873fd333cd8e687b874af8dca2f043c50ea1f4bc64d496015ca038da383b91f0

Analysis

user interaction
yes
max time kernel
106s
max time network
196s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
06/05/2026, 13:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Velocity.exe
Size 32.9MB
Sample260506-qbppcsfx3q
SHA256 873fd333cd8e687b874af8dca2f043c50ea1f4bc64d496015ca038da383b91f0
MD5 83da367e14fe39262fcf57c39dc3180b
SHA1 a0d2655ceff2d35b7eceb55e2be1058b966970e2
SHA512 8ce8b77b95640a111d43b75ff76bdfdacfd8680a39c5d5c6a97fdef7aef18bd7470a4df4716fd3c67a51cfed69a710d6c33086c864a0b91ea0c03966b8a97df5
SSDEEP 196608:ktQ56WdpH6emXAro0JTToUgmwh8qZYOCu51ZTAFLzbjblIjvT7CThIPPBrYjPWDx:kt6pHxmXf0J9A8qCFqAFLKnCTMGPWl
TLSH
T1A9779E22A3A44E3DC99F5773E4B603254335CA06AF43939E581CA69C1F933860B59BF7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
124	3736	msedge.exe

Executes dropped EXE 2 IoCs

pid	Process
2364	windowsdesktop-runtime-10.0.7-win-x86.exe
5248	wixstdba.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
2	api.gofile.io
34	api.gofile.io

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.7-win-x86.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wixstdba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Velocity.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Velocity.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.7-win-x86.exe

System Time Discovery 1 TTPs 4 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4356	chrome.exe
5216	msedge.exe
3736	msedge.exe
3552	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134225463816035283"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-650218026-1419908266-2856590055-1000\{A97F4290-31F3-4449-A572-BE2A2482988C}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Velocity.zip:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.7-win-x86.exe:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5216	msedge.exe
5216	msedge.exe
5216	msedge.exe
5216	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5072	chrome.exe
Token: SeCreatePagefilePrivilege	5072	chrome.exe
Token: SeShutdownPrivilege	5072	chrome.exe
Token: SeCreatePagefilePrivilege	5072	chrome.exe
Token: SeShutdownPrivilege	5072	chrome.exe
Token: SeCreatePagefilePrivilege	5072	chrome.exe
Token: SeShutdownPrivilege	5072	chrome.exe
Token: SeCreatePagefilePrivilege	5072	chrome.exe
Token: SeShutdownPrivilege	5072	chrome.exe
Token: SeCreatePagefilePrivilege	5072	chrome.exe
Token: SeShutdownPrivilege	5072	chrome.exe
Token: SeCreatePagefilePrivilege	5072	chrome.exe
Token: SeShutdownPrivilege	5072	chrome.exe
Token: SeCreatePagefilePrivilege	5072	chrome.exe
Token: SeShutdownPrivilege	5072	chrome.exe
Token: SeCreatePagefilePrivilege	5072	chrome.exe
Token: SeShutdownPrivilege	5072	chrome.exe
Token: SeCreatePagefilePrivilege	5072	chrome.exe
Token: SeShutdownPrivilege	5072	chrome.exe
Token: SeCreatePagefilePrivilege	5072	chrome.exe
Token: SeShutdownPrivilege	5072	chrome.exe
Token: SeCreatePagefilePrivilege	5072	chrome.exe
Token: SeShutdownPrivilege	5072	chrome.exe
Token: SeCreatePagefilePrivilege	5072	chrome.exe
Token: SeShutdownPrivilege	5072	chrome.exe
Token: SeCreatePagefilePrivilege	5072	chrome.exe
Token: SeShutdownPrivilege	5072	chrome.exe
Token: SeCreatePagefilePrivilege	5072	chrome.exe
Token: SeShutdownPrivilege	5072	chrome.exe
Token: SeCreatePagefilePrivilege	5072	chrome.exe
Token: SeShutdownPrivilege	5072	chrome.exe
Token: SeCreatePagefilePrivilege	5072	chrome.exe
Token: SeShutdownPrivilege	5072	chrome.exe
Token: SeCreatePagefilePrivilege	5072	chrome.exe
Token: SeShutdownPrivilege	5072	chrome.exe
Token: SeCreatePagefilePrivilege	5072	chrome.exe
Token: SeShutdownPrivilege	5072	chrome.exe
Token: SeCreatePagefilePrivilege	5072	chrome.exe
Token: SeShutdownPrivilege	5072	chrome.exe
Token: SeCreatePagefilePrivilege	5072	chrome.exe
Token: SeShutdownPrivilege	5072	chrome.exe
Token: SeCreatePagefilePrivilege	5072	chrome.exe
Token: SeShutdownPrivilege	5072	chrome.exe
Token: SeCreatePagefilePrivilege	5072	chrome.exe
Token: SeShutdownPrivilege	5072	chrome.exe
Token: SeCreatePagefilePrivilege	5072	chrome.exe
Token: SeShutdownPrivilege	5072	chrome.exe
Token: SeCreatePagefilePrivilege	5072	chrome.exe
Token: SeShutdownPrivilege	5072	chrome.exe
Token: SeCreatePagefilePrivilege	5072	chrome.exe
Token: SeShutdownPrivilege	5072	chrome.exe
Token: SeCreatePagefilePrivilege	5072	chrome.exe
Token: SeShutdownPrivilege	5072	chrome.exe
Token: SeCreatePagefilePrivilege	5072	chrome.exe
Token: SeShutdownPrivilege	5072	chrome.exe
Token: SeCreatePagefilePrivilege	5072	chrome.exe
Token: SeShutdownPrivilege	5072	chrome.exe
Token: SeCreatePagefilePrivilege	5072	chrome.exe
Token: SeShutdownPrivilege	5072	chrome.exe
Token: SeCreatePagefilePrivilege	5072	chrome.exe
Token: SeShutdownPrivilege	5072	chrome.exe
Token: SeCreatePagefilePrivilege	5072	chrome.exe
Token: SeShutdownPrivilege	5072	chrome.exe
Token: SeCreatePagefilePrivilege	5072	chrome.exe

Suspicious use of FindShellTrayWindow 61 IoCs

pid	Process
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5216	msedge.exe
5216	msedge.exe
5216	msedge.exe
5216	msedge.exe
5216	msedge.exe
5216	msedge.exe
5216	msedge.exe
5216	msedge.exe
5216	msedge.exe
5216	msedge.exe
5216	msedge.exe
5216	msedge.exe
5216	msedge.exe
5216	msedge.exe
5216	msedge.exe
5248	wixstdba.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe

Suspicious use of WriteProcessMemory 59 IoCs

description	pid	Process	procid_target
PID 5072 wrote to memory of 1064	5072	chrome.exe	79
PID 5072 wrote to memory of 3228	5072	chrome.exe	80
PID 5072 wrote to memory of 3228	5072	chrome.exe	80
PID 5072 wrote to memory of 4356	5072	chrome.exe	81
PID 5072 wrote to memory of 1876	5072	chrome.exe	82
PID 5072 wrote to memory of 1876	5072	chrome.exe	82
PID 5072 wrote to memory of 3400	5072	chrome.exe	84
PID 5072 wrote to memory of 3400	5072	chrome.exe	84
PID 5072 wrote to memory of 492	5072	chrome.exe	86
PID 5072 wrote to memory of 492	5072	chrome.exe	86
PID 5072 wrote to memory of 5516	5072	chrome.exe	87
PID 5072 wrote to memory of 5516	5072	chrome.exe	87
PID 5072 wrote to memory of 1620	5072	chrome.exe	88
PID 5072 wrote to memory of 1620	5072	chrome.exe	88
PID 5072 wrote to memory of 2188	5072	chrome.exe	89
PID 5072 wrote to memory of 4508	5072	chrome.exe	91
PID 5072 wrote to memory of 3712	5072	chrome.exe	92
PID 5072 wrote to memory of 3684	5072	chrome.exe	93
PID 5072 wrote to memory of 6108	5072	chrome.exe	94
PID 5072 wrote to memory of 6108	5072	chrome.exe	94
PID 5072 wrote to memory of 5348	5072	chrome.exe	95
PID 5072 wrote to memory of 5348	5072	chrome.exe	95
PID 5072 wrote to memory of 4912	5072	chrome.exe	96
PID 5072 wrote to memory of 4912	5072	chrome.exe	96
PID 5072 wrote to memory of 244	5072	chrome.exe	97
PID 5072 wrote to memory of 244	5072	chrome.exe	97
PID 5072 wrote to memory of 5428	5072	chrome.exe	98
PID 4768 wrote to memory of 5216	4768	Velocity.exe	102
PID 5216 wrote to memory of 5476	5216	msedge.exe	103
PID 5216 wrote to memory of 3736	5216	msedge.exe	104
PID 5216 wrote to memory of 3912	5216	msedge.exe	105
PID 5216 wrote to memory of 3912	5216	msedge.exe	105
PID 5216 wrote to memory of 3912	5216	msedge.exe	105
PID 5216 wrote to memory of 4488	5216	msedge.exe	106
PID 5216 wrote to memory of 4488	5216	msedge.exe	106
PID 5216 wrote to memory of 2172	5216	msedge.exe	109
PID 5216 wrote to memory of 4844	5216	msedge.exe	108
PID 5216 wrote to memory of 2172	5216	msedge.exe	109
PID 5216 wrote to memory of 2172	5216	msedge.exe	109
PID 5216 wrote to memory of 4844	5216	msedge.exe	108
PID 5216 wrote to memory of 4844	5216	msedge.exe	108
PID 5216 wrote to memory of 3292	5216	msedge.exe	110
PID 5216 wrote to memory of 4932	5216	msedge.exe	111
PID 5216 wrote to memory of 3292	5216	msedge.exe	110
PID 5216 wrote to memory of 4932	5216	msedge.exe	111
PID 5216 wrote to memory of 3764	5216	msedge.exe	113
PID 5216 wrote to memory of 2328	5216	msedge.exe	114
PID 2328 wrote to memory of 4364	2328	msedge.exe	115
PID 5216 wrote to memory of 1724	5216	msedge.exe	118
PID 5216 wrote to memory of 1724	5216	msedge.exe	118
PID 5216 wrote to memory of 1724	5216	msedge.exe	118
PID 5216 wrote to memory of 2220	5216	msedge.exe	119
PID 5216 wrote to memory of 5272	5216	msedge.exe	120
PID 5216 wrote to memory of 2220	5216	msedge.exe	119
PID 5216 wrote to memory of 2220	5216	msedge.exe	119
PID 5216 wrote to memory of 5272	5216	msedge.exe	120
PID 5216 wrote to memory of 4504	5216	msedge.exe	121
PID 5216 wrote to memory of 2364	5216	msedge.exe	122
PID 2364 wrote to memory of 5248	2364	windowsdesktop-runtime-10.0.7-win-x86.exe	123

C:\Users\Admin\AppData\Local\Temp\Velocity.exe
"C:\Users\Admin\AppData\Local\Temp\Velocity.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:6124

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0x88,0x108,0x7fff842ec728,0x7fff842ec734,0x7fff842ec740
  2⤵
  PID:1064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1752,i,4467421729670294519,14348905097065081293,262144 --field-trial-handle=1952,i,11882073939291138356,5089131534503296952,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1948 /prefetch:2
  2⤵
  PID:3228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1384,i,17130412632896988432,2018281038876014405,524288 --field-trial-handle=1952,i,11882073939291138356,5089131534503296952,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2264 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2380,i,10877323957333180873,14086453601657654701,524288 --field-trial-handle=1952,i,11882073939291138356,5089131534503296952,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2392 /prefetch:13
  2⤵
  PID:1876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3228,i,5293703215680777400,719434998409511742,2097152 --field-trial-handle=1952,i,11882073939291138356,5089131534503296952,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:3400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3548,i,12116308110571151921,2474471627869101628,2097152 --field-trial-handle=1952,i,11882073939291138356,5089131534503296952,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3712,i,15568610363982816187,16964387919182151561,2097152 --field-trial-handle=1952,i,11882073939291138356,5089131534503296952,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4172 /prefetch:9
  2⤵
  PID:5516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4636,i,1614516800505875586,2516380595412144699,2097152 --field-trial-handle=1952,i,11882073939291138356,5089131534503296952,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4648 /prefetch:1
  2⤵
  PID:1620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5388,i,5358659764836870420,2645485671424543619,524288 --field-trial-handle=1952,i,11882073939291138356,5089131534503296952,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5392 /prefetch:14
  2⤵
  PID:2188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5428,i,7698203192305490195,454505943711621188,524288 --field-trial-handle=1952,i,11882073939291138356,5089131534503296952,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5728 /prefetch:14
  2⤵
  PID:4508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5396,i,5241718972506547563,3751929885860557700,524288 --field-trial-handle=1952,i,11882073939291138356,5089131534503296952,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5636 /prefetch:14
  2⤵
  PID:3712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5720,i,5926404378155456618,16704038253152833822,524288 --field-trial-handle=1952,i,11882073939291138356,5089131534503296952,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5640 /prefetch:14
  2⤵
  PID:3684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5808,i,4826641282968970728,1057062958773938071,2097152 --field-trial-handle=1952,i,11882073939291138356,5089131534503296952,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5428 /prefetch:1
  2⤵
  PID:6108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5724,i,16865015819474349,486255473990657624,2097152 --field-trial-handle=1952,i,11882073939291138356,5089131534503296952,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5712 /prefetch:1
  2⤵
  PID:5348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=3292,i,8833037058210406895,11304931514362911356,2097152 --field-trial-handle=1952,i,11882073939291138356,5089131534503296952,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:4912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=3548,i,3599780167057065976,11167273974829351279,2097152 --field-trial-handle=1952,i,11882073939291138356,5089131534503296952,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5840 /prefetch:1
  2⤵
  PID:244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3292,i,6870046396419912302,4888834838785697678,524288 --field-trial-handle=1952,i,11882073939291138356,5089131534503296952,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3660 /prefetch:14
  2⤵
  - NTFS ADS
  PID:5428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1168,i,17885121040010812983,10439458422128264081,262144 --field-trial-handle=1952,i,11882073939291138356,5089131534503296952,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5988 /prefetch:10
  2⤵
  PID:2780

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1868

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2156

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2200

C:\Users\Admin\Downloads\Velocity\Velocity\Velocity.exe
"C:\Users\Admin\Downloads\Velocity\Velocity\Velocity.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=x86&rid=win-x86&os=win10&apphost_version=10.0.0&gui=true
  2⤵
  - Drops file in Windows directory
  - System Time Discovery
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2b0,0x2e4,0x2e8,0x2ac,0x2f4,0x7fff5f92c188,0x7fff5f92c194,0x7fff5f92c1a0
    3⤵
    PID:5476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1840,i,10864736041095732019,7160339759436176463,524288 --field-trial-handle=2224,i,14586319556698226627,1639651423227306260,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:11
    3⤵
    - Downloads MZ/PE file
    - System Time Discovery
    PID:3736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,8597069876477910739,452473219914385148,262144 --field-trial-handle=2224,i,14586319556698226627,1639651423227306260,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:2
    3⤵
    PID:3912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2468,i,13899527203309692830,2932512082514960293,524288 --field-trial-handle=2224,i,14586319556698226627,1639651423227306260,262144 --variations-seed-version --mojo-platform-channel-handle=1944 /prefetch:13
    3⤵
    PID:4488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3492,i,12108008251955431882,4142490299469736116,2097152 --field-trial-handle=2224,i,14586319556698226627,1639651423227306260,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
    3⤵
    PID:4844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3496,i,10843771716294327242,3538369144754285200,2097152 --field-trial-handle=2224,i,14586319556698226627,1639651423227306260,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
    3⤵
    PID:2172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4880,i,7134015321301999782,16505436686952973525,524288 --field-trial-handle=2224,i,14586319556698226627,1639651423227306260,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:14
    3⤵
    PID:3292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4868,i,4599256586552759844,278007586116966395,524288 --field-trial-handle=2224,i,14586319556698226627,1639651423227306260,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:14
    3⤵
    PID:4932
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5708,i,242569533613410859,2096435954298010253,524288 --field-trial-handle=2224,i,14586319556698226627,1639651423227306260,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:14
    3⤵
    PID:4080
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5708,i,242569533613410859,2096435954298010253,524288 --field-trial-handle=2224,i,14586319556698226627,1639651423227306260,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:14
    3⤵
    PID:3764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,12352632289135826687,2089848132104832348,524288 --field-trial-handle=2224,i,14586319556698226627,1639651423227306260,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1128
      4⤵
      PID:4364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5972,i,1057991941535338536,13519728134521777648,2097152 --field-trial-handle=2224,i,14586319556698226627,1639651423227306260,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:1
    3⤵
    PID:1724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6368,i,2706563582994189104,7345836339327052432,2097152 --field-trial-handle=2224,i,14586319556698226627,1639651423227306260,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:1
    3⤵
    PID:2220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6392,i,13745598045500734008,4915126994984208804,524288 --field-trial-handle=2224,i,14586319556698226627,1639651423227306260,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:14
    3⤵
    PID:5272
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6740,i,11135649092696816199,888175391856826793,524288 --field-trial-handle=2224,i,14586319556698226627,1639651423227306260,262144 --variations-seed-version --mojo-platform-channel-handle=6724 /prefetch:14
    3⤵
    - Subvert Trust Controls: Mark-of-the-Web Bypass
    - NTFS ADS
    PID:4504
- - C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.7-win-x86.exe
    "C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.7-win-x86.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2364
  - - C:\Windows\TEMP\{AD63D01A-D30F-4E1B-9936-E11D2129391E}\.ba\wixstdba.exe
      "C:\Windows\TEMP\{AD63D01A-D30F-4E1B-9936-E11D2129391E}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{6C5E28B4-4BDD-4B07-B225-5B31B9C03FFF} {F51D645E-86CC-4155-9A55-CA39C367ECF7}
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      PID:5248
  - - C:\Windows\TEMP\{AD63D01A-D30F-4E1B-9936-E11D2129391E}\.be\windowsdesktop-runtime-10.0.7-win-x86.exe
      "C:\Windows\TEMP\{AD63D01A-D30F-4E1B-9936-E11D2129391E}\.be\windowsdesktop-runtime-10.0.7-win-x86.exe" -q -burn.elevated BurnPipe.{BAFC387C-0E0D-4980-875D-501CC6E13C14} {D5EA5F68-ED03-4B1D-AF6C-1BFC80054158} 2364
      4⤵
      PID:3976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7612,i,16678535022602654238,9954258452270773670,524288 --field-trial-handle=2224,i,14586319556698226627,1639651423227306260,262144 --variations-seed-version --mojo-platform-channel-handle=7388 /prefetch:14
    3⤵
    PID:2380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7400,i,12721807889568074830,5229498641384850415,524288 --field-trial-handle=2224,i,14586319556698226627,1639651423227306260,262144 --variations-seed-version --mojo-platform-channel-handle=7372 /prefetch:14
    3⤵
    PID:4344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7472,i,8816731139126990196,7470836628399014668,524288 --field-trial-handle=2224,i,14586319556698226627,1639651423227306260,262144 --variations-seed-version --mojo-platform-channel-handle=7708 /prefetch:14
    3⤵
    PID:5568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7652,i,10864366675186935833,16275485007175551925,524288 --field-trial-handle=2224,i,14586319556698226627,1639651423227306260,262144 --variations-seed-version --mojo-platform-channel-handle=7400 /prefetch:14
    3⤵
    PID:5400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7672,i,13926778697560859753,8186142223142733965,524288 --field-trial-handle=2224,i,14586319556698226627,1639651423227306260,262144 --variations-seed-version --mojo-platform-channel-handle=7696 /prefetch:14
    3⤵
    PID:2704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    PID:1672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2b4,0x7fff5f92c188,0x7fff5f92c194,0x7fff5f92c1a0
      4⤵
      PID:5104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,10304733001292676712,18034546261974794306,524288 --field-trial-handle=2516,i,2818565328524287221,6251837010020736906,262144 --variations-seed-version --mojo-platform-channel-handle=2592 /prefetch:11
      4⤵
      System Time Discovery
      PID:3552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1588,i,5441272763850725578,2120753426004345354,262144 --field-trial-handle=2516,i,2818565328524287221,6251837010020736906,262144 --variations-seed-version --mojo-platform-channel-handle=2512 /prefetch:2
      4⤵
      PID:6012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2124,i,8091071701096241643,5888031994728109992,524288 --field-trial-handle=2516,i,2818565328524287221,6251837010020736906,262144 --variations-seed-version --mojo-platform-channel-handle=2648 /prefetch:13
      4⤵
      PID:2028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4500,i,8278035828638432605,1411742401163906132,524288 --field-trial-handle=2516,i,2818565328524287221,6251837010020736906,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:14
      4⤵
      PID:3008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4500,i,8278035828638432605,1411742401163906132,524288 --field-trial-handle=2516,i,2818565328524287221,6251837010020736906,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:14
      4⤵
      PID:5036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4920,i,2225355517371708883,11180618451047112786,524288 --field-trial-handle=2516,i,2818565328524287221,6251837010020736906,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:14
      4⤵
      PID:5652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4924,i,16261511203629290749,17254598340918012950,524288 --field-trial-handle=2516,i,2818565328524287221,6251837010020736906,262144 --variations-seed-version --mojo-platform-channel-handle=4576 /prefetch:14
      4⤵
      PID:2296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4928,i,18357989659219200599,6281178169637090121,524288 --field-trial-handle=2516,i,2818565328524287221,6251837010020736906,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:14
      4⤵
      PID:6128

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5432

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3344

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:5356
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding B98FA5B9CAC1AC9B027C383EB3FC1EB8
  2⤵
  PID:5324
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding B7B975C838F3DA532606654B05AFBAC5
  2⤵
  PID:4292
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding D4A4897BB4E72B1F84ABBD0047954FE0
  2⤵
  PID:2504
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 38A8ED129FC256DBB9F4A098AB60729C
  2⤵
  PID:5004

C:\ProgramData\Package Cache\{580865E1-2073-4861-8356-3D20DFF3D50E}\windowsdesktop-runtime-10.0.7-win-x86.exe
"C:\ProgramData\Package Cache\{580865E1-2073-4861-8356-3D20DFF3D50E}\windowsdesktop-runtime-10.0.7-win-x86.exe" /burn.runonce
1⤵
PID:5052
- C:\ProgramData\Package Cache\{580865E1-2073-4861-8356-3D20DFF3D50E}\windowsdesktop-runtime-10.0.7-win-x86.exe
  "C:\ProgramData\Package Cache\{580865E1-2073-4861-8356-3D20DFF3D50E}\windowsdesktop-runtime-10.0.7-win-x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.7_(x86)_20260506140750.log"
  2⤵
  PID:1136
- - C:\Windows\TEMP\{7D13570D-5997-4968-9B2F-902EC2A39E17}\.ba\wixstdba.exe
    "C:\Windows\TEMP\{7D13570D-5997-4968-9B2F-902EC2A39E17}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{8FAC436E-01D3-4D34-AC3D-5196B10ED89E} {F9D7FC7F-3F24-43E2-B887-76B4F6411118}
    3⤵
    PID:2824

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1392

C:\Users\Admin\Downloads\Velocity\Velocity\Velocity.exe
"C:\Users\Admin\Downloads\Velocity\Velocity\Velocity.exe"
1⤵
PID:1540
- C:\Users\Admin\Downloads\Velocity\Velocity\Bin\Decompiler.exe
  "Bin\Decompiler.exe"
  2⤵
  PID:4492

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e59916c.rbs

Path C:\Config.Msi\e59916c.rbs
Size 10KB
SHA256 bb69ac94a2446ed3fc4e56b45397a0166ce212cf2df247872f954308e9b9abd3
MD5 740abb523cf08d560e15cd506691a195
SHA1 6912f87a6503f4e65c066859bfc70f05809cbd05
SHA512 f64eb8dc3e8f4ba38ccdce458ddcc547164961afd3cabc5d89435a15cf71b6f3ef98559f8e11f0e4f7e0d7c42d302ba53884248ac0571f65b23404553f868c0f
SSDEEP 96:MIvJrAQ5tNa1n81RdCP1EQUneD2QPuCsThqJUneD2QPuC6jlF3MeThqVH5iyE5Mo:MKJtUhgCOvoNIboN6OEc46kdpb
TLSH
T1E2222001B640C2D3E89B0778E7131B153BBBC6EA671083DF01DD95785F6A7885FA81DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e599171.rbs

Path C:\Config.Msi\e599171.rbs
Size 8KB
SHA256 10f683eabee45c37add45405f40f47e3b5ea780e16b77ab45ed5eb500e905f02
MD5 b05e093987b6d588855508b542fa189e
SHA1 4470645b32f727ccbcea664340d918f6124a96f5
SHA512 028160f91ced13af39071b1170562ac3a03bdf683473b7e2e42c850b76cb86132e1bc8fcf2af6485224540ee823d7b628e862f567b0d2c6904cce6a7a2bf1620
SSDEEP 96:PFeI07BxAjrZkzCLEWQUs2eD26sPuCsThq9Us2eD26sPuC6jkzdYeThqRH1iUE5C:PF90LauCfvhNInhN54EKHV9dpH
TLSH
T106122081310186E2ED9A5B34C3871B24BFEBE3D79611129F25CD52205F8B7C93F642EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e599176.rbs

Path C:\Config.Msi\e599176.rbs
Size 49KB
SHA256 ff102adf3cfc44d7248dcef171e33784868061958bb3b4a813f42d3fb4adeb5d
MD5 9fc998567830e6e19d6f56b9471181ab
SHA1 2f4fe73e193827e7d9daa8e9fc9f258419131763
SHA512 b5ef94a3f0712532b5cd59f6cd5e839fe2e377e38ffe72c299c7b4593c4b940b147241d3a99a051816d931661aa9f55f164cf9c48ad8ce3e5cf5a9673760a2d7
SSDEEP 384:PV7ONK0DLsrmMwoXlhkOI5RBMgumgKtaz0XHpZtcMq5UGRWBHNfrL/VZih/aHfHX:PpWilnAThuthRa/0fxArH
TLSH
T11D334220AB05D2E3FB226C7133E1DD08EF1ACD627744DDA914C61665C5A3DAC3EE885B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59917b.rbs

Path C:\Config.Msi\e59917b.rbs
Size 72KB
SHA256 28c040fa1ffa98e6e99fb733ef4e79c665e96cc8e702dde03999c6cfce0699e3
MD5 b0dc7265e1277922a47138af86cbf98c
SHA1 9fa9a6907cfdbbac3a0367bc2d2adc107cf04e03
SHA512 55b9b7ac1c75ef41f6b409f3679c18bd9136a68e12fde4ce62acc3bcd52ccc41dd7086387ff3211b998598576a328e10a27c6407376113088f6e7b39e229e142
SSDEEP 768:/ONxqMomkns8EnoLou+PTcKsfNTGKJL040iA0qTR0P1wKaq00a/UzZYemq0KYFut:GNkNCnoLZ+PTlUN7umeGKymciu0KYu
TLSH
T1E0731F464B91E5C5FB325EB176B7EA4CDD035CBBA292493D20C9252ECDB3D882EE44C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE.txt

Path C:\Program Files (x86)\dotnet\LICENSE.txt
Size 9KB
SHA256 7f6839a61ce892b79c6549e2dc5a81fdbd240a0b260f8881216b45b7fda8b45d
MD5 31c5a77b3c57c8c2e82b9541b00bcd5a
SHA1 153d4bc14e3a2c1485006f1752e797ca8684d06d
SHA512 ad33e3c0c3b060ad44c5b1b712c991b2d7042f6a60dc691c014d977c922a7e3a783ba9bade1a34de853c271fde1fb75bc2c47869acd863a40be3a6c6d754c0a6
SSDEEP 192:ydP0KvBLCqikR/EgGJLrlwD+eilNi5Py1SDeoDXDw9lF5OMz6Q:PWBuqikR/EDJLriwlNi5KI1Tw9lF5OjQ
TLSH
T1EC12B57D7284177109D207E16A0AB9D6F62A953C3117AA2438FDC15923AAF2CC37F3E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ThirdPartyNotices.txt

Path C:\Program Files (x86)\dotnet\ThirdPartyNotices.txt
Size 77KB
SHA256 deb4427a295e1ed474b0d81c5a0d972c1b550b9a715cda939cdfa9236b1b418f
MD5 0d8867a25ba926e6e40cd52ab3536b5c
SHA1 89390dc8b8318d0bfef1c6a2fb4783537e28a465
SHA512 317ca335405274f4f91b173651ca2826760acb5ba5cf41aff51adc55c2cda9059fb268333665f13f62fa48119e55a303720a780dd58d28dd9967db4c88407d61
SSDEEP 1536:HA9jHwsGfgg39/zwgAVkguQxrDjugtSEGepkWvrpX7anuqdLSVnfiStPq+3LefrL:HA97w/ogz1AVxuMjHtSFULryLOgrGWm+
TLSH
T17773A45F7E45077319E2C3916569A8C5F22FA02E3B6B2A44346EF248133B42DD6FF858
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files (x86)\dotnet\dotnet.exe
Size 141KB
SHA256 8b6be8b21aae8f21fdfc0e15d350e072bd84e439c4d99e1ee8b6f38a61eabb5a
MD5 f25f2493a974dd8d01fb9410398c094f
SHA1 f6397f4c97ea07a57b846ded5c212b84ce0b25c0
SHA512 81f932c605c96e68e923e37c83eca1e1b24147b5435d3714d298ed1fb6f63ba2663d760d36441921ed80c923b0086a05ee5a27df1f853169c8d29edadcfda4b8
SSDEEP 3072:0078iKA/8gNs0xphwaNq92hxQOA7qVy2nY:0umQphy9z7qlY
TLSH
T1C5E3F725F9958162D15D1970CB29CE91BA3BAC619BE1E0C763C0FDBE0B701C0AAF5B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 2db13bf545d19a593d3f633ad5f56f54bee899b38554d729f7950707224fcc9e
MD5 34e57c9e34cbc737bd61ef89fc7d3606
SHA1 379e01b8ded7d01bce6bef37d1be6eb8cc1ec579
SHA512 d70aa42b426df53d23a1c2a848f20daa1a5ab0180d92addda5c247f186ea4db7475d28629ccf2cc01c140844b560e7a625554cb8a3f2911d53228c4342487845
TLSH
T199E02BB6CE25DC3709FD0B3C35800705EB5503172B41890F773D560E8FB163A865581C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 720B
SHA256 aba42f966f87b1ab786b6e1a04aaaf05d0776d1524e056d30d1d11b3203c8e3f
MD5 cfd4cad2c765c83387f298ab60b9414c
SHA1 e46642a49519c580f7860d579e8dfbc217296406
SHA512 1100574524870a493817dd7bc8142186c62f4fc65a5706365628964edf40c6ac197974e6c951c09a21de318f07c9b8856e22d9832865106083791f9d72230d48
TLSH
T107015506B496A257C3649BFEA3C2A91036F617243F033D212241C2B8E42C38B210876C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 f991ebd13679eaa5d5bdba54ae1e83ce1a461f1e0f05c666ec9438e1677fea6f
MD5 24cab0e51383013df8844b8566cdea68
SHA1 9856d27f896c0fb50bb1daa1678bb1e984a60828
SHA512 0ce820f6b7fc87cb2eb743a5bcf533b31d7dad794f161d31972811b8855c62e78d8a34d76733c58c302a742020408ce9c72f3ea275bfdda4fbe80f7b0c7b25f4
SSDEEP 96:D4KWaIa371LkSfbLUu17SP+lwWM8Vi2Fl6jhqkou:D4KWaIaL9DfH517SPZWM8UG0jhrn
TLSH
T1C591BEF3C3F8957D892192F8AB256F2FCD690914532C3D6689D4AE0B53F2972D24038E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 1f185ca1cba1cac1ac3c603ce29430a204be5fa814490d8702f0ab20770a1966
MD5 0fc14141b9cf80c4ccab6e5c63ed5b46
SHA1 5d8b97996d7f03067c2442709b8a57c2125404a3
SHA512 a3ad6bdcb27f93ead58321fa21fad93e7f32cf1490ef9c0f58dbd3f55737d46d776c978b19caa57e5cf29d29708bc0660ef651265e2a564c5228a6a7c9f7c9de
SSDEEP 96:D4KWaIa371LkSfbLUu1ueFHSP+lwWM8Vi2FHu:D4KWaIaL9DfH51fFHSPZWM8UGO
TLSH
T1A0819DF7C3F8957D892192F4AB256F2FCD681915532C3D6689D4AE0B53F2972D20038E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 379e47470fb265520484a203afa4fcba73de52dce5662ebba56fce13a3c0340d
MD5 b978ea3cb048eadeba67141d2f8c0673
SHA1 7410f572c9470c2fcaa94c77ec8eb31e6d67d0d3
SHA512 f696805fd0ba586a59b2186f8202274880fd0ba1f55ddf1035e773404818931153734e73596c7894859f8e97f7bb7ac3578a5107ceba14d02dd1eabd3a6676e4
TLSH
T1C0219DA393BEB4A750BE48F66D4878163D7FE431019294F9DE67912C60854F30B1A476
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 1e42e1ae47c666e5255197544cb39d5fa779b5cd58a7dadf59a5260fe1d0c772
MD5 a6952c45da279247e35a86f6bae73a6a
SHA1 12344e3deda422c844d30c0bb5f9ca1315b0f4da
SHA512 032488b6e0b900611887854d55f5fe261aec828c3e677152e0b5783d997671f808ac8bb2b4c6ba7dbbabde5bbbd2c066f63f1a99a6949cb15901c4839715c7ce
SSDEEP 192:+Rxqe1KnmMkEv7ghAPRp2B99Hsb+WNn5v0bkPD6kwhTfa9lvVyIsnAUgraJ:+RxqWgs8Xq/wt0oPeBra9lJe
TLSH
T16242E72EB914753B9CDBD219FD21BB17E7F5102125842E88EAFC8A2C18D79CD6217027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 e6a834b9d736e444d4abc35036ed55a4f77619e2e859e2ade8fe034a2d75e70f
MD5 0309930d43722b589b19bac01a835388
SHA1 476e52863e22927a89be302707df9cd8a783a199
SHA512 d9275ac511ae612cfc3d7dfd44e0d1f77010c05473f852e18d09b438ec9b7260f5191bc6dc573beda61d9dce2e0eafe71aae1f52d5f52b135e7feaf206e6ed53
SSDEEP 192:+Rxqe1KnmMTEv7ghAPRp2B99Hsb+WNn5v0akPD6kwhTfaslvVyIsnAUgtaJ:+Rxq1gs8Xq/wt0zPeBraslJ8
TLSH
T10242E82EA914753B9CCBC229FD21B717E7F5102125942E98EBFC8A2C18D75CD6227027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 8c6225bd5d2482eef4c6e1954f94750d9bee0694e1985a77820e327ac4b0bc8a
MD5 528145aa3e0fc948440d65964f582ad8
SHA1 6dcecba11e87eae49ca65b5aef5e512d9fbb7e73
SHA512 56b94d5f83565766681a02198ea2214f2f8bdfdaa30c06f9f5fa6034bf143cf4813cb5fec873e669156bb4ce7829e378316d0ff93888cb0851d9fb4d8694c74e
SSDEEP 192:+Rxqe1KnmMFEv7ghAPRp2B99Hsb+WNn5v0akPD6kwhTfaslvVyIsnAUgtaJ:+RxqXgs8Xq/wt0zPeBraslJ8
TLSH
T13342E82EEA18753B9CCBD319FD21B717E7F5102125942E88EAFC8A2C18D75CD6227027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 8f74fbb58fe89efe78ff7faeee69be6ef734c2ed6cbdd34e508759eef962bb20
MD5 98c526bbe78e6c21f095ba4617168af0
SHA1 6e775f9712ce541c444cc164dd70b48f7475f0f8
SHA512 cda5b5085cd33f5c1a2979e580fe84fd34accdd4ae86e6d8d3fedb4b9def6cc2feec6051259133ce4b3d393f6e8afc70ac007a295f51d0e64fc18400b435fb0a
SSDEEP 192:+Rxqe1KnmMSEv7ghAPRp2LlE99Hsb+WNn5v3iI2okPD6kwhTfa9lvVyIsnAUgraJ:+Rxqsgs8XV/wtZ2RPeBra9lJe
TLSH
T1A452F72EA918753B9CDBD229F911B717E7F5102165842E88EAFC8A2C18D79CC621B027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 0ace0e369910e75f27a5ca63a4739ae6e392da98438a00ff685eb3efda2f56e6
MD5 aec379bad3b888dd824e0dc45b881b52
SHA1 0a5d4a6dfbd8026c7f77c2e2c6aa1f22062a282a
SHA512 1f80f839f87f2fe1f07b5047399b6fa5dfbf937d91249b3609a21eb4463ebd12d4efeef1ffa53e2411944add3a1f3948680a898a2b632e90389f21376e9f7bb2
SSDEEP 192:+Rxq81KnmMSEv7ghBPRpiLlE99Hsb+WNn5v3iI2JkPD6kwhTfaplvVyIsnAUgraJ:+RxqKgsvXB/wtZ2uPeBraplJe
TLSH
T19B52082EB914753B9CDBC619FD51BB17E7F5102126942E88EBFC8A2C18D79CC621B027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 82085f58435b7b7a260780dca3ee69a48427de11b3ece82d53af0d56f36fd555
MD5 92547e8f34c99d1b69c0e1d957604d80
SHA1 4ca5a2d93853b96b7fc565a0e16045bbcee47e58
SHA512 aee9857bb3f81b98b9310e49ebca2773ad80f91201f0efac2260b404123571baef569acba1d144b7aa20664020dd07820f3547f4604d3bc6c7d155025f48eb07
SSDEEP 384:V3jBM7KxkXqKf/pUZNCgVLH2HfgslQwl7pLuLcifTuXODBU+ErU3bwxHGak5Je0o:VTBM7KxkXqKf/pUZNCgVLH2Hfgsi87pL
TLSH
T1DE72FA67AC4CAA370F94D6CCD827BE4FADB5020B65DD886883FA581903D5ADF110A1F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 913111c01992b2ca4dc767bc1609195dbf93f830de8b978f2e275e0f4398222b
MD5 ab0423a0cc5785dc50f5ec0dd71b6e8c
SHA1 eaa92d7b1edf5ad812ae4903158829df27b11ff4
SHA512 c39c719ee12ebfedf19eaa0d1bbcf74cdd31749fb63aafd7451f2a79a587210bd0ca582cb594618c08d8fb57463334283d35eac939882f09d6bc2be900256757
TLSH
T163B01210A0016951C09312F512C604D831585F108705270263E5EB71D8261A14024160
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5866d3.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5866d3.TMP
Size 96B
SHA256 8dd1c4593803c503a7bdf22a53b85885b15c1bd8429ed3c4cf38cedc8db80635
MD5 ddb708a8fcdf4f97218dd47c29ee11fa
SHA1 695d22f9a604d19bafb82fa3ac809c23eb769b7b
SHA512 75c85404865a2c3362797b6237add33ac6837ed13df1d2003a079a25fc09b017325321965941118191f898befde82ac3e5c5f0a66e2de0ec0fb4e77d4d687eef
TLSH
T116B0220AC0023222C0020BB0FEC0C0C8F2F2CF30CA03320282E00BAACC20A30802C022
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 198KB
SHA256 6fffcc54cfb193517261a2020122265729b612265332f1ef590f0a3e11e2c771
MD5 fc089c4783feb06903012cbdcbf79620
SHA1 20aeb993d672d9b5195f5610d65d4e6280c20c2a
SHA512 8f0fc423c768f554d7bc7ec4cfa69d528ea5b6b644098b074b9fa058b8ae4219fec17d28c77179c03ba830b107f3ea92490ac6852126c7c30fd741774734dcd9
SSDEEP 6144:iPcU0FE1S+G+Djk0+bH+9rJ++JjcMW2VcVLj8:onZG+Djk0+bH+9/OMWt8
TLSH
T1C51423A39E1EBCBC534E92ED1507ADBC0D9692CF0220D5FC31C37F5A159E341C68AA96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 199KB
SHA256 ddb35a9d0bdbb1e09ea04f4ec175164ae7189deca2e7a260f62a6a867ecdfe14
MD5 5cf802b2b72af690eac01c3a09a1eaa7
SHA1 3c2447f086124bfefe4adaf6ab4a7745878c6b0d
SHA512 78f7292e5c0be2b1f2abd8e0fd33a83c9d41d3453c8fb450661e51477ad290d3aaa4c82f61653d91ea36fba6f595d576e0d18c9f634b24fa2f2689c52cc3d500
SSDEEP 6144:9PcU0FE1S+G+Djk0+bH+9rJ++JjcMW2VcVLj8:JnZG+Djk0+bH+9/OMWt8
TLSH
T1881423A39E1EBCBC534E92ED1507ADBC0D9692CF0220D5FC31C37F5A159E341C68AA96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 200KB
SHA256 509ebe8c74c2695ed2e0f41d139df27aae6be63859da9e2bbec8d13e4a60a96f
MD5 173f894d8dadc472fe8721e297cb1a46
SHA1 69c65321c747696bd04f79a27c8a3d22834329e5
SHA512 523d61131878e6a2725437d59c9c3fc3e2853828e85ec916457b48910b02c4ddc21270168bbbf816102ffba7f81d05ea7e566f836712e3d8d1835b8c488aa4cc
SSDEEP 6144:SmPcU0FE1S+G+Djk0+bH+9rJ++JjcMW2VcVLj8:znZG+Djk0+bH+9/OMWt8
TLSH
T19C1412B3AD1EBCBC535E91DD1507ADBC0D86A1CF0220E5FC31827F9A159E341C68AAD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 b2c41906b0debb94d01cc054fedd4d89046f95d7443f3150fe255d1d8a5a1631
MD5 28f341a4a8e22b375c432fe9bc23c193
SHA1 d8684d1bc8c60fd447ebfebc535c4a3cfb61659a
SHA512 597247888abb8f1f48a98347c4b5d60fb31a9afac64be38e7413fee9793954fceee2d7f4ea4d38553b2b1e2cf4e2bc1627ec06f4c83a330d3354bbda5768bc6f
SSDEEP 1536:ub+P++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNJm:F++J3qUQm08KMWF0bFTcVHr6zqm
TLSH
T17F9312B9591EBD79636BC696A0179CAC4CD3CCCE111055BC30C76F1E18BA392E31B8E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 199KB
SHA256 8555b93c1c45692ad70a3989e0a449306d927632eefcc5e4155dad6beae521a2
MD5 bcef3284ae7b11e1c41f8bc00ba2add2
SHA1 adfa49558f2d46c977cc5d39b31b63251ad71a14
SHA512 42d6c045f9572260f1af80107df37487707dd0139e8059a37b2d88428448e2bf9af93a80932808011faff9335fcfd9a1a6613c60b5b8b083ec744dae65fc82cd
SSDEEP 6144:3bPcU0FE1S+G+Djk0+bH+9rJ++JjcMW2VcVLj8:bnZG+Djk0+bH+9/OMWt8
TLSH
T17D1412B3AD1EBCBC535E91DD1507ADBC0D86A1CF1220E5FC30827F9A159E341C68AAD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8d9e7887a6cc5b1d11b67b1848c38f9899ca7b6a5bacc51042792d3d7e2c0d58
MD5 8fa0b3bf8175106d57e21c006993876a
SHA1 672afe4a7e7441011280df51198b0c4a6baac963
SHA512 00424d5ed4c242255591e6bc5435c2282425d2cc566f3815b00657a0a8e8d3829b4a1ca16672ed37646848fdeb6921094ab6337cbc5663d5fbeac89d682f6ac1
TLSH
T19CD02370F399D412D9AC04716021D3D41E5BC58DB4CFC1C5F31D845DD6D515A93D6193
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8df20847d324544fbe366e90c2b20d90df8a967893da4dfba9189cc3852a0f77
MD5 2efc2397049b9f97cc60f94d50444079
SHA1 1f64bd54047d19d33da81b46509ee575d16f03db
SHA512 b4adf713e9627f45925c17418fc731d40700a80ce57ddbfc906316e2e49af81e56298f77790fd8e98468e5ae7cdb6c53ab460e6d728dfccf25896ee1ebd8f6e0
TLSH
T12CD0A7B1B38DE462C69C18F16020D7C55B97849FB44BD7816158C4AD9586159A2C6242
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 09d43745b7beb0d2574056dfdacdb3449b786708a0b1a5f978e5c9d69f81a1ce
MD5 c5c86d9c5f7c32a8c4fd09d6ffda4aa8
SHA1 8d3978b900d523ba08075019d6235c1e176294cb
SHA512 e14f89cb3354fd6d7a68e1c291c8723a5bfd3d28140a150bf75ef42a2ef8212eddaed6f6db92cd69e603806f0897ef93b8761a51acd8b8db67878c4cf26ee23d
TLSH
T10AD0C040DAF02820D8046471242CF3C00E09CCA1CC43DA2124E0EF798D820C644C0DD3
MD5 SHA1 SHA512 TLSH

Submit Download

070b1747-770b-49a3-8d83-2cfc9a67d682.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\070b1747-770b-49a3-8d83-2cfc9a67d682.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 f21ab9b6fe16e6b0677dff59e2bc1c48ea9c56b01f0a1c889b766321536f04a3
MD5 ed3d6e1825614a9ce6c0774a8d1e183d
SHA1 30b82c53e94235850c614419fde8a586a0fd84d5
SHA512 39cf97ce95bd1b3ebf479d1f37df01a3375f26442c569a86affef060edaa938eea1bc5ff37aba0b468fccbc43f8931308d6434ba29e75312a8a56172f6258987
TLSH
T1EDE022AAC865E82B0CF92B6D60644746FB6013572A4189CB3E3C920C8FB4E3B568681C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 5121560c2819301288834e3c0f39eeba36831867ed5a2d3c0a90f8b5e93e7b32
MD5 d447b737ce468aaefebbbc2bad968f59
SHA1 436702db8d0d64189c1c370b7ceac0d2d9f3dec9
SHA512 6f692410b00790bdafe35573bb592fa4cfa43e2b5f79d4deec249ca9c6a0e24fdee18dbd4d7298736339df7e0c54a47a4d3d53ac13bf9baa90958af2363903eb
TLSH
T12E714C902CBEB467F7E188B807E5645375B0CB9902D71F1A17DCC8BC8A4EB64C081D28
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 475764ba8bd02f9a3edf5d5a78dbef117e02625fc2bb350883da8970ea96acff
MD5 e7eaa99326cd47c5389eb01452977f25
SHA1 5c97f0cad9e1395ee19e183dab8b24b29a1be00a
SHA512 0818911a8cff8b40aecf3fcaaf9065f9e04dd888ad69919a42b4f2b422338c88182fd5294035c967f77bfba71afceb1ab5b7e6de5d5b343c16c5ce98fc258e00
SSDEEP 3:MsEllllkEthXllkl2zEklXUKtl:/M/xT02znEul
TLSH
T1B04404147FC00C05C50510744115D3540370F4500511775334574713DCD55C00D44070
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 5bf9579c8be2a087317368e012502241c39f76c883de060bf768343f111d1390
MD5 5758a9af10c998309646f8474ea7a502
SHA1 35a9c22664a72b666d9d1425a4760c8e6b337bae
SHA512 43663db398a42c5c592250972e76efe7d5608d09d81f1953a6b172fc8caf9b68e48394373b2985208d0d64f57ca48e8a3872914d6e776ced4e2faef8e10c4984
TLSH
T137519EF783F4856E8A1196F0AA18AF2FDF2D0515432C3C5A89E4EE27D3E3471E14165B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 363d72c780aef895d1f2358758f8d07203bbd9795be0404b5b76127f1c599c92
MD5 fff2b590b8e3f9d4e21c4fb7591d7742
SHA1 2388eef005d155716bece669db4bb1924b66aba3
SHA512 3882a8314efb5d905e087440cf030c181fabe96e359bee6b96a7dea293b60e1067aa8fd0f99e22adcaea20f7d4e9a5a36f859c9e583532641c7fa68bfa64a8a6
TLSH
T17B51AEF783F4856E8A1196F0AA18AF2FDF2D0515432C3C5A89E4AE27D3E3471E10165B
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 f7698c7bedaa8f74761a223c13041b0ef9993e729e174a8893f4a2ae22e32bd3
MD5 6f7e81bcecaa8a44936e1d8d5dff8858
SHA1 2a42bb034aa6254d8ab0b3b0cb1cdfa7141952e0
SHA512 321270f017f52a3df7a6a3aee3d9dac4a8665cf9a4b7e19abccaa0ec9a446f89a65efc23b3fdeb7239ab1c00d0b9223eb7c169e989b423b5eaee472e9b4217b0
SSDEEP 192:sxZtRKyMqZ/K1Ml8klY2/fYsw2WpVM6c+05zodp5v/W6+WNTa5B/Y0RJ1A25IgbU:sxZtR7Y2/fYsw2WvM6c/yB/bC/5uE2x
TLSH
T16272F905A938997BCCD7D619F685BF53D6F81423A2945E449AFCCA0C04E7BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 8f344bcb71d24f546138378c13eee760c6ea053592cc2b356fdc7bd4c2da492c
MD5 1bf0587e327760cea446cc489a049292
SHA1 abbc44addf8e9eede241f3abdcc4b87be206eb86
SHA512 99574f165ec36bde82c6bebf40f879a34055423cf588868c021cc2065230a3bc4b8b4ffd662908341c1e8fec250a98815ea222162e82ea7bc50c484ce0b32462
SSDEEP 192:sxZtRKyMqZ/K1Ml8McY2/fYsAo6/HOwkNQWzodp5v/W6+WNr5B/Y0tWeAgfIgjzJ:sxZtR0Y2/fYsAo6/udQtB/bb/564jl
TLSH
T15E62E9156938A93BCCD7D618BA85BF53D7F9156392844E449AFCCA0C04E6AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 1130274ba34bf1d0dc9e427bbb4e63df5d13bcb54461f0d4f924087b81c3b555
MD5 8b3ede9117e9d3900212842e50b2c4bc
SHA1 b6abb59671d41e0ee7658c396cb0a30af21074c8
SHA512 2462c8a26466f269e555279ffc24ad49bd60948a6854cea9fd77ab7ea5170ed2587eaac7fdcfc919af0f81476e1f57823ecc665bba5b0b4349dcfacbb9c716e7
SSDEEP 768:2DhVP8b320P7pLuL/mKWRmmeQRe8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3HWWlLlV:2DhVP8b320JE/mKWRmmeQReu1jaKHWWN
TLSH
T148031B3B280CCB7F4F844E9CEC27BE9A6DE8018B9698899447FA444C03C67EF55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 70189b6c8aaa54b312b55e007cc670913447bf89af97168d4c40a6639726441d
MD5 891ba4c70437bb0584af8acc9636f290
SHA1 abe8aac4b139e5a72b59fa6b63f5a9b57ab645d6
SHA512 787d5c011cfc18de889c247bc1ac3c68bf99ff52c87c5ce318bf7db7d88e50626c1cc02cec5c5c87511a24b173f69fcf7d9fcd7db13634983b2c6f561a7df36e
SSDEEP 96:KcMgKNqmuzuK8AzGYK7CWiGMKrqkEYKR6kGfOKUMLXaKMg3CWIKnKYfeKQo++JmR:qD1rjvYZ5V8fO9ddTXkrno9BBFhR
TLSH
T127B26C11313B13903ABE754A9155B8AF42C271633114F87B7BB904AA4F6BE24DDFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 29KB
SHA256 1d2a4ddf638e26708738a6b0d858d9db8417a59391d95eb3969fa754e706d15d
MD5 2dace748d69854a179456d5ae73d3f74
SHA1 132c5cb552ca595c3de60857a81dd5f631191037
SHA512 c13e8e9b7d9896facf605f3bda864dd3f4534186682920fec998451612ffee902dcafdbd05f7804c00d481a7cf979c25384bfbf4b959533fca09d322bc148555
SSDEEP 384:n3PiF2cXqnv8NP8TUNTUlIRVdnO2+4Or4LOVUGOrfpYQKcMLl5aFgSOx95jbf1r/:3aFkvgwgXdO2ZSUDYQ0uxOx95jb35bwg
TLSH
T1FDD23939DC55CDBF9CDE6F89A24E76539DE01273C5AC4A98EBC84F4C00A349CA70B825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 f56453ac0d042b969be47d01e14170daa1994680a4d25957f8377bf763d554a6
MD5 f72cd9a5cc3efb42ca5f1c13bd321e61
SHA1 2e191d83f9faf32e92b669206b5e63e9f605b876
SHA512 acbf3c766448ff4c52805fc624def5bf407f8cd8037e138248a193fcd3ae027196f7fbd9051d8e9b0b0c4897345456d16e4c3ce52a02845b5291097d4a3fa0fb
SSDEEP 384:naiFavqMg38Nm8TUNTUlIxBO2+4Or4LJmqSOrfpYQKcMLl5kN/xEIRYV/Vw1mR56:RFayv3dwgO2ZmqHYQ0MpjRYk1m37Fc
TLSH
T1AFC26C35EC54C9B7EDEA8FD9E70A7A03EEE00167D98C4AD8DAD80D1E00D719D230B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 4d44636f2f6e3959818a8b340dc0e10ac048c25f30d68335d40a4b587db165bf
MD5 c4ea347967b5db482c65e22e1c5fceb6
SHA1 d2dbec6904a04705fbb9435b356b43faec47cec1
SHA512 39ca50e1cbf43a2f5901a7576940e417ab9cd5dc454c0592246b744112c3110d1aff7f16d0f713e9559f4f105eb0fcb6701980cf0f170f13a7bcea1868e1d304
SSDEEP 768:3rFkvfwgXdO2ZMUDYQ0YhP7x545wQ95bwbF:2vhdO2ZMm0kdOKQji
TLSH
T15DF2063DEC5499BF98DE6F89924E66129DE01237C5BC4998EBC80F4C807389CF74B925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 1dce992bff86bb2fbc49704736fc6b5d18e2bcee56b211beef55c3be680275bc
MD5 73bd45bfcd234c747365f612f33461f1
SHA1 4e9aafdc58faf4fd74f3f48abaac42f33aa0721f
SHA512 3891b7abb861d04f5b23198ffb46a69ee25476e503f9a4b5db3b3405d7712fce51f597af82de131110cc688c2b2560d2e9f003f12d508cbac9a9b139d3a63ea4
SSDEEP 384:nNQiFavqMO38NY8TUNTUlIRBdnO2+4Or4LbNGOrfpYQKcMLl5YXmipPLGrN1k+5Y:NrFayl3fwgXdO2ZDDYQ0YhpTKA
TLSH
T101C24B71E868CE67ECDB8FD9B74A7643EEE00167898C8AD8E6D85D0D00971AD170FC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 b8313d821341166a04eb82a4eb10c2aa5566b86de4903d5ed0e1b4b8e12631f5
MD5 54fd36eea9b3adbd1a963ca8f6069154
SHA1 e1afa53bf15f81acd80b0c480c2d57c0b4d18e79
SHA512 a4238e7db4095feb9da6f8937afd3b7f419ab3fe476896257caaa54e4057dd5ab284d0cdf9fd98e1c658be51bb66fe62b0e03174e261f236606773782e161ac4
SSDEEP 384:nNQiFrcXqnN38NY8TUNTUlIRBdnO2+4Or4LGNGOrfpYQKcMLl5YXeipt1r55bwLF:NrFzN3fwgXdO2ZGDYQ0YZp95bwbF
TLSH
T1DDC26B35E898CD6BECDA8FC9A34A7643EEE01163898C4ED8DAD85E4D008759D170FC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 972b7394526c429dfcb420491a7fd396a7cae12b06042b060826bcbc8d3445ee
MD5 36705f08c5309c5e08a30c26f7d18521
SHA1 dee91686c141ff077f9d0c69f3ad62248a7afe7a
SHA512 365f61c42042bde67f82303242d4c4703215e69b910dc9fd58bb235e4beaa4d2a08278c01768e50a4e51fc0fed4dc0be71f14374d9fb01afbe1eaa1f792396f5
SSDEEP 384:nNQiFzcXqn138NY8TUNTUlIRVdnO2+4Or4LuNGOrfpYQKcMLl5YXeipt1r55bwLF:NrFL13fwgXdO2ZmDYQ0YZp95bwbF
TLSH
T1CDD25B36E898CD6BECDB8FD9A34A7643EEE01163898C4ED8D6D85E4D008759D170FC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 8309bc6e4577b9353241c0a674b055a8df8282299570ded6ac359936331f3f67
MD5 39de9d91e32aaa8dce972471e54c27bf
SHA1 7fab4e01353cb0366b68a796d1507e91d8f0da1f
SHA512 8ff6ff72a4409136a3de3bc060902303feb36d2201c7899535ea29dc6bff31041d090c61455aa4eb25ed101d1892fbddcd8dd68e0220f4d66ce041e4065da07b
SSDEEP 768:3rFkvfwgXdO2ZfUDYQ0YhP7x545wQ95bwbF:2vhdO2Zfm0kdOKQji
TLSH
T12DF2063DEC5499BF98DE6F89924E66129DE01237C5BC4998EBC80F4C807389CF74B925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 f07af7f209124928671d54db211f61c046bfab8df456cee5da0ed5b783a32933
MD5 6429ecf0e0ee93389dc147721632c7b9
SHA1 5320ecccaefbd50679aea482810d42ec5b1878f2
SHA512 aeb16426f3ab757d01d6571da5b859fb5d828b196dd90735a64083afa8f64a4fc371fd6c2f98b34156f8f9acdaef505f9b35645b50fa19a8b7872965782eeef0
SSDEEP 384:nZiFavqMg38N88TUNTUlIxBO2+4Or4LM8nOrfpYQKcMLl5YXGipRYV/Vw1mR57iR:wFayv3vwgO2ZxqYQ0YBpRYk1m37Fc
TLSH
T1A4C26C35E858CD67EDDA8FD9E74A7A43EEE00167C98C8AD4E6D40E0E009719E270FC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 54f761e00d363bd15db7bae3cc55144c80148a5fa1db7c3c2049e0e406a9142c
MD5 b1ac780361002049b0a10a7fd30fd809
SHA1 0ee0a7dc27fd175ab7abd6e5649890be3e2795b5
SHA512 1bd8b1d2dc30bc62728d3d08085a446e8c037b02499687affa9a0bb18c6bdfee19104eabdcd8a52c2d0b542046abf26b7fdf81815037d4923e31231b0dfb7d60
TLSH
T156C02B5538F9488C2FA5257ED238092E12E4C912310022B0002ED804103465C13A0C2F
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.7_(x86)_20260506140750_000_DotNetHost.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.7_(x86)_20260506140750_000_DotNetHost.log
Size 2KB
SHA256 d15f34239a6a5f4cf3557e92a6257f067b280a4044c23ac37287623bdcdb4886
MD5 1ad392c76600177dfb76cc13d9eac119
SHA1 5f729580fa67bc19a7a929718433b2903ecca0cf
SHA512 5a68737d568cd9f3127913a0490dacb46b4aa60191c4c577805ae51694b9d534e4944a06861d45cea0c3b278b15a6248bfd9295d706becf0b4a9e655cdce3e1b
TLSH
T18B41F7652BE50905B1B76707EEF3C1526A33BDC5A834CF4C3349821A066BD025DACB6E
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.7_(x86)_20260506140750_001_DotNetHostFxr.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.7_(x86)_20260506140750_001_DotNetHostFxr.log
Size 2KB
SHA256 6bffdf40e8aed1918b3e1fdc25afb6d00a0c10e19e7cac241240faed35233ab2
MD5 e76d78b48ec6da2818cc69f79762ce28
SHA1 e0a6fb22490c95902ea7571b0730eedab4f28a16
SHA512 2efb76f87c66e01a0b35ab7934077a7c21a67857160405936bd2c80843189b2dcf49ef91ab3afeb65839e8e9afaf715d6cf63ce4cfd7add70e667c79dcd60282
TLSH
T1DA4127991AE50805F2B79747EEF3D1122A33FDD5A834CF4C32884219066BD0269ADB6E
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.7_(x86)_20260506140750_002_DotNetRuntime.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.7_(x86)_20260506140750_002_DotNetRuntime.log
Size 2KB
SHA256 b4451ea6979f3e2ad6975c2bdb09dd372747bcd2739cf2350311735a1df45915
MD5 d5f551d4eed19c245087c2c1dff3dee8
SHA1 df618220d4e14ea3041f61c53c914ab5f522bd7b
SHA512 10617e7d3a0b0d2ad400e8d7c70a4d42ca58069d14bb460268b02e91cf197cb470bc41bb7aee92cd4e573eef20bf99d2625d3a5a07633b93e7d5422759fcc133
TLSH
T14841D6551AF50909B1F7570BEFF3C1526A33BEC96934CF4C3248831906ABD0659ACB7A
MD5 SHA1 SHA512 TLSH

Submit Download

DotNetHost

Path C:\Users\Admin\AppData\Local\Temp\{AD63D01A-D30F-4E1B-9936-E11D2129391E}\DotNetHost
Size 900KB
SHA256 efe1a594f21ea09c5c6f3f75d5618df0ff6bb465e1b7a440394eeadf06d86bdb
MD5 6b8563447431316d2fec41888d36a80a
SHA1 12e0efe2109fb356fa980e7bf7575fbd248cc64c
SHA512 9007dcba3c7adcb29aafcfd77e18a398903cb65f53e51b04c351625751c8fb95d29d2cbc34a232feffc95f900af956d7a75c9a7b3e434a079d9c72c41ca39845
SSDEEP 12288:8jcnTi8XiHmGdKkg78We96sI+yDxTYwsoCm1p:ecnTiadGdKkg78We96FDxTYwsvq
TLSH
T19C157C23BC419036D9EA0D72A438CB616E3D7D14279488DB9390B94DFCF06D26FB26D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetHostFxr

Path C:\Users\Admin\AppData\Local\Temp\{AD63D01A-D30F-4E1B-9936-E11D2129391E}\DotNetHostFxr
Size 956KB
SHA256 767110859ec26785e7cccf654785f32e3753b545a6c9003d55bd280da9b395d4
MD5 85dcd01ef3e23d75cc9b6ab925f9eb5e
SHA1 64f9491648d78d252bf06c30f042a8def4a203e3
SHA512 a9faab719ffd01d6a6c3ae726679bdc711f9c1311787de148ffc8870611769fe4798a87b6100d0262e3efd04cdcef0bfa7d64316ac6601cff07057d7a8238475
SSDEEP 24576:lcnTiadGdKkg78We96FDxTYwsvqV8iw+f:lcTi8GExDdYwsvlhY
TLSH
T154258C237C41A036D9EA0D72A478CB616E3DBD14279484DB5390B94DFCF06C2ABB27D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetRuntime

Path C:\Users\Admin\AppData\Local\Temp\{AD63D01A-D30F-4E1B-9936-E11D2129391E}\DotNetRuntime
Size 11.6MB
SHA256 1cd7916560b9703320d67fa07ff212426c98a653bb6bb0625a581f3541002391
MD5 c0a32b7151cb5be5cf1f979378354d39
SHA1 4ae96491eccbb540508023f7db445554d511352b
SHA512 d12d68462d07e8158200d33499bda3002fbb38acfeb5c0a28bfa11c93f199a48c6d5d8fb2291995873c650000936dbe118ff3cc9384f2c01a52ea391549dcf38
SSDEEP 196608:LUEkUHLgEvySMwD/dCBAe2IlCK3F7HK84TlvDFw8cwW7Q1MG2XTqt1/sbjD+irTC:LUErHl/lgAoF7HKZNDnc7ORmYGD9rTKT
TLSH
T175C62323BC42A032D5EE0D35A43ADB74193C7D60279859DB93D0BD4DF8F02D19A72AE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsDesktopRuntime

Path C:\Users\Admin\AppData\Local\Temp\{AD63D01A-D30F-4E1B-9936-E11D2129391E}\WindowsDesktopRuntime
Size 11.6MB
SHA256 a9d121791627648b5ab61a0c5e7f43edf4c691b5415564f7b8c5acd5263a0ed2
MD5 7be79c6aac947c413d9878fa9cfaffb4
SHA1 e196152062023c203011c5590924b10052b51a7b
SHA512 28236285f67089ab85d3056878aba8a0b6e9df44c5c4b78c04a301ca5ea9a7c27b50a283328eef5f87ed04ede6737e8207fd43b38eb9efaaf9522cb81be4e30d
SSDEEP 196608:jsskolsHoGTaIRHWh1jL2RLNaHao2xw1AowWyHAetWS29cAus:jssvlsIGea2XGaHP2voVResFgs
TLSH
T174C633137D939076D6FA0CB2A43ACB60283DAD14579448DF9390B84DF8F05D29FB2AD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Velocity.zip.crdownload

Path C:\Users\Admin\Downloads\Velocity.zip.crdownload
Size 12.5MB
SHA256 4ba3a8a29a4adaf21f304239e3c769d4f8da809106e01caef80945fd604b0076
MD5 69c1ec1744daf4c5dea14f428621dbce
SHA1 a01c9792d87a5ee761f1953794e5f08cfa3f600d
SHA512 743cd36db333c7412c9581245c7c570313791ac9c2c3311bd5d5cf425a7a0b47751b469b88e7c5216acb6afca8b1385c9ab0d32f7d49985195de3e748df1120b
SSDEEP 196608:VsI43uQZN/rzCs2jNH1CKuXYAISerbwoCFWOB3sMXcz0hNRcY8m/gSTu/gjwGN:VztWN/rzCVNE1YbjC8jMXc4Vv5Y4V7N
TLSH
T155D633DD9EA26F6DD17F3873501859CC4FAD296AE5ED012630A8E0C96AC35FC7C80C66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Velocity.zip:Zone.Identifier

Path C:\Users\Admin\Downloads\Velocity.zip:Zone.Identifier
Size 162B
SHA256 8e251dfd76983d1b8505ad292c82639cbb3adae2be5624dcad9571ba0884e348
MD5 7fe9e94363f4816f9fee79616a979a0a
SHA1 676d1e05a658c8e7a7d77f09a9f83a9d8283cda9
SHA512 da2ee6dd2df004501b303ef17bc44a4f6c98789831785af218fcd552f26717490a2887c2a88d9b8b3ffe241ebe488cb941d8efa21f7571982c8359fcd40bd9dd
TLSH
T1F6C08CE3480498810A5836C46DB9A2A9F88F99448EAA8A04D440808B78C9C20DAC056A
MD5 SHA1 SHA512 TLSH

Submit Download

windowsdesktop-runtime-10.0.7-win-x86.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.7-win-x86.exe:Zone.Identifier
Size 185B
SHA256 4423e7b7a7e49693d09e6fff75f573ba0a43c10bfc0a9e8040caa0920dc5b0be
MD5 ed9fc2d35e3884ecd183b9c3b23a1c9d
SHA1 80669794b594f34131ce1f955325ad5f5f60ab06
SHA512 bddf79cc48cf6ce80e0506687696f54cb9913f7babec90f355b394b128c4295344d70e4f222d0033b4d53b76c75dc172da06820d416f5a352d6b061316971e73
TLSH
T1E3C012ABC80144520E3032821B6ED559FF0F1D125D81C38898C48096E992AD6C1528D5
MD5 SHA1 SHA512 TLSH

Submit Download

MSI9532.tmp

Path C:\Windows\Installer\MSI9532.tmp
Size 346KB
SHA256 1caa470031f4f3fb53bb38187d522990a3a7423476b1b5aaa27443a3e2fc62c0
MD5 f715d24632e765c53e9856df53dc8318
SHA1 78e2280ccaeed00119fe827acc58ba10996517cb
SHA512 dd0568de924a86910d8bf59b2f0c22663268004ef9a5f80ffd78f37885f3b8538d138d1e5c70de8e4fda7aab150df48bd34e3838c976ec90ed4f0e49bed0e9e6
SSDEEP 6144:WbOobwWeCg6QvyuFtPwvGyDBQlEz8a+CFTYK0OnsoIcGm1p:W78We96sI+yDxTYwsoCm1p
TLSH
T1BF745B31A456707AE6F90872F568CB706D3CB21827D8849FC3E0E84E38645D36BB775A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e599173.msi

Path C:\Windows\Installer\e599173.msi
Size 10.1MB
SHA256 bd69b48536c0c714059933f238983ef132b9c9b51ae8f698a9281e70dce5498d
MD5 f5d9ba98c8014b4b50d13ae36ee02043
SHA1 bce8b72aba9da893dc26f85b613781d44c79464d
SHA512 33b6e4b8cd784566708c40da8615709bb1aa59d8a351ed461453b7cbc3b46e3de47cec9c93acbeb0a8604a866fe21a45a6280cc2890cd55f379f5adbda241382
SSDEEP 196608:LUEkUHLgEvySMwD/dCBAe2IlCK3F7HK84TlvDFw8cwW7Q1MG2XTqt1/sbjD+irT2:LUErHl/lgAoF7HKZNDnc7ORmYGD9rTKR
TLSH
T183B62323BC52A032D5FE0D35A539DB74193C7D60239859DB83D0B98DF8F02D19A72ADA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BootstrapperApplicationData.xml

Path C:\Windows\TEMP\{AD63D01A-D30F-4E1B-9936-E11D2129391E}\.ba\BootstrapperApplicationData.xml
Size 9KB
SHA256 1633b50661776a39ec9ffdc98ec19e48e0099a08ff5168cc3376137a904ee6e3
MD5 1b7efeed50be6f8ee212995070717d65
SHA1 22c3bc34718c78531cc3b56c312a54a89aebff9e
SHA512 9456bee88d409491723b8aa09ef6348b31119b5ee1ef3ba92a9d5fe7034353852c4e0f97031ae4f99e6ecaa49df5ebf611de83ad99a0c1f885318ea9920de5f3
SSDEEP 96:2BqRBM/En6YcYY0wZycirLdin6sUsD20wFycDdin6UkEc0wNycdOZdin6fMS2g05:2I1zfTK/lvjnlX0OOamagM5cYsCsysz
TLSH
T1BE12E3113BFD0218F0F3AE48EFF6A5555A36BD552E39C82D01601D0E49B2E819962FB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetLogo_256x.png

Path C:\Windows\TEMP\{AD63D01A-D30F-4E1B-9936-E11D2129391E}\.ba\DotNetLogo_256x.png
Size 2KB
SHA256 0f571f95d8eab48dbc81b0ec5e9f7225e349e26ef50868bfaab556f3c2443b01
MD5 39aa52615723b782c92dec710caaec7f
SHA1 760b49e256a7979fe50a56a2b1be3688a474b886
SHA512 89d1baa3820154667747b25e9e2fd321bfb2ec71dc309915b0a28dacdc80822a4943b639ebb37c37bd2559d5a4306d2096119cd970c84a0d331f6c68b0456dc9
TLSH
T1534195CF1BFD78D7E6E557918E1A8DD232738483B4B3A42CCE7B10B8274A5642B87940
MD5 SHA1 SHA512 TLSH

Submit Download

dotnet.ico

Path C:\Windows\TEMP\{AD63D01A-D30F-4E1B-9936-E11D2129391E}\.ba\dotnet.ico
Size 44KB
SHA256 61a2cbd12868cb9b359e0c78961d409b7875f072eb8e53ea88d3e6bfe2961a18
MD5 b8096652d9ec286709a2c863b244b110
SHA1 b3b7f0f4d608fad7cb59ba499d4d17c2b873a7af
SHA512 492a5aa83220bb77c178b7c5b50bf44968c0427e9e45bb97a33df14d7fb4c667ca7adde0ebb3874c7b6011057b01144e4e6651fbad62c6bcf5e0b93586c4bc7a
SSDEEP 96:r+gfbzo+wHK9NbwOY4tIWQeVlV1W9+H+guapUjFamINUItzf1dBNaIZ:ro5HuNcH4tIzeVlV1WEOFDgUWzf1PIm
TLSH
T1E913EF6DE68547C1C10C2032DB4AC792B5233C72E4DAE0C4F9D4FA7E177906965C6E6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\TEMP\{AD63D01A-D30F-4E1B-9936-E11D2129391E}\.ba\thm.wxl
Size 7KB
SHA256 b00edd703dd8a475119d0e4dd70a3aaa47f0e95361af290e76d367a8edef3432
MD5 8b2c667a8bbad3153068c0ed90df7ec4
SHA1 c9e04a3a37e5e6262ab9bfecf78280171b8f7b74
SHA512 5269f00d474acccb4c48cb7bcfdf19e63557a388572d3a6335aa39191319691d924e27f70da3f3495387c319396476c63a8fd7b35835cca0901220e39783847b
SSDEEP 96:HiTgM1+XSNEzA0HtYQstYCpCwZQpCeyk5HQJM9ouvj9urz8:Ew9EmtYQstYCPC9e8
TLSH
T191E1026F68DFDEE03A732651B2B3698D6919C29A136F1CF0F869084B47635016377A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.xml

Path C:\Windows\TEMP\{AD63D01A-D30F-4E1B-9936-E11D2129391E}\.ba\thm.xml
Size 11KB
SHA256 dfee8e2d075087227f19c835c145c5bb8e72a46880ea24080bb2472fd3a521be
MD5 4329e418dc56b1386d7ea29a0dcfab5b
SHA1 58387f92e89ca21b4179fb697c7de9675c59142f
SHA512 6934873d27e6efbb94da4f13ee8369b29995490051016fdf82800256b924902306d328bf1d4ebbf266d1a53eb24adb6478d1a67de4ecc3e3bcbe561968f24922
SSDEEP 96:HgvPkoeWEH3IWTaQfSJgHzth5mFahbuB8pR5+Vpwe+UIJLg1gEp+6F5pQnxc:AvoWydmQfVHMyyj5Z
TLSH
T14B42FC6851DC7811C532D702AB9371D3FF12BDA6C6C85A58B48E256B1FF262028B739C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixstdba.exe

Path C:\Windows\Temp\{AD63D01A-D30F-4E1B-9936-E11D2129391E}\.ba\wixstdba.exe
Size 431KB
SHA256 2b1cee5e3e24593247854eb7a7c4308937b9c607754ed2fb83520a8706c26f1e
MD5 0e88ffd2e737ac9b9a4241616838bc23
SHA1 3c8beb465d20bcef0cd6ceca9c60286d1d15cebd
SHA512 169b9e08518834c9bc5adfe4ab7b79e07685b72f30ede1c1a386229668bde8c15da378e1274e4013ad7b84d6f7a5acc64ef0806e3b8a66322861efaa7e26b620
SSDEEP 6144:X9vfS1NP+c3ytxmg4Stlqe3B9m2LSLTwGw7C3ZLaov5xZvSdF:X9v+GIyugllqe3wwGfX5/SdF
TLSH
T129943B3165F04037C6F90572AE14FA31BF69F208231095EBA3C0DD293968AE5BBB7657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windowsdesktop-runtime-10.0.7-win-x86.exe

Path C:\Windows\Temp\{AD63D01A-D30F-4E1B-9936-E11D2129391E}\.be\windowsdesktop-runtime-10.0.7-win-x86.exe
Size 967KB
SHA256 d7159bd11bc004ee485fb6fd031b71d38e4303721d0665acfefaee1fb97588fe
MD5 54b260b4c45fc5f0438080d937e0e2c8
SHA1 c7838ea3732e2619ba05fa3a9901384eeebf5fc8
SHA512 9a063312880700e71b4a1fe12365918900c033ab04c720ba880b4bc247c635ebacdf36672051948e5a07aa5e4773a2ec92a5e321a303175abd6930387a915544
SSDEEP 12288:XVGWl6qCmyZeU6lqlDjC+fScn6X8GwMgJEQaA6fTQfulZYDGSGPjR0ASh:XVGWl6qCmyt6UdmcpMzfz0xOjK
TLSH
T13D257D31A166242BD6F50973F914D2307E2CD7082B5C95BAC6C0D90D39689FA6FFB24B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2200-209-0x000002936DB40000-0x000002936DB71000-memory.dmp

Download

memory/3764-507-0x000001C1CCE60000-0x000001C1CCE91000-memory.dmp

Download

memory/3976-1698-0x0000000000770000-0x0000000000836000-memory.dmp

Download

memory/4364-325-0x000002BFF0960000-0x000002BFF0991000-memory.dmp

Download

memory/5036-1682-0x000002062F280000-0x000002062F2B1000-memory.dmp

Download

memory/5356-1658-0x000001B296390000-0x000001B29639C000-memory.dmp

Download