c4c0b8e1593bc5481521cecfce00b953e3ee6d7323b98e7ddf2e8c90a78ce545

Analysis

user interaction
yes
max time kernel
105s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/07/2026, 21:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VelocityLite.exe
Size 232KB
Sample260727-1j91dadd64
SHA256 c4c0b8e1593bc5481521cecfce00b953e3ee6d7323b98e7ddf2e8c90a78ce545
MD5 e4df8ee6e755c3da3088701eb1c05b76
SHA1 c52dbc1190b84555e27649b9b54746b958e5f3cb
SHA512 623ae06db60f42e33c6e94b4d74a20d6e456a1edb94e2b8bc58424532f27bc5baa516465cad455bddc0351e21614d4965919a123b7cb0891b8527021928a09d5
SSDEEP 3072:IlDJk88wN1QI7sxrYL1peQ3lOY9SkHNwG7NzaAT56Q7BQz:UAIwxrI14Q3kYBTM5QNQ
TLSH
T185341903B65890BAE1A2D638CD928981E7727C594F71A6CF37507B7E0F766D09E39302
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
96	4320	msedge.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	windowsdesktop-runtime-10.0.10-win-x64.exe

Executes dropped EXE 6 IoCs

pid	Process
960	windowsdesktop-runtime-10.0.10-win-x64.exe
3552	wixstdba.exe
816	windowsdesktop-runtime-10.0.10-win-x64.exe
4916	windowsdesktop-runtime-10.0.10-win-x64.exe
1832	windowsdesktop-runtime-10.0.10-win-x64.exe
4300	wixstdba.exe

Loads dropped DLL 8 IoCs

pid	Process
2132	MsiExec.exe
2132	MsiExec.exe
848	MsiExec.exe
848	MsiExec.exe
3096	MsiExec.exe
3096	MsiExec.exe
5280	MsiExec.exe
5280	MsiExec.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{866BECDA-F284-473A-9E84-0CCE816BF06F} = "\"C:\\ProgramData\\Package Cache\\{866BECDA-F284-473A-9E84-0CCE816BF06F}\\windowsdesktop-runtime-10.0.10-win-x64.exe\" /burn.runonce"	windowsdesktop-runtime-10.0.10-win-x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\Microsoft.VisualBasic.Core.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\de\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\zh-Hant\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\Microsoft.NETCore.App.runtimeconfig.json	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Resources.Reader.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Runtime.Serialization.Formatters.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\System.Xaml.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\ja\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\pt-BR\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.ComponentModel.TypeConverter.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Diagnostics.StackTrace.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\ko\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\ru\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\zh-Hant\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Diagnostics.TextWriterTraceListener.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\hostpolicy.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\UIAutomationClientSideProviders.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\ru\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\ru\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.ComponentModel.DataAnnotations.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Net.Security.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\it\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\zh-Hant\UIAutomationTypes.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Threading.ThreadPool.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\System.DirectoryServices.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\fr\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\tr\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Runtime.Numerics.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\tr\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.ComponentModel.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Data.Common.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.IO.Compression.ZipFile.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Runtime.InteropServices.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Linq.Parallel.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Xml.XmlDocument.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\ko\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Linq.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Net.ServicePoint.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\pt-BR\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Runtime.Serialization.Json.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\System.Configuration.ConfigurationManager.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\System.Diagnostics.EventLog.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\es\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\PresentationFramework.Aero2.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\ru\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Runtime.Loader.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\System.Windows.Forms.Primitives.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\fr\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\pt-BR\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\tr\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Configuration.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Runtime.InteropServices.RuntimeInformation.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Xml.XPath.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\zh-Hans\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Net.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Data.DataSetExtensions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Diagnostics.FileVersionInfo.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.IO.Pipes.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\System.Printing.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\es\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\es\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\fr\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.IO.FileSystem.Primitives.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Linq.Queryable.dll	msiexec.exe

Drops file in Windows directory 35 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSIAA06.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB796.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC332.tmp	msiexec.exe
File created	C:\Windows\Installer\e58a563.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDC3C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEC3B.tmp	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149\fileCoreHostExe	msiexec.exe
File opened for modification	C:\Windows\Installer\e58a56a.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149\fileCoreHostExe	msiexec.exe
File created	C:\Windows\Installer\SourceHash{DA493AF2-5A21-4D85-BB57-757D7525EB73}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC6AD.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e58a563.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{8A8CC49F-7D1E-45DC-B7B5-35FF61A2C25E}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB8FE.tmp	msiexec.exe
File created	C:\Windows\Installer\e58a56e.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e58a56f.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{441FCDB0-A03A-4130-A1D5-FFD8C53CFF6B}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB206.tmp	msiexec.exe
File created	C:\Windows\Installer\e58a56a.msi	msiexec.exe
File created	C:\Windows\Installer\e58a56f.msi	msiexec.exe
File created	C:\Windows\Installer\e58a574.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{F0BCFB2E-4878-4F6E-BD5D-3ABFF264829E}	msiexec.exe
File created	C:\Windows\Installer\e58a578.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB4C6.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBA86.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID882.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149	msiexec.exe
File created	C:\Windows\Installer\e58a569.msi	msiexec.exe
File created	C:\Windows\Installer\e58a573.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID5A3.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e58a574.msi	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.10-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wixstdba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.10-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.10-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.10-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wixstdba.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4320	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 12 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134296622656891607"	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\9309C9E278150CC5452917C0EA916C61	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.40.55332_x64\Dependents\{866BECDA-F284-473A-9E84-0CCE816BF06F}	windowsdesktop-runtime-10.0.10-win-x64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{23490217-31AA-4AB5-99EF-87A2AD567DB5}	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2FA394AD12A558D4BB7557D75752BE37\SourceList\PackageName = "dotnet-hostfxr-10.0.10-win-x64.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\834CD68BBAA561857EB26882AAFC6242\0BDCF144A30A03141A5DFF8D5CC3FFB6	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{866BECDA-F284-473A-9E84-0CCE816BF06F}\Version = "10.0.10.50000"	windowsdesktop-runtime-10.0.10-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{866BECDA-F284-473A-9E84-0CCE816BF06F}\Dependents\{866BECDA-F284-473A-9E84-0CCE816BF06F}	windowsdesktop-runtime-10.0.10-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F94CC8A8E1D7CD547B5B53FF162A2CE5	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F94CC8A8E1D7CD547B5B53FF162A2CE5\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_80.40.55332_x64\ = "{F0BCFB2E-4878-4F6E-BD5D-3ABFF264829E}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E2BFCB0F8784E6F4DBD5A3FB2F4628E9	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2FA394AD12A558D4BB7557D75752BE37\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E2BFCB0F8784E6F4DBD5A3FB2F4628E9\ProductName = "Microsoft Windows Desktop Runtime - 10.0.10 (x64)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A8A84F1AA6E5EFD5BE00C8237B84D6D4\F94CC8A8E1D7CD547B5B53FF162A2CE5	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F94CC8A8E1D7CD547B5B53FF162A2CE5	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F94CC8A8E1D7CD547B5B53FF162A2CE5\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\0BDCF144A30A03141A5DFF8D5CC3FFB6	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0BDCF144A30A03141A5DFF8D5CC3FFB6\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0BDCF144A30A03141A5DFF8D5CC3FFB6\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{441FCDB0-A03A-4130-A1D5-FFD8C53CFF6B}v80.40.55332\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E2BFCB0F8784E6F4DBD5A3FB2F4628E9\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F94CC8A8E1D7CD547B5B53FF162A2CE5\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F94CC8A8E1D7CD547B5B53FF162A2CE5\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2FA394AD12A558D4BB7557D75752BE37\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{DA493AF2-5A21-4D85-BB57-757D7525EB73}v80.40.55332\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_80.40.55332_x64\ = "{441FCDB0-A03A-4130-A1D5-FFD8C53CFF6B}"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E2BFCB0F8784E6F4DBD5A3FB2F4628E9\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2FA394AD12A558D4BB7557D75752BE37\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{DA493AF2-5A21-4D85-BB57-757D7525EB73}v80.40.55332\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0BDCF144A30A03141A5DFF8D5CC3FFB6\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\5D9ADA2B34E5318566B5BBB43BFD9EF6\E2BFCB0F8784E6F4DBD5A3FB2F4628E9	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E2BFCB0F8784E6F4DBD5A3FB2F4628E9\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{F0BCFB2E-4878-4F6E-BD5D-3ABFF264829E}v80.40.55332\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.40.55332_x64\Version = "80.40.55332"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2FA394AD12A558D4BB7557D75752BE37	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2FA394AD12A558D4BB7557D75752BE37\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_80.40.55332_x64\DisplayName = "Microsoft .NET Runtime - 10.0.10 (x64)"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A8A84F1AA6E5EFD5BE00C8237B84D6D4	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F94CC8A8E1D7CD547B5B53FF162A2CE5\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E2BFCB0F8784E6F4DBD5A3FB2F4628E9\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F94CC8A8E1D7CD547B5B53FF162A2CE5\Provider	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2FA394AD12A558D4BB7557D75752BE37\ProductName = "Microsoft .NET Host FX Resolver - 10.0.10 (x64)"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0BDCF144A30A03141A5DFF8D5CC3FFB6\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0BDCF144A30A03141A5DFF8D5CC3FFB6\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{441FCDB0-A03A-4130-A1D5-FFD8C53CFF6B}v80.40.55332\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E2BFCB0F8784E6F4DBD5A3FB2F4628E9\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.40.55332_x64\Dependents	windowsdesktop-runtime-10.0.10-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0BDCF144A30A03141A5DFF8D5CC3FFB6\PackageCode = "69DC61D230D275C4FAFCB32DD99348DD"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E2BFCB0F8784E6F4DBD5A3FB2F4628E9\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F94CC8A8E1D7CD547B5B53FF162A2CE5\PackageCode = "BB5A5A59AE909304FB0B47459E96A72D"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2FA394AD12A558D4BB7557D75752BE37\MainFeature	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F94CC8A8E1D7CD547B5B53FF162A2CE5\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F94CC8A8E1D7CD547B5B53FF162A2CE5\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F94CC8A8E1D7CD547B5B53FF162A2CE5\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\windowsdesktop_runtime_80.40.55332_x64	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2FA394AD12A558D4BB7557D75752BE37\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2FA394AD12A558D4BB7557D75752BE37\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0BDCF144A30A03141A5DFF8D5CC3FFB6	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0BDCF144A30A03141A5DFF8D5CC3FFB6\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\dotnet_runtime_80.40.55332_x64	windowsdesktop-runtime-10.0.10-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E2BFCB0F8784E6F4DBD5A3FB2F4628E9\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{F0BCFB2E-4878-4F6E-BD5D-3ABFF264829E}v80.40.55332\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F94CC8A8E1D7CD547B5B53FF162A2CE5\SourceList\PackageName = "dotnet-host-10.0.10-win-x64.msi"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2FA394AD12A558D4BB7557D75752BE37\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2FA394AD12A558D4BB7557D75752BE37\Version = "1344854052"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0BDCF144A30A03141A5DFF8D5CC3FFB6\Version = "1344854052"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{866BECDA-F284-473A-9E84-0CCE816BF06F}\DisplayName = "Microsoft Windows Desktop Runtime 10.0.10 (x64)"	windowsdesktop-runtime-10.0.10-win-x64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x64	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2FA394AD12A558D4BB7557D75752BE37	msiexec.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4080	msiexec.exe
4080	msiexec.exe
4080	msiexec.exe
4080	msiexec.exe
4080	msiexec.exe
4080	msiexec.exe
4080	msiexec.exe
4080	msiexec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	816	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeIncreaseQuotaPrivilege	816	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeSecurityPrivilege	4080	msiexec.exe
Token: SeCreateTokenPrivilege	816	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeAssignPrimaryTokenPrivilege	816	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeLockMemoryPrivilege	816	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeIncreaseQuotaPrivilege	816	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeMachineAccountPrivilege	816	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeTcbPrivilege	816	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeSecurityPrivilege	816	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeTakeOwnershipPrivilege	816	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeLoadDriverPrivilege	816	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeSystemProfilePrivilege	816	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeSystemtimePrivilege	816	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeProfSingleProcessPrivilege	816	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeIncBasePriorityPrivilege	816	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeCreatePagefilePrivilege	816	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeCreatePermanentPrivilege	816	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeBackupPrivilege	816	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeRestorePrivilege	816	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeShutdownPrivilege	816	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeDebugPrivilege	816	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeAuditPrivilege	816	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeSystemEnvironmentPrivilege	816	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeChangeNotifyPrivilege	816	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeRemoteShutdownPrivilege	816	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeUndockPrivilege	816	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeSyncAgentPrivilege	816	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeEnableDelegationPrivilege	816	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeManageVolumePrivilege	816	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeImpersonatePrivilege	816	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeCreateGlobalPrivilege	816	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeRestorePrivilege	4080	msiexec.exe
Token: SeTakeOwnershipPrivilege	4080	msiexec.exe
Token: SeRestorePrivilege	4080	msiexec.exe
Token: SeTakeOwnershipPrivilege	4080	msiexec.exe
Token: SeRestorePrivilege	4080	msiexec.exe
Token: SeTakeOwnershipPrivilege	4080	msiexec.exe
Token: SeRestorePrivilege	4080	msiexec.exe
Token: SeTakeOwnershipPrivilege	4080	msiexec.exe
Token: SeRestorePrivilege	4080	msiexec.exe
Token: SeTakeOwnershipPrivilege	4080	msiexec.exe
Token: SeRestorePrivilege	4080	msiexec.exe
Token: SeTakeOwnershipPrivilege	4080	msiexec.exe
Token: SeRestorePrivilege	4080	msiexec.exe
Token: SeTakeOwnershipPrivilege	4080	msiexec.exe
Token: SeRestorePrivilege	4080	msiexec.exe
Token: SeTakeOwnershipPrivilege	4080	msiexec.exe
Token: SeRestorePrivilege	4080	msiexec.exe
Token: SeTakeOwnershipPrivilege	4080	msiexec.exe
Token: SeRestorePrivilege	4080	msiexec.exe
Token: SeTakeOwnershipPrivilege	4080	msiexec.exe
Token: SeRestorePrivilege	4080	msiexec.exe
Token: SeTakeOwnershipPrivilege	4080	msiexec.exe
Token: SeRestorePrivilege	4080	msiexec.exe
Token: SeTakeOwnershipPrivilege	4080	msiexec.exe
Token: SeRestorePrivilege	4080	msiexec.exe
Token: SeTakeOwnershipPrivilege	4080	msiexec.exe
Token: SeRestorePrivilege	4080	msiexec.exe
Token: SeTakeOwnershipPrivilege	4080	msiexec.exe
Token: SeRestorePrivilege	4080	msiexec.exe
Token: SeTakeOwnershipPrivilege	4080	msiexec.exe
Token: SeRestorePrivilege	4080	msiexec.exe
Token: SeTakeOwnershipPrivilege	4080	msiexec.exe

Suspicious use of FindShellTrayWindow 15 IoCs

pid	Process
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
3552	wixstdba.exe
640	msedge.exe

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 2272 wrote to memory of 640	2272	VelocityLite.exe	89
PID 640 wrote to memory of 2644	640	msedge.exe	90
PID 640 wrote to memory of 4320	640	msedge.exe	91
PID 640 wrote to memory of 1068	640	msedge.exe	92
PID 640 wrote to memory of 1068	640	msedge.exe	92
PID 640 wrote to memory of 1068	640	msedge.exe	92
PID 640 wrote to memory of 2580	640	msedge.exe	94
PID 640 wrote to memory of 2580	640	msedge.exe	94
PID 640 wrote to memory of 1472	640	msedge.exe	96
PID 640 wrote to memory of 1472	640	msedge.exe	96
PID 640 wrote to memory of 4880	640	msedge.exe	95
PID 640 wrote to memory of 1472	640	msedge.exe	96
PID 640 wrote to memory of 4880	640	msedge.exe	95
PID 640 wrote to memory of 4880	640	msedge.exe	95
PID 640 wrote to memory of 4704	640	msedge.exe	97
PID 640 wrote to memory of 1740	640	msedge.exe	98
PID 640 wrote to memory of 4704	640	msedge.exe	97
PID 640 wrote to memory of 4704	640	msedge.exe	97
PID 640 wrote to memory of 1740	640	msedge.exe	98
PID 640 wrote to memory of 1740	640	msedge.exe	98
PID 640 wrote to memory of 4532	640	msedge.exe	101
PID 640 wrote to memory of 4532	640	msedge.exe	101
PID 640 wrote to memory of 3416	640	msedge.exe	102
PID 640 wrote to memory of 3416	640	msedge.exe	102
PID 640 wrote to memory of 2052	640	msedge.exe	104
PID 640 wrote to memory of 2052	640	msedge.exe	104
PID 640 wrote to memory of 2052	640	msedge.exe	104
PID 640 wrote to memory of 4292	640	msedge.exe	105
PID 640 wrote to memory of 4292	640	msedge.exe	105
PID 640 wrote to memory of 1692	640	msedge.exe	106
PID 640 wrote to memory of 1692	640	msedge.exe	106
PID 640 wrote to memory of 1264	640	msedge.exe	108
PID 640 wrote to memory of 1144	640	msedge.exe	109
PID 640 wrote to memory of 1144	640	msedge.exe	109
PID 640 wrote to memory of 4128	640	msedge.exe	113
PID 640 wrote to memory of 4128	640	msedge.exe	113
PID 640 wrote to memory of 3208	640	msedge.exe	111
PID 640 wrote to memory of 3208	640	msedge.exe	111
PID 640 wrote to memory of 1984	640	msedge.exe	112
PID 640 wrote to memory of 1984	640	msedge.exe	112
PID 640 wrote to memory of 4128	640	msedge.exe	113
PID 640 wrote to memory of 4128	640	msedge.exe	113
PID 640 wrote to memory of 3928	640	msedge.exe	115
PID 640 wrote to memory of 3928	640	msedge.exe	115
PID 640 wrote to memory of 3928	640	msedge.exe	115
PID 640 wrote to memory of 1092	640	msedge.exe	114
PID 640 wrote to memory of 1092	640	msedge.exe	114
PID 640 wrote to memory of 776	640	msedge.exe	116
PID 640 wrote to memory of 960	640	msedge.exe	117
PID 960 wrote to memory of 3552	960	windowsdesktop-runtime-10.0.10-win-x64.exe	119
PID 960 wrote to memory of 816	960	windowsdesktop-runtime-10.0.10-win-x64.exe	120
PID 4916 wrote to memory of 1832	4916	windowsdesktop-runtime-10.0.10-win-x64.exe	124
PID 4080 wrote to memory of 2132	4080	msiexec.exe	125
PID 4080 wrote to memory of 848	4080	msiexec.exe	131
PID 1832 wrote to memory of 4300	1832	windowsdesktop-runtime-10.0.10-win-x64.exe	136
PID 4080 wrote to memory of 3096	4080	msiexec.exe	137
PID 640 wrote to memory of 5164	640	msedge.exe	142
PID 640 wrote to memory of 5172	640	msedge.exe	143
PID 640 wrote to memory of 5184	640	msedge.exe	144
PID 4080 wrote to memory of 5280	4080	msiexec.exe	146

C:\Users\Admin\AppData\Local\Temp\VelocityLite.exe
"C:\Users\Admin\AppData\Local\Temp\VelocityLite.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.NETCore.App&framework_version=10.0.0&arch=x64&rid=win-x64&os=win10&gui=true
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2ec,0x7fff659cc188,0x7fff659cc194,0x7fff659cc1a0
    3⤵
    PID:2644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,18311297443553425187,14001174880397669320,524288 --field-trial-handle=2272,i,5422366275692383219,3358120801206830527,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:3
    3⤵
    - Downloads MZ/PE file
    - System Time Discovery
    PID:4320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1680,i,16413174835547497957,15128003520793470433,262144 --field-trial-handle=2272,i,5422366275692383219,3358120801206830527,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:2
    3⤵
    PID:1068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2668,i,1695303144450407499,5441638029889286381,524288 --field-trial-handle=2272,i,5422366275692383219,3358120801206830527,262144 --variations-seed-version --mojo-platform-channel-handle=2640 /prefetch:8
    3⤵
    PID:2580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,4996854359690846062,14818649626883049240,2097152 --field-trial-handle=2272,i,5422366275692383219,3358120801206830527,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
    3⤵
    PID:4880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,10071003504989892286,510753104929146151,2097152 --field-trial-handle=2272,i,5422366275692383219,3358120801206830527,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
    3⤵
    PID:1472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4236,i,6696497971284137445,16657721163107681822,2097152 --field-trial-handle=2272,i,5422366275692383219,3358120801206830527,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:1
    3⤵
    PID:4704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4248,i,210436253478690101,11713520906273157798,2097152 --field-trial-handle=2272,i,5422366275692383219,3358120801206830527,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:2
    3⤵
    PID:1740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3728,i,5363530673816966976,1545749503209376080,524288 --field-trial-handle=2272,i,5422366275692383219,3358120801206830527,262144 --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:8
    3⤵
    PID:4532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5232,i,2909684969219343924,15533635045159400287,524288 --field-trial-handle=2272,i,5422366275692383219,3358120801206830527,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:8
    3⤵
    PID:3416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5228,i,6168044535366238273,10335284292631114744,2097152 --field-trial-handle=2272,i,5422366275692383219,3358120801206830527,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:1
    3⤵
    PID:2052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3608,i,3372251392277307388,764767417868241876,524288 --field-trial-handle=2272,i,5422366275692383219,3358120801206830527,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:8
    3⤵
    PID:4292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3684,i,16319639337537154245,18137114287550169339,524288 --field-trial-handle=2272,i,5422366275692383219,3358120801206830527,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:8
    3⤵
    PID:1692
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,17068800736182754900,17652224697930558336,524288 --field-trial-handle=2272,i,5422366275692383219,3358120801206830527,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
    3⤵
    PID:3844
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,17068800736182754900,17652224697930558336,524288 --field-trial-handle=2272,i,5422366275692383219,3358120801206830527,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
    3⤵
    PID:1264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,8703450621488033024,2104378675164353869,524288 --field-trial-handle=2272,i,5422366275692383219,3358120801206830527,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:8
    3⤵
    PID:1144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6244,i,16006567178515119988,11215790873159740744,524288 --field-trial-handle=2272,i,5422366275692383219,3358120801206830527,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:8
    3⤵
    PID:4128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6552,i,7293251857307697854,7651358708948144404,524288 --field-trial-handle=2272,i,5422366275692383219,3358120801206830527,262144 --variations-seed-version --mojo-platform-channel-handle=6540 /prefetch:8
    3⤵
    PID:3208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6580,i,16489987177060138614,10001124959637067728,524288 --field-trial-handle=2272,i,5422366275692383219,3358120801206830527,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:8
    3⤵
    PID:1984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,6072324415239802673,12137958412718561802,524288 --field-trial-handle=2272,i,5422366275692383219,3358120801206830527,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:8
    3⤵
    PID:4128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6572,i,3139509224334412238,8066677777023285652,524288 --field-trial-handle=2272,i,5422366275692383219,3358120801206830527,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:8
    3⤵
    PID:1092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6360,i,12819715549103447470,11455679463054401004,2097152 --field-trial-handle=2272,i,5422366275692383219,3358120801206830527,262144 --variations-seed-version --mojo-platform-channel-handle=6744 /prefetch:1
    3⤵
    PID:3928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6620,i,7670869319053887085,16801113315749087751,524288 --field-trial-handle=2272,i,5422366275692383219,3358120801206830527,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:8
    3⤵
    PID:776
- - C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.10-win-x64.exe
    "C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.10-win-x64.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:960
  - - C:\Windows\TEMP\{F43CDF23-6C61-4512-9EA8-684401E48CA6}\.ba\wixstdba.exe
      "C:\Windows\TEMP\{F43CDF23-6C61-4512-9EA8-684401E48CA6}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{EDEFA08A-EAD9-41CF-81AE-BD00ED3FD734} {8B5CE353-D41B-4C80-A062-2E4FC4705BAE}
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      PID:3552
  - - C:\Windows\TEMP\{F43CDF23-6C61-4512-9EA8-684401E48CA6}\.be\windowsdesktop-runtime-10.0.10-win-x64.exe
      "C:\Windows\TEMP\{F43CDF23-6C61-4512-9EA8-684401E48CA6}\.be\windowsdesktop-runtime-10.0.10-win-x64.exe" -q -burn.elevated BurnPipe.{B4266CDF-93A0-47EF-82F3-1CC147D91384} {4D80F9A1-8E8D-44E7-9A02-2293374C7636} 960
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      PID:816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,927893964106705559,474482424219268014,524288 --field-trial-handle=2272,i,5422366275692383219,3358120801206830527,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:8
    3⤵
    PID:5164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4680,i,3425446998095211627,5141708394338369839,524288 --field-trial-handle=2272,i,5422366275692383219,3358120801206830527,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:8
    3⤵
    PID:5172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4304,i,8198915802993491323,6441856815483968041,524288 --field-trial-handle=2272,i,5422366275692383219,3358120801206830527,262144 --variations-seed-version --mojo-platform-channel-handle=4684 /prefetch:8
    3⤵
    PID:5184

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3940

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4080
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding CA5C91D1B1EA05DB18EBC390F3E17FC6
  2⤵
  - Loads dropped DLL
  PID:2132
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding E8CAAB6432720396621661F0E8DE547B
  2⤵
  - Loads dropped DLL
  PID:848
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding AED380A3403900E35114CBF629B84F93
  2⤵
  - Loads dropped DLL
  PID:3096
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 1F7F46B5A86B97DD56865DBEC12D517A
  2⤵
  - Loads dropped DLL
  PID:5280

C:\ProgramData\Package Cache\{866BECDA-F284-473A-9E84-0CCE816BF06F}\windowsdesktop-runtime-10.0.10-win-x64.exe
"C:\ProgramData\Package Cache\{866BECDA-F284-473A-9E84-0CCE816BF06F}\windowsdesktop-runtime-10.0.10-win-x64.exe" /burn.runonce
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4916
- C:\ProgramData\Package Cache\{866BECDA-F284-473A-9E84-0CCE816BF06F}\windowsdesktop-runtime-10.0.10-win-x64.exe
  "C:\ProgramData\Package Cache\{866BECDA-F284-473A-9E84-0CCE816BF06F}\windowsdesktop-runtime-10.0.10-win-x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.10_(x64)_20260727224435.log"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1832
- - C:\Windows\TEMP\{3D9021AB-5E7C-4469-8563-E4C785455CA2}\.ba\wixstdba.exe
    "C:\Windows\TEMP\{3D9021AB-5E7C-4469-8563-E4C785455CA2}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{981F3D49-B306-49E0-80CF-44F26D65DA4D} {A14C13CD-8A77-4E78-BDD2-B2A932D6BB24}
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4300

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:6012

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e58a566.rbs

Path C:\Config.Msi\e58a566.rbs
Size 11KB
SHA256 3f51e20ec0c85c029873cc0cf1522e9abd3b965d2ed7c7c2f0641c281a084621
MD5 050e80a111de33dfaf345b7c5e3246e8
SHA1 e08a863b3fae676ada05aca3cfbe36a4b8a9bc15
SHA512 afa5838d41ff11a2005ec1e0acb874e82bf5d4c0e4fa7e13aa1ffe2dd339a56021442f57dd46b4ab5e3fc1279540401ef0330e552d61c12cf9b585d5a40b1fdd
SSDEEP 192:jrKHCR6CbVtN5H7Al/e7x/RI1/Rl1E+o5Ca35pbM:jrKHCR6CptN5H0G/o/9aM
TLSH
T1413252427614D2D3E9DB2738D71727703B72D3AA9314664F15CCC22C4F8B7894E68AAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58a56d.rbs

Path C:\Config.Msi\e58a56d.rbs
Size 9KB
SHA256 583cc4d45d5fe7f7cf7303fec519fc6e88ece0f3cbd4ddb7dd510e86bfc57b70
MD5 08b07e0435606b666b09d31aac5f84c9
SHA1 7d2a36e6d418336e7f0f7f7e3923fd0b0f1ac0e9
SHA512 1e0ab9b0dd899d2ba418788124a37c54693044c655c709dcbef6045aee79e34f9e83744d3bd2d3bacd92e88d6ec92dd48258ea88b587f9c22c8580ed74be5c7f
SSDEEP 96:pmSDTTClrWS/eCYFeUieD2AyCsTlyyUieD2AyC6jMlN8gnuTlyfnAP7E5d7P/53k:ECnSFeJxDRIIDRP017EbnKCCi5pu3
TLSH
T1EE120012760081A2E9921B39C7173B223BB6D3D9A315265F48CDF5F41E03BD52FA91DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58a572.rbs

Path C:\Config.Msi\e58a572.rbs
Size 49KB
SHA256 f6d63b31be0511cb2978bcc431555fb1c6bc3d20d46f24f30c5b30dd7f04413b
MD5 9eaa96eccdda9cfa6c8234ff1188b44b
SHA1 8c725974762db3829c7987c4e2eaeebcc0330468
SHA512 0fa428f723885e3865d5e8f19b42816d2d969acd9d2e4b0606bd78f2c9ce5e6fce660a4c7393ca90924efd7be40b6358c9305d93577f43bd4bc536dba9344a69
SSDEEP 1536:6HZgOohW4wN5RaHB/LyM/ajqmuUHr92ha8u3tn2N8zRM9Wc/hihbZGXEpp4IQPDR:vNgeE+1D
TLSH
T145335461DB08C0F2F9333DA26770F8847719C99AE34095AD16D60144CEA6EEEDEBD1E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58a577.rbs

Path C:\Config.Msi\e58a577.rbs
Size 71KB
SHA256 3feccddc85ef0e944fb86b119109e95802ad1f850543a13649b8ab38647112a8
MD5 a2cca2b29b0568e23112769b37cc01e8
SHA1 f241eadac21dd1c56c3d2550fd79c917c12ff56e
SHA512 e114a26af7dcbe40293eea413008deb256bc838c928e5be299b3cde47500b575ac70d5d4a152cd53c339a4343443df8ffa9c773209de59d7391ea14395478c33
SSDEEP 1536:tlTX+EvElgJPlhUR+6svby5ybcmb/WrPMmq0mgG2WdDfbH9cMWmHDCaJVZ/KoLHw:Ru2z+LmEEiycECCoeWb
TLSH
T16D6325BA7A14D1C1BC732DD557BBE916AD054C7393608D2E63CC4029CDD2A86EFB86E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ThirdPartyNotices.txt

Path C:\Program Files\dotnet\ThirdPartyNotices.txt
Size 77KB
SHA256 deb4427a295e1ed474b0d81c5a0d972c1b550b9a715cda939cdfa9236b1b418f
MD5 0d8867a25ba926e6e40cd52ab3536b5c
SHA1 89390dc8b8318d0bfef1c6a2fb4783537e28a465
SHA512 317ca335405274f4f91b173651ca2826760acb5ba5cf41aff51adc55c2cda9059fb268333665f13f62fa48119e55a303720a780dd58d28dd9967db4c88407d61
SSDEEP 1536:HA9jHwsGfgg39/zwgAVkguQxrDjugtSEGepkWvrpX7anuqdLSVnfiStPq+3LefrL:HA97w/ogz1AVxuMjHtSFULryLOgrGWm+
TLSH
T17773A45F7E45077319E2C3916569A8C5F22FA02E3B6B2A44346EF248133B42DD6FF858
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 163KB
SHA256 4377f10c78400f0370b88156773de9843c07f14e65b3232005ec3179ef38d463
MD5 363603c51aa522bf21b2e8320a51c54e
SHA1 b4dba9e0d47c9fd4636549d5a23fe1a96faf9b1f
SHA512 b2b045ad8538416bd81753359ca86ba956f2ac99befeb89c7c03993741411703e03f4373d11cb94992cb93ed569d6741954111f4ad519daebcb18138800877ce
SSDEEP 3072:oGgPYwruvTSBbQ/fp4SbDqIG/vk7l55wK9vLPg:oG4rubgbQpDvqIbt10
TLSH
T1A6F3F61AD65811AAD06E9575CB428941BB337C668BE0E3CB53C0F9BE0F726905EF9703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

state.rsm

Path C:\ProgramData\Package Cache\{866BECDA-F284-473A-9E84-0CCE816BF06F}\state.rsm
Size 1KB
SHA256 b6e130620798f7bd39306cfbc54f351c279631f45fbd737ce808a23cae1ed732
MD5 4cc167ee5e80c908f3cec20447c9e1c6
SHA1 da9a58fa7558f93c2d9a332255b892eabbf1d56f
SHA512 24ad1747636e8100341677bdd1dc3cc29a3722aa47797be0284996f908f4c7e83255d72063dee7528eae646fb148d4b9b6fc5194212c6bd600ff7a418a8b6984
TLSH
T18321D1515BF6092CF3F6AB3469F96665443BBC121C24C26E0001318A9E32BD0CCB0B37
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 03c9714ceda41208919b91db8014de24ae37606ed2abc96a2531b3653937df48
MD5 8c2296de8b61220530f453b2f30415dd
SHA1 2c66c88bc6a0f8267af3c1881fe9195ca1582177
SHA512 c741a1ee72d19a8af3a3823ca6df21b2e3afeeede73da7c80eb421ce9f7370fb162d00a8565078ba3856a8ccf78493a4b12f92955afe287b59ec5f2dc6911402
TLSH
T1E7D023307A3671C0C21E0030E4110B40236E40B230CF43476194440DADB40C1D2DFEC7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ab98da7535c8de464335204ae97fd672936e639269325c3a388b3039d8396b83
MD5 1656a3560c7aeae221756f3891b89fd3
SHA1 e48441fe2b843ba3bd0bb7799c07b22a27db8eb7
SHA512 c06d7152d11e33601716d4c5c33c7373ac4e0c16571e80ac4a8ffb9cabb52fae51d4fe8d808fc75be943287b55a320e90a186d71a5f06e9db006f6ab89266400
TLSH
T1CFD09B307B597042D3074031E8074790169E84B5249B86066554410D7D5A485E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 af0b575ab33c5713666cea4eeea5ab9c6ad0156a183021b2547e8d235bd6a22a
MD5 5ca0987b9114f5b67ca5934863f16282
SHA1 ef5d1cff5d07f5e43753bbb2252e3cd1e894d635
SHA512 e2c9fe51188e3debdf2b62c191b101c168c5be9193cc6f6e68ed24c19561e38e8cd3df3426206a49587b422221b6c8e822619f87184f1819750aae95d4d6ea5f
TLSH
T14871703C89810129F3214132AFE16D1A7BB343E8FA1F6EF195A46B749BF67D3C159029
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 8c1e82875939352821012b1503507d931ce3f01182027257b7097b2faf1f2092
MD5 a06af0f7ba071110d6b3bc3e14303493
SHA1 a00ad6106711691a4f1cfc5a49c5d6b30b666b6a
SHA512 54c719849f6d6e38665e6ebd0c0dfbd574a5cfbe6aa3923b678282c1da862f83b44347ea2807561a48c3c4088a0eb970834f18f1c3b8697da5cafc92ac4757c6
SSDEEP 3:MsEllllkEthXllkl2zEklw4:/M/xT02znw4
TLSH
T1FF440405FFC0C54DC50050304513C35003F0D4101D315FC33CD10453DDDD5400C01040
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 efa0221258bda48e2ba31e64448709917e0f8fb72176618c6f92ea8c6a3eeb5c
MD5 1902d49c950a0ef46663fe8c1a2e75f2
SHA1 7c7705a9a0417e37707bce6a1c87010523dd11d6
SHA512 c48825c4331c70664b5c1fed57c2b7f5e9751b32d9be9256249542b8c48f1404145969d7ab4072d6681347677cd34c45fde817a6b249bc60be0de65473c756e5
TLSH
T12951AEF787E4896E8A0196F09A18AE2FDF2D0615431C3C6989D4EE27D7F3472E10265F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 63b9c581dad273dee9982ab8f9f069a764b84ea87bc63a16c05df29ae406a585
MD5 7f5a52d150822fd55274d05657d31bfc
SHA1 d1553a3be96bf382e2f5175f0f56409ec10b846d
SHA512 9afca42df02ef6ba32bd9afefc0a450acf0d8c5d60da6f0fecc69e611ac8c36e5d981e838ca8f9ac7cf05ad2eb0e59bc35ce2b251d3c52d30451d448f031ae4f
SSDEEP 192:sxZIRmzN/fssr5GBQFZNw31YIdpw6HW6+WNr3g/AjzDXw4Ig4J:sxZI0N/fssr5GcZ4bbHbE/Sc
TLSH
T17C32C7566E34987B8CCBD219BA54BF53E6FA503291D51E48A6FC8A0C05E7BDD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 4d59a2f08501af62a5f84f96e4fa44d5edc929f8896599b7bd21091405a75f3c
MD5 3eee388d6e5be3f7e50ffefa532b4c3e
SHA1 fa270a32760673e327a8d79d934966bd82fde3b0
SHA512 3ff59cff33200b728f55ca96087926acb459608d23aaa44908ab37f05b39419f1b243374de855476dda30cb4cd973d34baac7c8bf7e02f24c4a49298e18c31f8
SSDEEP 192:sxZIRLmN/fssdWWpVNkBQFZNw3hYIdpw6HW6+WNHLUC33g/AjTC/YyIgbPJ:sxZIoN/fssdWWvNkcZ43bHbHQCA/D9
TLSH
T1D342C617A934987B8CCBD21EBA55BF13E6F9502292D11E48A6FCCA1C05E77DD230780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 694e5b2f51fa2b173de3e8165c4e98aee00cbb5bfaf6285bfa7ddcc9813fd76e
MD5 9226be591e2f64e54399f262a5dfc918
SHA1 2466949bb57bbbe7f050f29ab4703ff78546ae36
SHA512 3abfad21c1294621c292038ac522c7d1b1c5dd79d67ace590bd6b7ca10c1cd2abe614f1a82b9cb1cd300a4e94701a23568f4b3759ad4bdd1d1783b9e514bb89f
SSDEEP 192:sxZIRmmN/fssd5GBQFZNw31YIdpw6HW6+WNr3g/AjzD9w4Ig5BJ:sxZIRN/fssd5GcZ4bbHbE/cZ
TLSH
T15632C856AE34997B8CCBD21ABA54BF53E6F9503291D41E48A6FC8A0C05E77DD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 0ed0889578220cad4d0a6d3e00b9e8fc3620ac03754cbef0dbfe756447d02786
MD5 423800339ce5d776da71e5a0cc050495
SHA1 4fe77e2d5fdad6955b3b68aaa29ea430c2b3f340
SHA512 bd01013fe7038beaadb3ffa7100d7f522c96b9a08a5f64ccad96e1429243e27bdd06090b248654dfa7bbde79bc69e4f9da0a31b9af563db290347cdb64299f08
SSDEEP 768:c2k7uP47pLuLfg0WvqiEa8F1+UoAYDCx9Tuqh0VfUC9xbog/OVtXi5LlWYSBLroh:c2k7uPkEfg0WvqiEau1jaAXi5LA3B4CM
TLSH
T19BE2EC7B740CCB7E4F800E9DED1A7F9A6EA801CB96D8C94047FA945C02C76EA51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 e349ea7fb71ec666520e8d88678660462e942206160ea3518f14a157c1fc3984
MD5 ea5ce69e419a6fb7b026ae25561f0f7d
SHA1 9d22da4f1046eac6b52292a51f00661dcff7cc11
SHA512 19d2e285bcf11f4478da8d6d6f530963d252eba6777d3609d9250e91b5a1c9ce16d8d5eae9565a456a6b966f16eadbfefe4c2d6dd87e548c93021edc3fb05024
SSDEEP 48:KfSVOyIQA2aQL9IZy2KYT3MIXKZqYHyNlIJKek8e1INK2QA4:KIbCKc3MIKZqS2lCKekh1CK2Qx
TLSH
T1AFA12416717B06013C7E2C59A19595378F8235A33458A8EF7FB810B54E66E124FFC8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0cf97543bbe250820c52700eda7182eb374ed70593d949ea9bc92dc15caad84e
MD5 44b3a432ec43f82039764bdca47571d2
SHA1 e683b4db703b1cdb7bb1f0195384a6cff55504a6
SHA512 b03fe865c4d49416edec4fd0b6e51ead32fc8466f2d7ff302ce0e6ba30e8f2bb07faa39815a059e663ea96c7c07870f47b0e4cc81aebbc60bc6f7b1fb3799e20
SSDEEP 192:MONa64BAQmiUyx1oW5GBPKScC2567aDRphU6:MONa6eAmqWE2BdU6
TLSH
T14802F9396C796C7B9EB2AD45F48637175FA4117BE6946F44EAE82B1C00D724C230392B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 bb1e9ebf4d00cc1f05adf292d87739e57c1a016479acce43d823136ef87d4f8c
MD5 21bd5c2f7e832659e17fd8b47a78384c
SHA1 0b02655aceca0d730b9ff1ece3f57229c35093a2
SHA512 adc92e69dfe029e055a5e7dfb6c70f4b83aba3bcc51d3954257865ec590c4c6a3faf607bc70add5a446547b46070b1634c6915ce281f493b84614d65a63aee94
SSDEEP 384:nVZcILsNaEfwby4mn2Vj06vKASBV9dsd55MPRwOObjI9G6w7zz:tL5LsqHtSYd55MPa29MX
TLSH
T1B7B25C74ECA51EFB8565E9C2B085EA1B2EE45177D2980A4CA6F8FB3C348F5FC0312416
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b0079926ae458d69c733fcc4484e312585f0691554b8381bff6388d4da585246
MD5 b04a19810732de00f38ce3a0715c24d2
SHA1 482d03e653620a5862f38c0f4e1808f95e5d4e14
SHA512 271948e4b6c951665628b13311cd6cc88226d2147a4b4e5a5e50d08c3d2a82d2e3d9cf5ed9cd509c38480e94771dc5450cdcec109822ed23bcfceef03acad37f
SSDEEP 192:xONm64ByQmiUyGoy5GBPKScC256bePNlWwcqphU6:xONm6eumyE2VptU6
TLSH
T15D120A75ACBAAD2B5EA2B101F0C633575EA41177EA849F40FAE85B1C04D739C2B0B51B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 fef5b6dffe9222b208cefeaa72c3540050b319db86202a916d4db9a0621f5e32
MD5 257b9b76d5bc63d033055fbb36a9749d
SHA1 1cf0f103afdfec869f7d87ec9e520011a85d05e1
SHA512 32eee01dcd8d2bd0badbd37ee056bf20f80d31cdb10d408012fcb2990478e659a1b986ece421310d05a10e0094e574ecf82111906954f77625c389fff55a4f5e
SSDEEP 384:nbZcIhsNLXfwbPgmn2VbtOObjI9G6w7zz:Dh7ssmt29MX
TLSH
T1CE929E35AC759E369AA7E112F0CA371B5FF860B7E6840F44F5E8DB0C099769C170A817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 17b359ddb154708d91e5e798c35028a7090c5cfcec5718e1b62c4a678cabb612
MD5 d897987df85ebfd3e5cafc5768b05c8a
SHA1 ac28040e6ce89627572ae462273f265ae6bef6e9
SHA512 ece912537d1530aaa09434396ecd6a5460e34644f42473ec8335471e9a0d7cca9f21c2390eabffe596a0f4a6dece8ad32a10cf535808bce38857660f6aaa371a
SSDEEP 384:nJZcILsNLDfwbDgmn2VbtOObjI9G6w7zz:BLfIsmt29MX
TLSH
T1B2928E35AC759E3699A7E111F0CA361B5FF850B7E6840F44F5E8DB0C099769C170B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c648028e-8dd3-4676-ba93-d639859f0e26.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\c648028e-8dd3-4676-ba93-d639859f0e26.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 98c37786f6540e0d30f2be377e190fb6f85ddf0949d556a0dad28074d11fbf6a
MD5 42dfc775c3ab996a158c01dae4a5f8bb
SHA1 58c5102dcd615a0984c47071bba3904b93773c3d
SHA512 eac2bed219395d74eb1988f9a1afbebc0256d6949d037d4871ed5f622a3f9191f6a8e80a9128f31ca955eefc4922fd529de119ebf2f2562a265fb816382243df
TLSH
T108411859A6FA1148B3B36F5AABF6A86D447E7C772F0BD46E00010D4F0662B44C9A2737
MD5 SHA1 SHA512 TLSH

Submit Download

1770843c-63e3-479b-ad87-c1a4b6e0e2af.tmp

Path C:\Users\Admin\AppData\Local\Temp\1770843c-63e3-479b-ad87-c1a4b6e0e2af.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.10_(x64)_20260727224435_000_DotNetHost.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.10_(x64)_20260727224435_000_DotNetHost.log
Size 3KB
SHA256 506947bc4811ee245981bd259b9e9dd2259fa62894a710aedbcb750513312bab
MD5 1a2b83eb41822101e5d3a998389e2979
SHA1 87a72d43b15a54abe103499ac90a78cc7911c307
SHA512 5c45a78805301eb6d957ca955474677c26c487217190535bb4482a95b3b1a7700a39f725b27c04582cd4d2a61ca2f29cd68efb4d85eb761fa6ecb813c551ea91
TLSH
T1EE713C181AF50C5AF1B3964B9EF3C0565B33FCD69834CF0C1389871A06AFD09A955BBA
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.10_(x64)_20260727224435_001_DotNetHostFxr.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.10_(x64)_20260727224435_001_DotNetHostFxr.log
Size 2KB
SHA256 ea636bca17b8aaa7e854e2f5527f95278d12b7f8969ddbdc1147661fec0e0ebe
MD5 7d23f8cb22f92dee780f34c07ddfb2c6
SHA1 6c834e5b6685c5c0d28ccd69415c3217cfafcadb
SHA512 aa04d06023e8a0548a84a16de45ee6b64d8c791fdacca55d0f361578a1b9938d8a8074f32760c372110e30d16a2105debb290493d08bf1e7ca06220e9185c403
TLSH
T12A41FA581BF5094BF5B2570B5EF3C2534B33FCC55834DF4D6288931A067BD08A899BAA
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.10_(x64)_20260727224435_002_DotNetRuntime.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.10_(x64)_20260727224435_002_DotNetRuntime.log
Size 2KB
SHA256 510411e9d0ebcb9a074ec372fa168da42be5135bdd07d6d86e09c4912d6f7a1b
MD5 09defc69508a09e8afea698f78fdb7b3
SHA1 9a270231b86b64ae66efa782b2d1c5b5705e924b
SHA512 471141fd227f16130086e640d62c4b51792b5304baaac2987f5d2b65635c973026b7c8dc4348d6c4b7db42ae1b607921fa647915e4b977b99b1afe7b1641e3c1
TLSH
T18B412B481BE9094BF1B697475EF3C0529B33FCC66C38DF0C62895219467BD08A855BAE
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.10_(x64)_20260727224435_003_WindowsDesktopRuntime.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.10_(x64)_20260727224435_003_WindowsDesktopRuntime.log
Size 2KB
SHA256 f53f62403dd9a578dc22125b2ee9186989d6dc96eb6df7203c48835e6fee2eb4
MD5 186d5a74a87afda33217b43b5b656c36
SHA1 62d2d297e45af453471e8a3201e579b720dcd576
SHA512 26de81ffc127b83be8af331a659eca5d7b33106ed45187f39ab95dc9cee2fd62d1b048ddafe88f852380d2ebbbaf1cab259225b5f6ee70adbdd66857419b71e9
TLSH
T16441291C1AF5494EF1B697079EF3C0536B33FC857930CF0C22C95659066BD09A869BAA
MD5 SHA1 SHA512 TLSH

Submit Download

8481797c-59c1-46a9-b16a-b1b25fc51442.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir640_1003342444\8481797c-59c1-46a9-b16a-b1b25fc51442.tmp
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir640_2104420901\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aca974f2-5d3e-4a75-aa7d-f0fd034f5f15.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir640_2104420901\aca974f2-5d3e-4a75-aa7d-f0fd034f5f15.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetHost

Path C:\Users\Admin\AppData\Local\Temp\{F43CDF23-6C61-4512-9EA8-684401E48CA6}\DotNetHost
Size 1012KB
SHA256 03eb33e8eb7746542febda19278dde1c7bd496396a69a9d625a05f9506a1c3ee
MD5 667bbe018d9a8052f0ed4d4b44a02ec8
SHA1 9af6e69d606a4741ada8a58f36b9c06c9cf22626
SHA512 5e07d476569a3c7bf938278adb2b710be015698e5c3f01a5aab2db319d07b8ea675758aeb201577d3d51394550c313dc4bf401397c44f846154fcec9a445c073
SSDEEP 12288:SN2etgX0xsm7HrObWMInYLE/BbdJ0zErWolCJ9TeWxqYZfDvXNM:i26gG74W6WBbdJwEqECJ9Te7YxDXN
TLSH
T1A2256A1BBFA404A9D8B24E75C5B78321EE357C482320969F43A47229DEFB7D0647A7C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetHostFxr

Path C:\Users\Admin\AppData\Local\Temp\{F43CDF23-6C61-4512-9EA8-684401E48CA6}\DotNetHostFxr
Size 1.1MB
SHA256 da12be59d35710ff0082f3506e84d741c00816290ac1d3093078e7c7b4ec2d51
MD5 ecd6f2e85cdb3623db79832c198448b2
SHA1 48580a0e26d28d8c3ec0c0418e1896eb70448285
SHA512 4764485b64fb4bb7e3c4e28678e172c84cf9f67a23a905a0cca8f9c4522cf404be3a5dd6cc23d3dd6fb96ea2bd7dae425ca36adb80324ec795ce560806575fa7
SSDEEP 24576:626gG74W6WBbdJwEqECJ9Te7YxM6fA9Ac:626748BnwEpI9T6Yu6lc
TLSH
T134357B1BBFA404A9D8A24EB5C5B78321FE357C082320959F43A47229DEFB7D0647A7C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetRuntime

Path C:\Users\Admin\AppData\Local\Temp\{F43CDF23-6C61-4512-9EA8-684401E48CA6}\DotNetRuntime
Size 28.2MB
SHA256 4af98ab9168f319b9d026e01bd6e9df577799a222b04454579053a5a00abd555
MD5 8fe07617a818797bf2170e4ca5f4bb95
SHA1 126523726901f0a1129d9066c369f963f1ef5854
SHA512 75544a3a9bff83e7fed005ecfd0847ce32442e82c53879097518fd03ef4f6d8364bd5400912613d1eb33f6ae1e262bd1a61087960fbc6655ecd03260072bdaea
SSDEEP 786432:Tg+OS4VhnxfDEAOZGc3PHDOsz1tHDypQp:TF43nxfYnvDOsqu
TLSH
T12A573397BFA408A9D4A24E71C5B78325EF313C182721C59B42607669EFFB3D464BA7C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsDesktopRuntime

Path C:\Users\Admin\AppData\Local\Temp\{F43CDF23-6C61-4512-9EA8-684401E48CA6}\WindowsDesktopRuntime
Size 28.8MB
SHA256 024753cf71ec777cf38c82c29bfaae467ab554086d1cf6b34f5d850f61a16c28
MD5 b76d067851e1d31cc6c6f00bd68d078b
SHA1 1a83f1fca787b802f03b12c60cea0306b64eda1e
SHA512 c1551bc40c04b552b6925675180fdb69bd00e4282bbe5c3ac6db13fa49a2786f430171ed7379f7bbdfbecb998297fff54ecb77db6c58feb9f8a1196d112d155a
SSDEEP 786432:Kl8TBZmSPFbeIQhCxCLWcSEDm03uCoE7WOF:KlGZmiFbVQsECcSEdfS
TLSH
T19B673367BF9018A9D87B4E78C4B783649E317C192320AAAB47607619DEF73D451BB3C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIAA06.tmp

Path C:\Windows\Installer\MSIAA06.tmp
Size 392KB
SHA256 a28ed81b8594774c7e1e82f9bbe858c3b36f0d7a93067001387a5a872288231a
MD5 f1fafe5c54813a5d7b60d08b859bd58b
SHA1 95e6598ce1c02220d68edab5474980b7f0f0a12c
SHA512 6dbc8b10277c6fae8d7ba961a843810df0bb11c9c6e3ba54eea1b24e13b1069e454ef5d76d345839a32f94871855928578a15948ba242d03c990b21d8f845df9
SSDEEP 6144:u/VbdUw0z9ursTolCJSqJiIUk8AeWNxFqYrtUc06N:u/VbdJ0zErWolCJ9TeWxqYZfN
TLSH
T1CC846A29F7E418EDD4B782B6C5A68030FF75754D332095AF8BA845291F3BAA470BB701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BootstrapperApplicationData.xml

Path C:\Windows\TEMP\{F43CDF23-6C61-4512-9EA8-684401E48CA6}\.ba\BootstrapperApplicationData.xml
Size 9KB
SHA256 b1eda1e98d843eef81232344754cdc0973d9dda1c1790a91a352c167c9a64ca5
MD5 5b54f26d64fb1f7e82bec5b4ff190ba2
SHA1 11d8be75fdb2bded9b835a2d0f6e5bf1848e0ce6
SHA512 3418f51296007c704600edc69c91e26c23e8e159e0a20aadeae06d010c80cb85cb4d86517d9fcf6ec5b150578311cb57592eb220ba0f93c7512d812e29b83fb6
SSDEEP 192:2/zaT1c/ovY9qnpijXjamaD0QP7XsCsysz:9sCsysz
TLSH
T1A912D4112BFD0218F0F3AE48EFF6A4555A3ABD552E39C92D01301D0F49B2E819962FB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetLogo_256x.png

Path C:\Windows\TEMP\{F43CDF23-6C61-4512-9EA8-684401E48CA6}\.ba\DotNetLogo_256x.png
Size 2KB
SHA256 0f571f95d8eab48dbc81b0ec5e9f7225e349e26ef50868bfaab556f3c2443b01
MD5 39aa52615723b782c92dec710caaec7f
SHA1 760b49e256a7979fe50a56a2b1be3688a474b886
SHA512 89d1baa3820154667747b25e9e2fd321bfb2ec71dc309915b0a28dacdc80822a4943b639ebb37c37bd2559d5a4306d2096119cd970c84a0d331f6c68b0456dc9
TLSH
T1534195CF1BFD78D7E6E557918E1A8DD232738483B4B3A42CCE7B10B8274A5642B87940
MD5 SHA1 SHA512 TLSH

Submit Download

dotnet.ico

Path C:\Windows\TEMP\{F43CDF23-6C61-4512-9EA8-684401E48CA6}\.ba\dotnet.ico
Size 44KB
SHA256 61a2cbd12868cb9b359e0c78961d409b7875f072eb8e53ea88d3e6bfe2961a18
MD5 b8096652d9ec286709a2c863b244b110
SHA1 b3b7f0f4d608fad7cb59ba499d4d17c2b873a7af
SHA512 492a5aa83220bb77c178b7c5b50bf44968c0427e9e45bb97a33df14d7fb4c667ca7adde0ebb3874c7b6011057b01144e4e6651fbad62c6bcf5e0b93586c4bc7a
SSDEEP 96:r+gfbzo+wHK9NbwOY4tIWQeVlV1W9+H+guapUjFamINUItzf1dBNaIZ:ro5HuNcH4tIzeVlV1WEOFDgUWzf1PIm
TLSH
T1E913EF6DE68547C1C10C2032DB4AC792B5233C72E4DAE0C4F9D4FA7E177906965C6E6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\TEMP\{F43CDF23-6C61-4512-9EA8-684401E48CA6}\.ba\thm.wxl
Size 7KB
SHA256 b00edd703dd8a475119d0e4dd70a3aaa47f0e95361af290e76d367a8edef3432
MD5 8b2c667a8bbad3153068c0ed90df7ec4
SHA1 c9e04a3a37e5e6262ab9bfecf78280171b8f7b74
SHA512 5269f00d474acccb4c48cb7bcfdf19e63557a388572d3a6335aa39191319691d924e27f70da3f3495387c319396476c63a8fd7b35835cca0901220e39783847b
SSDEEP 96:HiTgM1+XSNEzA0HtYQstYCpCwZQpCeyk5HQJM9ouvj9urz8:Ew9EmtYQstYCPC9e8
TLSH
T191E1026F68DFDEE03A732651B2B3698D6919C29A136F1CF0F869084B47635016377A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.xml

Path C:\Windows\TEMP\{F43CDF23-6C61-4512-9EA8-684401E48CA6}\.ba\thm.xml
Size 11KB
SHA256 dfee8e2d075087227f19c835c145c5bb8e72a46880ea24080bb2472fd3a521be
MD5 4329e418dc56b1386d7ea29a0dcfab5b
SHA1 58387f92e89ca21b4179fb697c7de9675c59142f
SHA512 6934873d27e6efbb94da4f13ee8369b29995490051016fdf82800256b924902306d328bf1d4ebbf266d1a53eb24adb6478d1a67de4ecc3e3bcbe561968f24922
SSDEEP 96:HgvPkoeWEH3IWTaQfSJgHzth5mFahbuB8pR5+Vpwe+UIJLg1gEp+6F5pQnxc:AvoWydmQfVHMyyj5Z
TLSH
T14B42FC6851DC7811C532D702AB9371D3FF12BDA6C6C85A58B48E256B1FF262028B739C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixstdba.exe

Path C:\Windows\Temp\{F43CDF23-6C61-4512-9EA8-684401E48CA6}\.ba\wixstdba.exe
Size 431KB
SHA256 2b1cee5e3e24593247854eb7a7c4308937b9c607754ed2fb83520a8706c26f1e
MD5 0e88ffd2e737ac9b9a4241616838bc23
SHA1 3c8beb465d20bcef0cd6ceca9c60286d1d15cebd
SHA512 169b9e08518834c9bc5adfe4ab7b79e07685b72f30ede1c1a386229668bde8c15da378e1274e4013ad7b84d6f7a5acc64ef0806e3b8a66322861efaa7e26b620
SSDEEP 6144:X9vfS1NP+c3ytxmg4Stlqe3B9m2LSLTwGw7C3ZLaov5xZvSdF:X9v+GIyugllqe3wwGfX5/SdF
TLSH
T129943B3165F04037C6F90572AE14FA31BF69F208231095EBA3C0DD293968AE5BBB7657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windowsdesktop-runtime-10.0.10-win-x64.exe

Path C:\Windows\Temp\{F43CDF23-6C61-4512-9EA8-684401E48CA6}\.be\windowsdesktop-runtime-10.0.10-win-x64.exe
Size 967KB
SHA256 47b74e25c31fceb862dcc4496af4dcce01823094997aba1e88eb936013ffc2f8
MD5 0f57602b1b78b077a5b0e996ef306a7d
SHA1 4c86ca072878cf03f66be4dc721a02d5c6fe76d2
SHA512 b28e50f9ef8debb5e25af797cc9a7ed6882f08425c595ce36eb6d48e0b703c17f619151d84a6d1b8dd8b5f7affc231c19790c46d6224b94279de5a5c568aa1a2
SSDEEP 12288:OVGWl6qCmyZeU6lqlDjC+fScn6X8GwMgJEkqd68Wr//f0ZoiDqIMjFqs:OVGWl6qCmyt6UdmcpMzrI58lDqPxr
TLSH
T1B4257D31A166242BD6F50973F914D2307E28D7082B5C99B6C6C0DD0D39689FA6FFB24B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/816-1337-0x00000000000C0000-0x0000000000186000-memory.dmp

Download