873fd333cd8e687b874af8dca2f043c50ea1f4bc64d496015ca038da383b91f0

Analysis

user interaction
yes
max time kernel
287s
max time network
290s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
07/05/2026, 15:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Velocity/Velocity.exe
Size 32.9MB
Sample260507-sxt73sft8w
SHA256 873fd333cd8e687b874af8dca2f043c50ea1f4bc64d496015ca038da383b91f0
MD5 83da367e14fe39262fcf57c39dc3180b
SHA1 a0d2655ceff2d35b7eceb55e2be1058b966970e2
SHA512 8ce8b77b95640a111d43b75ff76bdfdacfd8680a39c5d5c6a97fdef7aef18bd7470a4df4716fd3c67a51cfed69a710d6c33086c864a0b91ea0c03966b8a97df5
SSDEEP 196608:ktQ56WdpH6emXAro0JTToUgmwh8qZYOCu51ZTAFLzbjblIjvT7CThIPPBrYjPWDx:kt6pHxmXf0J9A8qCFqAFLKnCTMGPWl
TLSH
T1A9779E22A3A44E3DC99F5773E4B603254335CA06AF43939E581CA69C1F933860B59BF7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery persistence

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
53	1560	msedge.exe

Executes dropped EXE 8 IoCs

pid	Process
5240	windowsdesktop-runtime-10.0.7-win-x86.exe
2240	wixstdba.exe
3760	windowsdesktop-runtime-10.0.7-win-x86.exe
5744	windowsdesktop-runtime-10.0.7-win-x86.exe
4412	windowsdesktop-runtime-10.0.7-win-x86.exe
2388	wixstdba.exe
5584	windowsdesktop-runtime-10.0.7-win-x86.exe
5652	Decompiler.exe

Loads dropped DLL 64 IoCs

pid	Process
5584	MsiExec.exe
3452	MsiExec.exe
5896	MsiExec.exe
3704	MsiExec.exe
4700	MsiExec.exe
5284	MsiExec.exe
3372	msedge.exe
3132	Velocity.exe
3132	Velocity.exe
3132	Velocity.exe
3132	Velocity.exe
3132	Velocity.exe
3132	Velocity.exe
3132	Velocity.exe
3132	Velocity.exe
3132	Velocity.exe
3132	Velocity.exe
3132	Velocity.exe
3132	Velocity.exe
3132	Velocity.exe
3132	Velocity.exe
3132	Velocity.exe
3132	Velocity.exe
3132	Velocity.exe
3132	Velocity.exe
3132	Velocity.exe
3132	Velocity.exe
3132	Velocity.exe
3132	Velocity.exe
3132	Velocity.exe
3132	Velocity.exe
3132	Velocity.exe
3132	Velocity.exe
3132	Velocity.exe
3132	Velocity.exe
3132	Velocity.exe
3132	Velocity.exe
3132	Velocity.exe
3132	Velocity.exe
3132	Velocity.exe
3132	Velocity.exe
3132	Velocity.exe
3132	Velocity.exe
3132	Velocity.exe
3132	Velocity.exe
3132	Velocity.exe
3132	Velocity.exe
3132	Velocity.exe
3132	Velocity.exe
3132	Velocity.exe
3132	Velocity.exe
3132	Velocity.exe
3132	Velocity.exe
3132	Velocity.exe
3132	Velocity.exe
3132	Velocity.exe
3132	Velocity.exe
3132	Velocity.exe
3132	Velocity.exe
3132	Velocity.exe
3132	Velocity.exe
3132	Velocity.exe
3132	Velocity.exe
3132	Velocity.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{580865E1-2073-4861-8356-3D20DFF3D50E} = "\"C:\\ProgramData\\Package Cache\\{580865E1-2073-4861-8356-3D20DFF3D50E}\\windowsdesktop-runtime-10.0.7-win-x86.exe\" /burn.runonce"	windowsdesktop-runtime-10.0.7-win-x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{580865E1-2073-4861-8356-3D20DFF3D50E} = "\"C:\\ProgramData\\Package Cache\\{580865E1-2073-4861-8356-3D20DFF3D50E}\\windowsdesktop-runtime-10.0.7-win-x86.exe\" /burn.runonce"	windowsdesktop-runtime-10.0.7-win-x86.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
346	api.gofile.io
347	api.gofile.io
349	api.gofile.io

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Bin\erto3e4rortoergn.exe	Velocity.exe
File created	C:\Windows\SysWOW64\Bin\Decompiler.exe	Velocity.exe
File created	C:\Windows\SysWOW64\Bin\current_version.txt	Velocity.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\de\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Net.Http.Json.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\PresentationFramework.AeroLite.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\ru\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Resources.Writer.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\es\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\it\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\ru\WindowsBase.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Net.HttpListener.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Runtime.Serialization.Json.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\System.Printing.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\fr\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\ja\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\ko\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\ko\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.ComponentModel.TypeConverter.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\Microsoft.VisualBasic.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Collections.Specialized.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.ComponentModel.Annotations.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.IO.FileSystem.Watcher.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Linq.AsyncEnumerable.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\fr\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\pt-BR\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\PresentationFramework.Royale.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\System.Windows.Forms.Design.Editors.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\pt-BR\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\zh-Hans\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\System.Windows.Extensions.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\it\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\ko\UIAutomationTypes.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\ru\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\ja\UIAutomationTypes.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\ko\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\mscorlib.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\PresentationFramework.Classic.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\System.Configuration.ConfigurationManager.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Transactions.Local.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\System.Security.Cryptography.ProtectedData.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\fr\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\pt-BR\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Security.Cryptography.X509Certificates.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\ru\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\tr\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\zh-Hant\WindowsBase.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Reflection.Metadata.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\System.Windows.Input.Manipulations.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\es\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\ko\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Xml.XPath.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\de\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\ko\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\ru\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Runtime.Loader.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\System.Drawing.Common.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\zh-Hans\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Reflection.Emit.Lightweight.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\pt-BR\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\ru\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.ComponentModel.EventBasedAsync.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.IO.Compression.ZipFile.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Net.Mail.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\10.0.7\System.Security.Cryptography.Algorithms.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\de\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.7\ru\PresentationFramework.resources.dll	msiexec.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3372_377162598\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3372_377162598\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3372_377162598\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\~DFA78F1D8E32C69A18.TMP	msiexec.exe
File created	C:\Windows\Installer\e590009.msi	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3372_316110062\crs.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3372_377162598\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3372_377162598\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3372_377162598\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3372_377162598\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\~DF581BEC03E8A17DAE.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3372_554395112\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3372_377162598\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3372_377162598\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3372_377162598\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3372_377162598\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3372_377162598\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3372_377162598\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3372_377162598\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3372_377162598\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\~DFFE7B6325E8EB4A84.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3372_377162598\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3372_377162598\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3372_377162598\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3372_377162598\_locales\ko\messages.json	msedge.exe
File opened for modification	C:\Windows\Installer\e590000.msi	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3372_250873439\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3372_377162598\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3372_377162598\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\~DFBAEAFB353C445E27.TMP	msiexec.exe
File created	C:\Windows\Installer\e590004.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFCC4EA026951712DE.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3372_377162598\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3372_377162598\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3372_377162598\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3372_377162598\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3372_377162598\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3372_377162598\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\~DF194939A09FC64067.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3372_519606212\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3372_377162598\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3372_377162598\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3372_377162598\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3372_377162598\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3372_377162598\_locales\km\messages.json	msedge.exe
File opened for modification	C:\Windows\Installer\e590005.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{6F122B2D-6824-4922-A23E-A9151114EE7A}	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3372_377162598\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3372_377162598\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\~DF8D4CB25425542120.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3372_554395112\autofill_bypass_cache_forms.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3372_377162598\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3372_377162598\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3372_377162598\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3372_377162598\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3372_377162598\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3372_377162598\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3372_554395112\edge_autofill_global_block_list.json	msedge.exe
File opened for modification	C:\Windows\Installer\MSI100.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{2A17EBA5-4EEE-4A8A-9CEE-E8B67938B606}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI10D3.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFE40BC689B6123E7B.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3372_377162598\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3372_377162598\_locales\gu\messages.json	msedge.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.7-win-x86.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.7-win-x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.7-win-x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Velocity.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wixstdba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.7-win-x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.7-win-x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Velocity.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wixstdba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.7-win-x86.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1560	msedge.exe
3372	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134226414928412997"	msedge.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2B	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2C	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2d	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_80.28.51996_x86\Dependents\{580865E1-2073-4861-8356-3D20DFF3D50E}	windowsdesktop-runtime-10.0.7-win-x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2DC2EA90D1018E54982215BAAA138FCC\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{09AE2CD2-101D-45E8-8922-51ABAA31F8CC}v80.28.51996\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_80.28.51996_x86\ = "{2A17EBA5-4EEE-4A8A-9CEE-E8B67938B606}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3178EEBD72B5CC250FFFEA4077368656\D2B221F6428622942AE39A511141EEA7	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x86	windowsdesktop-runtime-10.0.7-win-x86.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2DC2EA90D1018E54982215BAAA138FCC\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5ABE71A2EEE4A8A4C9EE8E6B97836B60\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\865988FEFD93BBF4386A98D30F5A7A7D\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2DC2EA90D1018E54982215BAAA138FCC\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{0f62ff89-5cc3-5dfe-ec82-db9d826b6527}	windowsdesktop-runtime-10.0.7-win-x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{0f62ff89-5cc3-5dfe-ec82-db9d826b6527}\Version = "10.0.7.50000"	windowsdesktop-runtime-10.0.7-win-x86.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2DC2EA90D1018E54982215BAAA138FCC\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.28.51996_x86\Dependents	windowsdesktop-runtime-10.0.7-win-x86.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5ABE71A2EEE4A8A4C9EE8E6B97836B60\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D2B221F6428622942AE39A511141EEA7\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D2B221F6428622942AE39A511141EEA7\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{6F122B2D-6824-4922-A23E-A9151114EE7A}v80.28.51996\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{0f62ff89-5cc3-5dfe-ec82-db9d826b6527}\Dependents	windowsdesktop-runtime-10.0.7-win-x86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\865988FEFD93BBF4386A98D30F5A7A7D\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2DC2EA90D1018E54982215BAAA138FCC\SourceList\PackageName = "dotnet-hostfxr-10.0.7-win-x86.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2DC2EA90D1018E54982215BAAA138FCC\SourceList\Media	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5ABE71A2EEE4A8A4C9EE8E6B97836B60\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x86\ = "{EF889568-39DF-4FBB-83A6-893DF0A5A7D7}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\B9FD6305CAA5D224A5486ED10DAF7290\2DC2EA90D1018E54982215BAAA138FCC	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D2B221F6428622942AE39A511141EEA7\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D2B221F6428622942AE39A511141EEA7\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{0f62ff89-5cc3-5dfe-ec82-db9d826b6527}\DisplayName = "Microsoft Windows Desktop Runtime 10.0.7 (x86)"	windowsdesktop-runtime-10.0.7-win-x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\7C5F02C108B5629409B1C2D8A072F2A4\865988FEFD93BBF4386A98D30F5A7A7D	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\865988FEFD93BBF4386A98D30F5A7A7D\SourceList\PackageName = "dotnet-host-10.0.7-win-x86.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2DC2EA90D1018E54982215BAAA138FCC\Provider	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3178EEBD72B5CC250FFFEA4077368656	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\B9FD6305CAA5D224A5486ED10DAF7290	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D2B221F6428622942AE39A511141EEA7\ProductName = "Microsoft Windows Desktop Runtime - 10.0.7 (x86)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{0f62ff89-5cc3-5dfe-ec82-db9d826b6527}\Version = "10.0.7.50000"	windowsdesktop-runtime-10.0.7-win-x86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2DC2EA90D1018E54982215BAAA138FCC	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5ABE71A2EEE4A8A4C9EE8E6B97836B60\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{2A17EBA5-4EEE-4A8A-9CEE-E8B67938B606}v80.28.51996\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D2B221F6428622942AE39A511141EEA7\Provider	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_80.28.51996_x86\Dependents\{580865E1-2073-4861-8356-3D20DFF3D50E}	windowsdesktop-runtime-10.0.7-win-x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x86\Version = "80.28.51996"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2DC2EA90D1018E54982215BAAA138FCC\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5ABE71A2EEE4A8A4C9EE8E6B97836B60	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5ABE71A2EEE4A8A4C9EE8E6B97836B60	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5ABE71A2EEE4A8A4C9EE8E6B97836B60\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{2A17EBA5-4EEE-4A8A-9CEE-E8B67938B606}v80.28.51996\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\windowsdesktop_runtime_80.28.51996_x86	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_80.28.51996_x86\ = "{6F122B2D-6824-4922-A23E-A9151114EE7A}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{0f62ff89-5cc3-5dfe-ec82-db9d826b6527}\DisplayName = "Microsoft Windows Desktop Runtime 10.0.7 (x86)"	windowsdesktop-runtime-10.0.7-win-x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\865988FEFD93BBF4386A98D30F5A7A7D\MainFeature	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\865988FEFD93BBF4386A98D30F5A7A7D\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.28.51996_x86	windowsdesktop-runtime-10.0.7-win-x86.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5ABE71A2EEE4A8A4C9EE8E6B97836B60\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.28.51996_x86\ = "{09AE2CD2-101D-45E8-8922-51ABAA31F8CC}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2DC2EA90D1018E54982215BAAA138FCC\MainFeature	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2DC2EA90D1018E54982215BAAA138FCC\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D2B221F6428622942AE39A511141EEA7\MainFeature	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D2B221F6428622942AE39A511141EEA7	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\865988FEFD93BBF4386A98D30F5A7A7D\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.28.51996_x86\Version = "80.28.51996"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\dotnet_runtime_80.28.51996_x86	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5ABE71A2EEE4A8A4C9EE8E6B97836B60\SourceList\Net	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\865988FEFD93BBF4386A98D30F5A7A7D\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\865988FEFD93BBF4386A98D30F5A7A7D\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2DC2EA90D1018E54982215BAAA138FCC\PackageCode = "76A15FE2D7C0C094BAC51D0288AFF67C"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_80.28.51996_x86\Version = "80.28.51996"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D2B221F6428622942AE39A511141EEA7\PackageCode = "C01DBE88C89D6684C98072939B97831F"	msiexec.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.7-win-x86.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Velocity.zip:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1164	msiexec.exe
1164	msiexec.exe
1164	msiexec.exe
1164	msiexec.exe
1164	msiexec.exe
1164	msiexec.exe
1164	msiexec.exe
1164	msiexec.exe
1164	msiexec.exe
1164	msiexec.exe
1164	msiexec.exe
1164	msiexec.exe
3744	msedge.exe
3744	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

pid	Process
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3760	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeIncreaseQuotaPrivilege	3760	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeSecurityPrivilege	1164	msiexec.exe
Token: SeCreateTokenPrivilege	3760	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeAssignPrimaryTokenPrivilege	3760	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeLockMemoryPrivilege	3760	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeIncreaseQuotaPrivilege	3760	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeMachineAccountPrivilege	3760	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeTcbPrivilege	3760	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeSecurityPrivilege	3760	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeTakeOwnershipPrivilege	3760	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeLoadDriverPrivilege	3760	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeSystemProfilePrivilege	3760	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeSystemtimePrivilege	3760	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeProfSingleProcessPrivilege	3760	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeIncBasePriorityPrivilege	3760	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeCreatePagefilePrivilege	3760	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeCreatePermanentPrivilege	3760	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeBackupPrivilege	3760	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeRestorePrivilege	3760	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeShutdownPrivilege	3760	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeDebugPrivilege	3760	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeAuditPrivilege	3760	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeSystemEnvironmentPrivilege	3760	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeChangeNotifyPrivilege	3760	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeRemoteShutdownPrivilege	3760	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeUndockPrivilege	3760	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeSyncAgentPrivilege	3760	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeEnableDelegationPrivilege	3760	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeManageVolumePrivilege	3760	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeImpersonatePrivilege	3760	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeCreateGlobalPrivilege	3760	windowsdesktop-runtime-10.0.7-win-x86.exe
Token: SeRestorePrivilege	1164	msiexec.exe
Token: SeTakeOwnershipPrivilege	1164	msiexec.exe
Token: SeRestorePrivilege	1164	msiexec.exe
Token: SeTakeOwnershipPrivilege	1164	msiexec.exe
Token: SeRestorePrivilege	1164	msiexec.exe
Token: SeTakeOwnershipPrivilege	1164	msiexec.exe
Token: SeRestorePrivilege	1164	msiexec.exe
Token: SeTakeOwnershipPrivilege	1164	msiexec.exe
Token: SeRestorePrivilege	1164	msiexec.exe
Token: SeTakeOwnershipPrivilege	1164	msiexec.exe
Token: SeRestorePrivilege	1164	msiexec.exe
Token: SeTakeOwnershipPrivilege	1164	msiexec.exe
Token: SeRestorePrivilege	1164	msiexec.exe
Token: SeTakeOwnershipPrivilege	1164	msiexec.exe
Token: SeRestorePrivilege	1164	msiexec.exe
Token: SeTakeOwnershipPrivilege	1164	msiexec.exe
Token: SeRestorePrivilege	1164	msiexec.exe
Token: SeTakeOwnershipPrivilege	1164	msiexec.exe
Token: SeRestorePrivilege	1164	msiexec.exe
Token: SeTakeOwnershipPrivilege	1164	msiexec.exe
Token: SeRestorePrivilege	1164	msiexec.exe
Token: SeTakeOwnershipPrivilege	1164	msiexec.exe
Token: SeRestorePrivilege	1164	msiexec.exe
Token: SeTakeOwnershipPrivilege	1164	msiexec.exe
Token: SeRestorePrivilege	1164	msiexec.exe
Token: SeTakeOwnershipPrivilege	1164	msiexec.exe
Token: SeRestorePrivilege	1164	msiexec.exe
Token: SeTakeOwnershipPrivilege	1164	msiexec.exe
Token: SeRestorePrivilege	1164	msiexec.exe
Token: SeTakeOwnershipPrivilege	1164	msiexec.exe
Token: SeRestorePrivilege	1164	msiexec.exe
Token: SeTakeOwnershipPrivilege	1164	msiexec.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
2240	wixstdba.exe
2388	wixstdba.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4320 wrote to memory of 3372	4320	Velocity.exe	79
PID 3372 wrote to memory of 6024	3372	msedge.exe	80
PID 3372 wrote to memory of 1560	3372	msedge.exe	82
PID 3372 wrote to memory of 2096	3372	msedge.exe	83
PID 3372 wrote to memory of 2096	3372	msedge.exe	83
PID 3372 wrote to memory of 2096	3372	msedge.exe	83
PID 3372 wrote to memory of 3388	3372	msedge.exe	84
PID 3372 wrote to memory of 3388	3372	msedge.exe	84
PID 3372 wrote to memory of 6108	3372	msedge.exe	85
PID 3372 wrote to memory of 444	3372	msedge.exe	86
PID 3372 wrote to memory of 6108	3372	msedge.exe	85
PID 3372 wrote to memory of 6108	3372	msedge.exe	85
PID 3372 wrote to memory of 444	3372	msedge.exe	86
PID 3372 wrote to memory of 444	3372	msedge.exe	86
PID 3372 wrote to memory of 2304	3372	msedge.exe	88
PID 3372 wrote to memory of 2304	3372	msedge.exe	88
PID 3372 wrote to memory of 2304	3372	msedge.exe	88
PID 3372 wrote to memory of 2388	3372	msedge.exe	89
PID 3372 wrote to memory of 2388	3372	msedge.exe	89
PID 3372 wrote to memory of 4728	3372	msedge.exe	90
PID 3372 wrote to memory of 4728	3372	msedge.exe	90
PID 3372 wrote to memory of 4728	3372	msedge.exe	90
PID 3372 wrote to memory of 4744	3372	msedge.exe	91
PID 3372 wrote to memory of 4744	3372	msedge.exe	91
PID 3372 wrote to memory of 4760	3372	msedge.exe	92
PID 3372 wrote to memory of 4760	3372	msedge.exe	92
PID 3372 wrote to memory of 4832	3372	msedge.exe	93
PID 3372 wrote to memory of 952	3372	msedge.exe	95
PID 4832 wrote to memory of 5008	4832	msedge.exe	96
PID 3372 wrote to memory of 5216	3372	msedge.exe	97
PID 3372 wrote to memory of 3564	3372	msedge.exe	100
PID 3372 wrote to memory of 4152	3372	msedge.exe	101
PID 3372 wrote to memory of 2076	3372	msedge.exe	102
PID 3372 wrote to memory of 5164	3372	msedge.exe	103
PID 3372 wrote to memory of 5164	3372	msedge.exe	103
PID 3372 wrote to memory of 1892	3372	msedge.exe	104
PID 3372 wrote to memory of 1892	3372	msedge.exe	104
PID 3372 wrote to memory of 3008	3372	msedge.exe	106
PID 3372 wrote to memory of 1604	3372	msedge.exe	107
PID 3372 wrote to memory of 1604	3372	msedge.exe	107
PID 3372 wrote to memory of 1604	3372	msedge.exe	107
PID 3372 wrote to memory of 3948	3372	msedge.exe	108
PID 3372 wrote to memory of 3948	3372	msedge.exe	108
PID 3372 wrote to memory of 5240	3372	msedge.exe	111
PID 5240 wrote to memory of 2240	5240	windowsdesktop-runtime-10.0.7-win-x86.exe	112
PID 5240 wrote to memory of 3760	5240	windowsdesktop-runtime-10.0.7-win-x86.exe	113
PID 5744 wrote to memory of 4412	5744	windowsdesktop-runtime-10.0.7-win-x86.exe	116
PID 1164 wrote to memory of 5584	1164	msiexec.exe	118
PID 1164 wrote to memory of 3452	1164	msiexec.exe	119
PID 4412 wrote to memory of 2388	4412	windowsdesktop-runtime-10.0.7-win-x86.exe	121
PID 1164 wrote to memory of 5896	1164	msiexec.exe	122
PID 3372 wrote to memory of 1668	3372	msedge.exe	124
PID 3372 wrote to memory of 1668	3372	msedge.exe	124
PID 1164 wrote to memory of 3704	1164	msiexec.exe	125
PID 4412 wrote to memory of 5584	4412	windowsdesktop-runtime-10.0.7-win-x86.exe	127
PID 1164 wrote to memory of 4700	1164	msiexec.exe	128
PID 1164 wrote to memory of 5284	1164	msiexec.exe	129
PID 3372 wrote to memory of 32	3372	msedge.exe	130
PID 3372 wrote to memory of 32	3372	msedge.exe	130
PID 3372 wrote to memory of 1020	3372	msedge.exe	131
PID 3372 wrote to memory of 1020	3372	msedge.exe	131
PID 3372 wrote to memory of 1020	3372	msedge.exe	131
PID 3372 wrote to memory of 5756	3372	msedge.exe	132
PID 3372 wrote to memory of 5756	3372	msedge.exe	132

C:\Users\Admin\AppData\Local\Temp\Velocity\Velocity.exe
"C:\Users\Admin\AppData\Local\Temp\Velocity\Velocity.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=x86&rid=win-x86&os=win10&apphost_version=10.0.0&gui=true
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Time Discovery
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x2f4,0x7ffe33e1c188,0x7ffe33e1c194,0x7ffe33e1c1a0
    3⤵
    PID:6024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1836,i,7421197879458686240,16688967741052789946,524288 --field-trial-handle=2344,i,17102372401520900311,8341051999565993499,262144 --variations-seed-version --mojo-platform-channel-handle=2412 /prefetch:11
    3⤵
    - Downloads MZ/PE file
    - System Time Discovery
    PID:1560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1676,i,7343174410261669034,14129541524372937449,262144 --field-trial-handle=2344,i,17102372401520900311,8341051999565993499,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:2
    3⤵
    PID:2096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2452,i,12238743604682721901,12201656794073493345,524288 --field-trial-handle=2344,i,17102372401520900311,8341051999565993499,262144 --variations-seed-version --mojo-platform-channel-handle=2716 /prefetch:13
    3⤵
    PID:3388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,5971504691598567924,10452109893256182747,2097152 --field-trial-handle=2344,i,17102372401520900311,8341051999565993499,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
    3⤵
    PID:6108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,6575200268725664005,10353709294919945789,2097152 --field-trial-handle=2344,i,17102372401520900311,8341051999565993499,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
    3⤵
    PID:444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4836,i,5839545378710078647,9404143906675669597,2097152 --field-trial-handle=2344,i,17102372401520900311,8341051999565993499,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:1
    3⤵
    PID:2304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3648,i,8594639056558199246,7277350670234751429,524288 --field-trial-handle=2344,i,17102372401520900311,8341051999565993499,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:14
    3⤵
    PID:2388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3736,i,18145948807871875941,14185219514384104661,2097152 --field-trial-handle=2344,i,17102372401520900311,8341051999565993499,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:1
    3⤵
    PID:4728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5584,i,10483536424499884084,3979088161103444576,524288 --field-trial-handle=2344,i,17102372401520900311,8341051999565993499,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:14
    3⤵
    PID:4744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5596,i,686549640643735416,8999181210333017633,524288 --field-trial-handle=2344,i,17102372401520900311,8341051999565993499,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:14
    3⤵
    PID:4760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6472,i,5183368677467621760,6274450660033801551,524288 --field-trial-handle=2344,i,17102372401520900311,8341051999565993499,262144 --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1132
      4⤵
      PID:5008
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5640,i,14303724571359158106,3267919724528989499,524288 --field-trial-handle=2344,i,17102372401520900311,8341051999565993499,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:14
    3⤵
    PID:5004
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5640,i,14303724571359158106,3267919724528989499,524288 --field-trial-handle=2344,i,17102372401520900311,8341051999565993499,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:14
    3⤵
    PID:952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6712,i,2397291653266752755,9609967319182568198,524288 --field-trial-handle=2344,i,17102372401520900311,8341051999565993499,262144 --variations-seed-version --mojo-platform-channel-handle=6708 /prefetch:14
    3⤵
    - Subvert Trust Controls: Mark-of-the-Web Bypass
    - NTFS ADS
    PID:5216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6880,i,9558736862034426178,5826238457135219710,524288 --field-trial-handle=2344,i,17102372401520900311,8341051999565993499,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:14
    3⤵
    PID:3564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5640,i,17264516210540868632,5527620036590583047,524288 --field-trial-handle=2344,i,17102372401520900311,8341051999565993499,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:14
    3⤵
    PID:4152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6692,i,7211493969733756320,5257245624480900547,524288 --field-trial-handle=2344,i,17102372401520900311,8341051999565993499,262144 --variations-seed-version --mojo-platform-channel-handle=4904 /prefetch:14
    3⤵
    PID:2076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3696,i,3566701308418779854,13487911465860240766,524288 --field-trial-handle=2344,i,17102372401520900311,8341051999565993499,262144 --variations-seed-version --mojo-platform-channel-handle=4904 /prefetch:14
    3⤵
    PID:5164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6496,i,18338718711479042514,12222327819534325041,524288 --field-trial-handle=2344,i,17102372401520900311,8341051999565993499,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:14
    3⤵
    PID:1892
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5740,i,621133879307864971,6420506563453805014,524288 --field-trial-handle=2344,i,17102372401520900311,8341051999565993499,262144 --variations-seed-version --mojo-platform-channel-handle=1952 /prefetch:14
    3⤵
    PID:2796
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5740,i,621133879307864971,6420506563453805014,524288 --field-trial-handle=2344,i,17102372401520900311,8341051999565993499,262144 --variations-seed-version --mojo-platform-channel-handle=1952 /prefetch:14
    3⤵
    PID:3008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=4952,i,6969801326562690048,4304576430777374163,2097152 --field-trial-handle=2344,i,17102372401520900311,8341051999565993499,262144 --variations-seed-version --mojo-platform-channel-handle=2844 /prefetch:1
    3⤵
    PID:1604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7052,i,7239674149038236642,10556356171317363337,524288 --field-trial-handle=2344,i,17102372401520900311,8341051999565993499,262144 --variations-seed-version --mojo-platform-channel-handle=7056 /prefetch:14
    3⤵
    PID:3948
- - C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.7-win-x86.exe
    "C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.7-win-x86.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5240
  - - C:\Windows\TEMP\{C8B9907E-B94B-4EDD-8E3F-CDBF68F5D839}\.ba\wixstdba.exe
      "C:\Windows\TEMP\{C8B9907E-B94B-4EDD-8E3F-CDBF68F5D839}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{081A485E-734F-48C4-96A0-09E9F0F4DE5C} {F14486F0-42FC-4703-85BC-666D2696FA03}
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      PID:2240
  - - C:\Windows\TEMP\{C8B9907E-B94B-4EDD-8E3F-CDBF68F5D839}\.be\windowsdesktop-runtime-10.0.7-win-x86.exe
      "C:\Windows\TEMP\{C8B9907E-B94B-4EDD-8E3F-CDBF68F5D839}\.be\windowsdesktop-runtime-10.0.7-win-x86.exe" -q -burn.elevated BurnPipe.{5FA33A8C-203C-42AB-BDE1-BAA7216B5AF7} {14EB30FB-E88A-4052-9D05-ABD13128B9E3} 5240
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      PID:3760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7332,i,7592472861875430150,2432150055112157363,524288 --field-trial-handle=2344,i,17102372401520900311,8341051999565993499,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:14
    3⤵
    PID:1668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6496,i,2321450333133716505,14999795622715931683,524288 --field-trial-handle=2344,i,17102372401520900311,8341051999565993499,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:14
    3⤵
    PID:32
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7532,i,5687165345307930988,6438531872380286898,2097152 --field-trial-handle=2344,i,17102372401520900311,8341051999565993499,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:1
    3⤵
    PID:1020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5276,i,413510195386606931,12464667845646192430,524288 --field-trial-handle=2344,i,17102372401520900311,8341051999565993499,262144 --variations-seed-version --mojo-platform-channel-handle=3948 /prefetch:14
    3⤵
    PID:5756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7800,i,9953967446754831968,7596888143409082009,262144 --field-trial-handle=2344,i,17102372401520900311,8341051999565993499,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7460,i,15871030590855049311,5028984613683321579,524288 --field-trial-handle=2344,i,17102372401520900311,8341051999565993499,262144 --variations-seed-version --mojo-platform-channel-handle=7416 /prefetch:14
    3⤵
    PID:2448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7848,i,9976328226517286667,16862968699928881775,524288 --field-trial-handle=2344,i,17102372401520900311,8341051999565993499,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:14
    3⤵
    PID:6052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=2120,i,5828867846339270066,4923209092241879858,2097152 --field-trial-handle=2344,i,17102372401520900311,8341051999565993499,262144 --variations-seed-version --mojo-platform-channel-handle=3972 /prefetch:1
    3⤵
    PID:6140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=6368,i,7410412782042864392,2520203099469156632,2097152 --field-trial-handle=2344,i,17102372401520900311,8341051999565993499,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:1
    3⤵
    PID:5972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=6752,i,3692730715266488592,14142985860972117905,2097152 --field-trial-handle=2344,i,17102372401520900311,8341051999565993499,262144 --variations-seed-version --mojo-platform-channel-handle=7828 /prefetch:1
    3⤵
    PID:5896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=7740,i,8701182128018435061,6899950128289339316,2097152 --field-trial-handle=2344,i,17102372401520900311,8341051999565993499,262144 --variations-seed-version --mojo-platform-channel-handle=7700 /prefetch:1
    3⤵
    PID:4364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4560,i,17967025020421854290,12115673149186923123,524288 --field-trial-handle=2344,i,17102372401520900311,8341051999565993499,262144 --variations-seed-version --mojo-platform-channel-handle=7944 /prefetch:14
    3⤵
    PID:4524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=8108,i,1386577572508519084,16389475055661060191,2097152 --field-trial-handle=2344,i,17102372401520900311,8341051999565993499,262144 --variations-seed-version --mojo-platform-channel-handle=8100 /prefetch:1
    3⤵
    PID:4816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=8232,i,13309023352330019711,13831277387754616175,2097152 --field-trial-handle=2344,i,17102372401520900311,8341051999565993499,262144 --variations-seed-version --mojo-platform-channel-handle=8280 /prefetch:1
    3⤵
    PID:3936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=8304,i,892057289516871991,9556914366697345302,2097152 --field-trial-handle=2344,i,17102372401520900311,8341051999565993499,262144 --variations-seed-version --mojo-platform-channel-handle=8240 /prefetch:1
    3⤵
    PID:2588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8724,i,16985837065725676003,8416399818203752766,524288 --field-trial-handle=2344,i,17102372401520900311,8341051999565993499,262144 --variations-seed-version --mojo-platform-channel-handle=8744 /prefetch:14
    3⤵
    PID:1656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9008,i,11563940916867542737,7517150124197128563,524288 --field-trial-handle=2344,i,17102372401520900311,8341051999565993499,262144 --variations-seed-version --mojo-platform-channel-handle=9012 /prefetch:14
    3⤵
    PID:3708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7944,i,13755207398380667148,2706742930274708030,524288 --field-trial-handle=2344,i,17102372401520900311,8341051999565993499,262144 --variations-seed-version --mojo-platform-channel-handle=8124 /prefetch:14
    3⤵
    PID:5428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=8276,i,10044400952256685904,7537290587862193721,2097152 --field-trial-handle=2344,i,17102372401520900311,8341051999565993499,262144 --variations-seed-version --mojo-platform-channel-handle=8756 /prefetch:1
    3⤵
    PID:1816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=8976,i,7414624977360062452,11648320179291565963,2097152 --field-trial-handle=2344,i,17102372401520900311,8341051999565993499,262144 --variations-seed-version --mojo-platform-channel-handle=8572 /prefetch:1
    3⤵
    PID:2584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=8804,i,17078552890859937644,2935188812430545392,2097152 --field-trial-handle=2344,i,17102372401520900311,8341051999565993499,262144 --variations-seed-version --mojo-platform-channel-handle=8352 /prefetch:1
    3⤵
    PID:3588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=5020,i,11771897990027389154,15246502400998784952,2097152 --field-trial-handle=2344,i,17102372401520900311,8341051999565993499,262144 --variations-seed-version --mojo-platform-channel-handle=8796 /prefetch:1
    3⤵
    PID:5708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=8032,i,11753011879489705552,17705558601149343544,2097152 --field-trial-handle=2344,i,17102372401520900311,8341051999565993499,262144 --variations-seed-version --mojo-platform-channel-handle=8548 /prefetch:1
    3⤵
    PID:4680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8240,i,3428628930100830822,12821948696030002132,524288 --field-trial-handle=2344,i,17102372401520900311,8341051999565993499,262144 --variations-seed-version --mojo-platform-channel-handle=8980 /prefetch:14
    3⤵
    - NTFS ADS
    PID:5540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7712,i,16761165434591247819,5713623262047569761,524288 --field-trial-handle=2344,i,17102372401520900311,8341051999565993499,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:14
    3⤵
    PID:5668

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3704

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2716

C:\ProgramData\Package Cache\{580865E1-2073-4861-8356-3D20DFF3D50E}\windowsdesktop-runtime-10.0.7-win-x86.exe
"C:\ProgramData\Package Cache\{580865E1-2073-4861-8356-3D20DFF3D50E}\windowsdesktop-runtime-10.0.7-win-x86.exe" /burn.runonce
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5744
- C:\ProgramData\Package Cache\{580865E1-2073-4861-8356-3D20DFF3D50E}\windowsdesktop-runtime-10.0.7-win-x86.exe
  "C:\ProgramData\Package Cache\{580865E1-2073-4861-8356-3D20DFF3D50E}\windowsdesktop-runtime-10.0.7-win-x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.7_(x86)_20260507163224.log"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4412
- - C:\Windows\TEMP\{11408472-2D74-4F65-86C7-30383EFDC745}\.ba\wixstdba.exe
    "C:\Windows\TEMP\{11408472-2D74-4F65-86C7-30383EFDC745}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{9DCB11DC-DFDB-4022-9B2E-30774E0DA662} {1AD9E583-E527-44BE-AA70-1ED703B6157F}
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:2388
- - C:\ProgramData\Package Cache\{580865E1-2073-4861-8356-3D20DFF3D50E}\windowsdesktop-runtime-10.0.7-win-x86.exe
    "C:\ProgramData\Package Cache\{580865E1-2073-4861-8356-3D20DFF3D50E}\windowsdesktop-runtime-10.0.7-win-x86.exe" -q -burn.elevated BurnPipe.{16C527E9-F16B-4CC2-A18F-7C85BF7A133F} {6389BC39-87D6-4A9B-9581-DA77595C16FD} 4412
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:5584

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1164
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding FAF8B5EDF8EC76A52E316B5C7618BA9E
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5584
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 8D21A148F8672500578C09BD9F4DD0F8
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3452
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 252EA5AD4A634152F5EED5AB159D9D1F
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5896
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 323106E230EF03244D25E418378902D8
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3704
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 1978136BEBA8093D65574ED93AD9E7DE
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4700
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 62EF7918B36780F02D1EB2A6639E5A44
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5284

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4656

C:\Users\Admin\AppData\Local\Temp\Temp1_Velocity.zip\Velocity\Velocity.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_Velocity.zip\Velocity\Velocity.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3132
- C:\Windows\SysWOW64\Bin\Decompiler.exe
  "Bin\Decompiler.exe"
  2⤵
  - Executes dropped EXE
  PID:5652

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e58fff9.rbs

Path C:\Config.Msi\e58fff9.rbs
Size 10KB
SHA256 bc5bc96f2d7c68a513f1f3de75507329e0789a8602bc68c54fd0ab0f79ad3ba3
MD5 6fa3679e19b801fe0e9d03f56159d1f1
SHA1 8fe481260961b5250d572579d4f0439bc1fa14a4
SHA512 2dab7a1529a1e6abe73016d8849794d22edf9394b09b837cb671808736b6cc907933aafd02a43e71017f06b55023038a9e791efeadfe108e12261a0c74056618
SSDEEP 96:ZIvJrAQttNa1n81RdC3jEQU2eD2QPuCsThqJU2eD2QPuC6jlF3MeThqVH5iyE5Mo:ZK9tUhgCYvLNIbLN6OEc46kdpb
TLSH
T1DC222002B640C2D3E89B0778E7131B153BBBC6EA571083DF01DD95B85F6A7885FA81DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58fffe.rbs

Path C:\Config.Msi\e58fffe.rbs
Size 8KB
SHA256 5c11c97bc85a8e3f5a29d4a6ae25e18586e0fbc863829cfa2278cb738680d2aa
MD5 14c422b2025131a32d4f674450a8b1b3
SHA1 875e7a9f6c385d3e410e7b7c9871030b3fac3fe3
SHA512 30529afb8e9373c5a63fb4c773a7420e98b6e26659152d9b13dabaa115c5621ec1d0dda358290c431095dbcbbee8dbbe7c328573c3540427a86787e139b0d688
SSDEEP 96:OFeI07BxAjrZkzCvUWQUT2eD26sPuCsThq9UT2eD26sPuC6jkzdYeThqRH1iUE5C:OF90LauC7vuNInuN54EKHV9dpH
TLSH
T19F121081310186E2ED9B5B34C3872B24BFEBE3D79611125F25CD52605F8A7C93F642EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e590003.rbs

Path C:\Config.Msi\e590003.rbs
Size 49KB
SHA256 b4270342239cc7ad57891fb8fa2099336dfea46b27b57ad57ee11402a6333cd8
MD5 57663aa2236b2f9841215a9248c46c87
SHA1 0535e6f0e3198546c3004607e8de2c61f674ddff
SHA512 1f12f11e6b9afa224a121169e8595d79e915a530df777b0bc3f8a23bc1a387124949d0b39b54bb161d583946d27245c19d0a8caf1734d76c2f4a1f26efedc633
SSDEEP 384:kV7ONK0DLsrmMwoXlhkOI5RBMgumgKtaz0XHpZtcMq5UGRWBHNfrL/VZih/28f8X:kpWilnAThuthR2MNfxArH
TLSH
T181334320AB05D2E3FB226C7133E1DD08EF1ACD627744DDA914C61665C5A3DAC3EE885B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e590008.rbs

Path C:\Config.Msi\e590008.rbs
Size 72KB
SHA256 2e17cdf7de42108133c5a859fef3e767ac5295fa9387d3d554d7fa5a97383942
MD5 a7cbb68b0335d44d55711f0211132a41
SHA1 98cde953232c1091f3e7e9fd66af4fbb7cf4fdef
SHA512 8ef4bb158668ba30b06df6325260bea12116b0e06af6cb56d7761b74d7cced442b7f624c3a4da69c12ce78dc6abdf3fd6152c340cf4bedeab14c32732e1474bc
SSDEEP 768:CONxqMomkns8EnoLou+PTcKsfNTGKJL040iA0qTR0P1wKaq00a/UzZYemq0KYixe:3NkNCnoLZ+PTlUN7umeGKymciu0KY9
TLSH
T1DC731F464B91E5C5FB325EB176B7EA4CDD035CBBA292493D20C9252ECDB3D882EE44C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59000c.rbs

Path C:\Config.Msi\e59000c.rbs
Size 3KB
SHA256 1c7b88d5ef9788d813384bc54e990669858d1824f939e55eb9086cdbce70dcba
MD5 d0ef6bf62e9cd0a01ba4eb663b4ff4b6
SHA1 bff985e7301cd094d4ff3595053eadcb21e6a3e7
SHA512 9d758c274303ca2dc43bdbc07cf250735c106b6a1386fa1749dbf8c03bfc5ca5189f2502662194467358b5a38c5235fdfd41bc42120f72c23f282c602e2d21dc
TLSH
T1FE71DF42EA04D2D3EDA72F31DD5707117B7BDBD6A3108347048C92345E17BC56EE658A
MD5 SHA1 SHA512 TLSH

Submit Download

e59000f.rbs

Path C:\Config.Msi\e59000f.rbs
Size 3KB
SHA256 4eca55f3e6db4d213ed211513b522e435a0d4f10a66fa44e4847b1bb3d61e786
MD5 135edd2c5eca5a8d367b7a6be8d2b5fb
SHA1 057dd3bb47d4c20f90f0d9e5a739934220cd6069
SHA512 3bfa4f11653094d819e28e8beae480a9ea40e6029f6352a053b06bb603813b97a20c947912bdcbf173e41188ba37ca76961ba2b99bc5e74f63433e3e44c905f5
TLSH
T1A081EE03EA40E683ECA32F30DD57071A3777DAEA8351834B10CDD1754E4BB8A9ED6689
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE.txt

Path C:\Program Files (x86)\dotnet\LICENSE.txt
Size 9KB
SHA256 7f6839a61ce892b79c6549e2dc5a81fdbd240a0b260f8881216b45b7fda8b45d
MD5 31c5a77b3c57c8c2e82b9541b00bcd5a
SHA1 153d4bc14e3a2c1485006f1752e797ca8684d06d
SHA512 ad33e3c0c3b060ad44c5b1b712c991b2d7042f6a60dc691c014d977c922a7e3a783ba9bade1a34de853c271fde1fb75bc2c47869acd863a40be3a6c6d754c0a6
SSDEEP 192:ydP0KvBLCqikR/EgGJLrlwD+eilNi5Py1SDeoDXDw9lF5OMz6Q:PWBuqikR/EDJLriwlNi5KI1Tw9lF5OjQ
TLSH
T1EC12B57D7284177109D207E16A0AB9D6F62A953C3117AA2438FDC15923AAF2CC37F3E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ThirdPartyNotices.txt

Path C:\Program Files (x86)\dotnet\ThirdPartyNotices.txt
Size 77KB
SHA256 deb4427a295e1ed474b0d81c5a0d972c1b550b9a715cda939cdfa9236b1b418f
MD5 0d8867a25ba926e6e40cd52ab3536b5c
SHA1 89390dc8b8318d0bfef1c6a2fb4783537e28a465
SHA512 317ca335405274f4f91b173651ca2826760acb5ba5cf41aff51adc55c2cda9059fb268333665f13f62fa48119e55a303720a780dd58d28dd9967db4c88407d61
SSDEEP 1536:HA9jHwsGfgg39/zwgAVkguQxrDjugtSEGepkWvrpX7anuqdLSVnfiStPq+3LefrL:HA97w/ogz1AVxuMjHtSFULryLOgrGWm+
TLSH
T17773A45F7E45077319E2C3916569A8C5F22FA02E3B6B2A44346EF248133B42DD6FF858
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files (x86)\dotnet\dotnet.exe
Size 141KB
SHA256 8b6be8b21aae8f21fdfc0e15d350e072bd84e439c4d99e1ee8b6f38a61eabb5a
MD5 f25f2493a974dd8d01fb9410398c094f
SHA1 f6397f4c97ea07a57b846ded5c212b84ce0b25c0
SHA512 81f932c605c96e68e923e37c83eca1e1b24147b5435d3714d298ed1fb6f63ba2663d760d36441921ed80c923b0086a05ee5a27df1f853169c8d29edadcfda4b8
SSDEEP 3072:0078iKA/8gNs0xphwaNq92hxQOA7qVy2nY:0umQphy9z7qlY
TLSH
T1C5E3F725F9958162D15D1970CB29CE91BA3BAC619BE1E0C763C0FDBE0B701C0AAF5B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft Windows Desktop Runtime 10.0.7 (x86).swidtag

Path C:\Program Files (x86)\dotnet\swidtag\Microsoft Windows Desktop Runtime 10.0.7 (x86).swidtag
Size 488B
SHA256 8308f6fca5b2a877534bc93bc62b25b075f846e772afcbe61280442f8f0e86ef
MD5 ad52e97277f16f9c81ea1c03c85e9d7d
SHA1 9d06d56c38818a48f4232b473ac9ee9ec728ea53
SHA512 e42bb7d2b326df0bf3d2cf6d0cb1e80028118e4924f03cf04d2f1647d2f243191136adf2674fd1d66b3dc6378563dc681d7933bfc10826feb6564138960c8f19
TLSH
T148F09E46F522B93249F36720AA5D9041E35EB9D7CC8C6B844C59841A019B5A9437BA50
MD5 SHA1 SHA512 TLSH

Submit Download

state.rsm

Path C:\ProgramData\Package Cache\{580865E1-2073-4861-8356-3D20DFF3D50E}\state.rsm
Size 1KB
SHA256 a19dd723353b655af63146c5a5803f7443ac7d12dcec67794a96fc1fcf337b53
MD5 228f397fe4d0e0507e0efef78c68a831
SHA1 7e8a6eb7ef27f73d251adbc471e4ba5286fc499f
SHA512 353f76efee175efe71d40f09c0a024060c51cb1dd7ca90deda8f4edbd79f2f5d67e3da24517a352140043f43d844b6bd3877e56ed2d24228497127a96b1f50f3
TLSH
T14E2181615BF6192CF3F2AB35A9F96729543BBC125D24C16E0001318A9E72BE1C8B4B33
MD5 SHA1 SHA512 TLSH

Submit Download

autofill_bypass_cache_forms.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\autofill_bypass_cache_forms.json
Size 161B
SHA256 f7510e38f81f8a84027304070205dd55127e3233fdf011411465ede67b5b5d92
MD5 4b1a79b1996f03fb926a97912835c881
SHA1 ca43e23f7bbb4ff3839751f722df3c38ef7bd8a7
SHA512 c2e07a1b311ab71d94c7b874d645fe1114fdccfe4468875d6b23318fbe327481a60b2782af105b7546b3c1e6c3a7ec67261b21a0587f914cc7bf77c55f1f568e
TLSH
T1E5C08C07ABB804230B414E0B590DEFC9990476F6D5C146FEAB75A5A98A3C6B0005B74A
MD5 SHA1 SHA512 TLSH

Submit Download

edge_autofill_global_block_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\edge_autofill_global_block_list.json
Size 6KB
SHA256 7d3c45c8207ba69066516e51e10a2137bc4f1fce070a692e0c65225f9856e04c
MD5 5d4464dabc1289c3a010e14c05b92c57
SHA1 d2d185faca1cd13a6d42dea68803a9941074707d
SHA512 f93f4b58efc0127946ffa1b2950a1cf71da6f77a6ab4cf98ad8ada6a751d6261be4818ff8c64fe1f1d45467aa070e0823d15be36c8259c1044fb2d1289df9994
SSDEEP 192:C73stL7O9FnLk25+tF4B8K5b+QiGoztWuDpR6lFuftdHAa4/i:nwJ2r
TLSH
T133D16A2BA91C54B32A044839128E5BE47DDD73B6DD6008D6D650C0B9AEDFCB8203FDA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v1FieldTypes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\v1FieldTypes.json
Size 509KB
SHA256 611e7995ab7599a0c89f98d6c6152a42aaedf7449748109a465bb5b0badd0af2
MD5 b1c140ef49f01eea089d3957da1a529f
SHA1 de64781f20aac98b4d2bbc497e3defa83b25aa8f
SHA512 02ddfcbaf9eaff793f251bd983394cf473b1340182ac1f3217cb7258ddfbd2de066ab08af16b47a378644bcc1871ad6ed8c641f6a053802c90e77f648e4f4be8
SSDEEP 1536:jlKS/dYt+dtxX9U2/W++dGcUooTHR6rF1azQmkEMUmxralqDAtyttVJAC5c8KrVx:B
TLSH
T148B48E2BF9F25C634D822A32053E18996A30615F5CEC6CD4BB3E211F4F2C1791E797A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9cf5acc3a4797f1d8e969ab1970c2330530e33f7dac25d2b42a810961a67ea68
MD5 6bbadb85852ef58796e988ee6bd3abc6
SHA1 f87a8c99cc4052067a5b532f97bd1ccc92f6a0b9
SHA512 a3813b64d663d976b681f2ced98d428dc47f49c99219d4a147277e7c8375b07692a5a14501eee0df77c86f9da6e3205c49e89510005d4f3b21e3afff243fb088
TLSH
T13CD080155FF27C70D014E8F694187B41392DACA68D43A6115471EA7E4C224D48BD0FE7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ea750b8ccfa8d7c7a393cdf6c9c8a3be0f2f086fb814bb44905a02c83d9af71f
MD5 697a394c9a3ff43b8925489b648b073c
SHA1 5828315de0bd17378051f664204bff07d8659dea
SHA512 37519d78554ef3947030bf7fc74d2660bf2dc752f04de85daef8079fdce335d2e6ad77071de5a938f7422ad0bdd2acad3963260b61149fc0d91381c007a2514f
TLSH
T173D080115FF27C70D014E8F694187B413A3DA8A68D43A61154B1EA7E4C624D48FD0FE7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 a52b0ac1d4a942de4d588e2fd746c9fc092edfef11997703fe793b4518d5254c
MD5 bfaeab8c78508c15e2e4bb5c9cda3094
SHA1 1d9bd98137d50a203404dda4ef525517876dd88b
SHA512 ef56f621615d9aa8671016416f1a94394d4973a3988a52f77a29d96bdc7001de44d7b2b00bee99df3a1599cde6e0cedb5ce2ed50e6e79aa6647cca0eb392510d
TLSH
T189E02BAAC930AC374AFD872854588746F750135717804C4F3A3C920DCFB17274586C6C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000091

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000091
Size 34KB
SHA256 afd4782e0b7442187ef3334e0dd04804eec2f7e78b66f2486e9aad0e2c0f415d
MD5 86838477fc764344efbfb59db3377e02
SHA1 975ba960ae9f272dcbbffa0bb4846ae66a217bca
SHA512 c070be0783368b0cfc2c82c404a77b3d3a54d4fa7276947675c29af0c0f1596c0820ab6b7f55ffef78204b6270599e52685c465a5e5a14719affedfcc6e5171c
SSDEEP 768:UyU08MPVeXS+IFU8EHGmvKhcxSDctxyvsi0PD:IsdeCV5mG3hcwwLyX0b
TLSH
T1AFF2E1309D56284B8376EC684F46B9E2D4953252873AB157063E974835F13ECB3899CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000092

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000092
Size 126KB
SHA256 b43566937efaec9040fdbc6143183a4fde5fb9d1e5f280e0b2e0b37e389edfcf
MD5 5bb2104c8b09f76fadf2c750fa8909bd
SHA1 342a51f0b7cedb8c72f799e9f10b068b66c1b2af
SHA512 3f8e7c721640ba96f232d7ebaad59cc3a1eaab53d20c75e12ccc0c8fd02eccf9f5154d2ef328623740678d55ae824391b8501f4b35e6c870a40761f27fe70376
SSDEEP 3072:4/m+OiJILGsL+oiZUr3Hud9wCbzFq07bXwCK7An0u:4/m4ILezUrXe9Fq07bXdD
TLSH
T180C3129D9D338B13FBBA135D04D3E486EB9438D43BAE7660938D2B701189551E4F8E36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000093

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000093
Size 401KB
SHA256 bba288d879b25f52e6c63ca96097a8d1c41584f421e64803879d22ce37271b3e
MD5 c3259f71a35342a01739b6a3599f6060
SHA1 6f7619fea8d02440763fd4b3c2854cb7529b9dcb
SHA512 8be4a7eb901b495a245a3417c012617244818a683afd1f10a12c27545cc64cb59633ae5a7d4a628fe0f4505f6c2a116d89dacc77c63cdb6d8c2669878f10e232
SSDEEP 12288:xY5J3O5UZdDPgSiBhs4PBTR++65XfVChaEZJ4:xI3jjUSkhTPFRWXNCxz4
TLSH
T15894237D8E5C11FAA654790F9A33370F82A82D3DC60F1B5C1269BC27C6CCA66A137719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000096

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000096
Size 84KB
SHA256 ef1a84f90faba9e8fe20621808c5ac243fc27dfe78aa2eed356ec5d3fc261d59
MD5 0569384cef60ab486d3c6f998436e72d
SHA1 659428a7d179c375403afc80d09a7fd4a2fe0252
SHA512 504f379be0b65e588a31e71e8f54f15e4c81b0d96b8f0e86473b69d98e5973d99f80a1a29ba6aa24527716ac846baceb7113d86cbd86dd67807b370b0894da7e
SSDEEP 1536:9hGd8IPPoBUFpRRX3NzJ6blma2rmsM5+GpZSywks71Qf13tOFsWy:9ho8kPoBURXdGlmeJcGiRk01QyFa
TLSH
T1FE83024ADB3E3198C70C4B61D5FA5AE1861EBB8354DC0868D845AE7F11BC8CE11693DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000097

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000097
Size 20KB
SHA256 0853a7d80c2dcbf17e3cafe04332391ef4067e65d0f6712009399febc059cf03
MD5 001421d61a22df634206a8a7b486ce16
SHA1 9bd41e85857219050eca0498fc3404d06ae7ce48
SHA512 59a002a6e634a50e121a2b3cb1742274263641c6aa0d82320a1dbe5365d02f8116dc1a97009050e42b99e01bb32225e128983b762e432567bb2b1667fe826a95
SSDEEP 384:LWOPjtxgNeTZ9qpiK6jC/5Slrabx69Vk/siggPSyWC/l2nIcuEgwL7PvV:KKmNeTZeiKhQH9Vk/sigTctXAz9
TLSH
T18B92E114AC4FC52F56964A28EBD9002A44953DBADB17043722EF6E4F637395093AA83B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000099

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000099
Size 170KB
SHA256 502db7c47c2f4faaa429a3978d685da6e046fabf9807b730c1c6462dca15b990
MD5 ade938008859f1d95f0eb9221092ad99
SHA1 9153fb2ae075108bdf6d5fd87721ab96ca6108cb
SHA512 a28c058bc68623cfe1d7832300dcc518523199f998220825c44f82bcd089fc0d682a9a2e5989098073d8206ed1fbcb68b2b785c3e20a2ae5b99a5d81d6899368
SSDEEP 3072:N3cfWHJg+ulImlPTqhSH//lKDTGBtsgo5WNFr6DtdIbesEnI7Wv/o76tgOlSHhJO:Jy35l4SH/NqMKg2m5YtdIHEIa7AH7O
TLSH
T15C0412FE5D32A628FB6BA5B259FCF5EFB4C9902720B46813E175F445C845217302268F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000b3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b3
Size 40KB
SHA256 543978865e2cd9ff1b791e8a781cb8831f5ed72a6b711d101bb98510ddd0eb58
MD5 3a4bda96993f489e3f456bac72ef3d70
SHA1 ea08d9cf5902672ebf1537cd8bef073bb9d393ec
SHA512 e257f94f5d30fe5e614b690ade8e3491b83f1f194c495352427c2ea4a4fc9808fcc1d8bd19001b66f6704fe622e7977b6885967c8c55953676ec8b0b0b2018d7
SSDEEP 768:ZG/4Rt+ut8WK/uBnQ1iXH9jpD0DtE1Vod+Ht1PDzt3WstcXSFutO:Z+4Rt+ufB4q9ChQLN1PDNWstcCmO
TLSH
T11A03F11393868784090D908AB3DB336796712D403AF4DAD602FFB72CD853F81DAE466A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 8KB
SHA256 4b5eec44b38d9b283331889fbca8c7e63bfe0d7fd6da6fd5ccf5f32e55cfa28b
MD5 60f69cad07f5999196f5e933cef7002b
SHA1 83c6e9259d00285ca77fc36924a82d66506f093e
SHA512 6018d78f162695cd27a711c8cf4d026db59f0ec8b0f82253d9bb9c13914864b8738679273421a622494b8c28a07259c1cd732a9b15b197bd1e6d83db09d0a199
SSDEEP 96:A8kzDe1+CSK+sksZkSqLLQN30mggwxJLSW64g4zIkggFFlov2/TmUaxe:A8kWYCl+sksZdqLEN30ddx64xxjWbs
TLSH
T10102C84751B284E7FFE68471B3DA78AB7A30885B4AC34F5B17A4453C96BEBD08D00C64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 5334c04df7c573ddebafdda7e10e2c8648866746e9b6f4210ea139dc0065377b
MD5 72f80c302fab484b49e5c953872ce63f
SHA1 de5e26a880b271f7dbcf74064c5bdc1b04c60c31
SHA512 b4323e6632e2a274a3ac7ff6f0af9adbb1faba170124d32cb41ccbbf2227c521ae65c50ed66d93d647c392082f4902b0d0414e45bdb5b436c91cc869feb1103e
SSDEEP 96:ZRFa1dUxMqt94TOkyPeXlQH01wjNWwxoLaoMZ0SSXrcdvE3JxuxUX:ZRkPKMqt94TODPeXlQU1wjszMfS7jJEO
TLSH
T198D1CB4B84B688D5EFF24871B1E0795E7E30E95F9AC60F8747D4512C679FAD48E20C12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 8KB
SHA256 70821042cf3cfdd116b5abd6c71d1b2db01f6833c292c8a53b469516bf08aec6
MD5 399721f87c8ff65ac683b5122eee7559
SHA1 7190c2970199c972db0295277fddc630d465a9e9
SHA512 3551ae42813379f18666d09eff036329ed63a645cf8b66008cbd78170ab7450cc7b4ed22540accb60e7afe36539df394b8c71c00cffd6477f7febaeba1a85ed7
SSDEEP 192:J8DAHYCiXsBIsZhqyGwv30dWx64+ZwfZ7bV:J8MHYCi8BIsXqyGwvO664RZ7bV
TLSH
T1B002B94650B284E7FFE68471B3DA786B7932D95B4AC30F6B17A4853C96BEBD08D00C64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 0f5273fb6152a505e04087263ddd6478a10b46fc2720a9e13b1a34d0ce261a22
MD5 5404ae99f9817c7a31c331753a9d08a6
SHA1 1e0ddd6059661187cebccf175483c6c670e263a7
SHA512 49c4a251af8b07b9e7e1a1c861f2e70371fc376ca288e6a39d8943278372465b7c9b24ff62456f6b5dd22b5753c2c69a048ef911b724f6ca8ba3e06a6c8a00bf
TLSH
T1CF71E887907698D8E7F6407575D5746F36308D4F0B975F4B0BD4457C9AADF204E00C11
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58773e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58773e.TMP
Size 3KB
SHA256 07652f8ef5305168c2b6f061fa8026b72975793388e0587e9f3dc5b43ded766e
MD5 e373e24e11c2af4c3aef4fd118694447
SHA1 3effeeccb519f90de3406ca07e590bd019d56696
SHA512 d368918ef172dd730ce6bad71d82c9cc60ef98844a5fec4d8b415d63e8c2defe7ad1829f3fa8818b73334f1755ab57f763673119d6d6f49e0025a31345fa9914
TLSH
T1DC71C48BA07689D8E3F6407572DAB05F7A70CE8F0A575F4B0BD0447E9A6DF100E40C22
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\000003.log
Size 26KB
SHA256 c09c1749e4bdb396ab90efc97fae4d645542cd6b46db9536c6e7d79977a6c0d5
MD5 f286e6d45593e17374e940a1d32e5349
SHA1 53703d7cc3213916341ac3333133f13f572a27c5
SHA512 1444b83c99a73889d5fd813e783c012a23db19845be4a5b7285b5e5436898cddad5019540e454c54c826fe56c334b8362e74f6b0c685921c9b7d69fb7619f065
SSDEEP 768:JuCyJAPKya8ao4My/qGcFBRkM1MsziRFzPs:sAs/Lc/gzPs
TLSH
T19AC2755275F8020AF2BB5FBAE9B26BA54C7ABE562C00C85D58A0625D4C71F40CD73B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\LOG
Size 345B
SHA256 d0d4d3dfeac5daeaa903e1a15a22c325585609f82c1f319fc4addecc8fc5bb94
MD5 57b896b203c1129d7f4972b5cb8a692a
SHA1 a00019f662fbbe9691a75bb873cb8cee27129511
SHA512 325e8eb88cf4d2433bf8413147f1248806099c6cc49f1933cdd69790ca4a17c1dd40ecc03b6ec57948df79e4e8a3656065f5ab3bf49c4c6c699348696ef69300
TLSH
T1D5E0D87885C9C15B529551D60625BF0ED6E7360AABC8AE861E0CC8117146084B86E151
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 13KB
SHA256 f566c08acabfe6fecb8cad0bc87f798785549c967aa1f720e7f67df1b85d5efd
MD5 c7119b5a978d8eac186fbfc1b67cb816
SHA1 854b86331b7cf1818c640b04f3081f7fd60b814c
SHA512 02027674f87eaddde42bbeee481d18d1789f91a688926b37c70a099ee48e4fb8ac5c0c62bcc14631d0727b9436a00d1b2e7136aca70b5d6298b47aa4eb0e69de
SSDEEP 384:DPfcf2sSoupTsiHXsiuWeOr2y7rSItK78SCeSiJsfJSx/15ebKfdA3GlOna057H4:8Qk3Nstw
TLSH
T12652EEF383F5866DD91556F0AA14AE1FCE1D0919431C3D5A88E4BE4BE3E2471E202A6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 9b4ff13523a0cb7193e993fe4ed14582a51e166bdf008482eee917f5ce252f48
MD5 60e61e393bb255ad8165b7c27e5ac462
SHA1 d52561807603640caae5cdbbae44a8fb48253777
SHA512 ef74d1ff23ac7fd9d08c5c139b8c12b61907cbf272f2af18aa1853c56c9ba8d676e8400c14bf0d3daa3de307c992fa38a3ae71e7c8d3ce0d3b9ff9c12fc57250
SSDEEP 96:DEOfcf+/zBPBGBbKfLBlwd3j6liwlnaABGORb4G5jHztO/Izr:DPfcf+/15ebKfdlG3j6liwna07Z4G5jN
TLSH
T104B1CCF783A5856DCA1196F0AA18AF2FCF1C055243AC3C5A85E4AE1BD3B3471E101B9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 2c1e725ac7d45bf98aca2bdf1d0c0e4fa01d493caf1ff5de7825bb5871b83393
MD5 58a0ca3c7cc74100c40dbecb7353e244
SHA1 e8ed46bea266901375fc08a7c9a1835cb37f21a7
SHA512 97cbb0b5a0a90fd97cd37859c83f3af73a95e58de25a6cdee03677b32415f1e19260e097eb3249ca17deda489ffa23fec8ee800609890860c7dd462ed441c293
TLSH
T15551CFF783B4856E8A1196F0AA18AE2FDF2D0611435C7C6A89E4AE27D3E3471E00165F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 759efb88160536bda891e7ba7bedbdaeaf5bae8e30eed4258c1de2353ca8d503
MD5 2ab854a3d8a6bc2978b07ef189256325
SHA1 b10c9c55e3575a0b1c072c4e00649dbc12dd7df7
SHA512 9c5b903f08302e8f0883466b47d6113472fb859170ddf46b9e0007e89930e4771afd7268d3a31dec8f9370890874b85d86838ea436f2bb0d6eab8572c2d34851
TLSH
T1B9D02223270070F6A7BC2FCAE06EEC8FC32B20650C82EDD461E4989E453946C2A07281
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 25KB
SHA256 8f8faa379ec2aeb5d06b26282f72bd8e0f964bc6f8c8ff14fc5a6f4e77c8c06d
MD5 00e1184d9eb11f4b0b444407e3a11e04
SHA1 afd37da0eeb7abaec5236c3303cc48eee148c0a9
SHA512 c8de2e19a6e26b7dda3c588ca1404d35f28797741254a6d3228bf3785fada670788c67785c0ecad76703b0230959f4b332555ba01466f5f8d74e866af52b2fd5
SSDEEP 768:soTEsm4W/fSKXHOIhMDHkAG0/bw240UasA/N:HEsm4jKXOIhMDHkAGCw2UasA/N
TLSH
T1C6C2F853652489B78CEBC519F935BF26D7E50063CE554E8CAAFCCA0C10DA6FD360682B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 20KB
SHA256 2761e73048bcb00d6add76984bdb465b2c4db5e75ce98fd93c599cfe3a475cf6
MD5 5df2a39d8f03f3940071b931d53ebee2
SHA1 4da39df7617524a4e07403eb3462d07354d2b7c1
SHA512 5c3b4c4f9be2ba17c6c14cc81e5ad0185b7e4e03c52f2283b5429e5d04f4a8d310b7167e96eb100786b178e15762908527197d7831cc28a6192db3c818692ef3
SSDEEP 384:sxZmnDVCW/fos+KTz3LIOOLceE2Apo6D3/bBA/5fDcQ:soDIW/fSKXEOOLceE2Apj/b05IQ
TLSH
T154920A57662449778CDBC619FA25BF52D7F81063DA444E8C9AFCCA0C14EA6FD220783B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 23KB
SHA256 7d0ce653cf25330c4605e768c7d5694cbf7241dff554f7cbc9e9a52faf8ca2f0
MD5 f159609b5b03e952d35cfde86eeba8ac
SHA1 85bde575f7d8344835e6bbd6c5bd9c2e61129440
SHA512 d050cd5ee402c2bebba9c139ab52732ec0ebcb5b0b07e27abb4096ca5fd3eb97e9f49d14c3209a5bae6aff32d04475026c765631c60b6216986ce652cad34a1b
SSDEEP 384:sxZmnCVqsm4W/fos+KTz3Y9OIhMDHkAGV0b/bBAd/5lDcAfHN:soCEsm4W/fSKXcOIhMDHkAG4/bS5+A/N
TLSH
T157B20957662489778CDBC619FE35BF22D7F80063CD554E8C9AFCCA0C14DA6BD260682B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 0365bd73278977f59bf9d401764939bbcb29857c0c01a2318da47b4db02d167a
MD5 10eb7df8538e9fbc7de86eb168b41ad0
SHA1 da02abf7079646b925064c4d47dd95bab157fff0
SHA512 3ed9a1b6b9b3c102d5137f6b71ea3439b3102bca551bde5f43b8df14645e72bf7deebc2192ad2f0c60f1534a7404b5b8a5296eed0ab54a1a044614701834fd87
SSDEEP 192:sxZQRoyMqZ/K1Ml8MlW/foswWH/ILc2zodp5+/W6+WNr3V/Y0luTFIgjRJ:sxZQ7tW/foswWf3NA/bB/5cjb
TLSH
T11D72FB06A638597B8CDBD209FA45BF53E7F5156392544E489AFCCB0C14E7AED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 4d6ea8969e1b9a7125b90db0767d7e6056e65527891d392aaf3df87ffb6d6fbc
MD5 fc3dc951fcc71cb6b496b6922b12a331
SHA1 cea9f0ea535af7fc013fe89827213277772482a8
SHA512 17e47ae8f7beeb3e12195fc5b2438255cb6e57322f8877a7d36572c40e175de927c1ada27a17b8e98fbe0d6ebbc41f5ae2ab9d01b3f77f04f7668a08844cac75
SSDEEP 192:sxZwRoyMqZ/K1Ml8MlW/fos+W04zILcMzodp5+/W6+WNr3V/Y0l5aulFIg5WRJ:sxZw7tW/fos+WTz3PA/bB/5lob
TLSH
T1CE720A166A385D7B8CDBD219FA45BF53E6F4116392544E489AFCCB0C10E7AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 37KB
SHA256 a25baafc70dd7bf52a4ab2c7151da4d283cc51c373241aef0c28f58cbf4b0acc
MD5 583eea96efc28c6d8568ce8a75f3db38
SHA1 426870ed0d08838fdd2d9dfc19ceb0aa3b293f33
SHA512 d568801644b7b92d1e711d95aed26b7d14d1ac3e0f9cf00b4802daaa9dd894792f46d5b1230d002558e278cde3852dea9e1d2c87543287d289e69edecb641971
SSDEEP 768:EmN9b8PT24f7pLuL/CuWRmCCQx68F1+UoAYDCx9Tuqh0VfUC9xbog/OV3o7yZLlW:EmN9b8PT24ZE/CuWRmCCQx6u1jaKo7yK
TLSH
T19B031C3B2C0CCB7E4F844E9CDD26BE8E6DE801CB9698899447FA844C03D66EF45165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 554a32dfa55ad239ca2185fbe0b389b51437f357df0fbd7162dcccc694d0d938
MD5 9a795d242bb4a35c7e69619f553d32e3
SHA1 85dea40a8d8397cd37604637c90923a0cf401cfd
SHA512 daf294a49fc15b66e4ffac7ba95f0cfa1048783d952666ee80b13e157fbde577a9fcbcd335eb65bfafd07c5b63a9f75b49b3c04084d6e974acd6f54169a681b2
SSDEEP 768:EZN9b8PT24f7pLuL/CuWRmCCQx68F1+UoAYDCx9Tuqh0VfUC9xbog/OV3o7yZLle:EZN9b8PT24ZE/CuWRmCCQx6u1jaKo7ya
TLSH
T102031C3B680CCB7F4F804E9CDD26AE8E7DE801CB9698898447FA844C03D66EF55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4f2277ea2139c475_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\16400d67-dcb3-4f58-9b0f-1aee95e63444\4f2277ea2139c475_0
Size 65KB
SHA256 4ed12e154ce3bf18ce12984c97c2e3a62779ea8e7146f1e4cc168bda0ad72d1d
MD5 8c840eb05030d61ce6372255697f9514
SHA1 5d136129996147eab5dbe581a6f9cadaf140c986
SHA512 a36222671e2a412dc4bc2b5ce25b77e2e3d819d1dab1456409801de0a3cce9517aaf0948f48342ddedab51ce548ce9784e0820c19e4aa87d88681293a177064a
SSDEEP 1536:c43p7TNQ9jWdWkYs/b23Whz5CGmNHnZXpg7vnjW7HPwqpzkA/V:c43RoK/YsfhzUGmd1L/V
TLSH
T19F632AA7B062603587AD22E6646B3F00F12B17567944C9D8F0AC69913F18E8B5377BFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\16400d67-dcb3-4f58-9b0f-1aee95e63444\index-dir\the-real-index
Size 72B
SHA256 a428e6e6ce1d62efe96c9e04d447fa04b13c07c4cb4455d7fbd1a4c7168b77f4
MD5 87f1466b220d04ae4138b003a70b29dd
SHA1 1ba812bc4169e1654aa89f89e6fb1da9621c7550
SHA512 050e5f89c2c5bbda9dff8da80c9c704dd835c0439a70db3221e2c9fd08e41e9305c330e5ecd183bf2c369b5ec7f8e10492abe1249f5a949057c74bf4344ca4e8
TLSH
T143A0022605742441D0420BB4564603506316DD1A0151431F4190047D9E651DCED03444
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\16400d67-dcb3-4f58-9b0f-1aee95e63444\index-dir\the-real-index
Size 72B
SHA256 8610e3a124e8d79f1c3b5984c2833a68ce769af21cdcfac52a258c8373a6418b
MD5 e5cb7b12a5899b09bde9dec6f2189bdb
SHA1 a394a0a31bd1a4981125a6df057d995d6cf924a8
SHA512 8bec62ec4870ef38fad67d110413ceab78084a71b2d545d6716ae3fb82a55ea3b02bdb1072a6e597a32887622d9f8e6df3a34e1ef3a3879739f9c4795994b614
TLSH
T14AA00261427400A5E1A21BB1914A61902718ED150351431744A408FE8C611D84E0758C
MD5 SHA1 SHA512 TLSH

Submit Download

623cd082b6202da0_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8c25048e-ff1f-45e2-9fb3-c8319a8de388\623cd082b6202da0_0
Size 65KB
SHA256 31b1ef80c74e60dc68c6230b6bef688bd00cd054e0e2f5419da85ad7851a3a02
MD5 14a1ae6256ba4d862278e265befaa0c3
SHA1 3f5ea5d56c5c7a9608345887ebffdbd153ea8774
SHA512 774c7bb5a1536b0f605a272a01d1c352ab46742497e30ccc36e37415ae3e66afd0955a20969d59907c2daeccd68fda89db588d02b0ce8e4838d74f674af8b94e
SSDEEP 1536:s3p7TNQ9jWdWkYs/b23Whz5CGmNHnZXpg7vnjW7HPwqpzkA/5:s3RoK/YsfhzUGmd1L/5
TLSH
T124632AA7B062603587AD22E6646B3F00F12B17567944C9D8F0AC69913F18E8B5377BFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8c25048e-ff1f-45e2-9fb3-c8319a8de388\index-dir\the-real-index
Size 72B
SHA256 0e4f791ea2f44eed9d7690c8f2e09a1b7c3ad9ec5bb8b70b050151378b862b45
MD5 e08e2bfdc5a0229f20b82ee54a928ddb
SHA1 14553a29af1653b79e01476553f5130cf92a1200
SHA512 8bcdaae288214013002a01d93faeb00eb7a75e843736436ae5fccab9143c4fac9cbaa4dcd02beddf6684c76ea9732cbd151fc9879322782e94979ecc84cbd07d
TLSH
T191A0026406800443C00F17B435DE0151B719CC100649331752A16488ED505E44D6382C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8c25048e-ff1f-45e2-9fb3-c8319a8de388\index-dir\the-real-index
Size 72B
SHA256 ecbca7f55407c0a8c8ec7293c48444f7ae3a1777bd314273b8be8217233d9753
MD5 9e6f3988e4e92ee5db8edf210597bf60
SHA1 8c9cc5eb27ac445443d9f56bf41beff39975c629
SHA512 53aff9e3c5af96ba619022873ea440fea8f9b58561a2eabd64deda1cd2c10718d322597cb8ad986724dc1e04ffb7f95bddfb5e7478f67650d3fd4e88dfcda1af
TLSH
T1CFA0025107A005A5D40316F4269207516351D81007511357D1D1116CDCB05D059D344C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59e584.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8c25048e-ff1f-45e2-9fb3-c8319a8de388\index-dir\the-real-index~RFe59e584.TMP
Size 72B
SHA256 a821665b24467421d3139c4ab0e5e2e21b8d2041656b515e62f86e2ec2a19d3c
MD5 5f6a5896b1dcf9b707980615cb0d6800
SHA1 d38012426c38612a0f65bfcfabea5559778cd22a
SHA512 814eccd07b61b04158de7b32e567655517061bcce96315217c8d0751815bf041b4d2f779b6cdd1e49f056d4b8bddff96240b96953949794217d9a6fcc0554701
TLSH
T1B1A0029163B74D45F05222F1179703419201C914116A934652A50445CD76C40754604E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\975adb1f-7a3d-454e-87a7-b5b4a2c9e7ea\index-dir\the-real-index
Size 3KB
SHA256 2a151307050d0f22013a428c8df6799f5b3ed8c25ba413033e1200ca70872be9
MD5 17dd2065cbd11316628fbe2b9390d904
SHA1 c59dbc0407cce6ecdee4019e855bf953b533f619
SHA512 3d1e62d909a00b282c459ec417cf5095343515c3f0b71c4d45a6351453807db45365a28f2100fc5a7d290c077dacff386915451b77ee8ca4e3bc23c9c5a32eba
TLSH
T10D51D8CC1D4F4FB6CCAC51B21871045137784DCD57545E075CBC627678A332E1E0AE88
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a0178.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\975adb1f-7a3d-454e-87a7-b5b4a2c9e7ea\index-dir\the-real-index~RFe5a0178.TMP
Size 2KB
SHA256 a640991b780c2f5888b3ef49e81edf6a220e7656b9716d8f32355f9af4dfed7f
MD5 65f1ac04f6d781a1dd909c398db49665
SHA1 0f07ef4c27e6979e4af550a52dde7b9e87765e37
SHA512 0d35d0763f60eeb5072e52e1ed3490f9d6601b0e5ec3557651ca4c5fc43a988a5e02d7e5fb330e10b6d84c2189dc75467820a07d96bd71d8bc4f76cf2866993d
TLSH
T1E051C95F9C430A31CDA491B359CA5469333E68954945AF0B35FCCA33ACC77AE3D56384
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c6d60e5f-8a2c-4289-a4e7-01562ea16bac\index-dir\the-real-index
Size 72B
SHA256 265bcf4f06d7ce694045ef1bd0bdb3fee5a81240c18681c2945206629178c607
MD5 308bed848994733faf99ab72c5954fb8
SHA1 cb9ea29161c3b963742ec91bf7da8b736790121a
SHA512 4b7c90741daf95f3db07c335ca59fa0ecba6b61072a33c273f318a415c63af36c5e069d1288bf98ee2f3e49f7b6744494033179c344c9f715727e50ef831fc45
TLSH
T13AA00215C356407EC45107B3128996D0A77CCD2421550F73A0B801AD9E5156C8109780
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c6d60e5f-8a2c-4289-a4e7-01562ea16bac\index-dir\the-real-index
Size 72B
SHA256 eedd98bffb2bee27cd2ebf9dfb9474197592eb5f03a1666089bba40211d9b54b
MD5 ac58b37a846807c36ce0cf949bfe45d0
SHA1 6f6ce035a7e50cb0aaf8885e13775b3fc7efd474
SHA512 4d6f9f177d2d4ea3b2c29c01557f4798798ff2ba2ada3820a34ae93c403865611f5203df74d5cf4b6bc74a15c75f03bf68560ee1c0a8947154c34cc56a20d9a0
TLSH
T194A00214C244018FD53443B0114B46F026284C2D21451A6AC4A004699E611B4436550C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59f090.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c6d60e5f-8a2c-4289-a4e7-01562ea16bac\index-dir\the-real-index~RFe59f090.TMP
Size 48B
SHA256 811b30fc62c41037a543a532702ccee0c3874f2e6e838ef9940624063011995a
MD5 f3b7073cb1ac7fab32b140aac3490aa1
SHA1 6483a935b978bd44649ccafc3dc8355c52d68f63
SHA512 7c13efd5fe7ccdc5933aefc94fca9849fd87eca9031bf42ecb05253b64d6cfd2c7127ce0f185a9acf3342b658517249ff347b819358a1f51d9a44a16122d9401
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 476B
SHA256 42cf2ade315f6540cfa6ee209495c5bd9a418123127a1959a833ae1ee2c51b88
MD5 6418a62c6cd36ae57a364e342d0640b5
SHA1 cfafad8f7b585dde115cbf53d39061dbaf605458
SHA512 e60f3834790a7cc8b097b937769a099bda1bc23e5fe1115c13c80736abd71556d13a9fff8bbd3a7ade496b2807a92f94d74968ba61a39df98ab5efa6856407d6
TLSH
T1A7F05C772EF71C00F9DFD3E6687100B106697C58D866EC4F141AA2DB40B8359255ECB2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 476B
SHA256 587cfdf8a5735fcd140ac956eef35bd47805e782895778c417cd397b1087ec98
MD5 2d5ccb970e33015ed2e10969518727a7
SHA1 b0f82c696e2f81742729cf7b1ed10ad8071b9fee
SHA512 e3d9866efac9a2474128b37b28f5b496f995c21991b0a36ec761f999109f4cea23eceece560e6300e2705e0542871b652f8a4617981cfda49faffdba406401e1
TLSH
T1DCF05C772FF71C00F9EFD3E6687100B106657C58D866EC4F141AA1DB40B8399255ECB2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 481B
SHA256 0ac74e45094ac87a4dae819821e9e881841a259098d39dff254ffce9563ab543
MD5 8261dac94fe7f46e987a8c6795befcdc
SHA1 e2e6db115621322d7fe085538e6bd7a6fb9578bc
SHA512 b59a36a25ab5242b733fdda2dd0df7af5b0d7881f8468fee8f29ce8801d4eab0610cd3310baf43e121b864f85d21505b99c712c7e1a529e5364bd356cd739a83
TLSH
T1C1F05C732EF71C00F9DFC3D6687150B105647C58D856EC0F141AB2DB8078359265ECB2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 f0f0521fb433ebe396b8024f223c27110dee6f1f3f723a07655d61fc7f77613d
MD5 f96600fc8d1b288b64cdb44529509b50
SHA1 b63fb7ef0a2666994f79887d8813b2317aa8143b
SHA512 b1a15b5c72ccb848478b858d9d711b3c16a840a9530f234cde9438ecd24b7bafd4379482cd98c7093636fd5274fa967740bbb1363f379de7bbaca815699c51bc
TLSH
T157A002218968935DC14C967A916B82C6722498981A49223AC1FD915488511444396416
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59fd04.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59fd04.TMP
Size 72B
SHA256 69a99f6e7a893ba84d91787a0e9b564ac0ae3f88326ae552af7eeb9d34e9c887
MD5 c9b2f8db67e361ce66b4bed4d6633079
SHA1 e3b850bae9795e87e079c66d4f33eac02f31781a
SHA512 04285e921441146eb60444f88d9bf98ccc8fe4fdf578e5fe9482b39ba4da2c47ccc7cf7d28b28400e9c8a31c52097049fb1903ea36180200618376337b580a11
TLSH
T1FEA00224976B1400D54C0EB911052291136099590108534646E091DEEC960D46DD1113
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 772c7007385e4915f318f36a69568a473606f3ac01d04115e4e816ff2ce766f8
MD5 c3ab52f9d821db8bb450d5820c10b48b
SHA1 12234cece842b928059d9bcdb5d3e07105ca7413
SHA512 2a186b9e7a5d7580d5e2378b6ce06eb11f81f31d09a8e1b72467f540007b370edebe51f1732f7bf4eea83cd7b0fa8d585b135c278f0b9feb9a48d554060157a8
SSDEEP 384:cdOlNbMrgcmS2paFgkI1keB0k1+ojSSjroduZFtR:cdOlNXJjSSjroduZFtR
TLSH
T1B7B26D15713B13903ABD258A8594B8AF42C231633018E43B7BB954AE4F67E19DDFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

domain_actions.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Domain Actions\3.0.0.18\domain_actions.dll
Size 83KB
SHA256 d35c8efcb710239f009633bcc5ae904ac6dafa985d451bedf791cf6909f014d4
MD5 956f610121cd5827fd5549097b79cd9f
SHA1 dbd23f99895a3a92fbe04c3c35d475a6f6998fd0
SHA512 3cc4712f64474497495d229ddd743c6bf25c30c3fbfca2525f46227d99a59a0f9e80e2119ffb40bc8a707b539f65f907e2e1565ea937e0387db47cf7269944e6
SSDEEP 1536:sNGnmI1FOxAdgxBf8paY3JQzQik428fKagFVbydki8yyafuzWk:sNG91FPgrfrPza428fIenya2Sk
TLSH
T16D83F180DF58411BF86F4835E0B269857A78E6B50FE092DF2376C9590E12FD1AF39705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.4.6\data.txt
Size 145KB
SHA256 44dda6faa8220666a11a09301932b82c5d89ba5cf60227ae3b5c3a0a7518bbac
MD5 370210ebc9e63f6f39a4185846435533
SHA1 17b63f65390d236465b6952953a7df4cbc6fce1e
SHA512 e594ebf58d19f6d9e7024f98107c738142c6cc2504a0ba89e13f8f771c6a600427e75951ccbfe105983c21b735dcde6e6e173f4da37745c4de51bb9f5e86b989
SSDEEP 3072:7PAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEI/tLZjUd6mG:LX1aI5aZoKzMJ07NI/leBG
TLSH
T105E3F1108EC41FACDFA8291C70BE0B1D63E1C79D84676585E773FE0AAFAB90462275C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 99342f73d507313314cf0a86954cea57439a153a42e9e8d4b7bdce646db791cc
MD5 c1d32e65936df0c31933c81b2a15b04f
SHA1 c0f0939ec0a3d6187adb556ce753444b058bd76f
SHA512 7e5a6b8c4b1c809aac7873cb9a4eda408c6d1cac733a7d71f5c6e188c149bb0a0fbb17f66ec9e8b2711a19f4fc7d1fa99a18fa82a3ef1a77848c3e61e490b4d6
SSDEEP 384:npiF0CcmyWC538NLV8TUNTUlIRR1BT2dUpq21ZfnFKPhHmn1oMaXBf+jGe11tTz8:AF/cp53QVwg/1DqaKPhHm1oJpMj11ta5
TLSH
T190E2A1F698D78877D8AE4787A73D2D4299FCC163B5484A94F7984E0CCC861BFD30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 000911dc5343322d54a285ab18f99d0e6f3da29ceb4357a67161818a36081640
MD5 1d7e17dcdc6eea3e01290c53222abd85
SHA1 2344f0b0eaed167e9e6aa419440d8b8e902ffb1c
SHA512 09d54c68671525d19cded3901e125f7e62350a8076eaaaf9b53d96ac6eb721e0af7d8a56597cbe70b27ec078cb4ee7dd74d455628e0e7ff806d1837ac35e89a6
SSDEEP 384:npiFSCcmyWCh38NLV8TUNTUlIRR1BT2d8AV1FfnNYPhHmn1oMaXBf+jGe11tTzN+:AFJcph3QVwg/1eXYPhHm1oJpMj11ta5
TLSH
T12BE2A1F698D78877D8AE478BA73D2D4299FCC163B5484A94F7980E0CDC861BFD30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 bc37a05336d6ac2971e43c7b800aebce0c17247e2a3561a6d50ed8bf1bdfb450
MD5 04cd47b937f012981eb8d0a69b976cba
SHA1 21362e011bcbe2c9820b57a7e7f4bd497ded0535
SHA512 c3dd6890c81170d4acd46cb90fd7231f4ceeeb9d67bd9d197414d4c2e8c2b4ce1b944d50eff1bd2d03c83d09b94edf7f354e77f9daf9aebb7be575b1b8299f2c
SSDEEP 384:nsiFavqMg38NJ8TUNTUlIxB4d45u3K14fDKPhHmn1fARYV/Vw1mRp7ierN1k+5v1:XFayv3KwgLA3zKPhHm1fARYk1mD77F
TLSH
T1EEC24B36E868D9ABEDEA4FC9EB097A03EEE00167D59C4AD4D6D81D1D10D709E230BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 e12e3b37b3d309f4bf03c4b1ca9985bf5900f71814b3b0f3f6070143ef5cc01e
MD5 135129b27a1edf4dd505ed9547ee1d12
SHA1 aff7ab565efd8f0426a07ec652ce2cd78dff9dc2
SHA512 3b202c5c15c2c17a25cde54cd494227cdeaa122f195d00ff5bfcb72495bad663c22aec5ebeeb369a3fef90a1eeeac655beb23ce66f002e5af4e15f5f309486aa
SSDEEP 768:4Fjy63Zwg3VweKPhHm1oJpMn1RYk1mD77s:Iy63fVEJLrImkED7o
TLSH
T1BDD25C36E865CD67EDEA4BC9F70A7A43EEE00163D98C4AD4E6D40E1D109719E170BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 d4c9e409e3faa8d0ec5d504b9b13024841f35410f9e760faf70a0f2777c901c0
MD5 c855239635ce24231518ecbbece91b4e
SHA1 218f47ca585814fdb04fa1dd8b284109f4865ab8
SHA512 01d097df4164c4c2669a4869a8b513d0f77e44840cf9abde559b5e10361754f4b5c496637c79fc510392f993317cbe85a385acff5719352078598a12d18026a1
SSDEEP 384:n5iF0CcmyWC938Na8TUNTUlIRR1g4d4/h14fDKPhHmn1oMaXBf+jGH11tTzNjyZ9:QF/cp93Zwg/1yeKPhHm1oJpMA11ta5
TLSH
T170C25C36E868CDA7E8E64BD9F74A7643EEE00163C58C8ED4D6D84E5C10DB19D270BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 15a691ce2ca7a8152b0206c1f28011d342b01b2b2b88b6a44efd05b3f822a8ac
MD5 6638d6ed9761161468138f2f6f7d3abc
SHA1 a76551927ee851c783773946d1d8b88f4cef5c60
SHA512 9d6f331787f4938dda8ca0069374e71ef51fc7915641210eac3e8453e3b68fabc6a20e8b71efc332dd8932e85557ea21d64949a20e26f6b045ed11232859bd64
SSDEEP 384:nriFavqMg38Ne8TUNTUlIxB4dWkC14fDKPhHmn1oMaXBf+jG81RYV/Vw1mRp7iep:GFayv3pwgSbKPhHm1oJpMl1RYk1mD77F
TLSH
T113C25B36E859CD67EDEA4FC9E74A7A43EEE001A3D98C4AD4E6D40E1D10D709E270BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 e39059de70212af7e7bd589761eae40cb20b3b3cec75293a2569ef1f52220a54
MD5 03e6433ea63cacc0a7f510bde8dce80c
SHA1 3f1c8d33dc9a801cef2aa349759e0f439e03958a
SHA512 28b965dab06cd8c32683c8cd8c6a21756335833e80934df52f285c15c79e27856cbb4211159cbbef3dcc86daae1e050ae6a42653fd34690ddbb763c611702b42
SSDEEP 384:nRiF0CcmyWC938Na8TUNTUlIRR1g4d4/h14fDKPhHmn1oMaXBf+jGH11tTzNjyZ9:4F/cp93Zwg/1yeKPhHm1oJpMA11ta5
TLSH
T10AC25C36E868CDA7E8E64BD9F74A7643EEE00163C58C8ED4D6D84E5C00DB19D270BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 2539e366cccc63abf2c4bf817e6c57bae54d149b6d0350ad0bb77954ba2af029
MD5 12f62136e40200ce4c7a0831652e7120
SHA1 d81fb976bb62936fc2af8d5073ebe557006e2824
SHA512 b096dd0ea20c2344ae61d17a567a952b79fda129b384b428ae5c25c4e6d24cda6643121beb9d7cfeccd87b11a72322a6b993451239c64ac2544fbbe9b7f27348
SSDEEP 384:npiFnCcmyWCv38Na8TUNTUlIRR1g4ds/h14fDKPhHmn1oMaXBf+jGp11tTzNjyZ9:AFCcpv3Zwg/1meKPhHm1oJpMY11ta5
TLSH
T1A1D25C36E8A8CDA7A8E64BD9F74A7643EEE00163858C8FD4D6D94E5C10CB1DD270BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crs.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\46.0.0.0\crs.pb
Size 233KB
SHA256 c132e2ba94619caf6143b3bbdd9c32944e80cbf3bff87364175c42801afe2584
MD5 8bbfaa2cd5cdd9a5019da146cf4deed5
SHA1 17ed2fb07543c5d4bc196a1989dd16a9dbcaacc1
SHA512 cfeee2916f19648ed408b4287e234b4140cf82254cd4b83d918c0a4c3bac2b0467d921915aec290823355be4a0cc82017557be588f65134b466b7192f795f6c2
SSDEEP 6144:KKiD4F7BVps9YpVW+J2i/P66k8GyST+uUP:KB69Vps9C2GAQb
TLSH
T14A34AE9A0F3C3A11BFD2DEA466C8D9377D79B3E06A6928172111C4F169927E07D8C12F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ct_config.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\46.0.0.0\ct_config.pb
Size 16KB
SHA256 aaeeb46cd91a4a392223cf2885f449bf532f0878c087d50bb0cb3fc7fa873a60
MD5 ca6e253c3fc7718b4455493460053be3
SHA1 4085dcccd29a931b8ea9b74f008e26409edf78ad
SHA512 0004e83a845bdab07f01df32094c202c9f3b8767a6dadd707abc19796f917221f869791673315e9d2c5a6a1fc50b922cceb622db98601055df5949818dd6ea58
SSDEEP 384:7tomWvvtJvzm9myvg+FN2VOhikm5hV5+QiyA94pDmiDyDS1c8CazaUhszz:7l5Zhk5hV5+Qis2DS1cbe7Kzz
TLSH
T13A72C9BFA1169F000383D558D6E157AAA12363DACCF3763DB1E1C005F5423E6B1A567B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kp_pinslist.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\46.0.0.0\kp_pinslist.pb
Size 10KB
SHA256 b5b2a45a5b25becb901916b13752e3477d4126a42d088f29863bd8672320ecf6
MD5 8061c7027f406f3e20ea5d26969f00bd
SHA1 635d6260e16d1ac595f760df9c5bdda8279629a4
SHA512 7be0be7d59ed46b7ce6adbc1ddc42119426b3223491a03ff068dae66d13a261cc954640916ff4379a6040e021689f070b33dc82b45c010b728ee59abd42f3610
SSDEEP 96:Bxk+yBjecaikDBwrBnnoxGwMAy5z5tBT6c5MacFwn2Xh6g/gw:I1IDCrBnYQ5jlMacFwn2c9w
TLSH
T1362204B37904F99350E7E0BE1041F59AE93343A540ADF98A528C4A7635F1F0719BB4EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 441e2669c1de173655998bfef7a6fcd72157397b82ce85cfcd7085b7fdfc6125
MD5 fda927c141d02880902b72a0f3c84a8d
SHA1 1a889f9c1fd7c7bda88a27e3139897051b18eb27
SHA512 8cdaa31dd24ed34a5ee3fdd08afdb1729c525fc5acf92cf2147b086845dfa087d2ffdad05cfe4a2c544360ae95939e2cf18e501c1c28cf42740f60d078f4bf04
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 7f08ec9b979a77a420c4b3b50e43a5364df79e65a63df39a42adaf8d1f144ce4
MD5 529b0e27330bfa14338a5b1be95df99f
SHA1 704e4166c0c483439f991b641240314aa624eeeb
SHA512 8a788f27fb2f17f43cb00b6e4bc8bdfc355b2062f9ff9c694da2e645ebc7f7ea1b73bf341bf0c65a3e7268c95ef1ace8961ef8a64d2bc298b915b2db80068147
TLSH
T1B0E001111340427EC43C033400C72B203BF1802103F2020A1A7001682D773243E31FC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 925ec15c3e5dee0d3dff6c301cd847463ec96975ff81bbaa471a044e31884572
MD5 1845c3a81e3157227a013c9ecac07ea9
SHA1 18ba8dca5c74c7cb869ac19d147a6a7290757c1e
SHA512 cc86aa004a0745a9d983503a0ce5cbb4b125b57e4d39cbeff74632a1d05daa333fd8c3cc186e771b3e5205558a8dfe7bcf58f63f45e510f9c8eb42f6f49b3717
TLSH
T18CE009521380527EC43C033400CB2B302BE2803502F2020B1A6001682DB73242F35FC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5a89b3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5a89b3.TMP
Size 392B
SHA256 19af45a5f37bbee56381dfdbb23379f6fcc19142fbe015752639011fa83b4016
MD5 db06c35be636063a2ce240999331419b
SHA1 5d05fe54ca294aa77dfd17a5ab3a1a2cec570ad7
SHA512 1944a13f1dcb147db2a1ab7e43dc180494caf3423b25f190d580a053ca702d8cb0db448cf5ff2a06993e0c0d67b42bb23630c00164da50440c3248e49362a6dc
MD5 SHA1 SHA512

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.4.17.1\typosquatting_list.pb
Size 1.6MB
SHA256 805d8d74e6a3b6b2fe689e200868d7fa4781089d5f6fc830487ed1b5a9017049
MD5 acc4a11e2e7ba213daa0f5e73300f694
SHA1 979463888ec0a9931499a9b1bf6cdedd9bee0872
SHA512 cd81ae9130a4df9ff95932ab57a6f8410aaf6fc0df0979f0d54c2d8332f0c15dc860d0e59d3d6b32e2b14c47a89179c79f935f75498634fe7cb904f3374db907
SSDEEP 12288:1Po6kw86Bm53N/m9hb0dleifKXYXHX0Wi5QIQ6E7JOPo1oQSc9paunY:1PZq9+9hbHifKXYXHX0WwQIw7VSj
TLSH
T1C985B5F9DFC00194DAB8112D20BE71D8081412A540E5EFEAFE7C855F2BC6AC977E49E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 f933bdaa50c2bc0e0f30c8c71bddc797c8d8aeaff53245ee1c089e7deba0a210
MD5 763eddba443fc0fa792e1439f53cd18a
SHA1 c065b67ac1d80d9f88bd9597a4429c5df494f25d
SHA512 b6711b3f03e4181ce07e2f3ffc4491edb674503590c7ddbcd8626c34e386cfd7ad7d453d327078eed61e20926194dda570beeef11ef85c30c1a13c6295deb7ae
TLSH
T14F4160D04C3E1AD1D4BD1A3E649B38FC96DCDB2AF4A4347C2824EA980A7E61C648443F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 d99946cdd2d987b05d10f37e80880a10e379f1660d5060e6243c464afae1f59c
MD5 07ad4bf072e29a6b9a45114e42d18565
SHA1 a630402ea8d922e635e2b4c7f9c06ee5ef5afeaa
SHA512 9ac220e658c4e12751f18980d40e0bbd1a64132f59112f522eea5969baf809ae225320368b612ee74f76bd16e6aa363181aac9ac3d7a9e4a424abe9454db7387
TLSH
T1CB4143E14C3D2AD5D5BD0A7E648B34FC96ECD729F494343D2824E9D80A7A21C748443F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 06d50bdae2e6b8befbc216ad21095d1acdbc350b62e28946fb438e4becba5128
MD5 ab31f9a1add62ebff3b2a155677908e4
SHA1 9366670e83b4b8c655f47d88fb461f5d4f4e9458
SHA512 c8f549e0a54f7a936200ee649ce265430cf949192798b0c5e5c4293f5c2232e2915fc1a69c27f55fabfaaccd1e7adc8bcbdacef62703ff42c47ae07b921cabff
TLSH
T1894140E04C3D2AC1E4BD1A7E748B38FC95DCCB2AF4A4353D2824E998067A61C748443F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 5803c876b283b6e726ff775c384e8dc2506a2de2f231d62438fd41021051ed9b
MD5 ec8c1fb18b64d2d7d8ccdb853591987d
SHA1 19b7af731c28b33d5723ed0e32e53aa64469cec2
SHA512 48d5a734059700e0cd7f3e44bf3bfc72f0f6e6d6c7a4a497721b629214ce8039b09d9ebbc0d36076000ec962efa2b9c2c8195bdf23a7abf9fb74f0103b6c0578
TLSH
T1534140D04C3D1AC2D4BD0A7E748B38EC95ECDB29F094347D2864EAD8067A61C748543F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 fdb2e4a7db8599f69ab2fda6bd08f71eac1f757b5a06d1400da28ebe2d78a4dc
MD5 e2a2346bdc900087004ef619d13f5917
SHA1 43ba2d5e35292e1f5564a175cec4afa9710d9943
SHA512 6d7334e2dcaa2b8e9954c0efd13543411f34c48d3018f3f7a418651c1c7475eed455e675b0c30aab098e49c8622ed0e001c14d0f3c565c3f57587297b97472b1
TLSH
T13D4140E04C3C2AD2D4BD0A7E748B38FC96E8D72AF094353D6854EA980A7E61C748543F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 4cf667c611126a2a3ae9a7e4902c5b6c2739ac366edcfaf4237f7142f88ecda6
MD5 f571352fb8b386fe653be0dd71d9f417
SHA1 32d056f3805daa4490f8cb8b9c3a900a85ba2c39
SHA512 b15cd1eb8fefb34023336c5c43c21f137c806c917ed14a02d2260be7a5e92b6a99de47eaed158447be2a51b5c9a5f1505cc40d628d017b6ae41235b9381350f2
TLSH
T1B94163D04C3D1AC5D5BD1A7E688B38FC95ECD729F494343D2864E9D8067A21C748443F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 265f973437a74550f0c30381751a4f0f7d213749a0f577bc45e283fb51a94f96
MD5 c2b390104a44982afef3bb0b6fe6d3e5
SHA1 b206a8bd4b4b75bc793c7ce1a0257ffb8ae39fc2
SHA512 c6a3b5eb814b9984b58fa60a0e3e8d3f2c81b23b6b417e8926cbd5ddae05a9fc3daad14c21be81330bcb5844e3b667843d800cdccd22c94670844fd67cd3b2ab
TLSH
T1AD4161D18C3D26D1D8BD1A3E648B38FC95DCD72AF4A4357D6824EAD8063A61CB08443F
MD5 SHA1 SHA512 TLSH

Submit Download

3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 54f761e00d363bd15db7bae3cc55144c80148a5fa1db7c3c2049e0e406a9142c
MD5 b1ac780361002049b0a10a7fd30fd809
SHA1 0ee0a7dc27fd175ab7abd6e5649890be3e2795b5
SHA512 1bd8b1d2dc30bc62728d3d08085a446e8c037b02499687affa9a0bb18c6bdfee19104eabdcd8a52c2d0b542046abf26b7fdf81815037d4923e31231b0dfb7d60
TLSH
T156C02B5538F9488C2FA5257ED238092E12E4C912310022B0002ED804103465C13A0C2F
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.7_(x86)_20260507163224_000_DotNetHost.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.7_(x86)_20260507163224_000_DotNetHost.log
Size 3KB
SHA256 5de1048045b0b10acdedb4cf258700959e6316740e9c66a316553555527f4432
MD5 d4486f1bf637449fd0e219761b621106
SHA1 39404b534acbf5acb7b882660acc0c96041e0742
SHA512 edb7234d1747b036e4bbb1f64f4c21fbb14dde44a76471f5bbcc49177f692935e0ee5d66c637abca052136edb416843481bbb7d3e1db541b898cad01af3ecb5d
TLSH
T1D481206D1EE50914B2B3D747AAF7D4121A33FDD66C34CF4C1384861D06ABD0668ECBAA
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.7_(x86)_20260507163224_001_DotNetHostFxr.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.7_(x86)_20260507163224_001_DotNetHostFxr.log
Size 44KB
SHA256 1d4954bd360e59abab7c76c978705e5e79a509353fc1c235ad7046adf6592a5b
MD5 aa981243a68245a09a8e9db1a24ee61f
SHA1 472bdae82e3931647c6f386a6748bf0330b4c83d
SHA512 7d60d4dcaa6109cf57f83b8265ba0d5c8bf26f45ba7351c91bfc3c580f100fbf0c4aa927ad96fdc0bf006103f7fcbd9408eec14e21d6e8d786b8f61888661796
SSDEEP 768:c5OlunOJ+qR/PG03zvbjm2jNbCN0sb5zfMJwJm0cboJyL/cRjU25TAYP:cclunOJ+qR/PG03zvbjm21C3JMJwJm0h
TLSH
T1C2132C3D2EE50108F2B7DB47DBF784251A33BE29A935CD0C25C1C91D05A2906B9BC7EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.7_(x86)_20260507163224_002_DotNetRuntime.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.7_(x86)_20260507163224_002_DotNetRuntime.log
Size 3KB
SHA256 39d3373410bf5667d20e21ffe811d239f3e3c61615c20e705343e1b0a9420ce6
MD5 0a706779609832e86d5a1fca95ea2871
SHA1 577da16754626348c7ba1783ca73a132971ec902
SHA512 5dc69afc1f5ae86bd6f28d594ffae5f810bb78f5be9d3d3fa17bd6985810e00c1d214a70580653d87daa25e0c06ddca91ab7c50ed05cbd00e32ac24a6480959f
TLSH
T19E811B691AE40904B1F35747DEF3C4221A33FDD6A830CF5D2384861D02AB90769ACBBA
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.7_(x86)_20260507163224_003_WindowsDesktopRuntime.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.7_(x86)_20260507163224_003_WindowsDesktopRuntime.log
Size 2KB
SHA256 01861a218d62c4dcc426523dc37cc5125ffdb3522be7859fd441d145ff44eb71
MD5 937ace70ae21e4e59a1d8568512b29fd
SHA1 e002d37b5bc33961c67b51e2028b5636b84e81cc
SHA512 e70abfcea548c0f5ba32793c6793d83bfbf6cacf68fb39388ede34db96bd4dfcafd8ac1e333a0d49ca0ac85365fec45cc53257f848689c867666c41ec8049fd0
TLSH
T18741CA592EE50905F6B297479EF3D1626E33FCD27834CF4C1284425D06ABD056CE8B7A
MD5 SHA1 SHA512 TLSH

Submit Download

DotNetHost

Path C:\Users\Admin\AppData\Local\Temp\{C8B9907E-B94B-4EDD-8E3F-CDBF68F5D839}\DotNetHost
Size 900KB
SHA256 efe1a594f21ea09c5c6f3f75d5618df0ff6bb465e1b7a440394eeadf06d86bdb
MD5 6b8563447431316d2fec41888d36a80a
SHA1 12e0efe2109fb356fa980e7bf7575fbd248cc64c
SHA512 9007dcba3c7adcb29aafcfd77e18a398903cb65f53e51b04c351625751c8fb95d29d2cbc34a232feffc95f900af956d7a75c9a7b3e434a079d9c72c41ca39845
SSDEEP 12288:8jcnTi8XiHmGdKkg78We96sI+yDxTYwsoCm1p:ecnTiadGdKkg78We96FDxTYwsvq
TLSH
T19C157C23BC419036D9EA0D72A438CB616E3D7D14279488DB9390B94DFCF06D26FB26D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetHostFxr

Path C:\Users\Admin\AppData\Local\Temp\{C8B9907E-B94B-4EDD-8E3F-CDBF68F5D839}\DotNetHostFxr
Size 956KB
SHA256 767110859ec26785e7cccf654785f32e3753b545a6c9003d55bd280da9b395d4
MD5 85dcd01ef3e23d75cc9b6ab925f9eb5e
SHA1 64f9491648d78d252bf06c30f042a8def4a203e3
SHA512 a9faab719ffd01d6a6c3ae726679bdc711f9c1311787de148ffc8870611769fe4798a87b6100d0262e3efd04cdcef0bfa7d64316ac6601cff07057d7a8238475
SSDEEP 24576:lcnTiadGdKkg78We96FDxTYwsvqV8iw+f:lcTi8GExDdYwsvlhY
TLSH
T154258C237C41A036D9EA0D72A478CB616E3DBD14279484DB5390B94DFCF06C2ABB27D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetRuntime

Path C:\Users\Admin\AppData\Local\Temp\{C8B9907E-B94B-4EDD-8E3F-CDBF68F5D839}\DotNetRuntime
Size 26.1MB
SHA256 6fe13e18d56706ab4594ef5e8dc0104972e0a732eadb89383bd77815b4ed2b4b
MD5 94215feca007a68a741c4581fd317632
SHA1 10f54be9bc3ff44c7eb840b2fc3d943d79b22e7f
SHA512 682598c5a654f6af043b194b1b44b70a6b3310560966951278ac4d047e0e44ab9be9e8dde6728e41680bfc4ab7b23799198a4b639100eebd0b47dee6b160336f
SSDEEP 786432:AAw74NDnKORiD9fNBvBwDs6jz+Gws44qirlQmkccg:Aj+PRwFGDjj6G+mkhg
TLSH
T184573327BC836022D5EA1D35A47ACBB1293C7D60174488CB87D0B94EF8F12D19BB67D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsDesktopRuntime

Path C:\Users\Admin\AppData\Local\Temp\{C8B9907E-B94B-4EDD-8E3F-CDBF68F5D839}\WindowsDesktopRuntime
Size 26.7MB
SHA256 9aa6ec95172581a1a485d4f5208a0c422e892941c9f859b2efc964def9bfd963
MD5 cecf22905b6bc75e8eda547379796581
SHA1 85db3f58fdac544e5854fae2b137c9ed8ac3fa02
SHA512 fcb8309a1d055a2273a2b08ff079be7ecfac48c8d6d8dcbed86ed976969460f93b4e6d25ee486c356da2d5336b7abdc120fa78f3d47e5006bc059787d6809b9a
SSDEEP 786432:xsMa2N2voVo66TV/D2tZO0I/u/3bb9yI4jSW3e:xsg5VkTV/D2tZCirb9kSAe
TLSH
T1FA573313BD83A53BD6BA0D72A439CB1068395C141B54454F93A4B88EFCF12D3ABF66D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Velocity.zip.crdownload

Path C:\Users\Admin\Downloads\Velocity.zip.crdownload
Size 12.5MB
SHA256 4ba3a8a29a4adaf21f304239e3c769d4f8da809106e01caef80945fd604b0076
MD5 69c1ec1744daf4c5dea14f428621dbce
SHA1 a01c9792d87a5ee761f1953794e5f08cfa3f600d
SHA512 743cd36db333c7412c9581245c7c570313791ac9c2c3311bd5d5cf425a7a0b47751b469b88e7c5216acb6afca8b1385c9ab0d32f7d49985195de3e748df1120b
SSDEEP 196608:VsI43uQZN/rzCs2jNH1CKuXYAISerbwoCFWOB3sMXcz0hNRcY8m/gSTu/gjwGN:VztWN/rzCVNE1YbjC8jMXc4Vv5Y4V7N
TLSH
T155D633DD9EA26F6DD17F3873501859CC4FAD296AE5ED012630A8E0C96AC35FC7C80C66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windowsdesktop-runtime-10.0.7-win-x86.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.7-win-x86.exe:Zone.Identifier
Size 185B
SHA256 4423e7b7a7e49693d09e6fff75f573ba0a43c10bfc0a9e8040caa0920dc5b0be
MD5 ed9fc2d35e3884ecd183b9c3b23a1c9d
SHA1 80669794b594f34131ce1f955325ad5f5f60ab06
SHA512 bddf79cc48cf6ce80e0506687696f54cb9913f7babec90f355b394b128c4295344d70e4f222d0033b4d53b76c75dc172da06820d416f5a352d6b061316971e73
TLSH
T1E3C012ABC80144520E3032821B6ED559FF0F1D125D81C38898C48096E992AD6C1528D5
MD5 SHA1 SHA512 TLSH

Submit Download

MSI1EB.tmp

Path C:\Windows\Installer\MSI1EB.tmp
Size 346KB
SHA256 1caa470031f4f3fb53bb38187d522990a3a7423476b1b5aaa27443a3e2fc62c0
MD5 f715d24632e765c53e9856df53dc8318
SHA1 78e2280ccaeed00119fe827acc58ba10996517cb
SHA512 dd0568de924a86910d8bf59b2f0c22663268004ef9a5f80ffd78f37885f3b8538d138d1e5c70de8e4fda7aab150df48bd34e3838c976ec90ed4f0e49bed0e9e6
SSDEEP 6144:WbOobwWeCg6QvyuFtPwvGyDBQlEz8a+CFTYK0OnsoIcGm1p:W78We96sI+yDxTYwsoCm1p
TLSH
T1BF745B31A456707AE6F90872F568CB706D3CB21827D8849FC3E0E84E38645D36BB775A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3372_2086712533\manifest.json
Size 177B
SHA256 096e772e0f2e8c15e6dec9087ee0a1fb8b0c56b25061626aedc9e7e705adfc2e
MD5 2714a51ed8c2a891ad73b7488ab655b9
SHA1 9a8cc479aec8de1b4eb678e5d68b23b16a39dc99
SHA512 4811522c06ad6946626a9f4d12eb62a1d623825d18a1cd0ad7b628f4c059f37d299b5857abffd959e4ea53239412490539f5705b4aa6c6951d13c68e6d5b72ad
TLSH
T1E6C012EFDC509DB215EB4323156D43C4E733CF4B1546490935FB66082A25981C193500
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3372_250873439\manifest.json
Size 118B
SHA256 69e4e1c13d13f15e8066d6d7e984a96a08d3b2a2ae33fbb218b1e0de5b8d1aed
MD5 4687681b420a5c580fe40870ed6af32c
SHA1 1aa40f91b2ed8c5ea38cb30b81c87a9ac7e21e6f
SHA512 5ced299552785894df9aa86f0cb5d9c057cf73753f81112ef91a8b8dbc6147913e39c27b6327613bc41c447ed230fbbc74881db79853d38e365685132e618762
TLSH
T170B092B00C1AA43B22C09320ECA0668683F84218E8421B1A098036481F882B880362B2
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3372_316110062\manifest.json
Size 102B
SHA256 932322ae700a7d7606efb182239db5fd9550dd6cb5860e0a17bfb6fe3bcb5f35
MD5 19322c8a94f1ac01a70f8c58cdbbc720
SHA1 7c90dac178c47dac9087dfce738f24a4a627f022
SHA512 f54a9cab8dbe96333862a67912e88c4f26cc3e25a7dc93e8f06d1fb5b0b8e91d53cc0f5619c192380573a2846034ee583276d7eda73dc9fc93bb0d9168f4e099
TLSH
T156B01221EC10B4B32004036C086CC3C063272F032C4079280DE19F84E90D9DBE471528
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3372_519606212\manifest.json
Size 52B
SHA256 38bee4120e8eb37975dd2f6a2a3b23f9cea6e6c4f0335ad80270dc22b9990fc9
MD5 50ba36034cb8b97ce52eb941d76e9103
SHA1 a8757a3700f2af777ce5efc382010d2619f51491
SHA512 001110c3e45514a09cf6f60ca14855524e83ac15cf56776cf3005e016464dc6584b107c63842328a7c1738cc7f2154d8689f84d913b9b8199367699c3f9085aa
TLSH
T1FC900260082491171AC10E506570F8859391661A95851D1D0445154802A646CE050298
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3372_554395112\manifest.json
Size 119B
SHA256 7169d86e87f904218238cd293e043e20b7828afad9acd1ff2e5d64188530b9d7
MD5 7382260298fc06c135b7c7399e9acff9
SHA1 6a829f795a3b8be25200675e00abfa1908fdefdf
SHA512 f0ce77f9f72fb6721bcfa9b03f77b0771e8217988183787c00dba4f9d9f19cdba252ddd656422336035f81939cb97c8b5dcb4f036a39280198c17cd04faaaed4
TLSH
T191B09273A800E83830E9EB91093A8243F320AB4BA585640A3625485C0B2B9F990606C4
MD5 SHA1 SHA512 TLSH

Submit Download

keys.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3372_660057558\keys.json
Size 8KB
SHA256 ae6e69a145f84c0a261b4e82888779fbf137f193881d687588e1af71609ae947
MD5 d3ebc1cb4b692c6e2d29a4625420fe73
SHA1 4ce74c1e9af6fd34d6379ec0fec6afb24082a7c1
SHA512 e34b855615e6a3bf770f27d85aa29ca57a324c08bd8f8d9c0130e2a142c0e4a5f17bffd0861b725acc8a2316f73b7fe50406b0af26264a5c2d8f37599b260860
SSDEEP 192:uNtGbR+mFGfvPNyR9Pm4lOvMwkoR9PuGMXcy:ORmqwKjA
TLSH
T18402A57F14A41181CE7FC1698F0B78B78FA038065BCA3A83539BFA49494296D173B5B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3372_660057558\manifest.json
Size 79B
SHA256 7ea98f2308a9c51d17a1ac71b64afbe2a41ff0a083a166a0e4cc428bf44f0715
MD5 817fea104100763cd1bf4f15a51bfe94
SHA1 589717cf98cf7e2d55fc0d6025a4b8e215ed13d6
SHA512 da7b959d93113c5a6be360f90d9c721989c5e7acad7fa592081b582c4c3a0c4a9066a71473fd8492ce7fe7b0fbfd6870d939428a67fbd508fcf6b2c6dc1a41ea
TLSH
T15EA0122058019233108407600360478243551C022015244809461041258813A12A3128
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3372_986933620\manifest.json
Size 165B
SHA256 daf50c160ae8f5935baa4a7207e9d04afbbc81a6dd9ed02d99de12056743eeb6
MD5 8ff4c35081337b1ba6731cc36163c2a8
SHA1 31c80c4a98e5492fbf1b6b3e050446e7240c24a6
SHA512 1a616b9b797441fb438c89864beae36c1a151b1c85e1288481dc61d9f82df2c1fd5e002dbacc05d3070323f56325ed960df3e353d314eb2ee218f8e93aea3fac
TLSH
T1D6C0805294011D7419CE47150D5CE3889723D7152980B0155BD7C218DC3DC8B68F3B4D
MD5 SHA1 SHA512 TLSH

Submit Download

BootstrapperApplicationData.xml

Path C:\Windows\TEMP\{C8B9907E-B94B-4EDD-8E3F-CDBF68F5D839}\.ba\BootstrapperApplicationData.xml
Size 9KB
SHA256 1633b50661776a39ec9ffdc98ec19e48e0099a08ff5168cc3376137a904ee6e3
MD5 1b7efeed50be6f8ee212995070717d65
SHA1 22c3bc34718c78531cc3b56c312a54a89aebff9e
SHA512 9456bee88d409491723b8aa09ef6348b31119b5ee1ef3ba92a9d5fe7034353852c4e0f97031ae4f99e6ecaa49df5ebf611de83ad99a0c1f885318ea9920de5f3
SSDEEP 96:2BqRBM/En6YcYY0wZycirLdin6sUsD20wFycDdin6UkEc0wNycdOZdin6fMS2g05:2I1zfTK/lvjnlX0OOamagM5cYsCsysz
TLSH
T1BE12E3113BFD0218F0F3AE48EFF6A5555A36BD552E39C82D01601D0E49B2E819962FB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetLogo_256x.png

Path C:\Windows\TEMP\{C8B9907E-B94B-4EDD-8E3F-CDBF68F5D839}\.ba\DotNetLogo_256x.png
Size 2KB
SHA256 0f571f95d8eab48dbc81b0ec5e9f7225e349e26ef50868bfaab556f3c2443b01
MD5 39aa52615723b782c92dec710caaec7f
SHA1 760b49e256a7979fe50a56a2b1be3688a474b886
SHA512 89d1baa3820154667747b25e9e2fd321bfb2ec71dc309915b0a28dacdc80822a4943b639ebb37c37bd2559d5a4306d2096119cd970c84a0d331f6c68b0456dc9
TLSH
T1534195CF1BFD78D7E6E557918E1A8DD232738483B4B3A42CCE7B10B8274A5642B87940
MD5 SHA1 SHA512 TLSH

Submit Download

dotnet.ico

Path C:\Windows\TEMP\{C8B9907E-B94B-4EDD-8E3F-CDBF68F5D839}\.ba\dotnet.ico
Size 44KB
SHA256 61a2cbd12868cb9b359e0c78961d409b7875f072eb8e53ea88d3e6bfe2961a18
MD5 b8096652d9ec286709a2c863b244b110
SHA1 b3b7f0f4d608fad7cb59ba499d4d17c2b873a7af
SHA512 492a5aa83220bb77c178b7c5b50bf44968c0427e9e45bb97a33df14d7fb4c667ca7adde0ebb3874c7b6011057b01144e4e6651fbad62c6bcf5e0b93586c4bc7a
SSDEEP 96:r+gfbzo+wHK9NbwOY4tIWQeVlV1W9+H+guapUjFamINUItzf1dBNaIZ:ro5HuNcH4tIzeVlV1WEOFDgUWzf1PIm
TLSH
T1E913EF6DE68547C1C10C2032DB4AC792B5233C72E4DAE0C4F9D4FA7E177906965C6E6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\TEMP\{C8B9907E-B94B-4EDD-8E3F-CDBF68F5D839}\.ba\thm.wxl
Size 7KB
SHA256 b00edd703dd8a475119d0e4dd70a3aaa47f0e95361af290e76d367a8edef3432
MD5 8b2c667a8bbad3153068c0ed90df7ec4
SHA1 c9e04a3a37e5e6262ab9bfecf78280171b8f7b74
SHA512 5269f00d474acccb4c48cb7bcfdf19e63557a388572d3a6335aa39191319691d924e27f70da3f3495387c319396476c63a8fd7b35835cca0901220e39783847b
SSDEEP 96:HiTgM1+XSNEzA0HtYQstYCpCwZQpCeyk5HQJM9ouvj9urz8:Ew9EmtYQstYCPC9e8
TLSH
T191E1026F68DFDEE03A732651B2B3698D6919C29A136F1CF0F869084B47635016377A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.xml

Path C:\Windows\TEMP\{C8B9907E-B94B-4EDD-8E3F-CDBF68F5D839}\.ba\thm.xml
Size 11KB
SHA256 dfee8e2d075087227f19c835c145c5bb8e72a46880ea24080bb2472fd3a521be
MD5 4329e418dc56b1386d7ea29a0dcfab5b
SHA1 58387f92e89ca21b4179fb697c7de9675c59142f
SHA512 6934873d27e6efbb94da4f13ee8369b29995490051016fdf82800256b924902306d328bf1d4ebbf266d1a53eb24adb6478d1a67de4ecc3e3bcbe561968f24922
SSDEEP 96:HgvPkoeWEH3IWTaQfSJgHzth5mFahbuB8pR5+Vpwe+UIJLg1gEp+6F5pQnxc:AvoWydmQfVHMyyj5Z
TLSH
T14B42FC6851DC7811C532D702AB9371D3FF12BDA6C6C85A58B48E256B1FF262028B739C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixstdba.exe

Path C:\Windows\Temp\{C8B9907E-B94B-4EDD-8E3F-CDBF68F5D839}\.ba\wixstdba.exe
Size 431KB
SHA256 2b1cee5e3e24593247854eb7a7c4308937b9c607754ed2fb83520a8706c26f1e
MD5 0e88ffd2e737ac9b9a4241616838bc23
SHA1 3c8beb465d20bcef0cd6ceca9c60286d1d15cebd
SHA512 169b9e08518834c9bc5adfe4ab7b79e07685b72f30ede1c1a386229668bde8c15da378e1274e4013ad7b84d6f7a5acc64ef0806e3b8a66322861efaa7e26b620
SSDEEP 6144:X9vfS1NP+c3ytxmg4Stlqe3B9m2LSLTwGw7C3ZLaov5xZvSdF:X9v+GIyugllqe3wwGfX5/SdF
TLSH
T129943B3165F04037C6F90572AE14FA31BF69F208231095EBA3C0DD293968AE5BBB7657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windowsdesktop-runtime-10.0.7-win-x86.exe

Path C:\Windows\Temp\{C8B9907E-B94B-4EDD-8E3F-CDBF68F5D839}\.be\windowsdesktop-runtime-10.0.7-win-x86.exe
Size 967KB
SHA256 d7159bd11bc004ee485fb6fd031b71d38e4303721d0665acfefaee1fb97588fe
MD5 54b260b4c45fc5f0438080d937e0e2c8
SHA1 c7838ea3732e2619ba05fa3a9901384eeebf5fc8
SHA512 9a063312880700e71b4a1fe12365918900c033ab04c720ba880b4bc247c635ebacdf36672051948e5a07aa5e4773a2ec92a5e321a303175abd6930387a915544
SSDEEP 12288:XVGWl6qCmyZeU6lqlDjC+fScn6X8GwMgJEQaA6fTQfulZYDGSGPjR0ASh:XVGWl6qCmyt6UdmcpMzfz0xOjK
TLSH
T13D257D31A166242BD6F50973F914D2307E2CD7082B5C95BAC6C0D90D39689FA6FFB24B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/952-282-0x000002095EF90000-0x000002095EFC1000-memory.dmp

Download

memory/1164-1005-0x00000157708B0000-0x00000157708BC000-memory.dmp

Download

memory/3008-726-0x000001CE70520000-0x000001CE70551000-memory.dmp

Download

memory/3760-1344-0x0000000000B40000-0x0000000000C06000-memory.dmp

Download

memory/4656-958-0x00000165534A0000-0x00000165534D1000-memory.dmp

Download

memory/5008-135-0x0000024BFB890000-0x0000024BFB8C1000-memory.dmp

Download