hxxps://gofile[.]io/d/J7uaY0

Analysis

user interaction
yes
max time kernel
123s
max time network
123s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
27/04/2026, 00:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://gofile.io/d/J7uaY0
Sample260427-aefmvsav9x

Score

9^/10

defense_evasion discovery persistence trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	erto3e4rortoergn.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
124	2316	msedge.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	erto3e4rortoergn.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	erto3e4rortoergn.exe

Executes dropped EXE 10 IoCs

pid	Process
432	windowsdesktop-runtime-10.0.7-win-x86.exe
784	wixstdba.exe
1332	windowsdesktop-runtime-10.0.7-win-x86.exe
2332	windowsdesktop-runtime-10.0.7-win-x86.exe
4256	windowsdesktop-runtime-10.0.7-win-x86.exe
444	wixstdba.exe
72	Decompiler.exe
2608	Decompiler.exe
1468	Decompiler.exe
4768	erto3e4rortoergn.exe

Loads dropped DLL 64 IoCs

pid	Process
1648	MsiExec.exe
3668	MsiExec.exe
4600	MsiExec.exe
2164	MsiExec.exe
1268	Velocity.exe
1268	Velocity.exe
1268	Velocity.exe
1268	Velocity.exe
1268	Velocity.exe
1268	Velocity.exe
1268	Velocity.exe
1268	Velocity.exe
1268	Velocity.exe
1268	Velocity.exe
1268	Velocity.exe
1268	Velocity.exe
1268	Velocity.exe
1268	Velocity.exe
1268	Velocity.exe
1268	Velocity.exe
1268	Velocity.exe
1268	Velocity.exe
1268	Velocity.exe
1268	Velocity.exe
1268	Velocity.exe
1268	Velocity.exe
1268	Velocity.exe
1268	Velocity.exe
1268	Velocity.exe
1268	Velocity.exe
1268	Velocity.exe
1268	Velocity.exe
1268	Velocity.exe
1268	Velocity.exe
1268	Velocity.exe
1268	Velocity.exe
1268	Velocity.exe
1268	Velocity.exe
1268	Velocity.exe
1268	Velocity.exe
1268	Velocity.exe
1268	Velocity.exe
1268	Velocity.exe
1268	Velocity.exe
1268	Velocity.exe
1268	Velocity.exe
1268	Velocity.exe
1268	Velocity.exe
1268	Velocity.exe
1268	Velocity.exe
1268	Velocity.exe
1268	Velocity.exe
1268	Velocity.exe
1268	Velocity.exe
1268	Velocity.exe
1268	Velocity.exe
1268	Velocity.exe
1268	Velocity.exe
1268	Velocity.exe
1268	Velocity.exe
1268	Velocity.exe
1268	Velocity.exe
1268	Velocity.exe
1268	Velocity.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{580865E1-2073-4861-8356-3D20DFF3D50E} = "\"C:\\ProgramData\\Package Cache\\{580865E1-2073-4861-8356-3D20DFF3D50E}\\windowsdesktop-runtime-10.0.7-win-x86.exe\" /burn.runonce"	windowsdesktop-runtime-10.0.7-win-x86.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	erto3e4rortoergn.exe

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
41	api.gofile.io
42	api.gofile.io
44	api.gofile.io
45	api.gofile.io

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4768	erto3e4rortoergn.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.ComponentModel.EventBasedAsync.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Runtime.Serialization.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\cs\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\zh-Hans\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\zh-Hant\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.ComponentModel.Primitives.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Drawing.Primitives.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Net.WebSockets.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.ServiceModel.Web.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\cs\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\fr\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\ru\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\System.Configuration.ConfigurationManager.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Diagnostics.TraceSource.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Numerics.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.ObjectModel.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Private.Uri.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Runtime.Serialization.Xml.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Security.Cryptography.Algorithms.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\de\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Diagnostics.Debug.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Runtime.Serialization.Primitives.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\es\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\it\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\ja\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\zh-Hans\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Data.DataSetExtensions.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.IO.Compression.ZipFile.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\System.Xaml.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\UIAutomationClientSideProviders.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\it\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\pt-BR\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\pt-BR\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\ru\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\mscorrc.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\cs\UIAutomationTypes.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\ko\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\zh-Hans\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Text.Encoding.Extensions.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\it\UIAutomationTypes.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\ru\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\ru\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Transactions.Local.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\cs\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\tr\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\tr\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\tr\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Linq.AsyncEnumerable.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\ru\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\zh-Hans\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.IO.Compression.Brotli.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Data.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\System.Formats.Nrbf.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\PresentationFramework.Classic.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Diagnostics.Tools.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\PresentationUI.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\System.Windows.Forms.Design.Editors.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\de\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Web.HttpUtility.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\es\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\zh-Hant\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\System.Windows.Forms.Design.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\msquic.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\es\System.Windows.Forms.resources.dll	msiexec.exe

Drops file in Windows directory 49 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\~DF9D39A00197AECE30.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAD18.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3240_47299305\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3240_47299305\nav_config.json	msedge.exe
File opened for modification	C:\Windows\Installer\MSI9DC2.tmp	msiexec.exe
File created	C:\Windows\Installer\e589c73.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF67E1CF0D548E6DE7.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF6D18C569C5717668.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3240_1698320689\protocols.json	msedge.exe
File created	C:\Windows\Installer\SourceHash{09AE2CD2-101D-45E8-8922-51ABAA31F8CC}	msiexec.exe
File created	C:\Windows\SystemTemp\~DFC12C8E3AB1EB8156.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA5B3.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF516D6C0C734100C9.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFFD4694A311CA718B.TMP	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\e589c6f.msi	msiexec.exe
File created	C:\Windows\Installer\e589c74.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF4347AC4B6B3DCB4D.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFD63D9E62223C1B0E.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\~DF30356957AB716CAC.TMP	msiexec.exe
File created	C:\Windows\Installer\e589c6e.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{6F122B2D-6824-4922-A23E-A9151114EE7A}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBBA0.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3240_706223607\manifest.json	msedge.exe
File created	C:\Windows\Installer\SourceHash{2A17EBA5-4EEE-4A8A-9CEE-E8B67938B606}	msiexec.exe
File created	C:\Windows\Installer\e589c6a.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e589c6a.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFE4A8910BC1A9E2E1.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFCF3F5ABD242157E6.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA612.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF9F53966B9B228BF0.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICA09.tmp	msiexec.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\Installer\SourceHash{EF889568-39DF-4FBB-83A6-893DF0A5A7D7}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9EBD.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e589c6f.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF93A0A639B331327D.TMP	msiexec.exe
File created	C:\Windows\Installer\e589c78.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB70B.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF540A559DD84DE31E.TMP	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF5CCD4C36E7AC9A58.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e589c74.msi	msiexec.exe
File created	C:\Windows\Installer\e589c79.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e589c79.msi	msiexec.exe
File created	C:\Windows\Installer\e589c7d.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF6F6E7019571BBD75.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3240_1698320689\manifest.json	msedge.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.7-win-x86.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Velocity.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.7-win-x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.7-win-x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wixstdba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Velocity.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.7-win-x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wixstdba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.7-win-x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2316	msedge.exe
1852	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134217220502343332"	msedge.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2DC2EA90D1018E54982215BAAA138FCC\Clients = 3a0000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5ABE71A2EEE4A8A4C9EE8E6B97836B60\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D2B221F6428622942AE39A511141EEA7\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\865988FEFD93BBF4386A98D30F5A7A7D\Provider	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\865988FEFD93BBF4386A98D30F5A7A7D\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x86\ = "{EF889568-39DF-4FBB-83A6-893DF0A5A7D7}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{0f62ff89-5cc3-5dfe-ec82-db9d826b6527}	windowsdesktop-runtime-10.0.7-win-x86.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\865988FEFD93BBF4386A98D30F5A7A7D\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2DC2EA90D1018E54982215BAAA138FCC\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2DC2EA90D1018E54982215BAAA138FCC\SourceList\PackageName = "dotnet-hostfxr-10.0.7-win-x86.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D2B221F6428622942AE39A511141EEA7\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{6F122B2D-6824-4922-A23E-A9151114EE7A}v80.28.51996\\"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\865988FEFD93BBF4386A98D30F5A7A7D\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2DC2EA90D1018E54982215BAAA138FCC\Provider	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D2B221F6428622942AE39A511141EEA7	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5ABE71A2EEE4A8A4C9EE8E6B97836B60\ProductName = "Microsoft .NET Runtime - 10.0.7 (x86)"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_80.28.51996_x86\Dependents\{580865E1-2073-4861-8356-3D20DFF3D50E}	windowsdesktop-runtime-10.0.7-win-x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\865988FEFD93BBF4386A98D30F5A7A7D\PackageCode = "145EF10EFC3685A4188A83437E504485"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.28.51996_x86\Dependents	windowsdesktop-runtime-10.0.7-win-x86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_80.28.51996_x86\Dependents\{580865E1-2073-4861-8356-3D20DFF3D50E}	windowsdesktop-runtime-10.0.7-win-x86.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2DC2EA90D1018E54982215BAAA138FCC\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5ABE71A2EEE4A8A4C9EE8E6B97836B60	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5ABE71A2EEE4A8A4C9EE8E6B97836B60\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{2A17EBA5-4EEE-4A8A-9CEE-E8B67938B606}v80.28.51996\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D2B221F6428622942AE39A511141EEA7\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{6F122B2D-6824-4922-A23E-A9151114EE7A}v80.28.51996\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D2B221F6428622942AE39A511141EEA7\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3178EEBD72B5CC250FFFEA4077368656\D2B221F6428622942AE39A511141EEA7	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x86\Version = "80.28.51996"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\865988FEFD93BBF4386A98D30F5A7A7D\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.28.51996_x86	windowsdesktop-runtime-10.0.7-win-x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D2B221F6428622942AE39A511141EEA7\MainFeature	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D2B221F6428622942AE39A511141EEA7\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\865988FEFD93BBF4386A98D30F5A7A7D\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\7C5F02C108B5629409B1C2D8A072F2A4	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5ABE71A2EEE4A8A4C9EE8E6B97836B60\Provider	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5ABE71A2EEE4A8A4C9EE8E6B97836B60\SourceList	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D2B221F6428622942AE39A511141EEA7\Version = "1344064284"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_80.28.51996_x86\Dependents	windowsdesktop-runtime-10.0.7-win-x86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{0f62ff89-5cc3-5dfe-ec82-db9d826b6527}\Dependents	windowsdesktop-runtime-10.0.7-win-x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2DC2EA90D1018E54982215BAAA138FCC\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{09AE2CD2-101D-45E8-8922-51ABAA31F8CC}v80.28.51996\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\windowsdesktop_runtime_80.28.51996_x86	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.28.51996_x86\ = "{09AE2CD2-101D-45E8-8922-51ABAA31F8CC}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D2B221F6428622942AE39A511141EEA7\PackageCode = "C01DBE88C89D6684C98072939B97831F"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D2B221F6428622942AE39A511141EEA7\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D2B221F6428622942AE39A511141EEA7\SourceList\Media\1 = ";"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\865988FEFD93BBF4386A98D30F5A7A7D\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\865988FEFD93BBF4386A98D30F5A7A7D\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.28.51996_x86\DisplayName = "Microsoft .NET Host FX Resolver - 10.0.7 (x86)"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\B9FD6305CAA5D224A5486ED10DAF7290	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D2B221F6428622942AE39A511141EEA7\Provider	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3178EEBD72B5CC250FFFEA4077368656	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5ABE71A2EEE4A8A4C9EE8E6B97836B60\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_80.28.51996_x86\ = "{6F122B2D-6824-4922-A23E-A9151114EE7A}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x86	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\865988FEFD93BBF4386A98D30F5A7A7D\MainFeature	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.28.51996_x86\Dependents\{580865E1-2073-4861-8356-3D20DFF3D50E}	windowsdesktop-runtime-10.0.7-win-x86.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\dotnet_runtime_80.28.51996_x86	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\865988FEFD93BBF4386A98D30F5A7A7D\SourceList\PackageName = "dotnet-host-10.0.7-win-x86.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.28.51996_x86\Version = "80.28.51996"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_80.28.51996_x86\ = "{2A17EBA5-4EEE-4A8A-9CEE-E8B67938B606}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D2B221F6428622942AE39A511141EEA7\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2DC2EA90D1018E54982215BAAA138FCC\PackageCode = "76A15FE2D7C0C094BAC51D0288AFF67C"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5ABE71A2EEE4A8A4C9EE8E6B97836B60\SourceList\PackageName = "dotnet-runtime-10.0.7-win-x86.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\865988FEFD93BBF4386A98D30F5A7A7D\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{EF889568-39DF-4FBB-83A6-893DF0A5A7D7}v80.28.51996\\"	msiexec.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Velocity.zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.7-win-x86.exe:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 29 IoCs

pid	Process
4916	msiexec.exe
4916	msiexec.exe
4916	msiexec.exe
4916	msiexec.exe
4916	msiexec.exe
4916	msiexec.exe
4916	msiexec.exe
4916	msiexec.exe
4768	erto3e4rortoergn.exe
4768	erto3e4rortoergn.exe
1268	Velocity.exe
1268	Velocity.exe
1268	Velocity.exe
1268	Velocity.exe
1268	Velocity.exe
1268	Velocity.exe
1268	Velocity.exe
1268	Velocity.exe
1268	Velocity.exe
1268	Velocity.exe
1268	Velocity.exe
1268	Velocity.exe
1268	Velocity.exe
1268	Velocity.exe
1268	Velocity.exe
1268	Velocity.exe
1268	Velocity.exe
4508	msedge.exe
4508	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1332	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeIncreaseQuotaPrivilege	1332	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeSecurityPrivilege	4916	msiexec.exe
Token: SeCreateTokenPrivilege	1332	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeAssignPrimaryTokenPrivilege	1332	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeLockMemoryPrivilege	1332	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeIncreaseQuotaPrivilege	1332	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeMachineAccountPrivilege	1332	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeTcbPrivilege	1332	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeSecurityPrivilege	1332	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeTakeOwnershipPrivilege	1332	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeLoadDriverPrivilege	1332	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeSystemProfilePrivilege	1332	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeSystemtimePrivilege	1332	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeProfSingleProcessPrivilege	1332	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeIncBasePriorityPrivilege	1332	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeCreatePagefilePrivilege	1332	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeCreatePermanentPrivilege	1332	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeBackupPrivilege	1332	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeRestorePrivilege	1332	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeShutdownPrivilege	1332	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeDebugPrivilege	1332	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeAuditPrivilege	1332	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeSystemEnvironmentPrivilege	1332	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeChangeNotifyPrivilege	1332	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeRemoteShutdownPrivilege	1332	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeUndockPrivilege	1332	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeSyncAgentPrivilege	1332	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeEnableDelegationPrivilege	1332	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeManageVolumePrivilege	1332	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeImpersonatePrivilege	1332	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeCreateGlobalPrivilege	1332	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeRestorePrivilege	4916	msiexec.exe
Token: SeTakeOwnershipPrivilege	4916	msiexec.exe
Token: SeRestorePrivilege	4916	msiexec.exe
Token: SeTakeOwnershipPrivilege	4916	msiexec.exe
Token: SeRestorePrivilege	4916	msiexec.exe
Token: SeTakeOwnershipPrivilege	4916	msiexec.exe
Token: SeRestorePrivilege	4916	msiexec.exe
Token: SeTakeOwnershipPrivilege	4916	msiexec.exe
Token: SeRestorePrivilege	4916	msiexec.exe
Token: SeTakeOwnershipPrivilege	4916	msiexec.exe
Token: SeRestorePrivilege	4916	msiexec.exe
Token: SeTakeOwnershipPrivilege	4916	msiexec.exe
Token: SeRestorePrivilege	4916	msiexec.exe
Token: SeTakeOwnershipPrivilege	4916	msiexec.exe
Token: SeRestorePrivilege	4916	msiexec.exe
Token: SeTakeOwnershipPrivilege	4916	msiexec.exe
Token: SeRestorePrivilege	4916	msiexec.exe
Token: SeTakeOwnershipPrivilege	4916	msiexec.exe
Token: SeRestorePrivilege	4916	msiexec.exe
Token: SeTakeOwnershipPrivilege	4916	msiexec.exe
Token: SeRestorePrivilege	4916	msiexec.exe
Token: SeTakeOwnershipPrivilege	4916	msiexec.exe
Token: SeRestorePrivilege	4916	msiexec.exe
Token: SeTakeOwnershipPrivilege	4916	msiexec.exe
Token: SeRestorePrivilege	4916	msiexec.exe
Token: SeTakeOwnershipPrivilege	4916	msiexec.exe
Token: SeRestorePrivilege	4916	msiexec.exe
Token: SeTakeOwnershipPrivilege	4916	msiexec.exe
Token: SeRestorePrivilege	4916	msiexec.exe
Token: SeTakeOwnershipPrivilege	4916	msiexec.exe
Token: SeRestorePrivilege	4916	msiexec.exe
Token: SeTakeOwnershipPrivilege	4916	msiexec.exe

Suspicious use of FindShellTrayWindow 55 IoCs

pid	Process
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
784	wixstdba.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3240 wrote to memory of 2772	3240	msedge.exe	80
PID 3240 wrote to memory of 2316	3240	msedge.exe	81
PID 3240 wrote to memory of 2800	3240	msedge.exe	84
PID 3240 wrote to memory of 2800	3240	msedge.exe	84
PID 3240 wrote to memory of 4984	3240	msedge.exe	82
PID 3240 wrote to memory of 4984	3240	msedge.exe	82
PID 3240 wrote to memory of 4984	3240	msedge.exe	82
PID 3240 wrote to memory of 2196	3240	msedge.exe	85
PID 3240 wrote to memory of 2196	3240	msedge.exe	85
PID 3240 wrote to memory of 2196	3240	msedge.exe	85
PID 3240 wrote to memory of 4968	3240	msedge.exe	86
PID 3240 wrote to memory of 4968	3240	msedge.exe	86
PID 3240 wrote to memory of 4968	3240	msedge.exe	86
PID 3240 wrote to memory of 3524	3240	msedge.exe	88
PID 3240 wrote to memory of 4208	3240	msedge.exe	89
PID 3240 wrote to memory of 2924	3240	msedge.exe	90
PID 3240 wrote to memory of 3524	3240	msedge.exe	88
PID 3240 wrote to memory of 3524	3240	msedge.exe	88
PID 3240 wrote to memory of 604	3240	msedge.exe	91
PID 3240 wrote to memory of 4208	3240	msedge.exe	89
PID 3240 wrote to memory of 4208	3240	msedge.exe	89
PID 3240 wrote to memory of 2924	3240	msedge.exe	90
PID 3240 wrote to memory of 2924	3240	msedge.exe	90
PID 3240 wrote to memory of 604	3240	msedge.exe	91
PID 3240 wrote to memory of 604	3240	msedge.exe	91
PID 3240 wrote to memory of 444	3240	msedge.exe	92
PID 3240 wrote to memory of 444	3240	msedge.exe	92
PID 3240 wrote to memory of 3188	3240	msedge.exe	93
PID 3240 wrote to memory of 3188	3240	msedge.exe	93
PID 3240 wrote to memory of 3188	3240	msedge.exe	93
PID 3240 wrote to memory of 4884	3240	msedge.exe	95
PID 3240 wrote to memory of 4760	3240	msedge.exe	96
PID 3240 wrote to memory of 4884	3240	msedge.exe	95
PID 3240 wrote to memory of 4760	3240	msedge.exe	96
PID 3240 wrote to memory of 3608	3240	msedge.exe	98
PID 3240 wrote to memory of 2548	3240	msedge.exe	99
PID 2548 wrote to memory of 2520	2548	msedge.exe	100
PID 3240 wrote to memory of 3880	3240	msedge.exe	101
PID 3240 wrote to memory of 3880	3240	msedge.exe	101
PID 3240 wrote to memory of 1496	3240	msedge.exe	102
PID 3240 wrote to memory of 1496	3240	msedge.exe	102
PID 3240 wrote to memory of 2428	3240	msedge.exe	103
PID 3240 wrote to memory of 2428	3240	msedge.exe	103
PID 3240 wrote to memory of 1832	3240	msedge.exe	104
PID 3240 wrote to memory of 1832	3240	msedge.exe	104
PID 3240 wrote to memory of 4912	3240	msedge.exe	105
PID 3240 wrote to memory of 4912	3240	msedge.exe	105
PID 3240 wrote to memory of 4600	3240	msedge.exe	106
PID 3240 wrote to memory of 4600	3240	msedge.exe	106
PID 3240 wrote to memory of 4600	3240	msedge.exe	106
PID 3240 wrote to memory of 4840	3240	msedge.exe	108
PID 3240 wrote to memory of 4840	3240	msedge.exe	108
PID 3240 wrote to memory of 4840	3240	msedge.exe	108
PID 3240 wrote to memory of 2036	3240	msedge.exe	107
PID 3240 wrote to memory of 2036	3240	msedge.exe	107
PID 3240 wrote to memory of 2296	3240	msedge.exe	109
PID 1432 wrote to memory of 1852	1432	Velocity.exe	115
PID 3240 wrote to memory of 2288	3240	msedge.exe	116
PID 3240 wrote to memory of 2288	3240	msedge.exe	116
PID 3240 wrote to memory of 2288	3240	msedge.exe	116
PID 3240 wrote to memory of 968	3240	msedge.exe	117
PID 3240 wrote to memory of 968	3240	msedge.exe	117
PID 3240 wrote to memory of 968	3240	msedge.exe	117
PID 3240 wrote to memory of 4892	3240	msedge.exe	118

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://gofile.io/d/J7uaY0
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x258,0x7ffa7798c188,0x7ffa7798c194,0x7ffa7798c1a0
  2⤵
  PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1796,i,11097044210516625165,14277084055626025114,524288 --field-trial-handle=2184,i,12129366642402720601,12248205204238114946,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:2316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,9957639892977961854,4944640445233944915,262144 --field-trial-handle=2184,i,12129366642402720601,12248205204238114946,262144 --variations-seed-version --mojo-platform-channel-handle=2180 /prefetch:2
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2440,i,11114162646347675101,7986201500425796521,524288 --field-trial-handle=2184,i,12129366642402720601,12248205204238114946,262144 --variations-seed-version --mojo-platform-channel-handle=3028 /prefetch:13
  2⤵
  PID:2800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3528,i,4457251098451139935,11734958946996612967,2097152 --field-trial-handle=2184,i,12129366642402720601,12248205204238114946,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
  2⤵
  PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3532,i,7975466125234751189,18288100738555724292,2097152 --field-trial-handle=2184,i,12129366642402720601,12248205204238114946,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4128,i,4088929349892470592,10601305197628868027,2097152 --field-trial-handle=2184,i,12129366642402720601,12248205204238114946,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:1
  2⤵
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4156,i,15940805048318829113,17644371914081857008,2097152 --field-trial-handle=2184,i,12129366642402720601,12248205204238114946,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:9
  2⤵
  PID:4208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4172,i,4859359052708245476,17627043093962105732,2097152 --field-trial-handle=2184,i,12129366642402720601,12248205204238114946,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:1
  2⤵
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4184,i,9519778508014015984,10644463138087337693,2097152 --field-trial-handle=2184,i,12129366642402720601,12248205204238114946,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:9
  2⤵
  PID:604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3884,i,6425255108123698060,4795943534997920162,524288 --field-trial-handle=2184,i,12129366642402720601,12248205204238114946,262144 --variations-seed-version --mojo-platform-channel-handle=3872 /prefetch:14
  2⤵
  PID:444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5464,i,17375819278091149478,1005147972221000611,2097152 --field-trial-handle=2184,i,12129366642402720601,12248205204238114946,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:1
  2⤵
  PID:3188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3656,i,150078411370982238,14246781088057766668,524288 --field-trial-handle=2184,i,12129366642402720601,12248205204238114946,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:14
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3936,i,6337212303243950358,13363861940956471603,524288 --field-trial-handle=2184,i,12129366642402720601,12248205204238114946,262144 --variations-seed-version --mojo-platform-channel-handle=3988 /prefetch:14
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,860357345941084387,18212849608707409045,524288 --field-trial-handle=2184,i,12129366642402720601,12248205204238114946,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:14
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,860357345941084387,18212849608707409045,524288 --field-trial-handle=2184,i,12129366642402720601,12248205204238114946,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:14
  2⤵
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6180,i,17303089737345610907,10713496557079328783,524288 --field-trial-handle=2184,i,12129366642402720601,12248205204238114946,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2548
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1132
    3⤵
    PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6336,i,215649049235684139,14370933604667370788,524288 --field-trial-handle=2184,i,12129366642402720601,12248205204238114946,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:14
  2⤵
  PID:3880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6488,i,11319760723366209782,4048949066864783792,524288 --field-trial-handle=2184,i,12129366642402720601,12248205204238114946,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:14
  2⤵
  PID:1496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,17052560576971362259,2366490437886516953,524288 --field-trial-handle=2184,i,12129366642402720601,12248205204238114946,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:14
  2⤵
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6820,i,11360677252663311942,11019162403098885779,524288 --field-trial-handle=2184,i,12129366642402720601,12248205204238114946,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:14
  2⤵
  PID:1832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6676,i,4168522062163823150,7707362263189418093,524288 --field-trial-handle=2184,i,12129366642402720601,12248205204238114946,262144 --variations-seed-version --mojo-platform-channel-handle=6804 /prefetch:14
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6788,i,9857181818685078818,647662720001129660,2097152 --field-trial-handle=2184,i,12129366642402720601,12248205204238114946,262144 --variations-seed-version --mojo-platform-channel-handle=6692 /prefetch:1
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6444,i,18067293564152627292,18148097195361688170,524288 --field-trial-handle=2184,i,12129366642402720601,12248205204238114946,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:14
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6436,i,1250320926377530605,9896776370527217656,2097152 --field-trial-handle=2184,i,12129366642402720601,12248205204238114946,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:1
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7076,i,3666217373180444955,15574057304704417475,524288 --field-trial-handle=2184,i,12129366642402720601,12248205204238114946,262144 --variations-seed-version --mojo-platform-channel-handle=6952 /prefetch:14
  2⤵
  - NTFS ADS
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=4784,i,13269070829003514942,1245508566044650611,2097152 --field-trial-handle=2184,i,12129366642402720601,12248205204238114946,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:1
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=6744,i,4132369120772291421,2314936320088919803,2097152 --field-trial-handle=2184,i,12129366642402720601,12248205204238114946,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:1
  2⤵
  PID:968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=6384,i,1372651996514582198,14871078582435967492,2097152 --field-trial-handle=2184,i,12129366642402720601,12248205204238114946,262144 --variations-seed-version --mojo-platform-channel-handle=7264 /prefetch:1
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7396,i,4897741265061557004,12062925377405943861,524288 --field-trial-handle=2184,i,12129366642402720601,12248205204238114946,262144 --variations-seed-version --mojo-platform-channel-handle=7428 /prefetch:14
  2⤵
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7420,i,3514615566292460888,15923395316934325425,524288 --field-trial-handle=2184,i,12129366642402720601,12248205204238114946,262144 --variations-seed-version --mojo-platform-channel-handle=7476 /prefetch:14
  2⤵
  PID:1184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7412,i,15618738031921673245,1627869277284140176,524288 --field-trial-handle=2184,i,12129366642402720601,12248205204238114946,262144 --variations-seed-version --mojo-platform-channel-handle=7520 /prefetch:14
  2⤵
  PID:2544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4488,i,6741036797190657026,4282877697987831914,524288 --field-trial-handle=2184,i,12129366642402720601,12248205204238114946,262144 --variations-seed-version --mojo-platform-channel-handle=2772 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:3564
- C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.7-win-x86.exe
  "C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.7-win-x86.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:432
- - C:\Windows\TEMP\{C63D8074-9BE6-4DE8-8CE9-49B53E6693BE}\.ba\wixstdba.exe
    "C:\Windows\TEMP\{C63D8074-9BE6-4DE8-8CE9-49B53E6693BE}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{30611866-F72C-479F-B674-97C4827C47C4} {273F96DB-3D84-433A-A48D-6E7341EA4EC5}
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:784
- - C:\Windows\TEMP\{C63D8074-9BE6-4DE8-8CE9-49B53E6693BE}\.be\windowsdesktop-runtime-10.0.7-win-x86.exe
    "C:\Windows\TEMP\{C63D8074-9BE6-4DE8-8CE9-49B53E6693BE}\.be\windowsdesktop-runtime-10.0.7-win-x86.exe" -q -burn.elevated BurnPipe.{48D6CB46-8DB5-45E6-ADCE-327A1870CD30} {F06C05A9-1FE3-4DD5-BC64-AD0FB660A747} 432
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    PID:1332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8048,i,15744163135386546378,7729887799007843204,524288 --field-trial-handle=2184,i,12129366642402720601,12248205204238114946,262144 --variations-seed-version --mojo-platform-channel-handle=8052 /prefetch:14
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8036,i,3522345238286407269,4819927997978238949,524288 --field-trial-handle=2184,i,12129366642402720601,12248205204238114946,262144 --variations-seed-version --mojo-platform-channel-handle=3964 /prefetch:14
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2032,i,2745282127316438692,14320330561886203056,524288 --field-trial-handle=2184,i,12129366642402720601,12248205204238114946,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:14
  2⤵
  PID:840
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2036,i,13201538507295302270,12096911270386353053,524288 --field-trial-handle=2184,i,12129366642402720601,12248205204238114946,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:14
  2⤵
  PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2036,i,13201538507295302270,12096911270386353053,524288 --field-trial-handle=2184,i,12129366642402720601,12248205204238114946,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:14
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7920,i,16949474397314912354,14075889569639233100,524288 --field-trial-handle=2184,i,12129366642402720601,12248205204238114946,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:14
  2⤵
  PID:2608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6420,i,8556926383802775855,6118034449494427854,262144 --field-trial-handle=2184,i,12129366642402720601,12248205204238114946,262144 --variations-seed-version --mojo-platform-channel-handle=8040 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4508

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2960

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3120

C:\Users\Admin\Downloads\Velocity\Velocity\Velocity.exe
"C:\Users\Admin\Downloads\Velocity\Velocity\Velocity.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=x86&rid=win-x86&os=win10&apphost_version=10.0.0&gui=true
  2⤵
  - System Time Discovery
  PID:1852

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4916
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding EF27C88CF90B55D79354664933D4788E
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1648
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 40EDD017227C659942A34F3A72AB5C53
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3668
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding B4918488EB76E1AC7155F7F1F712C367
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4600
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 0BDD9D50EABB25D761EB4C5AD0B9E523
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2164

C:\ProgramData\Package Cache\{580865E1-2073-4861-8356-3D20DFF3D50E}\windowsdesktop-runtime-10.0.7-win-x86.exe
"C:\ProgramData\Package Cache\{580865E1-2073-4861-8356-3D20DFF3D50E}\windowsdesktop-runtime-10.0.7-win-x86.exe" /burn.runonce
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2332
- C:\ProgramData\Package Cache\{580865E1-2073-4861-8356-3D20DFF3D50E}\windowsdesktop-runtime-10.0.7-win-x86.exe
  "C:\ProgramData\Package Cache\{580865E1-2073-4861-8356-3D20DFF3D50E}\windowsdesktop-runtime-10.0.7-win-x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.7_(x86)_20260427010804.log"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4256
- - C:\Windows\TEMP\{DD9EF479-A553-409D-A4C4-C8CD1C16714D}\.ba\wixstdba.exe
    "C:\Windows\TEMP\{DD9EF479-A553-409D-A4C4-C8CD1C16714D}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{B244A803-11A8-48BA-B275-35CFE60B2EE1} {8AF1C14A-74C1-4E9E-9C44-69AE5909BB7F}
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:444

C:\Users\Admin\Downloads\Velocity\Velocity\Velocity.exe
"C:\Users\Admin\Downloads\Velocity\Velocity\Velocity.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1268
- C:\Users\Admin\Downloads\Velocity\Velocity\Bin\Decompiler.exe
  "Bin\Decompiler.exe"
  2⤵
  - Executes dropped EXE
  PID:72

C:\Users\Admin\Downloads\Velocity\Velocity\Bin\Decompiler.exe
"C:\Users\Admin\Downloads\Velocity\Velocity\Bin\Decompiler.exe"
1⤵
- Executes dropped EXE
PID:2608

C:\Users\Admin\Downloads\Velocity\Velocity\Bin\Decompiler.exe
"C:\Users\Admin\Downloads\Velocity\Velocity\Bin\Decompiler.exe"
1⤵
- Executes dropped EXE
PID:1468

C:\Users\Admin\Downloads\Velocity\Velocity\Bin\erto3e4rortoergn.exe
"C:\Users\Admin\Downloads\Velocity\Velocity\Bin\erto3e4rortoergn.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4768

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e589c6d.rbs

Path C:\Config.Msi\e589c6d.rbs
Size 10KB
SHA256 26e0961fe25a4742d10e80cc9d7cbbe3d58c86ba5a8f7af67dac08d6e6c0e390
MD5 6fd809a865a26797903ed06b64fdac35
SHA1 4be28b45f2ff0433ee3a026cc1a4017e44f03e65
SHA512 08b67459215d02c53871ea5685ef426a24be3c2aeecacc14fd9e10675c4ac4392fec77d5056e4cec828cfa972476b8b645c3727ba896a96c820a9e05863bc845
SSDEEP 96:VIvJrAQCtNa1n81RdCz7/EaEQU9eD2QPuCsThqJU9eD2QPuC6jlF3MeThqVH5iyk:VKStUhgCz7M7v6NIb6N6OEc46kdpb
TLSH
T119223F01B640C2D3E89B0778EB131B153BBBC6EA6710839F01DD95785F6A78C5FA81DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e589c72.rbs

Path C:\Config.Msi\e589c72.rbs
Size 8KB
SHA256 fb95b22da620b83b1e11dec92917439fd99f09d05c12375069fa53b0310f6db0
MD5 9d667a512c0036b2b753c5cfdf068724
SHA1 e2b316fc932527d631eb596e9182729add6e671f
SHA512 30c57fe4a376e29842dfe01c8e4ab115f47cb5a33ef507267742ac8f9134592bf85bd3c18c366d54e566c7e9f7630f8b012c11163876b28ee7f5ba8b82094fa9
SSDEEP 96:MFeI07BxAjrZkzCHyWQUu2eD26sPuCsThq9Uu2eD26sPuC6jkzdYeThqRH1iUE5C:MF90LauCpvfNInfN54EKHV9dpH
TLSH
T1FB122F81310186E2ED9A6B34C3871B24BFEBE3D79611124F25CD52201F8B7C93F642EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e589c77.rbs

Path C:\Config.Msi\e589c77.rbs
Size 49KB
SHA256 5ae51273443991c0ad9ec1a4aa15ee6e3950c997f2f079e2771eb6f22e4868c6
MD5 b201ef2c07b9eb895cd9a2b660b97abc
SHA1 af24831d6e1be277db02b35cc05f8a13114d482d
SHA512 8e411a83f94ddb1cff84f161fe41074019686ee3312658d6703102e0f351f402c218f65a89f0bbff0b2af3de8d5701eb9e29b1427a8846a589efe7ae12ff454f
SSDEEP 384:rV7ONK0DLsrmMwoXlhkOI5RBMgumgKtaz0XHpZtcMq5UGRWBHNfrL/VZih/+xfxX:rpWilnAThuthR+JqfxArH
TLSH
T146334220AB05D2E3FB226C7133E1DD08EF1ACD627744DDA914C61665C5A3DAC3EE885B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e589c7c.rbs

Path C:\Config.Msi\e589c7c.rbs
Size 72KB
SHA256 a301855f1e9b6c56ba866047ecaf6d02df3262614f817b4e985f38056282d994
MD5 82dc88d007c2f2286f08f4af4dcfc504
SHA1 f8f79ccb8b9662544c1499abd2179b6c84efdedf
SHA512 aa47b7cf16459ce11043b251a92f348497536a668219dca8094c76745743ffa6132e82cb2253a9923b93fcfab2af684553924cd52a64ad29c44dc3730700f46d
SSDEEP 768:JONxqMomkns8EnoLou+PTcKsfNTGKJL040iA0qTR0P1wKaq00a/UzZYemq0KYhwr:gNkNCnoLZ+PTlUN7umeGKymciu0KYy
TLSH
T1B1731F464B91E5C5FB325EB176B7EA4CDD035CBBA292493D20C9252ECDB3D882EE44C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE.txt

Path C:\Program Files (x86)\dotnet\LICENSE.txt
Size 9KB
SHA256 7f6839a61ce892b79c6549e2dc5a81fdbd240a0b260f8881216b45b7fda8b45d
MD5 31c5a77b3c57c8c2e82b9541b00bcd5a
SHA1 153d4bc14e3a2c1485006f1752e797ca8684d06d
SHA512 ad33e3c0c3b060ad44c5b1b712c991b2d7042f6a60dc691c014d977c922a7e3a783ba9bade1a34de853c271fde1fb75bc2c47869acd863a40be3a6c6d754c0a6
SSDEEP 192:ydP0KvBLCqikR/EgGJLrlwD+eilNi5Py1SDeoDXDw9lF5OMz6Q:PWBuqikR/EDJLriwlNi5KI1Tw9lF5OjQ
TLSH
T1EC12B57D7284177109D207E16A0AB9D6F62A953C3117AA2438FDC15923AAF2CC37F3E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ThirdPartyNotices.txt

Path C:\Program Files (x86)\dotnet\ThirdPartyNotices.txt
Size 77KB
SHA256 deb4427a295e1ed474b0d81c5a0d972c1b550b9a715cda939cdfa9236b1b418f
MD5 0d8867a25ba926e6e40cd52ab3536b5c
SHA1 89390dc8b8318d0bfef1c6a2fb4783537e28a465
SHA512 317ca335405274f4f91b173651ca2826760acb5ba5cf41aff51adc55c2cda9059fb268333665f13f62fa48119e55a303720a780dd58d28dd9967db4c88407d61
SSDEEP 1536:HA9jHwsGfgg39/zwgAVkguQxrDjugtSEGepkWvrpX7anuqdLSVnfiStPq+3LefrL:HA97w/ogz1AVxuMjHtSFULryLOgrGWm+
TLSH
T17773A45F7E45077319E2C3916569A8C5F22FA02E3B6B2A44346EF248133B42DD6FF858
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files (x86)\dotnet\dotnet.exe
Size 141KB
SHA256 8b6be8b21aae8f21fdfc0e15d350e072bd84e439c4d99e1ee8b6f38a61eabb5a
MD5 f25f2493a974dd8d01fb9410398c094f
SHA1 f6397f4c97ea07a57b846ded5c212b84ce0b25c0
SHA512 81f932c605c96e68e923e37c83eca1e1b24147b5435d3714d298ed1fb6f63ba2663d760d36441921ed80c923b0086a05ee5a27df1f853169c8d29edadcfda4b8
SSDEEP 3072:0078iKA/8gNs0xphwaNq92hxQOA7qVy2nY:0umQphy9z7qlY
TLSH
T1C5E3F725F9958162D15D1970CB29CE91BA3BAC619BE1E0C763C0FDBE0B701C0AAF5B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

state.rsm

Path C:\ProgramData\Package Cache\{580865E1-2073-4861-8356-3D20DFF3D50E}\state.rsm
Size 1KB
SHA256 a19dd723353b655af63146c5a5803f7443ac7d12dcec67794a96fc1fcf337b53
MD5 228f397fe4d0e0507e0efef78c68a831
SHA1 7e8a6eb7ef27f73d251adbc471e4ba5286fc499f
SHA512 353f76efee175efe71d40f09c0a024060c51cb1dd7ca90deda8f4edbd79f2f5d67e3da24517a352140043f43d844b6bd3877e56ed2d24228497127a96b1f50f3
TLSH
T14E2181615BF6192CF3F2AB35A9F96729543BBC125D24C16E0001318A9E72BE1C8B4B33
MD5 SHA1 SHA512 TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 3181581ff9a1d358cbc13c4b5b51ac0d60650b41933ed6f6b59bddd8d0e5ebcd
MD5 e7877ff8212ffab65a63d728bb0a4a95
SHA1 732a295e598c9c2eff559eae0b202b2b90c22e97
SHA512 59e3fef7e209202f0bce60bcaea0d1784e307f0ecdb58c9425fd2c2b21ab46234c614607e21af11add2b5ce8855fa0d25771d55233fb0d43b2c774455b99e2a0
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7h:fwUQC5VwBIiElEd2K57P7h
TLSH
T11CB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
Size 3KB
SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
MD5 1de85fec2dfcc28011a7c2aaab95eb5f
SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
TLSH
T1D1611DB79A3048090E3412B86B19B35DF63E029F1AD598EB76BE568F1F710F7245C54C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 eacd218daf22fcefbc23ae70ce919d8ac95b89c3f7d038f647296c47a218fc46
MD5 35b0754e7f5b0bef0f59e6474c3c9e30
SHA1 a5dbcd61883043544b184e46e47beb3bf5d259a8
SHA512 0a14f00d3bf385bd104004e3adb021fc5b135483b30669a0f446d235f67bf00d734e76a56ac18adc3d6765163a992c78b2c6833f0e764506a9c06ff2ad8fc90e
TLSH
T1ECD0801452F17C64C2E65975484677153D1DD4E346C3537225A3267C4C461881C953C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7173f2853e3b591f142ed047bb6a2ea62d5d817f9016fdd31efbebd88f820e91
MD5 9093390d9e798f9a4ccc25251c10fea5
SHA1 96837bd82509feb4ca69a53466162950148f0394
SHA512 4db01b0d83eba59662ef7f147a96bb0034c92f2c5d5ac83ceeae12ddc800fe8dbce64d41320c2a3031796e981edc605460e3a1da207a6a9d39812740085a86ef
TLSH
T1A7D0801412F17C64C6E65975484577153D1DD4E346C3537325A3267C4C471C81C953C7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 b5e3e6b35dcc77eee06a63225ab2e7ddd5102d34910bce39a55ee71cdcc88ed7
MD5 9846ecb12685d03127ba6c0ce3763dee
SHA1 bede0d2aa038400fe852ffcf0b90d67f25fae97b
SHA512 b2439ba9e579a8914e2ee7a0e712f18a6315e22a0e2f3e38551cfd28b31876992701875e6914c9f61600d50ce7a283f8fb0f017897a400811981adac3212b546
SSDEEP 96:FV94x1uj3pEQ+Om1BwKEZSN1U0oixVxLf:P94jUESmTvNC0T3
TLSH
T1EE813950BDAE90D8E3E34072A2FD6174B93646D83EB70E27FDD289BC9A09761C340138
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 be67a91d5530a6c81e863558d28243da22a61653617285fd4a72c2ae1bc26d8b
MD5 3dc0430c0ff45aab52e366b0fb5d04f7
SHA1 490e545120c7c0f0d2f99a21bcc999b072dc262f
SHA512 7b36922dee5afa0de44493991d02aa4b7c7774b4fa89feb9dd4843cf7295439d732c4457b5207041dbd8c6a290f19e4734654e913074abe86e3cec8f9416f7ab
SSDEEP 96:qAq4QJ1uuB3pQp++Om1uwKE+SN1U0XKixVxLC:Nq4EfSkm0WNC0XR6
TLSH
T1E4912950BDAE90D8E7E3507296FD2634B53606C93EB70E23FCD28ABC9A0A761C340134
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5854d2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5854d2.TMP
Size 3KB
SHA256 e94ee71a4d28d32da820c97669678c88e5a838087576b34d742b6d4eb2fe162f
MD5 f64a208ec317ea62caa8e24b7afc7164
SHA1 63eb1ae9d374778b6b5bd7d0d115fa0e8ce3db93
SHA512 a5ae69a0d98db1d3918ef1dae854cfa24931a6903b3a4b2a9dc90f90c424b65901cb23a2e198a506418556270f727711459464e24ef431bcdc7f9b2a90b74853
TLSH
T18B6128507EAD90D8E7E34472A2FD6165B93446D83DBA0E37FDD248FC9A0AB61C340435
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 f90705541c2887b974033321377341f896b425dc1974fc898a9b7ca7c5916671
MD5 981453a3680824e23d4012a3d753e778
SHA1 edc3df9b2878d2d1fbc889ca4c6f8eda0e9d66a4
SHA512 95a34ceaa6ee84ca2468192d040cacab545f2d0b3558dfbdc09c9bc1e684cf852627eaac20aa596ce2479686de19f10e85a6913636098b8b93101ff47f5d28f7
TLSH
T10271CEF783F4856E8E1196F0AA14AE1FCF1C0515831C7D6989D4AE27D3E3472E10165F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 2df7edef9a7a8fb969c0916600f99e2b9666e78a7d33acc67634aaac0fbddf4e
MD5 c50775b48ed925c28e258eadb377e331
SHA1 cd08eecb9bed8fa71943d53c67510b760abf592e
SHA512 9883ebc4be66a9c682e99aa87975cc0462f04a3d1c1c54c2a7260699f59b85c2f7662df82c72cac3d73702479b613d59014b41541320005170619f229c350ea0
SSDEEP 192:sxZnRiyM//K1Ml8MoT/fPspOhGrBIdpKlM/W6+WNeXV/Y0Xyi2gq+pIg4J:sxZnIQT/fPspcGrqj/bo/5iaqOc
TLSH
T1C252F8066A385977CCDBD209FA45BF53D6F91972D2900E44A9FCCA0C04E6AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 588c91bd40d9b876689bc2af998e6962481bf6d3cd6db89893a90275481c4b97
MD5 b948969285728a1f700741efc1caa79d
SHA1 2ed7bfba68b07b87a258e8b73c31a4e7af327ed3
SHA512 fc6deb7c66e7c0da2c0b31b27cc66dcdc63dab25576e9f467004a82939fec4bb4a27e838eaae805f09b5ea9b6bbc701399432f53cb7bfe32d5ae31d3047cedbd
SSDEEP 768:PKTTF8J52SE7pLuLnYwWRmY4QPU8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3OimfLlQ:PKTTF8J52SIEnYwWRmY4QPUu1jaKOimO
TLSH
T149030C3B680CCB7E4F804E9CEC26BE9A6DE8018B9698C99447FA444C03C66EF55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 37KB
SHA256 2145590d4ad6625800ed92e091b951b5329450726b6e53a204887048f58a76d2
MD5 6cbe8b48765f8769e4d99f3448e7be75
SHA1 d8b160c2bfe73fd32870cb1bf88e90970f17be6c
SHA512 23465fe0edff75ec0eab7914b253cdade6206899491adf2013559bcddfecfd8c75097ed1af9b28d4ef0826a657445ba6fc09365ba0327c76c14db18659c7399a
SSDEEP 768:PJTTF8J52SE7pLuLnYwWRmY4QPU8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3OimfLlO:PJTTF8J52SIEnYwWRmY4QPUu1jaKOimU
TLSH
T1E7030B3B2C0CCB7E4F844E9CEC26BE9A6DE8018B9698C99447FA444C03C66EF55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 5d30e7195a1c5d14767e4bbddd560de2af7f709ffac0a33a117dd6240d082a19
MD5 822b58aaabace12a1715c8c2a6d8def8
SHA1 bba186aa5552cf9d5b1db58d2ef2d914cfa9a485
SHA512 b855c835a0e72333e948507e302c313129eda6e96d4d1e20aca782e61721de7002e8dc62fc123bdda05ccf4a6d01a5a1500f2cf8713024910fe57c3401877f96
SSDEEP 96:KwzeKc4mWGEK7K2qa0KjaU7YPL5FRUxlGffDUKnRfRUjLLGZrJ+2Hmwm0mmmAmgA:YFDjXM/KRVfhBy1QR9j4u/onP49H
TLSH
T13DE12451B53A03813A7D28AF94D1B47E02C134A33078A43B7BBA51A61F67E54CEFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe58e8f4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe58e8f4.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 250f6322427b78592a33a1c24d759459cfbc93f7ea358f4d62ae56ed16319fa8
MD5 6a755729a96b69772014dc0db77a9bc0
SHA1 53d896bd0fd40f80da92896e5f310c96c095d619
SHA512 ef6a020c094b5296915991b092fbfb43ebc54a9ca21a6a1f2b7abb712523c9d5e2153b1b1c6e69eb10b6d341c7cd5eff8e1f59495f2e052826b52525856ee933
SSDEEP 384:nDjccCs+Bt0S3d8NYUQmlDDRlWxlkc/TlZ/bQNvUCf39:vccQ9XmPMOc/pBbS9
TLSH
T1CD828C3068B86D37DAF39A51F08736635F7414AB96942F68DCE95F1E009F2EC170B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 911875ccbd1ef4807a52e37fd0d86e9903545bd20c8cc4eb57a3efce5900a521
MD5 a7398c854883fa2ac582ea7bce6c1199
SHA1 9b6898438d3f5f890c2c62b0d5677b75f577ecb8
SHA512 60f7e424b8b4250ed454c3bafcd598bfcffcbfb32849d5618d5fc48abf4c5cc3064f44b438179c62588f6e418d554186012db668ce7c19723105daa0114ccdca
SSDEEP 384:nsjccCs+Bt0S3d8NYUcmlDDRlWxlkc/TlZ/bQNvUCf39:qccQ9TmPMOc/pBbS9
TLSH
T18B827C3068B86D36DAF39A41F08736635F7414AB96942F58DDE95F1E009F2EC170B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 2c8892219a4c8297dbaf46fcc3178f1880ee9d6d1ac1891909f820001665aaa8
MD5 36561b5b79b6570611066e2ff2763a4a
SHA1 fda04d9aa792b6564b222861d46a03bc420384cb
SHA512 7c77629eb7778859758bf267f4b821777c005d90ab6b1eb78aef8a4064de32aa241b7b806b98e049d5ade46b131aab282a928effc068547a90f49ed56ae90d8a
SSDEEP 384:njjccCs+Bt0S3d8NYUNmlDDRlzNO2kc/TlZcbQNvUCf39:PccQ9QmP3Odc/pGbS9
TLSH
T1E4828C3068B86D37CAF39A45F08736635F7414AB96D42F58DDE95F1E009B2EC170B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 081f622daed64a7cb09f6de61e0ce8dbdb21e94f3fd36dcc4a176bf4b3c93075
MD5 d5b7af5fb0afb4cc821d02d4dfadfb72
SHA1 ab847fa4513e9fc73465473cf225bb54ec011e17
SHA512 0e6fc7119a10e821b5596fd4a00b4524842cd7183c3d9f414bd19d9b32453b0cbe27df8f4eb5796e52ed146b09ea94cfe734f65039c0997e9135ae982d5728ef
SSDEEP 384:n8jccCs+Bt0S348NYUNmlDDRloNO2kc/TlZcbQNvUCf39:6ccQYQmPKOdc/pGbS9
TLSH
T143828C3068B86D37CAB39A41F08736635F7414AB96D42F58DDE95F1E00CB2EC1B07826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 aefc18ea4a4733c4ae8183a9b8a1ad5c63c43d9dc11c2586e32d45fa79c4b936
MD5 2778b49020b5137813bcd7140f5cffbd
SHA1 c84f508527f11bb04faffc5858ee52274f3ce862
SHA512 0ec9be191b933e55f87d381611097f9ce3da8e409a74704fe6a53ff7dd45e2371e74ca920caccc6bcf3a86d317c96e2f87d265d2eb8fe45ef38b1a416548eb7b
SSDEEP 192:lGNB6IMGEQmiUyRT66xc/TqoSSepmWBU6:lGNB6GU6W6xc/TlivU6
TLSH
T1C0020A357C787CBB9EE3AD55B48776235F94117BDA942F88CAE81B1D00EB69C1303822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e28a1ecf084173bf45dc9d1595b6f2895bb0bd97be6845c8c619883b85f972a6
MD5 c140aae0937defb582021e2e5308c7c7
SHA1 590684165769a090e3804a7d346d86ec2b748847
SHA512 2e4b64f3f6c1eda62e6dde1b89c4ad753540bd042d56b05b2582582cf9035c974bf19200eb6de2ba23ed47d0a83203da79a584cdd8219f7a7ac6cb5cb1ccb82c
SSDEEP 192:XGNS6IMGJQmiUyq6Xxc/TqoZtoLS66Hq0zU6:XGNS6GnwXxc/TlZfbU6
TLSH
T17B121830B878BCBB9FF3AD51F48776239F64116B9A841F99C9E51B1D00DB69C130B822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 493803a40fd0d10df1b7dd59bc62c2e4b82d5fb88ba43cf02483f2803bcba512
MD5 ee3bf4f289d0a02c3b9169e8fefe8e42
SHA1 08744fef4b05a69b0491f1dbfd0731c3620997aa
SHA512 cada98b5f860b6b12cd2943286d44a799e8bea4501bcbd62ca06042f89d4f35252cefe0982f664bd49a5b9b49f68ec7347282327d790bafa9aeba744e07f441c
SSDEEP 384:nEiFMjccCs+Bt0S3c8NZ8TUNTUlIlNmlDDRl7NO2jDfYac/TlZObQNvUCf39:fFKccQ8AwgPmPTOrac/p4bS9
TLSH
T143B21832D8A4DE3BEDF38B81F64676939EE011A786986DD4DDC95E0D008B2ED170BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nav_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
Size 2KB
SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
MD5 499d9e568b96e759959dc69635470211
SHA1 2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6
SHA512 3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905
TLSH
T16B51DB73D5988C4B9BF4A29CE919A309F11107CF75D48C0B76BE010C1F7757AB5C6588
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

3118f8b7-3173-400e-9c15-aca09954c684.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3118f8b7-3173-400e-9c15-aca09954c684.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.7_(x86)_20260427010804_000_DotNetHost.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.7_(x86)_20260427010804_000_DotNetHost.log
Size 3KB
SHA256 2098fe4cba625059a55ea33adc027f83bf0715469fa254e408cbcb3f10ccb2ff
MD5 42c66fa0a999d26c97e384932b4d6b54
SHA1 51e10c5716dcdaffc0caf52ee97a75add88c1435
SHA512 43b42c6c9b254340fb5ad65d787f3d6c6ed42f6f8ea5a9b6c8bf03a71665d844983858d3f03a6108e60dfebafe2282caf123f343a8b843f8df937371e48a3418
TLSH
T1AF81EA252EE50915F2B35747DEF3C5631A33BDD66974CF4C2388831906AB90688ACB7A
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.7_(x86)_20260427010804_001_DotNetHostFxr.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.7_(x86)_20260427010804_001_DotNetHostFxr.log
Size 15KB
SHA256 dad347d829671db18edd39e3ccde6dddaf53f89e0f2ecb72b0ff9c60b69aaa02
MD5 aad197d26b173d5c959d7862231108d5
SHA1 b422b1e4b30ce63428d1d424c0fd00521d8c0352
SHA512 abb48fbe410770f11e4a8a021dd25fc3295519e1b99ae17cb581941b564562196ec8e2f00d3c3e094b96d1a0d51dbfcee40d89c89e5991ae42694f2fda263e64
SSDEEP 192:x9ZbXAhOUiCLrBKFJCYxbffQ+UKijTIeunZ0vYg3:7ZbXAhOUiCnBECYffHUPjTIeunZ0gQ
TLSH
T1467236292EE40109F2B76A43DEF384671633BD5BAD75CE5D2180831A05B7907A47CFBA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.7_(x86)_20260427010804_002_DotNetRuntime.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.7_(x86)_20260427010804_002_DotNetRuntime.log
Size 2KB
SHA256 7eadaa93fae6fe703d3cff792e82ee09883db751535bf45f499dab283cd1ae64
MD5 43e6726c102daa33183e1ab983bce9de
SHA1 9938e8e9d277ceb78938a91da0414edf3d72be54
SHA512 33812c31edc7497f72fd1a4a57c4e855ca7c0e9d3bd9ee18d5f7ffb50e41e753fc15744536a2aacfeb3cad542e37b854963648711718b44797b197263a432509
TLSH
T1CD41B3652ED90915F1B31707DEF3C5622A33FDE2A871CF9C13458219066BD0649A8B7E
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.7_(x86)_20260427010804_003_WindowsDesktopRuntime.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.7_(x86)_20260427010804_003_WindowsDesktopRuntime.log
Size 2KB
SHA256 1768ed91a896d043845fdd6d33ef2b528faac995117fdb3f45c03d1ea32a9da6
MD5 4bc9a07b456c0138623a2194c1c42d82
SHA1 4e22d428d142a3debf72a2e14a9bdc4fe0de6d50
SHA512 94c388c1abd2e8e18e2e47bb7555366b7e40806d477613fdecada78273b383b6fc85f8a7bc920dcf16e2e154ad6921b8446b1af5fce3dca07c598bf5e9866875
TLSH
T1FE41F6552EE90C05F2B35707EEF3C0625A33FCD66974DF4C1246521906ABD095868F7E
MD5 SHA1 SHA512 TLSH

Submit Download

a2457d48-625d-4ca0-b931-d53789fa8cac.tmp

Path C:\Users\Admin\AppData\Local\Temp\a2457d48-625d-4ca0-b931-d53789fa8cac.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f6f86634-0a1a-4bdf-bcbf-415c6275300d.tmp

Path C:\Users\Admin\AppData\Local\Temp\f6f86634-0a1a-4bdf-bcbf-415c6275300d.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3240_1010979672\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7cfc2e45-b225-4ebd-8f7d-22d842f71d64.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3240_684322970\7cfc2e45-b225-4ebd-8f7d-22d842f71d64.tmp
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetHost

Path C:\Users\Admin\AppData\Local\Temp\{C63D8074-9BE6-4DE8-8CE9-49B53E6693BE}\DotNetHost
Size 900KB
SHA256 efe1a594f21ea09c5c6f3f75d5618df0ff6bb465e1b7a440394eeadf06d86bdb
MD5 6b8563447431316d2fec41888d36a80a
SHA1 12e0efe2109fb356fa980e7bf7575fbd248cc64c
SHA512 9007dcba3c7adcb29aafcfd77e18a398903cb65f53e51b04c351625751c8fb95d29d2cbc34a232feffc95f900af956d7a75c9a7b3e434a079d9c72c41ca39845
SSDEEP 12288:8jcnTi8XiHmGdKkg78We96sI+yDxTYwsoCm1p:ecnTiadGdKkg78We96FDxTYwsvq
TLSH
T19C157C23BC419036D9EA0D72A438CB616E3D7D14279488DB9390B94DFCF06D26FB26D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetHostFxr

Path C:\Users\Admin\AppData\Local\Temp\{C63D8074-9BE6-4DE8-8CE9-49B53E6693BE}\DotNetHostFxr
Size 956KB
SHA256 767110859ec26785e7cccf654785f32e3753b545a6c9003d55bd280da9b395d4
MD5 85dcd01ef3e23d75cc9b6ab925f9eb5e
SHA1 64f9491648d78d252bf06c30f042a8def4a203e3
SHA512 a9faab719ffd01d6a6c3ae726679bdc711f9c1311787de148ffc8870611769fe4798a87b6100d0262e3efd04cdcef0bfa7d64316ac6601cff07057d7a8238475
SSDEEP 24576:lcnTiadGdKkg78We96FDxTYwsvqV8iw+f:lcTi8GExDdYwsvlhY
TLSH
T154258C237C41A036D9EA0D72A478CB616E3DBD14279484DB5390B94DFCF06C2ABB27D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetRuntime

Path C:\Users\Admin\AppData\Local\Temp\{C63D8074-9BE6-4DE8-8CE9-49B53E6693BE}\DotNetRuntime
Size 26.1MB
SHA256 6fe13e18d56706ab4594ef5e8dc0104972e0a732eadb89383bd77815b4ed2b4b
MD5 94215feca007a68a741c4581fd317632
SHA1 10f54be9bc3ff44c7eb840b2fc3d943d79b22e7f
SHA512 682598c5a654f6af043b194b1b44b70a6b3310560966951278ac4d047e0e44ab9be9e8dde6728e41680bfc4ab7b23799198a4b639100eebd0b47dee6b160336f
SSDEEP 786432:AAw74NDnKORiD9fNBvBwDs6jz+Gws44qirlQmkccg:Aj+PRwFGDjj6G+mkhg
TLSH
T184573327BC836022D5EA1D35A47ACBB1293C7D60174488CB87D0B94EF8F12D19BB67D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsDesktopRuntime

Path C:\Users\Admin\AppData\Local\Temp\{C63D8074-9BE6-4DE8-8CE9-49B53E6693BE}\WindowsDesktopRuntime
Size 26.7MB
SHA256 9aa6ec95172581a1a485d4f5208a0c422e892941c9f859b2efc964def9bfd963
MD5 cecf22905b6bc75e8eda547379796581
SHA1 85db3f58fdac544e5854fae2b137c9ed8ac3fa02
SHA512 fcb8309a1d055a2273a2b08ff079be7ecfac48c8d6d8dcbed86ed976969460f93b4e6d25ee486c356da2d5336b7abdc120fa78f3d47e5006bc059787d6809b9a
SSDEEP 786432:xsMa2N2voVo66TV/D2tZO0I/u/3bb9yI4jSW3e:xsg5VkTV/D2tZCirb9kSAe
TLSH
T1FA573313BD83A53BD6BA0D72A439CB1068395C141B54454F93A4B88EFCF12D3ABF66D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Velocity.zip.crdownload

Path C:\Users\Admin\Downloads\Velocity.zip.crdownload
Size 12.5MB
SHA256 4ba3a8a29a4adaf21f304239e3c769d4f8da809106e01caef80945fd604b0076
MD5 69c1ec1744daf4c5dea14f428621dbce
SHA1 a01c9792d87a5ee761f1953794e5f08cfa3f600d
SHA512 743cd36db333c7412c9581245c7c570313791ac9c2c3311bd5d5cf425a7a0b47751b469b88e7c5216acb6afca8b1385c9ab0d32f7d49985195de3e748df1120b
SSDEEP 196608:VsI43uQZN/rzCs2jNH1CKuXYAISerbwoCFWOB3sMXcz0hNRcY8m/gSTu/gjwGN:VztWN/rzCVNE1YbjC8jMXc4Vv5Y4V7N
TLSH
T155D633DD9EA26F6DD17F3873501859CC4FAD296AE5ED012630A8E0C96AC35FC7C80C66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Velocity.zip:Zone.Identifier

Path C:\Users\Admin\Downloads\Velocity.zip:Zone.Identifier
Size 162B
SHA256 99d3a464b8f34fa4674ca921a5d953e3bf743a8359a026d1a855c25d9761d95b
MD5 ce422664d8bbf3419c71886b97549de1
SHA1 482c329bc1453412525219cf8f2855008f9b6769
SHA512 d64d12ce7faf52f3b672734d1a109adc6fe485d9fdfbfbd7cd2db8d2801dff7a2bb610b0a736150d0f1cad8291363c3e3fc09f59189a8c9025d09b8070999ef3
TLSH
T171C02BE79418C0C117CA37C10A79E98CF88FE44DCDB74F80C400508F98C9C28C9D60AB
MD5 SHA1 SHA512 TLSH

Submit Download

windowsdesktop-runtime-10.0.7-win-x86.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.7-win-x86.exe:Zone.Identifier
Size 185B
SHA256 4423e7b7a7e49693d09e6fff75f573ba0a43c10bfc0a9e8040caa0920dc5b0be
MD5 ed9fc2d35e3884ecd183b9c3b23a1c9d
SHA1 80669794b594f34131ce1f955325ad5f5f60ab06
SHA512 bddf79cc48cf6ce80e0506687696f54cb9913f7babec90f355b394b128c4295344d70e4f222d0033b4d53b76c75dc172da06820d416f5a352d6b061316971e73
TLSH
T1E3C012ABC80144520E3032821B6ED559FF0F1D125D81C38898C48096E992AD6C1528D5
MD5 SHA1 SHA512 TLSH

Submit Download

MSI9EBD.tmp

Path C:\Windows\Installer\MSI9EBD.tmp
Size 346KB
SHA256 1caa470031f4f3fb53bb38187d522990a3a7423476b1b5aaa27443a3e2fc62c0
MD5 f715d24632e765c53e9856df53dc8318
SHA1 78e2280ccaeed00119fe827acc58ba10996517cb
SHA512 dd0568de924a86910d8bf59b2f0c22663268004ef9a5f80ffd78f37885f3b8538d138d1e5c70de8e4fda7aab150df48bd34e3838c976ec90ed4f0e49bed0e9e6
SSDEEP 6144:WbOobwWeCg6QvyuFtPwvGyDBQlEz8a+CFTYK0OnsoIcGm1p:W78We96sI+yDxTYwsoCm1p
TLSH
T1BF745B31A456707AE6F90872F568CB706D3CB21827D8849FC3E0E84E38645D36BB775A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3240_1698320689\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
TLSH
T158C04C668D51DEAB00A747A56B295315E23B4B4B5044800A7AF5429C1A288964171944
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3240_47299305\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3240_706223607\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

BootstrapperApplicationData.xml

Path C:\Windows\TEMP\{C63D8074-9BE6-4DE8-8CE9-49B53E6693BE}\.ba\BootstrapperApplicationData.xml
Size 9KB
SHA256 1633b50661776a39ec9ffdc98ec19e48e0099a08ff5168cc3376137a904ee6e3
MD5 1b7efeed50be6f8ee212995070717d65
SHA1 22c3bc34718c78531cc3b56c312a54a89aebff9e
SHA512 9456bee88d409491723b8aa09ef6348b31119b5ee1ef3ba92a9d5fe7034353852c4e0f97031ae4f99e6ecaa49df5ebf611de83ad99a0c1f885318ea9920de5f3
SSDEEP 96:2BqRBM/En6YcYY0wZycirLdin6sUsD20wFycDdin6UkEc0wNycdOZdin6fMS2g05:2I1zfTK/lvjnlX0OOamagM5cYsCsysz
TLSH
T1BE12E3113BFD0218F0F3AE48EFF6A5555A36BD552E39C82D01601D0E49B2E819962FB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetLogo_256x.png

Path C:\Windows\TEMP\{C63D8074-9BE6-4DE8-8CE9-49B53E6693BE}\.ba\DotNetLogo_256x.png
Size 2KB
SHA256 0f571f95d8eab48dbc81b0ec5e9f7225e349e26ef50868bfaab556f3c2443b01
MD5 39aa52615723b782c92dec710caaec7f
SHA1 760b49e256a7979fe50a56a2b1be3688a474b886
SHA512 89d1baa3820154667747b25e9e2fd321bfb2ec71dc309915b0a28dacdc80822a4943b639ebb37c37bd2559d5a4306d2096119cd970c84a0d331f6c68b0456dc9
TLSH
T1534195CF1BFD78D7E6E557918E1A8DD232738483B4B3A42CCE7B10B8274A5642B87940
MD5 SHA1 SHA512 TLSH

Submit Download

dotnet.ico

Path C:\Windows\TEMP\{C63D8074-9BE6-4DE8-8CE9-49B53E6693BE}\.ba\dotnet.ico
Size 44KB
SHA256 61a2cbd12868cb9b359e0c78961d409b7875f072eb8e53ea88d3e6bfe2961a18
MD5 b8096652d9ec286709a2c863b244b110
SHA1 b3b7f0f4d608fad7cb59ba499d4d17c2b873a7af
SHA512 492a5aa83220bb77c178b7c5b50bf44968c0427e9e45bb97a33df14d7fb4c667ca7adde0ebb3874c7b6011057b01144e4e6651fbad62c6bcf5e0b93586c4bc7a
SSDEEP 96:r+gfbzo+wHK9NbwOY4tIWQeVlV1W9+H+guapUjFamINUItzf1dBNaIZ:ro5HuNcH4tIzeVlV1WEOFDgUWzf1PIm
TLSH
T1E913EF6DE68547C1C10C2032DB4AC792B5233C72E4DAE0C4F9D4FA7E177906965C6E6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\TEMP\{C63D8074-9BE6-4DE8-8CE9-49B53E6693BE}\.ba\thm.wxl
Size 7KB
SHA256 b00edd703dd8a475119d0e4dd70a3aaa47f0e95361af290e76d367a8edef3432
MD5 8b2c667a8bbad3153068c0ed90df7ec4
SHA1 c9e04a3a37e5e6262ab9bfecf78280171b8f7b74
SHA512 5269f00d474acccb4c48cb7bcfdf19e63557a388572d3a6335aa39191319691d924e27f70da3f3495387c319396476c63a8fd7b35835cca0901220e39783847b
SSDEEP 96:HiTgM1+XSNEzA0HtYQstYCpCwZQpCeyk5HQJM9ouvj9urz8:Ew9EmtYQstYCPC9e8
TLSH
T191E1026F68DFDEE03A732651B2B3698D6919C29A136F1CF0F869084B47635016377A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.xml

Path C:\Windows\TEMP\{C63D8074-9BE6-4DE8-8CE9-49B53E6693BE}\.ba\thm.xml
Size 11KB
SHA256 dfee8e2d075087227f19c835c145c5bb8e72a46880ea24080bb2472fd3a521be
MD5 4329e418dc56b1386d7ea29a0dcfab5b
SHA1 58387f92e89ca21b4179fb697c7de9675c59142f
SHA512 6934873d27e6efbb94da4f13ee8369b29995490051016fdf82800256b924902306d328bf1d4ebbf266d1a53eb24adb6478d1a67de4ecc3e3bcbe561968f24922
SSDEEP 96:HgvPkoeWEH3IWTaQfSJgHzth5mFahbuB8pR5+Vpwe+UIJLg1gEp+6F5pQnxc:AvoWydmQfVHMyyj5Z
TLSH
T14B42FC6851DC7811C532D702AB9371D3FF12BDA6C6C85A58B48E256B1FF262028B739C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixstdba.exe

Path C:\Windows\Temp\{C63D8074-9BE6-4DE8-8CE9-49B53E6693BE}\.ba\wixstdba.exe
Size 431KB
SHA256 2b1cee5e3e24593247854eb7a7c4308937b9c607754ed2fb83520a8706c26f1e
MD5 0e88ffd2e737ac9b9a4241616838bc23
SHA1 3c8beb465d20bcef0cd6ceca9c60286d1d15cebd
SHA512 169b9e08518834c9bc5adfe4ab7b79e07685b72f30ede1c1a386229668bde8c15da378e1274e4013ad7b84d6f7a5acc64ef0806e3b8a66322861efaa7e26b620
SSDEEP 6144:X9vfS1NP+c3ytxmg4Stlqe3B9m2LSLTwGw7C3ZLaov5xZvSdF:X9v+GIyugllqe3wwGfX5/SdF
TLSH
T129943B3165F04037C6F90572AE14FA31BF69F208231095EBA3C0DD293968AE5BBB7657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windowsdesktop-runtime-10.0.7-win-x86.exe

Path C:\Windows\Temp\{C63D8074-9BE6-4DE8-8CE9-49B53E6693BE}\.be\windowsdesktop-runtime-10.0.7-win-x86.exe
Size 967KB
SHA256 d7159bd11bc004ee485fb6fd031b71d38e4303721d0665acfefaee1fb97588fe
MD5 54b260b4c45fc5f0438080d937e0e2c8
SHA1 c7838ea3732e2619ba05fa3a9901384eeebf5fc8
SHA512 9a063312880700e71b4a1fe12365918900c033ab04c720ba880b4bc247c635ebacdf36672051948e5a07aa5e4773a2ec92a5e321a303175abd6930387a915544
SSDEEP 12288:XVGWl6qCmyZeU6lqlDjC+fScn6X8GwMgJEQaA6fTQfulZYDGSGPjR0ASh:XVGWl6qCmyt6UdmcpMzfz0xOjK
TLSH
T13D257D31A166242BD6F50973F914D2307E2CD7082B5C95BAC6C0D90D39689FA6FFB24B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1332-1374-0x0000000000A90000-0x0000000000B56000-memory.dmp

Download

memory/2520-146-0x000002036C430000-0x000002036C439000-memory.dmp

Download

memory/4768-1505-0x00007FF7E8050000-0x00007FF7ED4BD000-memory.dmp

Download

memory/4768-1507-0x00007FF7E8050000-0x00007FF7ED4BD000-memory.dmp

Download

memory/4768-1506-0x00007FF7E8050000-0x00007FF7ED4BD000-memory.dmp

Download

memory/4768-1503-0x00007FF7E8050000-0x00007FF7ED4BD000-memory.dmp

Download

memory/4768-1524-0x00007FF7E8050000-0x00007FF7ED4BD000-memory.dmp

Download

memory/4768-1526-0x00000175DA770000-0x00000175DA813000-memory.dmp

Download

memory/4768-1504-0x00007FF7E8050000-0x00007FF7ED4BD000-memory.dmp

Download

memory/4768-1500-0x00007FF7E8050000-0x00007FF7ED4BD000-memory.dmp

Download

memory/4768-1626-0x00000175DA770000-0x00000175DA813000-memory.dmp

Download

memory/4916-1174-0x000001CAC4D50000-0x000001CAC4D59000-memory.dmp

Download

memory/4916-1173-0x000001CAC4D30000-0x000001CAC4D3C000-memory.dmp

Download