35d5cdf23553b14ad8051f68b1af8199805f06479391888f609af4ed54ed5a63

Analysis

user interaction
yes
max time kernel
157s
max time network
232s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/07/2026, 03:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Velocity Exploit_43024246.exe
Size 702KB
Sample260719-dkybmsds9v
SHA256 35d5cdf23553b14ad8051f68b1af8199805f06479391888f609af4ed54ed5a63
MD5 cd85c75fa053954c4ae4ee338d3bcb63
SHA1 fb2fb89c667d901ef01600dae3f027c7dbfe16be
SHA512 f0d7e4732df889e6513f67e266c68bf7490c513bb78736b4fac4d90ed49040415a500ae8f0f9b696e100a92c871d5cf80fdb628bec0f42e3a531e1a636873f6d
SSDEEP 12288:utflJ50c6GeHR6Kjx288tG6rmC0tzeIiZ4fFo:ut9J6MB8gGaUtze74f+
TLSH
T123E48C16B6A801FCE1B7D179C9524912F7B1B847437297CF03A05A66AF2BAE05F3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence ransomware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
106	4272	msedge.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
6496	5740	WerFault.exe	154

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Velocity.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5672	msedge.exe
4272	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134289040113545928"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\OperaGXStable	Velocity Exploit_43024246.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\OperaStable	Velocity Exploit_43024246.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OperaGXStable	Velocity Exploit_43024246.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OperaStable	Velocity Exploit_43024246.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings	Velocity Exploit_43024246.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1875162379-3804078649-638427191-1000\{B991A1CB-455E-4D3E-8210-8C84213A22A0}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings	msedge.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2348	NOTEPAD.EXE

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe

Suspicious use of FindShellTrayWindow 13 IoCs

pid	Process
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 3340 wrote to memory of 2348	3340	Velocity Exploit_43024246.exe	92
PID 3392 wrote to memory of 4876	3392	msedge.exe	95
PID 3392 wrote to memory of 4272	3392	msedge.exe	96
PID 3392 wrote to memory of 2472	3392	msedge.exe	97
PID 3392 wrote to memory of 2472	3392	msedge.exe	97
PID 3392 wrote to memory of 2472	3392	msedge.exe	97
PID 3392 wrote to memory of 4092	3392	msedge.exe	98
PID 3392 wrote to memory of 4092	3392	msedge.exe	98
PID 3392 wrote to memory of 4780	3392	msedge.exe	100
PID 3392 wrote to memory of 4780	3392	msedge.exe	100
PID 3392 wrote to memory of 4780	3392	msedge.exe	100
PID 3392 wrote to memory of 4344	3392	msedge.exe	101
PID 3392 wrote to memory of 4344	3392	msedge.exe	101
PID 3392 wrote to memory of 4344	3392	msedge.exe	101
PID 3392 wrote to memory of 2076	3392	msedge.exe	102
PID 3392 wrote to memory of 2076	3392	msedge.exe	102
PID 3392 wrote to memory of 2076	3392	msedge.exe	102
PID 3392 wrote to memory of 812	3392	msedge.exe	103
PID 3392 wrote to memory of 812	3392	msedge.exe	103
PID 3392 wrote to memory of 812	3392	msedge.exe	103
PID 3392 wrote to memory of 2592	3392	msedge.exe	104
PID 3392 wrote to memory of 2592	3392	msedge.exe	104
PID 3392 wrote to memory of 2592	3392	msedge.exe	104
PID 3392 wrote to memory of 1680	3392	msedge.exe	105
PID 3392 wrote to memory of 1680	3392	msedge.exe	105
PID 3392 wrote to memory of 1424	3392	msedge.exe	106
PID 3392 wrote to memory of 1424	3392	msedge.exe	106
PID 3392 wrote to memory of 4228	3392	msedge.exe	107
PID 3392 wrote to memory of 4228	3392	msedge.exe	107
PID 3392 wrote to memory of 5392	3392	msedge.exe	109
PID 3392 wrote to memory of 5252	3392	msedge.exe	110
PID 3392 wrote to memory of 5252	3392	msedge.exe	110
PID 3392 wrote to memory of 5252	3392	msedge.exe	110
PID 3392 wrote to memory of 4064	3392	msedge.exe	111
PID 3392 wrote to memory of 4064	3392	msedge.exe	111
PID 3392 wrote to memory of 2652	3392	msedge.exe	114
PID 3392 wrote to memory of 2652	3392	msedge.exe	114
PID 3392 wrote to memory of 2040	3392	msedge.exe	115
PID 3392 wrote to memory of 2040	3392	msedge.exe	115
PID 3392 wrote to memory of 2040	3392	msedge.exe	115
PID 3392 wrote to memory of 3928	3392	msedge.exe	116
PID 3392 wrote to memory of 4716	3392	msedge.exe	117
PID 3392 wrote to memory of 4716	3392	msedge.exe	117
PID 3392 wrote to memory of 4716	3392	msedge.exe	117
PID 3392 wrote to memory of 5016	3392	msedge.exe	118
PID 3392 wrote to memory of 5016	3392	msedge.exe	118
PID 200 wrote to memory of 5672	200	Velocity.exe	138
PID 3392 wrote to memory of 260	3392	msedge.exe	124
PID 3392 wrote to memory of 260	3392	msedge.exe	124
PID 3392 wrote to memory of 260	3392	msedge.exe	124
PID 3392 wrote to memory of 3716	3392	msedge.exe	125
PID 3392 wrote to memory of 3672	3392	msedge.exe	126
PID 3392 wrote to memory of 4768	3392	msedge.exe	127
PID 3392 wrote to memory of 3336	3392	msedge.exe	128
PID 3392 wrote to memory of 3336	3392	msedge.exe	128
PID 3392 wrote to memory of 3336	3392	msedge.exe	128

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\Velocity Exploit_43024246.exe
"C:\Users\Admin\AppData\Local\Temp\Velocity Exploit_43024246.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3340
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\file.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2348
- C:\Users\Admin\AppData\Local\Temp\PremierOpinion\ContentI3.exe
  "C:\Users\Admin\AppData\Local\Temp\PremierOpinion\ContentI3.exe" -c:1538 -t:InstallUnion
  2⤵
  PID:4168
- - C:\Program Files (x86)\PremierOpinion\pmropn.exe
    C:\Program Files (x86)\PremierOpinion\pmropn.exe -install -uninst:PremierOpinion -t:InstallUnion -bid:wTUoCKFRkd98$WHxbpPOPN -o:0
    3⤵
    PID:2196

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\cf6831b8259b4ebf8688372bb1964410 /t 2200 /p 3340
1⤵
PID:5696

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\ConvertToJoin.mhtml
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x25c,0x304,0x7ffcaa0ec188,0x7ffcaa0ec194,0x7ffcaa0ec1a0
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2160,i,13811825690958653570,12629216709767291509,524288 --field-trial-handle=2376,i,18151890125402297917,4176606673693366433,262144 --variations-seed-version --mojo-platform-channel-handle=2404 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1972,i,10327849612118169831,15171922418569189140,262144 --field-trial-handle=2376,i,18151890125402297917,4176606673693366433,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:2
  2⤵
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2648,i,5842339849167055826,3448212896014131976,524288 --field-trial-handle=2376,i,18151890125402297917,4176606673693366433,262144 --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:13
  2⤵
  PID:4092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3600,i,16345376608696368740,14189827827046568116,2097152 --field-trial-handle=2376,i,18151890125402297917,4176606673693366433,262144 --variations-seed-version --mojo-platform-channel-handle=3840 /prefetch:1
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3604,i,9330164965353211829,3135923449379034878,2097152 --field-trial-handle=2376,i,18151890125402297917,4176606673693366433,262144 --variations-seed-version --mojo-platform-channel-handle=3824 /prefetch:1
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4264,i,18308281472409948832,12369517024496146657,2097152 --field-trial-handle=2376,i,18151890125402297917,4176606673693366433,262144 --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:9
  2⤵
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4252,i,5954759728610555460,5259387564162853469,2097152 --field-trial-handle=2376,i,18151890125402297917,4176606673693366433,262144 --variations-seed-version --mojo-platform-channel-handle=4784 /prefetch:1
  2⤵
  PID:812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5292,i,13309655820565058652,17785432731540189274,2097152 --field-trial-handle=2376,i,18151890125402297917,4176606673693366433,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:1
  2⤵
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4944,i,9004664766972462793,7054457587611788549,524288 --field-trial-handle=2376,i,18151890125402297917,4176606673693366433,262144 --variations-seed-version --mojo-platform-channel-handle=4904 /prefetch:14
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3912,i,16289467527382099507,2840978812289399736,524288 --field-trial-handle=2376,i,18151890125402297917,4176606673693366433,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:14
  2⤵
  PID:1424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3788,i,868520022543529242,10024893833654289426,524288 --field-trial-handle=2376,i,18151890125402297917,4176606673693366433,262144 --variations-seed-version --mojo-platform-channel-handle=4028 /prefetch:14
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5956,i,1790806161448064479,9828980483005304808,524288 --field-trial-handle=2376,i,18151890125402297917,4176606673693366433,262144 --variations-seed-version --mojo-platform-channel-handle=3884 /prefetch:14
  2⤵
  PID:2888
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5956,i,1790806161448064479,9828980483005304808,524288 --field-trial-handle=2376,i,18151890125402297917,4176606673693366433,262144 --variations-seed-version --mojo-platform-channel-handle=3884 /prefetch:14
  2⤵
  PID:5392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6272,i,17657424973942552487,12077127083154368734,2097152 --field-trial-handle=2376,i,18151890125402297917,4176606673693366433,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:1
  2⤵
  PID:5252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6496,i,9863683786815589061,5667766689564077740,524288 --field-trial-handle=2376,i,18151890125402297917,4176606673693366433,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:14
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6728,i,5545027662737121341,8744884993089960103,524288 --field-trial-handle=2376,i,18151890125402297917,4176606673693366433,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:14
  2⤵
  PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6860,i,8180408279329185322,10343142385110751023,2097152 --field-trial-handle=2376,i,18151890125402297917,4176606673693366433,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6984,i,2623357005610505560,15290528614291587972,524288 --field-trial-handle=2376,i,18151890125402297917,4176606673693366433,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:14
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7472,i,10349785265952857804,8348619984511407726,2097152 --field-trial-handle=2376,i,18151890125402297917,4176606673693366433,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:1
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7408,i,14645047997280329767,4457066832142455612,524288 --field-trial-handle=2376,i,18151890125402297917,4176606673693366433,262144 --variations-seed-version --mojo-platform-channel-handle=6928 /prefetch:14
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=4248,i,7531671107900608317,13310423059118358812,2097152 --field-trial-handle=2376,i,18151890125402297917,4176606673693366433,262144 --variations-seed-version --mojo-platform-channel-handle=3884 /prefetch:1
  2⤵
  PID:260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6584,i,14953978529763419757,4941151991905101820,524288 --field-trial-handle=2376,i,18151890125402297917,4176606673693366433,262144 --variations-seed-version --mojo-platform-channel-handle=6860 /prefetch:14
  2⤵
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7596,i,4628858309573435666,7085856847421610922,524288 --field-trial-handle=2376,i,18151890125402297917,4176606673693366433,262144 --variations-seed-version --mojo-platform-channel-handle=6600 /prefetch:14
  2⤵
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6732,i,4685247629570039431,9398304818511751195,524288 --field-trial-handle=2376,i,18151890125402297917,4176606673693366433,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:14
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6944,i,18279323257643410148,11162526550898744250,2097152 --field-trial-handle=2376,i,18151890125402297917,4176606673693366433,262144 --variations-seed-version --mojo-platform-channel-handle=7596 /prefetch:1
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=6324,i,13341823914378705529,10270635072516791329,2097152 --field-trial-handle=2376,i,18151890125402297917,4176606673693366433,262144 --variations-seed-version --mojo-platform-channel-handle=6568 /prefetch:1
  2⤵
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5728,i,11449615686952784661,14227990262102019382,524288 --field-trial-handle=2376,i,18151890125402297917,4176606673693366433,262144 --variations-seed-version --mojo-platform-channel-handle=7556 /prefetch:14
  2⤵
  PID:4740
- C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.10-win-x86.exe
  "C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.10-win-x86.exe"
  2⤵
  PID:3296
- - C:\Windows\TEMP\{87B72402-2F81-47A9-9B06-8F4AAE1732C6}\.ba\wixstdba.exe
    "C:\Windows\TEMP\{87B72402-2F81-47A9-9B06-8F4AAE1732C6}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{C3B5F142-F17F-44E0-9D8C-A90210077888} {CFC6FAD6-5401-46CC-BCE9-9B95266BC67B}
    3⤵
    PID:4364
- - C:\Windows\TEMP\{87B72402-2F81-47A9-9B06-8F4AAE1732C6}\.be\windowsdesktop-runtime-10.0.10-win-x86.exe
    "C:\Windows\TEMP\{87B72402-2F81-47A9-9B06-8F4AAE1732C6}\.be\windowsdesktop-runtime-10.0.10-win-x86.exe" -q -burn.elevated BurnPipe.{34B132CC-2F6D-4F54-9092-4F7949EA11DF} {B01B138A-189C-4C82-BA29-A8B88C2D934C} 3296
    3⤵
    PID:6088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1268,i,12108138310522530421,14684727775578376651,524288 --field-trial-handle=2376,i,18151890125402297917,4176606673693366433,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:14
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4476,i,8799663388652726383,14022939348474677388,524288 --field-trial-handle=2376,i,18151890125402297917,4176606673693366433,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:14
  2⤵
  PID:5828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6524,i,1699794958804503542,5394071948973540021,524288 --field-trial-handle=2376,i,18151890125402297917,4176606673693366433,262144 --variations-seed-version --mojo-platform-channel-handle=7300 /prefetch:14
  2⤵
  PID:6820

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5728

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5332

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2360

C:\Users\Admin\Downloads\Velocity\Velocity\Velocity.exe
"C:\Users\Admin\Downloads\Velocity\Velocity\Velocity.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=x86&rid=win-x86&os=win10&apphost_version=10.0.0&gui=true
  2⤵
  - System Time Discovery
  PID:5672

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:2988
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 79ACD259458DD1DBC6B3A73FA58BA88D
  2⤵
  PID:4512
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 175684BF0685B3914642A82FCCCB8950
  2⤵
  PID:2764
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 4C952AD875087E275AD617F04EE6C085
  2⤵
  PID:2600
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding A9B2F4D85611C887A6DE7BCA9C5EFB21
  2⤵
  PID:2216
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 79473C8D703BD3B11D8E05D0B50AAA02
  2⤵
  PID:2900
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding B7062EBF3B8C7527F8809B89A38D2EF1
  2⤵
  PID:2592

C:\ProgramData\Package Cache\{4A021EBB-D70A-4B9D-B07B-E1F68B3E7C92}\windowsdesktop-runtime-10.0.10-win-x86.exe
"C:\ProgramData\Package Cache\{4A021EBB-D70A-4B9D-B07B-E1F68B3E7C92}\windowsdesktop-runtime-10.0.10-win-x86.exe" /burn.runonce
1⤵
PID:5132
- C:\ProgramData\Package Cache\{4A021EBB-D70A-4B9D-B07B-E1F68B3E7C92}\windowsdesktop-runtime-10.0.10-win-x86.exe
  "C:\ProgramData\Package Cache\{4A021EBB-D70A-4B9D-B07B-E1F68B3E7C92}\windowsdesktop-runtime-10.0.10-win-x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.10_(x86)_20260719040734.log"
  2⤵
  PID:5672
- - C:\Windows\TEMP\{FAF51B7C-FFFD-478F-AF8E-2220FE49B3E5}\.ba\wixstdba.exe
    "C:\Windows\TEMP\{FAF51B7C-FFFD-478F-AF8E-2220FE49B3E5}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{C9C4923B-8761-4B11-8EDC-01351CCC0402} {1DDC0A7B-494C-460A-87B0-822F433D70CB}
    3⤵
    PID:5812
- - C:\ProgramData\Package Cache\{4A021EBB-D70A-4B9D-B07B-E1F68B3E7C92}\windowsdesktop-runtime-10.0.10-win-x86.exe
    "C:\ProgramData\Package Cache\{4A021EBB-D70A-4B9D-B07B-E1F68B3E7C92}\windowsdesktop-runtime-10.0.10-win-x86.exe" -q -burn.elevated BurnPipe.{C3ADB292-6FE1-448B-BE9D-F09DCF4C6A19} {685443EF-CA40-4712-8EAF-35C019376112} 5672
    3⤵
    PID:6024

C:\Users\Admin\Downloads\Velocity\Velocity\Velocity.exe
"C:\Users\Admin\Downloads\Velocity\Velocity\Velocity.exe"
1⤵
PID:4248
- C:\Users\Admin\Downloads\Velocity\Velocity\Bin\Decompiler.exe
  "Bin\Decompiler.exe"
  2⤵
  PID:6236

C:\Users\Admin\Downloads\Velocity\Velocity\Velocity.exe
"C:\Users\Admin\Downloads\Velocity\Velocity\Velocity.exe"
1⤵
PID:5996
- C:\Users\Admin\Downloads\Velocity\Velocity\Bin\Decompiler.exe
  "Bin\Decompiler.exe"
  2⤵
  PID:5804

C:\Users\Admin\Downloads\Velocity\Velocity\Velocity.exe
"C:\Users\Admin\Downloads\Velocity\Velocity\Velocity.exe"
1⤵
PID:5740
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5740 -s 2604
  2⤵
  - Program crash
  PID:6496

C:\Program Files (x86)\PremierOpinion\pmservice.exe
"C:\Program Files (x86)\PremierOpinion\pmservice.exe" /service
1⤵
PID:3032
- C:\Windows\system32\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Windows\system32\pmls64.dll,UpdateProcess 1620
  2⤵
  PID:3824
- C:\Windows\SysWOW64\reg.exe
  reg.exe EXPORT "HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{eeb86aef-4a5d-4b75-9d74-f16d438fc286}" C:\PROGRA~2\PREMIE~1\RData.reg /y
  2⤵
  PID:6148
- \??\c:\program files (x86)\premieropinion\pmropn.exe
  "c:\program files (x86)\premieropinion\pmropn.exe" -boot
  2⤵
  PID:6556
- - C:\Windows\SysWOW64\CheckNetIsolation.exe
    CheckNetIsolation.exe LoopbackExempt -s
    3⤵
    PID:4716
- - C:\Windows\SysWOW64\CheckNetIsolation.exe
    CheckNetIsolation.exe LoopbackExempt -s
    3⤵
    PID:7080
- C:\Windows\SysWOW64\cmd.exe
  /C C:\PROGRA~2\PREMIE~1\pmropn32.exe 6556
  2⤵
  PID:6180
- - C:\PROGRA~2\PREMIE~1\pmropn32.exe
    C:\PROGRA~2\PREMIE~1\pmropn32.exe 6556
    3⤵
    PID:6232
- C:\Windows\SysWOW64\cmd.exe
  /C C:\PROGRA~2\PREMIE~1\pmropn64.exe 6556
  2⤵
  PID:6160
- - C:\PROGRA~2\PREMIE~1\pmropn64.exe
    C:\PROGRA~2\PREMIE~1\pmropn64.exe 6556
    3⤵
    PID:5556
- \??\c:\program files (x86)\premieropinion\pmropn.exe
  "c:\program files (x86)\premieropinion\pmropn.exe" -updateapps
  2⤵
  PID:6492
- - C:\Windows\SysWOW64\CheckNetIsolation.exe
    CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.aad.brokerplugin_cw5n1h2txyewy
    3⤵
    PID:6296
- - C:\Windows\SysWOW64\CheckNetIsolation.exe
    CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.ecapp_8wekyb3d8bbwe
    3⤵
    PID:6120
- - C:\Windows\SysWOW64\CheckNetIsolation.exe
    CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.microsoftedge.stable_8wekyb3d8bbwe
    3⤵
    PID:6536
- - C:\Windows\SysWOW64\CheckNetIsolation.exe
    CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.sechealthui_8wekyb3d8bbwe
    3⤵
    PID:6684
- - C:\Windows\SysWOW64\CheckNetIsolation.exe
    CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.ui.xaml.2.8_8wekyb3d8bbwe
    3⤵
    PID:6720
- - C:\Windows\SysWOW64\CheckNetIsolation.exe
    CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.vclibs.140.00_8wekyb3d8bbwe
    3⤵
    PID:6780
- - C:\Windows\SysWOW64\CheckNetIsolation.exe
    CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.win32webviewhost_cw5n1h2txyewy
    3⤵
    PID:3760
- - C:\Windows\SysWOW64\CheckNetIsolation.exe
    CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windows.narratorquickstart_8wekyb3d8bbwe
    3⤵
    PID:6880
- - C:\Windows\SysWOW64\CheckNetIsolation.exe
    CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windows.shellexperiencehost_cw5n1h2txyewy
    3⤵
    PID:2160
- - C:\Windows\SysWOW64\CheckNetIsolation.exe
    CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy
    3⤵
    PID:4328
- - C:\Windows\SysWOW64\CheckNetIsolation.exe
    CheckNetIsolation.exe LoopbackExempt -a -n=microsoftwindows.client.cbs_cw5n1h2txyewy
    3⤵
    PID:6952
- - C:\Windows\SysWOW64\CheckNetIsolation.exe
    CheckNetIsolation.exe LoopbackExempt -a -n=windows.immersivecontrolpanel_cw5n1h2txyewy
    3⤵
    PID:7016
- - C:\Windows\SysWOW64\CheckNetIsolation.exe
    CheckNetIsolation.exe LoopbackExempt -a -n=windows_ie_ac_001
    3⤵
    PID:2832

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:2476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5740 -ip 5740
1⤵
PID:4716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5bcc48.rbs

Path C:\Config.Msi\e5bcc48.rbs
Size 10KB
SHA256 ce9b0cf0b578ce3d1216f2bb6e1a641b6e64ee279d771d5c44927080e7c73524
MD5 2a05c6c1429f9581cfcb7967e26de6b6
SHA1 afb1d60c955cb0c9195bd43fa9579a31438ff054
SHA512 05d877a24e8682dff5fb41eb3d153a674d7d842865855c3083d984a533f6f75d5af7dab4924217968820f6da2904d35bb227130acadf615f314e01ad11318305
SSDEEP 96:A51pB1NAuItNa1nz1iRdCHTaeULeD2MyCsThqBULeD2MyC6j//xr1oThqXHa1gA3:AT9qtUhZiC2x8RIv8Ry0j1EaachM5pRc
TLSH
T11B2241456B0099D3EDA727B4D76327223BBAC2EA9320171B05DDC1645F037881FAB68E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5bcc4d.rbs

Path C:\Config.Msi\e5bcc4d.rbs
Size 8KB
SHA256 b9ad1b29f9b2af9540e5cf21e9efac9cc4b186e982e72b033cf55ad22c8972c5
MD5 20c82a01cb74bf572e66c377005b16d8
SHA1 bdc4d39ce921177819004c78a7e2f47c21724355
SHA512 7dc625c0a67e781882766c112634d4ca008b6b5dc02d14f4f84fc52b24ccce2a906db079b0786a7e20733461a42f097d7726b1f654f8d82224683b87b0eaec54
SSDEEP 96:+fx1Y1wRrn1gCv9keUXeD2NyCsThqRUXeD2NyC6jO7lXn1oThqHHm1gs7E5s7wD5:+LQI1gCexhRIzhRv/07vEM4JvFy5p0n
TLSH
T10D121F013310A5D2FC961734DB572B2037ABD3AEA244A75B0BDCD2249E53B885EBD58F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5bcc52.rbs

Path C:\Config.Msi\e5bcc52.rbs
Size 50KB
SHA256 bdd0e2c9f4c164dfb972bdeaf33b5cce8a9a8cfa9600186d1e0ad7bd9e9cb1fb
MD5 ecbe8398876dcdfc294641fba653d407
SHA1 9b8847cedec5698992f41573fdd46281ff4f9b5c
SHA512 276e4cfc2615f9ccd877498bc22894f60cbf350f5f55acb73b5bdf169d90a75b2ef2a8585994a760ef0f55d266d2a05573150d02873f886fd6c2c76de7db49db
SSDEEP 384:37zdcNYw+peKF0OnI+m0WPiHPYaelsckOmzjLxP40KeY7jCHufcIyGqR8wZvE574:3KNHtOI+mlug0KeYUZMB+2/+9X
TLSH
T17933F1D5EB24F1DBFA3ABD7532F3DC006A22CA566B00565844CD2506CEF2DAC6F9C246
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5bcc57.rbs

Path C:\Config.Msi\e5bcc57.rbs
Size 72KB
SHA256 e319afe8ff14ff90915c6d2bd9d335ce19d9e85e31ee3d44aa6092d39e911f7f
MD5 0e0f89524f0bd844b1c6bfb051264477
SHA1 88f0fd57d64d8558c1c34923c90f3fe1958c8da4
SHA512 e7d0277bd14e631c955b25647d718a9333ab494b404ee34a1aad05d024d669c38e886dcbb8f887e656388b220ec1f06d4e76b52b74b6f920b649bf3a79bada2e
SSDEEP 1536:sLyFxj87Ft3rU+604+mLyQeKqYFBt25lK:sL88HrU+604+mWQeKqABtoA
TLSH
T1CF73E36657F0C0D1A5323D65377FFD08ED2A8E679A95A92A00C4212BCAF1FC52FE51C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5bcc5b.rbs

Path C:\Config.Msi\e5bcc5b.rbs
Size 3KB
SHA256 015aa5374e69a5cf93e98f355462977fe3cd3dd0d796ea2d52c51113083bec25
MD5 43478a09ef50384d5a54ae9120724556
SHA1 599b4f31d83f4597da39cfdd7dd148c6ac2b1cd8
SHA512 bfa8c2fa1581c1b2d2ee303725049240b8719065754d56f2410b8b7691422ba554243de5d3ba34bbc2f60c5f6c912205de33e869a9226756d0d0c96032a9d9ee
TLSH
T1D8717643EA24A683ECAA6B30CD531B11377BD3DA9714434700CCB1750E57BD6AFE928A
MD5 SHA1 SHA512 TLSH

Submit Download

e5bcc5e.rbs

Path C:\Config.Msi\e5bcc5e.rbs
Size 3KB
SHA256 c94ea85761be115a1574b8134b7d707328021958de6dcde32918b9456416cf84
MD5 5ce52e7352221009e4084ff15f34b897
SHA1 b605f2bbb087eeae7df692c88516fff93eea0273
SHA512 f020b55b27ee7d91271ef073db59bddb3d66bb00b899431525cd12b631b7ce8d71acf4a6fa553b3aa781ef3262ce2f531f5aa37bc914dccd673aef6e22170c85
TLSH
T16A816C039A90A282ECA22F30CE5B17117777CADAC755834745CC92719E87BC5AFDB1CA
MD5 SHA1 SHA512 TLSH

Submit Download

cacert.pem

Path C:\Program Files (x86)\PremierOpinion\cacert.pem
Size 3KB
SHA256 9f19e7a7139cca8373b516ab1ae49c644aa1c8048e8c7aa5784774a081dcbb87
MD5 77eb3ade4c5b0db67c6e8a26f131073c
SHA1 ad9e8c00174cc2e707f59df671f89a9d7fc2ffc7
SHA512 20eb7d34c80bb8d8a415bcdccf8e46cb36396c095ed1468b69c0cb91da915e3a14c7fd55247f68e64ff71cf8d336cc286c3662710ca6281840fdc2f1eb7ac6a1
TLSH
T1CF616E89DB903C566CA941E3D52F37BE0551C7272D97EA620A09A050C32AF39423DDCC
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE.txt

Path C:\Program Files (x86)\dotnet\LICENSE.txt
Size 9KB
SHA256 7f6839a61ce892b79c6549e2dc5a81fdbd240a0b260f8881216b45b7fda8b45d
MD5 31c5a77b3c57c8c2e82b9541b00bcd5a
SHA1 153d4bc14e3a2c1485006f1752e797ca8684d06d
SHA512 ad33e3c0c3b060ad44c5b1b712c991b2d7042f6a60dc691c014d977c922a7e3a783ba9bade1a34de853c271fde1fb75bc2c47869acd863a40be3a6c6d754c0a6
SSDEEP 192:ydP0KvBLCqikR/EgGJLrlwD+eilNi5Py1SDeoDXDw9lF5OMz6Q:PWBuqikR/EDJLriwlNi5KI1Tw9lF5OjQ
TLSH
T1EC12B57D7284177109D207E16A0AB9D6F62A953C3117AA2438FDC15923AAF2CC37F3E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ThirdPartyNotices.txt

Path C:\Program Files (x86)\dotnet\ThirdPartyNotices.txt
Size 77KB
SHA256 deb4427a295e1ed474b0d81c5a0d972c1b550b9a715cda939cdfa9236b1b418f
MD5 0d8867a25ba926e6e40cd52ab3536b5c
SHA1 89390dc8b8318d0bfef1c6a2fb4783537e28a465
SHA512 317ca335405274f4f91b173651ca2826760acb5ba5cf41aff51adc55c2cda9059fb268333665f13f62fa48119e55a303720a780dd58d28dd9967db4c88407d61
SSDEEP 1536:HA9jHwsGfgg39/zwgAVkguQxrDjugtSEGepkWvrpX7anuqdLSVnfiStPq+3LefrL:HA97w/ogz1AVxuMjHtSFULryLOgrGWm+
TLSH
T17773A45F7E45077319E2C3916569A8C5F22FA02E3B6B2A44346EF248133B42DD6FF858
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files (x86)\dotnet\dotnet.exe
Size 141KB
SHA256 6670e43102d64ee62a76d74083f14dcadb7dd21d8ca38390ef5551df13477072
MD5 fcb506c20a386242fa4524a9de322fea
SHA1 79929eac36c24eaffae6c83ea2addf7da3ef3cb2
SHA512 dc8b4fd3ba8776c26e1bd4c16220be67e8a67361d7fe56e9a2eac62b52fa27bf87d0b616562f18c5e274cc5149bf4e98b050c7bd772521746c4c554260051284
SSDEEP 3072:V/78iKA/8gNw8xphwaNq92hxQOAyqV9vfoi7:VVS4phy9jyqnD7
TLSH
T183E3F725F9958162D25D1971CB298E91BA3BAC61CBE1E0C763C0FDBE07701C0AAF5B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

state.rsm

Path C:\ProgramData\Package Cache\{4A021EBB-D70A-4B9D-B07B-E1F68B3E7C92}\state.rsm
Size 1KB
SHA256 7c4d927e155f23480e46a7ee29e99268f1d7927c51227f2a2baaec9500800dc1
MD5 460af76606d1700d7e2e7f8d0b6a772d
SHA1 e4a030d74fbcb7cc1b5ca44073c2ed883f5015d7
SHA512 1b804ec1a378f0b11fb98c42f3b9c0f37173b8b83b939b9e453ddc35ba96729ab0df41c318390246c9eabdf2b1c10d045060686da4108703abc132c2c5ce6809
TLSH
T17421D1515BF6092CF3F2AB34A9F96765543BBC121C24C16E0001318A9E32BE0CCB0B37
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 dfacefa73d018d54e3feba3eef28ec722a8422fee8768a2c3d8d6253f863b375
MD5 cb5000b6fab1115bfff50bedcc3eb9fd
SHA1 afbfe0ec03df59e7a1eba1da4227111508419c03
SHA512 aab9a1afd5de2f983466724b6ecf0dbc2e176c5a1eb2f059b9507511cc53643fcf9ed990bd565f22f8d53fb82db71cba238962a75c68db02d5f10b526661bd08
TLSH
T15AD09B667354991CC9C439712462565161015820941443581D96B16CCDE56C707561DA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ecdd5c8034c45eff453cbaf31d8886e2bd9609a73853367a6d096a69cc81f1be
MD5 a774534a956a5c8affebe08e87c80683
SHA1 b3e4e20a91e4087d3b9247b5ef6815f51858a041
SHA512 27769aee2cac148a0154fe42b51da2a9a1088e9e990873915b4c7ab9bd5442a3facf82b2bd1cbaef75328bd5937813698b96ac06aa76d934d07ab5ebb194a824
TLSH
T103D09B6673449A1CC9C439712461565161115820E41443581C96715CCDE56C707571DE
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 8b134b647e1b4fb9fa8bf3e85cde1581295e6e6cbabe08081785a63b35b91ed1
MD5 c717b78baff8b0691638265144dfd991
SHA1 dcae46c5fe65f737e5dbf4156c268be539b147b8
SHA512 9e26eeb67ba2a6a9d93a15daf4a5521634afc640e1d15bdd4334ddd226a014619a98ea5b87f647a6efd48f1a5b50a1edf7b38c2244d5580121b3772f826fff8f
TLSH
T14361ABC49363A5F2CBB4C8731DEC58583BB6A97D01575FB194BEE87CB81A3AC6710250
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 da3d5ee8cee2a59395e141cce6986fdeee55d058a252c3191324cfc4d324ce60
MD5 1c96646fffb0c2e4b94950889bf3e1fc
SHA1 5a7aa1b3fb2ec5c5c1587941ac18a05fcfc932b9
SHA512 fad6b120457b5cbf93dfc7c0a7c83b7e540b6c13e38087aa1141c906f3169a6c02acbc8b6377f4299c8da527442474a1efc9f3d0929617e4055665b4b37f0ef0
TLSH
T11551B9C49363E5F2DB74C4732EEC49583B76AD7E01872EB290AAE878B81E36C5310250
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5b4fa3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5b4fa3.TMP
Size 2KB
SHA256 c07fe7f44c231833903cfa4a4d9d1c01d544cf339227e80faebc54defef1adf7
MD5 cdce0a18fc413dff25f09be86900a65f
SHA1 6587f33b91df6574b4c979858f11d0d73600e31b
SHA512 6dee5efd134decb535cdec71fe50c5bf89a70ff7f0de873a4779ef1f691d7115191ec8e651c549a4e9034b8c7aa79b623efd9020e982c463aba2095684b08891
TLSH
T1E751B9C49363E4F2DF74C4732EEC49583B76AD7E40871EB290AAE978B81E36C5310250
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 abe9807210ae3599791ff1d3e12ab9c7b355c55afc1f57addce3f091a139eb8f
MD5 5b734c752294ed0d384a5eb92d7cdeed
SHA1 5d3e964b08428682c99d9b22704637c017eed789
SHA512 109e0142ca55fb1af1ee18c3603898d7ab915aab7af6860232a6ce364f6841bd9ddca4585d376e0a9e75dd0eec4b01a59eab73cd13db9da9075d8acbb5c99814
TLSH
T1BF619AF787F4856E8A0196F0AA18AE2FDF2C0615431C386989D4EE27D7F3472E10265F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 47f4dd8f574829e39464489a11db9b699c8b2d6c348782b01f2a55b60c608817
MD5 d2af90380c09b243c636ffacb4c2c0b8
SHA1 1667b3bb65c161de608d0b18f64e06a07262070f
SHA512 0f2f67363e3bdff75ce526526b1960ba5cca26c56ef1d93ad54eb9af92fb0dd5e0df87d4ae1eedb0b7d63f7c1ceeb1b5e7c7c3950ed2f673bbb7d8cd7d521ee6
SSDEEP 192:sxRsRBTC/fuslIUoZz/zoA8p4f/1Z6+WNIYD986SoGihIgtJ:sxRsbC/fuslIUWzWG/wISSu3
TLSH
T1B332B6166A68993B5CC7E219BB55BF53D6F96032A1D01E48E7FC970C00EB6DD130380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 ed4461909262806c331bd4fa9250c4bf9579c869d6694cb517781655ba20bfb0
MD5 72ca81a02a4270efb52329d623dc64fa
SHA1 d6594086f2ee55b287d2d7afef79a124e1976503
SHA512 3fa83f2ec2d035153ed73ad07b61bbf8536909d8d7d326b42f49abbbf64bbc3e2a76f6a110a53b8ff0382f5337634b595ca3606a0658c40090bf9af4304e9ed8
SSDEEP 192:sxRPRBTC/fusKIUoZz/zoA8p4f/1Z6+WNIYD996SoGihIgDWJ:sxRPbC/fusKIUWzWG/wIJSuO
TLSH
T1A142A616A968993B5CC7E21EBB55BF53D6F95032A1D11E48A7FC970C04EB6DD120380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 785aa5bea1dbce24cff984daa3aa6ac1babc92033175142a4d231a912b912a32
MD5 5acf8d8301d27cde094c325617d3f2e4
SHA1 bd51b1bddcd16501df7eebe5ae5e7f0a3c4729cd
SHA512 10bb0d1446930cb3b783befe950c2b5cb5972bff6cb730238c406465ea080470b36323ef16cda03cf6037028465f952cbe0af57b34c90e169fd4273d64973b5c
SSDEEP 192:sxRPRBTC/fusKIYoZzMzoA8p4sA/1Z6+WNZV6/AiD9U6SoGihIgDYJ:sxRPbC/fusKIYWz9C/wW/hSuo
TLSH
T18942B856A928593B5DC7E21ABB55BF53E3F95032A1D15F48A7FC970C00E76DD220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 54e55be97391e42ab81a8c6a71436aa73967bb43eb4a81a286b3da486d8e1fb8
MD5 d0f0b4271c0ca1929100be501230c949
SHA1 748242af62771025c1eda340896e2092847cadd3
SHA512 0225283bf3f2035ec8a5f4474ca3f90733646b960fb4bab869bf5e81997e198d3b8af0044c6cccc16cf8bdf7211dbb9ef9997c8deb364186348d3de8aa0bb24f
SSDEEP 768:azfW/L7pLuL7J0Wg/XfHf8F1+UoAYDCx9Tuqh0VfUC9xbog/OVJ/Yc16Kropic0p:azfW/dE7J0Wg/XfHfu1ja6/Yy6hpi5
TLSH
T191D2EA7B240CCE7F4F800A9DAD197EDF6DA802CB9698CD5047FE951C02C6BEA52164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5beb56.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5beb56.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 537971a55df0b071dbdf2518a30564b356c712fbb4b5cec3173a8ac0f609acca
MD5 904162af229c2187e7af5223ac8e0841
SHA1 128fbf248e6ec3245df0e095fb2a144a15fe5a03
SHA512 c68105bb73f89d8020b7d66367c30eb1b1bd3bb1614ae51c5bfed52ecabf2d3ca18ff0c954e77d6738133248f9849fb3eab477a5567352f9dac9a36af56386a4
SSDEEP 384:nAtNn/s3n9SY38NQdi6dcB7FWZlf8hyEGZjR7BFdy2rEoajo4cdR8eHhVODjYPN2:Aj+9D3+f7Si0HrEnjN3Gac1Fcb9MS
TLSH
T176F2BF3468659EB34CEAD39676477742BFE017B389C50E98DAC8BB0C06C76EC5707826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 0c4870e76f164a5060c187df4b4b81c243743067e7ad3721d2466103a93fcc60
MD5 6aa13873047578231ab849d61234f5e3
SHA1 6f15c0395a27fdddc11a96ba77b4c277d7036b91
SHA512 c247748788cea741e32464537b116b06b72fee3efc11a6d6122ae1345fb6dfec4761dc67cf93e35fee231e343d170cf24b4fe8e1df2800a8f027281ce1aac254
SSDEEP 768:rrv+4UNbdS3wmi0yrEnjN3Gac1ZNeVH1SCz:rbsbg3nyQnjMauEH1V
TLSH
T19603CF3269A89EB38CEBA385714776037FB4125386940BE4CADD7B0D069B5EC130B967
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 6ed5cb8315e5038298178e88b09a26b3ec97a47cb108648122463a29f9d37835
MD5 1c1e88535d1bf9dd19d67270de1734cc
SHA1 ee353b1ea398c3e9c22e4bee8bc9bee73b200ada
SHA512 b0178a8019df3badd69fa6fbec0cf807b2059d28836fb018e3f13eaf7d650d0d4878b519134a0109528b2a74073c40d5e929c7303172ffa84d2872ebc23ffd01
SSDEEP 768:Qrv+4UNbd03+LXSi0mrEnjN3Gac1Fcb9MG:Qbsbe3WYmQnjMazb+G
TLSH
T1AC13C0317868DEB38CEBD255B1477653BFE416A389C50E94DAC9BB0C06875EC270B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 73da2a96c78cdf42ba7e7f02ade3792585156a4042dbf8e62069e795c136cb32
MD5 bccab4955d8ac40ffc8e37d9b12c0a43
SHA1 e55e2200bccd97d8fc902f71b0d38bf25a507ce2
SHA512 ffb3ea03ba1699e1cf85ba94334aa3de120fe3f4c2e67025858477d5a8c3fec040071b43eb7cdaabb53902937dfcc13df88464f79cb4d35d69091b24ee678f6f
SSDEEP 768:3FFj+9Y3jwgvNZulsIrEnjN3Gac1Fcb9MS:u9Y3T7IQnjMazb+S
TLSH
T16C1318F598D78A73C89E4787673E6E429ABCC263B5844994B7C46E0CCC835BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 abf7f7e83cff97d55cc26746ada28af1a8026b39cff10ac067affedeea0419ae
MD5 1098bfcef75df1df1eb79e15e582a9d0
SHA1 8c4d9dd3e0363d8c8ee309d36055cbdb766e3971
SHA512 f0b787a9b7d43055c7c8535ffc4ccf24cd1841bf0dbefd990ac80bfc1c5deba0a220d21f22b3fc1ea9fbbc9097ebc0148acf2e43ba2eb7bd7190359a2e8e8f10
SSDEEP 384:n/tNn/s3n9SY38NQci6dCB6u2WZlf8hyEGZjR7BFVy2rEoajo4cdR8eHhVODjYP8:/j+9D3bJ6uHi0vrEnjN3Gac1Fcb9MS
TLSH
T12EF2BF3468659EB34CEAD39675477782BFE017B389C50E98DAC8BB0C05C76EC570B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 5b37935bd66db05b6858ac11bf9c61f0f26995ff705a29190da4943f8c5cbcca
MD5 bf7f25bc73337968b631b14f7c39d7a0
SHA1 3f9395bf28b98e3d2761e57de5f7ba7dd10a30f4
SHA512 e1db600afe1ed743b6f5f36a79cc32ab9bfda7d8a291c53bf50dc469f31fddb96112fdc6f9b04753c848fca87c5c13626e3bc01bfcc3ef80aaf9fb1ee9cc13b9
SSDEEP 384:nftNn/s3n9Sg38NQci6dOB6u2WZlf8hyEGZjR7BFVy2rEoajo4cdR8eHhVODjYP8:fj+973bp6uHi0vrEnjN3Gac1Fcb9MS
TLSH
T1E0F2BF3468659EB34CEAD39675477742BFE017B389C50E98DAC8BB0C06C76EC570B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 d24f7b8456f513d8435c47fa4f53ca1bc35a4fbe89c944db76041e4cda3a5525
MD5 4bf7cf2544e3d6e23afff75622886744
SHA1 645177f5e988e64f20616f9f02a551e980250bd7
SHA512 ebf2a1e0d89d1fb8c0365bab55885e6bda4da9b92af35edd82f13dd2eacb87536b8fa51d10d64f17ea8f913c15d58c31ccb9724c0b2978ebeac5b2c173a7002f
SSDEEP 768:3FAj+9h3jwgvpZu8sarEnjN3Gac1Fcb9MS:h9h3PQaQnjMazb+S
TLSH
T1651318F598D78A73D89E4787673E6E429ABCC2A3B5844994B7C46E0CCC835BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

d632ada6-092f-4d21-9b6c-1297d40e0683.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d632ada6-092f-4d21-9b6c-1297d40e0683.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.10_(x86)_20260719040734_000_DotNetHost.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.10_(x86)_20260719040734_000_DotNetHost.log
Size 2KB
SHA256 7baa37f7bde94bcfcbaf9c63ed479edd23f229d15e4b53598b8c18c0bbcd0595
MD5 aaf30f9b8ec06e1639f99b73f207e5c3
SHA1 e876582521430daafb67ef866be09779dc325337
SHA512 0cf5cbbe72e0648f72259f94da84ca9b1f4d33a9b19b50afe4e7857bb8f2eff9ff208d8de45987b7caa8d1dc8a5b79324602e6a8b4751eeb7dd69276495a6f39
TLSH
T1D14129551EF5091EB2B3974BDAF3C1530A33FDE65935CF4C32888319066B9016CA8B76
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.10_(x86)_20260719040734_001_DotNetHostFxr.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.10_(x86)_20260719040734_001_DotNetHostFxr.log
Size 2KB
SHA256 5659e9689da5bd2b2d4f9594488707a3084f4241a8834a7e0fd56ee29e6f34b6
MD5 1ca33d7fda2a1dd2b7ce16023c06fb8f
SHA1 6b0bfbfebf20bbc3d67ec7fe8d19c7c1b32fff31
SHA512 52d53afda14ed2c61a7a31ad59317af739d97f65fa98372d86ae22d9b5b78db1f03c70c4a4579f5b11ccbf5fd9ac858604842f8c87cbcb716d73a73d767f356c
TLSH
T12D415B241AF6080AB1B2574BDEF3C2531A33FDD55934DB4C3348831B066B90998BCBAA
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.10_(x86)_20260719040734_002_DotNetRuntime.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.10_(x86)_20260719040734_002_DotNetRuntime.log
Size 2KB
SHA256 8784faa09f8805d778abbaee07f02c0b9bbb4188dfd78c741228d3e93aad75ce
MD5 5449fa2432d43b63c5870021deb1f1a6
SHA1 eaded150c327751788880e55a2efc3d51c1925a0
SHA512 0a0b2a661a35e7af451a85fe3f154e1eb6ad98083c17c5fe6dda4b09733e3ce8c6f3ce3bdc1af4237fb5cacd9d5d637eb3c88199a540693c22cad7fa71fb7b22
TLSH
T11C4127641FF50809B1B29747DFF3C1534A33FDD65978CB4C3248431A466BD0598B8BAA
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.10_(x86)_20260719040734_003_WindowsDesktopRuntime.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.10_(x86)_20260719040734_003_WindowsDesktopRuntime.log
Size 2KB
SHA256 072a16776417206cdb0c0886b47289a55220e0063d2f0e30da73820bf4171cb7
MD5 d38a0f3bed9742b6701dfb8192ed116b
SHA1 21c65e6ae34b7593980c442ecbfbd3f959869ac0
SHA512 fcc5ce49c67e7e5dc9a859ee2d77127f253d3f1ba1abb56222ccd456aa4c5b04ae721d08327475735ac4675c19953e26284f3f7ac8fb5a615e3c7384d184dde4
TLSH
T18A4117241AF50849F1B6574BDAF3C1534A73FDDA9875CF4C3388431A066F902A9B8B7A
MD5 SHA1 SHA512 TLSH

Submit Download

ContentI3.exe

Path C:\Users\Admin\AppData\Local\Temp\PremierOpinion\ContentI3.exe
Size 3.8MB
SHA256 ef2734657b11113a433abb7ebac962e2bf6bf685f05c5f672997f01875430168
MD5 bf6eed6cdc17a0130189a33a55ef5209
SHA1 e337f5a0931f69c464f162385f1330b4d27b372f
SHA512 90d23fd84007343e85f9fc003cf826b112fd930216a24d8c1488468443ae2a4b0c3cc2426b91c81a8228e125050e922fce05672e010e65247709fc4a7b856f1d
SSDEEP 98304:QOlxyx1rYP44YaQqtGeIEAGoZXvFYfyCu:QOS7dqtGeIhGQXNYfRu
TLSH
T119166C02F6408039FAD201FAC3B64978EE789F141389A1D383D5B8F96B765D2783675B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3392_524464425\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetHost

Path C:\Users\Admin\AppData\Local\Temp\{87B72402-2F81-47A9-9B06-8F4AAE1732C6}\DotNetHost
Size 900KB
SHA256 1a4265446fee42bd3854a8d6c4a8b447e15f3812e4bd09c269529cf7f6863741
MD5 691142e73515a1c228f09b8c228a04f2
SHA1 a9da3c06e5ccd00673340f86a6ce48b8ed7ba2a8
SHA512 f39791ddff1b4240c591985dda60476b72d91748c41b9dd8bdf41b7e72b9e89196ec8fa0b77942104bc5d27ce0bd0b0703183e7b3f74b4ae988cdabb18c9733d
SSDEEP 12288:2jcnTi8XiHmGdKkg78We96sI+yDxTYwsoCm1G84:UcnTiadGdKkg78We96FDxTYwsvq
TLSH
T1C4157C23BC419036D9EA0D72A438CB616E3DBD14179488DB9390B94DFCF06D26BB27D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetHostFxr

Path C:\Users\Admin\AppData\Local\Temp\{87B72402-2F81-47A9-9B06-8F4AAE1732C6}\DotNetHostFxr
Size 956KB
SHA256 900f39253b93df24a12b69cc17644a690c27b443621846f19b5bc6f9b54ccbbe
MD5 365fed3d385cef1dca5678b94d4f734e
SHA1 0b2de9335b6ad90a182dcfefd8e82fd285e70a03
SHA512 a7d70eb4ede82049b9fe5efe3d82916ec50f4eda6dd8751cdb068b0146b5b971215a3c552c004e30fe29a89d65b03c2c4d266ebb2bbac69081948da155266d38
SSDEEP 12288:0jcnTi8XiHmGdKkg78We96sI+yDxTYwsoCm1Vgzwmh6AwrJ3:WcnTiadGdKkg78We96FDxTYwsvqVggJ
TLSH
T196258C23BC41A036D9EA0D72A478CB616E3DBD14179488DB5390B94DFCF05C2ABB27D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetRuntime

Path C:\Users\Admin\AppData\Local\Temp\{87B72402-2F81-47A9-9B06-8F4AAE1732C6}\DotNetRuntime
Size 26.0MB
SHA256 858aa7040e07a6e0674ca7e29afed4c2fb1e51f9b7f825124580ed45899cb58b
MD5 8c32f2ed1b7075278c993b7ad584d26b
SHA1 3fbf63be0fe61739098827d063e1c624960b922f
SHA512 428da96ff15a0de8ec48e018ba6fcb72f508dbb462a9190788c1a1ba6ce7fa01378dd57eca794a88a10f8cd5e3efa86f9a5338539e6e7316adc5da11db63f772
SSDEEP 786432:gOddjcNUQHAbvuIEW+h2nWRQN8cxnW6D:gOddjIHATSSrNzxW6
TLSH
T1AE573323BC429176EDE90D30603AEB714E3CBD14278454DB43A0B85AF9F15E26F726DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsDesktopRuntime

Path C:\Users\Admin\AppData\Local\Temp\{87B72402-2F81-47A9-9B06-8F4AAE1732C6}\WindowsDesktopRuntime
Size 26.7MB
SHA256 7657400b83d4d5b66ef7a295505419d773d5f5bd099c1ebe70e994f286330b76
MD5 ac8d99bc54c999f92a7a1f8a01405059
SHA1 90238bfa3defeb1644f7fcf70257c40d473d9058
SHA512 a525230129dc36efd383a634af91fb2d1e8fe39f9554070ad7d9eb5b878a104397e9f1c8294cfc102c95bd7f714072f25d419787991c0a2d1624bf50f0c2f2d1
SSDEEP 786432:8n29Gz7Y0+360weNE3vqM5ihtORTtAIOVExET:8n5rYy3vZ5ia6Iwn
TLSH
T1E55733237D429D35DAAA0D72A93ADB35292D9D181394899B0360F80DFCF03E16BF27D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pmls.dll

Path C:\Users\Admin\AppData\Local\Temp\~os42CE.tmp\pmls.dll
Size 884KB
SHA256 e471da417462c9f60181c27efe2355db4f0b3b4df6bd0d4097864a72677d8e5d
MD5 090730c9ca6c88c8ca73ded170e8b197
SHA1 5e4b58186e532af507fd4dca01f6396e55ddcbf7
SHA512 177efae6a662f42d4c59e6d9260af2eb126266e51e84ac324d4d319c761d9680044ffb6472c846d8c22895c6ad3c92d9ab6e4330b23febf1f8646e4e3bd572b7
SSDEEP 24576:Gde43g1CYMCZPGUpzR1EytT6ehqglHz5fbCKr1liRdHQJbi2pKwouuyv:GW1tfbCm1liUbi2Uwouuyv
TLSH
T10215AF023D59C070E39F117029696FABAAFDDD200BF18DDB67C01DFE99309D2653266A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pmls64.dll

Path C:\Users\Admin\AppData\Local\Temp\~os42CE.tmp\pmls64.dll
Size 1.1MB
SHA256 877c2894f42bf078dfa36f06b543490d800a32c4f5245464bfec300b56867661
MD5 3bc077723836060db010dacc3daa5a7b
SHA1 ee2299462546960e9505d3aa339bbaf1f95688bd
SHA512 3b31567564ec4c01c478f58192f49237d4d7a9744ee65c8cd9f19c34d1aad32791baf7748d2d11f3a5c2b7c0de9a341774e5b2137dfd1c7416e44a07eb966840
SSDEEP 24576:vX5RidvQ7Df5LWOkAgiqqi7oc/ETQDw6s2KM:/5LPdWOkAgiqqiP88D9LKM
TLSH
T1A6358C1F636501BCE0ABD078C51B5A07E3B4784A03B09ADF17A056AA2F677B16F7E350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pmph.dll

Path C:\Users\Admin\AppData\Local\Temp\~os42CE.tmp\pmph.dll
Size 806KB
SHA256 7cdd0b4b6492483d07ddd1869ea4c213d8d5043aec14117b1a5926093bedc7e1
MD5 27c1633ae24898c3c8fc6638ad72d4e4
SHA1 5c7751029cfd5c4055512f40d95b63fdee919ac3
SHA512 4b670092da2fbb6ff7814ab170e2c8141d148d99300794fcbd524f7ce9d0b20b3abff80c250cb949c8bf53dbb1612be65613f20e02225ce4dc20f7c43fdaebdf
SSDEEP 12288:i9VZRG3DDOEM3/auz7iMpAxHeoHVMSe60z1eEX:EVZRODGhZa1eoHVMSFEX
TLSH
T16D057D01EA8380B1F85D137411A6A72E7ABCB716D3302BEFFB903E7A5C215E055792B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pmropn.exe

Path C:\Users\Admin\AppData\Local\Temp\~os42CE.tmp\pmropn.exe
Size 7.4MB
SHA256 b8e134c1518903be8b260f821d1896b521f7f70956090562b3cc71b71bf8cb1b
MD5 4ab3a64141bcb6b1e34cbe8cd310fadc
SHA1 45120754f1821ca49f4520b1b31724023a07e752
SHA512 0e6a6dda054503f88eb714a4c6ea0b16e297a77757d4d42e243596d808f2a99540eeddb070dc3df06f0ca16822abe39f421c70e5d2891f7da6079020da963c97
SSDEEP 196608:wwlq5MyNKcI37mqQgLVSC3JEpgniiLkNCqtcF97:wwl0MwKcI3CqQSZ9iiLkUqt4
TLSH
T13B76AE02FA408079F6C600B582B60FB9EE78DE200365A5C353D1B9BD6F76ED27836756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pmropn32.exe

Path C:\Users\Admin\AppData\Local\Temp\~os42CE.tmp\pmropn32.exe
Size 244KB
SHA256 b56a74fbe9b0a0c027f230a412dd69afbb697c41f31635352b37fe74d334fc15
MD5 a6348e20d0a07a438b3e596350c8875a
SHA1 6621babf23511ed41f8910d15a263da7ba9b3c24
SHA512 3158f2893ad8b316e69868bd98736d6405ab345925bb5bdbb0bb6897897ba048c72303e957aee0739c239bd45c17fb04827f7f21ab1a000beb1bad3616f3a6f8
SSDEEP 3072:Tf1jylH+OCcTA/3xjjjplcg8kNRuEbrqAyMyKpNoQwOqw8930/iuAg0FubzgIZAK:sleOvk/pp5Rh/yMy+ovDCAO7WU1
TLSH
T1AE349D1176D0C472D973153608F8DB799A7EBD200F519DEB53D80B3E8E306D2EA31A6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pmropn64.exe

Path C:\Users\Admin\AppData\Local\Temp\~os42CE.tmp\pmropn64.exe
Size 303KB
SHA256 f6de7618e24c0731e5ff77aa56f200d3c0e30e672a63c7d11b9717ece29e6814
MD5 b6ce4ef9f276abe27d3dff35eead758d
SHA1 77e8545d979a595acac1a900a0c1d551166eaf8c
SHA512 c13fd956bef83be59195e766874b8502ac514d12de2c2f411619ab8d61c3353e06ad01987b32e7a3cffdd51c25e07873f0bbcf2d00a8dfa5692539c3b96a9836
SSDEEP 6144:q335ui2SMWpQcXubvHPUyKn6ZXu/x630ohVbdquTCB:G35ui2CpRAvHPUDn6C630oxc
TLSH
T186646C59B3A414F5EDB3C13CC8911506EAB278665771DBEF03A0865A2F237E0AD3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pmservice.exe

Path C:\Users\Admin\AppData\Local\Temp\~os42CE.tmp\pmservice.exe
Size 4.6MB
SHA256 f76c45ac8440c5a36096d7956bdf933bfff268469d1a73573c7f001f790dafa1
MD5 20eb40af892fabf7e74d1e64081ca481
SHA1 6683863abaefb1f8d9b201f5af316731655ea4b5
SHA512 249031743bb2a8f8466e2afca73b0ba9d1b99082746974629763099bc41e00db2107282a0dc1477789000f86268f3587b5051c7fe629634ea167d2c7bbb49704
SSDEEP 49152:agOW4nR8lACIclR6KeFWLkCFRRGN1NYWmkxMpXmP5cpmeNgYPgCFUJxazDGPO1pt:agOW4RkIcSEoCjIYW+vgYYCFQYN4R+
TLSH
T1AB268D01F5408029F9D300B283F70A78EE78AF201765A1C793D5B8F9AB769D1793979B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

file.txt

Path C:\Users\Admin\AppData\Local\file.txt
Size 58B
SHA256 9af49755fa2fc837a8d39633ab2a2e2584615f3d140df2ae5f00500cf6c54e43
MD5 9c639b99bc7f84f39e83a274ef343c01
SHA1 e75a3a22287e39216f653a024522487e9fc2e384
SHA512 6c44829b124acc05d6e64009b5a8a853f3431c8106d4cb2322461dbbd01e2da3e6e839c0eab4dc41eebabd59bcff00f0922a7f5addba6e2a891248e2f696737b
TLSH
T1E0A0021465811099AD05CE4935E03C5420555147056FD2A5CC614A01400665261E6345
MD5 SHA1 SHA512 TLSH

Submit Download

Velocity.zip

Path C:\Users\Admin\Downloads\Velocity.zip
Size 12.5MB
SHA256 4ba3a8a29a4adaf21f304239e3c769d4f8da809106e01caef80945fd604b0076
MD5 69c1ec1744daf4c5dea14f428621dbce
SHA1 a01c9792d87a5ee761f1953794e5f08cfa3f600d
SHA512 743cd36db333c7412c9581245c7c570313791ac9c2c3311bd5d5cf425a7a0b47751b469b88e7c5216acb6afca8b1385c9ab0d32f7d49985195de3e748df1120b
SSDEEP 196608:VsI43uQZN/rzCs2jNH1CKuXYAISerbwoCFWOB3sMXcz0hNRcY8m/gSTu/gjwGN:VztWN/rzCVNE1YbjC8jMXc4Vv5Y4V7N
TLSH
T155D633DD9EA26F6DD17F3873501859CC4FAD296AE5ED012630A8E0C96AC35FC7C80C66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSID0EA.tmp

Path C:\Windows\Installer\MSID0EA.tmp
Size 346KB
SHA256 1caa470031f4f3fb53bb38187d522990a3a7423476b1b5aaa27443a3e2fc62c0
MD5 f715d24632e765c53e9856df53dc8318
SHA1 78e2280ccaeed00119fe827acc58ba10996517cb
SHA512 dd0568de924a86910d8bf59b2f0c22663268004ef9a5f80ffd78f37885f3b8538d138d1e5c70de8e4fda7aab150df48bd34e3838c976ec90ed4f0e49bed0e9e6
SSDEEP 6144:WbOobwWeCg6QvyuFtPwvGyDBQlEz8a+CFTYK0OnsoIcGm1p:W78We96sI+yDxTYwsoCm1p
TLSH
T1BF745B31A456707AE6F90872F568CB706D3CB21827D8849FC3E0E84E38645D36BB775A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BootstrapperApplicationData.xml

Path C:\Windows\TEMP\{87B72402-2F81-47A9-9B06-8F4AAE1732C6}\.ba\BootstrapperApplicationData.xml
Size 9KB
SHA256 cfd0c2c7ccb279ae18975cceb406678daa21050fbbd0af5a75da895329b9357f
MD5 bfebb8f1689243d6e17ee1fcdaf8e6ca
SHA1 18026f747ebbfb85e35704b5f81db3b0d1b08cef
SHA512 4b6a5f6072946e9123cff7c993ce6529a3dd903e06359600e09a8a52cf18cac4bbd84ef7fc036bed9ff8a2acaae516b22520f2f0df07cf447e215171da994d2c
SSDEEP 96:2JBM/En6YcM0wZyct0in6sUsDT0wFycALn6UFg0wNyc1n6fMSh90wpMdycAM+rZb:2dz0Tc/mvTLnTXCagaRZmf7nsCsysz
TLSH
T1D612F5113BFE0218F0F36E88EFF6A5555A35BD552E39C82D01201D0F49B2E8199A2FB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetLogo_256x.png

Path C:\Windows\TEMP\{87B72402-2F81-47A9-9B06-8F4AAE1732C6}\.ba\DotNetLogo_256x.png
Size 2KB
SHA256 0f571f95d8eab48dbc81b0ec5e9f7225e349e26ef50868bfaab556f3c2443b01
MD5 39aa52615723b782c92dec710caaec7f
SHA1 760b49e256a7979fe50a56a2b1be3688a474b886
SHA512 89d1baa3820154667747b25e9e2fd321bfb2ec71dc309915b0a28dacdc80822a4943b639ebb37c37bd2559d5a4306d2096119cd970c84a0d331f6c68b0456dc9
TLSH
T1534195CF1BFD78D7E6E557918E1A8DD232738483B4B3A42CCE7B10B8274A5642B87940
MD5 SHA1 SHA512 TLSH

Submit Download

dotnet.ico

Path C:\Windows\TEMP\{87B72402-2F81-47A9-9B06-8F4AAE1732C6}\.ba\dotnet.ico
Size 44KB
SHA256 61a2cbd12868cb9b359e0c78961d409b7875f072eb8e53ea88d3e6bfe2961a18
MD5 b8096652d9ec286709a2c863b244b110
SHA1 b3b7f0f4d608fad7cb59ba499d4d17c2b873a7af
SHA512 492a5aa83220bb77c178b7c5b50bf44968c0427e9e45bb97a33df14d7fb4c667ca7adde0ebb3874c7b6011057b01144e4e6651fbad62c6bcf5e0b93586c4bc7a
SSDEEP 96:r+gfbzo+wHK9NbwOY4tIWQeVlV1W9+H+guapUjFamINUItzf1dBNaIZ:ro5HuNcH4tIzeVlV1WEOFDgUWzf1PIm
TLSH
T1E913EF6DE68547C1C10C2032DB4AC792B5233C72E4DAE0C4F9D4FA7E177906965C6E6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\TEMP\{87B72402-2F81-47A9-9B06-8F4AAE1732C6}\.ba\thm.wxl
Size 7KB
SHA256 b00edd703dd8a475119d0e4dd70a3aaa47f0e95361af290e76d367a8edef3432
MD5 8b2c667a8bbad3153068c0ed90df7ec4
SHA1 c9e04a3a37e5e6262ab9bfecf78280171b8f7b74
SHA512 5269f00d474acccb4c48cb7bcfdf19e63557a388572d3a6335aa39191319691d924e27f70da3f3495387c319396476c63a8fd7b35835cca0901220e39783847b
SSDEEP 96:HiTgM1+XSNEzA0HtYQstYCpCwZQpCeyk5HQJM9ouvj9urz8:Ew9EmtYQstYCPC9e8
TLSH
T191E1026F68DFDEE03A732651B2B3698D6919C29A136F1CF0F869084B47635016377A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.xml

Path C:\Windows\TEMP\{87B72402-2F81-47A9-9B06-8F4AAE1732C6}\.ba\thm.xml
Size 11KB
SHA256 dfee8e2d075087227f19c835c145c5bb8e72a46880ea24080bb2472fd3a521be
MD5 4329e418dc56b1386d7ea29a0dcfab5b
SHA1 58387f92e89ca21b4179fb697c7de9675c59142f
SHA512 6934873d27e6efbb94da4f13ee8369b29995490051016fdf82800256b924902306d328bf1d4ebbf266d1a53eb24adb6478d1a67de4ecc3e3bcbe561968f24922
SSDEEP 96:HgvPkoeWEH3IWTaQfSJgHzth5mFahbuB8pR5+Vpwe+UIJLg1gEp+6F5pQnxc:AvoWydmQfVHMyyj5Z
TLSH
T14B42FC6851DC7811C532D702AB9371D3FF12BDA6C6C85A58B48E256B1FF262028B739C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixstdba.exe

Path C:\Windows\Temp\{87B72402-2F81-47A9-9B06-8F4AAE1732C6}\.ba\wixstdba.exe
Size 431KB
SHA256 2b1cee5e3e24593247854eb7a7c4308937b9c607754ed2fb83520a8706c26f1e
MD5 0e88ffd2e737ac9b9a4241616838bc23
SHA1 3c8beb465d20bcef0cd6ceca9c60286d1d15cebd
SHA512 169b9e08518834c9bc5adfe4ab7b79e07685b72f30ede1c1a386229668bde8c15da378e1274e4013ad7b84d6f7a5acc64ef0806e3b8a66322861efaa7e26b620
SSDEEP 6144:X9vfS1NP+c3ytxmg4Stlqe3B9m2LSLTwGw7C3ZLaov5xZvSdF:X9v+GIyugllqe3wwGfX5/SdF
TLSH
T129943B3165F04037C6F90572AE14FA31BF69F208231095EBA3C0DD293968AE5BBB7657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windowsdesktop-runtime-10.0.10-win-x86.exe

Path C:\Windows\Temp\{87B72402-2F81-47A9-9B06-8F4AAE1732C6}\.be\windowsdesktop-runtime-10.0.10-win-x86.exe
Size 966KB
SHA256 0b39b24ac03798876fc4ff73ebff56a578dcd124f2f629b3bd02b6954281dd77
MD5 e6df6c94f1be90ad2f3af93d74960fbf
SHA1 fa29c63e454be57dae63607973e872a9d1472c2a
SHA512 d2c986d87802ed6450d6628cdeefb5d8d65876a80e89f1f0122e6e5050618791ecc4cf051fc3861278a595543acb456a69a3a9ddca2b4304bfb629bc2fa13b1d
SSDEEP 12288:NVGWl6qCmyZeU6lqlDjC+fScn6X8GwMgJEGGd6i+kECp2dbidMswbXJOd:NVGWl6qCmyt6UdmcpMz1IFFgVwbXI
TLSH
T144256D31A166242BD6F50973F914D2307E28D7082B5C99B6C6C0DD0D39689FA6FFB24B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3340-1365-0x00007FFCC9F10000-0x00007FFCC9F58000-memory.dmp

Download

memory/3340-1362-0x00007FFCCBB30000-0x00007FFCCBBF7000-memory.dmp

Download

memory/3340-1364-0x00007FFCB7CC0000-0x00007FFCB7F43000-memory.dmp

Download

memory/3340-1367-0x00007FFCCBA60000-0x00007FFCCBAD4000-memory.dmp

Download

memory/3340-1366-0x00007FFCC8B70000-0x00007FFCC939A000-memory.dmp

Download

memory/3340-1368-0x00007FFCC5170000-0x00007FFCC5296000-memory.dmp

Download

memory/3340-1369-0x00007FFCCA170000-0x00007FFCCA1D8000-memory.dmp

Download

memory/3340-1363-0x00007FFCCAE10000-0x00007FFCCB1B1000-memory.dmp

Download

memory/3824-1272-0x00007FFCCA170000-0x00007FFCCA1D8000-memory.dmp

Download

memory/3824-1274-0x00007FFCC9F10000-0x00007FFCC9F58000-memory.dmp

Download

memory/3824-1268-0x00007FFCCAE10000-0x00007FFCCB1B1000-memory.dmp

Download

memory/3824-1270-0x00007FFCB7CC0000-0x00007FFCB7F43000-memory.dmp

Download

memory/3824-1275-0x00007FFCCCCE0000-0x00007FFCCD3D6000-memory.dmp

Download

memory/3824-1273-0x00007FFCC5170000-0x00007FFCC5296000-memory.dmp

Download

memory/3824-1269-0x00007FFCCBA60000-0x00007FFCCBAD4000-memory.dmp

Download

memory/3824-1267-0x00007FFCCBB30000-0x00007FFCCBBF7000-memory.dmp

Download

memory/5740-1401-0x0000000074370000-0x00000000743C1000-memory.dmp

Download

memory/5740-1397-0x0000000075050000-0x00000000756FA000-memory.dmp

Download

memory/5740-1398-0x00000000742C0000-0x00000000742EB000-memory.dmp

Download

memory/5740-1402-0x00000000745D0000-0x00000000747EA000-memory.dmp

Download

memory/5740-1399-0x000000006E0B0000-0x000000006E18F000-memory.dmp

Download

memory/5740-1396-0x00000000777F0000-0x0000000077A7A000-memory.dmp

Download

memory/5740-1400-0x00000000774E0000-0x0000000077540000-memory.dmp

Download

memory/5996-1371-0x00000000777F0000-0x0000000077A7A000-memory.dmp

Download

memory/5996-1390-0x000000006E0B0000-0x000000006E18F000-memory.dmp

Download

memory/5996-1391-0x00000000774E0000-0x0000000077540000-memory.dmp

Download

memory/5996-1392-0x0000000074370000-0x00000000743C1000-memory.dmp

Download

memory/5996-1389-0x00000000742C0000-0x00000000742EB000-memory.dmp

Download

memory/5996-1380-0x0000000075050000-0x00000000756FA000-memory.dmp

Download

memory/5996-1404-0x00000000777F0000-0x0000000077A7A000-memory.dmp

Download

memory/5996-1408-0x00000000774E0000-0x0000000077540000-memory.dmp

Download

memory/5996-1409-0x0000000074370000-0x00000000743C1000-memory.dmp

Download

memory/5996-1407-0x000000006E0B0000-0x000000006E18F000-memory.dmp

Download

memory/5996-1405-0x0000000075050000-0x00000000756FA000-memory.dmp

Download

memory/5996-1406-0x00000000742C0000-0x00000000742EB000-memory.dmp

Download

memory/6088-1135-0x00000000005C0000-0x0000000000686000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads