873fd333cd8e687b874af8dca2f043c50ea1f4bc64d496015ca038da383b91f0

Analysis

user interaction
yes
max time kernel
76s
max time network
83s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/04/2026, 09:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Velocity.exe
Size 32.9MB
Sample260423-k73cfaf19s
SHA256 873fd333cd8e687b874af8dca2f043c50ea1f4bc64d496015ca038da383b91f0
MD5 83da367e14fe39262fcf57c39dc3180b
SHA1 a0d2655ceff2d35b7eceb55e2be1058b966970e2
SHA512 8ce8b77b95640a111d43b75ff76bdfdacfd8680a39c5d5c6a97fdef7aef18bd7470a4df4716fd3c67a51cfed69a710d6c33086c864a0b91ea0c03966b8a97df5
SSDEEP 196608:ktQ56WdpH6emXAro0JTToUgmwh8qZYOCu51ZTAFLzbjblIjvT7CThIPPBrYjPWDx:kt6pHxmXf0J9A8qCFqAFLKnCTMGPWl
TLSH
T1A9779E22A3A44E3DC99F5773E4B603254335CA06AF43939E581CA69C1F933860B59BF7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
80	5776	msedge.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\Control Panel\International\Geo\Nation	windowsdesktop-runtime-10.0.7-win-x86.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\Control Panel\International\Geo\Nation	windowsdesktop-runtime-10.0.7-win-x86.exe

Executes dropped EXE 7 IoCs

pid	Process
60	windowsdesktop-runtime-10.0.7-win-x86.exe
5624	wixstdba.exe
5384	windowsdesktop-runtime-10.0.7-win-x86.exe
1592	windowsdesktop-runtime-10.0.7-win-x86.exe
5612	windowsdesktop-runtime-10.0.7-win-x86.exe
3760	wixstdba.exe
5456	windowsdesktop-runtime-10.0.7-win-x86.exe

Loads dropped DLL 6 IoCs

pid	Process
4640	MsiExec.exe
4160	MsiExec.exe
1420	MsiExec.exe
3776	MsiExec.exe
5236	MsiExec.exe
4848	MsiExec.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{580865E1-2073-4861-8356-3D20DFF3D50E} = "\"C:\\ProgramData\\Package Cache\\{580865E1-2073-4861-8356-3D20DFF3D50E}\\windowsdesktop-runtime-10.0.7-win-x86.exe\" /burn.runonce"	windowsdesktop-runtime-10.0.7-win-x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{580865E1-2073-4861-8356-3D20DFF3D50E} = "\"C:\\ProgramData\\Package Cache\\{580865E1-2073-4861-8356-3D20DFF3D50E}\\windowsdesktop-runtime-10.0.7-win-x86.exe\" /burn.runonce"	windowsdesktop-runtime-10.0.7-win-x86.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.IO.IsolatedStorage.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Security.Principal.Windows.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\de\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\es\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\tr\WindowsBase.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.IO.MemoryMappedFiles.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\System.Drawing.Design.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\tr\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Security.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Xml.XmlDocument.dll	msiexec.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3948_2102251844\_locales\pa\messages.json	msedge.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\PresentationUI.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\de\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\fr\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.AppContext.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Security.Cryptography.X509Certificates.dll	msiexec.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3948_2102251844\_locales\iw\messages.json	msedge.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\es\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\ko\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\ru\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.IO.FileSystem.Primitives.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Xml.ReaderWriter.dll	msiexec.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3948_2102251844\_locales\hr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3948_2102251844\_locales\gu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3948_2102251844\_locales\pl\messages.json	msedge.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\de\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\fr\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\ja\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Web.HttpUtility.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\Microsoft.VisualBasic.Forms.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\es\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\fr\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\ru\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\zh-Hans\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3948_2102251844\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\fr\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\dotnet.exe	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Threading.ThreadPool.dll	msiexec.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3948_2102251844\_locales\en_CA\messages.json	msedge.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\PresentationFramework-SystemDrawing.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\UIAutomationProvider.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Net.Mail.dll	msiexec.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3948_2102251844\_locales\te\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3948_2102251844\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\cs\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Collections.Specialized.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Diagnostics.Debug.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Security.Claims.dll	msiexec.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3948_2102251844\_locales\or\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3948_2102251844\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\es\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\ru\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\ru\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\D3DCompiler_47_cor3.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\cs\UIAutomationTypes.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\ru\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Runtime.InteropServices.dll	msiexec.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3948_2102251844\_locales\uz\messages.json	msedge.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\ko\UIAutomationTypes.resources.dll	msiexec.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3948_2102251844\_locales\et\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3948_2102251844\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\de\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\ja\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\zh-Hant\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe

Drops file in Windows directory 31 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e585fa4.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e585fae.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9D6D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA4C2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6230.tmp	msiexec.exe
File created	C:\Windows\Installer\e585fa9.msi	msiexec.exe
File created	C:\Windows\Installer\e585fae.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9CFF.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\e585fa9.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\e585fa3.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI67FE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI69B5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA405.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6473.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{09AE2CD2-101D-45E8-8922-51ABAA31F8CC}	msiexec.exe
File created	C:\Windows\Installer\SourceHash{2A17EBA5-4EEE-4A8A-9CEE-E8B67938B606}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6FFF.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7BB8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8425.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI90D8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e585f9f.msi	msiexec.exe
File created	C:\Windows\Installer\e585fa8.msi	msiexec.exe
File created	C:\Windows\Installer\e585fad.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{6F122B2D-6824-4922-A23E-A9151114EE7A}	msiexec.exe
File opened for modification	C:\Windows\Installer\e585fa4.msi	msiexec.exe
File created	C:\Windows\Installer\e585fb2.msi	msiexec.exe
File created	C:\Windows\Installer\e585f9f.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{EF889568-39DF-4FBB-83A6-893DF0A5A7D7}	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wixstdba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.7-win-x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wixstdba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.7-win-x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.7-win-x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Velocity.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.7-win-x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.7-win-x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3948	msedge.exe
5776	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2C	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2d	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134214098170159729"	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2B\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\865988FEFD93BBF4386A98D30F5A7A7D	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\865988FEFD93BBF4386A98D30F5A7A7D\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2DC2EA90D1018E54982215BAAA138FCC\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.28.51996_x86	windowsdesktop-runtime-10.0.7-win-x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5ABE71A2EEE4A8A4C9EE8E6B97836B60\Provider	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D2B221F6428622942AE39A511141EEA7\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\dotnet_runtime_80.28.51996_x86	windowsdesktop-runtime-10.0.7-win-x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\865988FEFD93BBF4386A98D30F5A7A7D\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{EF889568-39DF-4FBB-83A6-893DF0A5A7D7}v80.28.51996\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5ABE71A2EEE4A8A4C9EE8E6B97836B60	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5ABE71A2EEE4A8A4C9EE8E6B97836B60\Version = "1344064284"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3178EEBD72B5CC250FFFEA4077368656	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1609746302-1884177235-1125644204-1000\{F62A80E0-84F8-4E12-B7AB-5106787A58F9}	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\865988FEFD93BBF4386A98D30F5A7A7D\ProductName = "Microsoft .NET Host - 10.0.7 (x86)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5ABE71A2EEE4A8A4C9EE8E6B97836B60\ProductName = "Microsoft .NET Runtime - 10.0.7 (x86)"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D2B221F6428622942AE39A511141EEA7\DeploymentFlags = "3"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\865988FEFD93BBF4386A98D30F5A7A7D\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.28.51996_x86	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\B9FD6305CAA5D224A5486ED10DAF7290\2DC2EA90D1018E54982215BAAA138FCC	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_80.28.51996_x86\DisplayName = "Microsoft .NET Runtime - 10.0.7 (x86)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5ABE71A2EEE4A8A4C9EE8E6B97836B60\PackageCode = "DBC5B90379055E24587405C416B60F2F"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\865988FEFD93BBF4386A98D30F5A7A7D\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.28.51996_x86\Dependents	windowsdesktop-runtime-10.0.7-win-x86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2DC2EA90D1018E54982215BAAA138FCC	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\0D507D71850510965704F554DD712F7E\5ABE71A2EEE4A8A4C9EE8E6B97836B60	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5ABE71A2EEE4A8A4C9EE8E6B97836B60\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{2A17EBA5-4EEE-4A8A-9CEE-E8B67938B606}v80.28.51996\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x86	windowsdesktop-runtime-10.0.7-win-x86.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\865988FEFD93BBF4386A98D30F5A7A7D\MainFeature	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\865988FEFD93BBF4386A98D30F5A7A7D\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2DC2EA90D1018E54982215BAAA138FCC	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\windowsdesktop_runtime_80.28.51996_x86	windowsdesktop-runtime-10.0.7-win-x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2DC2EA90D1018E54982215BAAA138FCC\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5ABE71A2EEE4A8A4C9EE8E6B97836B60\SourceList\PackageName = "dotnet-runtime-10.0.7-win-x86.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5ABE71A2EEE4A8A4C9EE8E6B97836B60\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{2A17EBA5-4EEE-4A8A-9CEE-E8B67938B606}v80.28.51996\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_80.28.51996_x86\Dependents\{580865E1-2073-4861-8356-3D20DFF3D50E}	windowsdesktop-runtime-10.0.7-win-x86.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.28.51996_x86	windowsdesktop-runtime-10.0.7-win-x86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x86\Dependents\{580865E1-2073-4861-8356-3D20DFF3D50E}	windowsdesktop-runtime-10.0.7-win-x86.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2DC2EA90D1018E54982215BAAA138FCC\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_80.28.51996_x86\Version = "80.28.51996"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D2B221F6428622942AE39A511141EEA7\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{6F122B2D-6824-4922-A23E-A9151114EE7A}v80.28.51996\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x86\Dependents	windowsdesktop-runtime-10.0.7-win-x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2DC2EA90D1018E54982215BAAA138FCC\PackageCode = "76A15FE2D7C0C094BAC51D0288AFF67C"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5ABE71A2EEE4A8A4C9EE8E6B97836B60\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5ABE71A2EEE4A8A4C9EE8E6B97836B60\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D2B221F6428622942AE39A511141EEA7\MainFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D2B221F6428622942AE39A511141EEA7\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{6F122B2D-6824-4922-A23E-A9151114EE7A}v80.28.51996\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x86\DisplayName = "Microsoft .NET Host - 10.0.7 (x86)"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\865988FEFD93BBF4386A98D30F5A7A7D\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x86	windowsdesktop-runtime-10.0.7-win-x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.28.51996_x86\ = "{09AE2CD2-101D-45E8-8922-51ABAA31F8CC}"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5ABE71A2EEE4A8A4C9EE8E6B97836B60\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_80.28.51996_x86\DisplayName = "Microsoft Windows Desktop Runtime - 10.0.7 (x86)"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{0f62ff89-5cc3-5dfe-ec82-db9d826b6527}\Dependents\{580865E1-2073-4861-8356-3D20DFF3D50E}	windowsdesktop-runtime-10.0.7-win-x86.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\865988FEFD93BBF4386A98D30F5A7A7D\Version = "1344064284"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_80.28.51996_x86\ = "{2A17EBA5-4EEE-4A8A-9CEE-E8B67938B606}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\0D507D71850510965704F554DD712F7E	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_80.28.51996_x86\Dependents\{580865E1-2073-4861-8356-3D20DFF3D50E}	windowsdesktop-runtime-10.0.7-win-x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\865988FEFD93BBF4386A98D30F5A7A7D\PackageCode = "145EF10EFC3685A4188A83437E504485"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5ABE71A2EEE4A8A4C9EE8E6B97836B60\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{0f62ff89-5cc3-5dfe-ec82-db9d826b6527}	windowsdesktop-runtime-10.0.7-win-x86.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D2B221F6428622942AE39A511141EEA7\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D2B221F6428622942AE39A511141EEA7\Version = "1344064284"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3178EEBD72B5CC250FFFEA4077368656\D2B221F6428622942AE39A511141EEA7	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\dotnet_runtime_80.28.51996_x86	windowsdesktop-runtime-10.0.7-win-x86.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4092	msiexec.exe
4092	msiexec.exe
4092	msiexec.exe
4092	msiexec.exe
4092	msiexec.exe
4092	msiexec.exe
4092	msiexec.exe
4092	msiexec.exe
4092	msiexec.exe
4092	msiexec.exe
4092	msiexec.exe
4092	msiexec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5384	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeIncreaseQuotaPrivilege	5384	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeSecurityPrivilege	4092	msiexec.exe
Token: SeCreateTokenPrivilege	5384	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeAssignPrimaryTokenPrivilege	5384	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeLockMemoryPrivilege	5384	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeIncreaseQuotaPrivilege	5384	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeMachineAccountPrivilege	5384	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeTcbPrivilege	5384	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeSecurityPrivilege	5384	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeTakeOwnershipPrivilege	5384	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeLoadDriverPrivilege	5384	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeSystemProfilePrivilege	5384	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeSystemtimePrivilege	5384	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeProfSingleProcessPrivilege	5384	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeIncBasePriorityPrivilege	5384	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeCreatePagefilePrivilege	5384	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeCreatePermanentPrivilege	5384	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeBackupPrivilege	5384	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeRestorePrivilege	5384	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeShutdownPrivilege	5384	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeDebugPrivilege	5384	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeAuditPrivilege	5384	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeSystemEnvironmentPrivilege	5384	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeChangeNotifyPrivilege	5384	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeRemoteShutdownPrivilege	5384	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeUndockPrivilege	5384	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeSyncAgentPrivilege	5384	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeEnableDelegationPrivilege	5384	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeManageVolumePrivilege	5384	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeImpersonatePrivilege	5384	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeCreateGlobalPrivilege	5384	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeRestorePrivilege	4092	msiexec.exe
Token: SeTakeOwnershipPrivilege	4092	msiexec.exe
Token: SeRestorePrivilege	4092	msiexec.exe
Token: SeTakeOwnershipPrivilege	4092	msiexec.exe
Token: SeRestorePrivilege	4092	msiexec.exe
Token: SeTakeOwnershipPrivilege	4092	msiexec.exe
Token: SeRestorePrivilege	4092	msiexec.exe
Token: SeTakeOwnershipPrivilege	4092	msiexec.exe
Token: SeRestorePrivilege	4092	msiexec.exe
Token: SeTakeOwnershipPrivilege	4092	msiexec.exe
Token: SeRestorePrivilege	4092	msiexec.exe
Token: SeTakeOwnershipPrivilege	4092	msiexec.exe
Token: SeRestorePrivilege	4092	msiexec.exe
Token: SeTakeOwnershipPrivilege	4092	msiexec.exe
Token: SeRestorePrivilege	4092	msiexec.exe
Token: SeTakeOwnershipPrivilege	4092	msiexec.exe
Token: SeRestorePrivilege	4092	msiexec.exe
Token: SeTakeOwnershipPrivilege	4092	msiexec.exe
Token: SeRestorePrivilege	4092	msiexec.exe
Token: SeTakeOwnershipPrivilege	4092	msiexec.exe
Token: SeRestorePrivilege	4092	msiexec.exe
Token: SeTakeOwnershipPrivilege	4092	msiexec.exe
Token: SeRestorePrivilege	4092	msiexec.exe
Token: SeTakeOwnershipPrivilege	4092	msiexec.exe
Token: SeRestorePrivilege	4092	msiexec.exe
Token: SeTakeOwnershipPrivilege	4092	msiexec.exe
Token: SeRestorePrivilege	4092	msiexec.exe
Token: SeTakeOwnershipPrivilege	4092	msiexec.exe
Token: SeRestorePrivilege	4092	msiexec.exe
Token: SeTakeOwnershipPrivilege	4092	msiexec.exe
Token: SeRestorePrivilege	4092	msiexec.exe
Token: SeTakeOwnershipPrivilege	4092	msiexec.exe

Suspicious use of FindShellTrayWindow 19 IoCs

pid	Process
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
5624	wixstdba.exe
3760	wixstdba.exe

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 4296 wrote to memory of 3948	4296	Velocity.exe	83
PID 3948 wrote to memory of 4508	3948	msedge.exe	84
PID 3948 wrote to memory of 5776	3948	msedge.exe	85
PID 3948 wrote to memory of 5772	3948	msedge.exe	86
PID 3948 wrote to memory of 5772	3948	msedge.exe	86
PID 3948 wrote to memory of 5772	3948	msedge.exe	86
PID 3948 wrote to memory of 2584	3948	msedge.exe	87
PID 3948 wrote to memory of 2584	3948	msedge.exe	87
PID 3948 wrote to memory of 3444	3948	msedge.exe	89
PID 3948 wrote to memory of 3444	3948	msedge.exe	89
PID 3948 wrote to memory of 3444	3948	msedge.exe	89
PID 3948 wrote to memory of 2988	3948	msedge.exe	90
PID 3948 wrote to memory of 2988	3948	msedge.exe	90
PID 3948 wrote to memory of 2988	3948	msedge.exe	90
PID 3948 wrote to memory of 1604	3948	msedge.exe	94
PID 3948 wrote to memory of 1604	3948	msedge.exe	94
PID 3948 wrote to memory of 3876	3948	msedge.exe	95
PID 3948 wrote to memory of 3876	3948	msedge.exe	95
PID 3948 wrote to memory of 5504	3948	msedge.exe	96
PID 3948 wrote to memory of 5504	3948	msedge.exe	96
PID 3948 wrote to memory of 5504	3948	msedge.exe	96
PID 3948 wrote to memory of 2356	3948	msedge.exe	98
PID 3948 wrote to memory of 5332	3948	msedge.exe	102
PID 3948 wrote to memory of 5332	3948	msedge.exe	102
PID 3948 wrote to memory of 1336	3948	msedge.exe	103
PID 3948 wrote to memory of 1336	3948	msedge.exe	103
PID 3948 wrote to memory of 1336	3948	msedge.exe	103
PID 3948 wrote to memory of 4016	3948	msedge.exe	104
PID 3948 wrote to memory of 60	3948	msedge.exe	105
PID 60 wrote to memory of 5624	60	windowsdesktop-runtime-10.0.7-win-x86.exe	107
PID 60 wrote to memory of 5384	60	windowsdesktop-runtime-10.0.7-win-x86.exe	110
PID 1592 wrote to memory of 5612	1592	windowsdesktop-runtime-10.0.7-win-x86.exe	114
PID 4092 wrote to memory of 4640	4092	msiexec.exe	116
PID 4092 wrote to memory of 4160	4092	msiexec.exe	117
PID 5612 wrote to memory of 3760	5612	windowsdesktop-runtime-10.0.7-win-x86.exe	121
PID 3948 wrote to memory of 4008	3948	msedge.exe	122
PID 3948 wrote to memory of 2168	3948	msedge.exe	123
PID 3948 wrote to memory of 3936	3948	msedge.exe	124
PID 4092 wrote to memory of 1420	4092	msiexec.exe	125
PID 3948 wrote to memory of 5700	3948	msedge.exe	126
PID 3948 wrote to memory of 5700	3948	msedge.exe	126
PID 5612 wrote to memory of 5456	5612	windowsdesktop-runtime-10.0.7-win-x86.exe	127
PID 3948 wrote to memory of 688	3948	msedge.exe	128
PID 3948 wrote to memory of 688	3948	msedge.exe	128
PID 4092 wrote to memory of 3776	4092	msiexec.exe	132
PID 4092 wrote to memory of 5236	4092	msiexec.exe	133
PID 4092 wrote to memory of 4848	4092	msiexec.exe	134
PID 3948 wrote to memory of 2504	3948	msedge.exe	136
PID 3948 wrote to memory of 2504	3948	msedge.exe	136

C:\Users\Admin\AppData\Local\Temp\Velocity.exe
"C:\Users\Admin\AppData\Local\Temp\Velocity.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=x86&rid=win-x86&os=win10&apphost_version=10.0.0&gui=true
  2⤵
  - Drops file in Program Files directory
  - System Time Discovery
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c8,0x2cc,0x2d0,0x2c4,0x360,0x7ffeb3b8c188,0x7ffeb3b8c194,0x7ffeb3b8c1a0
    3⤵
    PID:4508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2000,i,4820763821650900565,10436038245473676714,524288 --field-trial-handle=2308,i,888422439558056467,15237032137212966941,262144 --variations-seed-version --mojo-platform-channel-handle=2424 /prefetch:3
    3⤵
    - Downloads MZ/PE file
    - System Time Discovery
    PID:5776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1872,i,18125101486299750077,3189903102195306254,262144 --field-trial-handle=2308,i,888422439558056467,15237032137212966941,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:2
    3⤵
    PID:5772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2596,i,7116221599189619516,13768514170392690010,524288 --field-trial-handle=2308,i,888422439558056467,15237032137212966941,262144 --variations-seed-version --mojo-platform-channel-handle=2588 /prefetch:8
    3⤵
    PID:2584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,17475249046098533084,6024059832821575550,2097152 --field-trial-handle=2308,i,888422439558056467,15237032137212966941,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
    3⤵
    PID:3444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,7217633370790160819,14218635110379891387,2097152 --field-trial-handle=2308,i,888422439558056467,15237032137212966941,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
    3⤵
    PID:2988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4864,i,12063087125645179993,5882342242308424766,524288 --field-trial-handle=2308,i,888422439558056467,15237032137212966941,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:8
    3⤵
    PID:1604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4860,i,15201701708706252253,3596256715987081498,524288 --field-trial-handle=2308,i,888422439558056467,15237032137212966941,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:8
    3⤵
    PID:3876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5632,i,12354107965025791268,13964722415847859915,2097152 --field-trial-handle=2308,i,888422439558056467,15237032137212966941,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:1
    3⤵
    PID:5504
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,1731943620800472290,12626424059072660858,524288 --field-trial-handle=2308,i,888422439558056467,15237032137212966941,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:8
    3⤵
    PID:1756
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,1731943620800472290,12626424059072660858,524288 --field-trial-handle=2308,i,888422439558056467,15237032137212966941,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:8
    3⤵
    PID:2356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,5843261288632867915,12697187947326374065,524288 --field-trial-handle=2308,i,888422439558056467,15237032137212966941,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:8
    3⤵
    PID:5332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6236,i,2969069565091755491,2279851775959523325,2097152 --field-trial-handle=2308,i,888422439558056467,15237032137212966941,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:1
    3⤵
    PID:1336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6244,i,2307428383157006317,16121416552677813909,524288 --field-trial-handle=2308,i,888422439558056467,15237032137212966941,262144 --variations-seed-version --mojo-platform-channel-handle=6828 /prefetch:8
    3⤵
    PID:4016
- - C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.7-win-x86.exe
    "C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.7-win-x86.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:60
  - - C:\Windows\TEMP\{594FAB8E-929F-4302-A7A6-96F3940E555C}\.ba\wixstdba.exe
      "C:\Windows\TEMP\{594FAB8E-929F-4302-A7A6-96F3940E555C}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{642382B5-F4FB-4BC3-ABBE-0BF385EFF2CF} {7FB1818E-EE5E-44E5-9B4F-8425C9ABFDCB}
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      PID:5624
  - - C:\Windows\TEMP\{594FAB8E-929F-4302-A7A6-96F3940E555C}\.be\windowsdesktop-runtime-10.0.7-win-x86.exe
      "C:\Windows\TEMP\{594FAB8E-929F-4302-A7A6-96F3940E555C}\.be\windowsdesktop-runtime-10.0.7-win-x86.exe" -q -burn.elevated BurnPipe.{D7883BCB-0593-4AE5-B08A-F61D183BA7E8} {8268A612-6C15-47CA-B17B-7CD524DBB1C2} 60
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      PID:5384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,4984688398696985023,15770560201842207662,524288 --field-trial-handle=2308,i,888422439558056467,15237032137212966941,262144 --variations-seed-version --mojo-platform-channel-handle=704 /prefetch:8
    3⤵
    PID:4008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6832,i,17031590766833689258,1443494774059374598,524288 --field-trial-handle=2308,i,888422439558056467,15237032137212966941,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:8
    3⤵
    PID:2168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,8331640072796800312,7805545560914735138,524288 --field-trial-handle=2308,i,888422439558056467,15237032137212966941,262144 --variations-seed-version --mojo-platform-channel-handle=6984 /prefetch:8
    3⤵
    PID:3936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7016,i,9781036285572779317,14685520971759848149,524288 --field-trial-handle=2308,i,888422439558056467,15237032137212966941,262144 --variations-seed-version --mojo-platform-channel-handle=6992 /prefetch:8
    3⤵
    PID:5700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7040,i,548911166758080461,7561423014153985232,524288 --field-trial-handle=2308,i,888422439558056467,15237032137212966941,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
    3⤵
    PID:688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6592,i,2336934383557773184,7427705580386475738,524288 --field-trial-handle=2308,i,888422439558056467,15237032137212966941,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:8
    3⤵
    PID:2504

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2932

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2484

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4092
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding FAD09A43D68ACDDBAC0FF0A5C2062611
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4640
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 22B67F14D5C9366BF34578EF29EC9EDB
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4160
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 62DA681DCAE812DACA3C02B51F960D01
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1420
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding C98EB90E68BDBB52B4417952006EFD5A
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3776
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 014D656D29C127D083E630EA7D5CFAFA
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5236
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 394676B09996D21EB4A59E7EE3CC6E3A
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4848

C:\ProgramData\Package Cache\{580865E1-2073-4861-8356-3D20DFF3D50E}\windowsdesktop-runtime-10.0.7-win-x86.exe
"C:\ProgramData\Package Cache\{580865E1-2073-4861-8356-3D20DFF3D50E}\windowsdesktop-runtime-10.0.7-win-x86.exe" /burn.runonce
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1592
- C:\ProgramData\Package Cache\{580865E1-2073-4861-8356-3D20DFF3D50E}\windowsdesktop-runtime-10.0.7-win-x86.exe
  "C:\ProgramData\Package Cache\{580865E1-2073-4861-8356-3D20DFF3D50E}\windowsdesktop-runtime-10.0.7-win-x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.7_(x86)_20260423102345.log"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5612
- - C:\Windows\TEMP\{56AE6FDA-59CB-4BF1-96F3-3BC6700CF12D}\.ba\wixstdba.exe
    "C:\Windows\TEMP\{56AE6FDA-59CB-4BF1-96F3-3BC6700CF12D}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{50ABE9C5-1CAF-4818-AE3A-BAB4898FF85A} {ACCCA6B1-5709-4AFE-BFC3-4FD15211FCFE}
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:3760
- - C:\ProgramData\Package Cache\{580865E1-2073-4861-8356-3D20DFF3D50E}\windowsdesktop-runtime-10.0.7-win-x86.exe
    "C:\ProgramData\Package Cache\{580865E1-2073-4861-8356-3D20DFF3D50E}\windowsdesktop-runtime-10.0.7-win-x86.exe" -q -burn.elevated BurnPipe.{FCEDC1D8-8E24-4810-8D88-4F6A7F815DB5} {5320FC5B-9375-4B81-9BE3-503ECF16D06F} 5612
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:5456

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e585fa2.rbs

Path C:\Config.Msi\e585fa2.rbs
Size 10KB
SHA256 81776fa478ca2cec53e13dc3116d7e672eb13c2da737f306defe6e80dc6a05e8
MD5 53ec1864c7a461b31c17ea90244f2587
SHA1 61f64e581505326e2ba5628cc99f106f74e52c8a
SHA512 f48b1b5affa66407e48a21ef5cbe7beacdf53dcbcb4eb9de273a1a12b93571744affc46f0a09efe20734d9e5250682be625aa36ae590d8c2c3f9d387472e5191
SSDEEP 96:/IvJMAQxubtD4tn81RceWxEQUHheD2QPuCsThqJUHheD2QPuC6jlF3MeThqVH5wt:/KUstU5xeHvmNIbmN6GEc46kdpb
TLSH
T125223101B640C2D3E89B0778E7531B153BBBC6EA571083DF01DD95784F6A7885FA81DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e585fa7.rbs

Path C:\Config.Msi\e585fa7.rbs
Size 8KB
SHA256 0af6d9fc17be8057e31088f29051373a6aca4f5b3be951a8069ec2f161283040
MD5 0f18e2f2b58ffe2c7d7eacd34665d168
SHA1 b848ac3b9ce37e0def77612cedfc4cf6ca8699b3
SHA512 0573ae2af815515599dc576ffa801c4d85c8b8fb846371f5c2db49204478f8cb3da6ae347bf004aa819f1c2e72c21cb8381ef624fd774ed255ff54e63c79534f
SSDEEP 96:AFeI07BOC1rZkae+uWQUHq2eD26sPuCsThq9UHq2eD26sPuC6jkzdYeThqRH1wU5:AF90QSXeEvTNInTN5AEKHV9dpH
TLSH
T158122181310186E2ED9B5B34C3872B24BFEBE3D79611125F25CD52605F8A7C93F642EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e585fac.rbs

Path C:\Config.Msi\e585fac.rbs
Size 49KB
SHA256 c6d063660e85070e9b4692526ed4a9c4a5210bbb3dc9d3336846615ee82e15a0
MD5 872e66103764cf487574f46076b27068
SHA1 f606932ac7b8243341b65bcce21888b31c66349d
SHA512 1bce93f0bbc66be2b4704139a0a50b65f9cac09c52a4d2e5b25287867eaf87590027c9ed9989cca79ba49f993cd87fc1a5f85b73d93259e226a519ecaa564936
SSDEEP 384:hV7rNK0DLsrmMwoXlhkOI5RBMgu8gKtaz0XHpZtcMq5UGRWBHNfrL/VZih/N9f9/:hpPilnAThu7hRNlWfxArH
TLSH
T174335220AB05D2E3FB226C7133E1DD08EF1ACD627744DDA914C61665C5A3DAC3EE885B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e585fb1.rbs

Path C:\Config.Msi\e585fb1.rbs
Size 72KB
SHA256 d8f712631a5ddbb8f190d686414894361b7a2d0aab7a0c055c0aca966d0d9b62
MD5 1f496da87cc8976b20c09dc059365e01
SHA1 383b72b80df15803a98f8d8e968715a4ed54e0bc
SHA512 857a07a29d624f2630f526e8de78e07ca2031b8d00352c6d3c8d6e5ce02f108325234a0a176946459bd6d700d3247ec830e4a1e452f7d60c849cef2ddbd9b774
SSDEEP 768:zONOqMomkns8EnoLou+PTcKsfNTGKJL040iA0qTR0P1wKaq00a/UzZYemq0Kwbkv:CN3NCnoLZ+PTlUN7umeGKymciu0Kwm
TLSH
T12F731F464B91E5C5FB325EB176B7EA4CDD035CBBA292493D20C9252ECDB3D882EE44C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e585fb5.rbs

Path C:\Config.Msi\e585fb5.rbs
Size 3KB
SHA256 d9ff17f5755446a82bc25650fc6cc82beaf1b8ba17871274c4d71deb121d5421
MD5 ad0db3397c190ea24e769935a878446d
SHA1 827ce0fda65518fe0cd4a5167bb40d24f9849257
SHA512 f4306a11c7efd871bbc173bc3aa02d4f93444d1f3217d2e2044ab1f063b4973458c67b1a4db7f135b39c5a79d40e88e287e9df1034634d51cf5dcc2debbfb56d
TLSH
T16971DC42AA04D2D3EDA72F30DE5707113B7BDBD6A310834B048C92745E17BC5AEE658A
MD5 SHA1 SHA512 TLSH

Submit Download

e585fb8.rbs

Path C:\Config.Msi\e585fb8.rbs
Size 3KB
SHA256 3ff519e61ca321d479e1daa64d85deb7dc96e8a61a308ab7f371971832b974bd
MD5 42a3c9642ae1df5c8b0e2d7ebeb695a4
SHA1 7d8d55fc38ecff2b5266af7a5b7d73afb2470035
SHA512 52aec17d0797a96bf896a23a53d1d1d9f95c34558f11524979fd9b64ee31b2a2c816156462d5db1120fea60cfc1b14ddff4f5b4fadada59fb5bdfcf0545ffac7
TLSH
T18681CE03EA40E682ECA32F30DD5717593777DAEA8351434B10CCD1754E4BB8A9ED6689
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE.txt

Path C:\Program Files (x86)\dotnet\LICENSE.txt
Size 9KB
SHA256 7f6839a61ce892b79c6549e2dc5a81fdbd240a0b260f8881216b45b7fda8b45d
MD5 31c5a77b3c57c8c2e82b9541b00bcd5a
SHA1 153d4bc14e3a2c1485006f1752e797ca8684d06d
SHA512 ad33e3c0c3b060ad44c5b1b712c991b2d7042f6a60dc691c014d977c922a7e3a783ba9bade1a34de853c271fde1fb75bc2c47869acd863a40be3a6c6d754c0a6
SSDEEP 192:ydP0KvBLCqikR/EgGJLrlwD+eilNi5Py1SDeoDXDw9lF5OMz6Q:PWBuqikR/EDJLriwlNi5KI1Tw9lF5OjQ
TLSH
T1EC12B57D7284177109D207E16A0AB9D6F62A953C3117AA2438FDC15923AAF2CC37F3E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ThirdPartyNotices.txt

Path C:\Program Files (x86)\dotnet\ThirdPartyNotices.txt
Size 77KB
SHA256 deb4427a295e1ed474b0d81c5a0d972c1b550b9a715cda939cdfa9236b1b418f
MD5 0d8867a25ba926e6e40cd52ab3536b5c
SHA1 89390dc8b8318d0bfef1c6a2fb4783537e28a465
SHA512 317ca335405274f4f91b173651ca2826760acb5ba5cf41aff51adc55c2cda9059fb268333665f13f62fa48119e55a303720a780dd58d28dd9967db4c88407d61
SSDEEP 1536:HA9jHwsGfgg39/zwgAVkguQxrDjugtSEGepkWvrpX7anuqdLSVnfiStPq+3LefrL:HA97w/ogz1AVxuMjHtSFULryLOgrGWm+
TLSH
T17773A45F7E45077319E2C3916569A8C5F22FA02E3B6B2A44346EF248133B42DD6FF858
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files (x86)\dotnet\dotnet.exe
Size 141KB
SHA256 8b6be8b21aae8f21fdfc0e15d350e072bd84e439c4d99e1ee8b6f38a61eabb5a
MD5 f25f2493a974dd8d01fb9410398c094f
SHA1 f6397f4c97ea07a57b846ded5c212b84ce0b25c0
SHA512 81f932c605c96e68e923e37c83eca1e1b24147b5435d3714d298ed1fb6f63ba2663d760d36441921ed80c923b0086a05ee5a27df1f853169c8d29edadcfda4b8
SSDEEP 3072:0078iKA/8gNs0xphwaNq92hxQOA7qVy2nY:0umQphy9z7qlY
TLSH
T1C5E3F725F9958162D15D1970CB29CE91BA3BAC619BE1E0C763C0FDBE0B701C0AAF5B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft Windows Desktop Runtime 10.0.7 (x86).swidtag

Path C:\Program Files (x86)\dotnet\swidtag\Microsoft Windows Desktop Runtime 10.0.7 (x86).swidtag
Size 488B
SHA256 8308f6fca5b2a877534bc93bc62b25b075f846e772afcbe61280442f8f0e86ef
MD5 ad52e97277f16f9c81ea1c03c85e9d7d
SHA1 9d06d56c38818a48f4232b473ac9ee9ec728ea53
SHA512 e42bb7d2b326df0bf3d2cf6d0cb1e80028118e4924f03cf04d2f1647d2f243191136adf2674fd1d66b3dc6378563dc681d7933bfc10826feb6564138960c8f19
TLSH
T148F09E46F522B93249F36720AA5D9041E35EB9D7CC8C6B844C59841A019B5A9437BA50
MD5 SHA1 SHA512 TLSH

Submit Download

state.rsm

Path C:\ProgramData\Package Cache\{580865E1-2073-4861-8356-3D20DFF3D50E}\state.rsm
Size 1KB
SHA256 728711f25002fd08adee9853d84c01063c92385543f8ce116219cbe207e5e93f
MD5 00db8102592cd1078cab3441d2c263a5
SHA1 4c93910c4cf9710c858441b3d989a38843975db8
SHA512 0aa7793ef916a2e6b613ca2dc70ca7a54a3ca6f8777368c30030c8a930964823b9e7b3e6f71e075152c61a727f3a2a81b3f9d5d497237ec2c3b49b43162401e9
TLSH
T1092181615BF6192CF3F2AB35A9F96729543BBC125D24C16E0001318A9E72BE1C8B4B33
MD5 SHA1 SHA512 TLSH

Submit Download

state.rsm

Path C:\ProgramData\Package Cache\{580865E1-2073-4861-8356-3D20DFF3D50E}\state.rsm
Size 1KB
SHA256 a19dd723353b655af63146c5a5803f7443ac7d12dcec67794a96fc1fcf337b53
MD5 228f397fe4d0e0507e0efef78c68a831
SHA1 7e8a6eb7ef27f73d251adbc471e4ba5286fc499f
SHA512 353f76efee175efe71d40f09c0a024060c51cb1dd7ca90deda8f4edbd79f2f5d67e3da24517a352140043f43d844b6bd3877e56ed2d24228497127a96b1f50f3
TLSH
T14E2181615BF6192CF3F2AB35A9F96729543BBC125D24C16E0001318A9E72BE1C8B4B33
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c7296caf0e9cce556825f28f3642cb5ac31e31a0ff760d227744d879c3a93dee
MD5 1fd2da899cebd4d5aac2a3d85c0bfd18
SHA1 3f4e6dbc96df63582e9ba17acceda5012e453d7a
SHA512 840622178b39a880be2d80a1349d1dc0f7bfb63bf38c38c71fd96b89033d54de3e6a88f15ad237f3b66a8ebbff2bcfb19f5b6a6e94882c94044f73046f231584
TLSH
T1D5D0C0CC33B13C26C58C807004457F4D340BC4A20D42C3263433297C0CC30C428514C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cd04dec9a65c9ebbd9698b7d59631c916e6b6a0a7afdb22ef48d8a4a82d902d0
MD5 5491f296a003c3ba16025eb18fdfb799
SHA1 8104d473f5d8f681400a64b5d0ac5523a5d56b8e
SHA512 118ab6dad3343099380a953888db90a14fe8c7dcb62f906e55a163cdde9b95460d37b865178c48bfd20c166ef6b725e5b61ca55fc83a0221383e062a36b68b84
TLSH
T1CAD080D837B16C26C589947104857F4D351BC4A24D46D7267477297C5CC30C46D555D7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 ff47597202b1e8ca47b3bc8e5a64a8bb00d2e4cc97b0f580d5df99070f1c7a7e
MD5 0d5bb00b4902850b2c95ebb3d1e665cf
SHA1 e0980f65f7a0bc4c7bcbd594cee4f3a181a1421e
SHA512 25114e6b7b103f4c37bd8205fd05cfbcd2eda675666bc1a2d7f133be0822188ddf4549d142ce5e7d5913055f8a39edc3e16836b0190bb3e8e41a44ed6ecf59e4
TLSH
T183E02BEAC8219D3B44FD0B2960124746EB55275B1B50884F7B3DC2089FB0A370556C5C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 680720612c850a495cdd01246bfc5d8a6810a53251230e9238304d19829f1e2a
MD5 7b0c183d075ca79415f135d55a2479bf
SHA1 42fc63b97373ecabf4f8e31d1aa7ab3156ea3e69
SHA512 17b391c5965ff3678d20b58bdb21f08f5cf0ed24de12656a12d14fc78b9f4e05572a4e914328ff92715c19503d1c9dea32a79079d658fbbfaba2c501dc27af60
TLSH
T1A17193707085F454F7E441B285E5149AFAF0CB29A20F1E2635FBCDBF6B47BDA1062A04
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe588538.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe588538.TMP
Size 3KB
SHA256 9c00e5a6e63255ec7328a05ac9a5cb66b5cb51f2252038fbd07e535a2f82ab02
MD5 9f320a4590e0476772c6c423364bb788
SHA1 4fed0cba10e407e52c4838b75fa650d026ef13f1
SHA512 2265f89fd1a139528a643924ec8654124035f62cbefeb3d7946d7d6f608836eadf251264fc4e44629f74e087158f1c120ca0ff7285c9ea004ac2068bbc6b35f9
TLSH
T1637160717145F554F3E041B642E51092FAF0CB69A20F1E2935FBCEBF2707BD95062A04
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 d24a115c1c5267c456349dbed0381545d0ec8003c124ab7fbd606b3493e3287c
MD5 11592532649e80a1b05c67ddf10c1472
SHA1 c9ea9c6da36fb332acffa3b6c79bff971ca0ea92
SHA512 d113277d242adf1a0c2a28a63e96f8f3bc423bec63be2379cc2da84a09189a5fb8227b7dc785edc229b5a590e1c6616815db6fe12a5d9d9b9a5318e65faf364a
SSDEEP 192:sxZLR7yMqZ/K1Ml8Mjg/fPsp9qeVZxvgzodp62HW6+WNrez/YKTMwkNM9Ig5eiGL:sxZLAbg/fPsp9ZNvDNHb8/ONGDE
TLSH
T13D72E916AA34597BCCDBD609F9457F53D6F9452392404E44AAFCCA0C05E6AED311382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 a4797418e3db488c0f1a7df58ad820197a975b6318090ea69b245b2959fffb42
MD5 029ef7b182dc83897805a5a04d94cfd4
SHA1 205684c078074c35627dd677bcd01489a843e04e
SHA512 844c77d1f68db19e84e6d8983c57e72b415a73ad0422546f2a269e0851bb0e4d1ede27e057b65ef8adcdc1db38e4c9c280b3d8b2c3b30085c9a66b86f92ac695
SSDEEP 192:sxZLR7yMqZ/K1Ml8Mmg/fPsJUpqeVZxvgzodp62HW6+WNrez/YKFC7NM9IgjnJ:sxZLAug/fPsJIZNvDNHb8/SNGjJ
TLSH
T1AC62E9166A38997BCCDBD219FA457F53D6F5552392804E44AAFCCA0C04E7AED311382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 b933606f9350b028f2f480e9af00f9f26ff2131a9f7a27be655aaaf1a6be8a28
MD5 7636a7d3dd3ae18e3279c6abfc30bae0
SHA1 8898535ef804afa7eabae6f016b211d01d138587
SHA512 98aaf0d68e3c970084e2d208388d86154d45b867363ce0ea13163403374c85564dbe862d6817acf5515ee3316a4d59e2eb15cabe4659ea9249054d80fcc258db
SSDEEP 768:AasqZl+7pLuL/BlWvBDeT8F1+UoAYDCx9Tuqh0VfUC9xbog/OVaEx4Llhf51YroK:AasqZl+E/BlWvBDeTu1ja3Ex4LXB1jAr
TLSH
T13BF20A3B2C0CCB7E4F804E9CDC2A7E9E6EE8028B96D8895447F9841C03D66EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 8400c95a9aee24490fb0dfb4daecb01c6569558348192443c285bda20398f31c
MD5 47437cbdda172eeaf96273477801dec1
SHA1 e36c8c1d203309cf6cf8aced1bb0acb12536a23e
SHA512 2adff5b3ee68448fed349f2cdcfd21e4e7b6fdea1767bb493fd27ef832edf196dcf940e121d1807bd00c1c222ff9336ee12cdd29fd0b7e94c5ac08714d531519
SSDEEP 192:+HhOVXSe5i+EkETc3+uWvwAn+mPoOTR7uVhrx9aVYh5D+wHMT7glRZVrd9th/qne:+BOVglYXrbtZqRvJdXFG
TLSH
T118B25A11753B0380393E294E9594B46E62C270A37098B86B7BF944A64F6BF61CDFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 277328d401b83c1c8b9e2b2016cac1eeac087765089ca6037d8f8c4fc91bc6be
MD5 76afe701d4a5736f8dd2d8f613d6452e
SHA1 81f0bb09d80957ef2c65771112ad1ba1227f6c69
SHA512 d4a2f7552a2fcbe0bd456b1c1bd9c04f9d607414769936e971b8f91183e09aec0eb3fac295a9804452de7e9b631ad070a334e2f878936ff47588604a8ea552dd
SSDEEP 384:nqiFGjccCs+Bt0S3Z3sNM8TUNTUlI4lRihcc03x8vfDYH5R9DBzqBgctYn7lnL1E:hFAccQ53nwgQi1CGYH/lZqax7lnFHk
TLSH
T163D25C35E894DDABECEA8FD9F34A7743AEE001A3958C5AD8D5C88E1D00871DD170BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 c734e494a274e2c9c412805129e0683cbff01f42965263e7aaddc06ae7544c6a
MD5 48f103a5922a9efb40a7c10265ad8827
SHA1 c983caa5505e2e0abc07db8287511ba9dd079dac
SHA512 c2e4b55c9fed4bbe17f2b5b8b58a321e05a6ffe27718d38bf711d4b51cc97a290a8ae63355226779f8b23692ab828ed018d2c71a58a00ba1709e69b9f3deb2e8
SSDEEP 384:nuyiFavqMg3sNR8TUNTUlIm2RihYaOr8vfDYH5R9DBzoQuS7o1dKuiNk9xRrN1k1:u5Fayv3+wgTiU8YH/lZxumo1tigP8
TLSH
T193C25B35EC98DAABECEA8F89E749BA07DEE00267C58C4AD4D5D85D0D10D319E2307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 b2610a882477669ca19eecff7a38047a556fbde28037c7aee7112c28bb869e63
MD5 57b50bedd2e229cbe6cd095838f14076
SHA1 54ff5a39bdc2bae267321a7153b2dd46b3e8b9ab
SHA512 5b81df7456d4b665b410513e5b0dea19845c282c23dae4aae4d6f17c0ba5cbb3fa8d11f617939ec72763eb56a322c4bb0eca62585bed4293f6318f2232c48032
SSDEEP 384:nRiFavqMg3sNI8TUNTUlIm2Rihtj0Dy8vfDYH5R9DBzqBgct+n7S7o1dKuiNk9x2:4Fayv33wgTi3CjYH/lZqa/7mo1tigP8
TLSH
T1A7C24A31E898DEABECDA9F99E7497A43DEE002A7C98C4ED4D5D84D0D00971DD270BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 b633ba6fd6fa00533402517c6fe50cd19a28ff3a1ab720661eadeb8ec8cde212
MD5 b16a18a7167080237268dadb40d7c226
SHA1 4e1adfa063fa56fc3ba0fa2677bd21ca66d48dc4
SHA512 0a55e3a725f308266e532d90dcdf2498938e6bb02d62229dc66ab1c47a65cabe33600dfdb65a5fdf13eb5b3bcc74e2f43e42f8db433417ed56f64a0928b0d293
SSDEEP 384:nCiFavqMJ3sNM8TUNTUlI4JRihKc03x8vfDYH5R9DBzqBgctHn7zDORrN1k+rvIt:JFay+3nwgkifCGYH/lZqa27zqlI
TLSH
T1D4C23A35E858DDABECDA9B89F7053643DEE012A789CC4AD8E5D89E1D00871DD230BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 2f481d002ec152926eec3a3ada9a7f5d4a1a284f5588a851c1780c845e2bffb2
MD5 203f817b06f165236d1657084116ae50
SHA1 7c02d66ad6c28968bc652670491c4df8e95e0460
SHA512 fd5aabf3be728e52424f25907cad286e27675d0a5371457b92f365035e0c8792546f72a20be2bde3cd98a72091695eeadb770f4a912c6a5a11a100628ccba52d
SSDEEP 384:nCiFJjccCs+Bt0S3p3sNM8TUNTUlI4JRihZc03x8vfDYH5R9DBzqBgctqn7lnL1E:JFJccQJ3nwgkiMCGYH/lZqaj7lnFHk
TLSH
T1D3C25C35E894DDABECE68FD9F34A3743AEE001A3958C9AD8D5C98E1D00871DD170BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 03fca872b99ee68d05a1a3a43144dca610fa6e345685420d9c5757a50023c34e
MD5 a3acd01f08775f6e104edb63ee516039
SHA1 a1694381f9b1b51f7469fda4000f5792be928107
SHA512 4f66fa198a1d1cce967e03f0778ec73aaec18d2d0420d77f65c906acc1118e651e84bad64b53e82e51ab6b10cc469a565ba4847aa284781e340944f5ad515089
SSDEEP 384:nqiFxjccCs+Bt0S3p3sNM8TUNTUlI4lRihZc03x8vfDYH5R9DBzqBgctqn7lnL1E:hFBccQJ3nwgQiMCGYH/lZqaj7lnFHk
TLSH
T114D25C35E894DDABECEA8FD9F34A7743AEE001A3958C5AD8D5C88E1D00871DD170BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 54f761e00d363bd15db7bae3cc55144c80148a5fa1db7c3c2049e0e406a9142c
MD5 b1ac780361002049b0a10a7fd30fd809
SHA1 0ee0a7dc27fd175ab7abd6e5649890be3e2795b5
SHA512 1bd8b1d2dc30bc62728d3d08085a446e8c037b02499687affa9a0bb18c6bdfee19104eabdcd8a52c2d0b542046abf26b7fdf81815037d4923e31231b0dfb7d60
TLSH
T156C02B5538F9488C2FA5257ED238092E12E4C912310022B0002ED804103465C13A0C2F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 c0b726874dcb028a3737bba344ed3c9ed9b90c6a1171cbd0e70bd7ba6bdc14dd
MD5 4bec211a41a6890ef1631df5217fd0c8
SHA1 7615c1bb6bc1842a81a8d1e42dd2aac51a7d5406
SHA512 f5080fd86aadf567f930f8bb7d6e9b3b560ef02271521de56d310b585bad2106e2e71a461a476498fb6ef05f3d96afa30a12b237583ca9c0e03ac927ed2f2cf1
TLSH
T18741F35CAAF90108B3B77F5A9BF7A86D487AB82B2F07D15E00110D4F0A22B41D871B33
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.7_(x86)_20260423102345_000_DotNetHost.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.7_(x86)_20260423102345_000_DotNetHost.log
Size 2KB
SHA256 32a35540d1202a970287b4e4e81b30beed898353c02e74a7a66d90643b4f8d33
MD5 a4f15b92c99214ddc726e7b030f7cd21
SHA1 0aa0a1e9573d1ca6c1a9c7a49ad4c88932f432d6
SHA512 674a078b714208f704493646364b3c66a3ec6c4bc6c79c7bf1ab40f85cef7fc41f9d22160eced659196d62c1f15e38cdcb61c6174c12546c00a4d90c8445db40
TLSH
T1A6410B551AF41984B1B66707DAF3D053AA73BCC2B834DF4C2385431A076FD06696CBBA
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.7_(x86)_20260423102345_001_DotNetHostFxr.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.7_(x86)_20260423102345_001_DotNetHostFxr.log
Size 2KB
SHA256 d861860ac7f3e0306ae8d4b4192304b31d33bf245516de0ab905d4d390bd3dfa
MD5 83a8589b1ae9ffedad4b69e5c194dc74
SHA1 74e925937276504db288a4a89db1052a19ed163e
SHA512 d955279761da2b1ab8974071e9112572df20c2e30c79a99ebaa3df743019caad03a9c0f6a69d89a1cb987e3ff13db69a9dcca0cda13f368863c2b3a8136fccd3
TLSH
T10941061A1AE41944B1B6A707DAF3C0535A33FCC6A874DF4C23C4431A076BD07786CBAA
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.7_(x86)_20260423102345_002_DotNetRuntime.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.7_(x86)_20260423102345_002_DotNetRuntime.log
Size 2KB
SHA256 f43465c9071a833bf943ea426b323741cba597eda1e60fd0b18b02f83a888a9c
MD5 b877e03f880dfb4139b71bc116ab650b
SHA1 1a8f2888b4d2a110308906dfb212f66f54d5c55e
SHA512 814a142d6b9b552f49b95c1f616ff716159d7ac9045539619b23a21d5bdae927e623ca72f2bf7604d256003f1d53286da84881ab397317330bf1c05c2fa1b8a4
TLSH
T18F41C4651AE40995B1B75707DAF3D0535A73BCC7B830DF4C2385831A076B906A8ACBBA
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.7_(x86)_20260423102345_003_WindowsDesktopRuntime.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.7_(x86)_20260423102345_003_WindowsDesktopRuntime.log
Size 2KB
SHA256 7ad8bd1843d4d773121c97b4f5f5d2de0c23d3f3d4c04456d2b374872fec0c93
MD5 c2f2e32098f5ce4e1c17c2bc1d4c06ac
SHA1 669a41016fdb2f1dc5356b3f8b5e1ed9192aba20
SHA512 bbf4922eaeb9bed260080ed1d1c5ca9ebf3c97cf11ac7b496b5301e02360bf5dab4af74468745c66163e5c307c54eb505598f16b63fba553146133adcf9e2846
TLSH
T17041D7591EE51985B1BB5707DEF3D0527A73FCC3A830EF4C1385831A066B906686CBAE
MD5 SHA1 SHA512 TLSH

Submit Download

DotNetHost

Path C:\Users\Admin\AppData\Local\Temp\{594FAB8E-929F-4302-A7A6-96F3940E555C}\DotNetHost
Size 900KB
SHA256 efe1a594f21ea09c5c6f3f75d5618df0ff6bb465e1b7a440394eeadf06d86bdb
MD5 6b8563447431316d2fec41888d36a80a
SHA1 12e0efe2109fb356fa980e7bf7575fbd248cc64c
SHA512 9007dcba3c7adcb29aafcfd77e18a398903cb65f53e51b04c351625751c8fb95d29d2cbc34a232feffc95f900af956d7a75c9a7b3e434a079d9c72c41ca39845
SSDEEP 12288:8jcnTi8XiHmGdKkg78We96sI+yDxTYwsoCm1p:ecnTiadGdKkg78We96FDxTYwsvq
TLSH
T19C157C23BC419036D9EA0D72A438CB616E3D7D14279488DB9390B94DFCF06D26FB26D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetHostFxr

Path C:\Users\Admin\AppData\Local\Temp\{594FAB8E-929F-4302-A7A6-96F3940E555C}\DotNetHostFxr
Size 956KB
SHA256 767110859ec26785e7cccf654785f32e3753b545a6c9003d55bd280da9b395d4
MD5 85dcd01ef3e23d75cc9b6ab925f9eb5e
SHA1 64f9491648d78d252bf06c30f042a8def4a203e3
SHA512 a9faab719ffd01d6a6c3ae726679bdc711f9c1311787de148ffc8870611769fe4798a87b6100d0262e3efd04cdcef0bfa7d64316ac6601cff07057d7a8238475
SSDEEP 24576:lcnTiadGdKkg78We96FDxTYwsvqV8iw+f:lcTi8GExDdYwsvlhY
TLSH
T154258C237C41A036D9EA0D72A478CB616E3DBD14279484DB5390B94DFCF06C2ABB27D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetRuntime

Path C:\Users\Admin\AppData\Local\Temp\{594FAB8E-929F-4302-A7A6-96F3940E555C}\DotNetRuntime
Size 19.4MB
SHA256 53c476fbae67238a5549571d7d78a14f23eb76ee55653a4fd780bb63ea75e3ff
MD5 d8cdc2d1d4dd88cc7d94d3a7b1c7c44b
SHA1 3f4a58468fca9bdbb462435b70980097506d8b89
SHA512 b60b6d12d3c5d136622a89efc6adb0bd553a7e3bc9daef8dce7bf7d708e24747c7d2c7f122f4492c4c8e50aff0d41767e5480489d124c06c45895f63a728c01c
SSDEEP 393216:LUErHl/lgAoF7HKZNDnc7ORmYGD9rTKPGKWBHhdBwNZs68C3z+aQK/Ysda/L0uJN:AAw74NDnKORiD9fNBvBwDs6jz+Gws44c
TLSH
T1F6273323BC42A032D5FE0D32A47A9B74292C7920174859DB93D0BD5DF8F02D59B72BDA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsDesktopRuntime

Path C:\Users\Admin\AppData\Local\Temp\{594FAB8E-929F-4302-A7A6-96F3940E555C}\WindowsDesktopRuntime
Size 19.6MB
SHA256 3dd8165d16107981a883140ac3c7df8d2aac432b413ec4bf74054d3786cad94d
MD5 db4d1ae3af8bef883f6fa3af45fac900
SHA1 6a749bb727d66016eacc43a7437da6e3ec4cd678
SHA512 3aeebf514d31b9dbc3958b4dfccbdfce041ce6b8b33cdd12fc6f0e4d98bac807b15f9f3cf190ef976f0ba91c9bc41cb2c60728159cc47ed8bdc79211ac15309c
SSDEEP 393216:jssvlsIGea2XGaHP2voVResFgxXTwV+/60ci2tZO0aGO/u5xLzPJZU:xsMa2N2voVo66TV/D2tZO0I/u/3bU
TLSH
T1C4273313BC939176D6FA0CB2A579CB60283DAD1417A4448F5390B84EF8F06D26FF26D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI6473.tmp

Path C:\Windows\Installer\MSI6473.tmp
Size 346KB
SHA256 1caa470031f4f3fb53bb38187d522990a3a7423476b1b5aaa27443a3e2fc62c0
MD5 f715d24632e765c53e9856df53dc8318
SHA1 78e2280ccaeed00119fe827acc58ba10996517cb
SHA512 dd0568de924a86910d8bf59b2f0c22663268004ef9a5f80ffd78f37885f3b8538d138d1e5c70de8e4fda7aab150df48bd34e3838c976ec90ed4f0e49bed0e9e6
SSDEEP 6144:WbOobwWeCg6QvyuFtPwvGyDBQlEz8a+CFTYK0OnsoIcGm1p:W78We96sI+yDxTYwsoCm1p
TLSH
T1BF745B31A456707AE6F90872F568CB706D3CB21827D8849FC3E0E84E38645D36BB775A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e585fa9.msi

Path C:\Windows\Installer\e585fa9.msi
Size 19.2MB
SHA256 d15776c3475f49d0060907ba43452ba8a983a5d4421911c235a6fb780e9793cc
MD5 7e3ac7ff7631f27ca19ccb3e4516c8ca
SHA1 a14529c228e153548007aa88b57ae1d85b7abbce
SHA512 430813c91e9d7ded66b9d3a48521c83cc361a0b6bb20b537d76699b37aa3f1befb07997269315b1cbaff6912186ee3ac2cf54767322176817278a077bc12300e
SSDEEP 393216:LUErHl/lgAoF7HKZNDnc7ORmYGD9rTKPGKWBHhdBwNZs68C3z+aQK/Ysda/L0uJ0:AAw74NDnKORiD9fNBvBwDs6jz+Gws44B
TLSH
T1E6173323BC42A032D5FE0D32A47A9B75293C7920174859DB93C0BD5DF8F42D19B72ADA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BootstrapperApplicationData.xml

Path C:\Windows\TEMP\{594FAB8E-929F-4302-A7A6-96F3940E555C}\.ba\BootstrapperApplicationData.xml
Size 9KB
SHA256 1633b50661776a39ec9ffdc98ec19e48e0099a08ff5168cc3376137a904ee6e3
MD5 1b7efeed50be6f8ee212995070717d65
SHA1 22c3bc34718c78531cc3b56c312a54a89aebff9e
SHA512 9456bee88d409491723b8aa09ef6348b31119b5ee1ef3ba92a9d5fe7034353852c4e0f97031ae4f99e6ecaa49df5ebf611de83ad99a0c1f885318ea9920de5f3
SSDEEP 96:2BqRBM/En6YcYY0wZycirLdin6sUsD20wFycDdin6UkEc0wNycdOZdin6fMS2g05:2I1zfTK/lvjnlX0OOamagM5cYsCsysz
TLSH
T1BE12E3113BFD0218F0F3AE48EFF6A5555A36BD552E39C82D01601D0E49B2E819962FB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetLogo_256x.png

Path C:\Windows\TEMP\{594FAB8E-929F-4302-A7A6-96F3940E555C}\.ba\DotNetLogo_256x.png
Size 2KB
SHA256 0f571f95d8eab48dbc81b0ec5e9f7225e349e26ef50868bfaab556f3c2443b01
MD5 39aa52615723b782c92dec710caaec7f
SHA1 760b49e256a7979fe50a56a2b1be3688a474b886
SHA512 89d1baa3820154667747b25e9e2fd321bfb2ec71dc309915b0a28dacdc80822a4943b639ebb37c37bd2559d5a4306d2096119cd970c84a0d331f6c68b0456dc9
TLSH
T1534195CF1BFD78D7E6E557918E1A8DD232738483B4B3A42CCE7B10B8274A5642B87940
MD5 SHA1 SHA512 TLSH

Submit Download

dotnet.ico

Path C:\Windows\TEMP\{594FAB8E-929F-4302-A7A6-96F3940E555C}\.ba\dotnet.ico
Size 44KB
SHA256 61a2cbd12868cb9b359e0c78961d409b7875f072eb8e53ea88d3e6bfe2961a18
MD5 b8096652d9ec286709a2c863b244b110
SHA1 b3b7f0f4d608fad7cb59ba499d4d17c2b873a7af
SHA512 492a5aa83220bb77c178b7c5b50bf44968c0427e9e45bb97a33df14d7fb4c667ca7adde0ebb3874c7b6011057b01144e4e6651fbad62c6bcf5e0b93586c4bc7a
SSDEEP 96:r+gfbzo+wHK9NbwOY4tIWQeVlV1W9+H+guapUjFamINUItzf1dBNaIZ:ro5HuNcH4tIzeVlV1WEOFDgUWzf1PIm
TLSH
T1E913EF6DE68547C1C10C2032DB4AC792B5233C72E4DAE0C4F9D4FA7E177906965C6E6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\TEMP\{594FAB8E-929F-4302-A7A6-96F3940E555C}\.ba\thm.wxl
Size 7KB
SHA256 b00edd703dd8a475119d0e4dd70a3aaa47f0e95361af290e76d367a8edef3432
MD5 8b2c667a8bbad3153068c0ed90df7ec4
SHA1 c9e04a3a37e5e6262ab9bfecf78280171b8f7b74
SHA512 5269f00d474acccb4c48cb7bcfdf19e63557a388572d3a6335aa39191319691d924e27f70da3f3495387c319396476c63a8fd7b35835cca0901220e39783847b
SSDEEP 96:HiTgM1+XSNEzA0HtYQstYCpCwZQpCeyk5HQJM9ouvj9urz8:Ew9EmtYQstYCPC9e8
TLSH
T191E1026F68DFDEE03A732651B2B3698D6919C29A136F1CF0F869084B47635016377A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.xml

Path C:\Windows\TEMP\{594FAB8E-929F-4302-A7A6-96F3940E555C}\.ba\thm.xml
Size 11KB
SHA256 dfee8e2d075087227f19c835c145c5bb8e72a46880ea24080bb2472fd3a521be
MD5 4329e418dc56b1386d7ea29a0dcfab5b
SHA1 58387f92e89ca21b4179fb697c7de9675c59142f
SHA512 6934873d27e6efbb94da4f13ee8369b29995490051016fdf82800256b924902306d328bf1d4ebbf266d1a53eb24adb6478d1a67de4ecc3e3bcbe561968f24922
SSDEEP 96:HgvPkoeWEH3IWTaQfSJgHzth5mFahbuB8pR5+Vpwe+UIJLg1gEp+6F5pQnxc:AvoWydmQfVHMyyj5Z
TLSH
T14B42FC6851DC7811C532D702AB9371D3FF12BDA6C6C85A58B48E256B1FF262028B739C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixstdba.exe

Path C:\Windows\Temp\{594FAB8E-929F-4302-A7A6-96F3940E555C}\.ba\wixstdba.exe
Size 431KB
SHA256 2b1cee5e3e24593247854eb7a7c4308937b9c607754ed2fb83520a8706c26f1e
MD5 0e88ffd2e737ac9b9a4241616838bc23
SHA1 3c8beb465d20bcef0cd6ceca9c60286d1d15cebd
SHA512 169b9e08518834c9bc5adfe4ab7b79e07685b72f30ede1c1a386229668bde8c15da378e1274e4013ad7b84d6f7a5acc64ef0806e3b8a66322861efaa7e26b620
SSDEEP 6144:X9vfS1NP+c3ytxmg4Stlqe3B9m2LSLTwGw7C3ZLaov5xZvSdF:X9v+GIyugllqe3wwGfX5/SdF
TLSH
T129943B3165F04037C6F90572AE14FA31BF69F208231095EBA3C0DD293968AE5BBB7657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windowsdesktop-runtime-10.0.7-win-x86.exe

Path C:\Windows\Temp\{594FAB8E-929F-4302-A7A6-96F3940E555C}\.be\windowsdesktop-runtime-10.0.7-win-x86.exe
Size 967KB
SHA256 d7159bd11bc004ee485fb6fd031b71d38e4303721d0665acfefaee1fb97588fe
MD5 54b260b4c45fc5f0438080d937e0e2c8
SHA1 c7838ea3732e2619ba05fa3a9901384eeebf5fc8
SHA512 9a063312880700e71b4a1fe12365918900c033ab04c720ba880b4bc247c635ebacdf36672051948e5a07aa5e4773a2ec92a5e321a303175abd6930387a915544
SSDEEP 12288:XVGWl6qCmyZeU6lqlDjC+fScn6X8GwMgJEQaA6fTQfulZYDGSGPjR0ASh:XVGWl6qCmyt6UdmcpMzfz0xOjK
TLSH
T13D257D31A166242BD6F50973F914D2307E2CD7082B5C95BAC6C0D90D39689FA6FFB24B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/60-441-0x0000000001710000-0x0000000001830000-memory.dmp

Download

memory/60-1300-0x0000000001710000-0x0000000001830000-memory.dmp

Download

memory/1420-656-0x0000000000590000-0x00000000006B0000-memory.dmp

Download

memory/1592-359-0x0000000001750000-0x0000000001870000-memory.dmp

Download

memory/2356-265-0x000002C588600000-0x000002C58866B000-memory.dmp

Download

memory/3760-1279-0x0000000000A10000-0x0000000000B30000-memory.dmp

Download

memory/3760-1250-0x0000000000A10000-0x0000000000B30000-memory.dmp

Download

memory/3776-1230-0x0000000001400000-0x0000000001520000-memory.dmp

Download

memory/4092-924-0x0000025F51300000-0x0000025F5130C000-memory.dmp

Download

memory/4160-437-0x0000000001210000-0x0000000001330000-memory.dmp

Download

memory/4640-414-0x0000000000770000-0x0000000000890000-memory.dmp

Download

memory/4848-1271-0x0000000000AC0000-0x0000000000BE0000-memory.dmp

Download

memory/5236-1247-0x00000000011F0000-0x0000000001310000-memory.dmp

Download

memory/5384-1291-0x0000000000CC0000-0x0000000000DE0000-memory.dmp

Download

memory/5384-1297-0x0000000000580000-0x0000000000646000-memory.dmp

Download

memory/5384-1298-0x0000000000CC0000-0x0000000000DE0000-memory.dmp

Download

memory/5384-923-0x0000000000CC0000-0x0000000000DE0000-memory.dmp

Download

memory/5456-1277-0x0000000001540000-0x0000000001660000-memory.dmp

Download

memory/5456-1281-0x0000000001540000-0x0000000001660000-memory.dmp

Download

memory/5612-1282-0x0000000000AC0000-0x0000000000BE0000-memory.dmp

Download

memory/5612-960-0x0000000000AC0000-0x0000000000BE0000-memory.dmp

Download

memory/5624-442-0x0000000000B10000-0x0000000000C30000-memory.dmp

Download

memory/5624-1295-0x0000000000B10000-0x0000000000C30000-memory.dmp

Download