xbinder | 1857ca432a680b69e247e61cb4c95b8b7827ea3d32cbe716251ab9f2b6b6d766

Analysis

user interaction
yes
max time kernel
150s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/05/2026, 15:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
XBinderOutput2.exe
Size 12.1MB
Sample260503-syaj3act7x
SHA256 1857ca432a680b69e247e61cb4c95b8b7827ea3d32cbe716251ab9f2b6b6d766
MD5 43949f2de3c160b7135a11d4d292b8b3
SHA1 d1346c0bca958e3c225a7653f09cee36d840285a
SHA512 9c7e7c594f8936935de152a7c334b9f19a4fae0d521a23d2e523171bc5b9522c30897109c4e1dd8dfb61cb722031ed0ce60da7a1c088d6e5856b06fee8ce43bc
SSDEEP 196608:GW4NDHH+SJcOpbN5oKesKFewST06Ov5qMoHp9ZHBgdMMwHdzS5sUUTLxD:nsDnFpbHieTo5tolhgdMMwHM5srR
TLSH
T137D633F46AC93974F2EB4B3D73624FE9C9A62725342E02B8E0E4435D8BD7A8D45DC850
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution xbinder xworm loader persistence rat trojan

Malware Config

Extracted

Family

xbinder

Mutex

oBySjGJkKWMXO6yKN

Attributes

primary_drop_directory
%Temp%
primary_execute
true
primary_hidden_file
false
primary_resource_name
velocityy.exe
secondary_drop_directory
%Temp%
secondary_execute
true
secondary_hidden_file
false
secondary_resource_name
Velocity.exe

Extracted

Family

xworm

Version

aferistin-41691.portmap.host:41691

Attributes

Install_directory
%AppData%
install_file
USB.exe

Signatures

Family: XBinder
XBinder is a crypter and loader delivering a wide variety of malware, written in C#.
loader xbinder
Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral2/files/0x001e00000002b1ca-12.dat	family_xworm
behavioral2/memory/980-13-0x0000000000430000-0x0000000000444000-memory.dmp	family_xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3936	powershell.exe
3948	powershell.exe
5060	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
88	4108	msedge.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\velocityy.lnk	velocityy.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\velocityy.lnk	velocityy.exe

Executes dropped EXE 9 IoCs

pid	Process
980	velocityy.exe
2416	Velocity.exe
2476	windowsdesktop-runtime-10.0.7-win-x86.exe
584	wixstdba.exe
4596	windowsdesktop-runtime-10.0.7-win-x86.exe
1464	windowsdesktop-runtime-10.0.7-win-x86.exe
324	windowsdesktop-runtime-10.0.7-win-x86.exe
3176	wixstdba.exe
1332	windowsdesktop-runtime-10.0.7-win-x86.exe

Loads dropped DLL 5 IoCs

pid	Process
3532	MsiExec.exe
2268	MsiExec.exe
2788	MsiExec.exe
5032	MsiExec.exe
2672	MsiExec.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Windows\CurrentVersion\Run\velocityy = "C:\\Users\\Admin\\AppData\\Roaming\\velocityy.exe"	velocityy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{580865E1-2073-4861-8356-3D20DFF3D50E} = "\"C:\\ProgramData\\Package Cache\\{580865E1-2073-4861-8356-3D20DFF3D50E}\\windowsdesktop-runtime-10.0.7-win-x86.exe\" /burn.runonce"	windowsdesktop-runtime-10.0.7-win-x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{580865E1-2073-4861-8356-3D20DFF3D50E} = "\"C:\\ProgramData\\Package Cache\\{580865E1-2073-4861-8356-3D20DFF3D50E}\\windowsdesktop-runtime-10.0.7-win-x86.exe\" /burn.runonce"	windowsdesktop-runtime-10.0.7-win-x86.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.IO.Pipes.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Linq.AsyncEnumerable.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Threading.Channels.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\fr\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\it\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\zh-Hant\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Reflection.Emit.Lightweight.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Security.Cryptography.Primitives.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\clrjit.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\ja\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\ja\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\pt-BR\UIAutomationTypes.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.ComponentModel.Annotations.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Windows.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\msquic.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.IO.FileSystem.Watcher.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Runtime.CompilerServices.Unsafe.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\de\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\ko\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\pt-BR\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Diagnostics.Contracts.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\PenImc_cor3.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\fr\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\it\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.ComponentModel.DataAnnotations.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Linq.Parallel.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Collections.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.ComponentModel.EventBasedAsync.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Net.Sockets.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Security.Cryptography.Algorithms.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\cs\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\it\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\pl\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\coreclr.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\PresentationFramework-SystemData.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\fr\UIAutomationTypes.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\tr\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\Microsoft.Win32.Primitives.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Runtime.InteropServices.JavaScript.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Xml.XPath.XDocument.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Dynamic.Runtime.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Threading.Tasks.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\ru\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.ComponentModel.TypeConverter.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Text.Encoding.CodePages.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\System.Security.Cryptography.ProtectedData.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\cs\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\ko\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\ru\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\System.Configuration.ConfigurationManager.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.IO.Compression.Native.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Security.AccessControl.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\PresentationFramework.Luna.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\es\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\fr\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\Microsoft.NETCore.App.runtimeconfig.json	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Threading.Overlapped.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Private.Xml.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Reflection.Metadata.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Security.Claims.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\PresentationFramework.Fluent.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\cs\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Diagnostics.Debug.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Drawing.Primitives.dll	msiexec.exe

Drops file in Windows directory 52 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\~DFC0B148C2B8317F22.TMP	msiexec.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\Installer\e591340.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e591340.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFE8914DCBB293C571.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI168F.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFCE7F5650862C423B.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e59134a.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{2A17EBA5-4EEE-4A8A-9CEE-E8B67938B606}	msiexec.exe
File created	C:\Windows\SystemTemp\~DF8D361622BA624BE0.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{6F122B2D-6824-4922-A23E-A9151114EE7A}	msiexec.exe
File created	C:\Windows\SystemTemp\~DFCC9A5BEC75825213.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFDBFC5CD4FD94A6B1.TMP	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFFD5FE1C56AB9CDD9.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1A49.tmp	msiexec.exe
File created	C:\Windows\Installer\e59134e.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF5B038BE8BBA9FC05.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI24DA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI31EB.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFAF1D7AF643690B16.TMP	msiexec.exe
File created	C:\Windows\Installer\e59134a.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{EF889568-39DF-4FBB-83A6-893DF0A5A7D7}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI14C7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e591345.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFA97B9E8F30D54B1D.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF344A4B8FF1F5545A.TMP	msiexec.exe
File created	C:\Windows\Installer\e591353.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF0D96DC29D8908601.TMP	msiexec.exe
File created	C:\Windows\Installer\e59134f.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF3F1036DBE608F9B4.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1716_132118818\manifest.json	msedge.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\e591344.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF72A2A97C277F24C4.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{09AE2CD2-101D-45E8-8922-51ABAA31F8CC}	msiexec.exe
File created	C:\Windows\SystemTemp\~DF3586CC70FA70DFE8.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3B33.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1716_132118818\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1716_688061268\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\~DF71B0D82AFA5A4DBE.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF60CED3802346B64B.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI21FA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e59134f.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3B53.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF529B18B96962D241.TMP	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1459.tmp	msiexec.exe
File created	C:\Windows\Installer\e591345.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFE19FB2D1D3F11405.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1630.tmp	msiexec.exe
File created	C:\Windows\Installer\e591349.msi	msiexec.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.7-win-x86.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wixstdba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.7-win-x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.7-win-x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wixstdba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.7-win-x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.7-win-x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.7-win-x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Velocity.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1716	msedge.exe
4108	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 13 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134222959140865297"	msedge.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2B	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\windowsdesktop_runtime_80.28.51996_x86	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{0f62ff89-5cc3-5dfe-ec82-db9d826b6527}\Dependents\{580865E1-2073-4861-8356-3D20DFF3D50E}	windowsdesktop-runtime-10.0.7-win-x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\865988FEFD93BBF4386A98D30F5A7A7D\Provider	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\865988FEFD93BBF4386A98D30F5A7A7D\MainFeature	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\865988FEFD93BBF4386A98D30F5A7A7D\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2DC2EA90D1018E54982215BAAA138FCC\Provider	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2DC2EA90D1018E54982215BAAA138FCC\MainFeature	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2DC2EA90D1018E54982215BAAA138FCC\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2DC2EA90D1018E54982215BAAA138FCC\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{09AE2CD2-101D-45E8-8922-51ABAA31F8CC}v80.28.51996\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5ABE71A2EEE4A8A4C9EE8E6B97836B60\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{2A17EBA5-4EEE-4A8A-9CEE-E8B67938B606}v80.28.51996\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D2B221F6428622942AE39A511141EEA7\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{0f62ff89-5cc3-5dfe-ec82-db9d826b6527}\DisplayName = "Microsoft Windows Desktop Runtime 10.0.7 (x86)"	windowsdesktop-runtime-10.0.7-win-x86.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x86	windowsdesktop-runtime-10.0.7-win-x86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.28.51996_x86\Dependents\{580865E1-2073-4861-8356-3D20DFF3D50E}	windowsdesktop-runtime-10.0.7-win-x86.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5ABE71A2EEE4A8A4C9EE8E6B97836B60\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_80.28.51996_x86\Dependents\{580865E1-2073-4861-8356-3D20DFF3D50E}	windowsdesktop-runtime-10.0.7-win-x86.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2DC2EA90D1018E54982215BAAA138FCC\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5ABE71A2EEE4A8A4C9EE8E6B97836B60\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5ABE71A2EEE4A8A4C9EE8E6B97836B60\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5ABE71A2EEE4A8A4C9EE8E6B97836B60\SourceList\Media	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\7C5F02C108B5629409B1C2D8A072F2A4	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\865988FEFD93BBF4386A98D30F5A7A7D\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2DC2EA90D1018E54982215BAAA138FCC\SourceList\Net	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5ABE71A2EEE4A8A4C9EE8E6B97836B60\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D2B221F6428622942AE39A511141EEA7\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D2B221F6428622942AE39A511141EEA7\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{6F122B2D-6824-4922-A23E-A9151114EE7A}v80.28.51996\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\865988FEFD93BBF4386A98D30F5A7A7D	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.28.51996_x86\DisplayName = "Microsoft .NET Host FX Resolver - 10.0.7 (x86)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2DC2EA90D1018E54982215BAAA138FCC\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\0D507D71850510965704F554DD712F7E\5ABE71A2EEE4A8A4C9EE8E6B97836B60	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5ABE71A2EEE4A8A4C9EE8E6B97836B60\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{2A17EBA5-4EEE-4A8A-9CEE-E8B67938B606}v80.28.51996\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.28.51996_x86\ = "{09AE2CD2-101D-45E8-8922-51ABAA31F8CC}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2DC2EA90D1018E54982215BAAA138FCC	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5ABE71A2EEE4A8A4C9EE8E6B97836B60\MainFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_80.28.51996_x86\Version = "80.28.51996"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D2B221F6428622942AE39A511141EEA7\SourceList\Net	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D2B221F6428622942AE39A511141EEA7\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\865988FEFD93BBF4386A98D30F5A7A7D\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.28.51996_x86	windowsdesktop-runtime-10.0.7-win-x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5ABE71A2EEE4A8A4C9EE8E6B97836B60\ProductName = "Microsoft .NET Runtime - 10.0.7 (x86)"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_80.28.51996_x86\Dependents\{580865E1-2073-4861-8356-3D20DFF3D50E}	windowsdesktop-runtime-10.0.7-win-x86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_80.28.51996_x86\Dependents	windowsdesktop-runtime-10.0.7-win-x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{0f62ff89-5cc3-5dfe-ec82-db9d826b6527}\ = "{580865E1-2073-4861-8356-3D20DFF3D50E}"	windowsdesktop-runtime-10.0.7-win-x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x86\DisplayName = "Microsoft .NET Host - 10.0.7 (x86)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\865988FEFD93BBF4386A98D30F5A7A7D\PackageCode = "145EF10EFC3685A4188A83437E504485"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x86\Dependents	windowsdesktop-runtime-10.0.7-win-x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_80.28.51996_x86\ = "{2A17EBA5-4EEE-4A8A-9CEE-E8B67938B606}"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5ABE71A2EEE4A8A4C9EE8E6B97836B60\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1383858298-2057492509-1726743289-1000\{A1EF0AD6-973B-47D6-B0B0-9503B274246B}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\B9FD6305CAA5D224A5486ED10DAF7290	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_80.28.51996_x86\DisplayName = "Microsoft .NET Runtime - 10.0.7 (x86)"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x86\Dependents\{580865E1-2073-4861-8356-3D20DFF3D50E}	windowsdesktop-runtime-10.0.7-win-x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{0f62ff89-5cc3-5dfe-ec82-db9d826b6527}\DisplayName = "Microsoft Windows Desktop Runtime 10.0.7 (x86)"	windowsdesktop-runtime-10.0.7-win-x86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\0D507D71850510965704F554DD712F7E	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_80.28.51996_x86\Dependents\{580865E1-2073-4861-8356-3D20DFF3D50E}	windowsdesktop-runtime-10.0.7-win-x86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\865988FEFD93BBF4386A98D30F5A7A7D\SourceList	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2DC2EA90D1018E54982215BAAA138FCC\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5ABE71A2EEE4A8A4C9EE8E6B97836B60\SourceList\PackageName = "dotnet-runtime-10.0.7-win-x86.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D2B221F6428622942AE39A511141EEA7\ProductName = "Microsoft Windows Desktop Runtime - 10.0.7 (x86)"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D2B221F6428622942AE39A511141EEA7\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D2B221F6428622942AE39A511141EEA7\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\865988FEFD93BBF4386A98D30F5A7A7D\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\865988FEFD93BBF4386A98D30F5A7A7D\SourceList\PackageName = "dotnet-host-10.0.7-win-x86.msi"	msiexec.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.7-win-x86.exe:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
3936	powershell.exe
3936	powershell.exe
3948	powershell.exe
3948	powershell.exe
5060	powershell.exe
5060	powershell.exe
980	velocityy.exe
1864	msiexec.exe
1864	msiexec.exe
1864	msiexec.exe
1864	msiexec.exe
1864	msiexec.exe
1864	msiexec.exe
1864	msiexec.exe
1864	msiexec.exe
1864	msiexec.exe
1864	msiexec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1716	msedge.exe
1716	msedge.exe
1716	msedge.exe
1716	msedge.exe
1716	msedge.exe
1716	msedge.exe
1716	msedge.exe
1716	msedge.exe
1716	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	980	velocityy.exe
Token: SeDebugPrivilege	3936	powershell.exe
Token: SeDebugPrivilege	3948	powershell.exe
Token: SeDebugPrivilege	5060	powershell.exe
Token: SeDebugPrivilege	980	velocityy.exe
Token: SeShutdownPrivilege	4596	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeIncreaseQuotaPrivilege	4596	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeSecurityPrivilege	1864	msiexec.exe
Token: SeCreateTokenPrivilege	4596	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeAssignPrimaryTokenPrivilege	4596	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeLockMemoryPrivilege	4596	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeIncreaseQuotaPrivilege	4596	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeMachineAccountPrivilege	4596	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeTcbPrivilege	4596	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeSecurityPrivilege	4596	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeTakeOwnershipPrivilege	4596	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeLoadDriverPrivilege	4596	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeSystemProfilePrivilege	4596	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeSystemtimePrivilege	4596	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeProfSingleProcessPrivilege	4596	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeIncBasePriorityPrivilege	4596	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeCreatePagefilePrivilege	4596	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeCreatePermanentPrivilege	4596	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeBackupPrivilege	4596	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeRestorePrivilege	4596	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeShutdownPrivilege	4596	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeDebugPrivilege	4596	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeAuditPrivilege	4596	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeSystemEnvironmentPrivilege	4596	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeChangeNotifyPrivilege	4596	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeRemoteShutdownPrivilege	4596	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeUndockPrivilege	4596	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeSyncAgentPrivilege	4596	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeEnableDelegationPrivilege	4596	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeManageVolumePrivilege	4596	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeImpersonatePrivilege	4596	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeCreateGlobalPrivilege	4596	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeRestorePrivilege	1864	msiexec.exe
Token: SeTakeOwnershipPrivilege	1864	msiexec.exe
Token: SeRestorePrivilege	1864	msiexec.exe
Token: SeTakeOwnershipPrivilege	1864	msiexec.exe
Token: SeRestorePrivilege	1864	msiexec.exe
Token: SeTakeOwnershipPrivilege	1864	msiexec.exe
Token: SeRestorePrivilege	1864	msiexec.exe
Token: SeTakeOwnershipPrivilege	1864	msiexec.exe
Token: SeRestorePrivilege	1864	msiexec.exe
Token: SeTakeOwnershipPrivilege	1864	msiexec.exe
Token: SeRestorePrivilege	1864	msiexec.exe
Token: SeTakeOwnershipPrivilege	1864	msiexec.exe
Token: SeRestorePrivilege	1864	msiexec.exe
Token: SeTakeOwnershipPrivilege	1864	msiexec.exe
Token: SeRestorePrivilege	1864	msiexec.exe
Token: SeTakeOwnershipPrivilege	1864	msiexec.exe
Token: SeRestorePrivilege	1864	msiexec.exe
Token: SeTakeOwnershipPrivilege	1864	msiexec.exe
Token: SeRestorePrivilege	1864	msiexec.exe
Token: SeTakeOwnershipPrivilege	1864	msiexec.exe
Token: SeRestorePrivilege	1864	msiexec.exe
Token: SeTakeOwnershipPrivilege	1864	msiexec.exe
Token: SeRestorePrivilege	1864	msiexec.exe
Token: SeTakeOwnershipPrivilege	1864	msiexec.exe
Token: SeRestorePrivilege	1864	msiexec.exe
Token: SeTakeOwnershipPrivilege	1864	msiexec.exe
Token: SeRestorePrivilege	1864	msiexec.exe

Suspicious use of FindShellTrayWindow 15 IoCs

pid	Process
1716	msedge.exe
1716	msedge.exe
1716	msedge.exe
1716	msedge.exe
1716	msedge.exe
1716	msedge.exe
1716	msedge.exe
1716	msedge.exe
1716	msedge.exe
1716	msedge.exe
1716	msedge.exe
1716	msedge.exe
584	wixstdba.exe
3176	wixstdba.exe
1716	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
980	velocityy.exe
4480	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4884 wrote to memory of 980	4884	XBinderOutput2.exe	80
PID 4884 wrote to memory of 2416	4884	XBinderOutput2.exe	81
PID 980 wrote to memory of 3936	980	velocityy.exe	82
PID 980 wrote to memory of 3948	980	velocityy.exe	84
PID 980 wrote to memory of 5060	980	velocityy.exe	86
PID 2416 wrote to memory of 1716	2416	Velocity.exe	89
PID 1716 wrote to memory of 4352	1716	msedge.exe	90
PID 1716 wrote to memory of 4108	1716	msedge.exe	91
PID 1716 wrote to memory of 4744	1716	msedge.exe	92
PID 1716 wrote to memory of 4744	1716	msedge.exe	92
PID 1716 wrote to memory of 4744	1716	msedge.exe	92
PID 1716 wrote to memory of 1472	1716	msedge.exe	93
PID 1716 wrote to memory of 1472	1716	msedge.exe	93
PID 1716 wrote to memory of 4912	1716	msedge.exe	95
PID 1716 wrote to memory of 4912	1716	msedge.exe	95
PID 1716 wrote to memory of 4912	1716	msedge.exe	95
PID 1716 wrote to memory of 5064	1716	msedge.exe	96
PID 1716 wrote to memory of 5064	1716	msedge.exe	96
PID 1716 wrote to memory of 5064	1716	msedge.exe	96
PID 1716 wrote to memory of 2068	1716	msedge.exe	98
PID 1716 wrote to memory of 408	1716	msedge.exe	99
PID 1716 wrote to memory of 2068	1716	msedge.exe	98
PID 1716 wrote to memory of 2068	1716	msedge.exe	98
PID 1716 wrote to memory of 408	1716	msedge.exe	99
PID 1716 wrote to memory of 408	1716	msedge.exe	99
PID 1716 wrote to memory of 3076	1716	msedge.exe	100
PID 1716 wrote to memory of 3076	1716	msedge.exe	100
PID 1716 wrote to memory of 3076	1716	msedge.exe	100
PID 1716 wrote to memory of 2752	1716	msedge.exe	101
PID 1716 wrote to memory of 2752	1716	msedge.exe	101
PID 1716 wrote to memory of 2752	1716	msedge.exe	101
PID 1716 wrote to memory of 1084	1716	msedge.exe	102
PID 1716 wrote to memory of 1084	1716	msedge.exe	102
PID 1716 wrote to memory of 4316	1716	msedge.exe	104
PID 1716 wrote to memory of 4316	1716	msedge.exe	104
PID 1716 wrote to memory of 3376	1716	msedge.exe	105
PID 1716 wrote to memory of 3376	1716	msedge.exe	105
PID 1716 wrote to memory of 3376	1716	msedge.exe	105
PID 1716 wrote to memory of 1640	1716	msedge.exe	106
PID 1716 wrote to memory of 132	1716	msedge.exe	107
PID 1716 wrote to memory of 1640	1716	msedge.exe	106
PID 1716 wrote to memory of 132	1716	msedge.exe	107
PID 1716 wrote to memory of 2836	1716	msedge.exe	109
PID 1716 wrote to memory of 1676	1716	msedge.exe	110
PID 1676 wrote to memory of 3048	1676	msedge.exe	111
PID 1716 wrote to memory of 3852	1716	msedge.exe	112
PID 1716 wrote to memory of 3852	1716	msedge.exe	112
PID 1716 wrote to memory of 4596	1716	msedge.exe	113
PID 1716 wrote to memory of 4596	1716	msedge.exe	113
PID 1716 wrote to memory of 5060	1716	msedge.exe	115
PID 1716 wrote to memory of 5060	1716	msedge.exe	115
PID 1716 wrote to memory of 5060	1716	msedge.exe	115
PID 1716 wrote to memory of 4604	1716	msedge.exe	114
PID 1716 wrote to memory of 4604	1716	msedge.exe	114
PID 1716 wrote to memory of 5004	1716	msedge.exe	116
PID 1716 wrote to memory of 992	1716	msedge.exe	117
PID 1716 wrote to memory of 992	1716	msedge.exe	117
PID 1716 wrote to memory of 3024	1716	msedge.exe	118
PID 1716 wrote to memory of 3024	1716	msedge.exe	118
PID 1716 wrote to memory of 3760	1716	msedge.exe	119
PID 1716 wrote to memory of 3760	1716	msedge.exe	119
PID 1716 wrote to memory of 324	1716	msedge.exe	120
PID 1716 wrote to memory of 584	1716	msedge.exe	121
PID 1716 wrote to memory of 4256	1716	msedge.exe	122

C:\Users\Admin\AppData\Local\Temp\XBinderOutput2.exe
"C:\Users\Admin\AppData\Local\Temp\XBinderOutput2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4884
- C:\Users\Admin\AppData\Local\Temp\velocityy.exe
  "C:\Users\Admin\AppData\Local\Temp\velocityy.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:980
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\velocityy.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3936
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'velocityy.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3948
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\velocityy.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5060
- C:\Users\Admin\AppData\Local\Temp\Velocity.exe
  "C:\Users\Admin\AppData\Local\Temp\Velocity.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=x86&rid=win-x86&os=win10&apphost_version=10.0.0&gui=true
    3⤵
    - Drops file in Windows directory
    - System Time Discovery
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x2f0,0x7ffaa48cc188,0x7ffaa48cc194,0x7ffaa48cc1a0
      4⤵
      PID:4352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1784,i,6681941759009478673,14167671641879540249,524288 --field-trial-handle=2236,i,6578003351434034899,14139139710903019898,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:11
      4⤵
      Downloads MZ/PE file
      System Time Discovery
      PID:4108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,15589592144808251744,9661201513312739376,262144 --field-trial-handle=2236,i,6578003351434034899,14139139710903019898,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:2
      4⤵
      PID:4744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2552,i,11866667852551424457,7948114175361553056,524288 --field-trial-handle=2236,i,6578003351434034899,14139139710903019898,262144 --variations-seed-version --mojo-platform-channel-handle=2576 /prefetch:13
      4⤵
      PID:1472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,6012375633074344775,17211990698917371150,2097152 --field-trial-handle=2236,i,6578003351434034899,14139139710903019898,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
      4⤵
      PID:4912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,2228553548135039395,13933714514510917439,2097152 --field-trial-handle=2236,i,6578003351434034899,14139139710903019898,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
      4⤵
      PID:5064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4100,i,13988811255153221077,18445609870385114008,2097152 --field-trial-handle=2236,i,6578003351434034899,14139139710903019898,262144 --variations-seed-version --mojo-platform-channel-handle=4152 /prefetch:1
      4⤵
      PID:2068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4184,i,15749181578954572943,15916248858996164751,2097152 --field-trial-handle=2236,i,6578003351434034899,14139139710903019898,262144 --variations-seed-version --mojo-platform-channel-handle=4156 /prefetch:9
      4⤵
      PID:408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4236,i,2922927218072973340,4712006559186932068,2097152 --field-trial-handle=2236,i,6578003351434034899,14139139710903019898,262144 --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:1
      4⤵
      PID:3076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4436,i,6442124322399095902,13119572345794362246,2097152 --field-trial-handle=2236,i,6578003351434034899,14139139710903019898,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:9
      4⤵
      PID:2752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3540,i,17226114006628860014,18236122844058587016,524288 --field-trial-handle=2236,i,6578003351434034899,14139139710903019898,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:14
      4⤵
      PID:1084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4140,i,1558970275044829490,14145869458503054340,524288 --field-trial-handle=2236,i,6578003351434034899,14139139710903019898,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:14
      4⤵
      PID:4316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4292,i,11798397846582398181,12517342884810961417,2097152 --field-trial-handle=2236,i,6578003351434034899,14139139710903019898,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:1
      4⤵
      PID:3376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5332,i,9268489441530086765,6036215822713592626,524288 --field-trial-handle=2236,i,6578003351434034899,14139139710903019898,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:14
      4⤵
      PID:1640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5356,i,14898487558327034136,5141359920764431635,524288 --field-trial-handle=2236,i,6578003351434034899,14139139710903019898,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:14
      4⤵
      PID:132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6244,i,9915235989639389928,594475329324968139,524288 --field-trial-handle=2236,i,6578003351434034899,14139139710903019898,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:14
      4⤵
      PID:3096
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6244,i,9915235989639389928,594475329324968139,524288 --field-trial-handle=2236,i,6578003351434034899,14139139710903019898,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:14
      4⤵
      PID:2836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6356,i,14986585523979541289,10169204662690628364,524288 --field-trial-handle=2236,i,6578003351434034899,14139139710903019898,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:14
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1676
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1140
        5⤵
        
        PID:3048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4436,i,10141285501201390257,5797710906438265798,524288 --field-trial-handle=2236,i,6578003351434034899,14139139710903019898,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:14
      4⤵
      PID:3852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3820,i,5884952036988539916,9275257031219613309,524288 --field-trial-handle=2236,i,6578003351434034899,14139139710903019898,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:14
      4⤵
      PID:4596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4216,i,13316957015541771269,6951634097580451751,524288 --field-trial-handle=2236,i,6578003351434034899,14139139710903019898,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:14
      4⤵
      PID:4604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=3936,i,17004557362248187504,17301361131850850147,2097152 --field-trial-handle=2236,i,6578003351434034899,14139139710903019898,262144 --variations-seed-version --mojo-platform-channel-handle=3988 /prefetch:1
      4⤵
      PID:5060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6880,i,8515898816537742540,4463785544589697323,524288 --field-trial-handle=2236,i,6578003351434034899,14139139710903019898,262144 --variations-seed-version --mojo-platform-channel-handle=6720 /prefetch:14
      4⤵
      Subvert Trust Controls: Mark-of-the-Web Bypass
      NTFS ADS
      PID:5004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6744,i,12672010711126061487,16732444631001742004,524288 --field-trial-handle=2236,i,6578003351434034899,14139139710903019898,262144 --variations-seed-version --mojo-platform-channel-handle=6680 /prefetch:14
      4⤵
      PID:992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4380,i,7078196763559966548,7175245682332182539,524288 --field-trial-handle=2236,i,6578003351434034899,14139139710903019898,262144 --variations-seed-version --mojo-platform-channel-handle=7084 /prefetch:14
      4⤵
      PID:3024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6720,i,17004774465855000425,4413676829633021664,524288 --field-trial-handle=2236,i,6578003351434034899,14139139710903019898,262144 --variations-seed-version --mojo-platform-channel-handle=7228 /prefetch:14
      4⤵
      PID:3760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6920,i,17667735268417484971,423589397531098085,524288 --field-trial-handle=2236,i,6578003351434034899,14139139710903019898,262144 --variations-seed-version --mojo-platform-channel-handle=6912 /prefetch:14
      4⤵
      PID:324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6244,i,4210957436028227162,14387653203851586553,524288 --field-trial-handle=2236,i,6578003351434034899,14139139710903019898,262144 --variations-seed-version --mojo-platform-channel-handle=6916 /prefetch:14
      4⤵
      PID:584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6856,i,13292030232042344770,17270263213615225885,524288 --field-trial-handle=2236,i,6578003351434034899,14139139710903019898,262144 --variations-seed-version --mojo-platform-channel-handle=6880 /prefetch:14
      4⤵
      PID:4256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5768,i,7064078629655813193,7532388907951532543,524288 --field-trial-handle=2236,i,6578003351434034899,14139139710903019898,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:14
      4⤵
      PID:2632
  - - C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.7-win-x86.exe
      "C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.7-win-x86.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2476
    - - C:\Windows\TEMP\{6E0E185D-8E16-481C-A51C-172C01AF86AE}\.ba\wixstdba.exe
        
        "C:\Windows\TEMP\{6E0E185D-8E16-481C-A51C-172C01AF86AE}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{E29B72B2-B586-49AB-A7A3-4D2B2E4D406A} {B7DFD8F0-E591-4588-8285-CD735525746C}
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        
        PID:584
    - - C:\Windows\TEMP\{6E0E185D-8E16-481C-A51C-172C01AF86AE}\.be\windowsdesktop-runtime-10.0.7-win-x86.exe
        
        "C:\Windows\TEMP\{6E0E185D-8E16-481C-A51C-172C01AF86AE}\.be\windowsdesktop-runtime-10.0.7-win-x86.exe" -q -burn.elevated BurnPipe.{CC806A47-9A3B-4BBE-A44F-B0A35629BAB5} {4BA51C2C-B61E-4A34-B73C-3B5357F69C4B} 2476
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7228,i,17494836672610985726,13300763531904238486,524288 --field-trial-handle=2236,i,6578003351434034899,14139139710903019898,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:14
      4⤵
      PID:2752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7468,i,8999543308839161696,1122359249836615838,524288 --field-trial-handle=2236,i,6578003351434034899,14139139710903019898,262144 --variations-seed-version --mojo-platform-channel-handle=7456 /prefetch:14
      4⤵
      PID:2660

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4072

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1864
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding D367FA662179D2A1A5BEF7FE153809D0
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3532
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding AB54E9B44282810D729D0E140928F3FC
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2268
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 5291F6C9279D8F56292C60EF3BF8BEB8
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2788
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 2C9C4C5FC89617B58967AE172131A2B3
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5032
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding C557B041FB92FB83CD615D1F740A159D
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2672

C:\ProgramData\Package Cache\{580865E1-2073-4861-8356-3D20DFF3D50E}\windowsdesktop-runtime-10.0.7-win-x86.exe
"C:\ProgramData\Package Cache\{580865E1-2073-4861-8356-3D20DFF3D50E}\windowsdesktop-runtime-10.0.7-win-x86.exe" /burn.runonce
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1464
- C:\ProgramData\Package Cache\{580865E1-2073-4861-8356-3D20DFF3D50E}\windowsdesktop-runtime-10.0.7-win-x86.exe
  "C:\ProgramData\Package Cache\{580865E1-2073-4861-8356-3D20DFF3D50E}\windowsdesktop-runtime-10.0.7-win-x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.7_(x86)_20260503163301.log"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:324
- - C:\Windows\TEMP\{1D612988-5E0B-44E7-BB9A-12BFBC160BFD}\.ba\wixstdba.exe
    "C:\Windows\TEMP\{1D612988-5E0B-44E7-BB9A-12BFBC160BFD}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{10D3F948-F611-4BD1-A88B-D51FD35BDFE1} {9E16472C-8BD2-4CE1-8DD3-0EAF38F5B614}
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:3176
- - C:\ProgramData\Package Cache\{580865E1-2073-4861-8356-3D20DFF3D50E}\windowsdesktop-runtime-10.0.7-win-x86.exe
    "C:\ProgramData\Package Cache\{580865E1-2073-4861-8356-3D20DFF3D50E}\windowsdesktop-runtime-10.0.7-win-x86.exe" -q -burn.elevated BurnPipe.{D063D8BA-A6BE-40F4-BC0A-BD386045E766} {CDD57897-4E07-4EC2-A509-2DD18CB799E2} 324
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:1332

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:4480

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e591343.rbs

Path C:\Config.Msi\e591343.rbs
Size 10KB
SHA256 7a76740419c13fd08d8d990141562a71e2c787fedde2f2476be05bdc73a3ee32
MD5 219cb93b0e53164db60a3a59e5c9cd41
SHA1 e0ae8aac64c7df4538b4816cf33b33539f1df826
SHA512 baf1ba8affb572ada74d44b9b2c29d97f9789ce3ab468ea184f6267da4039c1958b86f9f9954615c10fbd299d6d78085299b8283438296700a44ab510d549c4b
SSDEEP 96:WIvJrAQUItNa1n81RdCfxEQUSeD2QPuCsThqJUSeD2QPuC6jlF3MeThqVH5iyE5V:WKVtUhgCivfNIbfN6OEc46kdpb
TLSH
T10A223001B640C2D3E89B0778EB131B153BBBC6EA571083DF01DD95B85F6A7885FA81DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e591348.rbs

Path C:\Config.Msi\e591348.rbs
Size 8KB
SHA256 5fe8ff58c7e0dd4ae83e5587982a9daf3185494f565c8c4a8c779721d10ab5b5
MD5 6b8eff2a7d6978272c8c16334b964735
SHA1 639ea35e4256127a781ca9d7c3ad12880be2e0b8
SHA512 a465b2e50dcdc7cdc55b404a2f76cd897fdd3f29cedd354f6445019b5efd894b28bc41cff0e723ac21e4688b744284209e92fa29dd3de852ee80c751a704d264
SSDEEP 96:WFeI07BxAjrZkzCHYWQUn2eD26sPuCsThq9Un2eD26sPuC6jkzdYeThqRH1iUE5C:WF90LauCXvqNInqN54EKHV9dpH
TLSH
T114120F81310186E2ED9A6B34C3871B24BFEBE3D79611125F25CD52605F8A7C93F642EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59134d.rbs

Path C:\Config.Msi\e59134d.rbs
Size 49KB
SHA256 09ebe63cace9edf9f411f265bd9658150887650bf6ad9e810b7ec521731e805d
MD5 60e88f6d2c525bc76f0376c07637b874
SHA1 c0678db143d82c3095a2476ea78a0c8e5d6623e2
SHA512 ed6547bcc1969313392c5c7f0a16d236ecea3281449a3c8584e0d38ef8b6c241eb24edfab1219acb52a08e3297f72d7e27df1ad9c0a81efce7f9ac3bfa64455f
SSDEEP 384:3V7ONK0DLsrmMwoXlhkOI5RBMgumgKtaz0XHpZtcMq5UGRWBHNfrL/VZih/pwfwX:3pWilnAThuthRpQRfxArH
TLSH
T1C2335320AB05D2E3FB226C7133E1DD08EF1ACD627744DDA914C61665C5A3DAC3EE8857
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e591352.rbs

Path C:\Config.Msi\e591352.rbs
Size 72KB
SHA256 74e04a25e65e1ff6444b511230fd05e4bc7c036458d02e5706b13d658411e686
MD5 3b87425dd3c25bcc98a4b2f991cbc74e
SHA1 425af32eb54f05a99cf3df783b3ad90e52f8e270
SHA512 6694a80c2a1155b61cdafe9740f955fb1b1a2e20d0befbef533b40d44f0fc579876042862a7efcda775fdf404fd20fbc92d02c316988f44a279a90beecce7dea
SSDEEP 768:EONxqMomkns8EnoLou+PTcKsfNTGKJL040iA0qTR0P1wKaq00a/UzZYemq0KYtdy:BNkNCnoLZ+PTlUN7umeGKymciu0KYe
TLSH
T1FA731F464B91E5C5FB325EB176B7EA4CDD035CBBA292493D20C9252ECDB3D882EE44C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e591356.rbs

Path C:\Config.Msi\e591356.rbs
Size 3KB
SHA256 48a7e86cc470b33df7c98df5ffaab8624a35aa750cf550021ceb127488c48a68
MD5 055fef32caf8beff33124cfdadfc8781
SHA1 e360bcb77a692e425d0ddeb1933dd9684f3d5591
SHA512 0d64a8ef46f107b006e7c0c888669878f86ec0a2e1889baacb98459ebedc89d994679d3cd78c0ef028ecfc80068c4c2099fd9b9c7fd6ece92d0747441a8cf975
TLSH
T12E81E003EA40E683ECA32F30DD5707193777DAEA8311434B10CCD1754D4BB8A9ED6689
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE.txt

Path C:\Program Files (x86)\dotnet\LICENSE.txt
Size 9KB
SHA256 7f6839a61ce892b79c6549e2dc5a81fdbd240a0b260f8881216b45b7fda8b45d
MD5 31c5a77b3c57c8c2e82b9541b00bcd5a
SHA1 153d4bc14e3a2c1485006f1752e797ca8684d06d
SHA512 ad33e3c0c3b060ad44c5b1b712c991b2d7042f6a60dc691c014d977c922a7e3a783ba9bade1a34de853c271fde1fb75bc2c47869acd863a40be3a6c6d754c0a6
SSDEEP 192:ydP0KvBLCqikR/EgGJLrlwD+eilNi5Py1SDeoDXDw9lF5OMz6Q:PWBuqikR/EDJLriwlNi5KI1Tw9lF5OjQ
TLSH
T1EC12B57D7284177109D207E16A0AB9D6F62A953C3117AA2438FDC15923AAF2CC37F3E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ThirdPartyNotices.txt

Path C:\Program Files (x86)\dotnet\ThirdPartyNotices.txt
Size 77KB
SHA256 deb4427a295e1ed474b0d81c5a0d972c1b550b9a715cda939cdfa9236b1b418f
MD5 0d8867a25ba926e6e40cd52ab3536b5c
SHA1 89390dc8b8318d0bfef1c6a2fb4783537e28a465
SHA512 317ca335405274f4f91b173651ca2826760acb5ba5cf41aff51adc55c2cda9059fb268333665f13f62fa48119e55a303720a780dd58d28dd9967db4c88407d61
SSDEEP 1536:HA9jHwsGfgg39/zwgAVkguQxrDjugtSEGepkWvrpX7anuqdLSVnfiStPq+3LefrL:HA97w/ogz1AVxuMjHtSFULryLOgrGWm+
TLSH
T17773A45F7E45077319E2C3916569A8C5F22FA02E3B6B2A44346EF248133B42DD6FF858
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files (x86)\dotnet\dotnet.exe
Size 141KB
SHA256 8b6be8b21aae8f21fdfc0e15d350e072bd84e439c4d99e1ee8b6f38a61eabb5a
MD5 f25f2493a974dd8d01fb9410398c094f
SHA1 f6397f4c97ea07a57b846ded5c212b84ce0b25c0
SHA512 81f932c605c96e68e923e37c83eca1e1b24147b5435d3714d298ed1fb6f63ba2663d760d36441921ed80c923b0086a05ee5a27df1f853169c8d29edadcfda4b8
SSDEEP 3072:0078iKA/8gNs0xphwaNq92hxQOA7qVy2nY:0umQphy9z7qlY
TLSH
T1C5E3F725F9958162D15D1970CB29CE91BA3BAC619BE1E0C763C0FDBE0B701C0AAF5B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

state.rsm

Path C:\ProgramData\Package Cache\{580865E1-2073-4861-8356-3D20DFF3D50E}\state.rsm
Size 1KB
SHA256 a19dd723353b655af63146c5a5803f7443ac7d12dcec67794a96fc1fcf337b53
MD5 228f397fe4d0e0507e0efef78c68a831
SHA1 7e8a6eb7ef27f73d251adbc471e4ba5286fc499f
SHA512 353f76efee175efe71d40f09c0a024060c51cb1dd7ca90deda8f4edbd79f2f5d67e3da24517a352140043f43d844b6bd3877e56ed2d24228497127a96b1f50f3
TLSH
T14E2181615BF6192CF3F2AB35A9F96729543BBC125D24C16E0001318A9E72BE1C8B4B33
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 4KB
SHA256 c04cf798dbb6500fd2ff8e91666486f3f026e6b122f67e23d04398c83ec0ae06
MD5 2ba896bccfee03894a3ff0cc2a1f2b3c
SHA1 7ac81065e79ddad017278ff2f528c68a4137f8cf
SHA512 744bb0d91fe59de6980d9defb57a91ef508b4b3e7df70677f32d5a644ddbeeeb8d5f4fade5792573bdd880394accb56cfc38ae09fa0718504edcd3f04cec05d5
SSDEEP 96:iq4uYqGEo9xx+htzYeqKln0q3qCYr7aqCiNLm7RIz+cBPzQh0nRAy6FcxZcosQSm:iq4uYqGEUutzYeqKln0q3qRWq2Iz+wx
TLSH
T11491EE323375E0D5C8263F07192C19C463AF439AEA54AF48B258620EED2714BDF122F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

228869be-a54a-43d9-84c1-829595033e2e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\228869be-a54a-43d9-84c1-829595033e2e.tmp
Size 8KB
SHA256 a55bbcf7a69d4220ae9754f843ef56a6f3bee870ffcff10ff2d5a22ce15efd14
MD5 3fc88cf679288c70090238916ad3c7ab
SHA1 ff6d6f31492b839725484b0d04a8f8440a32e7e4
SHA512 8e87b0012513723e57513b58ed72a60d16bcb5acd1849757d7ca34e24baf7a64498ddd4b4b4ce0bbb18fda78c5da48d794329b8fe1ffa8495474aff9de88a752
SSDEEP 192:BGNr6EajLQmiUyiBmRvAwD7jzoru9UrlSX8SJrjYup+qZVU6:BGNr6EKNmRvAwDL86AlSXLJrjnfU6
TLSH
T18C12E931B478BC6B5DE3B415B08736579EE41137ED856F44D6F85B1C00DB3482B4E92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 346ea60a0ae4d17c01949616e7832cf3b359983afcbb7e8912fe8a59321ed461
MD5 203e8ac15dc2fa01607dca121531cbf9
SHA1 6bb9e33e0eaaee142dcc669c175ec6b9508af90e
SHA512 9cbb9572308545c1a11487db03ac7301a81dad98c83fd39ad60fc0ba640dee016818808cbd7f5e840f2b2084982cd60ac725f84529aac2387baa86bafeb505f8
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7l:fwUQC5VwBIiElEd2K57P7l
TLSH
T1DFB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
Size 3KB
SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
MD5 1de85fec2dfcc28011a7c2aaab95eb5f
SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
TLSH
T1D1611DB79A3048090E3412B86B19B35DF63E029F1AD598EB76BE568F1F710F7245C54C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 92b3fe3c1f53c120f20ea643b0dc7ed8623f9d208eb1c4d7232edcc97f0b69b6
MD5 7c01ab9b4147641f5e78fe413048da53
SHA1 8e1e36c184f8a953d84d6bcf9a23a2aeccf11785
SHA512 f42cfb7a46a1c4450f02942035de8f5b217382c91026f29ea332e7a448ba0045eb1f7a5acb7c8eddde74daa258d80f1a8ba7fcf32be1c93b64cbb997ca2c55ef
TLSH
T1E7D0805C33715C74C8968E71140DBF063699C4B2545553333C332C691C471411ED5297
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 04041e9d14f3b0cfa89f268f1198fbab5d95461589c54f442abf5d1b19d4405a
MD5 cf9fbee0e9df0f21826249692c2c0e46
SHA1 1e1b77eca0ac37a417289edb3fbfe073d5b44be4
SHA512 b30663485f3ea94d9ec090e3c4bd1fecc5dcbe26f0510e69a82441dffb219543bea9e8281ffc7eb4785a8314d781e017c24bba13507a3461b55dabba2be8b272
TLSH
T1B2D0233173598006C4960DB34001975133CB80D530DF4082F029800E18DD2452FE3342
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 bf89531d0e3eaeb6193d0eb94b0bec959bbc3dbf51f4b1135a0c78cf16adaa46
MD5 38938711ef0446937338851ec79a0894
SHA1 179778fce333dbfd0c0e890d77eef83f40e68189
SHA512 f43a9b63b4232462afb2de768f45ce89cf129900c80bd1d32946f956e184aba1b903c62f63f5ff2ed8fb9fb615cb1ac6ddffb909f174000b4a41a45f7daef6fc
TLSH
T104D0805C33B15C74CC968E71140DBF063699C4B2545553333C332C691C471811ED5297
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 65861f68c6ec2df1e4f95b898c793bbdc779e65448e481b848c85ee40f2bca59
MD5 74b8c9d3750bf8ca1e1e181949ff7f8d
SHA1 8542656b1e24132d851fa03c9f311d5763ade37e
SHA512 4c89bf664fcb35d8431cab3480b06ae535432c712a03691ccf28318cf913f6feec19c2533f099558f4bbcbbf8c89d9ddbcc1dd1d096ca41d4492a23b1907f18b
TLSH
T17B610AD5F0B5C0E9E3F7CDB316A62476B2F09D28060E0F5B92D581BEEA7EB514080538
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 0eae84fae8421f09b1aad6c7330dc512d3619ebee74ada0afbd35b3870ac73bb
MD5 23b89612a8f3dd20331f4e5b8d19c12f
SHA1 e4e50a4f19a8b2e0567e7840fc3d3fb88197710b
SHA512 31222dbeaf68c72fb0f5a3386f5457e6a5225c0f8a14b11ca01ab3a9efcdf9f7ce5167dab8f6a18c9c848c078826677f5527812e9c634d25cfa688f9e42eda20
TLSH
T1F7712C95F0B5C0E8E3F7CC7316A218B672F09D18064F0F6B42D585BDEAAEB554144538
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58405f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58405f.TMP
Size 3KB
SHA256 9288f6f4b5186ae7c218123f894cdf61a51d8220d5d71865dbaf1d912d0b9c86
MD5 87ec927a5e30eec415ab11f95257a902
SHA1 46df2049e9af6b5f19812f84df6e91e8abcce871
SHA512 30f463a7b0ab14b34293ba3978c3c6b1fa84b798e1fffea68ab468ae2622b01c89e880af5fca3ed5c2bb15b58d5bc0339d9b825e1279fac0d04d749e7db7c343
TLSH
T1A3611AD5F0B5C0E8E3F7CD7316A2247AB2F09D28060E0F5B92D581BEEA7EB554080538
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 5a6fd1a35253ad03a5dd65443a100bc70d9e6ec1624dcaae9de3d2f98efc5dd0
MD5 8171d0c2c821b8274b87e2c616d17ab7
SHA1 e67fd92a494afef5bd8378e644ecc0d328e89aae
SHA512 f49ef614edbb7607a80c663695b94c109bdb76e90c3af0738e25a5912ff61614dd8887f5106dbbb84769a156e0f509e7f36eb0edbac8648ed39c8f8a28be4640
SSDEEP 3:MsEllllkEthXllkl2zEMil:/M/xT02zX
TLSH
T1D04404147FD00D45CD001C304013C3704374D4140551D7433CD105335DC75C00C10044
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 c53ec35212fbce58fa82bd6b605299816e76d8536fa18a304fcb79eaf65e737c
MD5 42836d838711e518721fbd31cff23d77
SHA1 38d75d7a3af23ce7f567be40a4c3c389dfa2ef60
SHA512 4bf90f625ff9d57edaf2e3eff721c6146592e45ba98df12dbe407cd28e930f2bb107c0046a82f6a7847b0213bf59a42539d2d2eef98570470a38906178c5b9bd
TLSH
T1DA519DF787A4856E8A1195F0AA18EE2FDF2D0615431C3C5A89E4EE17D3E3471E10165B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 bb6508875e4a608bdb8fa14a7b0a3cfce790edfdf6ec1d0cc3b45222a9ed8047
MD5 667e43d20f32445364ad96d4a79f4014
SHA1 92318997b247a5a6247b5e6673ab07a7d36d1700
SHA512 e070faa0513951cd02c232bd256f0618f9ce3a1d971328b5734e78032691d211565746164f70d2230d2e9de1a4c418151b1a5be7f656ca2cdcc14e9cd38cc53e
TLSH
T1D8519DF787A4856E8A1195F0AA18EE2FDF2D0615431C3C5A89E4EE17D3E3471E10165B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 eb5273f36f0f402c8d5439253077c18467ff1cb32cc55fc8b7da08fb86478953
MD5 c2fa92d3a735d0b436610297d126211b
SHA1 fcd299d8357f4070a6adccea05acee4fa2cfed49
SHA512 22dd01994ab9830c247b8909686423d3c95a2a4dd984b963d2e175cc5efcd7857d3d57dc9633084f2a6cd8c6493730d854b663e99b285fd7e4a48f3a73df2350
SSDEEP 192:sxZtRCyM//K1Ml8Mc+/fgsLOcIdpfL/W6+WNrip/AE0xkkZ6HgIg4J:sxZt80+/fgsLOFz/b8/IHc
TLSH
T16052EA127A346D7BDCDBD209BA55BB53D6F9057292910E449AFCCA0C04E6BFD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 fb9d726ce09e822b564bc426ce1b33d6a2dc276c6b9eb1fc8b9bc85a22a430b8
MD5 6aebde649d313e9cc6d55c10e0695f5a
SHA1 a813dd754333bc66ef95f858cc68e13fb48bcd9b
SHA512 af97c38fe0540d048ff125803ddd757b245dd0950b5419cbdf7a3c2b1d7191745deb9c3b1eeec0de48f8ed6032873cfddb2c55abd2de4c28db6e1bcfb2b65c6d
SSDEEP 192:sxZtRCyM//K1Ml8Ml+/fgs58P3AtzlRrtIdpfL/W6+WNrip/AE0xkqZYHgIg5FAJ:sxZt8t+/fgs58Yliz/b8/ITU
TLSH
T1B162E816BA346D7BDCDBD209BA45BF53D6F5056292910E449AFCCA0C01E6BFD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 bf713e0c873183d07693832d8fca003c56c2053a44e6cd33df813b8de5b894bd
MD5 3be691c5d98321fe200a7680f3492f8c
SHA1 f998d44920da76940d5d355089122edc7107b2cf
SHA512 fc50ced3869e16ffad893d462fc637fe3c0761737fbf258b8ced490b539866c8834d44ac6a5d67d445be45ffed9b733b378a82bc99adaa2bee68bdfd8ca5ba6c
SSDEEP 192:sxZtRCyM//K1Ml84l+/fgsvWpVc8P3AtzlRrtIdp5L/W6+WNVAip/AE0xsf5xee+:sxZt83+/fgsvWvc8Ylip/bV/Ig+
TLSH
T12072E916B9346D7BDCDBD219BA45BF63D6F5046292910E449AFCCA1C01E6BFD220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 16bf2b6ff1aa1691c27199504b5fb816c5e96fe4e7d7fae39159879d1e44911a
MD5 bf6563be3bcf1cb4a8e90bb4b5ef94d3
SHA1 bc63c6d3558d339de8fe3d76852f3ace850b233c
SHA512 79e495b55ebf5155868d7ceee47441c66597ed3ea3c839b1b68f2ea5e68b6dd948144afdfacb5996da11017d6db0d166bae2d761b29bae4210605ec0340a04ad
SSDEEP 768:MmK2G8g+2iJWRmdnQaP8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3f8Ll/JL0o6ProqE:MmK2G8g+2iJWRmdnQaPu1jaKf8LpJ4o9
TLSH
T1BCE21B2B284CCB7E4F841E5CEC26AF966DD801CBA7584D5447FA894C03C63EF561A49F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 8a3e1f0c11c0143fcd3ff3f48d8760bd106fef0c719dd129fb790b5fe91799dc
MD5 633180be87f2548d26406b615888218e
SHA1 94d6d95a27f96793d46010ed14aff51c7a2c3763
SHA512 3c2482e33925f174eb71b516ed6c36411d01c81115268882d01524e576f24a181962a2e5e5743171c8a7c0a774c072eb5c290c483e75e041fdc252a26f3167e5
SSDEEP 96:KAhyKisSu12KWY6KK8K/6g6kKXqmic4KhOi:ol9JfU7Lx
TLSH
T18AE14191F47616413A7E299A81E0B47A12C375633038A43B37B942A60F67E25CFFD9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe58ddc8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe58ddc8.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 8dae852935413734d9120faac0fbaa9d34d7a7e0fef20e4ccfe329f47ccb074d
MD5 3734c8803844d85261347eaa17102f61
SHA1 543800d0c068d28c8ed9911dcba70c523fa67c60
SHA512 9f68a13b7d33d04e68d72b26f94d08b8b58067e194ee52df4adb489cac911aec5d15f7bcccd19ade4dee17ff71a71311aead862e5043ca78e2ef8da6aeee481d
SSDEEP 384:n5iFscXqni8N68TUNTUlIlVDleht6VDfY4vAwDL86AlSXLJrjy0fRk:QFuinwgSB4PDwlqLhjVfRk
TLSH
T15EC294F194D7993AE8AE4787633E6E429EFCD163B5885984B7D44D0CCC862BFC30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 4870d4c534a599862412f48de1e4bdab9ef725adb3001c85af3a28bafdd9dc78
MD5 9770ad8efd55bb95f6c9e0cf53ddd050
SHA1 c8fc1f41730f342e8b0f8e57c6746415bebe3c84
SHA512 d2fa64d31e66ee37c1b0a60ddb2359ec445a7864185e64c6fbe9cac39bd71e9144bf641fcf1975f797a274439b8b78900566b67ccd5aa71dc79020ee0fb1f040
SSDEEP 192:zXa8NiYVnQmsUqAajLp2QmiU12Xl4QvAwD7jzoru9UrlSX8SJrj0lw+qZVr9xcCn:zq8NiKnlewe6QvAwDL86AlSXLJrjVfRB
TLSH
T19A521A71B878AC6B6DF3E515B04B36639FF45077AA842F54D6F84B0C04DF398270A92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 760aec7b51a9bf3a93eb153af1368dccc42abd4509695a75519e105dfe187486
MD5 88fd52db7412ed215574f47be1d3828d
SHA1 969dfd87c55fa0436083e8e718df7bfde720c29b
SHA512 73a5db7ececcb8d674bfc355a60dc62cb2dedd5ca1ee421356a0b0066dfe8ea050d3d43a2c48d4d25a9370a0f631585992113eb9e49806cd6faa0c021c5f5943
SSDEEP 384:nqcXqnc8NiVDlewe6QvAwDL86AlSXLJrjVfRk:IcK7PDwlqLhjVfRk
TLSH
T1E9726D71A878AC6B5DE7A649B04F37535FF460779A842F54D6F88B0C04DF398270A83A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 8f41370a1200c94a5bb338d227412d5c6d20e9547eee415eec1143414358ec69
MD5 4294a4b4f909027d8482632c28de92c0
SHA1 a81edf8b251da7c674c31c98632dbc9712535234
SHA512 bba6569a0a86f1d1d85bf0a7c41e5fc4890dd2bd3d23f453247fbdf20736733cf732b197f3d10b6387aefc2931856ad676c7102d38c20a5c0b32dcfcc179ba21
SSDEEP 192:VGN76EajeQmiUylw/BnRvAwD7jzoru9Uwq6p+U6:VGN76EN6wpnRvAwDL869gU6
TLSH
T14802D835B9787CAB9EF3AD55B04737176FE4112BE6942F44DAE81B1D00EB34C2306926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 9516bb695e586d8ca3d0e3c35d6c0da9d07dab3ff173a936a5d9e90f2f445669
MD5 390b4b56477901b21d6f1c8e43fbf1f2
SHA1 e5ed0ab031d1dbe15f8635c5ee04481740b60038
SHA512 0b4a96caf9383f14693937fc037052a9fbdf14b11563188907415ec882342744a9c2ada0336e8824ea9e0823f2e85085c30cff7ea1a7a8df5323a2fef7e9b088
SSDEEP 384:n5iFecXqnQ8N68TUNTUlIlVDleBt6VDfp4vAwDL86AlSXLJrjGfRk:QFcQnwg2E4PDwlqLhjGfRk
TLSH
T1DBC293F194D7993AE8AE4787633E6E429EFCD15375885984B7D44D0CCC862BFC30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 79454ab924fd3907a1412fc370723ff2d1004b19c18afeebdd4105bbf1f0ed1f
MD5 7b170fb66fa18789b96a97d25c1c709f
SHA1 aa4d2ee6636ca880ca983420aab86b14df4df165
SHA512 9079c83814a847cdec46e7e0ede7dabad4d0429e256684e3a7099e7b0075b6e96dc1a3530a9dfcfa1f211c38cd718f9dae00958124fcd1516815310f978de115
SSDEEP 384:n5iFhcXqnb8Na8TUNTUlIlVDleEC6Vifp4vAwDL86AlSXLJrjjo/AtMxKK/bLXPb:QFFbrwgs74PDwlqLhjj/tzK/brP8Rk
TLSH
T158F27FF998D3983ED8AE6787633E2D1249BCC137B5A85984F7980B0CCC665BFE305815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

1143f89f-6b31-42c9-8c6f-325d1e2cdfee.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\1143f89f-6b31-42c9-8c6f-325d1e2cdfee.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 08c541b85cdb7938dd0ea6f26c5311a737e30828a66614faa0bc98261498ed26
MD5 e3b1b6ad7c15c01f563401926041aa1a
SHA1 598661b6e233889c377babb2ef8b149baf937e44
SHA512 1c6de7c8b3118827b788912a6e4c9b93fca3ddd087abb7266953e1d1be9bfda6993945267e751f8dfd076f45dd2aed7460e40c2114d3a79547b3e76368ddd421
TLSH
T1A4218933B3ACC134C8D9117A108CAD01B2B5C3C7449ECE9B7B84C508A57F89ADB641E4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 c4ad4840dcbf88246bd8dddbe4a33f114501a6d5ff87fac603bdd8e89ed0da4a
MD5 190c88984cea7f330e10fbb548d83710
SHA1 afdfe0d0f20ed290c1d5606ab27485505b3714dc
SHA512 5312bac88b987521f13cfa44c57ad8d43c416b955b93eee3dddda77f65707ab1dab01274166976dcd8410a85d65447d4f7f092ad320e1e60cb37c7dafefb8fc8
TLSH
T1BE218933B79CC234C8D9117A108DAD01B2B5C3C7449ECECB7B84C508A57F999DB645E4
MD5 SHA1 SHA512 TLSH

Submit Download

59fe3799-5caf-4629-8047-833d66ee3f90.tmp

Path C:\Users\Admin\AppData\Local\Temp\59fe3799-5caf-4629-8047-833d66ee3f90.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.7_(x86)_20260503163301_000_DotNetHost.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.7_(x86)_20260503163301_000_DotNetHost.log
Size 3KB
SHA256 bde84432ca3cb66d680b4b59bcda1a307b1b08ca6d9fdba3f31b374edd5d6050
MD5 b4a2612177dc0f18aa1fa6f0cec9d528
SHA1 e2ac3099275af2f462b75a1a1ca18356c524d7bf
SHA512 46673d76d60170e5b22f04cb09846cfac88674798536037d60e93059175b0eefeb2816fed2641b7a289a5045235e14bc8093cbb4c91892d57ef1abd186503931
TLSH
T10471E8691BE50905B6B35707DEF3D4526A33BCD3A934CF4C2348821E469FC0698BCB6A
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.7_(x86)_20260503163301_001_DotNetHostFxr.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.7_(x86)_20260503163301_001_DotNetHostFxr.log
Size 15KB
SHA256 c48e7fe06477cb4aaa6e72ca72fd1b987f32e771b91d131ab3b9aa0f6b611907
MD5 0083cc4798619678d03c0b5a5ff425fa
SHA1 6a37d8d152629316e4035a5c20779d701eadcf21
SHA512 1ea2216cfda2f70892b69a64268cd1590b36448111ef214d596688e02d894b0efcc4b3b466b2c176875420cb4a4b261f40f79fd267f36915bcf9c9fe9bfd56d4
SSDEEP 192:3jw87FOLZgeEaKFI8FJeXv2ZK7aTlv/mETcYg2:3jw87FOLZgVaF8reXOZuaTlv/mETrt
TLSH
T1A77208582FF40205F6B3A6879EF39C166A33FD63AD398D4D2041821E05A7905D8BDF6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.7_(x86)_20260503163301_002_DotNetRuntime.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.7_(x86)_20260503163301_002_DotNetRuntime.log
Size 4KB
SHA256 93d0b8aee83d05c4a4d5bfdfe07a40b7fd370f527f3444f8af0b87d1e3cef94f
MD5 ce6cb9c5cdf34083a7de84b7d388ea64
SHA1 ac8fb9c7ef8fba442a2a9b5f72b2fecc3af5ac7a
SHA512 a77a54a9af2f5c7f78e5098c6e7d062987df7497bd4c1757a24f9b2706e1b2534b7d57104ce8d4421e8e4557d181cd9d9cd8ac134a928a0c6aca38e86e280d01
SSDEEP 96:YC+WqSMz/O4d1fOrwawJfnfi/O4d1xRwxuwd+wg/O4d1RwdgwuvwcKFM0wZ:3eO4Orwawx0OERwowUwaOmw6wmwcKFv6
TLSH
T18F8107641BE40905B5F25B079EF3D412BA33BDD3B839CF4D2345821E06AB90594ACB7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.7_(x86)_20260503163301_003_WindowsDesktopRuntime.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.7_(x86)_20260503163301_003_WindowsDesktopRuntime.log
Size 3KB
SHA256 2afedd9d581d296413906d87b70fb8a9af688f7db2c5f6ce8bc1e95957c91019
MD5 a76930ab906b321d131f34b2039d1af1
SHA1 1b3220d077a696b0ce40ff41bb4806033eb725ac
SHA512 5f2d84c6a0a062b3b03b2ab197be009f9dc622c4717887149d676f83736356cf9fce4f921f413fb38b57fd9ff1ee1ebef152b83fd11285d42797f643403baa59
TLSH
T15581C3581FE50905B6B35707DAF3D4525A33BCD7A830CF4C2385831E46AF90695ACBAE
MD5 SHA1 SHA512 TLSH

Submit Download

Velocity.exe

Path C:\Users\Admin\AppData\Local\Temp\Velocity.exe
Size 32.9MB
SHA256 873fd333cd8e687b874af8dca2f043c50ea1f4bc64d496015ca038da383b91f0
MD5 83da367e14fe39262fcf57c39dc3180b
SHA1 a0d2655ceff2d35b7eceb55e2be1058b966970e2
SHA512 8ce8b77b95640a111d43b75ff76bdfdacfd8680a39c5d5c6a97fdef7aef18bd7470a4df4716fd3c67a51cfed69a710d6c33086c864a0b91ea0c03966b8a97df5
SSDEEP 196608:ktQ56WdpH6emXAro0JTToUgmwh8qZYOCu51ZTAFLzbjblIjvT7CThIPPBrYjPWDx:kt6pHxmXf0J9A8qCFqAFLKnCTMGPWl
TLSH
T1A9779E22A3A44E3DC99F5773E4B603254335CA06AF43939E581CA69C1F933860B59BF7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_l0yzwcm1.hht.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_l0yzwcm1.hht.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

e1f9acdd-3d40-4f47-9d05-4d1a3c0bb624.tmp

Path C:\Users\Admin\AppData\Local\Temp\e1f9acdd-3d40-4f47-9d05-4d1a3c0bb624.tmp
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1716_965281714\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b74c926d-23e0-48b9-8995-8824373d4308.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1716_965281714\b74c926d-23e0-48b9-8995-8824373d4308.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

velocityy.exe

Path C:\Users\Admin\AppData\Local\Temp\velocityy.exe
Size 57KB
SHA256 402dfcad45c1accc395ec18cc56d4dae549f30dfe251bdfbd556d7de42ecdb40
MD5 41e0dc39cc6da98fa73b25326c3cf6a3
SHA1 81c8ca8881a4b44e57df5d39d51f5eacdbdd0769
SHA512 7983cb5a9af5686e678029418a57d6bae3675bf4d2cc5325ffb87b0b8bc4d6ff02dd13a25d306b3b56eb40e982194dc66373d4f3881239a5911b34f44f701271
SSDEEP 1536:mWOYjOFEjXQYoXegGGI20rFcbFZbfZLu6ajV8Ot+Ji:mWmFEGYGo2FZbfYj2OtQi
TLSH
T1EC437C287BE58465D1FF6BB11DE66392D735F3534A13D72F28C8028A1623E88CE417E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetHost

Path C:\Users\Admin\AppData\Local\Temp\{6E0E185D-8E16-481C-A51C-172C01AF86AE}\DotNetHost
Size 900KB
SHA256 efe1a594f21ea09c5c6f3f75d5618df0ff6bb465e1b7a440394eeadf06d86bdb
MD5 6b8563447431316d2fec41888d36a80a
SHA1 12e0efe2109fb356fa980e7bf7575fbd248cc64c
SHA512 9007dcba3c7adcb29aafcfd77e18a398903cb65f53e51b04c351625751c8fb95d29d2cbc34a232feffc95f900af956d7a75c9a7b3e434a079d9c72c41ca39845
SSDEEP 12288:8jcnTi8XiHmGdKkg78We96sI+yDxTYwsoCm1p:ecnTiadGdKkg78We96FDxTYwsvq
TLSH
T19C157C23BC419036D9EA0D72A438CB616E3D7D14279488DB9390B94DFCF06D26FB26D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetHostFxr

Path C:\Users\Admin\AppData\Local\Temp\{6E0E185D-8E16-481C-A51C-172C01AF86AE}\DotNetHostFxr
Size 956KB
SHA256 767110859ec26785e7cccf654785f32e3753b545a6c9003d55bd280da9b395d4
MD5 85dcd01ef3e23d75cc9b6ab925f9eb5e
SHA1 64f9491648d78d252bf06c30f042a8def4a203e3
SHA512 a9faab719ffd01d6a6c3ae726679bdc711f9c1311787de148ffc8870611769fe4798a87b6100d0262e3efd04cdcef0bfa7d64316ac6601cff07057d7a8238475
SSDEEP 24576:lcnTiadGdKkg78We96FDxTYwsvqV8iw+f:lcTi8GExDdYwsvlhY
TLSH
T154258C237C41A036D9EA0D72A478CB616E3DBD14279484DB5390B94DFCF06C2ABB27D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetRuntime

Path C:\Users\Admin\AppData\Local\Temp\{6E0E185D-8E16-481C-A51C-172C01AF86AE}\DotNetRuntime
Size 26.1MB
SHA256 6fe13e18d56706ab4594ef5e8dc0104972e0a732eadb89383bd77815b4ed2b4b
MD5 94215feca007a68a741c4581fd317632
SHA1 10f54be9bc3ff44c7eb840b2fc3d943d79b22e7f
SHA512 682598c5a654f6af043b194b1b44b70a6b3310560966951278ac4d047e0e44ab9be9e8dde6728e41680bfc4ab7b23799198a4b639100eebd0b47dee6b160336f
SSDEEP 786432:AAw74NDnKORiD9fNBvBwDs6jz+Gws44qirlQmkccg:Aj+PRwFGDjj6G+mkhg
TLSH
T184573327BC836022D5EA1D35A47ACBB1293C7D60174488CB87D0B94EF8F12D19BB67D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsDesktopRuntime

Path C:\Users\Admin\AppData\Local\Temp\{6E0E185D-8E16-481C-A51C-172C01AF86AE}\WindowsDesktopRuntime
Size 26.7MB
SHA256 9aa6ec95172581a1a485d4f5208a0c422e892941c9f859b2efc964def9bfd963
MD5 cecf22905b6bc75e8eda547379796581
SHA1 85db3f58fdac544e5854fae2b137c9ed8ac3fa02
SHA512 fcb8309a1d055a2273a2b08ff079be7ecfac48c8d6d8dcbed86ed976969460f93b4e6d25ee486c356da2d5336b7abdc120fa78f3d47e5006bc059787d6809b9a
SSDEEP 786432:xsMa2N2voVo66TV/D2tZO0I/u/3bb9yI4jSW3e:xsg5VkTV/D2tZCirb9kSAe
TLSH
T1FA573313BD83A53BD6BA0D72A439CB1068395C141B54454F93A4B88EFCF12D3ABF66D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windowsdesktop-runtime-10.0.7-win-x86.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.7-win-x86.exe:Zone.Identifier
Size 185B
SHA256 4423e7b7a7e49693d09e6fff75f573ba0a43c10bfc0a9e8040caa0920dc5b0be
MD5 ed9fc2d35e3884ecd183b9c3b23a1c9d
SHA1 80669794b594f34131ce1f955325ad5f5f60ab06
SHA512 bddf79cc48cf6ce80e0506687696f54cb9913f7babec90f355b394b128c4295344d70e4f222d0033b4d53b76c75dc172da06820d416f5a352d6b061316971e73
TLSH
T1E3C012ABC80144520E3032821B6ED559FF0F1D125D81C38898C48096E992AD6C1528D5
MD5 SHA1 SHA512 TLSH

Submit Download

MSI14C7.tmp

Path C:\Windows\Installer\MSI14C7.tmp
Size 346KB
SHA256 1caa470031f4f3fb53bb38187d522990a3a7423476b1b5aaa27443a3e2fc62c0
MD5 f715d24632e765c53e9856df53dc8318
SHA1 78e2280ccaeed00119fe827acc58ba10996517cb
SHA512 dd0568de924a86910d8bf59b2f0c22663268004ef9a5f80ffd78f37885f3b8538d138d1e5c70de8e4fda7aab150df48bd34e3838c976ec90ed4f0e49bed0e9e6
SSDEEP 6144:WbOobwWeCg6QvyuFtPwvGyDBQlEz8a+CFTYK0OnsoIcGm1p:W78We96sI+yDxTYwsoCm1p
TLSH
T1BF745B31A456707AE6F90872F568CB706D3CB21827D8849FC3E0E84E38645D36BB775A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1716_132118818\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
TLSH
T158C04C668D51DEAB00A747A56B295315E23B4B4B5044800A7AF5429C1A288964171944
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1716_688061268\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

BootstrapperApplicationData.xml

Path C:\Windows\TEMP\{6E0E185D-8E16-481C-A51C-172C01AF86AE}\.ba\BootstrapperApplicationData.xml
Size 9KB
SHA256 1633b50661776a39ec9ffdc98ec19e48e0099a08ff5168cc3376137a904ee6e3
MD5 1b7efeed50be6f8ee212995070717d65
SHA1 22c3bc34718c78531cc3b56c312a54a89aebff9e
SHA512 9456bee88d409491723b8aa09ef6348b31119b5ee1ef3ba92a9d5fe7034353852c4e0f97031ae4f99e6ecaa49df5ebf611de83ad99a0c1f885318ea9920de5f3
SSDEEP 96:2BqRBM/En6YcYY0wZycirLdin6sUsD20wFycDdin6UkEc0wNycdOZdin6fMS2g05:2I1zfTK/lvjnlX0OOamagM5cYsCsysz
TLSH
T1BE12E3113BFD0218F0F3AE48EFF6A5555A36BD552E39C82D01601D0E49B2E819962FB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetLogo_256x.png

Path C:\Windows\TEMP\{6E0E185D-8E16-481C-A51C-172C01AF86AE}\.ba\DotNetLogo_256x.png
Size 2KB
SHA256 0f571f95d8eab48dbc81b0ec5e9f7225e349e26ef50868bfaab556f3c2443b01
MD5 39aa52615723b782c92dec710caaec7f
SHA1 760b49e256a7979fe50a56a2b1be3688a474b886
SHA512 89d1baa3820154667747b25e9e2fd321bfb2ec71dc309915b0a28dacdc80822a4943b639ebb37c37bd2559d5a4306d2096119cd970c84a0d331f6c68b0456dc9
TLSH
T1534195CF1BFD78D7E6E557918E1A8DD232738483B4B3A42CCE7B10B8274A5642B87940
MD5 SHA1 SHA512 TLSH

Submit Download

dotnet.ico

Path C:\Windows\TEMP\{6E0E185D-8E16-481C-A51C-172C01AF86AE}\.ba\dotnet.ico
Size 44KB
SHA256 61a2cbd12868cb9b359e0c78961d409b7875f072eb8e53ea88d3e6bfe2961a18
MD5 b8096652d9ec286709a2c863b244b110
SHA1 b3b7f0f4d608fad7cb59ba499d4d17c2b873a7af
SHA512 492a5aa83220bb77c178b7c5b50bf44968c0427e9e45bb97a33df14d7fb4c667ca7adde0ebb3874c7b6011057b01144e4e6651fbad62c6bcf5e0b93586c4bc7a
SSDEEP 96:r+gfbzo+wHK9NbwOY4tIWQeVlV1W9+H+guapUjFamINUItzf1dBNaIZ:ro5HuNcH4tIzeVlV1WEOFDgUWzf1PIm
TLSH
T1E913EF6DE68547C1C10C2032DB4AC792B5233C72E4DAE0C4F9D4FA7E177906965C6E6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\TEMP\{6E0E185D-8E16-481C-A51C-172C01AF86AE}\.ba\thm.wxl
Size 7KB
SHA256 b00edd703dd8a475119d0e4dd70a3aaa47f0e95361af290e76d367a8edef3432
MD5 8b2c667a8bbad3153068c0ed90df7ec4
SHA1 c9e04a3a37e5e6262ab9bfecf78280171b8f7b74
SHA512 5269f00d474acccb4c48cb7bcfdf19e63557a388572d3a6335aa39191319691d924e27f70da3f3495387c319396476c63a8fd7b35835cca0901220e39783847b
SSDEEP 96:HiTgM1+XSNEzA0HtYQstYCpCwZQpCeyk5HQJM9ouvj9urz8:Ew9EmtYQstYCPC9e8
TLSH
T191E1026F68DFDEE03A732651B2B3698D6919C29A136F1CF0F869084B47635016377A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.xml

Path C:\Windows\TEMP\{6E0E185D-8E16-481C-A51C-172C01AF86AE}\.ba\thm.xml
Size 11KB
SHA256 dfee8e2d075087227f19c835c145c5bb8e72a46880ea24080bb2472fd3a521be
MD5 4329e418dc56b1386d7ea29a0dcfab5b
SHA1 58387f92e89ca21b4179fb697c7de9675c59142f
SHA512 6934873d27e6efbb94da4f13ee8369b29995490051016fdf82800256b924902306d328bf1d4ebbf266d1a53eb24adb6478d1a67de4ecc3e3bcbe561968f24922
SSDEEP 96:HgvPkoeWEH3IWTaQfSJgHzth5mFahbuB8pR5+Vpwe+UIJLg1gEp+6F5pQnxc:AvoWydmQfVHMyyj5Z
TLSH
T14B42FC6851DC7811C532D702AB9371D3FF12BDA6C6C85A58B48E256B1FF262028B739C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixstdba.exe

Path C:\Windows\Temp\{6E0E185D-8E16-481C-A51C-172C01AF86AE}\.ba\wixstdba.exe
Size 431KB
SHA256 2b1cee5e3e24593247854eb7a7c4308937b9c607754ed2fb83520a8706c26f1e
MD5 0e88ffd2e737ac9b9a4241616838bc23
SHA1 3c8beb465d20bcef0cd6ceca9c60286d1d15cebd
SHA512 169b9e08518834c9bc5adfe4ab7b79e07685b72f30ede1c1a386229668bde8c15da378e1274e4013ad7b84d6f7a5acc64ef0806e3b8a66322861efaa7e26b620
SSDEEP 6144:X9vfS1NP+c3ytxmg4Stlqe3B9m2LSLTwGw7C3ZLaov5xZvSdF:X9v+GIyugllqe3wwGfX5/SdF
TLSH
T129943B3165F04037C6F90572AE14FA31BF69F208231095EBA3C0DD293968AE5BBB7657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windowsdesktop-runtime-10.0.7-win-x86.exe

Path C:\Windows\Temp\{6E0E185D-8E16-481C-A51C-172C01AF86AE}\.be\windowsdesktop-runtime-10.0.7-win-x86.exe
Size 967KB
SHA256 d7159bd11bc004ee485fb6fd031b71d38e4303721d0665acfefaee1fb97588fe
MD5 54b260b4c45fc5f0438080d937e0e2c8
SHA1 c7838ea3732e2619ba05fa3a9901384eeebf5fc8
SHA512 9a063312880700e71b4a1fe12365918900c033ab04c720ba880b4bc247c635ebacdf36672051948e5a07aa5e4773a2ec92a5e321a303175abd6930387a915544
SSDEEP 12288:XVGWl6qCmyZeU6lqlDjC+fScn6X8GwMgJEQaA6fTQfulZYDGSGPjR0ASh:XVGWl6qCmyt6UdmcpMzfz0xOjK
TLSH
T13D257D31A166242BD6F50973F914D2307E2CD7082B5C95BAC6C0D90D39689FA6FFB24B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/324-1470-0x0000000001870000-0x000000000192B000-memory.dmp

Download

memory/324-1475-0x0000000001870000-0x000000000192B000-memory.dmp

Download

memory/584-1477-0x0000000000920000-0x00000000009DB000-memory.dmp

Download

memory/584-1415-0x0000000000920000-0x00000000009DB000-memory.dmp

Download

memory/980-160-0x0000000000C60000-0x0000000000C6C000-memory.dmp

Download

memory/980-334-0x0000000000CA0000-0x0000000000CB0000-memory.dmp

Download

memory/980-127-0x0000000000CA0000-0x0000000000CB0000-memory.dmp

Download

memory/980-13-0x0000000000430000-0x0000000000444000-memory.dmp

Download

memory/1332-1474-0x00000000016A0000-0x000000000175B000-memory.dmp

Download

memory/1464-877-0x0000000000ED0000-0x0000000000F8B000-memory.dmp

Download

memory/1864-1469-0x00000191CCE30000-0x00000191CCE3C000-memory.dmp

Download

memory/2268-906-0x0000000001600000-0x00000000016BB000-memory.dmp

Download

memory/2416-88-0x0000000000EB0000-0x0000000000F6B000-memory.dmp

Download

memory/2476-1492-0x0000000000AA0000-0x0000000000B5B000-memory.dmp

Download

memory/2476-1412-0x0000000000AA0000-0x0000000000B5B000-memory.dmp

Download

memory/2672-1460-0x0000000001310000-0x00000000013CB000-memory.dmp

Download

memory/2788-1115-0x0000000000BE0000-0x0000000000C9B000-memory.dmp

Download

memory/3176-1472-0x0000000001860000-0x000000000191B000-memory.dmp

Download

memory/3532-857-0x00000000010F0000-0x00000000011AB000-memory.dmp

Download

memory/3936-33-0x0000021AFFE80000-0x0000021AFFEA2000-memory.dmp

Download

memory/3936-51-0x0000021AE7A80000-0x0000021AE7A8C000-memory.dmp

Download

memory/3936-41-0x0000021A805C0000-0x0000021A80673000-memory.dmp

Download

memory/3936-42-0x0000021AFFE60000-0x0000021AFFE6A000-memory.dmp

Download

memory/3936-40-0x0000021A805A0000-0x0000021A805BC000-memory.dmp

Download

memory/3936-43-0x0000021AFFED0000-0x0000021AFFEEC000-memory.dmp

Download

memory/3936-52-0x0000021AE7B40000-0x0000021AE7B52000-memory.dmp

Download

memory/3936-44-0x0000021AFFE70000-0x0000021AFFE7A000-memory.dmp

Download

memory/3936-45-0x0000021AFFEF0000-0x0000021AFFF0A000-memory.dmp

Download

memory/3936-48-0x0000021AFFEB0000-0x0000021AFFEBA000-memory.dmp

Download

memory/3936-47-0x0000021A80690000-0x0000021A80696000-memory.dmp

Download

memory/3936-46-0x0000021A80680000-0x0000021A80688000-memory.dmp

Download

memory/3948-69-0x000002068DE70000-0x000002068DE82000-memory.dmp

Download

memory/3948-68-0x000002068DC30000-0x000002068DC3C000-memory.dmp

Download

memory/4072-133-0x000001D364060000-0x000001D36420C000-memory.dmp

Download

memory/4596-1490-0x0000000000F20000-0x0000000000FDB000-memory.dmp

Download

memory/4596-1489-0x0000000000C80000-0x0000000000D46000-memory.dmp

Download

memory/4596-1447-0x0000000000F20000-0x0000000000FDB000-memory.dmp

Download

memory/4884-26-0x0000000003C60000-0x0000000003C6C000-memory.dmp

Download

memory/4884-0-0x0000000000F60000-0x0000000001B88000-memory.dmp

Download

memory/4884-1-0x000000001C900000-0x000000001C910000-memory.dmp

Download

memory/5032-1434-0x0000000001060000-0x000000000111B000-memory.dmp

Download

memory/5060-83-0x000001D4EAE80000-0x000001D4EAF33000-memory.dmp

Download

memory/5060-86-0x000001D4D23D0000-0x000001D4D23E2000-memory.dmp

Download

memory/5060-85-0x000001D4D22B0000-0x000001D4D22BC000-memory.dmp

Download