4ba3a8a29a4adaf21f304239e3c769d4f8da809106e01caef80945fd604b0076

Analysis

user interaction
yes
max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/04/2026, 18:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Velocity.zip
Size 12.5MB
Sample260424-w7yvsshx3k
SHA256 4ba3a8a29a4adaf21f304239e3c769d4f8da809106e01caef80945fd604b0076
MD5 69c1ec1744daf4c5dea14f428621dbce
SHA1 a01c9792d87a5ee761f1953794e5f08cfa3f600d
SHA512 743cd36db333c7412c9581245c7c570313791ac9c2c3311bd5d5cf425a7a0b47751b469b88e7c5216acb6afca8b1385c9ab0d32f7d49985195de3e748df1120b
SSDEEP 196608:VsI43uQZN/rzCs2jNH1CKuXYAISerbwoCFWOB3sMXcz0hNRcY8m/gSTu/gjwGN:VztWN/rzCVNE1YbjC8jMXc4Vv5Y4V7N
TLSH
T155D633DD9EA26F6DD17F3873501859CC4FAD296AE5ED012630A8E0C96AC35FC7C80C66
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
139	4396	msedge.exe

Executes dropped EXE 2 IoCs

pid	Process
5212	windowsdesktop-runtime-10.0.7-win-x86 (1).exe
5504	wixstdba.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Velocity.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.7-win-x86 (1).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wixstdba.exe

System Time Discovery 1 TTPs 4 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3180	chrome.exe
5088	msedge.exe
2524	msedge.exe
4396	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134215294608568338"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-312252282-3884318443-358092420-1000\{658F8C85-B17C-41C6-A26E-24F11C7AC4A9}	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1544	chrome.exe
Token: SeCreatePagefilePrivilege	1544	chrome.exe
Token: SeShutdownPrivilege	1544	chrome.exe
Token: SeCreatePagefilePrivilege	1544	chrome.exe
Token: SeShutdownPrivilege	1544	chrome.exe
Token: SeCreatePagefilePrivilege	1544	chrome.exe
Token: SeShutdownPrivilege	1544	chrome.exe
Token: SeCreatePagefilePrivilege	1544	chrome.exe
Token: SeShutdownPrivilege	1544	chrome.exe
Token: SeCreatePagefilePrivilege	1544	chrome.exe
Token: SeShutdownPrivilege	1544	chrome.exe
Token: SeCreatePagefilePrivilege	1544	chrome.exe
Token: SeShutdownPrivilege	1544	chrome.exe
Token: SeCreatePagefilePrivilege	1544	chrome.exe
Token: SeShutdownPrivilege	1544	chrome.exe
Token: SeCreatePagefilePrivilege	1544	chrome.exe
Token: SeShutdownPrivilege	1544	chrome.exe
Token: SeCreatePagefilePrivilege	1544	chrome.exe
Token: SeShutdownPrivilege	1544	chrome.exe
Token: SeCreatePagefilePrivilege	1544	chrome.exe
Token: SeShutdownPrivilege	1544	chrome.exe
Token: SeCreatePagefilePrivilege	1544	chrome.exe
Token: SeShutdownPrivilege	1544	chrome.exe
Token: SeCreatePagefilePrivilege	1544	chrome.exe
Token: SeShutdownPrivilege	1544	chrome.exe
Token: SeCreatePagefilePrivilege	1544	chrome.exe
Token: SeShutdownPrivilege	1544	chrome.exe
Token: SeCreatePagefilePrivilege	1544	chrome.exe
Token: SeShutdownPrivilege	1544	chrome.exe
Token: SeCreatePagefilePrivilege	1544	chrome.exe
Token: SeShutdownPrivilege	1544	chrome.exe
Token: SeCreatePagefilePrivilege	1544	chrome.exe
Token: SeShutdownPrivilege	1544	chrome.exe
Token: SeCreatePagefilePrivilege	1544	chrome.exe
Token: SeShutdownPrivilege	1544	chrome.exe
Token: SeCreatePagefilePrivilege	1544	chrome.exe
Token: SeShutdownPrivilege	1544	chrome.exe
Token: SeCreatePagefilePrivilege	1544	chrome.exe
Token: SeShutdownPrivilege	1544	chrome.exe
Token: SeCreatePagefilePrivilege	1544	chrome.exe
Token: SeShutdownPrivilege	1544	chrome.exe
Token: SeCreatePagefilePrivilege	1544	chrome.exe
Token: SeShutdownPrivilege	1544	chrome.exe
Token: SeCreatePagefilePrivilege	1544	chrome.exe
Token: SeShutdownPrivilege	1544	chrome.exe
Token: SeCreatePagefilePrivilege	1544	chrome.exe
Token: SeShutdownPrivilege	1544	chrome.exe
Token: SeCreatePagefilePrivilege	1544	chrome.exe
Token: SeShutdownPrivilege	1544	chrome.exe
Token: SeCreatePagefilePrivilege	1544	chrome.exe
Token: SeShutdownPrivilege	1544	chrome.exe
Token: SeCreatePagefilePrivilege	1544	chrome.exe
Token: SeShutdownPrivilege	1544	chrome.exe
Token: SeCreatePagefilePrivilege	1544	chrome.exe
Token: SeShutdownPrivilege	1544	chrome.exe
Token: SeCreatePagefilePrivilege	1544	chrome.exe
Token: SeShutdownPrivilege	1544	chrome.exe
Token: SeCreatePagefilePrivilege	1544	chrome.exe
Token: SeShutdownPrivilege	1544	chrome.exe
Token: SeCreatePagefilePrivilege	1544	chrome.exe
Token: SeShutdownPrivilege	1544	chrome.exe
Token: SeCreatePagefilePrivilege	1544	chrome.exe
Token: SeShutdownPrivilege	1544	chrome.exe
Token: SeCreatePagefilePrivilege	1544	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3028	Velocity.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1544 wrote to memory of 1912	1544	chrome.exe	96
PID 1544 wrote to memory of 4716	1544	chrome.exe	97
PID 1544 wrote to memory of 4716	1544	chrome.exe	97
PID 1544 wrote to memory of 3180	1544	chrome.exe	98
PID 1544 wrote to memory of 4124	1544	chrome.exe	100
PID 1544 wrote to memory of 4124	1544	chrome.exe	100
PID 1544 wrote to memory of 1588	1544	chrome.exe	101
PID 1544 wrote to memory of 1032	1544	chrome.exe	102
PID 1544 wrote to memory of 1588	1544	chrome.exe	101
PID 1544 wrote to memory of 1032	1544	chrome.exe	102
PID 1544 wrote to memory of 1868	1544	chrome.exe	103
PID 1544 wrote to memory of 1868	1544	chrome.exe	103
PID 1544 wrote to memory of 4144	1544	chrome.exe	104
PID 1544 wrote to memory of 4144	1544	chrome.exe	104
PID 1544 wrote to memory of 4848	1544	chrome.exe	105
PID 1544 wrote to memory of 3368	1544	chrome.exe	107
PID 1544 wrote to memory of 3368	1544	chrome.exe	107
PID 1544 wrote to memory of 208	1544	chrome.exe	108
PID 1544 wrote to memory of 4712	1544	chrome.exe	112
PID 1544 wrote to memory of 4848	1544	chrome.exe	113
PID 1544 wrote to memory of 1968	1544	chrome.exe	114
PID 3028 wrote to memory of 5088	3028	Velocity.exe	120
PID 5088 wrote to memory of 2524	5088	msedge.exe	121
PID 2524 wrote to memory of 3236	2524	msedge.exe	122
PID 2524 wrote to memory of 4396	2524	msedge.exe	123
PID 2524 wrote to memory of 1852	2524	msedge.exe	124
PID 2524 wrote to memory of 1852	2524	msedge.exe	124
PID 2524 wrote to memory of 1852	2524	msedge.exe	124
PID 2524 wrote to memory of 4268	2524	msedge.exe	125
PID 2524 wrote to memory of 4268	2524	msedge.exe	125
PID 2524 wrote to memory of 4228	2524	msedge.exe	126
PID 2524 wrote to memory of 4228	2524	msedge.exe	126
PID 2524 wrote to memory of 4228	2524	msedge.exe	126
PID 2524 wrote to memory of 3176	2524	msedge.exe	127
PID 2524 wrote to memory of 3176	2524	msedge.exe	127
PID 2524 wrote to memory of 3176	2524	msedge.exe	127
PID 2524 wrote to memory of 1384	2524	msedge.exe	129
PID 2524 wrote to memory of 768	2524	msedge.exe	130
PID 2524 wrote to memory of 1384	2524	msedge.exe	129
PID 2524 wrote to memory of 1384	2524	msedge.exe	129
PID 2524 wrote to memory of 768	2524	msedge.exe	130
PID 2524 wrote to memory of 768	2524	msedge.exe	130
PID 2524 wrote to memory of 5540	2524	msedge.exe	133
PID 2524 wrote to memory of 5540	2524	msedge.exe	133
PID 2524 wrote to memory of 5580	2524	msedge.exe	134
PID 2524 wrote to memory of 5580	2524	msedge.exe	134
PID 2524 wrote to memory of 5884	2524	msedge.exe	136
PID 2524 wrote to memory of 5892	2524	msedge.exe	137
PID 2524 wrote to memory of 5884	2524	msedge.exe	136
PID 2524 wrote to memory of 5892	2524	msedge.exe	137
PID 2524 wrote to memory of 6096	2524	msedge.exe	139
PID 2524 wrote to memory of 5692	2524	msedge.exe	140
PID 2524 wrote to memory of 5692	2524	msedge.exe	140
PID 2524 wrote to memory of 5684	2524	msedge.exe	141
PID 2524 wrote to memory of 5684	2524	msedge.exe	141
PID 2524 wrote to memory of 5532	2524	msedge.exe	142
PID 2524 wrote to memory of 5532	2524	msedge.exe	142
PID 2524 wrote to memory of 5528	2524	msedge.exe	143
PID 2524 wrote to memory of 5528	2524	msedge.exe	143
PID 2524 wrote to memory of 5296	2524	msedge.exe	144
PID 2524 wrote to memory of 5296	2524	msedge.exe	144
PID 2524 wrote to memory of 5296	2524	msedge.exe	144
PID 2524 wrote to memory of 5592	2524	msedge.exe	145
PID 2524 wrote to memory of 5592	2524	msedge.exe	145

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\Velocity.zip
1⤵
PID:4340

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1136

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7fffe958c728,0x7fffe958c734,0x7fffe958c740
  2⤵
  PID:1912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1712,i,206514317796305621,2917117991873473987,262144 --field-trial-handle=1944,i,4802915229288387819,14403512073534821881,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=1936 /prefetch:2
  2⤵
  PID:4716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2272,i,11788691332795452759,14670641525114687667,524288 --field-trial-handle=1944,i,4802915229288387819,14403512073534821881,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=1616 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2416,i,11354736189954706998,401888165620834746,524288 --field-trial-handle=1944,i,4802915229288387819,14403512073534821881,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2608 /prefetch:8
  2⤵
  PID:4124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3248,i,14974089037039689796,536954379431997570,2097152 --field-trial-handle=1944,i,4802915229288387819,14403512073534821881,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:1588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3264,i,14262898092409546697,10521928915228968933,2097152 --field-trial-handle=1944,i,4802915229288387819,14403512073534821881,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:1032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4004,i,2032490776662453113,7548681295133903913,2097152 --field-trial-handle=1944,i,4802915229288387819,14403512073534821881,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4008 /prefetch:2
  2⤵
  PID:1868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4584,i,18325662699776210775,6577493334427139485,2097152 --field-trial-handle=1944,i,4802915229288387819,14403512073534821881,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4652 /prefetch:1
  2⤵
  PID:4144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5364,i,8808123355148239030,386860213597416819,524288 --field-trial-handle=1944,i,4802915229288387819,14403512073534821881,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5368 /prefetch:8
  2⤵
  PID:4848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5920,i,2697437734710654393,5630683282592901028,2097152 --field-trial-handle=1944,i,4802915229288387819,14403512073534821881,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5940 /prefetch:1
  2⤵
  PID:3368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4748,i,6557540402463465988,8712961968840549279,524288 --field-trial-handle=1944,i,4802915229288387819,14403512073534821881,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4760 /prefetch:8
  2⤵
  PID:208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=240,i,249685511985313891,17042415018565518142,524288 --field-trial-handle=1944,i,4802915229288387819,14403512073534821881,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4728 /prefetch:8
  2⤵
  PID:4712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4784,i,3332063351534333565,1377464435482532567,524288 --field-trial-handle=1944,i,4802915229288387819,14403512073534821881,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6172 /prefetch:8
  2⤵
  PID:4848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4656,i,7649870759430878006,11354189448487020911,524288 --field-trial-handle=1944,i,4802915229288387819,14403512073534821881,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6208 /prefetch:8
  2⤵
  PID:1968

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4136

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3768

C:\Users\Admin\Desktop\Velocity\Velocity.exe
"C:\Users\Admin\Desktop\Velocity\Velocity.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=x86&rid=win-x86&os=win10&apphost_version=10.0.0&gui=true
  2⤵
  - System Time Discovery
  - Suspicious use of WriteProcessMemory
  PID:5088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=x86&rid=win-x86&os=win10&apphost_version=10.0.0&gui=true
    3⤵
    - System Time Discovery
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x270,0x7fffe065c188,0x7fffe065c194,0x7fffe065c1a0
      4⤵
      PID:3236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1964,i,1505290388661059667,1223616960407652126,524288 --field-trial-handle=2312,i,6078186565550648047,24260931804763988,262144 --variations-seed-version --mojo-platform-channel-handle=2424 /prefetch:3
      4⤵
      Downloads MZ/PE file
      System Time Discovery
      PID:4396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1700,i,14414121704693217965,17919964220009542557,262144 --field-trial-handle=2312,i,6078186565550648047,24260931804763988,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:2
      4⤵
      PID:1852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2620,i,1141741493506694217,5858323299934224460,524288 --field-trial-handle=2312,i,6078186565550648047,24260931804763988,262144 --variations-seed-version --mojo-platform-channel-handle=2608 /prefetch:8
      4⤵
      PID:4268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3480,i,11317312643183688321,13478469840311280688,2097152 --field-trial-handle=2312,i,6078186565550648047,24260931804763988,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
      4⤵
      PID:4228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,13019240140876651353,12318784467129519337,2097152 --field-trial-handle=2312,i,6078186565550648047,24260931804763988,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
      4⤵
      PID:3176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4248,i,10378292181273692212,1354491934026998346,2097152 --field-trial-handle=2312,i,6078186565550648047,24260931804763988,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:1
      4⤵
      PID:1384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4280,i,7747109438844522986,6785232936793856441,2097152 --field-trial-handle=2312,i,6078186565550648047,24260931804763988,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:2
      4⤵
      PID:768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5088,i,3157609445813705798,13819380243600251921,524288 --field-trial-handle=2312,i,6078186565550648047,24260931804763988,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:8
      4⤵
      PID:5540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5268,i,11646953278044281423,3491305458306727783,524288 --field-trial-handle=2312,i,6078186565550648047,24260931804763988,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:8
      4⤵
      PID:5580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5060,i,3382627765668473176,6486053842274460585,524288 --field-trial-handle=2312,i,6078186565550648047,24260931804763988,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
      4⤵
      PID:5884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5240,i,9344808018153549101,9763662137749783286,524288 --field-trial-handle=2312,i,6078186565550648047,24260931804763988,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
      4⤵
      PID:5892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,15719112216409149983,13081399260020544712,524288 --field-trial-handle=2312,i,6078186565550648047,24260931804763988,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:8
      4⤵
      PID:6076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,15719112216409149983,13081399260020544712,524288 --field-trial-handle=2312,i,6078186565550648047,24260931804763988,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:8
      4⤵
      PID:6096
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,9360735447358937174,10665183646390411785,524288 --field-trial-handle=2312,i,6078186565550648047,24260931804763988,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:8
      4⤵
      PID:5692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6116,i,11195441920616171991,15498816603560435198,524288 --field-trial-handle=2312,i,6078186565550648047,24260931804763988,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:8
      4⤵
      PID:5684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6224,i,11035024860462867043,16210582837892265892,524288 --field-trial-handle=2312,i,6078186565550648047,24260931804763988,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:8
      4⤵
      PID:5532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6184,i,9663373296340143205,1225887442131081874,524288 --field-trial-handle=2312,i,6078186565550648047,24260931804763988,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:8
      4⤵
      PID:5528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6396,i,13157035100583213446,2815649436461927473,2097152 --field-trial-handle=2312,i,6078186565550648047,24260931804763988,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:1
      4⤵
      PID:5296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6616,i,17541011489368548066,1855979931409041546,524288 --field-trial-handle=2312,i,6078186565550648047,24260931804763988,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:8
      4⤵
      PID:5592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6288,i,15438773593851358634,9867350822707264369,524288 --field-trial-handle=2312,i,6078186565550648047,24260931804763988,262144 --variations-seed-version --mojo-platform-channel-handle=3432 /prefetch:8
      4⤵
      PID:5800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6196,i,9953575982585604181,12858978076097347465,2097152 --field-trial-handle=2312,i,6078186565550648047,24260931804763988,262144 --variations-seed-version --mojo-platform-channel-handle=4584 /prefetch:1
      4⤵
      PID:5540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6632,i,14724436117599446136,10714309428969150430,2097152 --field-trial-handle=2312,i,6078186565550648047,24260931804763988,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:1
      4⤵
      PID:5248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7108,i,4385502949077346495,10750426583797946440,524288 --field-trial-handle=2312,i,6078186565550648047,24260931804763988,262144 --variations-seed-version --mojo-platform-channel-handle=7072 /prefetch:8
      4⤵
      PID:5580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=6636,i,10877347242604350538,17998439509828592375,2097152 --field-trial-handle=2312,i,6078186565550648047,24260931804763988,262144 --variations-seed-version --mojo-platform-channel-handle=6796 /prefetch:1
      4⤵
      PID:5856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4328,i,15397663475235064612,2127525710097322311,524288 --field-trial-handle=2312,i,6078186565550648047,24260931804763988,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:8
      4⤵
      PID:6016

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2488

C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.7-win-x86 (1).exe
"C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.7-win-x86 (1).exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5212
- C:\Windows\TEMP\{F3874509-1B36-4266-BE70-7E9C55160A15}\.ba\wixstdba.exe
  "C:\Windows\TEMP\{F3874509-1B36-4266-BE70-7E9C55160A15}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{145AFE8F-6DA2-4900-BE8B-60C78B622189} {DCA92C80-D83F-4A17-8513-952CAB205AD1}
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5504

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 06b427f79e98e54cea1fe32068f1dea762764a3e357c5299109b884415226393
MD5 17ef2b3efca3ecc4275084e3cab6905c
SHA1 c95981558a857e51e6122e00a3bf7d289042f84c
SHA512 c3bf2e9893d836b7028f150816812d7558ec11364f68cf64b6916cdd576b9001bbb5a190998f02003b52a40e43d77f7726b55518287c4fbce9054604a7fba3a6
TLSH
T164E02BBBC821E83B08FD4B5970514746F711232A2BC0544F3A3D820D8FB473A05C385C
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 78bc877ce49102815d4b1a37c9aef56a23651476dbd201707686f4f709b4f431
MD5 d7f40091297669d41ec106ba94b40a51
SHA1 2110c9fc27e2e853431d563d843298aa491f25ac
SHA512 7c71fe796c9835726b46ab0c345942bab51a91bac42a5757a196d287f0af564da5684fa386c961db3b0669be1705d4398cf9652aaa5b31e625674fbcce1366d9
SSDEEP 192:dRU4LnA71Nvfv7CMhAPRp2u93Hsb+WNnTw0ShgkwaAfHVyIsnAUgtaJ:dRU47AD3x8XZxws06g6Yh8
TLSH
T14442B56EA915753B8CF7D329FD117B4BD7F2102161852E88EAFC8A2C14EB9CD221B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 0b85d24f6d53c2c1fa11ec158125de6e42072c0247ef6e37a6adf8b50305f1d3
MD5 bad6ba39a656c7561ac4210bcdaf16dc
SHA1 5a91969d3fd9dded1a9a325a45ae1d3808958413
SHA512 0ecec9293188a5d10b180c9f5bd9d4c22d98df74752c6d39c930ab92d046ec2174892792f718e0c27376c87c4a15fab49e581d71b3d735e443e765846a72f091
SSDEEP 192:dRrILnA71Nvfv7CMhAPRp2u93Hsb+WNnTw0T5GhgkwaA9HVyIsnAUgraJ:dRrI7AD3x8XZxws0T8g6uhe
TLSH
T13352C66EB915793B9CE7D319F9117B4BD7F2202161C51E88EAFC8A2C14EB9CD221B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 2abe6e189a417b9849bd317c9b3fc48f43698ba9432b1cbfcd9ba5552309cc00
MD5 3958ba5d7824cc8898425cc91bb0cd30
SHA1 514ab99dc6310fd4deb09cc5d7678e4ea2487b9a
SHA512 ce0078d8f9d55a8637680b6901d80080e8132d6176fb236a05c3ae3af27166102b657d8497f9b0ec620c16fd29879e0a16fda1bcea4987064ae183ff5bbb9f3e
SSDEEP 192:dRU4LnA71NJLv7CMhAPRp2u93Hsb+WNnTw0ShgkwaAfHVyIsnAUgtaJ:dRU47AFzx8XZxws06g6Yh8
TLSH
T16542C66EB915753B8CF6D329FD117B4BD7F2102164852E88EAFC8A2C14EB9CD221B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 9c430f8c17feb865c008f25efcb04058f5ca91ec3e589c4f1ad8c3f157cbd990
MD5 d8cfe36a6891342c51bc518f22217e71
SHA1 73290bff0114201260216b0cb931cd9bda0228c8
SHA512 7e9778e0fd6323fceb05d3cc91303d1d284a486f525d995ef288db3363d58c76ff756e8e5e9add87e5a95e7ffd83adb3cf949ed5b7444a047d33f0fd1fa9184a
SSDEEP 384:AmjUj7KxkXqKf/pUZNCgVLH2Hfgsl5x7pLuLcifuvXODUf+ErU3xeHGHHe7omBcw:AGUj7KxkXqKf/pUZNCgVLH2Hfgsfx7pH
TLSH
T15772EA677C4C9D3B0F94C68CD816BF4FADB6024B55ED886443FA982903D5ACB110A2F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 953cf100bbd78f821731b82dffa1ed3df88b2fdb365e502c9fa94359495eb6cf
MD5 54672f0541936f93fc009d764a39c0c4
SHA1 bfb3d0ebca9a95f2a6c4310d02f1a93928ed1b57
SHA512 b99fbb05f89f654a5651b48d7277a2a867ad1fe9c6ec4d9a67aee6589f3e382c98ca8fe553f395f689837f4612753338d696c8b0213b06822aa73af6818cccf4
TLSH
T14FB012308002A903C44756B1128604BC32147F108B0B230553E0AA71D8261A28128161
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59835f.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59835f.TMP
Size 96B
SHA256 540d7c61de7fd427ed3e9f623d57ceef5363f8284c788229cd8a4c88a4b70429
MD5 17343ce5cdfed037c18a3da7478122e5
SHA1 651d416f8c47a613fcc0f0e8120f32afc4938a03
SHA512 a6576797067c449a8c6ebe4278d297fac7864d511a5fffe7dadc6ede10abec40b397902bbfdd87f9b079e1504fb56d6848358a42bd4fb3b31f1c8fa143700318
TLSH
T105B022CBC002AB32C00203B02380A8C83BF0EF2CC303330282F00FA2FCA0A300022020
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 89KB
SHA256 8049c98503b977f318976c3668d64b9ff18fd94fa4e4d66868fdd485ef9b85dc
MD5 4f0d19650f43d8b04e0ea76afddc1ea0
SHA1 533760a4cca1bff8a614d3fa775df116b91aa060
SHA512 eadb098d552fabb969dda118909afc4cdb254ca581cb8a51960ea384a2928c5af3cd282ad06f63c3c795b5d2b5b1920aea026b91d2bbf1e698bf67ddba6697ee
SSDEEP 1536:ip/JcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YW:aJ3Qw/xLANk0mUW5GmRntSFCjEENL
TLSH
T1AD9312BA4E2646E7997D4A8176AD7809CE12534D709FA9CC325C638D61D02C82F72F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 195KB
SHA256 4efe46bc2c29bc73a6652d55c879e64db5f2a1a16b8875e9ba5b7e24b6cd4ce5
MD5 e45a3f0df3808bbc1bad6d9f51eb4fae
SHA1 3115838859696fe902f5cd18ebb1481658f558b4
SHA512 7d98b5316265d46f9957e2679c4a138c99b92b8e3692e3260c694fa1a8cb675deb62310b15e5be10b6f897b8318269bf9416bd6229c0affad91d40228aaf9447
SSDEEP 3072:WfFif/3b6sGOlfPnDXgVgCpjCtDuVI33Qw/xLANk0mUW5GmRntSFCjEENW:WdK/b6sPlHMVB+Dn3rOk0HOGm/SFyEEw
TLSH
T15E1412765D2A6BF3E4BC12B5B33A2B058C29564E607FB5983268D7C692E40C90F17F70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 195KB
SHA256 7493efefdc225c736965c856ae65dab6aa4bc880c78d092db49de0bb5de06efd
MD5 99af9ce71a4592ad557210b8f08a5718
SHA1 1257b51880b2369fa50d79379a0641f5a34e5841
SHA512 a6e018b35b15c3d3b06fbbd080d4a7ec68350c408791dbbf6f293337750c25ed652639b46c5939225373e18715e8c9c67f1ffdf76217fea02a7331c46b8ba68e
SSDEEP 3072:PfFif/3b6sGOlfPnDXgVgCpjCtDuVI33Qw/xLANk0mUW5GmRntSFCjEENW:PdK/b6sPlHMVB+Dn3rOk0HOGm/SFyEEw
TLSH
T11C1412765D2A6BF3E4BC12B5B33A2B058C29564E607FB5983268D7C692E40C90F17F70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 538c1a0bded49157881b1c0e111a58732912def07977f599efb60ebb986ecbbb
MD5 2e5f50c6e7cd1b1d6049d9d3e57a9866
SHA1 28319f3d040fd1e80776d82fef3baa00dc34dec2
SHA512 1a56a7d8e7dc2aa514d9d57d40d74133033bdabf84bd35a3b65f0b62eeda07a00060dd4058de9c4703a2c70d201c867647a11b5cbacf4bb2c1ee4acd92d13058
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7u:fwUQC5VwBIiElEd2K57P7u
TLSH
T1F7B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6b65e3f6d57bee85b90392c47f2236ea7ffcfe9cba07ca29930764c7dacc0ea2
MD5 726476576ad538c648305e214c389ece
SHA1 03960d925aa07a6736b28a431ddf422fa8bba04d
SHA512 7b99250e71a507574a7ea1c326ff4f687cffd7e1a0eb1ba5aa847f5b5e0c5d997dbef37ede7c2815a11e03b25f291a4f19173dd0aa9d22472d224e9b1d6349a5
TLSH
T11ED0808995F15C35D5D78CF1154B37067915C577DF42932374633C3C8C435D19546283
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d084fddc35d62ab10457432373865714cd0577ad9bebe9188135998b9f802bd3
MD5 ff587c8337b9997eb40f19fb41bffd1a
SHA1 75e9be1412e32cbe6e960e041e872bbb48ab464e
SHA512 d50cc729f4f047045aba003643fd356cb1ac85c1d90f9ed992f787f682a862005a91103e9e388ad5cbd4f884c2668a35a0e5a0d011d0684ef2d6bc59a10b1701
TLSH
T15ED08089D5B15C35D1D78CF1154B37067915C577DF42532274633C3C8C435919546283
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ecc103220659b15b56c51e9002281cb930975deca8db44af194bf80a64b234af
MD5 9fed310f4dbdc9a2461971b19f5052c0
SHA1 115846f0655f86ee9b0df9e6162b98f6759f0431
SHA512 fa56e883ae91402b4ea0c534c2613509a62d2b9143aa63ac21e6964c2160f26457b4535ce353ca6ca04a2cd6e78c64013c6198649d03713abde28dc1800ee193
TLSH
T19DD02375FDD9D006D33A04B3135353516746C6157F434011F055C40CDC557BEE3C5582
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 ff325437fbef7fc96db8a5c2609b7aa2bfa88152af8ffdfc14e90503c8265d9b
MD5 e3d2d74f4cafce0b29a1153e5916a33e
SHA1 776f04038f21ea73e5f653aeeb3b1b8a0c97bdc9
SHA512 31f1f2b9945b045fe406989e28eaed00f76b2fbdfb8ff4f580eb682462c5274e1e78f20d10d4f6b7826fee387dc5d9ec538dd3c744b7de05ff7c769e25f5220c
TLSH
T1C27108385385879BE7EC04B49695DBAC326F67CD410B1E8531F4E02C56C5B1DC06F4C4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a348e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a348e.TMP
Size 3KB
SHA256 4552ea534af8a0569e2922745648cf024e6e4e9eb643bda0529d816fbead1353
MD5 824e8fd8d1ee804c2b2eed53a81588b2
SHA1 6f94eeea17e60a30c840d4d2171eb836b246a73b
SHA512 45b172b6dc9badb89fe4d3dd854ad79d106cb35f2e06d28465008b73b5022724b093867095fa800f232e69415fd1876b254ed850afe5662c02d7f82e2d35fecc
TLSH
T1BF61D538439547EAE7EC00B09691D3AC326F8BCD410B0E8932F4E02C5AC5B2DC19F4C4
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 f36495c2141c70851e9087bd645c8aaf3c11996ac2191111219436ccd3772f52
MD5 aea3eb23242e05886085d06cef96c88f
SHA1 1c8e6d458971460f713c9bd2384e59221f26b1ed
SHA512 67da27d29ca5d26a1778cea5e44e1ee7b941d188070d54e7e76224d1a98df57764a3f3b59ac4051a1a83c80bda0b5ec9cae1b3d9f419475e719d8a82e9c44cc3
TLSH
T197519BF783B4856E8A1195F0AA18AF2FDF2D0515435C3C6A89E4AE27D3E34B1E10165F
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 11a779f463c998005a8f0f1f46daed6ea8685867154bd3e4ffe47dd022f0d7bc
MD5 c1d8d0610b58db05126dc4a6169c855b
SHA1 22c957f713db9d193f50dd2bc7b698f9cac96313
SHA512 41a187867708f5206da91c7dbc0cf0e132521b3a58204da71a6511904984db39d4e5a9baf222ee375e93906b1d6d678ddd55bd6ce38db29385750e5a3ad3d4f3
SSDEEP 192:sxZuR81yM//K1Ml8MzB/ftsinLMiGdIdpwPHW6+WNrS5/AvJChZnIg4J:sxZueLLB/ftsin4ZemHbE/Fc
TLSH
T1BD52D9167A38A97BCCC7D209B555BB53D6F55572D2804D489EFCCA0C00E6BED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 a777ed03d467ade43c955e5aa222dcd582d6eb54bcb8b58fa90c6868039b0329
MD5 7603b0656db6ebbce50c3a213d9df3ba
SHA1 bf5d8d1922d684bea15727a94b082942b50d1e48
SHA512 9e42b7a60f17594688a1269accad252e6185d5d5ad4842f45c988dfb4b5b282e371969568226044918d9773015d1736acd2268458db74c1c07b86602efafe195
SSDEEP 192:sxZuR81yM//K1Ml8QjB/ftsyWpVcnLMvGdIdpwPHW6+WNSqS5/AvN2pvdIgbfJ:sxZueLBB/ftsyWvcn4eemHbW/7d
TLSH
T1CD62C816BA34997BCCD7D209FA55BF53D6F9546292904E489EFCCA1C00E6BED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 ca7a28fc7e5b518bdad77f309899526904d3f6ce5ad889d6ba163b500f44071b
MD5 c1633cd5bef3887e3d18c5d936d15d72
SHA1 037ceec5a27d2728520dd857c9961fb5a883db4c
SHA512 bca3f8d177b16b92baa5a9f4478dc5415087289c50503daf48789313c584fbae4459a3bddd1dc81ea58b361876c52c384a2767e0d680fa9fe328dabc17464003
SSDEEP 192:sxZuR81yM//K1Ml8MjB/ftsknLMiGdIdpwPHW6+WNrS5/AvJChZnIg5fJ:sxZueLbB/ftskn4ZemHbE/FT
TLSH
T1C052C8167A38A97BCCCBD209B555BB53D6F55572D2904D48AEFCCA0C04E6BED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 842b6ccd1b39e7c66d1d5247b6830dee5de8792df6a4a169d9b2cc279efefe07
MD5 4d307e5fa4e188aee21cbe2d5907da32
SHA1 6d45bb5bf04ac65cbd4852abbaa404a010e7bf9c
SHA512 758849dafe9bfb3e73e40d049bc3ee4f2d41f867347974b1e0edbb20d1245e8c24da295ebb60312bdc6824f3dae8c9599360a46d933007c9e29c75ffb5e7c5bb
SSDEEP 768:XgQv2mS7pLuLneqWve+l+8F1+UoAYDCx9Tuqh0VfUC9xbog/OV4A0FLllnWhsroP:XgQv2mqEneqWve+l+u1jadA0FLfWh3xh
TLSH
T12EF20B3B6C0CCB7E4F804E9CEC2A7E8E6DE801CB9698895447FA845C03D66EB45175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 117aee47a8ebef5800d4c615b7fc07446844f01e398c90ce95102b1475e239c5
MD5 96ffa157be95f4626ed348a04a7e93e6
SHA1 f90590d29028a33e7964803e51614d0fb36c8f56
SHA512 0c73568b649f46c73a2e65563a2f9dd4785af73a3e6112a3bf29bf104fe94ba57bd91ec62105b28264e9d60115218eca5d6c11adc38e6a7beaab2a581a3a2238
SSDEEP 96:KkE4Kh6CtWnimAEQgksBzuugKm1uYgS+ux4KaxGKagNdKKWY6SOYKrqD:SnR/57Bnk
TLSH
T1D1E14A11323B42833A7E258EAD64B46E42C574673658A43B77B844A60F7BF20CCFD8D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 0421804c0a0c2497fbf617779bb7855c40edccf3ac06d492861035b36cd22725
MD5 5f99c1440d371457da6533d5ce5d28f4
SHA1 256f3772b60acc1811b1bc60334ed739937d2bad
SHA512 6e4312572960fce2af227903c5cb81fc2eb4b5c3850ba902bf1fbb7f97790513bd4de227677c13138f94259c4bf397bd5e4fbd1996c98852b5a92f3f217acf50
SSDEEP 384:nAjccCs+Bt0S3vsNWn7RHXhgDq6/MfYmTV5fPXNf38:eccQPj6Z0fYmDp8
TLSH
T172825B7638B46D3F9DE39921F14A3A039EB0C1ABA7C83F9899DC5B1D05DA1DC130B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 84c3b1c8987bccf91112f7afb36c9a494c9e99ea08016cfe2a05fbd9803f6a97
MD5 d22d2b4dc604de06c84659bbde48d791
SHA1 2b0b8eb830364670c5d53ae4e4b1cbd3cf9d9305
SHA512 bd9388aa15500cc24e3b0ff402993083399f638277ff06d8e9f1eed25ad27f5392a6cb6749b1efab3dc3236a244fb6cdee5ff21c3bec00109b4461c700951011
SSDEEP 384:najccCs+Bt0S35sNWL7RrUhgDq6/Mf1dvJASBrL/sd9ik83gmTV5fPXNf38:UccQZs6Z0fD2Smd9g3gmDp8
TLSH
T11DB25CB1A8E45DEF4892D5C5B14AF5036E74823B86886E5CA6FC7A3E319F0F88706815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 dd282918bca56c08a2edcf2fe34d9bae2a91daea9d06265dee912cf2b79c656d
MD5 cd00dd1031fb18b242273f8dbdf27e23
SHA1 d1edf3b448d686bb0a2d60d15c28e622e06c1178
SHA512 46a28af3236a9ceff27337f69cf20c469360ffc62062a76b0ccb2c2b7d0376e1583608efe97d908a29211ea476af569ba26d33c3f5ea24a7dbf7c4f6925c59ae
SSDEEP 192:rONP6IT0+QmiUyBkTgibFsxo/Mfh1oq6U6:rONP6ypTgiq6/MHYU6
TLSH
T1D4121B7278A8AC2F4EE36865F08736239EB4826BDB897F94D5DC1B1D01DF59C530B812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 be09d3f9424d2f7c4e06708d3800af6a05e18692b7a223fd9ab9a63550d6f765
MD5 624949bec19800471028511657df562c
SHA1 0d380af757d084deea9c57b0c4040fcdf6db47ce
SHA512 39f49e97f5b9d23449a603b30e88f4917277122968b5d0b8047eb32052bda158df72a01bde80987ae1faa5be439b2974b18d2bf8855b0f767b03cbba41c6b44f
SSDEEP 96:iqONkvQsjpfKTzDXcJRC5ih/cIPURHl8h4otop5uyDABEPgpYvJKxCbTqNGLpx7T:ZONr6IT0JZQmiUytkOgibFsxo4Fu7nU6
TLSH
T10702EA3578686C7B8EF36E55B48B3B235FA4116FDA952F88DAE41B1C00D759C1303826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b742316d-cd41-48f4-8905-01d6b865ddec.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\b742316d-cd41-48f4-8905-01d6b865ddec.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 f43b9cd1bc18b72019e8ea90ce972e1c42edbe8a7c55c665c28da76eec257f6e
MD5 9a31fb325b342da0ad0106ffbed5d456
SHA1 85054f28f55cb4fce58b0080a1d00eec87ca0e56
SHA512 a4024cb7035a3924b640b4e0ab32851bffd65835684632875009eea376c173e6c4983eaf59db54d49b7d346ca85941846532564fdc527effc83d593a9f01d68a
TLSH
T1EF411859BAEE1148B3B76F4A9BF6A56E447FBC772E06D09E00110D4F0A62B40C871B33
MD5 SHA1 SHA512 TLSH

Submit Download

6dfc88a0-75fd-40f3-ae37-7a8bb96d0366.tmp

Path C:\Users\Admin\AppData\Local\Temp\6dfc88a0-75fd-40f3-ae37-7a8bb96d0366.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

cdc75462-a589-4203-9c51-6e8dc3c9a400.tmp

Path C:\Users\Admin\AppData\Local\Temp\cdc75462-a589-4203-9c51-6e8dc3c9a400.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

822fb37e-3ad3-4e07-8845-f94ea54148f2.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2524_1078134820\822fb37e-3ad3-4e07-8845-f94ea54148f2.tmp
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2524_358692201\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Velocity.zip

Path C:\Users\Admin\Downloads\Velocity.zip
Size 12.5MB
SHA256 4ba3a8a29a4adaf21f304239e3c769d4f8da809106e01caef80945fd604b0076
MD5 69c1ec1744daf4c5dea14f428621dbce
SHA1 a01c9792d87a5ee761f1953794e5f08cfa3f600d
SHA512 743cd36db333c7412c9581245c7c570313791ac9c2c3311bd5d5cf425a7a0b47751b469b88e7c5216acb6afca8b1385c9ab0d32f7d49985195de3e748df1120b
SSDEEP 196608:VsI43uQZN/rzCs2jNH1CKuXYAISerbwoCFWOB3sMXcz0hNRcY8m/gSTu/gjwGN:VztWN/rzCVNE1YbjC8jMXc4Vv5Y4V7N
TLSH
T155D633DD9EA26F6DD17F3873501859CC4FAD296AE5ED012630A8E0C96AC35FC7C80C66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BootstrapperApplicationData.xml

Path C:\Windows\TEMP\{F3874509-1B36-4266-BE70-7E9C55160A15}\.ba\BootstrapperApplicationData.xml
Size 9KB
SHA256 1633b50661776a39ec9ffdc98ec19e48e0099a08ff5168cc3376137a904ee6e3
MD5 1b7efeed50be6f8ee212995070717d65
SHA1 22c3bc34718c78531cc3b56c312a54a89aebff9e
SHA512 9456bee88d409491723b8aa09ef6348b31119b5ee1ef3ba92a9d5fe7034353852c4e0f97031ae4f99e6ecaa49df5ebf611de83ad99a0c1f885318ea9920de5f3
SSDEEP 96:2BqRBM/En6YcYY0wZycirLdin6sUsD20wFycDdin6UkEc0wNycdOZdin6fMS2g05:2I1zfTK/lvjnlX0OOamagM5cYsCsysz
TLSH
T1BE12E3113BFD0218F0F3AE48EFF6A5555A36BD552E39C82D01601D0E49B2E819962FB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetLogo_256x.png

Path C:\Windows\TEMP\{F3874509-1B36-4266-BE70-7E9C55160A15}\.ba\DotNetLogo_256x.png
Size 2KB
SHA256 0f571f95d8eab48dbc81b0ec5e9f7225e349e26ef50868bfaab556f3c2443b01
MD5 39aa52615723b782c92dec710caaec7f
SHA1 760b49e256a7979fe50a56a2b1be3688a474b886
SHA512 89d1baa3820154667747b25e9e2fd321bfb2ec71dc309915b0a28dacdc80822a4943b639ebb37c37bd2559d5a4306d2096119cd970c84a0d331f6c68b0456dc9
TLSH
T1534195CF1BFD78D7E6E557918E1A8DD232738483B4B3A42CCE7B10B8274A5642B87940
MD5 SHA1 SHA512 TLSH

Submit Download

dotnet.ico

Path C:\Windows\TEMP\{F3874509-1B36-4266-BE70-7E9C55160A15}\.ba\dotnet.ico
Size 44KB
SHA256 61a2cbd12868cb9b359e0c78961d409b7875f072eb8e53ea88d3e6bfe2961a18
MD5 b8096652d9ec286709a2c863b244b110
SHA1 b3b7f0f4d608fad7cb59ba499d4d17c2b873a7af
SHA512 492a5aa83220bb77c178b7c5b50bf44968c0427e9e45bb97a33df14d7fb4c667ca7adde0ebb3874c7b6011057b01144e4e6651fbad62c6bcf5e0b93586c4bc7a
SSDEEP 96:r+gfbzo+wHK9NbwOY4tIWQeVlV1W9+H+guapUjFamINUItzf1dBNaIZ:ro5HuNcH4tIzeVlV1WEOFDgUWzf1PIm
TLSH
T1E913EF6DE68547C1C10C2032DB4AC792B5233C72E4DAE0C4F9D4FA7E177906965C6E6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\TEMP\{F3874509-1B36-4266-BE70-7E9C55160A15}\.ba\thm.wxl
Size 7KB
SHA256 b00edd703dd8a475119d0e4dd70a3aaa47f0e95361af290e76d367a8edef3432
MD5 8b2c667a8bbad3153068c0ed90df7ec4
SHA1 c9e04a3a37e5e6262ab9bfecf78280171b8f7b74
SHA512 5269f00d474acccb4c48cb7bcfdf19e63557a388572d3a6335aa39191319691d924e27f70da3f3495387c319396476c63a8fd7b35835cca0901220e39783847b
SSDEEP 96:HiTgM1+XSNEzA0HtYQstYCpCwZQpCeyk5HQJM9ouvj9urz8:Ew9EmtYQstYCPC9e8
TLSH
T191E1026F68DFDEE03A732651B2B3698D6919C29A136F1CF0F869084B47635016377A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.xml

Path C:\Windows\TEMP\{F3874509-1B36-4266-BE70-7E9C55160A15}\.ba\thm.xml
Size 11KB
SHA256 dfee8e2d075087227f19c835c145c5bb8e72a46880ea24080bb2472fd3a521be
MD5 4329e418dc56b1386d7ea29a0dcfab5b
SHA1 58387f92e89ca21b4179fb697c7de9675c59142f
SHA512 6934873d27e6efbb94da4f13ee8369b29995490051016fdf82800256b924902306d328bf1d4ebbf266d1a53eb24adb6478d1a67de4ecc3e3bcbe561968f24922
SSDEEP 96:HgvPkoeWEH3IWTaQfSJgHzth5mFahbuB8pR5+Vpwe+UIJLg1gEp+6F5pQnxc:AvoWydmQfVHMyyj5Z
TLSH
T14B42FC6851DC7811C532D702AB9371D3FF12BDA6C6C85A58B48E256B1FF262028B739C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixstdba.exe

Path C:\Windows\Temp\{F3874509-1B36-4266-BE70-7E9C55160A15}\.ba\wixstdba.exe
Size 431KB
SHA256 2b1cee5e3e24593247854eb7a7c4308937b9c607754ed2fb83520a8706c26f1e
MD5 0e88ffd2e737ac9b9a4241616838bc23
SHA1 3c8beb465d20bcef0cd6ceca9c60286d1d15cebd
SHA512 169b9e08518834c9bc5adfe4ab7b79e07685b72f30ede1c1a386229668bde8c15da378e1274e4013ad7b84d6f7a5acc64ef0806e3b8a66322861efaa7e26b620
SSDEEP 6144:X9vfS1NP+c3ytxmg4Stlqe3B9m2LSLTwGw7C3ZLaov5xZvSdF:X9v+GIyugllqe3wwGfX5/SdF
TLSH
T129943B3165F04037C6F90572AE14FA31BF69F208231095EBA3C0DD293968AE5BBB7657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1136-0-0x0000019657350000-0x000001965741D000-memory.dmp

Download

memory/3028-104-0x0000000004FE0000-0x0000000005043000-memory.dmp

Download

memory/6096-666-0x000001E233400000-0x000001E2334CD000-memory.dmp

Download