873fd333cd8e687b874af8dca2f043c50ea1f4bc64d496015ca038da383b91f0

Analysis

user interaction
yes
max time kernel
150s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
24/04/2026, 03:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Velocity.exe
Size 32.9MB
Sample260424-d1xeaady3s
SHA256 873fd333cd8e687b874af8dca2f043c50ea1f4bc64d496015ca038da383b91f0
MD5 83da367e14fe39262fcf57c39dc3180b
SHA1 a0d2655ceff2d35b7eceb55e2be1058b966970e2
SHA512 8ce8b77b95640a111d43b75ff76bdfdacfd8680a39c5d5c6a97fdef7aef18bd7470a4df4716fd3c67a51cfed69a710d6c33086c864a0b91ea0c03966b8a97df5
SSDEEP 196608:ktQ56WdpH6emXAro0JTToUgmwh8qZYOCu51ZTAFLzbjblIjvT7CThIPPBrYjPWDx:kt6pHxmXf0J9A8qCFqAFLKnCTMGPWl
TLSH
T1A9779E22A3A44E3DC99F5773E4B603254335CA06AF43939E581CA69C1F933860B59BF7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery persistence

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
70	4664	msedge.exe

Executes dropped EXE 7 IoCs

pid	Process
3812	windowsdesktop-runtime-10.0.7-win-x86.exe
4340	wixstdba.exe
3912	windowsdesktop-runtime-10.0.7-win-x86.exe
1796	windowsdesktop-runtime-10.0.7-win-x86.exe
1928	windowsdesktop-runtime-10.0.7-win-x86.exe
940	wixstdba.exe
4452	windowsdesktop-runtime-10.0.7-win-x86.exe

Loads dropped DLL 5 IoCs

pid	Process
4048	MsiExec.exe
4664	MsiExec.exe
2504	MsiExec.exe
2976	MsiExec.exe
2116	MsiExec.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{580865E1-2073-4861-8356-3D20DFF3D50E} = "\"C:\\ProgramData\\Package Cache\\{580865E1-2073-4861-8356-3D20DFF3D50E}\\windowsdesktop-runtime-10.0.7-win-x86.exe\" /burn.runonce"	windowsdesktop-runtime-10.0.7-win-x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{580865E1-2073-4861-8356-3D20DFF3D50E} = "\"C:\\ProgramData\\Package Cache\\{580865E1-2073-4861-8356-3D20DFF3D50E}\\windowsdesktop-runtime-10.0.7-win-x86.exe\" /burn.runonce"	windowsdesktop-runtime-10.0.7-win-x86.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.IO.IsolatedStorage.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\ko\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.IO.FileSystem.AccessControl.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Resources.Writer.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Threading.Overlapped.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\System.Private.Windows.GdiPlus.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\System.Windows.Input.Manipulations.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\ko\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.ComponentModel.Annotations.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\System.Windows.Forms.Design.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\pl\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\pt-BR\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\zh-Hant\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\Microsoft.CSharp.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Reflection.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\es\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Security.Claims.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\pl\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\pt-BR\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\zh-Hans\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\zh-Hant\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\hostpolicy.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\pt-BR\UIAutomationTypes.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\zh-Hans\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\ThirdPartyNotices.txt	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Resources.Reader.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Runtime.Handles.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\it\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\pt-BR\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\ru\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.IO.UnmanagedMemoryStream.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.ComponentModel.Primitives.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Data.DataSetExtensions.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Net.Requests.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Threading.Timer.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\pl\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\de\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\it\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\ko\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\tr\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\zh-Hans\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.IO.Compression.ZipFile.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\clrgc.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\PresentationFramework.AeroLite.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\cs\WindowsBase.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\Microsoft.NETCore.App.deps.json	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\WindowsBase.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\System.Diagnostics.EventLog.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\pt-BR\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\tr\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\zh-Hans\WindowsBase.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Diagnostics.Tracing.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Formats.Tar.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Text.Encoding.CodePages.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\System.Resources.Extensions.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\ja\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Runtime.Numerics.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Security.Principal.Windows.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\mscorrc.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\D3DCompiler_47_cor3.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\PresentationFramework.Aero2.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\cs\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\it\WindowsBase.resources.dll	msiexec.exe

Drops file in Windows directory 50 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\~DF4CDE8DD42E348666.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFCC149D24A64FE90A.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFA663E09AD94C654E.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF4DBA133D83ECF77A.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF10CA2C4F3571F956.TMP	msiexec.exe
File created	C:\Windows\Installer\e5957da.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF597048B861CB6677.TMP	msiexec.exe
File created	C:\Windows\Installer\e5957df.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6182.tmp	msiexec.exe
File created	C:\Windows\Installer\e5957e8.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF2B14612F0920EB25.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFA91A9E465B0027F5.TMP	msiexec.exe
File created	C:\Windows\Installer\e5957ed.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7FED.tmp	msiexec.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF38B31EC7789691CA.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e5957df.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFD1C9EF23FD18AA17.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF49137F008C9EBE9E.TMP	msiexec.exe
File created	C:\Windows\Installer\e5957e4.msi	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3116_1207712974\manifest.json	msedge.exe
File created	C:\Windows\Installer\SourceHash{09AE2CD2-101D-45E8-8922-51ABAA31F8CC}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6711.tmp	msiexec.exe
File created	C:\Windows\Installer\e5957e9.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5957e9.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFBA60FB22813C2C92.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF5B47D3302DAC6A2E.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF9DF7A627E385D610.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF3B56C274B9B8E660.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFAC4F20F5B72EEADA.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{2A17EBA5-4EEE-4A8A-9CEE-E8B67938B606}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6EE2.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF3E825FC3955D5691.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5E33.tmp	msiexec.exe
File created	C:\Windows\Installer\e5957de.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5EE0.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFF6E79B2DA23E9203.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e5957e4.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI60E5.tmp	msiexec.exe
File created	C:\Windows\Installer\e5957e3.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF0295897F530C2252.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{6F122B2D-6824-4922-A23E-A9151114EE7A}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI723E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI79D1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7FAE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5957da.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{EF889568-39DF-4FBB-83A6-893DF0A5A7D7}	msiexec.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.7-win-x86.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Velocity.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.7-win-x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wixstdba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.7-win-x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.7-win-x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.7-win-x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.7-win-x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wixstdba.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3116	msedge.exe
4664	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 13 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2B	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134214750092185009"	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\865988FEFD93BBF4386A98D30F5A7A7D\SourceList	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2DC2EA90D1018E54982215BAAA138FCC\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2DC2EA90D1018E54982215BAAA138FCC\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2DC2EA90D1018E54982215BAAA138FCC\SourceList\Media\1 = ";"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5ABE71A2EEE4A8A4C9EE8E6B97836B60\AdvertiseFlags = "388"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5ABE71A2EEE4A8A4C9EE8E6B97836B60\Clients = 3a0000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5ABE71A2EEE4A8A4C9EE8E6B97836B60\Version = "1344064284"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D2B221F6428622942AE39A511141EEA7	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\dotnet_runtime_80.28.51996_x86	windowsdesktop-runtime-10.0.7-win-x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\865988FEFD93BBF4386A98D30F5A7A7D\MainFeature	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2DC2EA90D1018E54982215BAAA138FCC\Version = "1344064284"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5ABE71A2EEE4A8A4C9EE8E6B97836B60\ProductName = "Microsoft .NET Runtime - 10.0.7 (x86)"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5ABE71A2EEE4A8A4C9EE8E6B97836B60\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D2B221F6428622942AE39A511141EEA7\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D2B221F6428622942AE39A511141EEA7\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{0f62ff89-5cc3-5dfe-ec82-db9d826b6527}	windowsdesktop-runtime-10.0.7-win-x86.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.28.51996_x86	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\0D507D71850510965704F554DD712F7E	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D2B221F6428622942AE39A511141EEA7	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D2B221F6428622942AE39A511141EEA7\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_80.28.51996_x86\Dependents	windowsdesktop-runtime-10.0.7-win-x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.28.51996_x86\DisplayName = "Microsoft .NET Host FX Resolver - 10.0.7 (x86)"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x86	windowsdesktop-runtime-10.0.7-win-x86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2DC2EA90D1018E54982215BAAA138FCC\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5ABE71A2EEE4A8A4C9EE8E6B97836B60	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D2B221F6428622942AE39A511141EEA7\Provider	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{0f62ff89-5cc3-5dfe-ec82-db9d826b6527}\Version = "10.0.7.50000"	windowsdesktop-runtime-10.0.7-win-x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\865988FEFD93BBF4386A98D30F5A7A7D\SourceList\Media\1 = ";"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2DC2EA90D1018E54982215BAAA138FCC\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5ABE71A2EEE4A8A4C9EE8E6B97836B60\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3178EEBD72B5CC250FFFEA4077368656	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\windowsdesktop_runtime_80.28.51996_x86	windowsdesktop-runtime-10.0.7-win-x86.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2DC2EA90D1018E54982215BAAA138FCC\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5ABE71A2EEE4A8A4C9EE8E6B97836B60\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{2A17EBA5-4EEE-4A8A-9CEE-E8B67938B606}v80.28.51996\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{0f62ff89-5cc3-5dfe-ec82-db9d826b6527}\DisplayName = "Microsoft Windows Desktop Runtime 10.0.7 (x86)"	windowsdesktop-runtime-10.0.7-win-x86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x86\DisplayName = "Microsoft .NET Host - 10.0.7 (x86)"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.28.51996_x86	windowsdesktop-runtime-10.0.7-win-x86.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\dotnet_runtime_80.28.51996_x86	windowsdesktop-runtime-10.0.7-win-x86.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\windowsdesktop_runtime_80.28.51996_x86	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{0f62ff89-5cc3-5dfe-ec82-db9d826b6527}	windowsdesktop-runtime-10.0.7-win-x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2DC2EA90D1018E54982215BAAA138FCC\PackageCode = "76A15FE2D7C0C094BAC51D0288AFF67C"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5ABE71A2EEE4A8A4C9EE8E6B97836B60	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5ABE71A2EEE4A8A4C9EE8E6B97836B60\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D2B221F6428622942AE39A511141EEA7\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{6F122B2D-6824-4922-A23E-A9151114EE7A}v80.28.51996\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x86	windowsdesktop-runtime-10.0.7-win-x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.28.51996_x86\ = "{09AE2CD2-101D-45E8-8922-51ABAA31F8CC}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2DC2EA90D1018E54982215BAAA138FCC	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2DC2EA90D1018E54982215BAAA138FCC\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\865988FEFD93BBF4386A98D30F5A7A7D\ProductName = "Microsoft .NET Host - 10.0.7 (x86)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\865988FEFD93BBF4386A98D30F5A7A7D\PackageCode = "145EF10EFC3685A4188A83437E504485"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5ABE71A2EEE4A8A4C9EE8E6B97836B60\SourceList\Net	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D2B221F6428622942AE39A511141EEA7\Version = "1344064284"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D2B221F6428622942AE39A511141EEA7\SourceList\Net	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\865988FEFD93BBF4386A98D30F5A7A7D\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3119821332-640943685-2562343641-1000\{837FF464-F75E-4415-8BAD-3B76F0314F89}	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\865988FEFD93BBF4386A98D30F5A7A7D\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{EF889568-39DF-4FBB-83A6-893DF0A5A7D7}v80.28.51996\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\B9FD6305CAA5D224A5486ED10DAF7290	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2DC2EA90D1018E54982215BAAA138FCC\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{09AE2CD2-101D-45E8-8922-51ABAA31F8CC}v80.28.51996\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_80.28.51996_x86\ = "{6F122B2D-6824-4922-A23E-A9151114EE7A}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_80.28.51996_x86\Dependents\{580865E1-2073-4861-8356-3D20DFF3D50E}	windowsdesktop-runtime-10.0.7-win-x86.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\865988FEFD93BBF4386A98D30F5A7A7D\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5ABE71A2EEE4A8A4C9EE8E6B97836B60\SourceList\PackageName = "dotnet-runtime-10.0.7-win-x86.msi"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D2B221F6428622942AE39A511141EEA7\InstanceType = "0"	msiexec.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.7-win-x86.exe:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2520	msiexec.exe
2520	msiexec.exe
2520	msiexec.exe
2520	msiexec.exe
2520	msiexec.exe
2520	msiexec.exe
2520	msiexec.exe
2520	msiexec.exe
2520	msiexec.exe
2520	msiexec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3912	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeIncreaseQuotaPrivilege	3912	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeSecurityPrivilege	2520	msiexec.exe
Token: SeCreateTokenPrivilege	3912	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeAssignPrimaryTokenPrivilege	3912	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeLockMemoryPrivilege	3912	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeIncreaseQuotaPrivilege	3912	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeMachineAccountPrivilege	3912	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeTcbPrivilege	3912	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeSecurityPrivilege	3912	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeTakeOwnershipPrivilege	3912	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeLoadDriverPrivilege	3912	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeSystemProfilePrivilege	3912	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeSystemtimePrivilege	3912	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeProfSingleProcessPrivilege	3912	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeIncBasePriorityPrivilege	3912	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeCreatePagefilePrivilege	3912	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeCreatePermanentPrivilege	3912	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeBackupPrivilege	3912	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeRestorePrivilege	3912	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeShutdownPrivilege	3912	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeDebugPrivilege	3912	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeAuditPrivilege	3912	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeSystemEnvironmentPrivilege	3912	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeChangeNotifyPrivilege	3912	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeRemoteShutdownPrivilege	3912	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeUndockPrivilege	3912	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeSyncAgentPrivilege	3912	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeEnableDelegationPrivilege	3912	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeManageVolumePrivilege	3912	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeImpersonatePrivilege	3912	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeCreateGlobalPrivilege	3912	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeRestorePrivilege	2520	msiexec.exe
Token: SeTakeOwnershipPrivilege	2520	msiexec.exe
Token: SeRestorePrivilege	2520	msiexec.exe
Token: SeTakeOwnershipPrivilege	2520	msiexec.exe
Token: SeRestorePrivilege	2520	msiexec.exe
Token: SeTakeOwnershipPrivilege	2520	msiexec.exe
Token: SeRestorePrivilege	2520	msiexec.exe
Token: SeTakeOwnershipPrivilege	2520	msiexec.exe
Token: SeRestorePrivilege	2520	msiexec.exe
Token: SeTakeOwnershipPrivilege	2520	msiexec.exe
Token: SeRestorePrivilege	2520	msiexec.exe
Token: SeTakeOwnershipPrivilege	2520	msiexec.exe
Token: SeRestorePrivilege	2520	msiexec.exe
Token: SeTakeOwnershipPrivilege	2520	msiexec.exe
Token: SeRestorePrivilege	2520	msiexec.exe
Token: SeTakeOwnershipPrivilege	2520	msiexec.exe
Token: SeRestorePrivilege	2520	msiexec.exe
Token: SeTakeOwnershipPrivilege	2520	msiexec.exe
Token: SeRestorePrivilege	2520	msiexec.exe
Token: SeTakeOwnershipPrivilege	2520	msiexec.exe
Token: SeRestorePrivilege	2520	msiexec.exe
Token: SeTakeOwnershipPrivilege	2520	msiexec.exe
Token: SeRestorePrivilege	2520	msiexec.exe
Token: SeTakeOwnershipPrivilege	2520	msiexec.exe
Token: SeRestorePrivilege	2520	msiexec.exe
Token: SeTakeOwnershipPrivilege	2520	msiexec.exe
Token: SeRestorePrivilege	2520	msiexec.exe
Token: SeTakeOwnershipPrivilege	2520	msiexec.exe
Token: SeRestorePrivilege	2520	msiexec.exe
Token: SeTakeOwnershipPrivilege	2520	msiexec.exe
Token: SeRestorePrivilege	2520	msiexec.exe
Token: SeTakeOwnershipPrivilege	2520	msiexec.exe

Suspicious use of FindShellTrayWindow 14 IoCs

pid	Process
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
4340	wixstdba.exe
940	wixstdba.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1176 wrote to memory of 3116	1176	Velocity.exe	79
PID 3116 wrote to memory of 1892	3116	msedge.exe	80
PID 3116 wrote to memory of 4664	3116	msedge.exe	81
PID 3116 wrote to memory of 2636	3116	msedge.exe	82
PID 3116 wrote to memory of 2636	3116	msedge.exe	82
PID 3116 wrote to memory of 2636	3116	msedge.exe	82
PID 3116 wrote to memory of 440	3116	msedge.exe	83
PID 3116 wrote to memory of 440	3116	msedge.exe	83
PID 3116 wrote to memory of 1860	3116	msedge.exe	87
PID 3116 wrote to memory of 1860	3116	msedge.exe	87
PID 3116 wrote to memory of 1860	3116	msedge.exe	87
PID 3116 wrote to memory of 1844	3116	msedge.exe	86
PID 3116 wrote to memory of 1844	3116	msedge.exe	86
PID 3116 wrote to memory of 1844	3116	msedge.exe	86
PID 3116 wrote to memory of 3404	3116	msedge.exe	88
PID 3116 wrote to memory of 1244	3116	msedge.exe	89
PID 3116 wrote to memory of 3404	3116	msedge.exe	88
PID 3116 wrote to memory of 3404	3116	msedge.exe	88
PID 3116 wrote to memory of 1244	3116	msedge.exe	89
PID 3116 wrote to memory of 1244	3116	msedge.exe	89
PID 3116 wrote to memory of 3080	3116	msedge.exe	90
PID 3116 wrote to memory of 1684	3116	msedge.exe	91
PID 3116 wrote to memory of 3080	3116	msedge.exe	90
PID 3116 wrote to memory of 3080	3116	msedge.exe	90
PID 3116 wrote to memory of 1684	3116	msedge.exe	91
PID 3116 wrote to memory of 1684	3116	msedge.exe	91
PID 3116 wrote to memory of 2976	3116	msedge.exe	93
PID 3116 wrote to memory of 2976	3116	msedge.exe	93
PID 3116 wrote to memory of 2976	3116	msedge.exe	93
PID 3116 wrote to memory of 1116	3116	msedge.exe	94
PID 3116 wrote to memory of 3888	3116	msedge.exe	95
PID 3116 wrote to memory of 1116	3116	msedge.exe	94
PID 3116 wrote to memory of 3888	3116	msedge.exe	95
PID 3116 wrote to memory of 4048	3116	msedge.exe	97
PID 3116 wrote to memory of 2392	3116	msedge.exe	98
PID 2392 wrote to memory of 3912	2392	msedge.exe	99
PID 3116 wrote to memory of 2308	3116	msedge.exe	100
PID 3116 wrote to memory of 2308	3116	msedge.exe	100
PID 3116 wrote to memory of 2308	3116	msedge.exe	100
PID 3116 wrote to memory of 4212	3116	msedge.exe	101
PID 3116 wrote to memory of 4212	3116	msedge.exe	101
PID 3116 wrote to memory of 2064	3116	msedge.exe	102
PID 3116 wrote to memory of 3416	3116	msedge.exe	103
PID 3116 wrote to memory of 3416	3116	msedge.exe	103
PID 3116 wrote to memory of 2080	3116	msedge.exe	104
PID 3116 wrote to memory of 2080	3116	msedge.exe	104
PID 3116 wrote to memory of 5064	3116	msedge.exe	105
PID 3116 wrote to memory of 5064	3116	msedge.exe	105
PID 3116 wrote to memory of 740	3116	msedge.exe	106
PID 3116 wrote to memory of 740	3116	msedge.exe	106
PID 3116 wrote to memory of 1224	3116	msedge.exe	107
PID 3116 wrote to memory of 1224	3116	msedge.exe	107
PID 3116 wrote to memory of 1508	3116	msedge.exe	108
PID 3116 wrote to memory of 1508	3116	msedge.exe	108
PID 3116 wrote to memory of 3796	3116	msedge.exe	109
PID 3116 wrote to memory of 3796	3116	msedge.exe	109
PID 3116 wrote to memory of 4400	3116	msedge.exe	110
PID 3116 wrote to memory of 3292	3116	msedge.exe	111
PID 3116 wrote to memory of 4428	3116	msedge.exe	112
PID 3116 wrote to memory of 4592	3116	msedge.exe	113
PID 3116 wrote to memory of 4592	3116	msedge.exe	113
PID 3116 wrote to memory of 720	3116	msedge.exe	117
PID 3116 wrote to memory of 720	3116	msedge.exe	117
PID 3812 wrote to memory of 4340	3812	windowsdesktop-runtime-10.0.7-win-x86.exe	121

C:\Users\Admin\AppData\Local\Temp\Velocity.exe
"C:\Users\Admin\AppData\Local\Temp\Velocity.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=x86&rid=win-x86&os=win10&apphost_version=10.0.0&gui=true
  2⤵
  - Drops file in Windows directory
  - System Time Discovery
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x308,0x7ffe8ce6c188,0x7ffe8ce6c194,0x7ffe8ce6c1a0
    3⤵
    PID:1892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1816,i,17780401241356241560,17611359903822251240,524288 --field-trial-handle=2176,i,5094578227858282717,2346972876226644182,262144 --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:11
    3⤵
    - Downloads MZ/PE file
    - System Time Discovery
    PID:4664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1672,i,3426100231907076702,3998667063289186733,262144 --field-trial-handle=2176,i,5094578227858282717,2346972876226644182,262144 --variations-seed-version --mojo-platform-channel-handle=2172 /prefetch:2
    3⤵
    PID:2636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2380,i,5919349474214682917,16675878051949357347,524288 --field-trial-handle=2176,i,5094578227858282717,2346972876226644182,262144 --variations-seed-version --mojo-platform-channel-handle=2732 /prefetch:13
    3⤵
    PID:440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3544,i,17428142062768966611,16930527744049282564,2097152 --field-trial-handle=2176,i,5094578227858282717,2346972876226644182,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
    3⤵
    PID:1844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3556,i,13542609191186763612,4577913396691924158,2097152 --field-trial-handle=2176,i,5094578227858282717,2346972876226644182,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
    3⤵
    PID:1860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4168,i,13274875839117373654,5388827480780359917,2097152 --field-trial-handle=2176,i,5094578227858282717,2346972876226644182,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:1
    3⤵
    PID:3404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4192,i,1234327752142979356,2803333259736393713,2097152 --field-trial-handle=2176,i,5094578227858282717,2346972876226644182,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:9
    3⤵
    PID:1244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4264,i,7576510454303071434,16294713190333078352,2097152 --field-trial-handle=2176,i,5094578227858282717,2346972876226644182,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:1
    3⤵
    PID:3080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4304,i,785750266004848228,1861655477554114871,2097152 --field-trial-handle=2176,i,5094578227858282717,2346972876226644182,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:9
    3⤵
    PID:1684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5296,i,17096702473911990229,11537751390890502446,2097152 --field-trial-handle=2176,i,5094578227858282717,2346972876226644182,262144 --variations-seed-version --mojo-platform-channel-handle=4008 /prefetch:1
    3⤵
    PID:2976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5392,i,3106565199648568162,5127763753359939853,524288 --field-trial-handle=2176,i,5094578227858282717,2346972876226644182,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:14
    3⤵
    PID:1116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,254423202409388335,3376380226269409087,524288 --field-trial-handle=2176,i,5094578227858282717,2346972876226644182,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:14
    3⤵
    PID:3888
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6212,i,15436162869674641440,11710887372958488273,524288 --field-trial-handle=2176,i,5094578227858282717,2346972876226644182,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:14
    3⤵
    PID:2256
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6212,i,15436162869674641440,11710887372958488273,524288 --field-trial-handle=2176,i,5094578227858282717,2346972876226644182,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:14
    3⤵
    PID:4048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6328,i,10046264571859232297,2684653772910405793,524288 --field-trial-handle=2176,i,5094578227858282717,2346972876226644182,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1128
      4⤵
      PID:3912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6684,i,14252910727875534904,2729747615082305438,2097152 --field-trial-handle=2176,i,5094578227858282717,2346972876226644182,262144 --variations-seed-version --mojo-platform-channel-handle=6736 /prefetch:1
    3⤵
    PID:2308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6692,i,14208711192218313108,10813592286142674871,524288 --field-trial-handle=2176,i,5094578227858282717,2346972876226644182,262144 --variations-seed-version --mojo-platform-channel-handle=6700 /prefetch:14
    3⤵
    PID:4212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7176,i,10852326176482569722,3799402426268796292,524288 --field-trial-handle=2176,i,5094578227858282717,2346972876226644182,262144 --variations-seed-version --mojo-platform-channel-handle=7196 /prefetch:14
    3⤵
    - Subvert Trust Controls: Mark-of-the-Web Bypass
    - NTFS ADS
    PID:2064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7132,i,7648430958623370778,14654570123896869629,524288 --field-trial-handle=2176,i,5094578227858282717,2346972876226644182,262144 --variations-seed-version --mojo-platform-channel-handle=4664 /prefetch:14
    3⤵
    PID:3416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4760,i,9127984784324978091,11694634403788102165,524288 --field-trial-handle=2176,i,5094578227858282717,2346972876226644182,262144 --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:14
    3⤵
    PID:2080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6212,i,16772054957922810229,640749859187897086,524288 --field-trial-handle=2176,i,5094578227858282717,2346972876226644182,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:14
    3⤵
    PID:5064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7304,i,8992313490678836122,12271018443591128141,524288 --field-trial-handle=2176,i,5094578227858282717,2346972876226644182,262144 --variations-seed-version --mojo-platform-channel-handle=4784 /prefetch:14
    3⤵
    PID:740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7432,i,4263632299752649583,283416723390424863,524288 --field-trial-handle=2176,i,5094578227858282717,2346972876226644182,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:14
    3⤵
    PID:1224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7548,i,737578964539176395,5750656371979121815,524288 --field-trial-handle=2176,i,5094578227858282717,2346972876226644182,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:14
    3⤵
    PID:1508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7552,i,6150472034258914678,15912380202689531722,524288 --field-trial-handle=2176,i,5094578227858282717,2346972876226644182,262144 --variations-seed-version --mojo-platform-channel-handle=6752 /prefetch:14
    3⤵
    PID:3796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7508,i,4716518319154844923,15740784129946571694,524288 --field-trial-handle=2176,i,5094578227858282717,2346972876226644182,262144 --variations-seed-version --mojo-platform-channel-handle=7536 /prefetch:14
    3⤵
    PID:4400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6312,i,14362991451471984614,10359843580736791575,524288 --field-trial-handle=2176,i,5094578227858282717,2346972876226644182,262144 --variations-seed-version --mojo-platform-channel-handle=7528 /prefetch:14
    3⤵
    PID:3292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7512,i,16322144571059804749,9086876069729327180,524288 --field-trial-handle=2176,i,5094578227858282717,2346972876226644182,262144 --variations-seed-version --mojo-platform-channel-handle=7452 /prefetch:14
    3⤵
    PID:4428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7532,i,9695730679337622277,8494975944085598393,524288 --field-trial-handle=2176,i,5094578227858282717,2346972876226644182,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:14
    3⤵
    PID:4592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5696,i,10791763546754836236,2088491365360635900,524288 --field-trial-handle=2176,i,5094578227858282717,2346972876226644182,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:14
    3⤵
    PID:720

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3628

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:380

C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.7-win-x86.exe
"C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.7-win-x86.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3812
- C:\Windows\TEMP\{36A878DA-56D7-4E07-B186-F47043B9CAFF}\.ba\wixstdba.exe
  "C:\Windows\TEMP\{36A878DA-56D7-4E07-B186-F47043B9CAFF}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{308C360A-72F4-40B3-BB70-AE465DADF010} {973BBBBA-075C-4F2D-90EB-FBAF4A7C17E0}
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  PID:4340
- C:\Windows\TEMP\{36A878DA-56D7-4E07-B186-F47043B9CAFF}\.be\windowsdesktop-runtime-10.0.7-win-x86.exe
  "C:\Windows\TEMP\{36A878DA-56D7-4E07-B186-F47043B9CAFF}\.be\windowsdesktop-runtime-10.0.7-win-x86.exe" -q -burn.elevated BurnPipe.{B5190738-7A7A-4AA6-9345-EB1951CE0DDC} {E78D7556-29FE-43D5-A7A2-BCA6375EBC7C} 3812
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  PID:3912

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2520
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 0816A9EB8285414E28FE1439EC6CE41E
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4048
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 53A157D377861EC6657F0CFCD23B1C62
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4664
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 593CEDEA77D8DE72CFA6FBC3CA408BB8
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2504
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding E347B4C899253C255B45DEBED64B7F72
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2976
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding FB97A757739E4F19A07BAD184DB4A924
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2116

C:\ProgramData\Package Cache\{580865E1-2073-4861-8356-3D20DFF3D50E}\windowsdesktop-runtime-10.0.7-win-x86.exe
"C:\ProgramData\Package Cache\{580865E1-2073-4861-8356-3D20DFF3D50E}\windowsdesktop-runtime-10.0.7-win-x86.exe" /burn.runonce
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1796
- C:\ProgramData\Package Cache\{580865E1-2073-4861-8356-3D20DFF3D50E}\windowsdesktop-runtime-10.0.7-win-x86.exe
  "C:\ProgramData\Package Cache\{580865E1-2073-4861-8356-3D20DFF3D50E}\windowsdesktop-runtime-10.0.7-win-x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.7_(x86)_20260424043126.log"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1928
- - C:\Windows\TEMP\{987E3934-2B1A-45A5-8476-913FE7AFE442}\.ba\wixstdba.exe
    "C:\Windows\TEMP\{987E3934-2B1A-45A5-8476-913FE7AFE442}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{FB040AF7-E562-4EFB-BE47-B00EC27BB8EC} {01278DD0-1196-4F0B-AF21-6951AEA79F2C}
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:940
- - C:\ProgramData\Package Cache\{580865E1-2073-4861-8356-3D20DFF3D50E}\windowsdesktop-runtime-10.0.7-win-x86.exe
    "C:\ProgramData\Package Cache\{580865E1-2073-4861-8356-3D20DFF3D50E}\windowsdesktop-runtime-10.0.7-win-x86.exe" -q -burn.elevated BurnPipe.{6491E8B6-FBE8-425C-9558-1E8204C6C9D5} {6EEE834F-C297-41AD-A945-9F3E20A6F802} 1928
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4452

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5957dd.rbs

Path C:\Config.Msi\e5957dd.rbs
Size 10KB
SHA256 f3a3cb8c1150b6585aca306e37101dcc4cf6ed39d3ebf53acbbfcb7f9da0389a
MD5 4ce0f27981bf2f5fbc8041b5944e76f1
SHA1 960c32ad253a01aa665a72e858229a3a06dd3fa4
SHA512 56dcfaa87b97d0920c713df541f627fff94517a2f0ea503115a15dcba28dcf8f00123d119326ea44190073d77485fb3b324015e4c85264f5721748908957cbbc
SSDEEP 96:NIvJrAQQtNa1n81RdCH2EQUieD2QPuCsThqJUieD2QPuC6jlF3MeThqVH5iyE5Mo:NKAtUhgCvvvNIbvN6OEc46kdpb
TLSH
T1CC223F01B640C2D3E89B0778EB531B143BBBC6EA571082DF01DD95784F6A78C5FA81DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5957e2.rbs

Path C:\Config.Msi\e5957e2.rbs
Size 8KB
SHA256 e0b975d86602c66a50595f6f2cf4a73921f540d73ce4048d118ba79900633dda
MD5 24690f88db07ba8a87097b605a07ee42
SHA1 c2aaf77de9d4a0c4555e47165fe260f5af3f1504
SHA512 0ca9e1cb4c93508d8f1c45807494644443f7fdc2703c5d3bad56ff68b542162330af4610de721f2b6e6b3f348ced0230b6260c69b21c52e729c7e95c17a01e82
SSDEEP 96:NFeI07BxAjrZkzC7LWQU32eD26sPuCsThq9U32eD26sPuC6jkzdYeThqRH1iUE5C:NF90LauCGv6NIn6N54EKHV9dpH
TLSH
T1B4122F81310186E2ED9A6B34C3871B24BFEBE3D79611125F25CD52205F8B7C93F642EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5957e7.rbs

Path C:\Config.Msi\e5957e7.rbs
Size 49KB
SHA256 cdf46ca71636f93b87340350f9011e4dcbd50e1cc8dfcdac7736e9ae3952e825
MD5 60c49a5a965d40f4a7faa2196727592f
SHA1 4891a4537aaa5ec1ea71cec726794810459b5132
SHA512 9d0d247e7d8c495c4fa788ddde9fe76a6171158f1b98a38b13201662004746b2add4ffe1e17bbd2adf877ea0e045c25354fa5831345f945e6199200aa41bca92
SSDEEP 384:KV7ONK0DLsrmMwoXlhkOI5RBMgumgKtaz0XHpZtcMq5UGRWBHNfrL/VZih/rAfAX:KpWilnAThuthRrghfxArH
TLSH
T132334220AB05D2E3FB226C7133E1DD08EF1ACD627744DDA914C61665C5A3DAC3EE885B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5957ec.rbs

Path C:\Config.Msi\e5957ec.rbs
Size 72KB
SHA256 87435c8fd2b37f8ef7d6033364f0e87442bb35c75c062109a926a94bae1b7158
MD5 82e99454345ac45dc9ed48272d3b90c0
SHA1 97c2cf1b0c3c94953a8bcadfb9cd53180357ac36
SHA512 b8f67662a6fac8ce7b6d44904e7433327740b054b3ee61798a5bb885b111d1e61b53870ca3f82a433bf874061324d9e9bdad2a0c6d318b70a7f06932b0afe040
SSDEEP 768:4ONxqMomkns8EnoLou+PTcKsfNTGKJL040iA0qTR0P1wKaq00a/UzZYemq0KYEtC:NNkNCnoLZ+PTlUN7umeGKymciu0KYj
TLSH
T15A731F464B91E5C5FB325EB176B7EA4CDD035CBBA292493D20C9252ECDB3D882EE44C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5957f0.rbs

Path C:\Config.Msi\e5957f0.rbs
Size 3KB
SHA256 05735979a570862dbe872552def655d86f56a31c8ff876b22c85c63c096048fd
MD5 5a5b14382569a6b3e4c49e7144d9402c
SHA1 4d3d4b821289ce7f7231ee99b1a2248aa765a84c
SHA512 ae2f080d9fefe68c765d2f4ecd9d4e452af51febfaf3f626ca0673db795f046a799261b3e8edeec0197d784c66e18ccb5985e218e77572e6890f24aed712d3ca
TLSH
T18A81DE03EA40E682ECA32F30DD57071A3777DAEA8311834B10CCD1754E4BB8A9ED6689
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE.txt

Path C:\Program Files (x86)\dotnet\LICENSE.txt
Size 9KB
SHA256 7f6839a61ce892b79c6549e2dc5a81fdbd240a0b260f8881216b45b7fda8b45d
MD5 31c5a77b3c57c8c2e82b9541b00bcd5a
SHA1 153d4bc14e3a2c1485006f1752e797ca8684d06d
SHA512 ad33e3c0c3b060ad44c5b1b712c991b2d7042f6a60dc691c014d977c922a7e3a783ba9bade1a34de853c271fde1fb75bc2c47869acd863a40be3a6c6d754c0a6
SSDEEP 192:ydP0KvBLCqikR/EgGJLrlwD+eilNi5Py1SDeoDXDw9lF5OMz6Q:PWBuqikR/EDJLriwlNi5KI1Tw9lF5OjQ
TLSH
T1EC12B57D7284177109D207E16A0AB9D6F62A953C3117AA2438FDC15923AAF2CC37F3E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ThirdPartyNotices.txt

Path C:\Program Files (x86)\dotnet\ThirdPartyNotices.txt
Size 77KB
SHA256 deb4427a295e1ed474b0d81c5a0d972c1b550b9a715cda939cdfa9236b1b418f
MD5 0d8867a25ba926e6e40cd52ab3536b5c
SHA1 89390dc8b8318d0bfef1c6a2fb4783537e28a465
SHA512 317ca335405274f4f91b173651ca2826760acb5ba5cf41aff51adc55c2cda9059fb268333665f13f62fa48119e55a303720a780dd58d28dd9967db4c88407d61
SSDEEP 1536:HA9jHwsGfgg39/zwgAVkguQxrDjugtSEGepkWvrpX7anuqdLSVnfiStPq+3LefrL:HA97w/ogz1AVxuMjHtSFULryLOgrGWm+
TLSH
T17773A45F7E45077319E2C3916569A8C5F22FA02E3B6B2A44346EF248133B42DD6FF858
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files (x86)\dotnet\dotnet.exe
Size 141KB
SHA256 8b6be8b21aae8f21fdfc0e15d350e072bd84e439c4d99e1ee8b6f38a61eabb5a
MD5 f25f2493a974dd8d01fb9410398c094f
SHA1 f6397f4c97ea07a57b846ded5c212b84ce0b25c0
SHA512 81f932c605c96e68e923e37c83eca1e1b24147b5435d3714d298ed1fb6f63ba2663d760d36441921ed80c923b0086a05ee5a27df1f853169c8d29edadcfda4b8
SSDEEP 3072:0078iKA/8gNs0xphwaNq92hxQOA7qVy2nY:0umQphy9z7qlY
TLSH
T1C5E3F725F9958162D15D1970CB29CE91BA3BAC619BE1E0C763C0FDBE0B701C0AAF5B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

state.rsm

Path C:\ProgramData\Package Cache\{580865E1-2073-4861-8356-3D20DFF3D50E}\state.rsm
Size 1KB
SHA256 a19dd723353b655af63146c5a5803f7443ac7d12dcec67794a96fc1fcf337b53
MD5 228f397fe4d0e0507e0efef78c68a831
SHA1 7e8a6eb7ef27f73d251adbc471e4ba5286fc499f
SHA512 353f76efee175efe71d40f09c0a024060c51cb1dd7ca90deda8f4edbd79f2f5d67e3da24517a352140043f43d844b6bd3877e56ed2d24228497127a96b1f50f3
TLSH
T14E2181615BF6192CF3F2AB35A9F96729543BBC125D24C16E0001318A9E72BE1C8B4B33
MD5 SHA1 SHA512 TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 538c1a0bded49157881b1c0e111a58732912def07977f599efb60ebb986ecbbb
MD5 2e5f50c6e7cd1b1d6049d9d3e57a9866
SHA1 28319f3d040fd1e80776d82fef3baa00dc34dec2
SHA512 1a56a7d8e7dc2aa514d9d57d40d74133033bdabf84bd35a3b65f0b62eeda07a00060dd4058de9c4703a2c70d201c867647a11b5cbacf4bb2c1ee4acd92d13058
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7u:fwUQC5VwBIiElEd2K57P7u
TLSH
T1F7B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 72b205beb453f50e17a365601deeef9544c1fb0a6c7471fff4fe6b93111db2cf
MD5 4545a4b7e84bcd1f6c7395a6930d3c6b
SHA1 26e12977a65c318160cfc591f3cc6ac9c106ebef
SHA512 789954b86c2f406bc6b7f62fd9619c8e956d66ddac2ac5afb6d58654154278baf2404cd620e207faa1dc05510f158069b79ca441afa4f99edcf4da9fa519cfd6
TLSH
T10DD0C02C00B15C25C0C489702841FB063F34D023140B5F3028F32C6C0D41342445B0D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 717eb4940c7fbe87ab8f0b600d1104c8a67cd4b09b0beada521544a45bbe175d
MD5 e9e994edd7a4b5a78b7b4a8f74bbf493
SHA1 df0475a3ce64d76335fb0863982edfd1a11e70b3
SHA512 d35a1536d171822e132b7f0c00b30e123c9a419e2c6192fd28ef0dd75cdabb6e20eeb4fa7c6c6085b4ad1cdf846fedf1ff5eb9437a48a09c77a49de91da73af5
TLSH
T10CD0C02C00F15C25C4C489702840FB063F34D023140B9F3128F32C6C0D42382445B0D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 332f65909ed5f8f7a51aac010085a6b4e34c728bbdca86d3d66b389da5491eb6
MD5 8c747522cef7834fbceb586c4713088d
SHA1 605454143cc8e1e60d0382dd551417755427fbdf
SHA512 a27b3748934ba1ec458244b67c41c9a656f9d699845fe7183883efc05e83c50a7d675a0ffd74df5aaa864c9f58e292057d4ff00d65a02ee78888682aa0327af8
TLSH
T19DD023387595D40BD13800337651D2517F758601345B4F90B5A5C84CE6583BF97DE0C6
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 e044b9fddefb93e2969ac8c359535bced2b88f6a894c0a156fb658bc7dc4bf10
MD5 d460eecb97d2d1d750d0c6940d1ad4d7
SHA1 7632777f27777021709fbb13a7220d2a7e5c1f9e
SHA512 1f3b0eca3b19ef128092bd45c8434216d61ebe419f512e708bfb011c392a5de3ce8dab8baa3c57faf625d3256ff788b6dcbc2fc2d1309892a8268ac4a604c826
TLSH
T15871E85DE0B283DAEBE857B54AE6C72032F10D5435872ECF16D4807C9D5E7A641BCC04
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe587a7a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe587a7a.TMP
Size 3KB
SHA256 e9cb9754c7ce10bf182c81eb8e0140d198086b33a2f1b8d49c3e45c7edb528ad
MD5 1032fb06a6e60835449069c0467055fd
SHA1 357d6fe5a5135055c5dabdafc1eca38fd63131dd
SHA512 4a077d315931179e4c994a2be86cb459c8d90ff3e3884b4c9887dee979fe5b525fdb91cfcc4713838e7ab19d0a434282c9d3a8ffaaed84aa2d3961761e5bcad8
TLSH
T1D871D61DE0B687DAEBE853B446E6D76032F14E4430872ECF06E4817D9D1E7A281BDC04
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 5f30da39e4d9180bcff82775bcdcccfc4290a4c881d88dbd1f152ce992d09b47
MD5 fc505458969f538396935d7367125d9b
SHA1 d805371dd2c948b3a6dc995326cdc045aede0a10
SHA512 6276cda2ffeff0978204ae72aa462a910e7a3b2405c1e34acf6b8e386fb0bbb4e12d486f57348ac03c6678082aa331d012674d26a7c43cf43c9c1720a29f2d45
SSDEEP 3:MsEllllkEthXllkl2zE/lKLa:/M/xT02zha
TLSH
T1A24402146B914906C50011355052C3901770D62106125743659105226D95A801D00200
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 f50caa2b23d60b633ecf63f1ffadd02bf948a678225507240ba83f832b8697c3
MD5 8b4e60e4b61237a598ad6ee535515906
SHA1 52cda7b98f80c8726881f9a5d89e4714bd6113c5
SHA512 d28453a1a3747f1ecccb069ba108fa2370632737833131b2238185f29652d7fab64f1d5f07fef0645e68e03cf5f96aa3b116f828c82b4e7abcdf2612f1fcee92
TLSH
T13751C0F787B4856E9A1196F0AA18AE1FDF2D0515431C3C6A89E0EE27D3E3471E10265B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 de096964c97aa0d28f3716b976dd396d4a37a3e88be7a181589b3b870ec3bb43
MD5 66a25d80232ae0a1c599a2377bd8e313
SHA1 2b30a57b375a31ba22beba759901ee38a7acb4f8
SHA512 1e0a3a2050e2ad60af2a149b87e4042e691e7ec6dcd12d98941561c29d76c8d911db12f0d2bebf2939406ac517f06e4991a877cf7b226d3816da02ac56ff2018
TLSH
T10651C0F787B4856E9A1196F0AA18AE1FDF2D0515431C3C6A89E0EE27D3E3471E10265B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 1b3b83e5439208355f4ddad59e96070e1ce3e3daa86795b3670167f3c2fa332c
MD5 00887f4398520dc5ae2abab74d98fc83
SHA1 f44af2cf43db0f493ccad4a0b7131332d1fce05b
SHA512 a21360f652acfffb75ea620c48eda818fbae998f7d8b67f41eb8845b0f28cfb0c030d86343c8b7ecf2143db7a857d34c3cc69b4b65a33634dc6d201ead9d3358
SSDEEP 192:sxZyF/yM//K1Ml8Yluc/fOWs1WpVYPzohiIdp5B/W6+WN4S3LID/Y0p1ILOKLIgs:sxZi9jx/f9s1WvYPzEb/b5k/5r0s
TLSH
T1B062F846AA349977CCDBD209FA45BF53D6F9146292900E489EFCCA0C01E7BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 9cd6222e4faa83b6bb15867ea3061fbef8bb4c83cd6c021ffca08f52d76d7e61
MD5 c755451c5f4fe5670631ec9a9dc48da3
SHA1 b18eced934f5eafda26e78b0ec0b6ce62ae6d01d
SHA512 3491bba99044dbcaac7643b089beca585ced2938b37708616f3668350cd1044cfa04fee49ee7ceb30bb33d392b451545ec8e624115ae93d50071454125a202e2
SSDEEP 192:sxZyF/yM//K1Ml8Mluc/fOWsvP/ViIdpfB/W6+WNrLID/Y0FvdHL5+ZIg4J:sxZi9tx/f9svP/pZ/bA/51yc
TLSH
T12E52E916AA349977CCDBD209BA55BB53D6F9147292900E489EFCCA0C04E6BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 3022bfa4cd533f33bbf59fda4971927822530d9d07fb1edb5e7f993a204a0482
MD5 6ec301a0807c6a4d87e18132766de738
SHA1 814597b597644d05745d0a07c5ca0e23a6fe6ae4
SHA512 629a44fa32f020f2a3c088a661a37ea7d707a9f5bd8273a841cfd46fea80cd4325d50f04828eb0c12657afbd90a5f1c8288ae6dc7792b761a0d1fc221cc5ffb4
SSDEEP 192:sxZyF/yM//K1Ml8MHuc/fOWszPzohiIdp5B/W6+WNrLID/Y0FvI55+ZIg5MJ:sxZi9/x/f9szPzEb/bA/5Yym
TLSH
T118620956AA349977CCDBD209B945BF53D6F9547292900E489EFCCA0C00E6BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 1b3f8058ad06113f8007ce15ea870c54745d3f1a0bd8f78a0a93d73841d65c0a
MD5 6cc577b5ed36ee600d31b000bea625bd
SHA1 859e3e59bb2ddbef997f9eba78d663cbfa1af3bc
SHA512 ed0b5747663c12f2ac56e08cde13df62f3f7bac462817e83d6a003996478f7bb9ba76f374ddc6a45c2200a4bbaee7cbec1c75380299a8ddcbd32fa07ea688cd5
SSDEEP 768:nmP7x8t12P0WRmoMQ3A8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3KzLl/cK0Ficro2G:nmP7x8t12P0WRmoMQ3Au1jaKKzLpcTF4
TLSH
T1E7E21B3B284CC77E4F844E9CDC26AF966DD801CBA6684D5447FA884C03C77EB952A49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 4efe53363cfa5e4eb33d2bb9df5568fc6958bf180fd5d7ee90aa8ec1e19b7ba5
MD5 cec37aac1ca13ae58ef309bb056bcea4
SHA1 3a001c83e80c150c544d9add20c0a3f6adce8786
SHA512 5a12163a29c468a74e2242b1e2023176f926f9fd727c9a5fd806611179b196b2b1725084a216d6f4dced2900280ad62b0659294e838e4f3c4c485259ed4646ac
SSDEEP 96:K84YKhq+ub+KgUyuFuK2gRjWKUQWGpuKCoS:y7xN1PVVL
TLSH
T14FE1F151F17A53813A7D695A85E0B47E02C334633028A47B7B7A41A60F67E10CEFD9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe58fb43.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe58fb43.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 702ba4351d919e6771db16fbd8850aca86b89c2644ffec308fa0bf3330fea64b
MD5 c715ef28cd3fd0329b6d13b4bf3605b9
SHA1 c0396f005997268d941bc6c7a884d6df94bc897a
SHA512 45b0e0475cbd52c0706d20612a7dedb2730fe6e57a6105e5bc80e8296c5917130767810f25e9b28cf2a5019fd2a48283900ac6d766b77dc8fa56e8b6d55cea6e
SSDEEP 192:uuuI8N+UY1QCLIHKYtQW5QmiU102i4Y/Fl8V38JcFuqXhdU8:nN8N+UeKHKeQ2hNY/Fk8mVdU8
TLSH
T182422A35A878EC3349E3A555B04A77539FB410BB9EC46F98D6E99B0C00DA78C271F827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e2da08a3b4c495ee24eedd1626a8a200c195ea34e262d5c58565f6ff32cf9c38
MD5 b6d04079f24b80395496f7f1b2d89867
SHA1 b962b1ff72b12044f0c206220a53e9cb478285e8
SHA512 93726bb9fb6a52ffc414defcdb681ca54fca2468bfc2ced9e22e9cbca8194f52c6b0170c6b24e13041a8e915edd3dc94c262fc95b9dd48802e83f243c1de8bf0
SSDEEP 192:ZGNG6Pt3QmiUyicYqB/Fl8V3t7ruJC5U6:ZGNG6FZhPqB/FkVcC5U6
TLSH
T1B6020B38ACB86C778EE39E55B487B7135FA4206BDAA55F94DAE41B1D00D768C2307823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 fa699d651f97a5c198c96dbb5cf2b6dadfd2a0cc01b8686c98e3640849628f11
MD5 3eeb26763f136c09ea9a474538bd5206
SHA1 c9ad264f3d6adfb178a0f78279cffa0f2a4bec55
SHA512 cc949c3ec0539b965e3d4aecfcfa02b0a052ff7434b80dfef64ff845002beea42e4a02065ea0d48cfce8e320ded0013a10c565f989c529653aaf217c6b0c4107
SSDEEP 768:rFGccQurwgCG6P/FkC+wmaxI45waoQz8+JD:QccQufH6NmHQz5JD
TLSH
T1BFF270F998E3993ED4AE6B47637D6D1249BCC177B5A84594FB840B0CCC624BFE306814
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 a477eb20e56e19f1c0457240707d74eb9cb2bb22ee24db0c997629d82c4686db
MD5 4a5030d7c377c93606dabc4911e5f62d
SHA1 9fe56cd57e33940eb076b36981ecb9e7e560ffcd
SHA512 60c520c40dfa38e7aa9bea91a634d5c08687f78cd3a456626ca95ba1c2a3657fc82d04d5cb6f9713f440b285de99240ca30c7af49d58ae955001571cee976fbe
SSDEEP 384:njjccCs+Bt0S3s8N+UmKHKeQ+CNY/Fk8FVdwvgk8+9f3D:PccQMbHe/FkkVdQz8+JD
TLSH
T192828D7568B49C3749E3E654F08A73535FB010BB9BC06FA5D9DC9B1D00CA6DC2B1B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 8cb391526bceaadb3d56e0c126eb6bde63c8e4b4a0f1fcee40d8a1b38873946c
MD5 4e550da9cb4419ab6ed7c94c6693cfc4
SHA1 874d0aa79a9310adf655e2c9af292d0ec4d307f9
SHA512 47055a7175b5ce6f58695477b80b6e233f2f4d17635ba49057c7b5bc5e1fb119be766a9a098d4ecdeac269b50512f9d1e34aac72dacd8cb8efa2be061bec9011
SSDEEP 384:nmBiFvjccCs+Bt0S3O8ND8TUNTUlIlmKHKeQ+PNqDfwP/Fk8pTVdwvgk8+9f3D:rF7ccQu2wgCKfP/Fk4TVdQz8+JD
TLSH
T1DCB21A76D8A4CE3BADF397C5F24AB6839EF000A78A889ED4D9C95E4C00876DD170BC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 4b2ecf63120ba0821c88de90b154c63471830588f0da6b9a2cdd4aef6c9e0b38
MD5 e4a4539ec03d5e5053fec909355dc312
SHA1 aef53c7cf257c4ae6117301c19383c363927b250
SHA512 37406d25ea918d2f20e75c5240e5f7d775bdb90d78eedafb6c1390dd478a1ab3f0ff95e226767ae741270c31d7c63bc572226da8ab50f9e5281d2f7e3a0afd1b
SSDEEP 192:PGNs6PtTQmiUy6nYPB/Fl8V38/n4uqXhdU6:PGNs6FFDYPB/Fk8QVdU6
TLSH
T134121838B878EC775D93A955B08773535E6420B7DE80AF95E6E85B1C00DB68C270B823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 13KB
SHA256 0e004c525091695831ccc8928a915836dca0ec076b545be0ab058ff43de40656
MD5 87b34ac8030a38535efff7e197295087
SHA1 533c15c7c3b80c27efe2316ab8a5620620c31eea
SHA512 356aa5ccd7d354e43b584d54a26e68ebab1663cd6969f9347988f946728b4eb5d2bae0b691a8b61f6dc3955324c2245f4e36d4ff7b188fb41403aeb2c0d66855
SSDEEP 192:uuuT8N+UYDQCLIHKYtQWNQmiU1N2i4Y/Fl8V38IcFuqXhdqYEn:ng8N+U0KHKeQ+CNY/Fk8FVdq9
TLSH
T199522A39A8799C7349E79545F04B37535EB410FB8EC46F98DAE99B0D00CAA8C271B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

92fbce88-29c0-4970-beb3-74f353054c20.tmp

Path C:\Users\Admin\AppData\Local\Temp\92fbce88-29c0-4970-beb3-74f353054c20.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9589dc6a-56a9-42a3-8334-46866a8b23b0.tmp

Path C:\Users\Admin\AppData\Local\Temp\9589dc6a-56a9-42a3-8334-46866a8b23b0.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.7_(x86)_20260424043126_000_DotNetHost.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.7_(x86)_20260424043126_000_DotNetHost.log
Size 3KB
SHA256 e359b8d4506f94c7ece16c0d8e795d290d2331b12a1cd1b8a71fe71e0ad6e742
MD5 d762bf86ce3a1104a8755ee7b8f891e8
SHA1 454a6465f48e9e61c822053658c435ffc87d326f
SHA512 e002e3a6c00261ddee41ac2081a007260855c5f3e904d8519ed3c3d61f733d7a6d3e3ff22f86a3af884e74e89a4990d93bdf2509dd232c7ceb7b699c89bcf8a9
TLSH
T1D5710F1E1FE5091AB2B39647DEF3C4221A73FCD29870CF4D23C4835A465BC06AD58BA6
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.7_(x86)_20260424043126_001_DotNetHostFxr.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.7_(x86)_20260424043126_001_DotNetHostFxr.log
Size 2KB
SHA256 5f3055ffb441fa520a1374f42bdf949bde55984db5545bb9d9f1b12d6fcdc33f
MD5 ed1c4c246f4bdedf2809e6a8bcb258fd
SHA1 e8449ca4fe97142249ace86d88fcd11a19593c93
SHA512 fa4d92b5c62839682e5e988baacf4a99c3aa9afc6cff7848ddcbd3f35d99d6b08bb763ea5dec52fefc824507297ca706108a0e62748903b443b57fa002412ad6
TLSH
T1DE41D8651BF5090AB1B21717AEF3C5631E33BDE36974CF0C22488359066FD0598ACB7A
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.7_(x86)_20260424043126_002_DotNetRuntime.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.7_(x86)_20260424043126_002_DotNetRuntime.log
Size 2KB
SHA256 931e31536b39762a629cfa88fc8cea07789b5088ad9a3e5e406b3122bd392aba
MD5 7d6f7068d00629e212f5905b0ac18611
SHA1 8094f1c7c2d38212cb08c2ea1faf6d98e22630f4
SHA512 cf6cc73e1b229e2c1170f789ec40391d0fdb72e6407cb6602a853059cfeaeb38257e1dca3f0fc666c967b9aca492a94de85066f127dc6f85329d448ab9e72068
TLSH
T16F41D6681BF50809B1B3170BAFF3C5631E33FCD26971CF0C12448369466F90698A9B7A
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.7_(x86)_20260424043126_003_WindowsDesktopRuntime.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.7_(x86)_20260424043126_003_WindowsDesktopRuntime.log
Size 4KB
SHA256 d55783575ac77412d2b994437fd0de2053200ff36abb7d08a2bf55ab8f626cd3
MD5 53781e3f5dd99a9388db62ce37522448
SHA1 c8e9b0cfe2ac38228c6438930c87091eb514b9ac
SHA512 036c34e14242fc571cf1e76b54a2c26ccc9ff58a7fb19f1bfd853dec7fd533bec996661fdd0f907784bb96b8e7d9d35ab137219aac9241cfeadadbb2451abf05
SSDEEP 96:Yc+8Fv/zvKqd4AvO2ehyJBf6iqd4btAqd4SwvKFML:pfnbbvO2ehyJmKF+
TLSH
T1ED81F8191FE50906B2B39707AEF3C4225E33BCD75974CF1C2285821A06AB90694ACF7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3116_73025374\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1905ce88-e324-449c-8995-93cd053b8340.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3116_878155588\1905ce88-e324-449c-8995-93cd053b8340.tmp
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetHost

Path C:\Users\Admin\AppData\Local\Temp\{36A878DA-56D7-4E07-B186-F47043B9CAFF}\DotNetHost
Size 900KB
SHA256 efe1a594f21ea09c5c6f3f75d5618df0ff6bb465e1b7a440394eeadf06d86bdb
MD5 6b8563447431316d2fec41888d36a80a
SHA1 12e0efe2109fb356fa980e7bf7575fbd248cc64c
SHA512 9007dcba3c7adcb29aafcfd77e18a398903cb65f53e51b04c351625751c8fb95d29d2cbc34a232feffc95f900af956d7a75c9a7b3e434a079d9c72c41ca39845
SSDEEP 12288:8jcnTi8XiHmGdKkg78We96sI+yDxTYwsoCm1p:ecnTiadGdKkg78We96FDxTYwsvq
TLSH
T19C157C23BC419036D9EA0D72A438CB616E3D7D14279488DB9390B94DFCF06D26FB26D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetHostFxr

Path C:\Users\Admin\AppData\Local\Temp\{36A878DA-56D7-4E07-B186-F47043B9CAFF}\DotNetHostFxr
Size 956KB
SHA256 767110859ec26785e7cccf654785f32e3753b545a6c9003d55bd280da9b395d4
MD5 85dcd01ef3e23d75cc9b6ab925f9eb5e
SHA1 64f9491648d78d252bf06c30f042a8def4a203e3
SHA512 a9faab719ffd01d6a6c3ae726679bdc711f9c1311787de148ffc8870611769fe4798a87b6100d0262e3efd04cdcef0bfa7d64316ac6601cff07057d7a8238475
SSDEEP 24576:lcnTiadGdKkg78We96FDxTYwsvqV8iw+f:lcTi8GExDdYwsvlhY
TLSH
T154258C237C41A036D9EA0D72A478CB616E3DBD14279484DB5390B94DFCF06C2ABB27D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetRuntime

Path C:\Users\Admin\AppData\Local\Temp\{36A878DA-56D7-4E07-B186-F47043B9CAFF}\DotNetRuntime
Size 26.1MB
SHA256 6fe13e18d56706ab4594ef5e8dc0104972e0a732eadb89383bd77815b4ed2b4b
MD5 94215feca007a68a741c4581fd317632
SHA1 10f54be9bc3ff44c7eb840b2fc3d943d79b22e7f
SHA512 682598c5a654f6af043b194b1b44b70a6b3310560966951278ac4d047e0e44ab9be9e8dde6728e41680bfc4ab7b23799198a4b639100eebd0b47dee6b160336f
SSDEEP 786432:AAw74NDnKORiD9fNBvBwDs6jz+Gws44qirlQmkccg:Aj+PRwFGDjj6G+mkhg
TLSH
T184573327BC836022D5EA1D35A47ACBB1293C7D60174488CB87D0B94EF8F12D19BB67D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsDesktopRuntime

Path C:\Users\Admin\AppData\Local\Temp\{36A878DA-56D7-4E07-B186-F47043B9CAFF}\WindowsDesktopRuntime
Size 26.7MB
SHA256 9aa6ec95172581a1a485d4f5208a0c422e892941c9f859b2efc964def9bfd963
MD5 cecf22905b6bc75e8eda547379796581
SHA1 85db3f58fdac544e5854fae2b137c9ed8ac3fa02
SHA512 fcb8309a1d055a2273a2b08ff079be7ecfac48c8d6d8dcbed86ed976969460f93b4e6d25ee486c356da2d5336b7abdc120fa78f3d47e5006bc059787d6809b9a
SSDEEP 786432:xsMa2N2voVo66TV/D2tZO0I/u/3bb9yI4jSW3e:xsg5VkTV/D2tZCirb9kSAe
TLSH
T1FA573313BD83A53BD6BA0D72A439CB1068395C141B54454F93A4B88EFCF12D3ABF66D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windowsdesktop-runtime-10.0.7-win-x86.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.7-win-x86.exe:Zone.Identifier
Size 185B
SHA256 4423e7b7a7e49693d09e6fff75f573ba0a43c10bfc0a9e8040caa0920dc5b0be
MD5 ed9fc2d35e3884ecd183b9c3b23a1c9d
SHA1 80669794b594f34131ce1f955325ad5f5f60ab06
SHA512 bddf79cc48cf6ce80e0506687696f54cb9913f7babec90f355b394b128c4295344d70e4f222d0033b4d53b76c75dc172da06820d416f5a352d6b061316971e73
TLSH
T1E3C012ABC80144520E3032821B6ED559FF0F1D125D81C38898C48096E992AD6C1528D5
MD5 SHA1 SHA512 TLSH

Submit Download

MSI5EE0.tmp

Path C:\Windows\Installer\MSI5EE0.tmp
Size 346KB
SHA256 1caa470031f4f3fb53bb38187d522990a3a7423476b1b5aaa27443a3e2fc62c0
MD5 f715d24632e765c53e9856df53dc8318
SHA1 78e2280ccaeed00119fe827acc58ba10996517cb
SHA512 dd0568de924a86910d8bf59b2f0c22663268004ef9a5f80ffd78f37885f3b8538d138d1e5c70de8e4fda7aab150df48bd34e3838c976ec90ed4f0e49bed0e9e6
SSDEEP 6144:WbOobwWeCg6QvyuFtPwvGyDBQlEz8a+CFTYK0OnsoIcGm1p:W78We96sI+yDxTYwsoCm1p
TLSH
T1BF745B31A456707AE6F90872F568CB706D3CB21827D8849FC3E0E84E38645D36BB775A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3116_1207712974\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

BootstrapperApplicationData.xml

Path C:\Windows\TEMP\{36A878DA-56D7-4E07-B186-F47043B9CAFF}\.ba\BootstrapperApplicationData.xml
Size 9KB
SHA256 1633b50661776a39ec9ffdc98ec19e48e0099a08ff5168cc3376137a904ee6e3
MD5 1b7efeed50be6f8ee212995070717d65
SHA1 22c3bc34718c78531cc3b56c312a54a89aebff9e
SHA512 9456bee88d409491723b8aa09ef6348b31119b5ee1ef3ba92a9d5fe7034353852c4e0f97031ae4f99e6ecaa49df5ebf611de83ad99a0c1f885318ea9920de5f3
SSDEEP 96:2BqRBM/En6YcYY0wZycirLdin6sUsD20wFycDdin6UkEc0wNycdOZdin6fMS2g05:2I1zfTK/lvjnlX0OOamagM5cYsCsysz
TLSH
T1BE12E3113BFD0218F0F3AE48EFF6A5555A36BD552E39C82D01601D0E49B2E819962FB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetLogo_256x.png

Path C:\Windows\TEMP\{36A878DA-56D7-4E07-B186-F47043B9CAFF}\.ba\DotNetLogo_256x.png
Size 2KB
SHA256 0f571f95d8eab48dbc81b0ec5e9f7225e349e26ef50868bfaab556f3c2443b01
MD5 39aa52615723b782c92dec710caaec7f
SHA1 760b49e256a7979fe50a56a2b1be3688a474b886
SHA512 89d1baa3820154667747b25e9e2fd321bfb2ec71dc309915b0a28dacdc80822a4943b639ebb37c37bd2559d5a4306d2096119cd970c84a0d331f6c68b0456dc9
TLSH
T1534195CF1BFD78D7E6E557918E1A8DD232738483B4B3A42CCE7B10B8274A5642B87940
MD5 SHA1 SHA512 TLSH

Submit Download

dotnet.ico

Path C:\Windows\TEMP\{36A878DA-56D7-4E07-B186-F47043B9CAFF}\.ba\dotnet.ico
Size 44KB
SHA256 61a2cbd12868cb9b359e0c78961d409b7875f072eb8e53ea88d3e6bfe2961a18
MD5 b8096652d9ec286709a2c863b244b110
SHA1 b3b7f0f4d608fad7cb59ba499d4d17c2b873a7af
SHA512 492a5aa83220bb77c178b7c5b50bf44968c0427e9e45bb97a33df14d7fb4c667ca7adde0ebb3874c7b6011057b01144e4e6651fbad62c6bcf5e0b93586c4bc7a
SSDEEP 96:r+gfbzo+wHK9NbwOY4tIWQeVlV1W9+H+guapUjFamINUItzf1dBNaIZ:ro5HuNcH4tIzeVlV1WEOFDgUWzf1PIm
TLSH
T1E913EF6DE68547C1C10C2032DB4AC792B5233C72E4DAE0C4F9D4FA7E177906965C6E6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\TEMP\{36A878DA-56D7-4E07-B186-F47043B9CAFF}\.ba\thm.wxl
Size 7KB
SHA256 b00edd703dd8a475119d0e4dd70a3aaa47f0e95361af290e76d367a8edef3432
MD5 8b2c667a8bbad3153068c0ed90df7ec4
SHA1 c9e04a3a37e5e6262ab9bfecf78280171b8f7b74
SHA512 5269f00d474acccb4c48cb7bcfdf19e63557a388572d3a6335aa39191319691d924e27f70da3f3495387c319396476c63a8fd7b35835cca0901220e39783847b
SSDEEP 96:HiTgM1+XSNEzA0HtYQstYCpCwZQpCeyk5HQJM9ouvj9urz8:Ew9EmtYQstYCPC9e8
TLSH
T191E1026F68DFDEE03A732651B2B3698D6919C29A136F1CF0F869084B47635016377A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.xml

Path C:\Windows\TEMP\{36A878DA-56D7-4E07-B186-F47043B9CAFF}\.ba\thm.xml
Size 11KB
SHA256 dfee8e2d075087227f19c835c145c5bb8e72a46880ea24080bb2472fd3a521be
MD5 4329e418dc56b1386d7ea29a0dcfab5b
SHA1 58387f92e89ca21b4179fb697c7de9675c59142f
SHA512 6934873d27e6efbb94da4f13ee8369b29995490051016fdf82800256b924902306d328bf1d4ebbf266d1a53eb24adb6478d1a67de4ecc3e3bcbe561968f24922
SSDEEP 96:HgvPkoeWEH3IWTaQfSJgHzth5mFahbuB8pR5+Vpwe+UIJLg1gEp+6F5pQnxc:AvoWydmQfVHMyyj5Z
TLSH
T14B42FC6851DC7811C532D702AB9371D3FF12BDA6C6C85A58B48E256B1FF262028B739C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixstdba.exe

Path C:\Windows\Temp\{36A878DA-56D7-4E07-B186-F47043B9CAFF}\.ba\wixstdba.exe
Size 431KB
SHA256 2b1cee5e3e24593247854eb7a7c4308937b9c607754ed2fb83520a8706c26f1e
MD5 0e88ffd2e737ac9b9a4241616838bc23
SHA1 3c8beb465d20bcef0cd6ceca9c60286d1d15cebd
SHA512 169b9e08518834c9bc5adfe4ab7b79e07685b72f30ede1c1a386229668bde8c15da378e1274e4013ad7b84d6f7a5acc64ef0806e3b8a66322861efaa7e26b620
SSDEEP 6144:X9vfS1NP+c3ytxmg4Stlqe3B9m2LSLTwGw7C3ZLaov5xZvSdF:X9v+GIyugllqe3wwGfX5/SdF
TLSH
T129943B3165F04037C6F90572AE14FA31BF69F208231095EBA3C0DD293968AE5BBB7657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windowsdesktop-runtime-10.0.7-win-x86.exe

Path C:\Windows\Temp\{36A878DA-56D7-4E07-B186-F47043B9CAFF}\.be\windowsdesktop-runtime-10.0.7-win-x86.exe
Size 967KB
SHA256 d7159bd11bc004ee485fb6fd031b71d38e4303721d0665acfefaee1fb97588fe
MD5 54b260b4c45fc5f0438080d937e0e2c8
SHA1 c7838ea3732e2619ba05fa3a9901384eeebf5fc8
SHA512 9a063312880700e71b4a1fe12365918900c033ab04c720ba880b4bc247c635ebacdf36672051948e5a07aa5e4773a2ec92a5e321a303175abd6930387a915544
SSDEEP 12288:XVGWl6qCmyZeU6lqlDjC+fScn6X8GwMgJEQaA6fTQfulZYDGSGPjR0ASh:XVGWl6qCmyt6UdmcpMzfz0xOjK
TLSH
T13D257D31A166242BD6F50973F914D2307E2CD7082B5C95BAC6C0D90D39689FA6FFB24B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/940-1450-0x00000000017A0000-0x0000000001862000-memory.dmp

Download

memory/1176-0-0x0000000001A00000-0x0000000001AC2000-memory.dmp

Download

memory/1796-826-0x0000000001020000-0x00000000010E2000-memory.dmp

Download

memory/1928-1453-0x0000000000C60000-0x0000000000D22000-memory.dmp

Download

memory/1928-1448-0x0000000000C60000-0x0000000000D22000-memory.dmp

Download

memory/2116-1446-0x0000000000D10000-0x0000000000D8A000-memory.dmp

Download

memory/2504-1114-0x0000000001240000-0x00000000012BA000-memory.dmp

Download

memory/2520-1447-0x0000016989620000-0x0000016989998000-memory.dmp

Download

memory/2976-1429-0x00000000008A0000-0x000000000091A000-memory.dmp

Download

memory/3812-1460-0x0000000000ED0000-0x0000000000F92000-memory.dmp

Download

memory/3812-1127-0x0000000000ED0000-0x0000000000F92000-memory.dmp

Download

memory/3912-1435-0x0000000000DF0000-0x0000000000EB2000-memory.dmp

Download

memory/3912-1458-0x0000000000DF0000-0x0000000000EB2000-memory.dmp

Download

memory/3912-1457-0x0000000000F00000-0x0000000000FC6000-memory.dmp

Download

memory/4048-284-0x000001CD93250000-0x000001CD935C8000-memory.dmp

Download

memory/4048-883-0x0000000001FB0000-0x000000000202A000-memory.dmp

Download

memory/4048-283-0x000001CD93250000-0x000001CD935C8000-memory.dmp

Download

memory/4340-1455-0x0000000000E20000-0x0000000000EE2000-memory.dmp

Download

memory/4340-1128-0x0000000000E20000-0x0000000000EE2000-memory.dmp

Download

memory/4452-1452-0x0000000000C30000-0x0000000000CF2000-memory.dmp

Download

memory/4664-905-0x0000000002E30000-0x0000000002EAA000-memory.dmp

Download