873fd333cd8e687b874af8dca2f043c50ea1f4bc64d496015ca038da383b91f0

Resubmissions

22/04/2026, 23:00

260422-2zed3sdw819

22/04/2026, 22:57

260422-2xhnqadw518

Analysis

user interaction
yes
max time kernel
292s
max time network
299s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/04/2026, 23:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Velocity.exe
Size 32.9MB
Sample260422-2zed3sdw81
SHA256 873fd333cd8e687b874af8dca2f043c50ea1f4bc64d496015ca038da383b91f0
MD5 83da367e14fe39262fcf57c39dc3180b
SHA1 a0d2655ceff2d35b7eceb55e2be1058b966970e2
SHA512 8ce8b77b95640a111d43b75ff76bdfdacfd8680a39c5d5c6a97fdef7aef18bd7470a4df4716fd3c67a51cfed69a710d6c33086c864a0b91ea0c03966b8a97df5
SSDEEP 196608:ktQ56WdpH6emXAro0JTToUgmwh8qZYOCu51ZTAFLzbjblIjvT7CThIPPBrYjPWDx:kt6pHxmXf0J9A8qCFqAFLKnCTMGPWl
TLSH
T1A9779E22A3A44E3DC99F5773E4B603254335CA06AF43939E581CA69C1F933860B59BF7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery persistence trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	erto3e4rortoergn.exe

Downloads MZ/PE file 3 IoCs

flow	pid	Process
90	844	msedge.exe
187	844	msedge.exe
281	2616	chrome.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	erto3e4rortoergn.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	erto3e4rortoergn.exe

Executes dropped EXE 13 IoCs

pid	Process
5028	windowsdesktop-runtime-10.0.7-win-x86.exe
5816	wixstdba.exe
5928	windowsdesktop-runtime-10.0.7-win-x86.exe
6120	windowsdesktop-runtime-10.0.7-win-x86.exe
3096	windowsdesktop-runtime-10.0.7-win-x86.exe
3364	wixstdba.exe
5992	windowsdesktop-runtime-10.0.7-win-x86.exe
5148	Velocity.exe
4800	Decompiler.exe
3692	Fishstrap.exe
2752	RobloxPlayerBeta.exe
6240	erto3e4rortoergn.exe
6428	Decompiler.exe

Loads dropped DLL 64 IoCs

pid	Process
4624	MsiExec.exe
4696	MsiExec.exe
5996	MsiExec.exe
4768	MsiExec.exe
2236	MsiExec.exe
5148	Velocity.exe
5148	Velocity.exe
5148	Velocity.exe
5148	Velocity.exe
5148	Velocity.exe
5148	Velocity.exe
5148	Velocity.exe
5148	Velocity.exe
5148	Velocity.exe
5148	Velocity.exe
5148	Velocity.exe
5148	Velocity.exe
5148	Velocity.exe
5148	Velocity.exe
5148	Velocity.exe
5148	Velocity.exe
5148	Velocity.exe
5148	Velocity.exe
5148	Velocity.exe
5148	Velocity.exe
5148	Velocity.exe
5148	Velocity.exe
5148	Velocity.exe
5148	Velocity.exe
5148	Velocity.exe
5148	Velocity.exe
5148	Velocity.exe
5148	Velocity.exe
5148	Velocity.exe
5148	Velocity.exe
5148	Velocity.exe
5148	Velocity.exe
5148	Velocity.exe
5148	Velocity.exe
5148	Velocity.exe
5148	Velocity.exe
5148	Velocity.exe
5148	Velocity.exe
5148	Velocity.exe
5148	Velocity.exe
5148	Velocity.exe
5148	Velocity.exe
5148	Velocity.exe
5148	Velocity.exe
5148	Velocity.exe
5148	Velocity.exe
5148	Velocity.exe
5148	Velocity.exe
5148	Velocity.exe
5148	Velocity.exe
5148	Velocity.exe
5148	Velocity.exe
5148	Velocity.exe
5148	Velocity.exe
5148	Velocity.exe
5148	Velocity.exe
5148	Velocity.exe
5148	Velocity.exe
5148	Velocity.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{580865E1-2073-4861-8356-3D20DFF3D50E} = "\"C:\\ProgramData\\Package Cache\\{580865E1-2073-4861-8356-3D20DFF3D50E}\\windowsdesktop-runtime-10.0.7-win-x86.exe\" /burn.runonce"	windowsdesktop-runtime-10.0.7-win-x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{580865E1-2073-4861-8356-3D20DFF3D50E} = "\"C:\\ProgramData\\Package Cache\\{580865E1-2073-4861-8356-3D20DFF3D50E}\\windowsdesktop-runtime-10.0.7-win-x86.exe\" /burn.runonce"	windowsdesktop-runtime-10.0.7-win-x86.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	erto3e4rortoergn.exe

Contacts third-party web service commonly abused for C2 1 TTPs 13 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
157	api.gofile.io
159	api.gofile.io
196	raw.githubusercontent.com
264	raw.githubusercontent.com
268	camo.githubusercontent.com
269	camo.githubusercontent.com
156	api.gofile.io
167	camo.githubusercontent.com
265	camo.githubusercontent.com
266	camo.githubusercontent.com
267	camo.githubusercontent.com
270	camo.githubusercontent.com
271	raw.githubusercontent.com

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
2752	RobloxPlayerBeta.exe
2752	RobloxPlayerBeta.exe
2752	RobloxPlayerBeta.exe
6240	erto3e4rortoergn.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\es\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\System.DirectoryServices.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\es\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\ja\UIAutomationTypes.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\pt-BR\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Diagnostics.Contracts.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\cs\UIAutomationTypes.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\PresentationFramework.Royale.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\zh-Hans\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Resources.ResourceManager.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\ru\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\zh-Hant\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Reflection.Emit.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\es\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\es\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\ja\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\pl\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\ru\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Runtime.CompilerServices.Unsafe.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Runtime.Intrinsics.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\ko\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\ru\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Runtime.Serialization.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\System.Security.Permissions.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\it\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\ko\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\zh-Hant\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\fr\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\fr\WindowsBase.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.IO.Compression.Brotli.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Xml.ReaderWriter.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\cs\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\de\UIAutomationTypes.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\es\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\fr\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Net.Primitives.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Reflection.Emit.Lightweight.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Runtime.Loader.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\.version	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\ko\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.ComponentModel.DataAnnotations.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Net.HttpListener.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Configuration.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\cs\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\ja\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Runtime.InteropServices.RuntimeInformation.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\System.Security.Cryptography.Pkcs.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\cs\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\es\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\pl\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\pl\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Collections.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Web.HttpUtility.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\ja\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Diagnostics.DiagnosticSource.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Linq.Expressions.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\it\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\Microsoft.VisualBasic.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\it\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\ja\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\zh-Hans\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.ComponentModel.EventBasedAsync.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Drawing.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Numerics.Vectors.dll	msiexec.exe

Drops file in Windows directory 51 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e58fe69.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFEFA93132D49C973E.TMP	msiexec.exe
File created	C:\Windows\Installer\e58fe64.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e58fe65.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF90AD5A19E2A18CF0.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF59E83F91D6FFE826.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF26E7850295B1DA33.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2334.tmp	msiexec.exe
File created	C:\Windows\Installer\e58fe73.msi	msiexec.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\Installer\SourceHash{EF889568-39DF-4FBB-83A6-893DF0A5A7D7}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFFB9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2D8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e58fe6a.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFCAEC025C48B50924.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{6F122B2D-6824-4922-A23E-A9151114EE7A}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2EBE.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFA0F9F3D50C63724C.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI12C7.tmp	msiexec.exe
File created	C:\Windows\Installer\e58fe6e.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFE3D8CA457E5B39A3.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3D94.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3DD3.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF3D9E0FF26E7705F9.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFCE6DD65B5F25A872.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFACD704E692552990.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF731484FE56B54A85.TMP	msiexec.exe
File created	C:\Windows\Installer\e58fe6a.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{2A17EBA5-4EEE-4A8A-9CEE-E8B67938B606}	msiexec.exe
File created	C:\Windows\SystemTemp\~DFE020316C78351A98.TMP	msiexec.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File created	C:\Windows\SystemTemp\~DF4F4C31B0664D9F9F.TMP	msiexec.exe
File created	C:\Windows\Installer\e58fe60.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI289.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF5E56662A28E45550.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1CF9.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFFDCDB97E99590C64.TMP	msiexec.exe
File created	C:\Windows\Installer\e58fe6f.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e58fe6f.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e58fe60.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFF2B.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFD9BE6DF996439455.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF88CE7497A4A9AB92.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFC5E8D000FD61D943.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_173505536\manifest.json	msedge.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF0C110B1533BDDBF8.TMP	msiexec.exe
File created	C:\Windows\Installer\e58fe65.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{09AE2CD2-101D-45E8-8922-51ABAA31F8CC}	msiexec.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 3 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.7-win-x86.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Velocity.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Fishstrap.exe:Zone.Identifier	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.7-win-x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Velocity.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Velocity.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wixstdba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.7-win-x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.7-win-x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.7-win-x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.7-win-x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wixstdba.exe

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4900	msedge.exe
844	msedge.exe
2616	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 14 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134213724732791790"	msedge.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2B	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\865988FEFD93BBF4386A98D30F5A7A7D\Provider	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2DC2EA90D1018E54982215BAAA138FCC\Provider	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D2B221F6428622942AE39A511141EEA7\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_80.28.51996_x86\Dependents\{580865E1-2073-4861-8356-3D20DFF3D50E}	windowsdesktop-runtime-10.0.7-win-x86.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\865988FEFD93BBF4386A98D30F5A7A7D\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_80.28.51996_x86\Dependents\{580865E1-2073-4861-8356-3D20DFF3D50E}	windowsdesktop-runtime-10.0.7-win-x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D2B221F6428622942AE39A511141EEA7\Provider	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\865988FEFD93BBF4386A98D30F5A7A7D\ProductName = "Microsoft .NET Host - 10.0.7 (x86)"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\865988FEFD93BBF4386A98D30F5A7A7D\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\roblox-player\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Fishstrap\\Fishstrap.exe\" -player \"%1\""	Fishstrap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{0f62ff89-5cc3-5dfe-ec82-db9d826b6527}\Dependents	windowsdesktop-runtime-10.0.7-win-x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x86\DisplayName = "Microsoft .NET Host - 10.0.7 (x86)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\865988FEFD93BBF4386A98D30F5A7A7D\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{EF889568-39DF-4FBB-83A6-893DF0A5A7D7}v80.28.51996\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D2B221F6428622942AE39A511141EEA7\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{0f62ff89-5cc3-5dfe-ec82-db9d826b6527}\ = "{580865E1-2073-4861-8356-3D20DFF3D50E}"	windowsdesktop-runtime-10.0.7-win-x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\B9FD6305CAA5D224A5486ED10DAF7290\2DC2EA90D1018E54982215BAAA138FCC	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_80.28.51996_x86\Version = "80.28.51996"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D2B221F6428622942AE39A511141EEA7\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_80.28.51996_x86\Dependents	windowsdesktop-runtime-10.0.7-win-x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\865988FEFD93BBF4386A98D30F5A7A7D\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{EF889568-39DF-4FBB-83A6-893DF0A5A7D7}v80.28.51996\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2DC2EA90D1018E54982215BAAA138FCC\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\roblox\ = "URL: Roblox Protocol"	Fishstrap.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_80.28.51996_x86\Dependents	windowsdesktop-runtime-10.0.7-win-x86.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D2B221F6428622942AE39A511141EEA7\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\865988FEFD93BBF4386A98D30F5A7A7D\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\865988FEFD93BBF4386A98D30F5A7A7D\Version = "1344064284"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\865988FEFD93BBF4386A98D30F5A7A7D\SourceList\PackageName = "dotnet-host-10.0.7-win-x86.msi"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2DC2EA90D1018E54982215BAAA138FCC\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\roblox-player\shell	Fishstrap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5ABE71A2EEE4A8A4C9EE8E6B97836B60\ProductName = "Microsoft .NET Runtime - 10.0.7 (x86)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5ABE71A2EEE4A8A4C9EE8E6B97836B60\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{2A17EBA5-4EEE-4A8A-9CEE-E8B67938B606}v80.28.51996\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D2B221F6428622942AE39A511141EEA7\PackageCode = "C01DBE88C89D6684C98072939B97831F"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D2B221F6428622942AE39A511141EEA7\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\865988FEFD93BBF4386A98D30F5A7A7D	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\7C5F02C108B5629409B1C2D8A072F2A4	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2DC2EA90D1018E54982215BAAA138FCC	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2DC2EA90D1018E54982215BAAA138FCC\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_80.28.51996_x86\ = "{2A17EBA5-4EEE-4A8A-9CEE-E8B67938B606}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\windowsdesktop_runtime_80.28.51996_x86	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_80.28.51996_x86\DisplayName = "Microsoft Windows Desktop Runtime - 10.0.7 (x86)"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D2B221F6428622942AE39A511141EEA7\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\865988FEFD93BBF4386A98D30F5A7A7D\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x86	windowsdesktop-runtime-10.0.7-win-x86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.28.51996_x86\Dependents	windowsdesktop-runtime-10.0.7-win-x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3178EEBD72B5CC250FFFEA4077368656\D2B221F6428622942AE39A511141EEA7	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{0f62ff89-5cc3-5dfe-ec82-db9d826b6527}	windowsdesktop-runtime-10.0.7-win-x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{0f62ff89-5cc3-5dfe-ec82-db9d826b6527}\Version = "10.0.7.50000"	windowsdesktop-runtime-10.0.7-win-x86.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\865988FEFD93BBF4386A98D30F5A7A7D\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2DC2EA90D1018E54982215BAAA138FCC\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2DC2EA90D1018E54982215BAAA138FCC\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{09AE2CD2-101D-45E8-8922-51ABAA31F8CC}v80.28.51996\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5ABE71A2EEE4A8A4C9EE8E6B97836B60\Provider	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5ABE71A2EEE4A8A4C9EE8E6B97836B60\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\dotnet_runtime_80.28.51996_x86	windowsdesktop-runtime-10.0.7-win-x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\7C5F02C108B5629409B1C2D8A072F2A4\865988FEFD93BBF4386A98D30F5A7A7D	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2DC2EA90D1018E54982215BAAA138FCC\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2DC2EA90D1018E54982215BAAA138FCC\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2DC2EA90D1018E54982215BAAA138FCC\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{09AE2CD2-101D-45E8-8922-51ABAA31F8CC}v80.28.51996\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_80.28.51996_x86\Dependents\{580865E1-2073-4861-8356-3D20DFF3D50E}	windowsdesktop-runtime-10.0.7-win-x86.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\dotnet_runtime_80.28.51996_x86	windowsdesktop-runtime-10.0.7-win-x86.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\roblox\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Fishstrap\\Fishstrap.exe\" -player \"%1\""	Fishstrap.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2DC2EA90D1018E54982215BAAA138FCC	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2DC2EA90D1018E54982215BAAA138FCC\Assignment = "1"	msiexec.exe

NTFS ADS 4 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.7-win-x86.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Velocity.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Fishstrap.exe:Zone.Identifier	chrome.exe
File created	C:\Users\Admin\AppData\Local\Fishstrap\Fishstrap.exe\:Zone.Identifier:$DATA	Fishstrap.exe

Suspicious behavior: EnumeratesProcesses 25 IoCs

pid	Process
6112	msiexec.exe
6112	msiexec.exe
6112	msiexec.exe
6112	msiexec.exe
6112	msiexec.exe
6112	msiexec.exe
6112	msiexec.exe
6112	msiexec.exe
6112	msiexec.exe
6112	msiexec.exe
5148	Velocity.exe
5212	chrome.exe
5212	chrome.exe
5212	chrome.exe
5212	chrome.exe
4888	chrome.exe
4888	chrome.exe
3692	Fishstrap.exe
3692	Fishstrap.exe
3692	Fishstrap.exe
3692	Fishstrap.exe
3692	Fishstrap.exe
2752	RobloxPlayerBeta.exe
6240	erto3e4rortoergn.exe
6240	erto3e4rortoergn.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 22 IoCs

pid	Process
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
5212	chrome.exe
5212	chrome.exe
5212	chrome.exe
5212	chrome.exe
5212	chrome.exe
5212	chrome.exe
5212	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5928	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeIncreaseQuotaPrivilege	5928	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeSecurityPrivilege	6112	msiexec.exe
Token: SeCreateTokenPrivilege	5928	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeAssignPrimaryTokenPrivilege	5928	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeLockMemoryPrivilege	5928	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeIncreaseQuotaPrivilege	5928	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeMachineAccountPrivilege	5928	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeTcbPrivilege	5928	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeSecurityPrivilege	5928	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeTakeOwnershipPrivilege	5928	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeLoadDriverPrivilege	5928	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeSystemProfilePrivilege	5928	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeSystemtimePrivilege	5928	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeProfSingleProcessPrivilege	5928	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeIncBasePriorityPrivilege	5928	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeCreatePagefilePrivilege	5928	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeCreatePermanentPrivilege	5928	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeBackupPrivilege	5928	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeRestorePrivilege	5928	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeShutdownPrivilege	5928	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeDebugPrivilege	5928	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeAuditPrivilege	5928	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeSystemEnvironmentPrivilege	5928	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeChangeNotifyPrivilege	5928	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeRemoteShutdownPrivilege	5928	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeUndockPrivilege	5928	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeSyncAgentPrivilege	5928	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeEnableDelegationPrivilege	5928	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeManageVolumePrivilege	5928	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeImpersonatePrivilege	5928	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeCreateGlobalPrivilege	5928	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeRestorePrivilege	6112	msiexec.exe
Token: SeTakeOwnershipPrivilege	6112	msiexec.exe
Token: SeRestorePrivilege	6112	msiexec.exe
Token: SeTakeOwnershipPrivilege	6112	msiexec.exe
Token: SeRestorePrivilege	6112	msiexec.exe
Token: SeTakeOwnershipPrivilege	6112	msiexec.exe
Token: SeRestorePrivilege	6112	msiexec.exe
Token: SeTakeOwnershipPrivilege	6112	msiexec.exe
Token: SeRestorePrivilege	6112	msiexec.exe
Token: SeTakeOwnershipPrivilege	6112	msiexec.exe
Token: SeRestorePrivilege	6112	msiexec.exe
Token: SeTakeOwnershipPrivilege	6112	msiexec.exe
Token: SeRestorePrivilege	6112	msiexec.exe
Token: SeTakeOwnershipPrivilege	6112	msiexec.exe
Token: SeRestorePrivilege	6112	msiexec.exe
Token: SeTakeOwnershipPrivilege	6112	msiexec.exe
Token: SeRestorePrivilege	6112	msiexec.exe
Token: SeTakeOwnershipPrivilege	6112	msiexec.exe
Token: SeRestorePrivilege	6112	msiexec.exe
Token: SeTakeOwnershipPrivilege	6112	msiexec.exe
Token: SeRestorePrivilege	6112	msiexec.exe
Token: SeTakeOwnershipPrivilege	6112	msiexec.exe
Token: SeRestorePrivilege	6112	msiexec.exe
Token: SeTakeOwnershipPrivilege	6112	msiexec.exe
Token: SeRestorePrivilege	6112	msiexec.exe
Token: SeTakeOwnershipPrivilege	6112	msiexec.exe
Token: SeRestorePrivilege	6112	msiexec.exe
Token: SeTakeOwnershipPrivilege	6112	msiexec.exe
Token: SeRestorePrivilege	6112	msiexec.exe
Token: SeTakeOwnershipPrivilege	6112	msiexec.exe
Token: SeRestorePrivilege	6112	msiexec.exe
Token: SeTakeOwnershipPrivilege	6112	msiexec.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
5816	wixstdba.exe
3364	wixstdba.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
5212	chrome.exe
5212	chrome.exe
5212	chrome.exe
5212	chrome.exe
5212	chrome.exe
5212	chrome.exe
5212	chrome.exe
5212	chrome.exe
5212	chrome.exe
5212	chrome.exe
5212	chrome.exe
5212	chrome.exe
5212	chrome.exe
5212	chrome.exe
5212	chrome.exe
5212	chrome.exe
5212	chrome.exe
5212	chrome.exe
5212	chrome.exe
5212	chrome.exe
5212	chrome.exe
5212	chrome.exe
5212	chrome.exe
5212	chrome.exe
5212	chrome.exe
5212	chrome.exe
5212	chrome.exe
5212	chrome.exe
5212	chrome.exe
5212	chrome.exe
5212	chrome.exe
5212	chrome.exe
5212	chrome.exe
5212	chrome.exe
5212	chrome.exe
5212	chrome.exe
5212	chrome.exe
5212	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5212	chrome.exe
5212	chrome.exe
5212	chrome.exe
5212	chrome.exe
5212	chrome.exe
5212	chrome.exe
5212	chrome.exe
5212	chrome.exe
5212	chrome.exe
5212	chrome.exe
5212	chrome.exe
5212	chrome.exe
5212	chrome.exe
5212	chrome.exe
5212	chrome.exe
5212	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1240 wrote to memory of 4900	1240	Velocity.exe	80
PID 4900 wrote to memory of 3888	4900	msedge.exe	81
PID 4900 wrote to memory of 420	4900	msedge.exe	83
PID 4900 wrote to memory of 844	4900	msedge.exe	82
PID 4900 wrote to memory of 420	4900	msedge.exe	83
PID 4900 wrote to memory of 420	4900	msedge.exe	83
PID 4900 wrote to memory of 4092	4900	msedge.exe	84
PID 4900 wrote to memory of 4092	4900	msedge.exe	84
PID 4900 wrote to memory of 3860	4900	msedge.exe	85
PID 4900 wrote to memory of 3860	4900	msedge.exe	85
PID 4900 wrote to memory of 3860	4900	msedge.exe	85
PID 4900 wrote to memory of 396	4900	msedge.exe	86
PID 4900 wrote to memory of 396	4900	msedge.exe	86
PID 4900 wrote to memory of 396	4900	msedge.exe	86
PID 4900 wrote to memory of 4944	4900	msedge.exe	88
PID 4900 wrote to memory of 4944	4900	msedge.exe	88
PID 4900 wrote to memory of 4944	4900	msedge.exe	88
PID 4900 wrote to memory of 1120	4900	msedge.exe	89
PID 4900 wrote to memory of 1120	4900	msedge.exe	89
PID 4900 wrote to memory of 1120	4900	msedge.exe	89
PID 4900 wrote to memory of 1604	4900	msedge.exe	90
PID 4900 wrote to memory of 4688	4900	msedge.exe	91
PID 4900 wrote to memory of 1604	4900	msedge.exe	90
PID 4900 wrote to memory of 1604	4900	msedge.exe	90
PID 4900 wrote to memory of 4688	4900	msedge.exe	91
PID 4900 wrote to memory of 4688	4900	msedge.exe	91
PID 4900 wrote to memory of 4880	4900	msedge.exe	93
PID 4900 wrote to memory of 4880	4900	msedge.exe	93
PID 4900 wrote to memory of 4760	4900	msedge.exe	95
PID 4900 wrote to memory of 4760	4900	msedge.exe	95
PID 4900 wrote to memory of 4956	4900	msedge.exe	96
PID 4900 wrote to memory of 3896	4900	msedge.exe	97
PID 4900 wrote to memory of 4956	4900	msedge.exe	96
PID 4900 wrote to memory of 3896	4900	msedge.exe	97
PID 4900 wrote to memory of 3996	4900	msedge.exe	98
PID 4900 wrote to memory of 3996	4900	msedge.exe	98
PID 4900 wrote to memory of 3996	4900	msedge.exe	98
PID 4900 wrote to memory of 4440	4900	msedge.exe	100
PID 4900 wrote to memory of 4464	4900	msedge.exe	101
PID 4464 wrote to memory of 2796	4464	msedge.exe	102
PID 4900 wrote to memory of 3608	4900	msedge.exe	103
PID 4900 wrote to memory of 3608	4900	msedge.exe	103
PID 4900 wrote to memory of 3720	4900	msedge.exe	104
PID 4900 wrote to memory of 3720	4900	msedge.exe	104
PID 4900 wrote to memory of 572	4900	msedge.exe	105
PID 4900 wrote to memory of 572	4900	msedge.exe	105
PID 4900 wrote to memory of 572	4900	msedge.exe	105
PID 4900 wrote to memory of 1640	4900	msedge.exe	106
PID 4900 wrote to memory of 2844	4900	msedge.exe	107
PID 4900 wrote to memory of 1640	4900	msedge.exe	106
PID 4900 wrote to memory of 2844	4900	msedge.exe	107
PID 4900 wrote to memory of 4720	4900	msedge.exe	108
PID 4900 wrote to memory of 4720	4900	msedge.exe	108
PID 4900 wrote to memory of 540	4900	msedge.exe	109
PID 4900 wrote to memory of 2568	4900	msedge.exe	110
PID 4900 wrote to memory of 540	4900	msedge.exe	109
PID 4900 wrote to memory of 2568	4900	msedge.exe	110
PID 4900 wrote to memory of 2568	4900	msedge.exe	110
PID 4900 wrote to memory of 952	4900	msedge.exe	111
PID 4900 wrote to memory of 5708	4900	msedge.exe	112
PID 4900 wrote to memory of 5716	4900	msedge.exe	113
PID 4900 wrote to memory of 5724	4900	msedge.exe	114
PID 4900 wrote to memory of 220	4900	msedge.exe	115
PID 4900 wrote to memory of 220	4900	msedge.exe	115

C:\Users\Admin\AppData\Local\Temp\Velocity.exe
"C:\Users\Admin\AppData\Local\Temp\Velocity.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=x86&rid=win-x86&os=win10&apphost_version=10.0.0&gui=true
  2⤵
  - Drops file in Windows directory
  - System Time Discovery
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x2f4,0x7ff8d3cec188,0x7ff8d3cec194,0x7ff8d3cec1a0
    3⤵
    PID:3888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1852,i,10750573840256263597,4662975928104476939,524288 --field-trial-handle=2152,i,14197305568074465328,9920947304451982834,262144 --variations-seed-version --mojo-platform-channel-handle=2180 /prefetch:11
    3⤵
    - Downloads MZ/PE file
    - System Time Discovery
    PID:844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,6414094018582392108,11279375224233135911,262144 --field-trial-handle=2152,i,14197305568074465328,9920947304451982834,262144 --variations-seed-version --mojo-platform-channel-handle=2148 /prefetch:2
    3⤵
    PID:420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2476,i,9648206088055023399,15377144898158342,524288 --field-trial-handle=2152,i,14197305568074465328,9920947304451982834,262144 --variations-seed-version --mojo-platform-channel-handle=2552 /prefetch:13
    3⤵
    PID:4092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,1877474663603687850,16555675421237704081,2097152 --field-trial-handle=2152,i,14197305568074465328,9920947304451982834,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
    3⤵
    PID:3860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,13290446264321985932,11291680695485552922,2097152 --field-trial-handle=2152,i,14197305568074465328,9920947304451982834,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
    3⤵
    PID:396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4152,i,10367619043974747767,10232085881479813874,2097152 --field-trial-handle=2152,i,14197305568074465328,9920947304451982834,262144 --variations-seed-version --mojo-platform-channel-handle=4148 /prefetch:1
    3⤵
    PID:4944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4212,i,5686696089156360020,495714539677961776,2097152 --field-trial-handle=2152,i,14197305568074465328,9920947304451982834,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:9
    3⤵
    PID:1120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4256,i,7823426583509655559,3859318509872405558,2097152 --field-trial-handle=2152,i,14197305568074465328,9920947304451982834,262144 --variations-seed-version --mojo-platform-channel-handle=4168 /prefetch:1
    3⤵
    PID:1604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4348,i,10398215752277209744,13259007658239666758,2097152 --field-trial-handle=2152,i,14197305568074465328,9920947304451982834,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:9
    3⤵
    PID:4688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4968,i,1390075673204869946,14191802190148456506,524288 --field-trial-handle=2152,i,14197305568074465328,9920947304451982834,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:14
    3⤵
    PID:4880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4240,i,11945475256960149678,8242183917501628884,524288 --field-trial-handle=2152,i,14197305568074465328,9920947304451982834,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:14
    3⤵
    PID:4760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5296,i,12445911508248086205,15953021297735144689,524288 --field-trial-handle=2152,i,14197305568074465328,9920947304451982834,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:14
    3⤵
    PID:4956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5264,i,17179983368001474992,11929764064712913571,524288 --field-trial-handle=2152,i,14197305568074465328,9920947304451982834,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:14
    3⤵
    PID:3896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5592,i,2262476912072412543,1244067571244303714,2097152 --field-trial-handle=2152,i,14197305568074465328,9920947304451982834,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:1
    3⤵
    PID:3996
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6240,i,6140842306890925499,4214872285399605005,524288 --field-trial-handle=2152,i,14197305568074465328,9920947304451982834,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:14
    3⤵
    PID:4172
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6240,i,6140842306890925499,4214872285399605005,524288 --field-trial-handle=2152,i,14197305568074465328,9920947304451982834,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:14
    3⤵
    PID:4440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6308,i,16195201108038783546,15470747152025843268,524288 --field-trial-handle=2152,i,14197305568074465328,9920947304451982834,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1128
      4⤵
      PID:2796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,9489341247794960646,9925017440484702868,524288 --field-trial-handle=2152,i,14197305568074465328,9920947304451982834,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:14
    3⤵
    PID:3608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6588,i,3541016968417529276,14381749875464878847,524288 --field-trial-handle=2152,i,14197305568074465328,9920947304451982834,262144 --variations-seed-version --mojo-platform-channel-handle=6592 /prefetch:14
    3⤵
    PID:3720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6540,i,16460930592982891811,4480618714332642084,2097152 --field-trial-handle=2152,i,14197305568074465328,9920947304451982834,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:1
    3⤵
    PID:572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6612,i,18008325248026022501,11396667924455002808,524288 --field-trial-handle=2152,i,14197305568074465328,9920947304451982834,262144 --variations-seed-version --mojo-platform-channel-handle=6588 /prefetch:14
    3⤵
    PID:1640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6624,i,16662991729188939793,11247683401263965047,524288 --field-trial-handle=2152,i,14197305568074465328,9920947304451982834,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:14
    3⤵
    PID:2844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6604,i,419687857835337719,4175884839538060059,524288 --field-trial-handle=2152,i,14197305568074465328,9920947304451982834,262144 --variations-seed-version --mojo-platform-channel-handle=6688 /prefetch:14
    3⤵
    PID:4720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3736,i,2760604835090750606,14344500786703717827,524288 --field-trial-handle=2152,i,14197305568074465328,9920947304451982834,262144 --variations-seed-version --mojo-platform-channel-handle=7140 /prefetch:14
    3⤵
    PID:540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=3724,i,12950740031123295796,4352299665509726430,2097152 --field-trial-handle=2152,i,14197305568074465328,9920947304451982834,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
    3⤵
    PID:2568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7420,i,2966473929916105048,538231764733762178,524288 --field-trial-handle=2152,i,14197305568074465328,9920947304451982834,262144 --variations-seed-version --mojo-platform-channel-handle=6968 /prefetch:14
    3⤵
    - Subvert Trust Controls: Mark-of-the-Web Bypass
    - NTFS ADS
    PID:952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4492,i,10291042254211132795,8389697826976303324,524288 --field-trial-handle=2152,i,14197305568074465328,9920947304451982834,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:14
    3⤵
    PID:5708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3632,i,12957173354215252428,5712671980589874166,524288 --field-trial-handle=2152,i,14197305568074465328,9920947304451982834,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:14
    3⤵
    PID:5716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5000,i,9724254571086689652,9457582712879303850,524288 --field-trial-handle=2152,i,14197305568074465328,9920947304451982834,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:14
    3⤵
    PID:5724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=4720,i,12484474723718944297,15053360808475168162,2097152 --field-trial-handle=2152,i,14197305568074465328,9920947304451982834,262144 --variations-seed-version --mojo-platform-channel-handle=7268 /prefetch:1
    3⤵
    PID:220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=5328,i,15531817954896086569,13096468826906708353,2097152 --field-trial-handle=2152,i,14197305568074465328,9920947304451982834,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:1
    3⤵
    PID:5072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=7364,i,9579872182384603106,9736999999209428435,2097152 --field-trial-handle=2152,i,14197305568074465328,9920947304451982834,262144 --variations-seed-version --mojo-platform-channel-handle=6856 /prefetch:1
    3⤵
    PID:5472
- - C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.7-win-x86.exe
    "C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.7-win-x86.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5028
  - - C:\Windows\TEMP\{ECAA38E2-A637-439E-A3FB-D6DBAF9FF4F9}\.ba\wixstdba.exe
      "C:\Windows\TEMP\{ECAA38E2-A637-439E-A3FB-D6DBAF9FF4F9}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{2577E481-1242-4074-83B9-D43508DAC677} {9017DE45-FE88-4581-9535-04BC92E14176}
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      PID:5816
  - - C:\Windows\TEMP\{ECAA38E2-A637-439E-A3FB-D6DBAF9FF4F9}\.be\windowsdesktop-runtime-10.0.7-win-x86.exe
      "C:\Windows\TEMP\{ECAA38E2-A637-439E-A3FB-D6DBAF9FF4F9}\.be\windowsdesktop-runtime-10.0.7-win-x86.exe" -q -burn.elevated BurnPipe.{46DFA0A3-372E-4959-919B-CA7A20F1353D} {3F7DD245-AE43-40E0-95D8-10EE15F24527} 5028
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      PID:5928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7736,i,12910465047377306062,6853700918645909364,524288 --field-trial-handle=2152,i,14197305568074465328,9920947304451982834,262144 --variations-seed-version --mojo-platform-channel-handle=7056 /prefetch:14
    3⤵
    PID:1772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=3624,i,15190516397470234860,15487596896325522610,2097152 --field-trial-handle=2152,i,14197305568074465328,9920947304451982834,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
    3⤵
    PID:1312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=6680,i,7737188288901523738,15579129365420690718,2097152 --field-trial-handle=2152,i,14197305568074465328,9920947304451982834,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:1
    3⤵
    PID:864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4464,i,5698809877042364488,11912620799352920234,524288 --field-trial-handle=2152,i,14197305568074465328,9920947304451982834,262144 --variations-seed-version --mojo-platform-channel-handle=7364 /prefetch:14
    3⤵
    - Subvert Trust Controls: Mark-of-the-Web Bypass
    - NTFS ADS
    PID:2504
- - C:\Users\Admin\Downloads\Velocity.exe
    "C:\Users\Admin\Downloads\Velocity.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:5148
  - - C:\Users\Admin\Downloads\Bin\Decompiler.exe
      "Bin\Decompiler.exe"
      4⤵
      Executes dropped EXE
      PID:4800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2308,i,17232995071749359633,8288982477353553490,524288 --field-trial-handle=2152,i,14197305568074465328,9920947304451982834,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:14
    3⤵
    PID:5656

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1620

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6112
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 9FD7DC02948C7E9DBC80709F5BF2635E
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4624
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 2D559F315671B39443BCF6F27749DFB1
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4696
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 838A13AD6279232F79C9D37281D6FCF8
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5996
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding BFC08F528C82F17484C60EB2A64EE7F2
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4768
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding C633577B5B2ACFA60488A6023FE79F68
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2236

C:\ProgramData\Package Cache\{580865E1-2073-4861-8356-3D20DFF3D50E}\windowsdesktop-runtime-10.0.7-win-x86.exe
"C:\ProgramData\Package Cache\{580865E1-2073-4861-8356-3D20DFF3D50E}\windowsdesktop-runtime-10.0.7-win-x86.exe" /burn.runonce
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6120
- C:\ProgramData\Package Cache\{580865E1-2073-4861-8356-3D20DFF3D50E}\windowsdesktop-runtime-10.0.7-win-x86.exe
  "C:\ProgramData\Package Cache\{580865E1-2073-4861-8356-3D20DFF3D50E}\windowsdesktop-runtime-10.0.7-win-x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.7_(x86)_20260423000150.log"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3096
- - C:\Windows\TEMP\{05050CCC-1D91-4B8E-B186-C359852A5507}\.ba\wixstdba.exe
    "C:\Windows\TEMP\{05050CCC-1D91-4B8E-B186-C359852A5507}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{F98C4274-832E-4638-89A7-BDBF86EC70D7} {E8A2695B-9C7F-44D0-BB45-121931534797}
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:3364
- - C:\ProgramData\Package Cache\{580865E1-2073-4861-8356-3D20DFF3D50E}\windowsdesktop-runtime-10.0.7-win-x86.exe
    "C:\ProgramData\Package Cache\{580865E1-2073-4861-8356-3D20DFF3D50E}\windowsdesktop-runtime-10.0.7-win-x86.exe" -q -burn.elevated BurnPipe.{74FBD066-2977-417C-933B-E3B0C20FC902} {EAA58480-D885-4735-AB3E-F529F025301A} 3096
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:5992

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8d383c728,0x7ff8d383c734,0x7ff8d383c740
  2⤵
  PID:5256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1636,i,14331427034957461188,17505885903020362582,262144 --field-trial-handle=1940,i,15006242513503357541,8786907702323196792,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1936 /prefetch:2
  2⤵
  PID:648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2248,i,7176506938126085769,2147269148541338761,524288 --field-trial-handle=1940,i,15006242513503357541,8786907702323196792,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2256 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:2616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2384,i,10306171673363038478,16045499701650142085,524288 --field-trial-handle=1940,i,15006242513503357541,8786907702323196792,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2564 /prefetch:13
  2⤵
  PID:3272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3228,i,12279697987557506810,10454589311009802310,2097152 --field-trial-handle=1940,i,15006242513503357541,8786907702323196792,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:5388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3252,i,8479873087723165476,2256907032885629308,2097152 --field-trial-handle=1940,i,15006242513503357541,8786907702323196792,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:5412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4348,i,11089907694941927009,7896879786485136315,2097152 --field-trial-handle=1940,i,15006242513503357541,8786907702323196792,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4328 /prefetch:9
  2⤵
  PID:5440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4668,i,2065693954032088756,6790455806121149774,2097152 --field-trial-handle=1940,i,15006242513503357541,8786907702323196792,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4632 /prefetch:1
  2⤵
  PID:1824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4792,i,16253172906234197145,2919347692500662981,524288 --field-trial-handle=1940,i,15006242513503357541,8786907702323196792,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4784 /prefetch:14
  2⤵
  PID:5732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4956,i,13133125503107148947,14080338491130566424,524288 --field-trial-handle=1940,i,15006242513503357541,8786907702323196792,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4968 /prefetch:14
  2⤵
  PID:5876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5420,i,7870368483308872323,507638131781928885,524288 --field-trial-handle=1940,i,15006242513503357541,8786907702323196792,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5312 /prefetch:14
  2⤵
  PID:6052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5752,i,16189861436055074848,5099676905869917389,2097152 --field-trial-handle=1940,i,15006242513503357541,8786907702323196792,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5668 /prefetch:1
  2⤵
  PID:4256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=3508,i,12442356040683341835,12522560306028286527,2097152 --field-trial-handle=1940,i,15006242513503357541,8786907702323196792,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3692,i,5029396431104891615,17092619565896784483,524288 --field-trial-handle=1940,i,15006242513503357541,8786907702323196792,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4688 /prefetch:14
  2⤵
  PID:3660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4612,i,1015181133557654312,16196131977533671704,524288 --field-trial-handle=1940,i,15006242513503357541,8786907702323196792,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3516 /prefetch:14
  2⤵
  PID:5060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3468,i,8715860658297675873,536694425737417522,524288 --field-trial-handle=1940,i,15006242513503357541,8786907702323196792,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3852 /prefetch:14
  2⤵
  PID:4936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=4436,i,6417381570566927065,16795950225095983971,2097152 --field-trial-handle=1940,i,15006242513503357541,8786907702323196792,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4456 /prefetch:1
  2⤵
  PID:5016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3252,i,3032048403321454380,1467199586877428239,262144 --field-trial-handle=1940,i,15006242513503357541,8786907702323196792,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4472 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6036,i,2543810390581629896,17527399100713239808,524288 --field-trial-handle=1940,i,15006242513503357541,8786907702323196792,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5388 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:5376
- C:\Users\Admin\Downloads\Fishstrap.exe
  "C:\Users\Admin\Downloads\Fishstrap.exe"
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:3692
- - C:\Users\Admin\AppData\Local\Fishstrap\Versions\version-2e6461290a3541f5\RobloxPlayerBeta.exe
    "C:\Users\Admin\AppData\Local\Fishstrap\Versions\version-2e6461290a3541f5\RobloxPlayerBeta.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    PID:2752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4524,i,8826946039018465434,2427313306340011754,524288 --field-trial-handle=1940,i,15006242513503357541,8786907702323196792,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5564 /prefetch:14
  2⤵
  PID:6316

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3924

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4772

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5688

C:\Users\Admin\Downloads\Bin\erto3e4rortoergn.exe
"C:\Users\Admin\Downloads\Bin\erto3e4rortoergn.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:6240

C:\Users\Admin\Downloads\Bin\Decompiler.exe
"C:\Users\Admin\Downloads\Bin\Decompiler.exe"
1⤵
- Executes dropped EXE
PID:6428

C:\Users\Admin\Downloads\Bin\Decompiler.exe
"C:\Users\Admin\Downloads\Bin\Decompiler.exe"
1⤵
PID:6584

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e58fe63.rbs

Path C:\Config.Msi\e58fe63.rbs
Size 10KB
SHA256 445ca6a0b5b27c9f10578ed2ad7966635ddc8731130b49ac400ab673d7976361
MD5 166a061af4eecfcb41ec09732dad6493
SHA1 20564c8d79c989fbdb6b2d2cc353c09644dce62e
SHA512 bb811bb3b96d070686ce3e37daaba4bdb309a9d248df4402b23ae932218f613ebbab17d29f350a9a54a53bc9c14d1dd4769556e0e6e2bbbb610762df3e9c0e5f
SSDEEP 96:mIvJrAQCtNa1n81RdCzZEQUHheD2QPuCsThqJUHheD2QPuC6jlF3MeThqVH5iyEr:mKStUhgC+vmNIbmN6OEc46kdpb
TLSH
T138223F01B640C2D3E89B0778EB131B143BBBC6EA5710839F01DC95B84F6A78C5FA81DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58fe68.rbs

Path C:\Config.Msi\e58fe68.rbs
Size 8KB
SHA256 55160710f6b5954d569355d1120ea6ebce8b562951048e77bf2849989029ccf5
MD5 bf717edb71a1e0c5f6f06b74ceba855c
SHA1 1047d4c31a1f3571c66a69cdaf44de5bb225e089
SHA512 95493af9a685c9c10a7a3aaf8d72b4f55772c2b51b658e394c51e78d06ef6c35d3b0c5e03aa1970a60b7d048442826cc2bd995704f1da59aaccc08479b745b63
SSDEEP 96:XFeI07BxAjrZkzCX8WQUHq2eD26sPuCsThq9UHq2eD26sPuC6jkzdYeThqRH1iU5:XF90LauCbvTNInTN54EKHV9dpH
TLSH
T13F121081310186E2ED9A6B34C3871B24BFEBE3D79611135F25CD52605F8A7C93F642EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58fe6d.rbs

Path C:\Config.Msi\e58fe6d.rbs
Size 49KB
SHA256 605d9d328813479d116e04ab1f849db6c1e85aa5ea32221b4d776d3d99a6c164
MD5 5da78c5bc7dee8c0c2f2af29ad3dc6ab
SHA1 412d7389bb4374650934a4c8d325b881001fe238
SHA512 0ead337f7fcd82e09c431d4365a9318d64019fd0a8acfb5fc82128c1edf4e19eb2337989e2e7d340aeb095c468d66ad73a415dcd04e556427de92d241ac5a6bd
SSDEEP 384:TV7ONK0DLsrmMwoXlhkOI5RBMgumgKtaz0XHpZtcMq5UGRWBHNfrL/VZih/x9f9X:TpWilnAThuthRxlWfxArH
TLSH
T1AB334320AB05D2E3FB226C7133E1DD08EF1ACD627744DDA914C61665C5A3DAC3EE885B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58fe72.rbs

Path C:\Config.Msi\e58fe72.rbs
Size 72KB
SHA256 f7ef0814820d05b39ad947765e6415dce89b16c9990b72dee792c1231d98ea0d
MD5 0fbe7b47fa0c4fe6665f16933fad499c
SHA1 29f8dc99dd659f5edad632f6bb4a9602b7bb35fb
SHA512 edc30eb6280b94d8cfc531839aeb8473b95fb582f899ea8226b4401e62f4ca2dccc0d14d51ccccc7e43397d29aecc56f55ac70fd3cbb837d09c8b59ebac9c0b2
SSDEEP 768:xONxqMomkns8EnoLou+PTcKsfNTGKJL040iA0qTR0P1wKaq00a/UzZYemq0KYhk3:INkNCnoLZ+PTlUN7umeGKymciu0KYi
TLSH
T1EB731F464B91E5C5FB325EB176B7EA4CDD035CBBA292493D20C9252ECDB3D882EE44C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58fe76.rbs

Path C:\Config.Msi\e58fe76.rbs
Size 3KB
SHA256 6c56d97082b9f0de13f8ec96722590b865036408aa6b1a71654f80d4b60ed993
MD5 ee183e5dd2e61828f1b34b89e0da0e0f
SHA1 9ae303ab572941d2cc375bfd1038d3a985163530
SHA512 fd524dd4a3a563ed60fabbf032f1b4c210de7b3229baee8d43b08fb9d217c0a15ec65e4835673f3f98bce9429dbe6e90e78712ce38214f49f1fecc0b054d66e6
TLSH
T19981EE03EA40E683ECA32F30DD57071A3777DAEA8311834B10CCD1754E4BB8A9ED6689
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE.txt

Path C:\Program Files (x86)\dotnet\LICENSE.txt
Size 9KB
SHA256 7f6839a61ce892b79c6549e2dc5a81fdbd240a0b260f8881216b45b7fda8b45d
MD5 31c5a77b3c57c8c2e82b9541b00bcd5a
SHA1 153d4bc14e3a2c1485006f1752e797ca8684d06d
SHA512 ad33e3c0c3b060ad44c5b1b712c991b2d7042f6a60dc691c014d977c922a7e3a783ba9bade1a34de853c271fde1fb75bc2c47869acd863a40be3a6c6d754c0a6
SSDEEP 192:ydP0KvBLCqikR/EgGJLrlwD+eilNi5Py1SDeoDXDw9lF5OMz6Q:PWBuqikR/EDJLriwlNi5KI1Tw9lF5OjQ
TLSH
T1EC12B57D7284177109D207E16A0AB9D6F62A953C3117AA2438FDC15923AAF2CC37F3E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ThirdPartyNotices.txt

Path C:\Program Files (x86)\dotnet\ThirdPartyNotices.txt
Size 77KB
SHA256 deb4427a295e1ed474b0d81c5a0d972c1b550b9a715cda939cdfa9236b1b418f
MD5 0d8867a25ba926e6e40cd52ab3536b5c
SHA1 89390dc8b8318d0bfef1c6a2fb4783537e28a465
SHA512 317ca335405274f4f91b173651ca2826760acb5ba5cf41aff51adc55c2cda9059fb268333665f13f62fa48119e55a303720a780dd58d28dd9967db4c88407d61
SSDEEP 1536:HA9jHwsGfgg39/zwgAVkguQxrDjugtSEGepkWvrpX7anuqdLSVnfiStPq+3LefrL:HA97w/ogz1AVxuMjHtSFULryLOgrGWm+
TLSH
T17773A45F7E45077319E2C3916569A8C5F22FA02E3B6B2A44346EF248133B42DD6FF858
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files (x86)\dotnet\dotnet.exe
Size 141KB
SHA256 8b6be8b21aae8f21fdfc0e15d350e072bd84e439c4d99e1ee8b6f38a61eabb5a
MD5 f25f2493a974dd8d01fb9410398c094f
SHA1 f6397f4c97ea07a57b846ded5c212b84ce0b25c0
SHA512 81f932c605c96e68e923e37c83eca1e1b24147b5435d3714d298ed1fb6f63ba2663d760d36441921ed80c923b0086a05ee5a27df1f853169c8d29edadcfda4b8
SSDEEP 3072:0078iKA/8gNs0xphwaNq92hxQOA7qVy2nY:0umQphy9z7qlY
TLSH
T1C5E3F725F9958162D15D1970CB29CE91BA3BAC619BE1E0C763C0FDBE0B701C0AAF5B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

state.rsm

Path C:\ProgramData\Package Cache\{580865E1-2073-4861-8356-3D20DFF3D50E}\state.rsm
Size 1KB
SHA256 a19dd723353b655af63146c5a5803f7443ac7d12dcec67794a96fc1fcf337b53
MD5 228f397fe4d0e0507e0efef78c68a831
SHA1 7e8a6eb7ef27f73d251adbc471e4ba5286fc499f
SHA512 353f76efee175efe71d40f09c0a024060c51cb1dd7ca90deda8f4edbd79f2f5d67e3da24517a352140043f43d844b6bd3877e56ed2d24228497127a96b1f50f3
TLSH
T14E2181615BF6192CF3F2AB35A9F96729543BBC125D24C16E0001318A9E72BE1C8B4B33
MD5 SHA1 SHA512 TLSH

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 5837cbe04f74f1fdd5c71fbd828b36d8d8bc0be7b08cf28646c60164c7a9e39a
MD5 a976c57f8d9ff3172c758d1f33058ac4
SHA1 75865cd8a4f3678e7721e058f6073978def30a50
SHA512 e9ec30526c22af6f83a967437feb4df2f772fced593fc8340170c0064cb60ebf161612f0b8c38af08deac7d068d1fa6d5a6333161312ee4500e0519e522fb2ff
TLSH
T113E0AB9EC9318C2305FC0B2860140346E259135A3B50441F3A3C820C4FF1A3A464286C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 840B
SHA256 19c29a4c96d8fbd3dc4f95512d97fe72d8349cd04cd79a05e9c009869d24c794
MD5 d842798c07e934dade3dce2c928bf496
SHA1 d241d9c83670151b922e70871fa970b07e5a8eef
SHA512 e46adf50de83711d0f8a6335a14c5618270daedd61ba4f8519c3abcf8962d9b793c4a344b06dc10a4e2f64a69df8ac7b74a1db19eb7e5c3e27c411a44a51ea03
TLSH
T1A5014F19E02DD241E733B1BAC8C449B0F0BC0B802963BE7A81C11FBD1A4E27DC843657
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 4632c07250aa700c964fa72945e75a093a37452a87c1729e3783c1c36e78f520
MD5 18d022a6887c9639d058b90031f5c57a
SHA1 fc3083e02b3f5016663285f432d533db0a82430a
SHA512 384b69a3b7bfe15b0532d5404e59d778148dd8cfbdcb74ed33d51fc0b160e4df38fdc4a00992e601ea3a378376be73c4260420d8b98d8331ac3c4e428390b772
TLSH
T10F713F31F4D9C101FB21A13180C04C74FE792A89BB47AF265CCB057E61CB3E8C9A2557
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 39ac3af0a8881457dd31efbab74ca68ec8326c77c69fe0a221150a7e8dc05ca5
MD5 806c461e72bf9a5ee029edaa059e605a
SHA1 26655016391045a2dbe4d8275d242106740db8a2
SHA512 327dc2ab80643bbf2f83780ab17da5d09d0122b7cdaf8c89a0eeb7d34e1d1c90f0644124a1c75370112c95c8d44bbf7ae26005f6d55e1d243fbb651dc6e3850a
SSDEEP 192:DXKv25PR+mKmMIaaoWPeqDTAJysXWZJjJcJ4mZJHm9msJm7JmDmt0mgmK:DXKv25PR+mKmMIaaoceqDTAJysXWL9S4
TLSH
T1C1F1C0F7C3E5866EC91156F4AB156F1FCE290628431C3C6AC8D4AF4B93E2872D211B5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 b38085f1ebb3174bab6136eab71fef8db06ec98cebfe0d4ea936fbe3caaa87f7
MD5 f5dae9c89c8699e1cfec08fcc2e8985d
SHA1 1581d37bd37c3d970139315d5d334e5293943d43
SHA512 de2d339189c7b7b6b4addf5462679b1d59a67d25b11d71b16ffb86d44c766c8ece015d7bc2ab72132fd33430d73c0d29d4b63d5b7807d90bfa54cef20f92fc36
SSDEEP 96:DXKv25PRxAIaaoWX/eqDTm/JCfC/JIWOor:DXKv25PRWIaaoWPeqDTAJysJIWO2
TLSH
T17FC1A1F7C3E8866EC81156F4A7256F1FCE290A28431C3C66C9D4AF4B53E2872D211B5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 9dafc1e84702fdf9ded61a072aff5eaa6e92ffd23e47ddd2ca5f9f1136b00ce2
MD5 90005d4d7d7959ce44b75073b9e209f4
SHA1 b6249ba9e291f36660ccdc09cec8b83486fb0af0
SHA512 aabdb90e67cf60f98a57d8dd2bad223e26cc8acaae821b8735855b3f48316bbe53ae248c82207cebbdc7202859b225b938cfedc52592ed5d24e5e0c7ca29c7d3
SSDEEP 192:cRScBz1Bh6lWivsv7HYhAPRp2Nn0s98Hsb+WNtKK714Ps2ekgE6ekw2iCVyIsnA4:cRSmz1M4E8X06wDT23gEDWx8
TLSH
T1D452C72EB95465775CDBC22DF921F717D7F5202161A41EC8EAF88A2C00E76CD6227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 215f5ac50331927fcd39eb1a1e1d654aff16bfc7ae0b5ffb5ec40ad01443e1a5
MD5 8f95d1572fbb0b54423f6ce537d0944e
SHA1 8e4c07efce804df21e0850d17209f87a5918b695
SHA512 72718594e6602c2cbf542e20466252c3bf3c293af0406cdd3a826ce27c0f7c7ebee4f8d9cca938e973b9045c189426a84ae81500ef08f01ec3c0f9e8397dfedf
SSDEEP 192:cRScBz1Bh6lWivBv7HYhgPRpqNn0l98Hsb+WNlFKK71Zn3c/Ps2VakgE6ekw2iWM:cRSmz1MREIXZ6wB1r2VzgEDWPe
TLSH
T15162C82EF95029779CDAC229F912F717E7F5302661E01E88EAFC8A1C14E76CD2627017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 cc41640933ff0e9d3f0d725f7bb326e35042dc20943abc9111d18017759a4295
MD5 4887ed9e0514eb6f6ea3247722839855
SHA1 7146b9e220477b5145cd3752febba77b4d88a928
SHA512 104f2002c335832e51b4774131c194e077de0ab0cb2def6e2be5a0c105df7f7b8a1c61291a6425794720cfbf039496301712e0dbcfe7bd667abea096ae473e2f
SSDEEP 192:cRC1Bh6lWivxv7HYhAPRp2I98Hsb+WNnK710tkgE6ekw2iCVyIsnAUgtaJ:cRC1MhE8XT6wY0SgEDWx8
TLSH
T13842D82DBD54757B9CCBC22DF922B717D7F5202261A41E88EAFC8A2C15E76CD2227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 efc2b0c1ae1df1883d44ef0a629850306a948519097454f4256796a6e5f2812e
MD5 3ad840650ba3590af0d76ab9af6f6364
SHA1 b7f6d7183c9ebba6300dd944356f21bcf2240056
SHA512 d93107bd295a9c7616b02e5a40e8794795c06232edbf4e4746b124d98e82f793c5d04e67d3daab72474a7ffa573286793d55e4e3c5eca2fd534903464d9f82e2
SSDEEP 192:cRScBz1Bh6lWivSv7HYhAPRp2Nn0s98Hsb+WNtKK71Zm9+Ps2NZkgE6ekw2i6Vyr:cRSmz1M+E8X06wD2J2N+gEDWFe
TLSH
T1EE52D92EB950657B5CDBC22DF911F71BE7F5202661A01EC8EAFC8A1C10E76CD6227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 973ee2b36f750573ad45b2a708f3e1c7d521bd1ba4903a4a0b78cd49b354f01e
MD5 04ecf090c6fa240fcbfad221e64b139b
SHA1 257f6e3b7b5e4a0f6441999a6e783425edd5804c
SHA512 5a47e8086c4fd80fe68ee83b8d2d65fc887bc58846b3d024abc99887a52fe2452257a4b66d18494afea6f3fea094ac563f5adb79fe35a73e8aa1763d69403a3a
SSDEEP 192:cRScBz1Bh6lWivvmv7HYhgPRpqNn0s98Hsb+WNtKK71ZSB+Ps2QakgE6ekw2iWVK:cRSmz1MvSEIXw6wDmJ2QzgEDWPe
TLSH
T14852C82EF96465779CDBC229F911FB17E7F5202261A01EC8EAFC8A1C14E76CD6227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 d4c22f8d9a4c777e2cf807998aa81d131ab55b830c93cc539e494d6c7294c588
MD5 c647b2b29fe5c488290c39b3ead2a984
SHA1 ee859c930528b5f66a3323bb77c232c11029c5e6
SHA512 fd63a8d7555a71ba4bc0ef0f9cc196e0c3d4a4c8a9c553731bae60acede8264ed80fd444f2e22f98242dfe078f54e26f70f6ee5735d475836b62657859dfb661
SSDEEP 192:cRScBzFBh6lWivGv7HYhgPRpqPTnotl98Hsb+WNl4cK71vwu7n3c/Ps26akgE6eD:cRSmzFMyEIXB6wk1Lr26zgEDWPe
TLSH
T1A962DA6EF950297B9CDAC229F912F717E7F5302561E01E88EAFC8A1C14E76CD6227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 2328ea9073549adab02fe99e0127dcb5999d2517b99cac1f85861fd5d1268867
MD5 40aba898dc4efcd9988ec53e06a8b15c
SHA1 af8b73cd37e29a8d0b68b474702174d179201fac
SHA512 1f184dc588afff9f591e8a55398deb52c19ccb2c739739b1384e2a6da49836e5a8171b750e21fad998d39b550d8f4906b846178327f24be8db946220ec5b5a8f
SSDEEP 384:hTjVw7KxkXqKf/pUZNCgVLH2HfgslXa7pLuLcif3yXODVw+ErU3L5HGcHRXD:hfVw7KxkXqKf/pUZNCgVLH2HfgsVa7pq
TLSH
T1D172FA676C4C9A770F94CACCDD27BF4FADB9024B65E9886443FA981903D5ACB010A1F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 50a547e7ddcce5ab21b4946e5f9df41057193ee182163dee0be954a2c588c2a6
MD5 ed5174606a6c86cc57f159c9342eb1d7
SHA1 4d7cb0d95f4a540ddcbbf4c0f5cc563de88b567a
SHA512 bbd65a326c911be8cf1d77f09dbd0574c215817700fe73ca3b3d4c26afb8ff36f007dba2de6e2dee2ef2488e8972b08f53cb10ab820db9c5c84cb9755643772d
TLSH
T14DB012A080039902C05302F4158644D83264DF10AB09130553E0AD75A826190C024161
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a1c92.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a1c92.TMP
Size 96B
SHA256 2ddbbe88410eb3726d91b03c429d156ae5be2cabb5eedec0c7875464cc91c938
MD5 2f81f2876fed94c7ce35eccb2498513b
SHA1 f4108734b904b2672dc904ad21c056ac07de3087
SHA512 146c6a422eda0b8bca7f6e7f6759494dd41746369fb952ef3c553cf67ac0fae601af9c5d873d18dca36f056721b611b5434ddb455cac2027e19c0840bc733737
TLSH
T133B00259C263A262C04743F02D99D5E871A0EF25EA031216E2E41A67DC2567545255AC
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 194KB
SHA256 bdc95d52afbd39777f9d7c76bef396aa9f884a127145b0f10e7ae4f9a684901d
MD5 20020fc25d31e2edaf34a7c145f8ef29
SHA1 766a1f960efbc3381f0cc45883b3cca29b66d60c
SHA512 ed3e11714c3836ab1a7a3ba241c4d4f50a4e5b8aebe1ea96ac5859c9e1ba8e6e1151e76d1302ad3f9010ae2ac9628dc26948a14b50e55f2fc158b959bd101f54
SSDEEP 6144:M1xHhQ1pHPCegFwawjDk++JjcMW2VcVLa:+G1pvG+awH2OMWM
TLSH
T1E1141265FD1F3C736B449742812FBECE48D1FCDB00058B786289BB49209A7CA675BD68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 194KB
SHA256 705abbd03389ec0a7654b799124ca520a7991274a45bcf885380743cd08de593
MD5 3a6ba6b6b673dac5bfac2237f8a7cb62
SHA1 52284a43882d3004a233753c477e3731b6b962fd
SHA512 9d1a89ccf28e37df6f6684116a1167d87c0fdf541c5bcee295a6fdc60a2d4d0aa8babf526780e1fa5f4585ed47a5cc7d65b33e03977ad43c3d3e9103eb43223c
SSDEEP 6144:P1xHhQ1pHPCegFwawjDk++JjcMW2VcVLa:3G1pvG+awH2OMWM
TLSH
T1C7141265FD1F3C736B449742812FAECE48D1FCDB00058B786289BB49209A7CA675BD68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 195KB
SHA256 4246814bd9c54c842c9e19f649c8e5e80a972949d14d00266e34846786c62d75
MD5 29770355426d628b2239b073524df23e
SHA1 48480bcf2cc30edcf7fa09c792d2e242d00ac02a
SHA512 1a1367cd2535365aeea896805fcf9325c51baaee64c1cf1767fb930f8596d81717ccd47648b643b7c0ed64fa2fef489924a137cba34da9fdac31c96673421ca8
SSDEEP 6144:c1xHhQ1pHPCegFwawjDk++JjcMW2VcVLa:OG1pvG+awH2OMWM
TLSH
T18F141275FD1F3C636B549701812BAE8E8CE1FCDB10098A3C6289BF4950993CAA75BD64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 195KB
SHA256 0535cfe40d842c91789802aa135ba1c469bea2c34ef85e34d5da3e22cf8989e4
MD5 63bddbcac1c4e214664a0e100cc1a9a3
SHA1 0933005912a12e35e15e1d0a685aa5f38e94384b
SHA512 799dd54b82e43d2f92ea77c8bd4dddcada34eb652c0ea0d2365c145f856a085c407a4fb8c68c5d49c3d57d15728ec98b61f4b91de702bd60e98438ab7ebb4d0e
SSDEEP 6144:Q1xHhQ1pHPCegFwawjDk++JjcMW2VcVLa:yG1pvG+awH2OMWM
TLSH
T157141275FD1F3C636B549701812BAE8E4CE1FCDB10098B3C6289BF4950993CAA75BD64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 49e336540789dae15be34d7f0277731bc6c8f43d6907692d3aea19416f92b10f
MD5 a2328b77a8c12bdb882cf4429a056a35
SHA1 c819d8997253212e8f2e9d0554c7c1359d3d6abc
SHA512 be4e44dc9bb4a7d83a0f5b829996bcdebbc0fc6eabac4ed68557fbd8e89c516b2bb7f7dafb821c0924a7616fc87d1891279f305d64dae389569384ac4ec97e7a
SSDEEP 1536:wSxP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNA:H++J3qUQm08KMWF0bFTcVHr6zf
TLSH
T1149312B9991E7D79236FC396A0179CAC88D3DCDE151411BC30C76F1E14BB392A31B8A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 cf0266ac99d59d8e7bf7d06daaae58886aa69f3d629c74fbbf7794adfd2219a7
MD5 855c93f4f21d237e49deeb0724f94d4d
SHA1 9ddc8ddc10d3e5b48f893c6a47c2caefbff1140f
SHA512 0ffe3618dda92cf0c32f53b88d8586e4100a7bf6ff98a8c85877c4ffa8b392b45a5f3092f9ce911a0b58f4fa82e09244626a391f4deb58dc0c7adc95b0ed3fe9
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P71:fwUQC5VwBIiElEd2K57P71
TLSH
T151B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8648dbe7c6ccfd26bf551adf1fc6e3265815ce5ea5942267fdb3d8494e49ccaf
MD5 0d69a24f0c5199062814f3276a0e0425
SHA1 1689f8b116072314ed6419bdbf045ff11d1d2f1c
SHA512 1609905f1cd06a7538f4d74fe58e56421156a96ae16f40de19041369554941dd25cf283bb0eab1972345de9fc7fa8406d01b16d3ec09b21fe116537aaa21605f
TLSH
T1CDD0A73076D5F009C3751137865191602B5E844225D34090B255815DD45C6BD6BD9686
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 eacd218daf22fcefbc23ae70ce919d8ac95b89c3f7d038f647296c47a218fc46
MD5 35b0754e7f5b0bef0f59e6474c3c9e30
SHA1 a5dbcd61883043544b184e46e47beb3bf5d259a8
SHA512 0a14f00d3bf385bd104004e3adb021fc5b135483b30669a0f446d235f67bf00d734e76a56ac18adc3d6765163a992c78b2c6833f0e764506a9c06ff2ad8fc90e
TLSH
T1ECD0801452F17C64C2E65975484677153D1DD4E346C3537225A3267C4C461881C953C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7173f2853e3b591f142ed047bb6a2ea62d5d817f9016fdd31efbebd88f820e91
MD5 9093390d9e798f9a4ccc25251c10fea5
SHA1 96837bd82509feb4ca69a53466162950148f0394
SHA512 4db01b0d83eba59662ef7f147a96bb0034c92f2c5d5ac83ceeae12ddc800fe8dbce64d41320c2a3031796e981edc605460e3a1da207a6a9d39812740085a86ef
TLSH
T1A7D0801412F17C64C6E65975484577153D1DD4E346C3537325A3267C4C471C81C953C7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000073

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000073
Size 34KB
SHA256 d27f23c77e9f765ff3b019a8016c04dd8ff4cb4fd2592776283adbe2c3a7f806
MD5 237b4fec77123003fc35c0992efc1a1d
SHA1 1c54b71cc9c55929c2d297f963e4fdda1fb35226
SHA512 3388536be0cc74f5bb77e64723a2908003f382b05614f15165eada4fc25f2d605da6a003d9337b88f9ff16c42e6424a899e52c47954f3df95ed68aaf24b8fa20
SSDEEP 768:tGKnhTmzHW9mqMmKHGGAzrRubGexo7xh5AmhrF01n:tGKnhaLW9x8GZFuaexo9vrFC
TLSH
T17DF2F14FBC2176ABA6BD6FD005F3015796AA2C86D1A3308DF3EC591C5216920A81FF3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000074

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000074
Size 99KB
SHA256 36154547e4bbfcca046f37ce3fbcf2a8ec2fd0626c799e93987d58768e6293a9
MD5 f25b1851d93ed4c6e4cf3502b8fec74c
SHA1 9ec4d7e53a27c68f0f91b1173b9cd2d5dd340833
SHA512 c222460d246609616f9344cc2fe6ec760e3848490015998ad7b1120ddc1e3e33c1e83777b21aa7b69dc75865de7078d718473f4896730f87e4849c9ccf2bb965
SSDEEP 3072:4swg9TsIoA658h7KHkEN05koFaHV4EmMR:JwosIP6WCkQ05kqM
TLSH
T14FA312AF6388E3EBCE0645A0FA25BF3F666043F426A9D3250D4E1007D6D784C47495EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000076

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000076
Size 402KB
SHA256 63be601bd7d5120da10417791063cd83d85c0dd0d4769098429aa52f6f0be765
MD5 02f82b178b5ddcd625f5bb06058dd1d3
SHA1 32082f05a0d2d0c0ae2fc906450326be258bb92d
SHA512 82fc7d3b6949e7ca7aaf430be0600ec86c54d9212a3357a35d00237fbbae87dbefa6ef6b8af3347c9b6c32737feeaeed29b921d9dd88b4a967762b811d9baad2
SSDEEP 12288:0210G5gE4GR5tmF9hRcS/JMjI5zS7ajFdb:T15zNbt4RNOLaTb
TLSH
T1F6942389439A8ECC2D14DD28CD5E0D901F4D6AF0748E6AD708E71F8EA92FC663614E97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000078

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000078
Size 66KB
SHA256 6bc9c246e617d4ebb6d5097c561e90e7d752480a77c93e71d85d4a0a97e68cf5
MD5 216479c5183a5982c2da8500efb790f7
SHA1 2d096e7117251427a984f21e5293be2ba2ca3379
SHA512 aafa123336cf30d98fb04f09495679dfd9f57de70e47f485d74bf8a6ffc146632ffc6af98bf7b73d63b94406bec82f289979f5f5c2cd202f8ed97b08b6dea5b1
SSDEEP 1536:pcv/vhUwcGmmCPykdZemIFlfstxORJg5NzwA4cUV17:m597CaPecg3wTcU/7
TLSH
T15F6302B564EC49DF43A8FE46D26A78F2AC042D71A7974021C839BB01CB79598931BBF0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008e
Size 16KB
SHA256 380afccb5139b58682ae393a8bd7b8fd08ed9b4a835243777b4c18267df61375
MD5 d09bf1fd4f1c1b28182e2b8502e87f23
SHA1 66ef186b540f651cd2e55651ec0b3f235e8e6ef5
SHA512 30156515f1c3be6c7b2028865ff1876a84c1dd0f54222e45be54d2502ac0ae260393e1cfc3ff75e80b928440e308329d9b9503355eea220768c8ed67c427b191
SSDEEP 384:JhooSM3IcEhyL+C0pva3kdApw5s4FbASEL8jms8bmq2e:nSSNMpv8kdV5JEhkqR
TLSH
T18572D1F9BA8D95753A0D9A2715F38053DF8022672FDCEDD0767BD063384488874B74A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000093

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000093
Size 19KB
SHA256 a19a63d9409fcd7c8cc2baff3e5c670d03ce8d82cc67ab011ffacfa6ba1de037
MD5 c49113743999cdf1a086b112a52e7e08
SHA1 70b663f5b46684099e6e1a911e6b107301e5d2f5
SHA512 f9e58a69a1aeb377e7a2e633627fdf852f70782f8dfa009cd1412d4b57f6b257e48eac80f05e79cb55c1abdb6ac2767f9838aa5e52d5943be29c83b715607c8c
SSDEEP 384:vnMA9ahBU1lZUyg+iVP9MOffxo1XLcG8whfGxckzOjGnnXKw1SGK0xd+Bv:3AhBWlZYFMOgclwhe+sOj8/Y/0xd+1
TLSH
T16492E038466CF79339770CF14CBD271C4129BA5A0BE3538997ABD46C1D9B3DE81B2019
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000095

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000095
Size 55KB
SHA256 9bc047ac8fe630eee479777069537697dffcd514aa7c51c6d0fb8ca5b50cf315
MD5 470490b4870025506e6727895e9e42c7
SHA1 10b6cffa1b834ca5ded32882a20c84debc6e0b3b
SHA512 44526c6d5fed54dd34bb8812cb1c4de741efd39dd1650f399a6eab7ab5976159dcf105e1bf86bee8418ed25f1dfe1a739bff24db9a63ff23a33fe49f34de09e6
SSDEEP 768:iLGGEMIJCvQS2W29Fnw1FFrQt9mTwX/1acqUNFsF1jnd1NKCCfAorQAMd:k2TJ6U9RwlQt1PccqZ/jnzNKCgrQDd
TLSH
T1DB43020C2696836F05DD0880C1E6A375B5CADC2165F29284FA756877ECF9C1BB9F478C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009b
Size 71KB
SHA256 e7cf10ce16cd074b2ca5a0faeffc34c351bdae3e920c190abbfbe5322fe34716
MD5 d2699aba0f201c635d5961c9bed09a93
SHA1 1547413661ea30c0baddce8105677180af1d06ec
SHA512 0710f4eec3e60a8a717465aae2d8c892d3b80cd65578a1f2b74c8983893c3d1b07e017713c3e34f5fe39cf007372b4f71f9bb9e24b5199a15eab77e562a34c43
SSDEEP 1536:L86f/GPUJDLdzOOprCMWVayfBn4EvNE0i8BK8K5XOIb+uo:L86XGPUlLgOVhyfBnF1o8QLOIb+uo
TLSH
T1AC73125DC5C55F33231D97FB9FC18894762A80D8CB86B10D375EB7052929E8AFA094F4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a0
Size 20KB
SHA256 ea95b1ef238655dbc2040025d97029aa3dfc95b85d6fe338c1cd70c9f8394a29
MD5 fc8c4f42ba6075218a5c78e70d5e139f
SHA1 519a558aa80067631b17e039ec0fe9522b9f337d
SHA512 ab641bd2fd9eb5fed65e35c6c09d21bf7a771f1972eccc526bf1cdd858180a5583afae50bb5e06701fb9fd4b7369cf9cd4b57ac16db4fa255384cac2657ada97
SSDEEP 384:Sdb8SvpuDNwgPKjLBlprTW7kT2OEHpNlpvmpynyEZzTKykhtT5FPuaLevzbp4Pp9:OwSGNjyjBTW7l34EFzTkhFWaLSi9
TLSH
T13792E1C639A9F308ECB723972756127EB2FD5C313EA1A5E2138101F90D54E417AFD242
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 91bf18f12981b6477bbc7e23fe103ef6bb43141b8446199518f6016a380a915d
MD5 a5189fc95d342dc30d9df74402ee48fd
SHA1 aff32978545a6e66adb2e7532bea777b415bbba8
SHA512 828aa7c479a3f0239ee722d90775c9e2aecfa26c54acc62b5b4db3bb7dab46be11df24cd4877a0283e088cb83dd8ab3ceff295a2e78b2bbbe9a76c4f24e33373
SSDEEP 96:oXgmfybHrTBmne5OzgYm7NDiLnJys9MZJNTjgCKGJQM1USyjN9Yx+iN3gGK:FhBVcz+NGQs9MZ7Tj3JJXRygIidgL
TLSH
T1C6E1AA6E60B8C159EBD1453F69DE5B30F37702A418B72F2741FBE23E9653BE1A020546
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe592c27.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe592c27.TMP
Size 3KB
SHA256 39361590bd0a25f3653a3f218d56a6b3f5e4888591da4ae6c7965b5f0f691120
MD5 ecec9744954374b1562fffa2f8153eef
SHA1 50ef20ebb8db7256dcd6bf422b5ad7453cd56027
SHA512 f52fb93608f673a31c831fb61b656283d6de2a05d491ec21919d27908463396a18005e945b5d4a3c7a747e93865c03360de0addb86e3dd5f1ed01e8396c9a127
TLSH
T1BC61919A80BDC024E7E4517F22ED17387232579808BB2E5B8AF3F47F5652B1200740C9
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 7245446c11609992f34be46356ec112a309a20fbb0e1b31329d41d69aead0105
MD5 ef94a03c90ce0cf5a4576dccc1aab5f3
SHA1 ab3c0b84aa8fb7bb14d1423fc5c39f8009c7c678
SHA512 1df46051826e64bd894a7de78f6cc77c7023c09493bc1b279150f7cc15481dc5b6ee44a128b0c2a94b7ec08e2d817f73c40c6335ee2b510d3ad733f38605c22a
SSDEEP 3:MsEllllkEthXllkl2zE/l9:/M/xT02zA
TLSH
T19F4402086BA04407C5001130449193649371E41006135743249109226C866405C04000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\000003.log
Size 26KB
SHA256 6a75adea6fa6fe0affae5b2cce0ecce56958c8fbfc260725fd2538b5dbd1307c
MD5 cf713366f762c65191f8fbc5f115711d
SHA1 5cc935639e147098d5d491f949492e2fa7c0c0aa
SHA512 9df6d969c9983ff1e7b4b7acae5924dcf264f053bd02e0ae3c7847e29c899ec2bc2a058a3638c66e8cd74c43c90dc7fe1a2f3b18bc46f65ef28b238b6d1212dd
SSDEEP 768:JuCHKAPHyazao4jlDy2ysJpXpMVih3MTuw1:iAoypSMTuw1
TLSH
T18DC2786675F8520AF2BB9FBAE8751BA54C7ABE462C04C85D58B0610D4C72F40CD73B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\LOG
Size 345B
SHA256 9be8c4a4c7e87896eba879438dd4142286733389c53bb497c50268b28b8b980c
MD5 68bc6364cc6e54f111a1f4d38d913426
SHA1 8f1f1f06265d9e1d1b4c3a2e7f53fab64402d7fb
SHA512 3c84d0402a35bc3f3a37c5742362d2841f29a7c37e0665539386a2bf8ff14e0764822d0ca56ee5e878237d046f8f4f99f676d76e34fe4df44753ea16dbd938ac
TLSH
T159E0D87888C9C15B915451E60924FF0BD5A3660FAB8D7D455E4DDC047042188F47D651
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 f518fb4274c98fcb3ec9a3610f64ac87cac393ae46a113d679ae5fbd28a3bbe1
MD5 34309ca1ce9a1e669e367549bf86d661
SHA1 430561e13e57bffc13b1c1f2a0eb48629b4fa5c5
SHA512 902743129f047944e512448838025514b8f221d87d833ffaae765c62a8900a592020d3fd4c7b1c482c6daf7542739e73998ae0ce2e847047381c7c321d989e1f
SSDEEP 192:DRgg4OW38aj6qi5ekKfbdlG375Hp1cz5eGctjPShq4Gj:DRgg4OW38aGqi5ekKfbdA375Hfcz5eGM
TLSH
T1E1D1AAF783B5852EDE1195F0AA14AF2BCF1D0152436C3D5A89E4AE17A3F3861E001B9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 1f535ae54d7b69c6b063648f7bcaa39dedb851c5e8be72f05ce6872ed57c20d6
MD5 58a224414e2b8cadeac9e15410788e08
SHA1 a9e31f6eb2f0ead6540a593a351c6e5057e13bf9
SHA512 a721f6bc241d011256c66402fc6ea4254c9eebb90de0ca077f5312dea57abc646358df9b3ac9e5c750ed391f1ca61f6040efab5de76a6af345edcd75192c3267
SSDEEP 192:DRgg4OW38aj6qi5ekKfbdlG35G75Hp1cz5eGctjPShqA:DRgg4OW38aGqi5ekKfbdA35G75Hfcz5B
TLSH
T1CDD1AAF783B5852EDE1195F0AA14AF2BCF1D0152436C3D5A89E4AE17A3F3861E001B9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 68f539cc4fc87027fe49b809c845ab920b1aa83aefaf512db5c4a167a7e5e9b4
MD5 4a07fb97168572e37a94756fd3f68693
SHA1 c59170862791043582dd6f25d763b28e060b06d0
SHA512 5cd4cd051dc22ec1373e2db6d8f66c257657c0c2b9b5c772881849901800532383f7f438ec39de2849209a94759046e62a0b2b66f0e8aee17e40c72b5c5a9545
SSDEEP 384:sxZOnNK4C/ftsTgaATsQhrO/bN7t/mjH1D:sgNzC/fughG/b/qHt
TLSH
T1E172F85669345A77DCDBD219FA05FB53D6F91062D6A00E489AFCCB0C04E6BED2213C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 b8c8036fd4e3972ed43c6a16b968c6df33125e7fc915fa64b82f12f57bbbf946
MD5 f2079fd0f4dcb97ec2077dd628979c35
SHA1 ac7019ea37ef623e9fbdbce7fd9f5f263da93fcd
SHA512 70da24760c440a99da4e6fa405616244358d09b016860a19ffb9727123d8b4a0bccddde5d5bac8ddd39c2c77f7a36967cd390321feaacb3127548677e8b7ed62
SSDEEP 192:sxZpR4yM//K1Ml8MhC/f1Xs77wBwBSTcYnqdpj+/W6+WNrdd8qdy/Aze0XRh5r9c:sxZpi5C/ftsHwaATcVi/bwt/mjx1c
TLSH
T1F552E916AA389A77CCDBD209BA05FB53D6F5146292900D489DFCCA0C04E6BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 432964a5b11e609a023b92a2d27b8260b6eb4c472cf56a16cfe6cd62a8091464
MD5 28e89bc361f489eec4e9440fd766dea9
SHA1 852331ef6adb2eeb4443f3d664a2ff542feaac69
SHA512 f2a8d9bcabc62ad89d8bc0a5981dcb41c5a52a41935857d2ba3083024d8de6d3f1867ab6cef9bdcc380138229002797abb31320409fe6a8461c221ed9950ac54
SSDEEP 384:sxZOnNKOC/ftsUWv1gaATfQhr0/bkaV/mjocnx:sgNDC/fFY1ghT/bHqocx
TLSH
T17182E846A534497BDCEBD219F905FB53D6F91062D6A04E489AFCDB0C04E6BED2213C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 74d0e09c553eb568b8cc99e537b260a1fc028bcad097130588f6075c6855c863
MD5 92333464bdbd8641171cee2fda5a7cb6
SHA1 3196d3d4a29076279f0700792e561a2042da5b8e
SHA512 cf249c5fc7f38f6678dcda009d61827e5aa8231a4ad2a8cefff8bae4540ac822439c3fb7dc97cf3becb53ec0de973292b01b6e92b2cad433464e800b28d85573
SSDEEP 768:FITTF8J52Hp0vq7pLuLnYwWRmY4QPU8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3apmu:FITTF8J52Hp0vCEnYwWRmY4QPUu1jaKu
TLSH
T16D030C3F2C0CCB7E4F804E9CED26BE8A6DE8018B9698C99447FA454C03C66EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\29f82bdf-5137-47fc-84db-12b63379496e\index-dir\the-real-index
Size 72B
SHA256 5b16ff1d9d954789f986574a9977a00f9023801998ec1a240df39a64b19463f9
MD5 781e72459556cdf2fdb3242faba29893
SHA1 60d5302571f64857d7b89fa1b14ba641e5a01c25
SHA512 280704a188cb1e9798ac319fcc7e15a623bdcf4984405c1f9ccf49aca53ba5599d7b1eea2c3c5a2400258623899201ca601faecc787fee5d74b34e8bf9c3a84f
TLSH
T14DA00220E194404BC50546B0658321B4731C9D1605435B4E84901797CD59E684501444
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\48166f30-78f6-4da5-98a5-a0ff368b9888\index-dir\the-real-index
Size 2KB
SHA256 3f1925154f1559f8474826c3e9225916b1ed0c77f21a06628ad635e37bb312e2
MD5 7af330599055c3acf4fd9053288f9fad
SHA1 c9c19822e1d33076b0facd1c9bbad3d4dd26cced
SHA512 2f512f2442a2394d763f56a46ba9a55a56148bf88da6acecd3818db4fe1ba216d694253c09f37293ba4f85b16ae20ccb601aef9684021008ba75201e9f4c59c6
TLSH
T1E4510A4D8C8B0E27ED7D537210F2046833B819ED1B584707BDEC0675BD8B2AD5CA6318
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\48166f30-78f6-4da5-98a5-a0ff368b9888\index-dir\the-real-index
Size 2KB
SHA256 2fa498cd281c2bdffb4fe489f892bc6c5f0d06d929a8b385c8fb3894eb9b8c28
MD5 48d7ecdb1f086ff8c259cf1188ac944d
SHA1 86fb98923b2c4dcb5c2f630df5a3194ca52fb368
SHA512 e9937b5453ec406efb1173ad6c0a21769f9bcf3f6f4f5c531e9fc109d93c7a604749793e4e88733a62a5e6af093626c1e8c374037aaf6b6ca6846b41c6977f3b
TLSH
T11351B41D9C4A4F26F879167308B7189433B458CE6FE80A37ECEC88B064822695F5A624
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58af27.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\48166f30-78f6-4da5-98a5-a0ff368b9888\index-dir\the-real-index~RFe58af27.TMP
Size 2KB
SHA256 fb5143e1b73e34acaa07f3bb067727106dc0e418ce1ccd4e6acace820ce1ef65
MD5 8725922c5e1cf0107bc7d7c36c68cfaf
SHA1 a5c4bb08fe0f4859b6eb23f43c477c047db183f7
SHA512 02b6b43d77316013f4da1b695b3e30f3f6a65f1e293c76054989aa8bceddc827af22d49008e27f6c497e2cbb22fe4b5229bf0d951db125fa072ea9e248b01708
TLSH
T10551B79E9C430A32C9A0957349CA6465333D68954949AF0B35EC8A33ACC77AD3D56354
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\6193aeaf-cc4e-427c-bbbd-14e288f1949d\index-dir\the-real-index
Size 72B
SHA256 29b2bc9c19dd0225cb6bf3e27b2570a1df9380ebf12f2f3a1bb16204120f41ae
MD5 d5be656fc3e6ab9c3c037d06bc2e2da1
SHA1 42dbe8e928c31bcd2f776f9db8e72d6a6ff9d7f2
SHA512 390a137445b3919ef1bacbb2e9c24e37f7764b5826a5ba851f5e214b40e6bea3fe017f110de089ced8ec7529bc7436ac6d5594b2088961819f74d482d061a52d
TLSH
T1EFA0025C064541C9C244777020E30576627548622A41030248E1B4D98C57244531E87E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59110d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\6193aeaf-cc4e-427c-bbbd-14e288f1949d\index-dir\the-real-index~RFe59110d.TMP
Size 48B
SHA256 82fc39966a9f09850df822a31a25272995c0ad35efb1a9ebacb99786bfbd6e5c
MD5 420698c71874a100876c007d597840ec
SHA1 369d51db0dd9f7d19ebe4eeb7ba07ac4bf88010e
SHA512 6c263fa1c9ff353ec953294ba264bb08405aa68937e92a9f5c92b8894e33849fb92ae38fdbaec24d3629b63ab033f43b63cb4c3782a397b4c236bed90984ef5c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\a0feea58-0528-4786-bcab-29a71cde3c37\index-dir\the-real-index
Size 72B
SHA256 9816513a3cb12b9cf90e4e7df8e956e1c22d3d0b9bb6ec030fb4500c866e5773
MD5 00576cbc9add39f1e1b24f27a08d17f2
SHA1 c1a6b4934c9944e1e84929e0f302845525fd857f
SHA512 7c402e0d132d5ada4b49ddaa8a4beb9cf136a95aad15dc4e26b547264ee4d7a1f0ac116857ca6aca98cce5f5e15c609cd550ed05ed7e04fc1cb316a28b796cc9
TLSH
T1D0A0027452808001D04332BB25A7419176954C5412591705519E814EC8A19D0898118E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59110d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\a0feea58-0528-4786-bcab-29a71cde3c37\index-dir\the-real-index~RFe59110d.TMP
Size 72B
SHA256 9b4a87610c60a01d8d3d655ea1c525b1085419eb12c9a909752576a3b27c4624
MD5 b5362af95eac24a9b639e7989f3e429a
SHA1 f6060df6d70ce34715d1d6bdc3116a411eae3de2
SHA512 2d30fc3abc884a70ca84e0bb408af1e66f787af6fc60af2fd13a790320ebb2af941a3cc5f573cb1e95236ae57dfb716a26085a461a6af04836b274b017f37afb
TLSH
T145A0021447C00016C01299B22552224516819C10111B174751A10885CE5044047424AD
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 476B
SHA256 e4d24f3bb8313f401f77fea0a314486d2fe715edb1ec362391c0305a3d9da75a
MD5 f68cdd67c8e4963f4bade9956c3c3ef9
SHA1 0526211ddaa7da33c7b78a7cb48d87fd641a1d97
SHA512 1fcb74a307f080f72c1e96e578a1a7720aadbd6cd3ef017b6b2f757ad2c40edb9d5adc35c4fb37d16c860ee4dcfc9e7866afbcd02ab7c64f87ec1f622f39f07b
TLSH
T1C4F027B72EFF2C20ECEEE3E2247154A00545BD5DC425EC5F1009778700B1355388EC66
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 481B
SHA256 03d12ad6647c18033a9ee8a121a5a98018cbc102c82186acaf809b4781d08739
MD5 da9c269dcfe61d92e9d6755c79e1e2a7
SHA1 34f6e155ad6cfa4a72c5f91576774e8ecc0f0de3
SHA512 6759b76dd2121b1c8396101c740020ed6021f0cc9d56f54d7ceeed5e65db611b306cf208f5793fcea46eaf051f6eb7015ec062fd4a3ede9481daa8b1a4a8fb2c
TLSH
T12CF027B73EFB2C20ECEFE3D2607154A00545BD59C411EC5F100A778750B2355348ECA6
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 a2540006ec305620246c3bbd7c7dd265499f98781145278f0e8ddf3444092d7c
MD5 166d9b12b109385cebe015337e62b34c
SHA1 c14e77fcb42576866ba78cbfdf2ba5c38b0b89c7
SHA512 a570bb74bc01462da9378bc167340bc61a07a2a4273c43e25bd4302283e8bd87ad261865ee2b75e915158d51c72f59cac842b4c562eb8ca9e0bdbbdb0b72cb7f
TLSH
T125A00228814D5051E54806BC1045655433B1581D82151A42C8B190DDACD114199C1523
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 fb1fe3880f89e8624d4c12b98d7bc5a5e55cef69f32113cfbd65278bdb0928a8
MD5 204892bb8777a2220ab23d0a8aba47ce
SHA1 48219825f17f2e29bb9f48069e009b431e3bebdc
SHA512 43e9c760770e67a4885b2f41659fa36dcf26c0caaffb0d06ba14ffb436150adda66e3a89399ba26d9db16916306437cf74ec59c95d64f0b81c377a3cdddc4644
TLSH
T13DA0022D8356D549C20453B0A0D2019C2A1199550645235284B40459E8721984362059
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58ad71.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58ad71.TMP
Size 72B
SHA256 3f7b70f883cc3c6bb6c14d8a17ffc168e018eda4b8c5bbdb0a2d1b81d0ed0d6b
MD5 9edd644fb60275cceca940b737453f10
SHA1 f9f7d9a26f65c4c59f204dc1e3bcd6f1c3f3d717
SHA512 89126286bb581cd370db06db4e79004bee637ee723c2b9ccc28d7a4ef20b1b9e020878928be61553fd4c7a5c9f7308e70e0253e7d745865279b4f43199044adf
TLSH
T15CA00254828A5420D50845B91015334017A1C85A4014560388A1D0DCECD10D19DC1503
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 612b0c83305ece5a569ebad07c3205f900a02a00d8bb5f9dcc02d959d579e981
MD5 cfd648116437deb9a37b5433bae05bd7
SHA1 064af4f6183601216734e3210660290274420f33
SHA512 911d304cb962716be5de7bff623d96382348ac78dea53c99295c5f4405f36a1a5d765cd3c7d4993f7ad56b344a94329b174e4532f87b319fc8484a311bf5c3d0
SSDEEP 96:KwzeKc4mMviL/tR9gxZQznngK/1nlg73nAFPtCkAK1Ge4gKNWqyqkKnKn:YFbPzaDXE
TLSH
T1C6E12F50713A13A03A7E2D9A90D5B43A96C231633018E4BB7BF945E64B26F60CDFDDC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59402c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59402c.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 29KB
SHA256 d49a41668d33269b38b7a14df425a41be1017ff3225c27bdab136430ba9bf103
MD5 0546563f0465ca5040d7face02aacfb3
SHA1 21335dc11a360e5ab42be2de34942d3df16c5c59
SHA512 6698939745cd96616255f89698961da89f7c4a2bdf9bee81fd856216ab98551c63e6f8c5ca990722c8bf1578bf8ab0362118f3d0749cbaf285863bd261541e57
SSDEEP 384:nZiFejccCs+Bt0S3Y8NB8TUNTUlIllTNZDwlEnyAP2jDfQac/T7pdlnyf37:wFIccQ4cwg9ZUdCrac/5dlnK7
TLSH
T133D2A3F598E3893AE8AE4747A77E7E529EBCC05375845984BBC84E0CCC861BFC706815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 5f7bf056e7736697242cd91cc4e3a9e0da72f003f326c71600be36428de8b5fa
MD5 64980552a46871ca77481295b670e54a
SHA1 890f0be46ab479c129d6f3a738a0301d0702a23b
SHA512 294524e766e7790564cf8ecf87ed7308debd67672eee168735aa107bfc7339cc29cdc3963e5dd6acb352c7b60cbce1bc15c67e0c5bc99f7d5a8632578af08366
SSDEEP 384:nvjccCs+Bt0S3v8NfxTNZDwlOnpAP2kc/T74dlnyf37:7ccQPUZUACdc/IdlnK7
TLSH
T153826B7068B55C3B69E7A508F4877763AFB050BB6A902F9CC9DD8B1C00CA2DC171B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 e8b1c5c22edf3e9482b0a4032488464b6bb9a888015f3be8a67466120ddef0d4
MD5 5cae1c42e77e02f70d5977b5a2ef06dd
SHA1 e57f6b6594570b618d8da28a1bca98b829e065ce
SHA512 8c4876537d98bea4a58fe521751827c95e6370f509440786569bfd592bc7d5b38f6bf18f4800cfc68bc22b07ba619ae13f12199139a73c24731ff01f489f8421
SSDEEP 384:nOjccCs+Bt0S3v8NfiTNZDwlBuAP2kc/T74dlnyf37:4ccQPNZUiCdc/IdlnK7
TLSH
T182826C7068755C3B69E3A508F48777636FB050BB6A902F9CD9DD8B1C00CA2DC170B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ca3302ea31d32b9253d334b24d20f999334f7b2f998ce5e60aac3121d151f28a
MD5 fba1875b07d1cee6d487939ff7d98840
SHA1 cb256b442d90b1553a55e7090551f9eaa0c7f05a
SHA512 dff22dab3758d72e197d5bffdc7e5ec0e1733d0ddf4caf77081a0573b8581cd1e42edd1e0d352ac202507311f768bef42f9d4a13234b5fce2ad2e864ce6c620a
SSDEEP 192:lGN+6IMGEQmiUyYTL6xc/TH1R6e2SepvNWvU6:lGN+6GUb/6xc/Tg8U6
TLSH
T17002093568787CBB9EE3AD44B44776236FD4106BE6952F88CAE81F1D00DB29C1306822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 87a43db014dc14759d222335b92f5f3136ed4ec0b8a3a1ff38e71f653fce77e0
MD5 4591b44acc4a6150f5f57df8eba12533
SHA1 e555d6def776eaf34a93bc0100beec0d7e5c7305
SHA512 4da2eed1449c6d09d694d55c6fb239e0553107d5599e59592e9d0f5f913b9fb8edeb0a7ad1db50906c731bf4d61fbf3f258f657b3f6b3ef3647cbcd126561051
SSDEEP 768:wFuccQI5wg9ZUOCeac/xrsn5t9VDilnK7:PccQIXUDk8DilnK7
TLSH
T19CF26EF99CE3893ED4AE6747632E6E5259BCC177B5A44898F7840B0CCC621BFE706811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 c5933bc39113b5dcd9c74b2223ad148f9dbcb613476d302db04e5b70c8027a73
MD5 3516fd6e3d5d6dd91423c7b0501bf0c9
SHA1 a79c7248db00a98cb5d049a09652075182bcfec7
SHA512 db3c1c2ec14f34548d88882803492a0ceff0e7acec9034ad22df0dfa63de7036f687450dcb1b9b10bface9221d6521bb599218ebabc5f5aec5dd0942504c80cc
SSDEEP 384:nNjccCs+Bt0S3v8NflTNZDwlZnpAP2kc/T74dlnyf37:NccQPwZUNCdc/IdlnK7
TLSH
T1C0826B7168B55C3B69E7A508B4877763AFB050BB6A941F98C9DC8F1C00CB2DC271B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0c53d37736927c99294dde1226bfbff4fa19ce348b4d36271e944bcdc94b275b
MD5 a788410df7e9cbfa3134b50ff66261cd
SHA1 09f503331bb9c59c4f430d00ed76f6e81730e3d6
SHA512 7a59e8514c225731a0dd4b886d8afd5bb7174dabaf9e7bb368b1cf37dbc1d7aa45a63beb17a86fd778f21361855bbd835732a2f3af0a984748b3a3126ada0e55
SSDEEP 192:dGNC6IMGnQmiUyhL7xc/TH1R6exPRUnS66Trq/WU6:dGNC6GJC7xc/T7BdU6
TLSH
T101121A707878AC7B6EE3B840B48736235E941177EE856F98D5D45B1C04DB39C270B922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbb0a1fe-d353-46fc-a973-604a2c0cb942.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\dbb0a1fe-d353-46fc-a973-604a2c0cb942.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

60766fc6-c133-4b1d-b483-9995bdbfdbc6.tmp

Path C:\Users\Admin\AppData\Local\Temp\60766fc6-c133-4b1d-b483-9995bdbfdbc6.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

84c9e409-2b2a-419e-97fd-0697987a0f85.tmp

Path C:\Users\Admin\AppData\Local\Temp\84c9e409-2b2a-419e-97fd-0697987a0f85.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.7_(x86)_20260423000150_000_DotNetHost.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.7_(x86)_20260423000150_000_DotNetHost.log
Size 3KB
SHA256 b3edfc4ce3ed2d3afe25bdbb1fd1f0cfa190ae98b2062d9b334f591450b49117
MD5 0c46ee1f782f3c346e049567832e5255
SHA1 a80921f10dfce70b468be0e631cab389590ce53f
SHA512 035395b686d24bb234328a5f5286eb0b6009eb972f915077388c6e112221f9d1184274d9d9d5f6c17429b54d02aa64d2014dbc9db832035818f1b78007c31469
TLSH
T1CA81FB151AE90954B1B75707DEF3C4239A33FDD2A974CF0C2385831A06ABC06986CBBE
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.7_(x86)_20260423000150_001_DotNetHostFxr.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.7_(x86)_20260423000150_001_DotNetHostFxr.log
Size 42KB
SHA256 76bda1a4c84cfc3b610b468421678e65b05ac93ecda56624d13222c9ffcb6f7f
MD5 40c78cbe8e2778da733453ea4c56661c
SHA1 c61f1a350756291b24c7c97651371a36370a305d
SHA512 6423e3c5379a05d6a9ff07fccfc291dff13d47f265776138849fc26503c8827cd59d29e911aad4996b8a1e4ece90355fc32790f994ed3ce4af8d7c9a581590b3
SSDEEP 768:SvJr4+3O5O6xP/Gkbc3ljmYzj7IkS0eb3IrCZe2ZXvTL2lI/vOgfOWlQYW:SvF4+3O5O6xP/Gkbc3ljmYrIk0OCZe2c
TLSH
T18F13D2142EF40186B6BBAA439EF384279A77F9359D31C50D7182D31D06A1A08DD2E7FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.7_(x86)_20260423000150_002_DotNetRuntime.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.7_(x86)_20260423000150_002_DotNetRuntime.log
Size 4KB
SHA256 df618bb5acf0fa20251bef3384c28bad7669da60331a5241b90e0183018f62ab
MD5 db3d61392accb5bcc84d7353f192975e
SHA1 e51c63e32aad2a20cfaa05cacc57fca254102575
SHA512 3d9ccb10793706a50974f7924233be23882ef5b8674e07988e33b24481c756e9d51a0513b8b88d39529b0b27dc2dc524e0272484ba800f309475a21d53e31ca5
SSDEEP 96:YHD+E+lW4v/O4d17OPSffi/O4d1+jq/O4d1sOxKFM1:SDIO8OP/OuOqKF8
TLSH
T1C7810A241AE40945B1B75707DEF3C4235A33FCD6A970CF5D1385931A07AB9068CACBBA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.7_(x86)_20260423000150_003_WindowsDesktopRuntime.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.7_(x86)_20260423000150_003_WindowsDesktopRuntime.log
Size 4KB
SHA256 ab21d62b6260e868b680b5d5f6a075251aa3a21f77730a76af65b1cd350ec5c0
MD5 478c7fde063ba0e98d9a8bd193109bd7
SHA1 5759a84f8a455c8a270aeab12310ab2b67af3f9c
SHA512 d0aba2947eeff86a1cf4f3f30173eec5d0d7c797ee7e6148e9e614b14d82e52a09fc3ed74834599c6001a6ec5d5ef061bf4690345cfa5337b600e927e953f301
SSDEEP 96:YH4+E+lElxeldulgqd4BmO3myQo7fLiqd4ZRM9cAqd4z9SO98KFMmI:S4tyOOmO3myQoAKF2
TLSH
T13A81FB1D1AE50845B2B397079EF3C4235933FCD59C70DB4D23C5831E46AB90AA4A8BBE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4900_1947412940\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c5920fe7-0d0c-40a5-b236-65074b0c4c72.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4900_603209671\c5920fe7-0d0c-40a5-b236-65074b0c4c72.tmp
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetHost

Path C:\Users\Admin\AppData\Local\Temp\{ECAA38E2-A637-439E-A3FB-D6DBAF9FF4F9}\DotNetHost
Size 900KB
SHA256 efe1a594f21ea09c5c6f3f75d5618df0ff6bb465e1b7a440394eeadf06d86bdb
MD5 6b8563447431316d2fec41888d36a80a
SHA1 12e0efe2109fb356fa980e7bf7575fbd248cc64c
SHA512 9007dcba3c7adcb29aafcfd77e18a398903cb65f53e51b04c351625751c8fb95d29d2cbc34a232feffc95f900af956d7a75c9a7b3e434a079d9c72c41ca39845
SSDEEP 12288:8jcnTi8XiHmGdKkg78We96sI+yDxTYwsoCm1p:ecnTiadGdKkg78We96FDxTYwsvq
TLSH
T19C157C23BC419036D9EA0D72A438CB616E3D7D14279488DB9390B94DFCF06D26FB26D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetHostFxr

Path C:\Users\Admin\AppData\Local\Temp\{ECAA38E2-A637-439E-A3FB-D6DBAF9FF4F9}\DotNetHostFxr
Size 956KB
SHA256 767110859ec26785e7cccf654785f32e3753b545a6c9003d55bd280da9b395d4
MD5 85dcd01ef3e23d75cc9b6ab925f9eb5e
SHA1 64f9491648d78d252bf06c30f042a8def4a203e3
SHA512 a9faab719ffd01d6a6c3ae726679bdc711f9c1311787de148ffc8870611769fe4798a87b6100d0262e3efd04cdcef0bfa7d64316ac6601cff07057d7a8238475
SSDEEP 24576:lcnTiadGdKkg78We96FDxTYwsvqV8iw+f:lcTi8GExDdYwsvlhY
TLSH
T154258C237C41A036D9EA0D72A478CB616E3DBD14279484DB5390B94DFCF06C2ABB27D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetRuntime

Path C:\Users\Admin\AppData\Local\Temp\{ECAA38E2-A637-439E-A3FB-D6DBAF9FF4F9}\DotNetRuntime
Size 26.1MB
SHA256 6fe13e18d56706ab4594ef5e8dc0104972e0a732eadb89383bd77815b4ed2b4b
MD5 94215feca007a68a741c4581fd317632
SHA1 10f54be9bc3ff44c7eb840b2fc3d943d79b22e7f
SHA512 682598c5a654f6af043b194b1b44b70a6b3310560966951278ac4d047e0e44ab9be9e8dde6728e41680bfc4ab7b23799198a4b639100eebd0b47dee6b160336f
SSDEEP 786432:AAw74NDnKORiD9fNBvBwDs6jz+Gws44qirlQmkccg:Aj+PRwFGDjj6G+mkhg
TLSH
T184573327BC836022D5EA1D35A47ACBB1293C7D60174488CB87D0B94EF8F12D19BB67D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsDesktopRuntime

Path C:\Users\Admin\AppData\Local\Temp\{ECAA38E2-A637-439E-A3FB-D6DBAF9FF4F9}\WindowsDesktopRuntime
Size 26.7MB
SHA256 9aa6ec95172581a1a485d4f5208a0c422e892941c9f859b2efc964def9bfd963
MD5 cecf22905b6bc75e8eda547379796581
SHA1 85db3f58fdac544e5854fae2b137c9ed8ac3fa02
SHA512 fcb8309a1d055a2273a2b08ff079be7ecfac48c8d6d8dcbed86ed976969460f93b4e6d25ee486c356da2d5336b7abdc120fa78f3d47e5006bc059787d6809b9a
SSDEEP 786432:xsMa2N2voVo66TV/D2tZO0I/u/3bb9yI4jSW3e:xsg5VkTV/D2tZCirb9kSAe
TLSH
T1FA573313BD83A53BD6BA0D72A439CB1068395C141B54454F93A4B88EFCF12D3ABF66D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unconfirmed 127012.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 127012.crdownload
Size 14.2MB
SHA256 22fffb8721fc41f81accf4f231e2c7c91519a595515ba0decdf2a9239c47f9b6
MD5 ac74f329f193545d07309cdec6322dc9
SHA1 04e49db8dc03dfb29f597bb16d437065650d940c
SHA512 b4626ab94e8f852c34ea32efe9e20aec263f12843b659b226a36419c7308301301e6bf37602571f01b1422b50534d3e4de238c584ccfe3e9a185a91c410ab09a
SSDEEP 98304:qG4JTsyTasI4mlsk+ZmD3XzOYoHwfLk3vSmaR0+Mc4AN0edaAHDfysrTlS:qhxsyusI3sk+ZqObAbN0F
TLSH
T1E5E68E8537FC2A35E3B74B35A970621E4976BC1AA811D78E2B84B64D1A72740CCF1B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windowsdesktop-runtime-10.0.7-win-x86.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.7-win-x86.exe:Zone.Identifier
Size 185B
SHA256 4423e7b7a7e49693d09e6fff75f573ba0a43c10bfc0a9e8040caa0920dc5b0be
MD5 ed9fc2d35e3884ecd183b9c3b23a1c9d
SHA1 80669794b594f34131ce1f955325ad5f5f60ab06
SHA512 bddf79cc48cf6ce80e0506687696f54cb9913f7babec90f355b394b128c4295344d70e4f222d0033b4d53b76c75dc172da06820d416f5a352d6b061316971e73
TLSH
T1E3C012ABC80144520E3032821B6ED559FF0F1D125D81C38898C48096E992AD6C1528D5
MD5 SHA1 SHA512 TLSH

Submit Download

MSIFFB9.tmp

Path C:\Windows\Installer\MSIFFB9.tmp
Size 346KB
SHA256 1caa470031f4f3fb53bb38187d522990a3a7423476b1b5aaa27443a3e2fc62c0
MD5 f715d24632e765c53e9856df53dc8318
SHA1 78e2280ccaeed00119fe827acc58ba10996517cb
SHA512 dd0568de924a86910d8bf59b2f0c22663268004ef9a5f80ffd78f37885f3b8538d138d1e5c70de8e4fda7aab150df48bd34e3838c976ec90ed4f0e49bed0e9e6
SSDEEP 6144:WbOobwWeCg6QvyuFtPwvGyDBQlEz8a+CFTYK0OnsoIcGm1p:W78We96sI+yDxTYwsoCm1p
TLSH
T1BF745B31A456707AE6F90872F568CB706D3CB21827D8849FC3E0E84E38645D36BB775A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_173505536\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

BootstrapperApplicationData.xml

Path C:\Windows\TEMP\{ECAA38E2-A637-439E-A3FB-D6DBAF9FF4F9}\.ba\BootstrapperApplicationData.xml
Size 9KB
SHA256 1633b50661776a39ec9ffdc98ec19e48e0099a08ff5168cc3376137a904ee6e3
MD5 1b7efeed50be6f8ee212995070717d65
SHA1 22c3bc34718c78531cc3b56c312a54a89aebff9e
SHA512 9456bee88d409491723b8aa09ef6348b31119b5ee1ef3ba92a9d5fe7034353852c4e0f97031ae4f99e6ecaa49df5ebf611de83ad99a0c1f885318ea9920de5f3
SSDEEP 96:2BqRBM/En6YcYY0wZycirLdin6sUsD20wFycDdin6UkEc0wNycdOZdin6fMS2g05:2I1zfTK/lvjnlX0OOamagM5cYsCsysz
TLSH
T1BE12E3113BFD0218F0F3AE48EFF6A5555A36BD552E39C82D01601D0E49B2E819962FB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetLogo_256x.png

Path C:\Windows\TEMP\{ECAA38E2-A637-439E-A3FB-D6DBAF9FF4F9}\.ba\DotNetLogo_256x.png
Size 2KB
SHA256 0f571f95d8eab48dbc81b0ec5e9f7225e349e26ef50868bfaab556f3c2443b01
MD5 39aa52615723b782c92dec710caaec7f
SHA1 760b49e256a7979fe50a56a2b1be3688a474b886
SHA512 89d1baa3820154667747b25e9e2fd321bfb2ec71dc309915b0a28dacdc80822a4943b639ebb37c37bd2559d5a4306d2096119cd970c84a0d331f6c68b0456dc9
TLSH
T1534195CF1BFD78D7E6E557918E1A8DD232738483B4B3A42CCE7B10B8274A5642B87940
MD5 SHA1 SHA512 TLSH

Submit Download

dotnet.ico

Path C:\Windows\TEMP\{ECAA38E2-A637-439E-A3FB-D6DBAF9FF4F9}\.ba\dotnet.ico
Size 44KB
SHA256 61a2cbd12868cb9b359e0c78961d409b7875f072eb8e53ea88d3e6bfe2961a18
MD5 b8096652d9ec286709a2c863b244b110
SHA1 b3b7f0f4d608fad7cb59ba499d4d17c2b873a7af
SHA512 492a5aa83220bb77c178b7c5b50bf44968c0427e9e45bb97a33df14d7fb4c667ca7adde0ebb3874c7b6011057b01144e4e6651fbad62c6bcf5e0b93586c4bc7a
SSDEEP 96:r+gfbzo+wHK9NbwOY4tIWQeVlV1W9+H+guapUjFamINUItzf1dBNaIZ:ro5HuNcH4tIzeVlV1WEOFDgUWzf1PIm
TLSH
T1E913EF6DE68547C1C10C2032DB4AC792B5233C72E4DAE0C4F9D4FA7E177906965C6E6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\TEMP\{ECAA38E2-A637-439E-A3FB-D6DBAF9FF4F9}\.ba\thm.wxl
Size 7KB
SHA256 b00edd703dd8a475119d0e4dd70a3aaa47f0e95361af290e76d367a8edef3432
MD5 8b2c667a8bbad3153068c0ed90df7ec4
SHA1 c9e04a3a37e5e6262ab9bfecf78280171b8f7b74
SHA512 5269f00d474acccb4c48cb7bcfdf19e63557a388572d3a6335aa39191319691d924e27f70da3f3495387c319396476c63a8fd7b35835cca0901220e39783847b
SSDEEP 96:HiTgM1+XSNEzA0HtYQstYCpCwZQpCeyk5HQJM9ouvj9urz8:Ew9EmtYQstYCPC9e8
TLSH
T191E1026F68DFDEE03A732651B2B3698D6919C29A136F1CF0F869084B47635016377A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.xml

Path C:\Windows\TEMP\{ECAA38E2-A637-439E-A3FB-D6DBAF9FF4F9}\.ba\thm.xml
Size 11KB
SHA256 dfee8e2d075087227f19c835c145c5bb8e72a46880ea24080bb2472fd3a521be
MD5 4329e418dc56b1386d7ea29a0dcfab5b
SHA1 58387f92e89ca21b4179fb697c7de9675c59142f
SHA512 6934873d27e6efbb94da4f13ee8369b29995490051016fdf82800256b924902306d328bf1d4ebbf266d1a53eb24adb6478d1a67de4ecc3e3bcbe561968f24922
SSDEEP 96:HgvPkoeWEH3IWTaQfSJgHzth5mFahbuB8pR5+Vpwe+UIJLg1gEp+6F5pQnxc:AvoWydmQfVHMyyj5Z
TLSH
T14B42FC6851DC7811C532D702AB9371D3FF12BDA6C6C85A58B48E256B1FF262028B739C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixstdba.exe

Path C:\Windows\Temp\{ECAA38E2-A637-439E-A3FB-D6DBAF9FF4F9}\.ba\wixstdba.exe
Size 431KB
SHA256 2b1cee5e3e24593247854eb7a7c4308937b9c607754ed2fb83520a8706c26f1e
MD5 0e88ffd2e737ac9b9a4241616838bc23
SHA1 3c8beb465d20bcef0cd6ceca9c60286d1d15cebd
SHA512 169b9e08518834c9bc5adfe4ab7b79e07685b72f30ede1c1a386229668bde8c15da378e1274e4013ad7b84d6f7a5acc64ef0806e3b8a66322861efaa7e26b620
SSDEEP 6144:X9vfS1NP+c3ytxmg4Stlqe3B9m2LSLTwGw7C3ZLaov5xZvSdF:X9v+GIyugllqe3wwGfX5/SdF
TLSH
T129943B3165F04037C6F90572AE14FA31BF69F208231095EBA3C0DD293968AE5BBB7657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windowsdesktop-runtime-10.0.7-win-x86.exe

Path C:\Windows\Temp\{ECAA38E2-A637-439E-A3FB-D6DBAF9FF4F9}\.be\windowsdesktop-runtime-10.0.7-win-x86.exe
Size 967KB
SHA256 d7159bd11bc004ee485fb6fd031b71d38e4303721d0665acfefaee1fb97588fe
MD5 54b260b4c45fc5f0438080d937e0e2c8
SHA1 c7838ea3732e2619ba05fa3a9901384eeebf5fc8
SHA512 9a063312880700e71b4a1fe12365918900c033ab04c720ba880b4bc247c635ebacdf36672051948e5a07aa5e4773a2ec92a5e321a303175abd6930387a915544
SSDEEP 12288:XVGWl6qCmyZeU6lqlDjC+fScn6X8GwMgJEQaA6fTQfulZYDGSGPjR0ASh:XVGWl6qCmyt6UdmcpMzfz0xOjK
TLSH
T13D257D31A166242BD6F50973F914D2307E2CD7082B5C95BAC6C0D90D39689FA6FFB24B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1240-0-0x0000000004B60000-0x0000000004BC4000-memory.dmp

Download

memory/2236-2162-0x0000000002C40000-0x0000000003242000-memory.dmp

Download

memory/2752-5883-0x00000187ECED0000-0x00000187ECEEF000-memory.dmp

Download

memory/2752-5884-0x00000187ECF10000-0x00000187ECFBE000-memory.dmp

Download

memory/3096-2180-0x00000000009B0000-0x0000000000FB2000-memory.dmp

Download

memory/3096-1825-0x00000000009B0000-0x0000000000FB2000-memory.dmp

Download

memory/3364-2177-0x0000000001640000-0x0000000001C42000-memory.dmp

Download

memory/3692-3091-0x0000022E8AF00000-0x0000022E8AFAE000-memory.dmp

Download

memory/4624-1532-0x00000000032F0000-0x00000000038F2000-memory.dmp

Download

memory/4696-1554-0x0000000002480000-0x0000000002A82000-memory.dmp

Download

memory/4768-2146-0x0000000002E90000-0x0000000003492000-memory.dmp

Download

memory/5028-1781-0x0000000001900000-0x0000000001F02000-memory.dmp

Download

memory/5028-2188-0x0000000001900000-0x0000000001F02000-memory.dmp

Download

memory/5148-2426-0x00000000031E0000-0x0000000003244000-memory.dmp

Download

memory/5816-1790-0x0000000001000000-0x0000000001602000-memory.dmp

Download

memory/5816-2183-0x0000000001000000-0x0000000001602000-memory.dmp

Download

memory/5928-1821-0x0000000001200000-0x0000000001802000-memory.dmp

Download

memory/5928-2186-0x0000000001200000-0x0000000001802000-memory.dmp

Download

memory/5928-2185-0x0000000000A20000-0x0000000000AE6000-memory.dmp

Download

memory/5992-2179-0x0000000001260000-0x0000000001862000-memory.dmp

Download

memory/5996-1797-0x0000000003100000-0x0000000003702000-memory.dmp

Download

memory/6120-1473-0x00000000012C0000-0x00000000018C2000-memory.dmp

Download

memory/6240-5890-0x00007FF731660000-0x00007FF736A27000-memory.dmp

Download

memory/6240-5889-0x00007FF731660000-0x00007FF736A27000-memory.dmp

Download

memory/6240-5891-0x00007FF731660000-0x00007FF736A27000-memory.dmp

Download

memory/6240-5892-0x00007FF731660000-0x00007FF736A27000-memory.dmp

Download

memory/6240-5893-0x00007FF731660000-0x00007FF736A27000-memory.dmp

Download

memory/6240-5896-0x000001B6A8DA0000-0x000001B6A8E4E000-memory.dmp

Download

memory/6240-5897-0x00007FF731660000-0x00007FF736A27000-memory.dmp

Download

memory/6240-5887-0x00007FF731660000-0x00007FF736A27000-memory.dmp

Download