\e591b07.rbs
Size 3KB
SHA256 0202e92b87fa5f87c5915f0064711f0b012136f75008a8dfbac752fd16a82f97
MD5 6c2fc83c8743d143d7c1c3cc94e15596
SHA1 8528919a480d84997a0a7261c9460ca66d7dea67
SHA512 4eb421a8238003c9e24aa9455f23c14f29db52e3a62e89b7ac3d3cb614482c5b017da9a2c8d24a1dccf1c42facaad7b5c434b20f8df23cdc18ef371598aa3378
TLSH
T1257191039600D293ECA22F30DD270B5137BBDBEA9754438704CC91755E4BBD99FEA18A
MD5 SHA1 SHA512 TLSH

Submit Download

e591b0a.rbs

Path C:\Config.Msi\e591b0a.rbs
Size 3KB
SHA256 62afb171a97efda0b19e3c1a566615b104e620e606c24463faf61e381021859d
MD5 b7b90bed59b3e285aa1ef7efa3761ae7
SHA1 7e789faea66f822366a946034054dec2a491a560
SHA512 ae56b85e31c15f3fe11068848ecc6548a618f1b94fa4fbf6e2db143e1c6b39adbb36d02b70ab72ef2f2ed9eb52307e1bdf849e5fed6e6059d7a156fca7e9b6dd
TLSH
T16981DD039A04D283ECB22B30DE2B5715B77BCBEA9355934704CC91744E4B7859FEE68A
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE.txt

Path C:\Program Files (x86)\dotnet\LICENSE.txt
Size 9KB
SHA256 7f6839a61ce892b79c6549e2dc5a81fdbd240a0b260f8881216b45b7fda8b45d
MD5 31c5a77b3c57c8c2e82b9541b00bcd5a
SHA1 153d4bc14e3a2c1485006f1752e797ca8684d06d
SHA512 ad33e3c0c3b060ad44c5b1b712c991b2d7042f6a60dc691c014d977c922a7e3a783ba9bade1a34de853c271fde1fb75bc2c47869acd863a40be3a6c6d754c0a6
SSDEEP 192:ydP0KvBLCqikR/EgGJLrlwD+eilNi5Py1SDeoDXDw9lF5OMz6Q:PWBuqikR/EDJLriwlNi5KI1Tw9lF5OjQ
TLSH
T1EC12B57D7284177109D207E16A0AB9D6F62A953C3117AA2438FDC15923AAF2CC37F3E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ThirdPartyNotices.txt

Path C:\Program Files (x86)\dotnet\ThirdPartyNotices.txt
Size 77KB
SHA256 deb4427a295e1ed474b0d81c5a0d972c1b550b9a715cda939cdfa9236b1b418f
MD5 0d8867a25ba926e6e40cd52ab3536b5c
SHA1 89390dc8b8318d0bfef1c6a2fb4783537e28a465
SHA512 317ca335405274f4f91b173651ca2826760acb5ba5cf41aff51adc55c2cda9059fb268333665f13f62fa48119e55a303720a780dd58d28dd9967db4c88407d61
SSDEEP 1536:HA9jHwsGfgg39/zwgAVkguQxrDjugtSEGepkWvrpX7anuqdLSVnfiStPq+3LefrL:HA97w/ogz1AVxuMjHtSFULryLOgrGWm+
TLSH
T17773A45F7E45077319E2C3916569A8C5F22FA02E3B6B2A44346EF248133B42DD6FF858
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files (x86)\dotnet\dotnet.exe
Size 141KB
SHA256 ebb30876af2939ac49b97696d93ae7f2d3cb4ed280e78da7497331305de2fed4
MD5 914ff6207dc5343d29d67add9de9561d
SHA1 dd1c72f02f2efc6babc1b9d338d1f59457d34e95
SHA512 f82cbb88888e93d2aa41fa9c11be112ac1980b8f3db868121902a7f6ba944e1125853c7556a1c58f53bbcf8c12fc55fee71a158c582ffeba592d7766c02b6a1e
SSDEEP 3072:z078iKA/8gNs0xphwaNq92hxQO2lqVir04+:zumQphy9VlqMm
TLSH
T150E3F725F9858162D25D1970CB29CE91BA3BAC619BE1E0C763C0FDBE07701C1AAF5B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft Windows Desktop Runtime 10.0.6 (x86).swidtag

Path C:\Program Files (x86)\dotnet\swidtag\Microsoft Windows Desktop Runtime 10.0.6 (x86).swidtag
Size 488B
SHA256 978fdaf4e517e6c35db3824815067b7d7c99cb1372a6a0d45789448734af5450
MD5 66ef2fc4c56dcbe87ebb8651f1d6889e
SHA1 f49f5ec1a35d02e0487db80e5eca055eba2befc3
SHA512 07c3117f385cd939c288b47d997b07bab8a4255779789d7ddb91cc77b512f002dd5b35426c93f6aead798403b854a591b0657f6586991ba2716ede9e38b1b1ec
TLSH
T1A8F0D486F150B63241B32B64BB9DE001F35FBDC7CC8C6A84485DD81A01CB5B6037B540
MD5 SHA1 SHA512 TLSH

Submit Download

state.rsm

Path C:\ProgramData\Package Cache\{470716B6-F2D6-4BB5-A865-70471E521D9B}\state.rsm
Size 1KB
SHA256 678b67f1ac9c96e4a2ec780828c36a366c605f8e353c433c7dc72eb6307c1a26
MD5 39903af50366454148c8ced1269f2cf2
SHA1 95864bbf9e694d040574b63fac385d3cbc570fe0
SHA512 f6613e436b73abdc7c82c41f585e8da954188ddb1b7a10815b911620e84a0c9a69368a07b9c43c9e84e1f6062750b117867446c7e5638787ede065866d877bde
TLSH
T1C22181515BF6092CF3F2AB35A9F96725643BBC125D34C56E0001318A9E72BE1C874B33
MD5 SHA1 SHA512 TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 d4b1f4021efe562889686ca23b343186755c4a3e384d48334452f0e3d84d3486
MD5 ee955f2c936c31e263773fe62d6a83cb
SHA1 47d2c335e07918d44d3d5d60208bd2e8ea91b3c5
SHA512 84d608e59364d37b614631245b5e20358df5bf985a2531a22dba8df4c53ad17ffd7989293c5a9242cbf1c9b5a7688cdb2e89f37edb3cf63a74a244c94c6da653
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7S:fwUQC5VwBIiElEd2K57P7S
TLSH
T154B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ed052e6aa62eb9cbc467b4593bb8dd26ccfc976d1fccb389ef957c030a5b18c7
MD5 f96064542fc5ec4c0549d4377c4f3483
SHA1 05ceecc956da598f16c67c99a5db1f2a0ace7c88
SHA512 77a0caf92414a29f73d2a41c29c2aa3610a2cc53457b42d6ba12448b1d4b87ee1c0ef866c4c78d5ceaf038f427597ad7e7831074462a20b6f08246f1836a7b52
TLSH
T16DD0A734B69AA402D2290037056192661B5AC995299644C0F02D850CFAA82A997DB1D2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a0685058bafaf899d74768c8bb6606d1ebf82d5ff3ded767e1a58ec12991d967
MD5 9d43960eaf8a506c2317c471d8da36f7
SHA1 9fae080221a6caa5b135c1795cd56d4d26ac3943
SHA512 ff68283f5814885b2e4029fcfbd48b1add91d66a6289e92e875fdcb8402df995e9ac6860fce176be0ac4d6139f5fde94dec5701fbb031054c6db6cd97a56e18c
TLSH
T162D0A738B61D6401DA55553354D0E2611F4E88985B7501C2A47C851DFF986E497DF2D3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cdb622d21a77ee775f123259b6cbc14e5f233b0812f9acb81a4cc7dbcfc42255
MD5 0e92578944ab2cca59ebf0c0420cbd1d
SHA1 102a4d1aaf8415f3be53f8042895692a911272be
SHA512 3da019d448c9dd08610b35fc2f61cdee6e39c77dc06093d1e4ff99d8d3e577e76f2fbef392396ed1f130e4ca3d7178584a67829ef25e1e133ec8251b7b7c24ca
TLSH
T185D0A738B61DA401DA55553394E0E2612F4E889C5B7501C2A47C851DEF986E497DF2D3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2d812d63b94e52acac0ff3d23d196b3c185f5ddb1e01deeb75aec3c1bafd468e
MD5 6152b0c1f75d5d080bcd3802185a9245
SHA1 4f64d728e6f0df535705d56e0e7a69fc1e71917c
SHA512 28c794bb2d2495521df039966b1a9e94a2843c311371b43db2ea79c54226693c48e9527fea13c5656d1ef3768cdbacfe060b82385bc27c6d4a2715b8b656c7da
TLSH
T1C3D0C00C73722C30C4C9CC300858730F2D19C8F28E42436254371A385DC20C045C71D3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e8b794ddae1c182cd5bdf3280502fc20e0d1bbb83fa98695dd9554e580b515db
MD5 e2acf35f85cc51742b6dbfd089a22de7
SHA1 d2f831a4d2d2a72bc82294e0db4496d425f3c241
SHA512 dc7c313b6984de31fba866906b65c34a375452af96f5f8d900080a50233e15566612618b446d95b3283af79511b9492a004b9a8f220a70ac98cbe8ba536fdac4
TLSH
T1A8D0C00CB3322C30C0C9CC300859730F2D19C8F28E42036154371A386DC108045C71D3
MD5 SHA1 SHA512 TLSH

Submit Download

31ae39f1-3960-45c8-918d-e5a6a0c0a50a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\31ae39f1-3960-45c8-918d-e5a6a0c0a50a.tmp
Size 414B
SHA256 8768020f6ea15f5cdfa564ff88badf18e8a0c273d81e30aa4dcbacec829b400a
MD5 8ebda270eddd75535b5fdf73c93231b0
SHA1 77ef7e137b551c3256769c6e6c776cf6642c7f2b
SHA512 2d341f2d4512042aa479229fd2220b7f7b38d98087f9ae65fe1033e5f7cec942718a941dee71737b4ec7938e79e467f845ac0eb9b12d448ba9324d7285618187
TLSH
T1E8E02BAADC15DC2718FD075960640746FB44335B2B81595F3B3D850D8FB063681C595C
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00009e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009e
Size 38KB
SHA256 13da02ce62b1a388a7c8d6f3bd286fe774ee2b91ac63d281523e80b2a8a063bc
MD5 ff5eccde83f118cea0224ebbb9dc3179
SHA1 0ad305614c46bdb6b7bb3445c2430e12aecee879
SHA512 03dc88f429dd72d9433605c7c0f5659ad8d72f222da0bb6bf03b46f4a509b17ec2181af5db180c2f6d11c02f39a871c651be82e28fb5859037e1bbf6a7a20f6b
SSDEEP 768:w35mZVsqT7RAo+6tbgLdolT9YSswcTWa+O/dm8ae41u37qt+:1xTO3kb0dolT998WhO/Hae4jt+
TLSH
T11B030292A14018CA6EAE219576CCC7A7F4745D89DA081DD619CD01F0FCB326BBB51A3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 e5b7a93ec675f2d1036c4943ec9f142e630589292f750dc93e13c14813b6714a
MD5 1bf3606845070ac733d5976512a61ac6
SHA1 8485437e50eb86460140b7669be21dd841c2df15
SHA512 a24379189d479afdc1325142122e5634d7f8d723ef227ca43b2f735d2b34a371766355d5ad45fe92c9aeb441d61570f4c77ba6d0205c1fcdf6e2b976568a6e98
TLSH
T11A614C895DA5C7D9E3E4417245EB344EB2F2F7D8E3861ED53AF147BD8A25F0282E2410
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 68b2b1aaff585f5f99ee88745fb754e221e0f06a783efe4bd1f1fead09882d82
MD5 fea6bc3cd4b61fa2b5ca4d99d957f979
SHA1 dfd62e226b23fe02a3d06fe693a9b53edba20df5
SHA512 dfe7a1a0d1c844f0924cf538553da9fe4a94eb0d4bc6c097e0afe36a3d6eb996e0d62a6e6b0513767a390215a8049b5d39d9e8620b347c2334af24c4e1240181
TLSH
T123717F868C95C7E9E3E4417246EB740DB1F2F3E8E3462ED53AF1437C9A61F1242E5420
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 803a70b339c4409b2c2c18d36fc3bd9e571e8294c26cb24f1609f2a9887f8f4b
MD5 560e0ed47e6352dce1951efc2aceef07
SHA1 4ac05fbbed05626518ddf595db3c18eb657e71b5
SHA512 be58c9838b862cca2f462b950eddb73e908b856a6e6af891c6278a5d56e7ea2e09296f4c8ceb3165fe067324b73c8bb72958e807be13eec2743c1d0b4dc59d78
SSDEEP 96:aBuZ49fquc1tPKP3E2L+QtX884ssCNOYTEUdQU2pirS+Y+snn420L:EuZ49NgmV+QlNOV+irjnQL
TLSH
T121F1F5466849C696EBE4123104FB385972B9B3B8EF161E9230F0D77CC462F6F81E6875
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 daf7c6010d6ea7e7c64d8c31a93c67758ca210f0c9ef1e22fc258274544ca360
MD5 4038fee88a6dbab17ae86ec1ec3d5792
SHA1 7684816762ebe30eb548ef8c40e08679505e5760
SHA512 bb34be43c8d09aade285bc135a0e6327e3e027667bac01d31587ddcfa79143f275848d1105ad074342128a8931a901aedf4509f6c26d230610fee7bcdb19564a
SSDEEP 3:MsEllllkEthXllkl2zEklcGeLKt:/M/xT02zn
TLSH
T10244040C7FC44C05D50051304457C3540370DC134D11775334D10C535CCD5450D00111
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4bfd6f95-ba5a-45ac-812f-7b3836ee2487.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\4bfd6f95-ba5a-45ac-812f-7b3836ee2487.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 e1b90eec12c05fa1c157d6bbccf7873d63b8ed9ba804f1e75deb58ecea39271f
MD5 09a477c057c03d946cb3733f291f7d69
SHA1 6347a9123d2795269a49de9af4a683ca7ad824c3
SHA512 7b24d8b4e405993f663e4dcad774161bad0d0f3b050ac017ebd098d96794e395647993c6cd454d204f3c3291f9dca4040748ca3af8a4c41c87743e84c8486933
SSDEEP 192:D8Clpd4kujriaj62ie5bKfdlG301NdH82l3yzirmrurYx:D8Clpd4kujriaG2ie5bKfdA301NdH82s
TLSH
T1E6D1CBF787E9822DD91156F0AA186E1FCE2D0914431C3C2EC9D5AE4B97E34B1F181A5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 b7e5a6ca0bb29dee42ccdd389f3bb36b39bfd8dd9e685076f45265d251f4af12
MD5 7e2ce296b0cd862830ee453ae4ec2b23
SHA1 63df425dbca93d64df867bcecec7ae0c4c1bf690
SHA512 a70d877abc9d4d1c9a645dcd0bbd97840000d09385f3f3f84cecc35f07575acdca211664a389771b1063f450365873a19630468b48a3575642bb6d07fdd2d455
SSDEEP 96:D5OCucpuAuVuPulazPiaj62iGBPBbKfLBlwd3ABP0Bue6PNuiu6BwquC3uWukuFi:D8Clpd4kFriaj62ie5bKfdlG30Ir6PN7
TLSH
T185C1BCF787E4862ED91156F06A186E1FCE2D0915431C3C2DC9D4AE4B97E34B2F182A5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 102daaa759270a459c5f6b83b329c759a610a963b1acf618c9c1874c86102328
MD5 55befe5a57fb4d4320cdd3addc08d150
SHA1 bb90d5ea75cd92a45f32a6c26dd72e7513558ffb
SHA512 a9ce12bd9e3dd1be3b80ff383aec58aaf14c7749ededbf8af12b13d0c9a8c4b148ee4e3b885ea4761efb9a6e7643f9a2b1ac87cbe02914a5b5bac928e804815b
TLSH
T12B519EF783E4856ECA1196F0AA18AF2FDF2D0615431C3C6989E4EE17D3E3471E00165B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 2KB
SHA256 3cd89c145ec9084db6abdd626d1d37c9c378ac9520de6266d8f95e31fafbc52a
MD5 272625d84b3327995431c0abf3483d18
SHA1 4162cbeef286cbd8811b5d3ab053adfbfb213ebf
SHA512 653d113c0c6c22167e0c39ea58faf852fbf0a4919bbc0c18996ff1c3934e2001ac77377c4ff174dd9eac3d318972e795b45169c7afc5016014de96a5a9010930
TLSH
T158417B63C77FA95B207C4DA72D2D7D097DBEA83202D254F8DEAA853C70915B71B12027
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 dc63cb8376a958f56162e6193d20c9558275f65cc1bee5b83d62d9c2d0cb91ae
MD5 835d64f2bc61e3c1f77e5bf4ac94c2d4
SHA1 0f1894c97a724955f5e1eb02f09fc990e6558262
SHA512 81475dbb63b7e53a8a8be848bfbcf2eb7698227d09a9e43fc4bf789cecf81a377b28f46b92b7b2639231f5b67499efc55dd29580939e4b02d5fa579208cc2036
SSDEEP 192:sxZZRCyM//K1Ml8Mzb/ftsFcP4oftknC0IdpwhaHW6+WNrhcls/AhZox5hSEpPIf:sxZZcLb/ftsFs4o1VtRHbb/jc
TLSH
T15352D916AA349A77CCDBD209F945BB53D6F5056292940E489EFCCA0C04E7BED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 c366a4956219b717fd75d033851522ae78fab88137ecf8eed4ddbca8ffb033ff
MD5 dc6d39060b92daedacde99afc7c6eac0
SHA1 b32140e2d5134af04ed82cc6511624ba689957c8
SHA512 05569d5fb3ab9242dfe7fb8d25296dd34cfa4ae366d8cfa2a2ddde3bf82219f4855f97ecb1bc21c8f3ef03ae462f77eceff735d4ef29c8f321a039d96f0af18e
SSDEEP 192:sxZZRCyM//K1Ml8d6mb/fts4LlWpVjP4EBftknS0IdpwhaHW6+WNbFhq6hcls/AU:sxZZcob/ftsYlWvz4s1RtRHbb+e/ycZ
TLSH
T1A162C816AA345977CCDBD219F945BF63D6F9146292900E489EFCCA0C05E7BED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 3c89d7e156ba1430d4edeb19a9ef6b1f7ae1a4d0ae8a1aafeca9abf5e0376f0b
MD5 c1ef1c737d3cc85fc445b56dd2fc5614
SHA1 e39722825e41d0d2174b3f21e0395d5447824ac2
SHA512 cee0bede80c4aa9efa5e9af821a601bb47c1cf107a1353eecfea1ece7dac85b80146d791fbb85ef23584e925bb2f461434ef205d49491ed32b1f1dd38ae727e1
SSDEEP 384:sxZZxTb/ftsMWvtsY6RtHnHbb+kw/AFcMn:shVb/ftYtsZHbb+LAqM
TLSH
T1DE82E956B53459778DDBD21DF915BB63D2F5146292900E88AEFCCA0C04EBBED2213C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 159d3a224a37dd779c10148c40755a257ead16a23187dabe2ff14a8809ef81d7
MD5 1ecc6d77dddcdf292aac6f3a975ef3bb
SHA1 491184d397e8d1ac62116dc40659d9f9339fa883
SHA512 e7838c204d2cf0c53184f4856732eab45b9aff3c6172d6c94a26bc258898545fc7d30cc7e7ee875b96d4f333dd8e7a5ef72cb47e3fd6924cf7c32a3f24264924
SSDEEP 384:sxZZxp1b/ftsMWvtsY6RtHnHbGM+kw/Ac8cMn:shT1b/ftYtsZHbGM+LAcPM
TLSH
T1CC82E957A53459778DDBD21DF905BB63D2F9146292904E48AEFCCA0C04EBBED2213C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 d5f9b07124318cd10e76935970495a80ab5c1227cd905a21936b7c0c6fdd317c
MD5 5790c3e8aad8ef577bc83da52667d98d
SHA1 4d57958134d81c0536f1ada62dc059a55522ebdd
SHA512 3803f03cfb7a7b77e04b9ab0b1d4531e759e6792123ef1200f95eeed67c04c432b81c3b9bd64699f8bf49e467fa002b7a87e37707b6076951f325a1956341443
SSDEEP 384:sxZZxob/ftsMWvts16RtHgHbb+dK/ewcZ:shOb/ftYtsdHbb+CeTZ
TLSH
T15872E916B634597BCDDBD209F945BB53D6F9046392900E48AEFCCA0C05E7BED221382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 9643e0a79652a39c5370c6dcfe6a71c5a0bb155f4f4b18c2d55a51cfd90eb474
MD5 cd6e1295d4c0f033df8d3993691ac434
SHA1 bb9d05eafcc78490bd15a2ca7d9215fca62f8a5e
SHA512 b1c6242fd4f7f6d461a799d803229b974f65aa5064ffb4ca493e2bb010d4cedc6a7ffc8042bd910983a544fe77d23a1c58ae51d216e734e7e903269ca4324109
SSDEEP 192:sxZZRCyM//K1Ml8Mmb/fts4LcP4oftknC0IdpwhaHW6+WNrhcls/AhZox5hsEpPk:sxZZcub/ftsYs4o1VtRHbb/ZSD
TLSH
T1C352DA16AA345A77CCDBD219F945BB53D6F9056292940E489EFCCA0C04E7BED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 21e3bfd97012c5fbb6bb5d572cf45d0220b18ffc09726ed6afed5a9f7b83e231
MD5 a42ce70a1469d364d749d55bee560ba8
SHA1 af6fa19929d0f80faf82f70f988a9ba362db223a
SHA512 a4a3ae442ed91554ce96ff09cbc911e3fa2e58d5684be1f9fd6709088b24cf526adb480f0f970aa255bd24499c2ab036fba1eca877e7716096dcdd4039c091fc
SSDEEP 768:oKsalRV7pLuLnNVWvNT6D8F1+UoAYDCx9Tuqh0VfUC9xbog/OVJrwoLl6QF5HroS:oKsalRjEnNVWvNT6Du1jaIrwoLIs5UfK
TLSH
T1B1F2FA7B6C0CCB7E4F804E9CDC2A7E8B6DE801CB96D8899447EA844C03C66EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 009cb7a5dde8dc122e571df5844d189529f474db5ff37db06031f5794a0dc601
MD5 50208df5f6abe8fe091b585183e61a41
SHA1 8dfd58ebfe798e8529a6c862fcaabe78c7e42480
SHA512 cee80006417e8352e55b87bdb8d4fd3e59c1012477bfdeaa6e7ce85c4fb6d5e0c4fc176688e72ecd75bb3e1ef2fb985a422a4ab515309fe7d70017c58fa396c6
SSDEEP 768:o2AalRV7pLuLnDVWvNTAD8F1+UoAYDCx9Tuqh0VfUC9xbog/OVJrioLl6QFDHrok:o2AalRjEnDVWvNTADu1jaIrioLIsDULo
TLSH
T164F2FA3B780CCB7E4F804E9CDC2A6E9F2DE802CB9698C99447FA445C02C66EF55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\08a6befd-dbd1-4c1d-968e-05d192d75d17\index-dir\the-real-index
Size 48B
SHA256 2f8e847afa6027c402bc9223af55cc7a860fa3e46fc1a6c97264e5a56e7e1e5d
MD5 0eb28b58e06e2ecafbb61d276da6aae4
SHA1 629001646e9ab1a4b5344b7d31e4405f7c54f2cd
SHA512 1c44c13dc7fa5dae681ec57d6f1acfa010caae3b9ca56c6f240d13b629aba44dc6ed80087c20098a47d28620767c849d6e14d1657efed2ad9dd752e58123c05b
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\08a6befd-dbd1-4c1d-968e-05d192d75d17\index-dir\the-real-index
Size 72B
SHA256 6499c53df1897fc441db410cd1cdeae4c753db9d12f52a73e5762f843976a637
MD5 c298610b7513e1dcc525ad64b0aa6531
SHA1 b98fd4e6227acaa95ca881d91b4abbe2675c8072
SHA512 e1bbedfbc61cd994d1f215ae31eeea7db5054b54b79e0caf650af639ed65a4ccdc2c1c768dd6c294c7d646633e2e9120c6fc4f15d73e0bc8bd889a0a5d79934a
TLSH
T105A0026491414299C1141971143781942680AA754054065251E04049EC502894623400
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 233B
SHA256 45cd9ffe5b0dea4386ad0f3c6f29f5d56e3d7b7bc7e2ee4286fdb1ef1cf5c45d
MD5 8c84fcf9740dedabd1d9a134e8f62ddf
SHA1 d5aba50b2a0bebd43b714874ea4f4146034a4d5c
SHA512 4c3644fc11de492cc0be0346c1f7ff019531df4730447fbcd83d64c4ba8a767add807a496649f7f10fb6a2277109e3af153ac40720108f9fceeddab4f0efb920
TLSH
T191D0972BE0B400C1D7320B816A2207974BB82C8824858088C40B241C1031B63F326EA2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 227B
SHA256 106474d492e83ae3f199151ad8a4de825f439023d9d555f35ad8b4d9de154969
MD5 f54ea71ad5d464a42b2fccb8e3ee83be
SHA1 8a6ed80a47be0f1076ef3229c84748a23824c8e4
SHA512 29a6368d3a951d28c0648d7fd71d27952cd78f75eb709ff596eb3e33a1c441af881d2ec7ff21cadd253612058dd7d38cbb336ae91425e0011ab753e63708c2dc
TLSH
T104D0972BE1A802C2DB724B80192207A74B64388C20D98098D40A01088041B33E213FA2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 226B
SHA256 612055d79ad5be41a97250acfe85e11599f34263f6598d36abfb02e378d44622
MD5 046a075a660f3e45096d3cc8e3c777e1
SHA1 fc319906b2aab8a51fd909e76798352ffd2c51f8
SHA512 b2c90c7ea92fdbdfb90f52d434f0a79f0049fd61cf08fa6b97e3c73aea598091bb7d05049cc849b86f4bfc6db44c473e1253dfafac3eec4ef65310c6d9891390
TLSH
T13DD0972BE1A802C2D7764B802A2207A74B68388820998098940A00188401B33F212EA2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe59f34f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe59f34f.TMP
Size 138B
SHA256 5dfb9b4c48dcbfb78eef2ea53ead99a513e7c10aa21b6d539d4f72dbad957eaf
MD5 be1fcab7ad73f5871136fedd52808999
SHA1 411649be11ccae7dd370183327d460a029ac9921
SHA512 fd966ba9b9a0cb57b7f01e02c80576700f24fead7d573681f7f8066ae678cf5a5631af5fb69d3c0e7f6d1b16e7ceb7ec74da5b1a47966e06d01deebd168a61ae
TLSH
T105C08C67A2A005418B20078082320A884B282C8C198AC088600734182034F33B205EE2
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 d5df2decfd5e716a9bbe8b50c0c2b004c1a4d53cf741aefc47f78bfcacf1089b
MD5 0e671a94fbba6c349cbeeadb422988c3
SHA1 b262a0e50166a0d9b5f73bafebff2efa4400b748
SHA512 227051b8e1c3176ab166c0797fa0fdeb62f89cc073a0cf5c963fc463c5031fe4ad3683c79dc18c6ada9020b6e1d7e9500d46a255303bf2b0ad4a33f025e743eb
SSDEEP 96:KoleKm8MIgKdSa68AKdO20wKpCiSkAKdWo:EynTS/LX
TLSH
T1C9D11015313B46517BBD3A8E9994B42E17C130A37559B82B7BF900A20F2BE11DDFC8E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5ad775.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5ad775.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 98b22268810a340c9bdd378e5aadaca706e02ebd4dc43b4861704fbb4fe5f0fe
MD5 04c780554fbaff5f3ccc62fc0ce37969
SHA1 d578f944081e82ed0bf90731271bc1360bcc8dc3
SHA512 c80b9b02162836d66253b8b96c9e57dca78643e7980ad502b321ccc17dc753685cea2c4aedfa85defede8d738f471df35a2f5a5c7b3aa92d1362dd66b1419f64
SSDEEP 192:gONt6QaQmiUy3vwZ/uOQL5RONxRxMvFTU6:gONt6vGwZ/uOCoodTU6
TLSH
T1B702E835A9782C7B8AF2AE09F4872B235FE4106BE9522F84DAD81F1D01D769C1346836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 5942e42055f4bac97bd18b00ebd4c8ee386b39c007932c78749586a039e0ac4a
MD5 5a597f2b294cd54484c39b3eb93c4cb2
SHA1 ca32d6a090d0c24b1beacc3141b13e2fdce38bfb
SHA512 0402d477a311854bec9ffe1919fa2174c8283f97c66d28b3ffbe0ffdfada57ac915510ca4a6afeedf9a026e23501cd1debbd1676fa802885626e44fe776883c2
SSDEEP 384:npjccCs+Bt0S3vsNt7LwWGE/uOCIawT0XU/AatId6/lZrBf3G:pccQPyx2Oj/T0XabW6X5G
TLSH
T1C4826B3269B44C3B59F2A154F5473A075EB440BBA7853FA8E9DD4F0D01EFAEC030A926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 34270ddbf899b8fe761aae68611353f6c6c0beac68d5103443c2b7edf4a79216
MD5 51f47202e04fc0d6606922c95d80c011
SHA1 b8c3e1e93bcf3f60177d71de80bf2e85fce2aca3
SHA512 de0c7f151cfa510cceffe56e65f2c086a7a31845cd3356ac855345c978c1b7e02930e1d2aa8926bc46c28ac95671760d979484a125f1acf23eaf99b7c181d42d
SSDEEP 384:nyiFejccCs+Bt0S3/IsNV8TUNTUlIlaL3GG0DfQP/uOCIauEjaXU/AatId6/lZrv:5FIccQwOwgLoP2Oj5EjaXabW6XH7
TLSH
T142D2A4F598D78936D9AE4387A33E2E425EBCC0A3B5845994FBC84E0DCC865BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 3e2a4da6a86dedb87bb9c0b7598fa6e8e14e816ca023dc27171559458748a70a
MD5 08f2cc0e9217ed1dc1ffafbd76389b7c
SHA1 0e34548fb2148539692ae2d9f2b248fc70ecb96e
SHA512 1c66aaa3536eaea0ebcca0acb5550e41f6b870a7d83a2b96f40211b1733d2ff77c4f3c41d7df55a26aa87847c0ed4ba5a3b481dcba9c5daa836f3f9c334cf523
SSDEEP 768:5FVccQB3Owg7joP2Oj7Ac1c+SYiKszlXabW6XH7:dccQB3FuSiKszlyW6H7
TLSH
T16CF26EF194D28DB6D89D83C7632DAD0269BCC173B5485598B7E82D2DEC8B4BFC306851
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 fec2b84a99018864619d62ecc411904d5e3488bcc6cc48e8d2dd3f595b2967a3
MD5 6ba5b098977628ad3673665e8a4ff611
SHA1 f7e940b087e24e6a108ddb984af9c3ffb9b10662
SHA512 5fd0f26dbdae4c5f22292dd482693361ec653717ed00d4a6d50a293597b8099a8423d22ec25ab6bbedf83c34abb58330d62ef5c3d5e84eb1bf5213828654179a
SSDEEP 384:nujccCs+Bt0S3ksNLaL3eGE/uOCIaVxjaXU/AatId6/lZrBwj/7Ig2f37:YccQEEx2OjuxjaXabW6XH7
TLSH
T123926C7568749C775DE2E118F2463B436EF410BBDA812F58E9DC8F0E10976ED230B526
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7b8c5b81031b52f4b1ec022f0cd9a4a7c918730e2f86516eb0eb48623da60a5f
MD5 1bf6b7ef353e64cf6a4260da61a34d0d
SHA1 49d740f04dfced7d71df426dc1c60c15bc9af463
SHA512 7c85712c1c3ca803b16aea27e011153f6a83d5062a3b86780549983d6bc787b86e2676d3a7f59ad78a2220406424da4a8ce06ee9201b71828c95a55786805675
SSDEEP 192:OONI6QtQmiUy1vSZ/uOQL5RONVaJRtnXq3U6:OONI6isSZ/uOCIaJX0U6
TLSH
T1E8122A36A8785C3B5DE2A554F44737039EE4406BEA8A7FC4D6DC1F0C01EFA9C130A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 4cee258650fee572eca365f83f697b1e00e2974c3de53c261c78e2d51998a283
MD5 fd8dcfd6bc600a8028529ff28e65c5f2
SHA1 d03c17ca1716ece590d151e60217b8a371038280
SHA512 e00e7224dd0920e3b7c3c9a8255ab27ca0b778c9ea546f6ffb2b20c45d65b21685f060ee96e71c105aec2e8644e55ee32f62ad4981a0d3af698c9dade93aed7e
SSDEEP 384:n7jccCs+Bt0S3ksNtfLFWGE/uOCIawT0XU/AatId6/lZrBf3G:XccQEJx2Oj/T0XabW6X5G
TLSH
T17C826C3269B45C3B59F3A154F54737075EB480BBA7852FA8E9DD4F0D01EBAEC030A926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 8bf1227a740cf538dbe20bab646556a48fb7ade6d2bf8d194fbc907565443bf0
MD5 7f7f643538b1ac90effa3ce525abd56d
SHA1 6142380701272f99a0a61a7f2dd9ee730e05e596
SHA512 f3acd9df96a4013ebcef87afccad862f44be8c70f98d36c3c9e0aa0dee8331d3c10634e0d796a8417b3f897856871b8cfb15308c543bd04684f2f408cb913d23
SSDEEP 384:nAjccCs+Bt0S3ksNYSLsjGE/uOCIaiTF6vKASBva/sD5R4e0WXXU/AatId6/lZrg:eccQElx2OjJT6tSND5R4e0WXXabW6X5G
TLSH
T117B26CB1E4A55CF745A2E0C86683F6036DB410778A485E1CEAF8BB3D309FAFC1316964
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

57c97dea-66a7-40ce-8d3d-c4b93043bc25.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\57c97dea-66a7-40ce-8d3d-c4b93043bc25.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 27840f616ab622d89e07f1d3c39dc2197436334b7310d6bae3b5b157f863d757
MD5 1a2904ab2caf71cdc453375693771b1c
SHA1 7c157ea173eb07ad3b47914852da1dc00721ef85
SHA512 67502008fb9cd752b71621b776e555d3ddb1a240fc3dd3f80a83e7e6dcf3817f056c027cfaa3344234d630d12a779c7ec1506ac70ca9a4c4547c44ca9e32dafe
TLSH
T17041F65CAAE91148B3B77F56ABFAA86D447FB9372E0BC49E00110D4F0A63B01D861737
MD5 SHA1 SHA512 TLSH

Submit Download

57b4bce1-9469-4960-91b7-43a395682e60.tmp

Path C:\Users\Admin\AppData\Local\Temp\57b4bce1-9469-4960-91b7-43a395682e60.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.6_(x86)_20260420160331_000_DotNetHost.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.6_(x86)_20260420160331_000_DotNetHost.log
Size 3KB
SHA256 9341c39a6b210645847defd20cdadb9689106e8ffa6f19985b19f4b0c91459aa
MD5 74aa69877768207199a8b69cfd2666a2
SHA1 479e388226b43a4d9551639631e12e98ed45f613
SHA512 1ed56458ff7e8a4f20be9c37af5c73bd64998ef5fb87a1325ddd3b5d0b169df6c461c7c0efbbdbdfed7a8069129204fb13a4a6607c956a182af370bf868b7501
TLSH
T1A5812B581AE50E15B2B357475EF3C413AA33FCD7B834CF4D23868319466A904A868FBE
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.6_(x86)_20260420160331_001_DotNetHostFxr.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.6_(x86)_20260420160331_001_DotNetHostFxr.log
Size 2KB
SHA256 e402e4fd8c8c5e26df6908cbb8139c0c40a9df01fc9342185f80c9aee568c7f2
MD5 50ee997fe524dc44557407d583367e62
SHA1 fca9ec04e593e6a71f1fcfde0bd1a369b98e0f0e
SHA512 09976ab0223e50fb836f8f9f72402ebf1e5ccdb8ad79cfd710ba0fc46afed160d001810bf9ce6b75e26257b6c6d31952627b46ce4866fd4ca3cbb432912397ac
TLSH
T17341F6682EE50904B6B7574BDAF3C1566A33FCD7B834CF4C23858319066BD016868BBA
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.6_(x86)_20260420160331_002_DotNetRuntime.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.6_(x86)_20260420160331_002_DotNetRuntime.log
Size 2KB
SHA256 d9222ec4b69173268c289c95933d679e189a1ec461146bfd7630600dcf085d85
MD5 0681a64e4101d776020832facb1cf1fb
SHA1 80db61739e33e2271704b53770176fc77242988d
SHA512 550cc26b36fa59318bc28437ec9904a11cc9f5fddfc7f0587697f0787c75025ed6b4c8c81e8d99060b5def3dcfcbf4fd69bf12179fe3f4006c5a472218b771fb
TLSH
T1E04105941BF40905F6B257879EF3D4532E73FDE6A830CF4C1285831A066BD0099A9BBA
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.6_(x86)_20260420160331_003_WindowsDesktopRuntime.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.6_(x86)_20260420160331_003_WindowsDesktopRuntime.log
Size 2KB
SHA256 920e1f23e4fd6d01f466e6d50e2c26b8943078f5cc70127b2ac2b97fb9c71ebe
MD5 1e1f83fbc1d0b2f424f4933f5ea91d9d
SHA1 083dc21078fa09d8608b4b7e52ebcd6343da6863
SHA512 4f4cd9c23e19bfcd2ef197793a76b0d3e18b22fc6e6ed31774687b995e5a3684364952278f1a57629f36f08744db399af168039be7645afe1b2818b7adca8d60
TLSH
T1234148A81BE80D06B1B757579EF3C0526B33FCD6B830CF4D23858219466B90198A8B7A
MD5 SHA1 SHA512 TLSH

Submit Download

f4d420ab-22c2-4bde-81ab-291c467c02d5.tmp

Path C:\Users\Admin\AppData\Local\Temp\f4d420ab-22c2-4bde-81ab-291c467c02d5.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

4892157a-8535-47c9-b6a5-514ad8afa729.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2812_1625876564\4892157a-8535-47c9-b6a5-514ad8afa729.tmp
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2812_700342607\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetHost

Path C:\Users\Admin\AppData\Local\Temp\{B2A4D9F1-38A4-410C-A413-E5F450A72910}\DotNetHost
Size 900KB
SHA256 1af87df38637ee46d6a7d36ecc69ea4542f2fd36d61d47ee44b2c9b6f531a206
MD5 61f14c323cd62ba85671e29183b7e4df
SHA1 46149954d59ca8938beafbb4f3b2ab925e7611a2
SHA512 3e9d21307344523afa7feaebe9de28b348f3be208809cb8511a3991750052b26994be2967daf27f389218c75c503a2c2981b534fead222ae71ed8650afc6358e
SSDEEP 24576:ccnTiadGdKkg78We96FDxTYwsvq8GPu5:ccTi8GExDdYwsvpGPQ
TLSH
T198157C23BC41A036D9EA0D72A438CB616E3D7D14179488DB9390B94DFCF06D26FB26D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetHostFxr

Path C:\Users\Admin\AppData\Local\Temp\{B2A4D9F1-38A4-410C-A413-E5F450A72910}\DotNetHostFxr
Size 956KB
SHA256 c32e3c6b259374095e8a1eb71419285c87b52c116384a144a5c4f033b4f3f201
MD5 3ddc54b7f05b6555c6cfc9680ff6b9e7
SHA1 0c03809e6c18c85d8a104aeb4761282e9a371125
SHA512 cf9c64345e33cf24390364d35721f3df614c2bc779fb5d1b5b0da18064ff8f8e237a5aa573c5838c7c88367f75624bf61b5f6cbe6263ca03c049813d957cf508
SSDEEP 24576:JcnTiadGdKkg78We96FDxTYwsvqVmX089:JcTi8GExDdYwsvRV
TLSH
T1CC258C23BC41A036D9EA0D72A478CB716A3DBD14179484DB4390B94DFCF06C2ABB67D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetRuntime

Path C:\Users\Admin\AppData\Local\Temp\{B2A4D9F1-38A4-410C-A413-E5F450A72910}\DotNetRuntime
Size 26.1MB
SHA256 203c7e9ddc65d3672dc28bb4a771b6967f00ea1ebf2e8f6e94d8e77123b4416f
MD5 0c6a3c52ccef3bfa6c73d920ae7d3b6e
SHA1 9458f66f9fd818617fb13438d43c2e0ca840e959
SHA512 1049460ddb0ab19cfa0def6b7f69f7f2b865e3fa849dd3e9a04e8e72df3b515633016f700f87822d747b280dde70c9329d1f1648b7a5f80c1329c2bcde5fbdad
SSDEEP 786432:tLsSCDUHOUw/hCXA7tVvz+4o+2BFrHYBG:tLs2zw/hmwz+40r4
TLSH
T126573323BC82D136D5B60D39AA39D3B01E3CAD046B54846F13D0B95CFDF15D26AB2AC6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsDesktopRuntime

Path C:\Users\Admin\AppData\Local\Temp\{B2A4D9F1-38A4-410C-A413-E5F450A72910}\WindowsDesktopRuntime
Size 26.7MB
SHA256 01ddb3d5c88cf85eb3796f3886859434baa1aef3076af268e2230703f16ab1c3
MD5 6d544a69dc8e2252972f6979efb6dd1a
SHA1 cb27c755fea497b37a73d1ddef3e337395a46c13
SHA512 0ce130cdb9c0061cf84c845f5157181a48d22c2ac60d0925f811811855b6473e438078ac667d2f118c530270a7fabe5784f1f7cc01f525d1e318eec155fb6ed5
SSDEEP 786432:amkmDZR+Uz10SBhvmkEZcK+nlsDQaWlrsW663YttF7:aeZRh10yvnEZ9+n/sZXTF
TLSH
T1A45733277D959036D9E61D72E43C87B029383C049BA0899FA790F90DF9F02D16FB26D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Velocity.exe

Path C:\Users\Admin\Desktop\Velocity\Velocity.exe
Size 32.9MB
SHA256 873fd333cd8e687b874af8dca2f043c50ea1f4bc64d496015ca038da383b91f0
MD5 83da367e14fe39262fcf57c39dc3180b
SHA1 a0d2655ceff2d35b7eceb55e2be1058b966970e2
SHA512 8ce8b77b95640a111d43b75ff76bdfdacfd8680a39c5d5c6a97fdef7aef18bd7470a4df4716fd3c67a51cfed69a710d6c33086c864a0b91ea0c03966b8a97df5
SSDEEP 196608:ktQ56WdpH6emXAro0JTToUgmwh8qZYOCu51ZTAFLzbjblIjvT7CThIPPBrYjPWDx:kt6pHxmXf0J9A8qCFqAFLKnCTMGPWl
TLSH
T1A9779E22A3A44E3DC99F5773E4B603254335CA06AF43939E581CA69C1F933860B59BF7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI2801.tmp

Path C:\Windows\Installer\MSI2801.tmp
Size 346KB
SHA256 1caa470031f4f3fb53bb38187d522990a3a7423476b1b5aaa27443a3e2fc62c0
MD5 f715d24632e765c53e9856df53dc8318
SHA1 78e2280ccaeed00119fe827acc58ba10996517cb
SHA512 dd0568de924a86910d8bf59b2f0c22663268004ef9a5f80ffd78f37885f3b8538d138d1e5c70de8e4fda7aab150df48bd34e3838c976ec90ed4f0e49bed0e9e6
SSDEEP 6144:WbOobwWeCg6QvyuFtPwvGyDBQlEz8a+CFTYK0OnsoIcGm1p:W78We96sI+yDxTYwsoCm1p
TLSH
T1BF745B31A456707AE6F90872F568CB706D3CB21827D8849FC3E0E84E38645D36BB775A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BootstrapperApplicationData.xml

Path C:\Windows\TEMP\{B2A4D9F1-38A4-410C-A413-E5F450A72910}\.ba\BootstrapperApplicationData.xml
Size 9KB
SHA256 28a025e1f26559f1fb305eb8a4505ade20dd1efeb8a2423bd5481d73d9b50504
MD5 6915070732a4441488fc41f0b7064157
SHA1 f869d3eb36a0da1202fbef75023edff0b82419a2
SHA512 2da1605e5bafe6e93c69b8eaa5527f35dd929f658c6a358c6ed072894d17e3e05e1dbb59540a7a353487881cc205ef75b1e8ac4fb3b6c621825647618ab637f3
SSDEEP 192:2GCzfTT/cvPV+snFXcYatakv2mXsCsysz:xjV8sCsysz
TLSH
T1F112E5513BFD0218F0F3AF88EBF6A5555A36BD552E39C82D01201D0F49B2E819962FB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetLogo_256x.png

Path C:\Windows\TEMP\{B2A4D9F1-38A4-410C-A413-E5F450A72910}\.ba\DotNetLogo_256x.png
Size 2KB
SHA256 0f571f95d8eab48dbc81b0ec5e9f7225e349e26ef50868bfaab556f3c2443b01
MD5 39aa52615723b782c92dec710caaec7f
SHA1 760b49e256a7979fe50a56a2b1be3688a474b886
SHA512 89d1baa3820154667747b25e9e2fd321bfb2ec71dc309915b0a28dacdc80822a4943b639ebb37c37bd2559d5a4306d2096119cd970c84a0d331f6c68b0456dc9
TLSH
T1534195CF1BFD78D7E6E557918E1A8DD232738483B4B3A42CCE7B10B8274A5642B87940
MD5 SHA1 SHA512 TLSH

Submit Download

dotnet.ico

Path C:\Windows\TEMP\{B2A4D9F1-38A4-410C-A413-E5F450A72910}\.ba\dotnet.ico
Size 44KB
SHA256 61a2cbd12868cb9b359e0c78961d409b7875f072eb8e53ea88d3e6bfe2961a18
MD5 b8096652d9ec286709a2c863b244b110
SHA1 b3b7f0f4d608fad7cb59ba499d4d17c2b873a7af
SHA512 492a5aa83220bb77c178b7c5b50bf44968c0427e9e45bb97a33df14d7fb4c667ca7adde0ebb3874c7b6011057b01144e4e6651fbad62c6bcf5e0b93586c4bc7a
SSDEEP 96:r+gfbzo+wHK9NbwOY4tIWQeVlV1W9+H+guapUjFamINUItzf1dBNaIZ:ro5HuNcH4tIzeVlV1WEOFDgUWzf1PIm
TLSH
T1E913EF6DE68547C1C10C2032DB4AC792B5233C72E4DAE0C4F9D4FA7E177906965C6E6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\TEMP\{B2A4D9F1-38A4-410C-A413-E5F450A72910}\.ba\thm.wxl
Size 7KB
SHA256 b00edd703dd8a475119d0e4dd70a3aaa47f0e95361af290e76d367a8edef3432
MD5 8b2c667a8bbad3153068c0ed90df7ec4
SHA1 c9e04a3a37e5e6262ab9bfecf78280171b8f7b74
SHA512 5269f00d474acccb4c48cb7bcfdf19e63557a388572d3a6335aa39191319691d924e27f70da3f3495387c319396476c63a8fd7b35835cca0901220e39783847b
SSDEEP 96:HiTgM1+XSNEzA0HtYQstYCpCwZQpCeyk5HQJM9ouvj9urz8:Ew9EmtYQstYCPC9e8
TLSH
T191E1026F68DFDEE03A732651B2B3698D6919C29A136F1CF0F869084B47635016377A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.xml

Path C:\Windows\TEMP\{B2A4D9F1-38A4-410C-A413-E5F450A72910}\.ba\thm.xml
Size 11KB
SHA256 dfee8e2d075087227f19c835c145c5bb8e72a46880ea24080bb2472fd3a521be
MD5 4329e418dc56b1386d7ea29a0dcfab5b
SHA1 58387f92e89ca21b4179fb697c7de9675c59142f
SHA512 6934873d27e6efbb94da4f13ee8369b29995490051016fdf82800256b924902306d328bf1d4ebbf266d1a53eb24adb6478d1a67de4ecc3e3bcbe561968f24922
SSDEEP 96:HgvPkoeWEH3IWTaQfSJgHzth5mFahbuB8pR5+Vpwe+UIJLg1gEp+6F5pQnxc:AvoWydmQfVHMyyj5Z
TLSH
T14B42FC6851DC7811C532D702AB9371D3FF12BDA6C6C85A58B48E256B1FF262028B739C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixstdba.exe

Path C:\Windows\Temp\{B2A4D9F1-38A4-410C-A413-E5F450A72910}\.ba\wixstdba.exe
Size 431KB
SHA256 2b1cee5e3e24593247854eb7a7c4308937b9c607754ed2fb83520a8706c26f1e
MD5 0e88ffd2e737ac9b9a4241616838bc23
SHA1 3c8beb465d20bcef0cd6ceca9c60286d1d15cebd
SHA512 169b9e08518834c9bc5adfe4ab7b79e07685b72f30ede1c1a386229668bde8c15da378e1274e4013ad7b84d6f7a5acc64ef0806e3b8a66322861efaa7e26b620
SSDEEP 6144:X9vfS1NP+c3ytxmg4Stlqe3B9m2LSLTwGw7C3ZLaov5xZvSdF:X9v+GIyugllqe3wwGfX5/SdF
TLSH
T129943B3165F04037C6F90572AE14FA31BF69F208231095EBA3C0DD293968AE5BBB7657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windowsdesktop-runtime-10.0.6-win-x86.exe

Path C:\Windows\Temp\{B2A4D9F1-38A4-410C-A413-E5F450A72910}\.be\windowsdesktop-runtime-10.0.6-win-x86.exe
Size 967KB
SHA256 33ab100546277fbf0df1dc5092bed58a02d90a9f910b27e1e92982b60b614d4d
MD5 c046a1812074ca8433a59b2b02a6b942
SHA1 9e3c66b06aa29ff502d20bf9325de31e5254836c
SHA512 7c58aae5d8510e79ed8d28354bff595bf13ec102c99aa378673596ef36a78a728b1b1697c84e5910f917e17ff981ba6a35e1b460d36fc2bcee153a01da101efb
SSDEEP 24576:sVGWl6qCmyt6UdmcpMzSz6lX37+D6Mu8io:bq/ytZ8cp0SYa298io
TLSH
T1C9257E31A166242BD6F50973F914D2307E2CD7082B5C99B6C6C0D90D39689FA6FFB24B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/748-1458-0x0000000000AD0000-0x0000000000B96000-memory.dmp

Download

memory/748-1459-0x00000000021C0000-0x0000000002205000-memory.dmp

Download

memory/748-775-0x00000000021C0000-0x0000000002205000-memory.dmp

Download

memory/2056-661-0x0000000001100000-0x0000000001145000-memory.dmp

Download

memory/2772-20-0x00000000025B0000-0x00000000025F5000-memory.dmp

Download

memory/3976-1456-0x0000000002FF0000-0x0000000003035000-memory.dmp

Download

memory/3976-773-0x0000000002FF0000-0x0000000003035000-memory.dmp

Download

memory/4196-1461-0x00000000023B0000-0x00000000023F5000-memory.dmp

Download

memory/4196-772-0x00000000023B0000-0x00000000023F5000-memory.dmp

Download

memory/4460-1325-0x0000000000BA0000-0x0000000000BE5000-memory.dmp

Download

memory/4460-868-0x0000000000BA0000-0x0000000000BE5000-memory.dmp

Download

memory/4460-1454-0x0000000000BA0000-0x0000000000BE5000-memory.dmp

Download

memory/5164-870-0x000002B0D1FF0000-0x000002B0D1FF8000-memory.dmp

Download

memory/5380-1448-0x0000000000920000-0x0000000000965000-memory.dmp

Download

memory/5408-982-0x0000000001300000-0x0000000001345000-memory.dmp

Download

memory/5412-731-0x0000000000BA0000-0x0000000000BE5000-memory.dmp

Download

memory/5560-1535-0x0000000008E20000-0x0000000008E65000-memory.dmp

Download

memory/5560-1665-0x0000000008E20000-0x0000000008E65000-memory.dmp

Download

memory/5564-752-0x0000000000CD0000-0x0000000000D15000-memory.dmp

Download

memory/5656-1451-0x00000000029F0000-0x0000000002A35000-memory.dmp

Download

memory/5656-1298-0x00000000029F0000-0x0000000002A35000-memory.dmp

Download

memory/5668-1453-0x0000000000BC0000-0x0000000000C05000-memory.dmp

Download

memory/5668-1449-0x0000000000BC0000-0x0000000000C05000-memory.dmp

Download

memory/5816-1303-0x0000000000580000-0x00000000005C5000-memory.dmp

Download

memory/5960-1322-0x00000000003B0000-0x00000000003F5000-memory.dmp

Download