3867a2b72d32cf68210086edf0c94305578c3dbadbeb3f2bdabb3f79888bd9f7

Analysis

user interaction
yes
max time kernel
798s
max time network
801s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
30/07/2026, 03:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VelocityLite.exe
Size 18.6MB
Sample260730-ejmdescn9s
SHA256 3867a2b72d32cf68210086edf0c94305578c3dbadbeb3f2bdabb3f79888bd9f7
MD5 69674db1e8505fc001ba1bb544ffdfcd
SHA1 10b7d17291d38a6fc5280c5db2e071290a53c068
SHA512 b3d9d78c3a4369f6b948ba7f49f2259c5d59fbfceed6c989345d8fae762e4b343e814cc1b424eccc82d75ee4b7cd892b0f6aa7819ea03425a1d609955341636d
SSDEEP 393216:pdtwpHrmXuabdwVorMb975j+ssedCCxr0DGfRJ9A8q:pTwpHrI1gowb975j+SCCxQJ8
TLSH
T100171247F389DE2EE25B1B3686730394A6359CA1BF5B030FA41A76B8AD733C01D146D6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware defense_evasion discovery execution persistence ransomware spyware trojan

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4908	powershell.exe

Downloads MZ/PE file 3 IoCs

flow	pid	Process
549	4176	VelocityLite.exe
532	4032	msedge.exe
769	4032	msedge.exe

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000\Control Panel\International\Geo\Nation	Fishstrap.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000\Control Panel\International\Geo\Nation	windowsdesktop-runtime-10.0.10-win-x64.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000\Control Panel\International\Geo\Nation	windowsdesktop-runtime-10.0.10-win-x64.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000\Control Panel\International\Geo\Nation	VelocityLite.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000\Control Panel\International\Geo\Nation	Fishstrap.exe

Executes dropped EXE 15 IoCs

pid	Process
2416	VelocityLite.exe
3552	VelocityLite.exe
5380	windowsdesktop-runtime-10.0.10-win-x64.exe
5372	wixstdba.exe
4724	windowsdesktop-runtime-10.0.10-win-x64.exe
1396	windowsdesktop-runtime-10.0.10-win-x64.exe
5396	windowsdesktop-runtime-10.0.10-win-x64.exe
4100	wixstdba.exe
5668	windowsdesktop-runtime-10.0.10-win-x64.exe
4176	VelocityLite.exe
3948	Decompiler.exe
1100	Fishstrap.exe
8788	RobloxPlayerBeta.exe
9040	Fishstrap.exe
9248	RobloxPlayerBeta.exe

Loads dropped DLL 64 IoCs

pid	Process
2632	MsiExec.exe
2632	MsiExec.exe
1288	MsiExec.exe
1288	MsiExec.exe
5600	MsiExec.exe
5600	MsiExec.exe
2012	MsiExec.exe
2012	MsiExec.exe
1108	MsiExec.exe
1108	MsiExec.exe
3324	MsiExec.exe
3324	MsiExec.exe
4176	VelocityLite.exe
4176	VelocityLite.exe
4176	VelocityLite.exe
4176	VelocityLite.exe
4176	VelocityLite.exe
4176	VelocityLite.exe
4176	VelocityLite.exe
4176	VelocityLite.exe
4176	VelocityLite.exe
4176	VelocityLite.exe
4176	VelocityLite.exe
4176	VelocityLite.exe
4176	VelocityLite.exe
4176	VelocityLite.exe
4176	VelocityLite.exe
4176	VelocityLite.exe
4176	VelocityLite.exe
4176	VelocityLite.exe
4176	VelocityLite.exe
4176	VelocityLite.exe
4176	VelocityLite.exe
4176	VelocityLite.exe
4176	VelocityLite.exe
4176	VelocityLite.exe
4176	VelocityLite.exe
4176	VelocityLite.exe
4176	VelocityLite.exe
4176	VelocityLite.exe
4176	VelocityLite.exe
4176	VelocityLite.exe
4176	VelocityLite.exe
4176	VelocityLite.exe
4176	VelocityLite.exe
4176	VelocityLite.exe
4176	VelocityLite.exe
4176	VelocityLite.exe
4176	VelocityLite.exe
4176	VelocityLite.exe
4176	VelocityLite.exe
4176	VelocityLite.exe
4176	VelocityLite.exe
4176	VelocityLite.exe
4176	VelocityLite.exe
4176	VelocityLite.exe
4176	VelocityLite.exe
4176	VelocityLite.exe
4176	VelocityLite.exe
4176	VelocityLite.exe
4176	VelocityLite.exe
4176	VelocityLite.exe
4176	VelocityLite.exe
4176	VelocityLite.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{866BECDA-F284-473A-9E84-0CCE816BF06F} = "\"C:\\ProgramData\\Package Cache\\{866BECDA-F284-473A-9E84-0CCE816BF06F}\\windowsdesktop-runtime-10.0.10-win-x64.exe\" /burn.runonce"	windowsdesktop-runtime-10.0.10-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{866BECDA-F284-473A-9E84-0CCE816BF06F} = "\"C:\\ProgramData\\Package Cache\\{866BECDA-F284-473A-9E84-0CCE816BF06F}\\windowsdesktop-runtime-10.0.10-win-x64.exe\" /burn.runonce"	windowsdesktop-runtime-10.0.10-win-x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	VelocityLite.exe

Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
262	api.gofile.io
265	api.gofile.io
266	api.gofile.io
268	api.gofile.io
814	raw.githubusercontent.com
815	raw.githubusercontent.com

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Probable phishing domain 1 TTPs 1 IoCs

Phishing

T1566

description	flow	ioc	stream
HTTP URL	672	https://sourceforge.net/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=a23183412e189383	5

Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs

pid	Process
8788	RobloxPlayerBeta.exe
8788	RobloxPlayerBeta.exe
8788	RobloxPlayerBeta.exe
9248	RobloxPlayerBeta.exe
9248	RobloxPlayerBeta.exe
9248	RobloxPlayerBeta.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\de\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\pt-BR\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Net.Ping.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Threading.Tasks.Parallel.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\System.DirectoryServices.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\wpfgfx_cor3.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Memory.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Security.Cryptography.OpenSsl.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\zh-Hant\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Net.Primitives.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Text.RegularExpressions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Threading.Channels.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\hostpolicy.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\DirectWriteForwarder.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\de\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\de\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\fr\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Runtime.Serialization.Json.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\it\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\zh-Hans\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Net.WebProxy.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Security.SecureString.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\mscordaccore_amd64_amd64_10.0.1026.32716.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\ja\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\pl\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\zh-Hant\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Reflection.Emit.Lightweight.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\tr\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Resources.Reader.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Security.Cryptography.Csp.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Web.HttpUtility.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\it\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\pt-BR\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Collections.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\netstandard.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\System.Drawing.Common.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\System.Windows.Forms.Primitives.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\UIAutomationClient.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Collections.Specialized.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Runtime.InteropServices.RuntimeInformation.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\PresentationCore.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\PresentationNative_cor3.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\ja\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\ru\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\zh-Hant\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Reflection.Extensions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Security.Principal.Windows.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\fr\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\ru\UIAutomationTypes.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\tr\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\zh-Hant\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.ComponentModel.Primitives.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\PresentationFramework.AeroLite.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\ja\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\ko\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\pt-BR\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Net.ServicePoint.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Runtime.Handles.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\it\UIAutomationTypes.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\ko\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\ko\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\tr\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\zh-Hant\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Net.ServerSentEvents.dll	msiexec.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI9415.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6040_2099465007\office_endpoints_list.json	msedge.exe
File opened for modification	C:\Windows\Installer\e6043d3.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4F02.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI93B6.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6040_1230575608\manifest.json	msedge.exe
File created	C:\Windows\Installer\e6043d3.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149\fileCoreHostExe	msiexec.exe
File created	C:\Windows\Installer\e6043de.msi	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6040_30172776\manifest.json	msedge.exe
File opened for modification	C:\Windows\Installer\MSI4B57.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI77BF.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6040_1526136306\classification.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6040_1230575608\LICENSE	msedge.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149	msiexec.exe
File created	C:\Windows\Installer\SourceHash{F0BCFB2E-4878-4F6E-BD5D-3ABFF264829E}	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6040_1840877074\sets.json	msedge.exe
File created	C:\Windows\Installer\SourceHash{8A8CC49F-7D1E-45DC-B7B5-35FF61A2C25E}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI45F7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e6043df.msi	msiexec.exe
File created	C:\Windows\Installer\e6043e3.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5F90.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e6043e4.msi	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6040_1840877074\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\Installer\SourceHash{DA493AF2-5A21-4D85-BB57-757D7525EB73}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5B88.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6040_420905419\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6040_1526136306\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6040_2099465007\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6040_1840877074\manifest.json	msedge.exe
File opened for modification	C:\Windows\Installer\MSI9667.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6040_2099465007\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6040_1230575608\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\Installer\e6043da.msi	msiexec.exe
File created	C:\Windows\Installer\e6043e4.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9079.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6040_420905419\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6040_30172776\nav_config.json	msedge.exe
File opened for modification	C:\Windows\Installer\MSI44CD.tmp	msiexec.exe
File created	C:\Windows\Installer\e6043e8.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9A61.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6040_2099465007\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6040_1230575608\keys.json	msedge.exe
File created	C:\Windows\Installer\e6043d9.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4FDD.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6040_1526136306\automation.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6040_1526136306\travel-facilitated-booking-kayak.js	msedge.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\e6043da.msi	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6040_1526136306\extraction.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6040_1526136306\travel-facilitated-booking-bing.js	msedge.exe
File created	C:\Windows\Installer\e6043df.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7349.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI99E3.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6F31.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8D0D.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{441FCDB0-A03A-4130-A1D5-FFD8C53CFF6B}	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6040_1777292133\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6040_1840877074\LICENSE	msedge.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149\fileCoreHostExe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5175.tmp	msiexec.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\7zO8EE9102F\VelocityLite.exe:Zone.Identifier	7zFM.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.10-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.10-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wixstdba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.10-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.10-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wixstdba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.10-win-x64.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5628	chrome.exe
4032	msedge.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	msedge.exe

Checks processor information in registry 2 TTPs 48 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies data under HKEY_USERS 17 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2B	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2C	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2d	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134298579342933241"	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_80.40.55332_x64\Dependents\{866BECDA-F284-473A-9E84-0CCE816BF06F}	windowsdesktop-runtime-10.0.10-win-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2FA394AD12A558D4BB7557D75752BE37\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings	OpenWith.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2FA394AD12A558D4BB7557D75752BE37\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0BDCF144A30A03141A5DFF8D5CC3FFB6\SourceList\Media	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E2BFCB0F8784E6F4DBD5A3FB2F4628E9\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E2BFCB0F8784E6F4DBD5A3FB2F4628E9\SourceList	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings	firefox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F94CC8A8E1D7CD547B5B53FF162A2CE5\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{8A8CC49F-7D1E-45DC-B7B5-35FF61A2C25E}v80.40.55332\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2FA394AD12A558D4BB7557D75752BE37	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F94CC8A8E1D7CD547B5B53FF162A2CE5	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F94CC8A8E1D7CD547B5B53FF162A2CE5\SourceList\Media	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0BDCF144A30A03141A5DFF8D5CC3FFB6\Version = "1344854052"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\dotnet_runtime_80.40.55332_x64	windowsdesktop-runtime-10.0.10-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E2BFCB0F8784E6F4DBD5A3FB2F4628E9\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{F0BCFB2E-4878-4F6E-BD5D-3ABFF264829E}v80.40.55332\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{866BECDA-F284-473A-9E84-0CCE816BF06F}	windowsdesktop-runtime-10.0.10-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F94CC8A8E1D7CD547B5B53FF162A2CE5\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2FA394AD12A558D4BB7557D75752BE37\ProductName = "Microsoft .NET Host FX Resolver - 10.0.10 (x64)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_80.40.55332_x64\ = "{F0BCFB2E-4878-4F6E-BD5D-3ABFF264829E}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E2BFCB0F8784E6F4DBD5A3FB2F4628E9\MainFeature	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E2BFCB0F8784E6F4DBD5A3FB2F4628E9	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E2BFCB0F8784E6F4DBD5A3FB2F4628E9\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E2BFCB0F8784E6F4DBD5A3FB2F4628E9\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x64\ = "{8A8CC49F-7D1E-45DC-B7B5-35FF61A2C25E}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\9309C9E278150CC5452917C0EA916C61	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x64	windowsdesktop-runtime-10.0.10-win-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\roblox\shell\open	Fishstrap.exe
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.40.55332_x64\ = "{DA493AF2-5A21-4D85-BB57-757D7525EB73}"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2FA394AD12A558D4BB7557D75752BE37\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.40.55332_x64	windowsdesktop-runtime-10.0.10-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0BDCF144A30A03141A5DFF8D5CC3FFB6\SourceList\PackageName = "dotnet-runtime-10.0.10-win-x64.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{866BECDA-F284-473A-9E84-0CCE816BF06F}\ = "{866BECDA-F284-473A-9E84-0CCE816BF06F}"	windowsdesktop-runtime-10.0.10-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A8A84F1AA6E5EFD5BE00C8237B84D6D4	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.40.55332_x64	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\0BDCF144A30A03141A5DFF8D5CC3FFB6\Provider	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\windowsdesktop_runtime_80.40.55332_x64	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\roblox\shell	Fishstrap.exe
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\roblox-player\shell\open	Fishstrap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\roblox-player\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Fishstrap\\Fishstrap.exe"	Fishstrap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F94CC8A8E1D7CD547B5B53FF162A2CE5\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0BDCF144A30A03141A5DFF8D5CC3FFB6	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{866BECDA-F284-473A-9E84-0CCE816BF06F}	windowsdesktop-runtime-10.0.10-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{866BECDA-F284-473A-9E84-0CCE816BF06F}\Dependents\{866BECDA-F284-473A-9E84-0CCE816BF06F}	windowsdesktop-runtime-10.0.10-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0BDCF144A30A03141A5DFF8D5CC3FFB6\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x64\Dependents\{866BECDA-F284-473A-9E84-0CCE816BF06F}	windowsdesktop-runtime-10.0.10-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E2BFCB0F8784E6F4DBD5A3FB2F4628E9\ProductName = "Microsoft Windows Desktop Runtime - 10.0.10 (x64)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E2BFCB0F8784E6F4DBD5A3FB2F4628E9\PackageCode = "FE4ED37A1EA6D14448ACD5426BC2F2A1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E2BFCB0F8784E6F4DBD5A3FB2F4628E9\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{F0BCFB2E-4878-4F6E-BD5D-3ABFF264829E}v80.40.55332\\"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\roblox\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Fishstrap\\Fishstrap.exe"	Fishstrap.exe
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F94CC8A8E1D7CD547B5B53FF162A2CE5\MainFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F94CC8A8E1D7CD547B5B53FF162A2CE5\ProductName = "Microsoft .NET Host - 10.0.10 (x64)"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\834CD68BBAA561857EB26882AAFC6242	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\5D9ADA2B34E5318566B5BBB43BFD9EF6\E2BFCB0F8784E6F4DBD5A3FB2F4628E9	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\roblox-player\shell	Fishstrap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x64\Version = "80.40.55332"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F94CC8A8E1D7CD547B5B53FF162A2CE5	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2FA394AD12A558D4BB7557D75752BE37\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\windowsdesktop_runtime_80.40.55332_x64	windowsdesktop-runtime-10.0.10-win-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\roblox-player	Fishstrap.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\7zO8EE9102F\VelocityLite.exe:Zone.Identifier	7zFM.exe
File created	C:\Users\Admin\Downloads\Velocity.7z:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
3816	7zFM.exe
3816	7zFM.exe
1032	msiexec.exe
1032	msiexec.exe
1032	msiexec.exe
1032	msiexec.exe
1032	msiexec.exe
1032	msiexec.exe
1032	msiexec.exe
1032	msiexec.exe
1032	msiexec.exe
1032	msiexec.exe
1032	msiexec.exe
1032	msiexec.exe
4908	powershell.exe
4908	powershell.exe
4908	powershell.exe
4176	VelocityLite.exe
4924	msedge.exe
4924	msedge.exe
1100	Fishstrap.exe
1100	Fishstrap.exe
1100	Fishstrap.exe
1100	Fishstrap.exe
8788	RobloxPlayerBeta.exe
9040	Fishstrap.exe
9040	Fishstrap.exe
9248	RobloxPlayerBeta.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4448	OpenWith.exe
3816	7zFM.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 44 IoCs

pid	Process
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
6040	msedge.exe
6040	msedge.exe
6040	msedge.exe
6040	msedge.exe
6040	msedge.exe
6040	msedge.exe
6040	msedge.exe
6040	msedge.exe
6040	msedge.exe
6040	msedge.exe
6040	msedge.exe
6040	msedge.exe
6040	msedge.exe
6040	msedge.exe
6040	msedge.exe
6040	msedge.exe
6040	msedge.exe
6040	msedge.exe
6040	msedge.exe
6040	msedge.exe
6040	msedge.exe
6040	msedge.exe
6040	msedge.exe
6040	msedge.exe
6040	msedge.exe
9608	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4408	firefox.exe
Token: SeDebugPrivilege	4408	firefox.exe
Token: SeManageVolumePrivilege	5248	svchost.exe
Token: SeDebugPrivilege	4408	firefox.exe
Token: SeDebugPrivilege	4408	firefox.exe
Token: SeDebugPrivilege	4408	firefox.exe
Token: SeDebugPrivilege	4408	firefox.exe
Token: SeDebugPrivilege	4408	firefox.exe
Token: SeShutdownPrivilege	4868	chrome.exe
Token: SeCreatePagefilePrivilege	4868	chrome.exe
Token: SeShutdownPrivilege	4868	chrome.exe
Token: SeCreatePagefilePrivilege	4868	chrome.exe
Token: SeShutdownPrivilege	4868	chrome.exe
Token: SeCreatePagefilePrivilege	4868	chrome.exe
Token: SeShutdownPrivilege	4868	chrome.exe
Token: SeCreatePagefilePrivilege	4868	chrome.exe
Token: SeShutdownPrivilege	4868	chrome.exe
Token: SeCreatePagefilePrivilege	4868	chrome.exe
Token: SeShutdownPrivilege	4868	chrome.exe
Token: SeCreatePagefilePrivilege	4868	chrome.exe
Token: SeShutdownPrivilege	4868	chrome.exe
Token: SeCreatePagefilePrivilege	4868	chrome.exe
Token: SeShutdownPrivilege	4868	chrome.exe
Token: SeCreatePagefilePrivilege	4868	chrome.exe
Token: SeShutdownPrivilege	4868	chrome.exe
Token: SeCreatePagefilePrivilege	4868	chrome.exe
Token: SeShutdownPrivilege	4868	chrome.exe
Token: SeCreatePagefilePrivilege	4868	chrome.exe
Token: SeShutdownPrivilege	4868	chrome.exe
Token: SeCreatePagefilePrivilege	4868	chrome.exe
Token: SeShutdownPrivilege	4868	chrome.exe
Token: SeCreatePagefilePrivilege	4868	chrome.exe
Token: SeShutdownPrivilege	4868	chrome.exe
Token: SeCreatePagefilePrivilege	4868	chrome.exe
Token: SeShutdownPrivilege	4868	chrome.exe
Token: SeCreatePagefilePrivilege	4868	chrome.exe
Token: SeShutdownPrivilege	4868	chrome.exe
Token: SeCreatePagefilePrivilege	4868	chrome.exe
Token: SeShutdownPrivilege	4868	chrome.exe
Token: SeCreatePagefilePrivilege	4868	chrome.exe
Token: SeShutdownPrivilege	4868	chrome.exe
Token: SeCreatePagefilePrivilege	4868	chrome.exe
Token: SeShutdownPrivilege	4868	chrome.exe
Token: SeCreatePagefilePrivilege	4868	chrome.exe
Token: SeShutdownPrivilege	4868	chrome.exe
Token: SeCreatePagefilePrivilege	4868	chrome.exe
Token: SeShutdownPrivilege	4868	chrome.exe
Token: SeCreatePagefilePrivilege	4868	chrome.exe
Token: SeShutdownPrivilege	4868	chrome.exe
Token: SeCreatePagefilePrivilege	4868	chrome.exe
Token: SeShutdownPrivilege	4868	chrome.exe
Token: SeCreatePagefilePrivilege	4868	chrome.exe
Token: SeShutdownPrivilege	4868	chrome.exe
Token: SeCreatePagefilePrivilege	4868	chrome.exe
Token: SeShutdownPrivilege	4868	chrome.exe
Token: SeCreatePagefilePrivilege	4868	chrome.exe
Token: SeShutdownPrivilege	4868	chrome.exe
Token: SeCreatePagefilePrivilege	4868	chrome.exe
Token: SeShutdownPrivilege	4868	chrome.exe
Token: SeCreatePagefilePrivilege	4868	chrome.exe
Token: SeShutdownPrivilege	4868	chrome.exe
Token: SeCreatePagefilePrivilege	4868	chrome.exe
Token: SeShutdownPrivilege	4868	chrome.exe
Token: SeCreatePagefilePrivilege	4868	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
3816	7zFM.exe
3816	7zFM.exe
1040	7zG.exe
6040	msedge.exe
6040	msedge.exe
6040	msedge.exe
6040	msedge.exe
6040	msedge.exe
6040	msedge.exe
6040	msedge.exe
6040	msedge.exe
6040	msedge.exe

Suspicious use of SendNotifyMessage 36 IoCs

pid	Process
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4448	OpenWith.exe
4448	OpenWith.exe
4448	OpenWith.exe
4448	OpenWith.exe
4448	OpenWith.exe
4448	OpenWith.exe
4448	OpenWith.exe
4448	OpenWith.exe
4448	OpenWith.exe
4448	OpenWith.exe
4448	OpenWith.exe
4448	OpenWith.exe
4448	OpenWith.exe
4448	OpenWith.exe
4448	OpenWith.exe
4448	OpenWith.exe
4448	OpenWith.exe
4448	OpenWith.exe
4448	OpenWith.exe
4448	OpenWith.exe
4448	OpenWith.exe
4448	OpenWith.exe
4448	OpenWith.exe
4448	OpenWith.exe
4448	OpenWith.exe
4448	OpenWith.exe
4448	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3576 wrote to memory of 4408	3576	firefox.exe	94
PID 3576 wrote to memory of 4408	3576	firefox.exe	94
PID 4408 wrote to memory of 4568	4408	firefox.exe	95
PID 4408 wrote to memory of 4568	4408	firefox.exe	95
PID 4408 wrote to memory of 4568	4408	firefox.exe	95
PID 4408 wrote to memory of 1028	4408	firefox.exe	96
PID 4408 wrote to memory of 1028	4408	firefox.exe	96
PID 4408 wrote to memory of 1028	4408	firefox.exe	96
PID 4408 wrote to memory of 1028	4408	firefox.exe	96
PID 4408 wrote to memory of 5020	4408	firefox.exe	97
PID 4408 wrote to memory of 5020	4408	firefox.exe	97
PID 4408 wrote to memory of 5020	4408	firefox.exe	97
PID 4408 wrote to memory of 5020	4408	firefox.exe	97
PID 4408 wrote to memory of 4000	4408	firefox.exe	98
PID 4408 wrote to memory of 4000	4408	firefox.exe	98
PID 4408 wrote to memory of 4000	4408	firefox.exe	98
PID 4408 wrote to memory of 3496	4408	firefox.exe	99
PID 4408 wrote to memory of 3496	4408	firefox.exe	99
PID 4408 wrote to memory of 3496	4408	firefox.exe	99
PID 4408 wrote to memory of 3496	4408	firefox.exe	99
PID 4408 wrote to memory of 2788	4408	firefox.exe	100
PID 4408 wrote to memory of 2788	4408	firefox.exe	100
PID 4408 wrote to memory of 2788	4408	firefox.exe	100
PID 4408 wrote to memory of 2788	4408	firefox.exe	100
PID 4408 wrote to memory of 5524	4408	firefox.exe	101
PID 4408 wrote to memory of 5524	4408	firefox.exe	101
PID 4408 wrote to memory of 5524	4408	firefox.exe	101
PID 4408 wrote to memory of 5524	4408	firefox.exe	101
PID 4408 wrote to memory of 5572	4408	firefox.exe	102
PID 4408 wrote to memory of 5572	4408	firefox.exe	102
PID 4408 wrote to memory of 5572	4408	firefox.exe	102
PID 4408 wrote to memory of 5572	4408	firefox.exe	102
PID 4408 wrote to memory of 5608	4408	firefox.exe	103
PID 4408 wrote to memory of 5608	4408	firefox.exe	103
PID 4408 wrote to memory of 5608	4408	firefox.exe	103
PID 4408 wrote to memory of 5608	4408	firefox.exe	103
PID 4408 wrote to memory of 4368	4408	firefox.exe	104
PID 4408 wrote to memory of 4368	4408	firefox.exe	104
PID 4408 wrote to memory of 4368	4408	firefox.exe	104
PID 4408 wrote to memory of 4368	4408	firefox.exe	104
PID 4408 wrote to memory of 5424	4408	firefox.exe	105
PID 4408 wrote to memory of 5424	4408	firefox.exe	105
PID 4408 wrote to memory of 5424	4408	firefox.exe	105
PID 4408 wrote to memory of 5424	4408	firefox.exe	105
PID 4408 wrote to memory of 4888	4408	firefox.exe	106
PID 4408 wrote to memory of 4888	4408	firefox.exe	106
PID 4408 wrote to memory of 4888	4408	firefox.exe	106
PID 4408 wrote to memory of 4888	4408	firefox.exe	106
PID 4408 wrote to memory of 4844	4408	firefox.exe	107
PID 4408 wrote to memory of 4844	4408	firefox.exe	107
PID 4408 wrote to memory of 4844	4408	firefox.exe	107
PID 4408 wrote to memory of 4844	4408	firefox.exe	107
PID 4408 wrote to memory of 1212	4408	firefox.exe	113
PID 4408 wrote to memory of 1212	4408	firefox.exe	113
PID 4408 wrote to memory of 1212	4408	firefox.exe	113
PID 4408 wrote to memory of 1212	4408	firefox.exe	113
PID 4408 wrote to memory of 3360	4408	firefox.exe	114
PID 4408 wrote to memory of 3360	4408	firefox.exe	114
PID 4408 wrote to memory of 3360	4408	firefox.exe	114
PID 4408 wrote to memory of 3360	4408	firefox.exe	114
PID 4408 wrote to memory of 340	4408	firefox.exe	115
PID 4408 wrote to memory of 340	4408	firefox.exe	115
PID 4408 wrote to memory of 340	4408	firefox.exe	115
PID 4408 wrote to memory of 340	4408	firefox.exe	115

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\VelocityLite.exe
"C:\Users\Admin\AppData\Local\Temp\VelocityLite.exe"
1⤵
PID:3860

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3576
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4408
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2012 -prefsLen 27100 -prefMapHandle 2016 -prefMapSize 270279 -ipcHandle 2088 -initialChannelId {547d33d7-ce72-4bdb-bbb0-fefb03dec00d} -parentPid 4408 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4408" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:4568
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2456 -prefsLen 27136 -prefMapHandle 2460 -prefMapSize 270279 -ipcHandle 2352 -initialChannelId {0b3d0fde-6b2d-415e-b9f4-febb6c2dfba3} -parentPid 4408 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4408" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:1028
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3916 -prefsLen 27277 -prefMapHandle 3920 -prefMapSize 270279 -jsInitHandle 3924 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3932 -initialChannelId {9a17a9cf-2a3b-4fc3-b182-90d52f193e0e} -parentPid 4408 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4408" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:5020
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4080 -prefsLen 27277 -prefMapHandle 4084 -prefMapSize 270279 -ipcHandle 4104 -initialChannelId {b6bf37d1-9848-47c4-b240-ae0d53b3ebce} -parentPid 4408 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4408" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:4000
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4396 -prefsLen 34776 -prefMapHandle 4400 -prefMapSize 270279 -jsInitHandle 4404 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4412 -initialChannelId {9a0c0960-aa37-4cb9-9cb6-0e401441b4f1} -parentPid 4408 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4408" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:3496
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4920 -prefsLen 34932 -prefMapHandle 4924 -prefMapSize 270279 -ipcHandle 4936 -initialChannelId {8dfdd03d-f0dd-47e1-92aa-5839c1e13553} -parentPid 4408 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4408" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:2788
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5312 -prefsLen 32952 -prefMapHandle 5316 -prefMapSize 270279 -jsInitHandle 5320 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5192 -initialChannelId {14aa75c7-0c79-4514-a749-9cb90d02223e} -parentPid 4408 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4408" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:5524
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5336 -prefsLen 32952 -prefMapHandle 5340 -prefMapSize 270279 -jsInitHandle 5344 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5352 -initialChannelId {6e543338-6e5e-4c61-96fb-6dd8ba653cfa} -parentPid 4408 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4408" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:5572
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5724 -prefsLen 32952 -prefMapHandle 5720 -prefMapSize 270279 -jsInitHandle 5716 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5744 -initialChannelId {c0300e05-0be2-47b1-b051-951b361ff408} -parentPid 4408 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4408" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:5608
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4404 -prefsLen 33071 -prefMapHandle 4400 -prefMapSize 270279 -jsInitHandle 6384 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6568 -initialChannelId {70ba1afb-e7dc-4aab-b770-f0da95a4f859} -parentPid 4408 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4408" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:4368
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 6424 -prefsLen 35201 -prefMapHandle 6428 -prefMapSize 270279 -ipcHandle 6440 -initialChannelId {5eab4765-3f5f-4247-b372-3a3eca13bde5} -parentPid 4408 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4408" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 utility
    3⤵
    - Checks processor information in registry
    PID:5424
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7016 -prefsLen 36758 -prefMapHandle 3376 -prefMapSize 270279 -jsInitHandle 7028 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7080 -initialChannelId {bba338d3-df5e-4632-a406-71e298f52125} -parentPid 4408 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4408" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
    3⤵
    - Checks processor information in registry
    PID:4888
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4768 -prefsLen 36758 -prefMapHandle 4772 -prefMapSize 270279 -jsInitHandle 7188 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1548 -initialChannelId {793f398a-1143-45ad-b83e-baedc4ec39e3} -parentPid 4408 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4408" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
    3⤵
    - Checks processor information in registry
    PID:4844
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4764 -prefsLen 36758 -prefMapHandle 3900 -prefMapSize 270279 -jsInitHandle 7476 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7508 -initialChannelId {890617ba-311f-4fcb-a156-e134c93b8567} -parentPid 4408 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4408" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab
    3⤵
    - Checks processor information in registry
    PID:1212
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7860 -prefsLen 36758 -prefMapHandle 7864 -prefMapSize 270279 -jsInitHandle 7868 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7876 -initialChannelId {a8992bfe-83a5-497b-b311-709e902e22ae} -parentPid 4408 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4408" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 tab
    3⤵
    - Checks processor information in registry
    PID:3360
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5560 -prefsLen 36758 -prefMapHandle 5496 -prefMapSize 270279 -jsInitHandle 7844 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7300 -initialChannelId {2d39ed8e-7734-44d5-a220-86a810daedcc} -parentPid 4408 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4408" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 16 tab
    3⤵
    - Checks processor information in registry
    PID:340
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5584 -prefsLen 36758 -prefMapHandle 6976 -prefMapSize 270279 -jsInitHandle 7812 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5572 -initialChannelId {0b3bcb40-ae01-4024-a264-491c0835f630} -parentPid 4408 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4408" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 17 tab
    3⤵
    - Checks processor information in registry
    PID:5660
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4372 -prefsLen 36854 -prefMapHandle 8240 -prefMapSize 270279 -jsInitHandle 8048 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7440 -initialChannelId {51467881-4d05-4bb4-ba7b-73c938ebb09a} -parentPid 4408 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4408" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 18 tab
    3⤵
    - Checks processor information in registry
    PID:5376
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8500 -prefsLen 36854 -prefMapHandle 6296 -prefMapSize 270279 -jsInitHandle 8052 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7108 -initialChannelId {96f013a5-4615-4c70-ac32-265ea8b75fe2} -parentPid 4408 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4408" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 19 tab
    3⤵
    - Checks processor information in registry
    PID:3548

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5248

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4448
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\Downloads\Velocity.7z"
  2⤵
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies Internet Explorer settings
  PID:892
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4752
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=C6BB0E4D6D021E203AC07A3A399CA78C --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=C6BB0E4D6D021E203AC07A3A399CA78C --renderer-client-id=2 --mojo-platform-channel-handle=1756 --allow-no-sandbox-job /prefetch:1
      4⤵
      System Location Discovery: System Language Discovery
      PID:2232
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=354C39F73388963FF8B9407BBBE6B697 --mojo-platform-channel-handle=1764 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:1056
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=68F604636D5FAE365841194EE3F98E03 --mojo-platform-channel-handle=2308 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:656
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=503041AB4ED05B6079BCAEC2C26BD81D --mojo-platform-channel-handle=2432 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:5376
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=FC8BA245381DE61347F123733ECE6028 --mojo-platform-channel-handle=2364 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:1244

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3348

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x228,0x22c,0x230,0x204,0x234,0x7ff95590c728,0x7ff95590c734,0x7ff95590c740
  2⤵
  PID:6104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1688,i,1515365829305003482,14819922278505750606,524288 --field-trial-handle=2184,i,3294949726757361563,15498483108394428346,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1772,i,663153793267664741,4013320245365338738,262144 --field-trial-handle=2184,i,3294949726757361563,15498483108394428346,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2044 /prefetch:2
  2⤵
  PID:3780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2436,i,17048836789543527022,415350646738690935,524288 --field-trial-handle=2184,i,3294949726757361563,15498483108394428346,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2612 /prefetch:8
  2⤵
  PID:4704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3216,i,10719661633132069137,17729927612220076587,2097152 --field-trial-handle=2184,i,3294949726757361563,15498483108394428346,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:5992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3220,i,3683851802409169719,4935395617161933438,2097152 --field-trial-handle=2184,i,3294949726757361563,15498483108394428346,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:2128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4472,i,15357477952365336371,16362652021830258445,2097152 --field-trial-handle=2184,i,3294949726757361563,15498483108394428346,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4480 /prefetch:2
  2⤵
  PID:5548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4740,i,9782944119908250386,12146298135553876251,2097152 --field-trial-handle=2184,i,3294949726757361563,15498483108394428346,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4752 /prefetch:1
  2⤵
  PID:5964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5436,i,13145137754998976689,2087578292854771071,524288 --field-trial-handle=2184,i,3294949726757361563,15498483108394428346,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5476 /prefetch:8
  2⤵
  PID:5868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5900,i,16045147005166992476,13552414649225206301,2097152 --field-trial-handle=2184,i,3294949726757361563,15498483108394428346,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:3320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3616,i,507387101704771047,13070847654384882064,2097152 --field-trial-handle=2184,i,3294949726757361563,15498483108394428346,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3592 /prefetch:1
  2⤵
  PID:5328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3596,i,9453218635677650869,8813300554721920616,2097152 --field-trial-handle=2184,i,3294949726757361563,15498483108394428346,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3568 /prefetch:1
  2⤵
  PID:5228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6080,i,13533304951721296183,15103783996520535746,524288 --field-trial-handle=2184,i,3294949726757361563,15498483108394428346,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3588 /prefetch:8
  2⤵
  PID:5828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6084,i,4288623128285203450,3921723471764747550,524288 --field-trial-handle=2184,i,3294949726757361563,15498483108394428346,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6092 /prefetch:8
  2⤵
  PID:4736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5528,i,12705389426796641303,1050316648781143386,524288 --field-trial-handle=2184,i,3294949726757361563,15498483108394428346,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5820 /prefetch:8
  2⤵
  PID:2620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=4492,i,223878329285664352,8432509999278696602,2097152 --field-trial-handle=2184,i,3294949726757361563,15498483108394428346,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4580 /prefetch:1
  2⤵
  PID:5500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=4524,i,17202821626738155889,10801519621271400228,2097152 --field-trial-handle=2184,i,3294949726757361563,15498483108394428346,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:1212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5808,i,1018140000341730944,9745522965475846076,2097152 --field-trial-handle=2184,i,3294949726757361563,15498483108394428346,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3676 /prefetch:1
  2⤵
  PID:5832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=3540,i,7805370947456217508,17098280384814156436,2097152 --field-trial-handle=2184,i,3294949726757361563,15498483108394428346,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6008 /prefetch:1
  2⤵
  PID:5344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6252,i,13816226957811694764,6452574309622659325,2097152 --field-trial-handle=2184,i,3294949726757361563,15498483108394428346,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6260 /prefetch:1
  2⤵
  PID:1440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=4784,i,7713466805106434551,7927120361666360400,2097152 --field-trial-handle=2184,i,3294949726757361563,15498483108394428346,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:2892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=4764,i,134108193980215289,9234143699694451563,2097152 --field-trial-handle=2184,i,3294949726757361563,15498483108394428346,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3940 /prefetch:1
  2⤵
  PID:4380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=4760,i,13593017649152988357,13585668836501262626,2097152 --field-trial-handle=2184,i,3294949726757361563,15498483108394428346,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4756 /prefetch:1
  2⤵
  PID:5624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=3260,i,15679151726559768146,7962977036910402120,2097152 --field-trial-handle=2184,i,3294949726757361563,15498483108394428346,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4900 /prefetch:1
  2⤵
  PID:6036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=5756,i,10743495302589607284,9483795973175268034,2097152 --field-trial-handle=2184,i,3294949726757361563,15498483108394428346,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5956 /prefetch:1
  2⤵
  PID:5396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=3596,i,17971076026971784957,2446000332982532237,2097152 --field-trial-handle=2184,i,3294949726757361563,15498483108394428346,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6592 /prefetch:1
  2⤵
  PID:5836

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4268

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:6140

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:5784

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Desktop\Velocity.7z"
1⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:3816
- C:\Users\Admin\AppData\Local\Temp\7zO8EE9102F\VelocityLite.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO8EE9102F\VelocityLite.exe"
  2⤵
  - Executes dropped EXE
  PID:2416

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\Velocity\" -ad -an -ai#7zMap30729:72:7zEvent23223
1⤵
- Suspicious use of FindShellTrayWindow
PID:1040

C:\Users\Admin\Desktop\Velocity\VelocityLite.exe
"C:\Users\Admin\Desktop\Velocity\VelocityLite.exe"
1⤵
- Executes dropped EXE
PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.NETCore.App&framework_version=10.0.0&arch=x64&rid=win-x64&os=win10&gui=true
  2⤵
  PID:6136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.NETCore.App&framework_version=10.0.0&arch=x64&rid=win-x64&os=win10&gui=true
    3⤵
    - Drops file in Windows directory
    - Checks SCSI registry key(s)
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    PID:6040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x25c,0x260,0x264,0x258,0x284,0x7ff947fcc188,0x7ff947fcc194,0x7ff947fcc1a0
      4⤵
      PID:5508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,16470572361845765553,15645624855229548117,524288 --field-trial-handle=2308,i,8432250481227853404,12042160948448301474,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:3
      4⤵
      Downloads MZ/PE file
      System Time Discovery
      PID:4032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1752,i,8059208649894047844,4815305567165809099,262144 --field-trial-handle=2308,i,8432250481227853404,12042160948448301474,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:2
      4⤵
      PID:5676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2652,i,8886963240765936857,7638456086449990163,524288 --field-trial-handle=2308,i,8432250481227853404,12042160948448301474,262144 --variations-seed-version --mojo-platform-channel-handle=2632 /prefetch:8
      4⤵
      PID:5388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3488,i,14245088505533881989,852963440921842100,2097152 --field-trial-handle=2308,i,8432250481227853404,12042160948448301474,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
      4⤵
      PID:4548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3492,i,12270270718481624649,1913205235174142370,2097152 --field-trial-handle=2308,i,8432250481227853404,12042160948448301474,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
      4⤵
      PID:6132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4284,i,11439341993009971476,16653433158206665756,2097152 --field-trial-handle=2308,i,8432250481227853404,12042160948448301474,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:1
      4⤵
      PID:2600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4292,i,4977016176917329664,6355045860109792360,2097152 --field-trial-handle=2308,i,8432250481227853404,12042160948448301474,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:2
      4⤵
      PID:5084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5264,i,11555240639082105353,15096617204367508004,524288 --field-trial-handle=2308,i,8432250481227853404,12042160948448301474,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:8
      4⤵
      PID:2060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3608,i,11371663202399279173,9886509554246181014,524288 --field-trial-handle=2308,i,8432250481227853404,12042160948448301474,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:8
      4⤵
      PID:5644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5524,i,17019441463427863075,15939103849105390861,524288 --field-trial-handle=2308,i,8432250481227853404,12042160948448301474,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:8
      4⤵
      PID:6060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5572,i,394199257381185441,6865871707655923979,524288 --field-trial-handle=2308,i,8432250481227853404,12042160948448301474,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:8
      4⤵
      PID:380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6068,i,17399625012878630982,10838173927381278873,2097152 --field-trial-handle=2308,i,8432250481227853404,12042160948448301474,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:1
      4⤵
      PID:428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5340,i,10456111996455988711,16781561316815154189,524288 --field-trial-handle=2308,i,8432250481227853404,12042160948448301474,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:8
      4⤵
      PID:4308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5340,i,10456111996455988711,16781561316815154189,524288 --field-trial-handle=2308,i,8432250481227853404,12042160948448301474,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:8
      4⤵
      PID:3948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3620,i,16547920632101834265,10402641381859791295,524288 --field-trial-handle=2308,i,8432250481227853404,12042160948448301474,262144 --variations-seed-version --mojo-platform-channel-handle=3796 /prefetch:8
      4⤵
      PID:4696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6204,i,6824007619338574140,9648882639530822399,524288 --field-trial-handle=2308,i,8432250481227853404,12042160948448301474,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:8
      4⤵
      PID:3508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,6418833128849743712,3717010993942803425,524288 --field-trial-handle=2308,i,8432250481227853404,12042160948448301474,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:8
      4⤵
      PID:3404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6240,i,12963808784457391184,7866531915433063838,524288 --field-trial-handle=2308,i,8432250481227853404,12042160948448301474,262144 --variations-seed-version --mojo-platform-channel-handle=3760 /prefetch:8
      4⤵
      PID:1792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3616,i,9172802092091666545,547053924249239515,524288 --field-trial-handle=2308,i,8432250481227853404,12042160948448301474,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:8
      4⤵
      PID:3356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,12827516175636848991,1382507261211048652,524288 --field-trial-handle=2308,i,8432250481227853404,12042160948448301474,262144 --variations-seed-version --mojo-platform-channel-handle=3724 /prefetch:8
      4⤵
      PID:1184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6344,i,8473147092703181536,7239978552362068957,2097152 --field-trial-handle=2308,i,8432250481227853404,12042160948448301474,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:1
      4⤵
      PID:5072
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6500,i,18127391370238315474,6238856612897252495,524288 --field-trial-handle=2308,i,8432250481227853404,12042160948448301474,262144 --variations-seed-version --mojo-platform-channel-handle=6968 /prefetch:8
      4⤵
      PID:3064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6560,i,17240369623233710479,4672670923406504139,2097152 --field-trial-handle=2308,i,8432250481227853404,12042160948448301474,262144 --variations-seed-version --mojo-platform-channel-handle=6976 /prefetch:1
      4⤵
      PID:568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6880,i,8545118529947943867,14604216129638941840,524288 --field-trial-handle=2308,i,8432250481227853404,12042160948448301474,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:8
      4⤵
      PID:3824
  - - C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.10-win-x64.exe
      "C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.10-win-x64.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5380
    - - C:\Windows\TEMP\{118FA235-86EC-4321-B5F3-E5BC80A6BF47}\.ba\wixstdba.exe
        
        "C:\Windows\TEMP\{118FA235-86EC-4321-B5F3-E5BC80A6BF47}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{D7719721-E243-46BE-87B2-35A3995ACF17} {37B24B96-E647-4810-8A05-EC5647E5CDBD}
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5372
    - - C:\Windows\TEMP\{118FA235-86EC-4321-B5F3-E5BC80A6BF47}\.be\windowsdesktop-runtime-10.0.10-win-x64.exe
        
        "C:\Windows\TEMP\{118FA235-86EC-4321-B5F3-E5BC80A6BF47}\.be\windowsdesktop-runtime-10.0.10-win-x64.exe" -q -burn.elevated BurnPipe.{B65E5B2C-0835-4CD9-8231-618A0F267503} {FFE1AFAE-BFB7-4EBC-9662-79B2ADD33106} 5380
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,15103470348053453135,773703479239239192,524288 --field-trial-handle=2308,i,8432250481227853404,12042160948448301474,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:8
      4⤵
      PID:5948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3520,i,13872508543772272481,7838636364853481142,524288 --field-trial-handle=2308,i,8432250481227853404,12042160948448301474,262144 --variations-seed-version --mojo-platform-channel-handle=6636 /prefetch:8
      4⤵
      PID:116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3636,i,2385447462558138988,1725879631303197880,524288 --field-trial-handle=2308,i,8432250481227853404,12042160948448301474,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:8
      4⤵
      PID:2500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3788,i,11612022388352389907,18100284088814885468,524288 --field-trial-handle=2308,i,8432250481227853404,12042160948448301474,262144 --variations-seed-version --mojo-platform-channel-handle=6928 /prefetch:8
      4⤵
      PID:4136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5228,i,521977468021985535,6381395759655765016,524288 --field-trial-handle=2308,i,8432250481227853404,12042160948448301474,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:8
      4⤵
      PID:5484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=792,i,8282849238337725274,7457910304218597318,524288 --field-trial-handle=2308,i,8432250481227853404,12042160948448301474,262144 --variations-seed-version --mojo-platform-channel-handle=6644 /prefetch:8
      4⤵
      PID:1852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7076,i,1855161861589257770,15691096642966832520,524288 --field-trial-handle=2308,i,8432250481227853404,12042160948448301474,262144 --variations-seed-version --mojo-platform-channel-handle=788 /prefetch:8
      4⤵
      PID:5668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,6812290362674598606,6360604986160168738,524288 --field-trial-handle=2308,i,8432250481227853404,12042160948448301474,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:8
      4⤵
      PID:4580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=3400,i,11212917104373257131,17070784675009607819,2097152 --field-trial-handle=2308,i,8432250481227853404,12042160948448301474,262144 --variations-seed-version --mojo-platform-channel-handle=4692 /prefetch:1
      4⤵
      PID:3864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6620,i,17050678221865096112,4732702344552565805,262144 --field-trial-handle=2308,i,8432250481227853404,12042160948448301474,262144 --variations-seed-version --mojo-platform-channel-handle=7004 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4680,i,10744178815164076326,15916871097397867193,524288 --field-trial-handle=2308,i,8432250481227853404,12042160948448301474,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:8
      4⤵
      PID:4760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=7160,i,17970710394782688786,4066888132175684029,2097152 --field-trial-handle=2308,i,8432250481227853404,12042160948448301474,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:1
      4⤵
      PID:2368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=5724,i,15046404471527959732,4186176121175176240,2097152 --field-trial-handle=2308,i,8432250481227853404,12042160948448301474,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:1
      4⤵
      PID:4736
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=4700,i,4097911866286265724,4142349284347138945,2097152 --field-trial-handle=2308,i,8432250481227853404,12042160948448301474,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:1
      4⤵
      PID:5452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=7336,i,2319756790056766067,5078934047493880191,2097152 --field-trial-handle=2308,i,8432250481227853404,12042160948448301474,262144 --variations-seed-version --mojo-platform-channel-handle=7356 /prefetch:1
      4⤵
      PID:5424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=5440,i,6970012201880272834,1321329032470075934,2097152 --field-trial-handle=2308,i,8432250481227853404,12042160948448301474,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:1
      4⤵
      PID:5496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=7248,i,2048927671832992942,13097030825855807584,2097152 --field-trial-handle=2308,i,8432250481227853404,12042160948448301474,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
      4⤵
      PID:2676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=7572,i,5246496332449763341,13500589384111818470,2097152 --field-trial-handle=2308,i,8432250481227853404,12042160948448301474,262144 --variations-seed-version --mojo-platform-channel-handle=7208 /prefetch:1
      4⤵
      PID:3824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8032,i,16315665630328438127,12026243992419092158,524288 --field-trial-handle=2308,i,8432250481227853404,12042160948448301474,262144 --variations-seed-version --mojo-platform-channel-handle=7960 /prefetch:8
      4⤵
      PID:1764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=3808,i,16555957315549744069,2474413081914218316,2097152 --field-trial-handle=2308,i,8432250481227853404,12042160948448301474,262144 --variations-seed-version --mojo-platform-channel-handle=7524 /prefetch:1
      4⤵
      PID:2408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=7592,i,967889088148817986,10164183186020067091,2097152 --field-trial-handle=2308,i,8432250481227853404,12042160948448301474,262144 --variations-seed-version --mojo-platform-channel-handle=7568 /prefetch:1
      4⤵
      PID:4640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=3816,i,2736801846109054065,7155197007482096403,2097152 --field-trial-handle=2308,i,8432250481227853404,12042160948448301474,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:1
      4⤵
      PID:2932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=7192,i,17144819914715112149,13439784347424276056,2097152 --field-trial-handle=2308,i,8432250481227853404,12042160948448301474,262144 --variations-seed-version --mojo-platform-channel-handle=8028 /prefetch:1
      4⤵
      PID:1460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=7816,i,16559151212781423765,3619137858144992347,2097152 --field-trial-handle=2308,i,8432250481227853404,12042160948448301474,262144 --variations-seed-version --mojo-platform-channel-handle=7600 /prefetch:1
      4⤵
      PID:3820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=7244,i,7442162556821584985,956862083899488780,2097152 --field-trial-handle=2308,i,8432250481227853404,12042160948448301474,262144 --variations-seed-version --mojo-platform-channel-handle=8140 /prefetch:1
      4⤵
      PID:2956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --metrics-shmem-handle=4352,i,576575620081486794,1111650679543644051,2097152 --field-trial-handle=2308,i,8432250481227853404,12042160948448301474,262144 --variations-seed-version --mojo-platform-channel-handle=7668 /prefetch:1
      4⤵
      PID:3656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=8064,i,3646336119422582927,3496117634285070623,2097152 --field-trial-handle=2308,i,8432250481227853404,12042160948448301474,262144 --variations-seed-version --mojo-platform-channel-handle=6956 /prefetch:1
      4⤵
      PID:3840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7304,i,2428852715623574358,290080452411859798,524288 --field-trial-handle=2308,i,8432250481227853404,12042160948448301474,262144 --variations-seed-version --mojo-platform-channel-handle=7448 /prefetch:8
      4⤵
      PID:4592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8384,i,5627074122459558497,16134238058516972650,524288 --field-trial-handle=2308,i,8432250481227853404,12042160948448301474,262144 --variations-seed-version --mojo-platform-channel-handle=7192 /prefetch:8
      4⤵
      PID:5144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=7192,i,9408068073278853801,11037142796772088926,2097152 --field-trial-handle=2308,i,8432250481227853404,12042160948448301474,262144 --variations-seed-version --mojo-platform-channel-handle=7592 /prefetch:1
      4⤵
      PID:4092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8432,i,10611726776746724901,1158773177771209526,524288 --field-trial-handle=2308,i,8432250481227853404,12042160948448301474,262144 --variations-seed-version --mojo-platform-channel-handle=7616 /prefetch:8
      4⤵
      PID:3976
  - - C:\Users\Admin\Downloads\Fishstrap.exe
      "C:\Users\Admin\Downloads\Fishstrap.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      PID:1100
    - - C:\Users\Admin\AppData\Local\Fishstrap\Versions\version-145f189a6a974303\RobloxPlayerBeta.exe
        
        "C:\Users\Admin\AppData\Local\Fishstrap\Versions\version-145f189a6a974303\RobloxPlayerBeta.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        
        PID:8788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,10076230315500887751,16802048384552104560,524288 --field-trial-handle=2308,i,8432250481227853404,12042160948448301474,262144 --variations-seed-version --mojo-platform-channel-handle=8172 /prefetch:8
      4⤵
      PID:1212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7424,i,2420486743666938737,11663387832780024885,524288 --field-trial-handle=2308,i,8432250481227853404,12042160948448301474,262144 --variations-seed-version --mojo-platform-channel-handle=2780 /prefetch:8
      4⤵
      PID:4412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8592,i,16633960744629534570,14366718610475605407,524288 --field-trial-handle=2308,i,8432250481227853404,12042160948448301474,262144 --variations-seed-version --mojo-platform-channel-handle=8216 /prefetch:8
      4⤵
      PID:1840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7428,i,4554737920554657128,16624860742601373442,524288 --field-trial-handle=2308,i,8432250481227853404,12042160948448301474,262144 --variations-seed-version --mojo-platform-channel-handle=7836 /prefetch:8
      4⤵
      PID:752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7380,i,5267377875065034312,4526322253524507504,524288 --field-trial-handle=2308,i,8432250481227853404,12042160948448301474,262144 --variations-seed-version --mojo-platform-channel-handle=788 /prefetch:8
      4⤵
      PID:9360

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5980

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1032
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 0F47D835F11988399ECF0D7D61D3F548
  2⤵
  - Loads dropped DLL
  PID:2632
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 4A492F1D58B62FAEF4CC46BCFDF83AA8
  2⤵
  - Loads dropped DLL
  PID:1288
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 744EB8E27EBF107B3D3768CC7217B5C5
  2⤵
  - Loads dropped DLL
  PID:5600
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding F435498B1BF01FB77DDE44DCC6099B2B
  2⤵
  - Loads dropped DLL
  PID:2012
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding A67E66EE75ADB384C5E79677BE645E69
  2⤵
  - Loads dropped DLL
  PID:1108
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 5D5E034BED63C95269475139DE58776F
  2⤵
  - Loads dropped DLL
  PID:3324

C:\ProgramData\Package Cache\{866BECDA-F284-473A-9E84-0CCE816BF06F}\windowsdesktop-runtime-10.0.10-win-x64.exe
"C:\ProgramData\Package Cache\{866BECDA-F284-473A-9E84-0CCE816BF06F}\windowsdesktop-runtime-10.0.10-win-x64.exe" /burn.runonce
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1396
- C:\ProgramData\Package Cache\{866BECDA-F284-473A-9E84-0CCE816BF06F}\windowsdesktop-runtime-10.0.10-win-x64.exe
  "C:\ProgramData\Package Cache\{866BECDA-F284-473A-9E84-0CCE816BF06F}\windowsdesktop-runtime-10.0.10-win-x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.10_(x64)_20260730050803.log"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5396
- - C:\Windows\TEMP\{9F534C09-0422-44A1-88C0-F648AD19CCE6}\.ba\wixstdba.exe
    "C:\Windows\TEMP\{9F534C09-0422-44A1-88C0-F648AD19CCE6}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{00704AA6-8DBF-4412-930A-F76260931BC0} {E8064A4B-3B99-496C-B840-48775712BA04}
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4100
- - C:\ProgramData\Package Cache\{866BECDA-F284-473A-9E84-0CCE816BF06F}\windowsdesktop-runtime-10.0.10-win-x64.exe
    "C:\ProgramData\Package Cache\{866BECDA-F284-473A-9E84-0CCE816BF06F}\windowsdesktop-runtime-10.0.10-win-x64.exe" -q -burn.elevated BurnPipe.{E5A849CA-A8EC-493A-9A92-0E7A5498A990} {5F4EC220-6301-4261-98EE-220FE567F3FB} 5396
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:5668

C:\Users\Admin\Desktop\Velocity\VelocityLite.exe
"C:\Users\Admin\Desktop\Velocity\VelocityLite.exe"
1⤵
- Downloads MZ/PE file
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:4176
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass -Force; Import-Module ConfigDefender; $status = Get-MpComputerStatus; $prefs = Get-MpPreference; [PSCustomObject]@{ AMServiceEnabled = $status.AMServiceEnabled; AntispywareEnabled = $status.AntispywareEnabled; RealTimeProtectionEnabled = $status.RealTimeProtectionEnabled; NISEnabled = $status.NISEnabled; ExclusionPath = $prefs.ExclusionPath } | ConvertTo-Json -Depth 3"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4908
- C:\Users\Admin\Desktop\Velocity\Bin\Decompiler.exe
  "Bin\Decompiler.exe"
  2⤵
  - Executes dropped EXE
  PID:3948
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=VelocityLite.exe --webview-exe-version=1.0.0 --user-data-dir="C:\Users\Admin\Desktop\Velocity\VelocityLite.exe.WebView2\EBWebView" --noerrdialogs --mojo-named-platform-channel-pipe=4176.9596.5372753993703544016
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  PID:9608
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\Desktop\Velocity\VelocityLite.exe.WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\Desktop\Velocity\VelocityLite.exe.WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x19c,0x1a0,0x1a4,0x178,0x1ac,0x7ff939ccb078,0x7ff939ccb084,0x7ff939ccb090
    3⤵
    PID:9628
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\Desktop\Velocity\VelocityLite.exe.WebView2\EBWebView" --webview-exe-name=VelocityLite.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1788,i,15613187865526707187,558728583922124071,262144 --variations-seed-version --mojo-platform-channel-handle=1784 /prefetch:2
    3⤵
    PID:9872
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\Desktop\Velocity\VelocityLite.exe.WebView2\EBWebView" --webview-exe-name=VelocityLite.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --always-read-main-dll --field-trial-handle=2076,i,15613187865526707187,558728583922124071,262144 --variations-seed-version --mojo-platform-channel-handle=2088 /prefetch:3
    3⤵
    PID:9916
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\Desktop\Velocity\VelocityLite.exe.WebView2\EBWebView" --webview-exe-name=VelocityLite.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --always-read-main-dll --field-trial-handle=2132,i,15613187865526707187,558728583922124071,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:8
    3⤵
    PID:9964
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\Desktop\Velocity\VelocityLite.exe.WebView2\EBWebView" --webview-exe-name=VelocityLite.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3540,i,15613187865526707187,558728583922124071,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
    3⤵
    PID:7636

C:\Users\Admin\AppData\Local\Fishstrap\Fishstrap.exe
"C:\Users\Admin\AppData\Local\Fishstrap\Fishstrap.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:9040
- C:\Users\Admin\AppData\Local\Fishstrap\Versions\version-145f189a6a974303\RobloxPlayerBeta.exe
  "C:\Users\Admin\AppData\Local\Fishstrap\Versions\version-145f189a6a974303\RobloxPlayerBeta.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:9248

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Phishing

T1566

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e6043d6.rbs

Path C:\Config.Msi\e6043d6.rbs
Size 11KB
SHA256 8dd1025759372dab13b4145ac9b57eb213b96eb6924e77f223ccdd10292db2e6
MD5 1990d3942765e6121fcc348b93e2059a
SHA1 b8fd38801b2b1812cfd6f8bc71a0ea6c83849ee9
SHA512 817b998cd1460feaa01c0e20973b265113cdd99128ac7ac5a4fcfbfc78cddcd06167118f938d373407be1bb57f2d06683a34094d29d2ff471c693d54943ae0f6
SSDEEP 192:BrKHCR6CbKt15HPAl/eJxjRI1jRl1E+o5Ca35pbM:BrKHCR6CWt15HIkjoj9aM
TLSH
T1583241426614D2D7E9DB2738D71727703B72D3AA8314665F05CCC22C4F8B7C94E64EAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e6043dd.rbs

Path C:\Config.Msi\e6043dd.rbs
Size 9KB
SHA256 cc972fa101e7e6d29b2ad8b5927310fc8998eab84159f6c507e8d766080e3945
MD5 05b49ab12298854909759fd8fc8bb987
SHA1 682288dcc47994a7817c0b4ef2d765cfb64d3012
SHA512 301011f907feb7234b56306b1979c0bbc414adcd73f420f1cb473c75743104289b3e459ab1f0ab704e3853e35f1ef6d8bd428f77ef15c3598e00b53e0cd83c63
SSDEEP 96:lmSDTTClrWS/eCiFeUGeD2AyCsTlyyUGeD2AyC6jMlN8gnuTlyfnAP7E5d7P/53k:oCnSFe7x3RII3RP017EbnKCCi5pu3
TLSH
T177121F12750081A2E9961B39C7133B223BBAD3D9A315265F48CCF9F41E03BD52FA91DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e6043e2.rbs

Path C:\Config.Msi\e6043e2.rbs
Size 49KB
SHA256 f10f3134f2d3f1ee44a8f5eef4694ebcdbb4c13cc943910d7d4b5d1a45c7f35c
MD5 23ab875faf7d2fbf1d82eba831149be9
SHA1 d2618b8ae567cbbb94df251507dc9156f9b61d8f
SHA512 9b8bad89f11ea623a52386307ad50e43e826282e148a34d16456930fabd0f43f5cbb9dd02ba9f99df3863600a45e40dab941aaf806baaf4fe4339ddb6248b2fa
SSDEEP 1536:9HZgOohW4wN5RaHB/LyM/ajqmuUHr92ha8u3tn2N8zRM9Wc/hihbZGXEpp4IQPDT:MNgeE+jD
TLSH
T1F5335461DB08C0F2F9333DA26770F8847719C99AE34095AD16D60144CEA6EEEDEBD1E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e6043e7.rbs

Path C:\Config.Msi\e6043e7.rbs
Size 71KB
SHA256 91d83fdebec6ecc22a4d662e31e2c3b3d0105fc01fd16786983dab2f281336b5
MD5 838cf41bf8518a3e9d93023a067e05ab
SHA1 0a3ca49971e4de1f33d4b2b01b3ca27ffa9e0b13
SHA512 346cd9d36ff0b1d2eb11002b9256b6d11a0f4ed3ee0b7b25633e09238c4163f740f3ead070270e57404d0376db60c6a1f6b779c76c9ec1722c26f217be491493
SSDEEP 1536:elTX+EvElgJPlhUR+6svby5ybcmb/WrPMmq0mgG2WdDfbH9cMWmHDCaJVZ/KoLH6:+u2z+LmEEiycECCoeWJ
TLSH
T18E6335BA7A14D1C1BC732DD457BBE916AD054C7393608D2E63CC4029CDD2A86EFB86E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e6043eb.rbs

Path C:\Config.Msi\e6043eb.rbs
Size 3KB
SHA256 c69a9983f48a16a462864cd7a0338dafa88efd72f4ddf50ff616763100ad3946
MD5 a4d7debd41f927383b99866cfd6f4e3f
SHA1 f70a0c0c3b003772cd0ccec41fc89361be419494
SHA512 6ea36f426dbad4d91c091d217a2518978c1a0172c038b84fe74af3009b97b4d736963c2c4a8fbda54f0a87f3b33d06e2e4e3768c88a237080b9884c9dddf51c1
TLSH
T13D717943D604C6D3EDA22B31DD271B50377BD6DAD315438B04CC91701E57BC69EEA28A
MD5 SHA1 SHA512 TLSH

Submit Download

e6043ee.rbs

Path C:\Config.Msi\e6043ee.rbs
Size 3KB
SHA256 3088d5dff21cfdd589356ca43145cd94ef6d77085e5d775fa35d0e80e8b83381
MD5 35fc07dd59e3285ebdf24912ec39549a
SHA1 0110993b2e36cffb026ef0ebd332747223f11696
SHA512 d338e7f4f6e295a6c47790d9b753e7bacfbe9f34f184b000a2fa2b2b57204f6ccae096a9983721e457caeceb5f96c4cfa48fb0476cc51cb8d94fc28c2ce11d97
TLSH
T13881AD43AA04E6D3ECE31B30CD5B17233777C6E69361474B45CC81741E87B89AEE9689
MD5 SHA1 SHA512 TLSH

Submit Download

ThirdPartyNotices.txt

Path C:\Program Files\dotnet\ThirdPartyNotices.txt
Size 77KB
SHA256 deb4427a295e1ed474b0d81c5a0d972c1b550b9a715cda939cdfa9236b1b418f
MD5 0d8867a25ba926e6e40cd52ab3536b5c
SHA1 89390dc8b8318d0bfef1c6a2fb4783537e28a465
SHA512 317ca335405274f4f91b173651ca2826760acb5ba5cf41aff51adc55c2cda9059fb268333665f13f62fa48119e55a303720a780dd58d28dd9967db4c88407d61
SSDEEP 1536:HA9jHwsGfgg39/zwgAVkguQxrDjugtSEGepkWvrpX7anuqdLSVnfiStPq+3LefrL:HA97w/ogz1AVxuMjHtSFULryLOgrGWm+
TLSH
T17773A45F7E45077319E2C3916569A8C5F22FA02E3B6B2A44346EF248133B42DD6FF858
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 163KB
SHA256 4377f10c78400f0370b88156773de9843c07f14e65b3232005ec3179ef38d463
MD5 363603c51aa522bf21b2e8320a51c54e
SHA1 b4dba9e0d47c9fd4636549d5a23fe1a96faf9b1f
SHA512 b2b045ad8538416bd81753359ca86ba956f2ac99befeb89c7c03993741411703e03f4373d11cb94992cb93ed569d6741954111f4ad519daebcb18138800877ce
SSDEEP 3072:oGgPYwruvTSBbQ/fp4SbDqIG/vk7l55wK9vLPg:oG4rubgbQpDvqIbt10
TLSH
T1A6F3F61AD65811AAD06E9575CB428941BB337C668BE0E3CB53C0F9BE0F726905EF9703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ClientAppSettings.json

Path C:\Users\Admin\AppData\Local\Fishstrap\Modifications\ClientSettings\ClientAppSettings.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 a7e6eb783774433b37cacca4fb41f1d08f7fd97e800b7fb92b0ed71b40a18206
MD5 92e00e10e444c3100ee9fa169e6b7da8
SHA1 b7a267997d9cdc5da9a00b48f90c00d1cc4bd5f4
SHA512 672e68c6e304a19152f8058130f6ad01132d23b05bc5bf59f097dc9d0b70e45c805006a6fdb6c813cd53cf7bb059d3f426194b6b35a169775e415f55a3f1ab71
TLSH
T1B9E02BA6C821ED2709FD1B1C50648641E640236B1B50895F373CC1088FB57364A92C1D
MD5 SHA1 SHA512 TLSH

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007
Size 38KB
SHA256 7165713d3e1a610399471a5e93d5677508f62ef072c1151e72273bf4bd54f916
MD5 9436affc97843765a966b3568fa7e5ec
SHA1 7bfda74bb30589c75d718fbc997f18c6d5cc4a0b
SHA512 473ec3a843c33e18d6d194651fe11353fcd03a7959225faeabf8c77484155ea6a7bccb72dbaf2093ed53c408faa3be9f6fc907f7a5ddf8223375f9d09b504456
SSDEEP 768:eUEh2+iKBVQbBhu8vjenqz2Ez6Y/AxHLEaP72sV9qKYbDblXqhP8qwFSE3uk:eUEEoBVQDjeQaLnP2pfZTqgSEB
TLSH
T11703F112148F7FA1C244F224A4EFE416ACC3F565ABA15E6980B8B7C7010E3C657A46FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000008

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000008
Size 84KB
SHA256 b02d81653438f2206e406fe74f198c4081b749f7ab9e5a2de8c1fcf349bf0f82
MD5 a06a101f4e9ae9bc3c7185f29d973177
SHA1 71ad19396030d4f261a2b79d182e107583b81016
SHA512 b022a01a0aadcaa3e9f8ede517d02121f852b5d20a3f0e07f76a01d73c412caff82f6ed33f8e8b459706741720002af2c8047988e7c4d96d360348d73cb8c1f4
SSDEEP 1536:X/Vo6Xtocjv/2uDQOwVIC+Qo+kgi1GbP5xunBQ+JPqiCEyDddmWOGPR7hjMHy5sK:X/Ntnj3BwVNfzq3lCEyYGPQHymvMNrY+
TLSH
T10A8302D04C3B7A5463A19924C5CF3A4CD4E1A65F9F97E8AD8C89B39B11F640E3C0E84C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000c

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000c
Size 61KB
SHA256 251777e3ba9021966c9c85c2c47f4ef0326f715db62cfe938bee1c0f500f78e7
MD5 57d246eb2bdf5c271436a2b0743c5b66
SHA1 4c2ef9ce6ba5179fb3ca94e180df0b7a1800f608
SHA512 bc506b37b024ce85de8038e8803ab53c4fc485dc02314bbd4b95369cb2896f706f11f53ebed35416ee825d192cf7a167a0e1bf6e16a0c7fa03554291916778c0
SSDEEP 1536:CJ6V3rScFzWtGL8DGJsvP1dDGpZ5KSPH+HOipeg/Z/ef3oYlyE:Cw3+cUM8bv+X5KSPeuiplS3oYlyE
TLSH
T1875302C1829C7AF14D91D31848B2F02562EAAA9C8E81347B9B7330710FD196D2BFF51C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000011

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000011
Size 21KB
SHA256 2a0b7c30f0977fb1625451633b6b398f1f2c69d01c655bba3918c961b66a0583
MD5 8a2c36b90c9c621271b5b157ed86e56b
SHA1 f542f96bdc7ea0f2acfd8cd9353ad01d722256a2
SHA512 10ab9e8180698c4f5570b516c20c7282c50755a33c9215c9bb97d58990004f614a95c06fcf5dd2fbb844e24a5d81332ebdffa5c89cd4b22ee46828d5deab1bd4
SSDEEP 384:3YCbDPjmywD3fwAJ2ZmSMqcHbjgog9rfaPkiTOi/dkewSpcE5uW:3sv0YUmSMnHgogxfadFkewc75uW
TLSH
T164A2E17711DD711BF84E9DE82DCE8ED5C8A9A0DE6C618C4047E014A8D0DEA760FFB4A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 600B
SHA256 f6173bb9b9e97f7a41face4b3056e1eb09f118bf977306273f4adcfb2137c072
MD5 22dca9d71b1ac421ea709dd7c0818d40
SHA1 b0b58e9327f91abc84136a3f1cd22a0be6190631
SHA512 8bae5e1faf36f8f10dfcd7febb2e690b7656b01f560c899e090c6d6a015bdc19fb64c44e2fdf2e548ace6b8a4f0d706b945c5717f27e36ab87f7533fb60842ff
TLSH
T155F0550D1148CACEDBB10A3118AC0C50D85109EBA0724D0F5680606CBA176F7A080CBF
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 fb432f8f300c981e304a7d882b4d8e1d34f1dfb8b99da6833d5348a04de30c8b
MD5 f40432ef2cb0aacf426fb792ee491b53
SHA1 7fb7407bdf0ec29989c14cbf014623948ad365f9
SHA512 a6ea3f57100b083a61f4d2c1c374ac5483990224aeb57d108ed71f0b72c31490213709ef658834b38f11b99c2f05a04e48283aa55f5f6ec722f89046e57b54d6
TLSH
T15B2195051D8889CADBB00A72D8AC3F64C4120AFB98610E4BC3B4A45C7D3AEFB5190C7F
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 91158cf9c8ae218ee1a70444c6ca142872d0dec0c7876f9eff05648f9aefb03c
MD5 a86f027ac2f05391c4cc34285037d1bd
SHA1 a878a1ddea79d7dcbe750ae818b7f02318a9b4c6
SHA512 d47cc58d5abffbf566a0d0dde235a9d315fd9b3d881e2a06ac879f1df63beed012b058c87e121674069ac94891b05a0f53f34731957160ea4cab23babde281cd
SSDEEP 3:MsEllllkEthXllkl2zE/l2nt:/M/xT02zLnt
TLSH
T1234402046B810546C50113304591C3506370ECB01A52574328910626AC856401D00040
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 6fc12826c9209116c4e13c1e0ca5f950eed156be80d9ba6dc189c9a34201432d
MD5 4f8dda7410a28b3cfca312a49f9ffd97
SHA1 216f24e08af87673f0706abbf67e36eea027380d
SHA512 64a699a5b889da8cabd8aec64abb99b0533daff23086c2db1b82bb38ab2bb8be4356cc244c5586bb450dd62b38881d366980d362260531656e2a2357e72d8410
SSDEEP 192:DVS0JsU7JbJcODgZUu2aILGK5uymP6rIew8NPYaP+vVPLfP2iDrW1PXE:DVS0JsU7JbJcODgZUu2aILGK5uymP6r6
TLSH
T1EC12ADF7C3D8966DC89116F89B257F1FCE1A0A18432D3C66C8D8AE5B93E2471D21624E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 184f45f4d9e9cc77f2c6c731ccf8aa13c2595353036a82b42cdefa54853cdce5
MD5 161a141009b164aa0162a5626704dd3a
SHA1 e6993b9a226a576641460e589da5c3275f7dfb5c
SHA512 455d8a54c69c91c094360e69bd45415a6529229ae06837cd05dd62c697db3d12109d478a5c20436dfab565c27b57c84c570b11bd82d84c46bca6a216993b01f2
SSDEEP 192:DVS0JsU7JbJcODgZUu2aILGWuymP6rIew8NPYaP+vVPLfP2iDrW1PXkQW:DVS0JsU7JbJcODgZUu2aILGWuymP6rIN
TLSH
T19512AEF7C3D8966DC89116F49B257F1FCE1E0A18032C3C66C8D8AE5B93E2471E21624E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 691B
SHA256 e6bfa2a04e8739a62eb71c4f598ea0bc04781b7c4844c73312e19c21750900c1
MD5 79830ce100c35c626265d9944266d80b
SHA1 c6abec4023e17a03a30e3a6ce71b91ff52f0a135
SHA512 63253efa9b7fc02a969d89379f1aa84261a66f6fa4be2993551b928e2796beaf06f1e91694ae0ddc40982f9e1fb1e4b3c4653a6eb045ea6127572e502705d30b
TLSH
T13F019EE7D779742310BC49AF1E40BC0A2573A43045812CF4DA5AC12EF0D29F30B01853
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 cf60692243f993de27ed422b1d037e346c641d4fe16cca06e6fa97d3b00156e3
MD5 95eff075847b4a9c08dfdb9cb82050c4
SHA1 e3ebfa28e4a309a379c6390c051f1a7a2866f4a3
SHA512 6e0e8a3ac5a95e69712d0039b9db04e09265e9e27d6ae19c2b661d9bcb63c89c26158a0fda4a73a141027fda21f872204f7eaa5f02dd10d54586e75d236a3154
SSDEEP 192:TR9cBzgqHVbhB7v7bhAPRp26ry9/Hsb+WNndi4If2hFeEFfaRVyIsnAUgtaJ:TR9mzg6PDP8Xe1ww32Ba38
TLSH
T1AC52B82EBA14653B5CDAD226F922B763D7F5102261D42E80EBFCCA1C15EB5CD721702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 77aaaddfb64d20ce6db44819b4a907f58fa8a62ec231db9f175e8ef812c1a8fd
MD5 9081baf1382b8bea4db6bbcd8589f886
SHA1 f17f2580ba50c773d21fb663afe174545b245fb0
SHA512 da95e4ede9d16f155468ed72d9edc59b257ccc55e7a534ca42fa252c75ea33d07ff49d3b7e1e6f8dea671de1ffb4b58b6097bd187d5311c4387b8783ce305c5b
SSDEEP 192:8R9cBzgqHVbhB7v7bIAPRp265gM9/Hsb+WNHyrIB8Dz522kFeEFfaOVyIsnAUgrK:8R9mzg6PDPJXH1wdOU2YaGe
TLSH
T17152C72EBA14653B6CDAD226F912B767E7F5102261D42E40EBFCCA1C05DB5CD221702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 87ff76227b2ceee5b31f71326317f66976b4d9a3499878aee0990131a753b21e
MD5 64414a8c19ae17304ec43272fbffb8a8
SHA1 21f0bb80afafd9be1758b05fd374137192d2e12d
SHA512 56b30b11314601bfd5f840324c9fe2ff06281ca817ca6e6779e5c38fff6f7b1e7b7c443cda8241d462c762901c516d1bfde9f540eea402fe026c4839b4daa01a
SSDEEP 192:8R9cBzgqHVbhBtv7bINDPRpKm65+aM9/Hsb+WN2wVNxrIB8DJXlT522SFeEFfahC:8R9mzg6PNPQ7XKs1wn4O302Ca1e
TLSH
T16162B72FBA10557B5CEAC226F912B767E3F51022A1D06E84FBFC8A1C15DB6CD2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 4a8de811b93ad52e9d4022e9fa8a9091cc20b5ffab88a1e0f530f17ec1f4af83
MD5 469645fc081cfe6eb6c54d3ab7d6055c
SHA1 a833172ee1a4cfdf987c031a33c493f52999a2a9
SHA512 e6874d4c0de8dab37c06cfe06c0e7f6a0485f59eca431899ec8c9501c7f2f35d5061c79cd8a90a2176dfdb88432ceb4ee67ce09a6e5a875caf924a573ae28e55
SSDEEP 384:RrjNI7KxkXqKf/pUZNCgVLH2Hfgsl4Tv7pLuLcSj/6XODNI+ErU3BtvHG+lGGEVP:RHNI7KxkXqKf/pUZNCgVLH2HfgsmT7pL
TLSH
T13D7209677C4C9A3B0F94C6CCE8177B4FADB5025B26E9886543FA582503D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 7c67a8e0d8f5cee9086d981a8dafa99ec3597adcff25d714598ed3fc75399082
MD5 d35a930115d5194791fd70b6ca2d7d9b
SHA1 34befcf4e5f8fa21e76c598f1a1cb8c47ed442ae
SHA512 68ba4d17953e22c83d7f083349ac13702fb44f7cbee9bf1e9c801a9a6891c7e4b89d66762e27d449327170ed1ea5d88c896fdba212023a2687d9088a8b12995d
TLSH
T126B012008041D151C54202F02182189C71546F10D60A2701C3E06D3AC826171CB14190
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5e3055.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5e3055.TMP
Size 96B
SHA256 a2e9da54a48620210e1f545f326c598bd16f4bdaf7cb1a6d4a222cee3f8cf08a
MD5 ac22581ce1cc34396b5988c9f4fafaeb
SHA1 406030281e47e07fa0285d3a3ef3818ff41a3962
SHA512 a391905bba6a349d8a0f8b98273a6de7ac242d784de556051cb2d537cfc144ad29039c8ae72c271257cbfd8f7f330ff37a68259bc3c0dd4f1100deeb76648e25
TLSH
T19EB00265C1126252C08243F42599A6D8B160DF69C6036322E3E15ABAEE257B54529560
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 ce6683570f5d96a11fd97ec7e64527087f11526ff4aa4cd5cbba4a6be71017fb
MD5 5f57b8cde0d7be4173510f5eac948c4e
SHA1 f9ce586cf7527b7b52754a52c19c3a3106b97e93
SHA512 d8d45f29da47cf7419910fb880cda2a0d5376a2bfa37dc3412302d33ee0aae61f5165e9f25c4d6d8f25d59cb1c4e1932e8f15cd99268ef34bf3cfe600f1d42b1
TLSH
T15CB022C88CA80882CF0C03F30BEAE2C2F3200E020B82802300B0803CC2322038333A82
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 150B
SHA256 b6ec8d2644be70f5d3697bf734f14982806275c4a58a43f8926a96cb83bf9634
MD5 75ecaee40f6a7d38223c3621ffd9c52c
SHA1 49ad1e84a606286de2b6e2ace3a642c5e128d147
SHA512 379287060d4791785d399b875feec89bbfc47e53a97159af74282c274f6271e323ea0692c27a05a10b4cf93abb333173175887390916baca86652a89689b0caf
TLSH
T1B0C02BD359104ADF0A30DED82038722DC527434C8CDCDCE8900850071178D33444373C
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5ee1f2.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt~RFe5ee1f2.TMP
Size 157B
SHA256 ad1581572fa20f59c7e6080807a00e9740136f3da208b22d0b1fad9a3db461df
MD5 b6632c456ce3f72a6a7b02c5a452a243
SHA1 38943a28b279fe37be6d942daef892c8af48828b
SHA512 db19126409816baa8be7c43a2c605c3ceb0c4c81a7f20863725715b49626958049db15a97ececbea38efd30276f7e5ba78e837edcb26fe715f5b63338d1abd06
TLSH
T1BEC02BD3192006DB0B3098D51038720DC6374E8C8CCCDCE8804870072178D33810673C
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 586d5b694cb0401220435d58ac99ac51e17ee597e7af8a317e900731c425ab4f
MD5 5e98f43802207ec4ef3388256c27d3f7
SHA1 a0bd534cbeb3a9a7f34d47764644917a7978363e
SHA512 4fe50f9f1f0256104a9354994f5343297a6a4b19061d000a9d0d590b631b72743185d27ab9b43a5316d024d1c888024bd33d1387eb73231fc5122bfd7b725506
SSDEEP 6144:7Oy/eY/0Ljo6PGqnIm7Rkm1tYpBeh2BAoF:7P2Y/0Ljo6L9oBGcAoF
TLSH
T1FE342323EE71F7750499623DB08F9A1C1CB21583DA89E6E18ED9EF8927EE9C41D14C70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 33b1a785cdc46787b566f88447b75896c3c2ca005cd5c13fa3827f95d4440493
MD5 b4a56d74f995d73b831ff95f8f5bb53a
SHA1 09ae0fde990c188fa0635758c03586bda2ddc67b
SHA512 5ca21cfeb2142907ec69767b8e43ae65b30edbd16751cea52fe145a71288c0f9fbeb807a6ed030510bd004c20473d0358c4eb4b655cfba31ebc7b80d5030381e
SSDEEP 6144:wOy/eY/0Ljo6PGqnIm7Rkm1tYpBeh2BAoF:wP2Y/0Ljo6L9oBGcAoF
TLSH
T157342323EEB1F7750499523DB08F9A1C1CB21583DA89E6E18ED9EF8927EE9C41D14C70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 7f38da29d658525f57e19031e6dfe8eb2920137b4b6c26196392946247582eaf
MD5 9188b31fd7badd6ac0cbbb0310132ab6
SHA1 8bf977dec0631be046e89355af8ca8fb6ecd551a
SHA512 60b003624b8098542aede5f8f23b5d572ec5cbec22ce8c6a6115493ca3524f449efdf3fb94b0159fb825ecec10fb3e3e98ad9f075e96c40de6a9def951cdcda3
SSDEEP 6144:COy/eY/0Ljo6PGqnIm7Rkm1tYpBeh2BAoF:CP2Y/0Ljo6L9oBGcAoF
TLSH
T15A342323EE71F7750499623DB08F9A1C1CB21583DA89E6E18ED9EF8927EE9C41D14C70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 256KB
SHA256 42f684f791cf86910cc92491841f95aa13a80f9f2d4f0585b0e974679c83ad3e
MD5 57e979d790920649e922790d8d788891
SHA1 d4fb775067e0170d4459c639d04c9f69163aae29
SHA512 3924d9fcfa2f3909927872372c7204c6e3ecc46cb0a0eb3aa7905f35c69cbd21928cb7d24c7f15cae1c7949c76c742d1f29b88683cee9db9a69247ac8b7936da
SSDEEP 6144:6OjS3Oy/eY/0Ljo6PGqnIm7Rkm1tYpBeh2BAoF:6O8P2Y/0Ljo6L9oBGcAoF
TLSH
T166442333AE61BA710899562D704FA91C0CF16AC3DE8DE5E09DD8BF8957EE9C40D18DB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 dbfd943e2103db4c639ab9a54f23dcd284741dc0ce1279e98db3719c1b0531fa
MD5 ebb33805fbc6627fe5f268868757ffef
SHA1 8b4ea70b9d05c9df465353f4affecdc8b2f18189
SHA512 97befd93419d0f7135335f6e4afe9ed1874071cbe7546c37d342eb8ebe1770adacb36f30d81aaa8cbcf794d49d67103d91a41232e804e850afaff208ad2a2544
SSDEEP 3072:zTGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM1:zqm7Rkm1tYpBeh2BAo1
TLSH
T116C3122B5E75E9375D79AB4EB08E0B1F1EF149A3C920DE8288D85B0477FA6CD0A44934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 237KB
SHA256 313bf7f7fcd314b3f4a4322e9354d90a848b0658416b4159e3fdcae330a34192
MD5 cd7b1d358971099d674b16b8ccaad6bd
SHA1 3b0372166c9ba97b1fa6447babe72e2fd4947dc7
SHA512 4a5ba874c6e271f825e4db6ace061f943d0cdfe1a3649906fe079a480ef5a46c03f89b7ac78ac7515fcb20a669d8377598ee755599826fd6f9b8700e78b09802
SSDEEP 6144:FSZOy/eY/0Ljo6PGqnIm7Rkm1tYpBeh2BAoF:yP2Y/0Ljo6L9oBGcAoF
TLSH
T1CF342337AE71BA7508A9522D708FA91C0CF15683DA4DF6E19DD9AF8927EF9C40C18C70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 237KB
SHA256 1070039355ce337dbd190090ec1cf59c7fbb5a4991a93da02aa0667ac0d9f850
MD5 f6c5b1fedddee8c0cf7753b9509ec586
SHA1 a680d8bcd1b0a69701887923744a8158d9045d55
SHA512 897caf6d6161a507bdecc69da2dc80778e39844a8c7aa76780f6eb020396a8d61764b7898d0fdbadde3ced5a5b55a06045036a924e43aa329390a41148b6e9b8
SSDEEP 6144:6SdOy/eY/0Ljo6PGqnIm7Rkm1tYpBeh2BAoF:xP2Y/0Ljo6L9oBGcAoF
TLSH
T114342333AE71BA7508A9522D708FA91C0CF15683DA4DF6E19DD9AF8967EF9C40C18C70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e091ac4f88db5453fb07661c5eb4ebedb553cc507ac11d855633af4bab0e74e5
MD5 2838a244aa4c14dbe7e2001806498b05
SHA1 1bb0bfd8bcc597bb5720c8093ec3d161d4012357
SHA512 6358674a949e5a667206cc69b328000a2144ad81bfbf5a0bb9b6cbf06ade5970c22882481326552ea44f9f58cdb8985b2fbafe455767bbc68818a67d9a6dc41d
TLSH
T160D09B34B75AE445D5074531582C4711D9199DD014A6C70B5160D41C9BA505C73BF457
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f581ea565cf0ece39a0cfdc05cae1573d34e8544d3d072c3f0598034de5e42f8
MD5 c80cb3ee13f62b490ae95d8bb68bb8fa
SHA1 a3baa3d078eae3e3de53faaf8b92df67f056d9e2
SHA512 f385ff91fe9914b069144548f6f36759de4228b81878118a49bc5d05a8f3055bf5724ef0be68d53b91691f095dc1736b8d3458eace80a0e31689f3d0c8f3f5eb
TLSH
T168D09B34F75AE445D1074531582C4711D9199DD014A6870B5160D41CABA401C73BF457
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 1KB
SHA256 297612f2209512657a09e1b44e40f4f1ac003db3dfcba328ab00f8078e61b2ff
MD5 07a67d9f6d0c51a2841dbfd057af1f67
SHA1 afe036166c6750c404a0dc55dd39d9bea8597e59
SHA512 2aab15c2afcf5b74ecdd3ad4ccb22826edc09f9cb8030207cd167371b603b6083ac2b286dc4c52b735ec753a78026b9ba9040f0bc91df538d99118e598517d5f
TLSH
T120218C92C5D4C3ABDB04319A4A65539D40703B0BEBD8DA05134D8EDD70499EAF6E66D0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 1KB
SHA256 c40373494a16affbc8843c9572b421c56b8b06f5f997eda89843e60b2bedca9f
MD5 49ca97a99ddc125ab98eb2994c81f5ef
SHA1 6beb54cb62f2bd1250e17deeaeabfec927875bd8
SHA512 a319f49e4768c4e577726f983a64a36aba1741f4380db7d5012c593048cf30290624557799f08d25d0383c91466a57c30640d61e8470c6dd711d2b7e9cdd7da3
TLSH
T133218FD78BC6C35BEB15108A8B61636C4170370AD7D8EB08174CC8FD3249495F6E55D0
MD5 SHA1 SHA512 TLSH

Submit Download

f_0000f3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000f3
Size 24KB
SHA256 a3cf4861c7d0c966f0ed6564f6aad6b28cbd3421a9ca4f60e2246848d249f196
MD5 344ee6eaad74df6b72dec90b1b888aab
SHA1 490e2d92c7f8f3934c14e6c467d8409194bb2c9a
SHA512 2a9a9162d610376512a8fae2cf9eb7e5146cc44c8ebde7a12e9a3985da1718c62ae517c25b00de7c0269efab61b4850a0becfbf04382a25730dbe9cf59825a62
SSDEEP 768:RMxowxdaCb0WaY4P8keYUej86bykBRWIsna:RM1r0NY4P80j86bHtqa
TLSH
T1EEB2E0EEEE552E4CE2F059B4962B734B8A46F022191F947832E7844E8F494C24EDE477
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000f4

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000f4
Size 24KB
SHA256 f254eb93b015455a3c89aaf970631bc989fe2bd387f79e871b514992359651aa
MD5 5366c57b20a86f1956780da5e26aac90
SHA1 927dca34817d3c42d9647a846854dad3cbcdb533
SHA512 15d7127970436f2510344600f3acecc19c39a05f8e82c8a7950095386382b2e2da55883a5a9faa97b84452e67315b9ac1693b6592274c8c1c35c813dfeb543a2
SSDEEP 768:ZfRLYs8uBykIQZ6yXBeQOS9JUmBgKYTbgVec:vsbmrDXwEfUmBgKYTc4c
TLSH
T18DB2D004F02ACA26E53655B371E82BD54CB6C4CAABA9935C113520AF3ED3F48C991673
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000f5

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000f5
Size 41KB
SHA256 0e2e6d1994902577a3d3a7f0e37875dd22de26342bec8403ebe262f92f2eddd7
MD5 a587d1a659231c3c59460569a5564da7
SHA1 eb542e028c0b1d2fd44d24b15f20176a26255d07
SHA512 73c9bfccbe137b51140469d22c9469ccda975e6caee5402a819a4629d1d5a23664e062e5f96271c1ca37b2f737e39cba6f7c25d25c0f1a3d7a31394ab8ecd814
SSDEEP 768:aS1GIh+o3q6EIwVfpJWMT3PHw1ALy+wBAPYqaia1PsbtUZE5JCaUvZGJatEG2fhN:aq9/EIwVTT3PHGAmPXRiMPmoKkHZGJau
TLSH
T17313F1CCED8DD55C266FF1E788F8B6B35468BF818819D336A4A067DC0724803743BAA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000f8

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000f8
Size 76KB
SHA256 71d6bb4c44b86b09346c8cf2850ff2ef1ddb4f669977f60c4490a4ac6f623931
MD5 a5c154a2129caa2cdc16c172bfe3c178
SHA1 3f9cc7ca8e58b43cb92ef5cb1d47df10ce365cdd
SHA512 829c1a0c9f4b0282dd10858dab96798d0a65288b0eb10cc926aa092661d707f6372a9a0499532f43be874a4fe27b887e979b8e0c6da6f5ba20e99bb1353affb1
SSDEEP 1536:NP2s592WtuNCZGDFzGsjeXnS1pa53x19Lpt59RyLV+LEVvbsz/B:N9592yEC7Sf1pA19Lb5SLwL2vbg/B
TLSH
T1A87312A93438977AA06914BCAACD55872074F451BC1EFFDE745AE3C5DBC433B089C41A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 0fbbe8bedceba8008abe189eb0b0265bf0fdeaa3fd3e2bcb2a0a7c8935ea28ac
MD5 a9c84c83f2c6082e1d050242b51ad241
SHA1 fd85e7107583a3ae9a2e72435bab9b41e2aee5e0
SHA512 a0b09bfa6d5d6ccc84ad35ce6fd1a697b2ee72ad98f74c864712907583d2f8f504110fac3139e9bedc16b5846c65aac78ce0bd55a14d931e547a2e6e6fff4236
TLSH
T16F81723A3A5E109ADB9061FFA0F64300B23089C8F9EF3F7612E8A53D670D351D790649
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 10KB
SHA256 d425b53e8d00d43205dfe406bc7e809782882b296aa6144cb519053b0b19e413
MD5 0b0f2f4cef47b6ca14d889b7de7595ae
SHA1 6a3a542dd5933fcb908ea799b40c1e03d2400b1d
SHA512 743f75917c9344039379c568984a181a518b49af944fa2bd3463c37d5f04bfad7c07c866341b443e357935d16f4822e99b4c6b326a0cd659e6bf6531f9187f22
SSDEEP 192:C8LX5fpQAvCCBJz6gvRkGviU4O4D/70cTCbQQwPj:C8LpB1vzAiCIU/HpQwPj
TLSH
T17222EF7AEAD588CECF5150BA54E48B0135F658A2B8EFBFE641CD253E550F78543C0A28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe6080cd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe6080cd.TMP
Size 3KB
SHA256 07ca0683f345a9ea3f6d85e1cd2449fce22017dd029af9e5b492b210c8b01d94
MD5 7c82487d9c2f8937aa927a1a227eb5c8
SHA1 6d546470e3dce8c88c317bc82c06daf6dbb74aa5
SHA512 c715088e585180aa21b3e577093b51038ef5c4fef22d863923f68cbf42f0fa5f3145618574fe948518c7fe5be64c4cb2ba8ae7e06470bd3e926d3a7e28c6ddb3
TLSH
T1EB714E3E3A0E105ADB9121FFA0F64300B67089D8F9EF3F7212D8A939670D752E791648
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 f4f35195dc0942d010c0d33a629ac60fb68ca63631b22ef7debd3034cd395c32
MD5 a60796a44b7695c1b7fc08b29cf42c6c
SHA1 1eeea6ebae20301ef015f7ffef5e3ebd6ae084cb
SHA512 467dc9bdbb5ae5bb170700861e5d1cf53bcacedbbbdb7b64e6bbd7567012766b78c60c36919bcf8a25075560d08d3109f7d09a8fb6e6e06a1cb39f1ed75fdecf
TLSH
T16751BFF783F4856E8A0096F0A618AE2FDF2D0625431C3C6989D4EE27D7E3471E10165F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 17KB
SHA256 d184a066b113028b1418ac0ce9c481bca361f7e8abf59bf0d4c62b95545e61c9
MD5 f481cfb7fea394495b0abff80afd81c7
SHA1 0bc993fcb344fb0c8391a3d1af3c311be7f60c48
SHA512 84067077d5f9a1da0f014c82fbf94615345108fefd71856aded1d48d3085fb891183649472384948b99fe83df85d5335f7311021b4faf6c43a3561dc25189a28
SSDEEP 384:DZdTM2uRBYhkLJuJseMvw9TMKRM5va5DibKfd4A3k057ltWc/o5ign3vQE65LDC+:eUmRQ2qE0
TLSH
T1BC82F0F7C3E8862DC86156F19A142F1FDE1D0529431C3D6A89E6EE4F93E2471E241B8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 055caff1efc699e002ccecdf0d832443c0f7156f9531ad146de4f10823ed4442
MD5 4f9314bacac7ebc7bc08a430878f21f6
SHA1 2a32c2fd76c75f9944e8e667bf93ae45f3c615fe
SHA512 1ba0141face7b10cbec50a5103423cbc941345a068234ec921dee77d3fd8a183fd59024f72a84e99dfcdfb6c98c5e2bd7173ddd3ac3613bca72cf1a1d2710c9c
TLSH
T1FED022271340B0B5A6AD3EC1A16BBC8FC33740600C83EDD411D0A99E0936CAC9A47688
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe622881.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe622881.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 eb41c757fd9152f140e4f0544a525f5d021fde176ee0ec4d4107aa0c4b8326b7
MD5 47f21b824b2ce299b331b7954c0a1426
SHA1 c106b9132f394e135a328f8577c796d2040efae8
SHA512 c6b324bf47b02f2c85be9fbd1bab0b736fd2309718f2fa91b0b5900442cd4ab835854f49630ae0a6115d000f376773df02d428d7cb13ef3f44a212d7df8039a0
SSDEEP 192:sxZeRxyM/jK1Ml8MmR/fZshsrqoBEejjIdpwCHW6+WNrpX/AtroPZxsqlIg4J:sxZeNuR/fZshMbEpjHbN/pPY0c
TLSH
T13A52F916AB349977CCCBD209BA447B53D6F50573E2944E54AAFCCA1C00E6BED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 5cd33faaf7788f2a96dbaa64106754bc8c0ff796b9a4af69f60027f1ada21ecd
MD5 e23713bd5a2408f8557cb6651e2503ee
SHA1 0d38dc12863c4a6240fdb9426b47a1f4dc27a98d
SHA512 09599ff100c810a5b87167d10a52e4d9e2bf12fa42715f8b61613ca7ebccf29125f4711d12dd047cc98aea44d65c5eb28e35f040fc88e26d1a9eda435d0308c6
SSDEEP 384:sxZgnwvqtm4R/fZsDDbELTT8AOkHbO1o/Jk0wX2:sSwStm4R/f6DOsjkHblCJ2
TLSH
T19B920956A6344977CCDBD218B9127F63D6F91463DA945E48A9FCCE0C00EABED231381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 0780778416ad616b938b16218a5b4b04195440f95e48e0a9e459a7f948f61c80
MD5 280da2546af913b81dfab6b4dbbd33c3
SHA1 de8b1c862b24ef1b9ff2ac7bd1709cc93a868175
SHA512 ac732a5bb343c03a47658a49880e8eacbe8d9b8775256c8e0d28280c5c32ec29671735bf3b1058ee89e93548bab722b96ab40ac542363776fc4120de2ae749a1
SSDEEP 768:8pgL6wI7pLuLfieWviSZq8F1+UoAYDCx9Tuqh0VfUC9xbog/OVcISJLlZzaR6rop:8pgL6w0EfieWviSZqu1jahISJL7+RxWS
TLSH
T117F20B3B6D0CCB7E4F844E9CED2A7E8B6DE8018B9698899447FA444C03C66EF11175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\a3dbbff3-3154-4942-9e56-f2ab9a1a577b\index-dir\the-real-index
Size 72B
SHA256 6e3f02955bd13e582cb778ddf9cd7ef5fc8afd2d27cd6685292d61e65356a496
MD5 085705f1350dec36adfec835f3cc0a0d
SHA1 57a9ef0f97c580bd4e6591853eeb7892640710c6
SHA512 917141a9e0ec0b30b45e043ba32d6eb48680ba0dd2bef2741e1dd9df4649ae9c2976a95cdfa37eaefd746a9c61a006c7b262707a2562acf9163b0b575155bbfc
TLSH
T147A0021D36E04561C15216FC3DD60A812660C920560E175D49940848CC58545495102C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\a3dbbff3-3154-4942-9e56-f2ab9a1a577b\index-dir\the-real-index
Size 72B
SHA256 196afc970576d8d5e80250dfa12309bc140edfe7ee44c243d588063406919635
MD5 185b2c31ef8c2a8dc13d47dd930cd7f2
SHA1 fe8d66fbe075b3d17f3be56ccdd8477ec10aef5c
SHA512 83684562d6c68d0270279e7f0cb7d119bb3f15570f9817bdd0c33a0f42291e291741b2cde081e2688167c379f96bb7bdd88c5d8dc616bfb01037396a73695a1e
TLSH
T12AA002550BA41005C0132DF5165A07422340DD54A100B7075095C084CC544D06D4150E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b0aa5566-4b17-4146-ad34-a674aa51c1a3\index-dir\the-real-index
Size 912B
SHA256 3d00b09402ab1bea486cf62988b5ed406daded5a18f70fd89bb8c7a5f2e17f17
MD5 68c59f9c1ab3bbf8f34e0c704e38ddfa
SHA1 d5903e3ad12232a2df83215d78ae6165ef763266
SHA512 d4a95bc16f25ae7e6e04bb35471218b3bd19fb239d2797bd1303c15c5ae7efbd63b9e112ac3a51187ac279bcf443f61108d8115fb853c126ae43b8985688ce64
TLSH
T11511FE5A6E958C1FE959027B15BAB4E872704ACCA710E733543D22322D1534A195B1DC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b0aa5566-4b17-4146-ad34-a674aa51c1a3\index-dir\the-real-index
Size 2KB
SHA256 f9cebdc3f6361e1fe4af3f95d0a7cd1817372289c7c15958507abc1dca8def6f
MD5 58248749eff378ad42d85f304002b8aa
SHA1 3300708c2bde8210f55a68e6540c04ce40cdef09
SHA512 aaf620289942a14f23489725ce82da213204a63a683bb81bd20a034902825d2d39ca881b283ad0aa967272b0f5224d95b48107af917760115c747b9bf409ddfc
TLSH
T15351D84E4D4A7BA6CDAC14B328F70482333534FF5A888B07A58CA97478C33252D6E918
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe61c3fb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b0aa5566-4b17-4146-ad34-a674aa51c1a3\index-dir\the-real-index~RFe61c3fb.TMP
Size 912B
SHA256 4463b103bc3d79cc2e11c3c63429279d79f39f3d51d88a94352b1b25a45a4341
MD5 dce0437de628d7ed6f9305277e5eb652
SHA1 b07b02f5c937a2fd49e0df87f2421f689ffa1c33
SHA512 c3aab76b40d43fb33f543991b81b692abebe2cf968cc5443a220437ae7111323c86798ae086d0f11e958d73bac89f2946bf3b74a9dff739bd5b80f96938025a1
TLSH
T1CD11D3574B924D1BE44451BF19A6A4FCB3304D005325F7B3543D253A5D397C94A470C8
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 04b0fffb5cb610d8a06d1affabfde4512e08bf19a91f7d89c322f0de9a7c5f4f
MD5 625b36501790ef0072172f717a1138c8
SHA1 75b2adab9cff8692103925ddafe0f9a655085be8
SHA512 1b6c79575e04ca196aeb997505c351a8bdf3951a787278c6b50e84716dab46b66d5d3de2c21f4427d861f802d82aaf15ffbc93f928185a60e6a403fc99630e59
TLSH
T11CE068B72DEB2504ACBFC3D2147248A000417854C884FD0E1026A28352F13493019C62
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 540e005868cb844548ef0086b953995e4f75ab3c85090aa2c865b948dd1ed5e5
MD5 fb0d3cf5dfa422b16f8096e144e44869
SHA1 33e82af7b2af4dfe2bc32ee32f826f864e90e067
SHA512 45b5b8d2eb6ba5a747675db05155ea1c69a24edefe7c208faa1a0333d9845f5a59ac39761d11b1c40930eb27380b387ad2783282532dea6e2581492917831b21
TLSH
T18EA00261C996D085D0401271AAB545862BD0D9FC0B05221246BC515DD95025155E6554
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe621864.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe621864.TMP
Size 48B
SHA256 016ebb394af5bf10a004dd803f9bf3727706cb17987d128cb767d03cfa945361
MD5 dfcf9cd5c1eb0dea144cf9818b00a93f
SHA1 2787ddbdb36b34ae6f88ff3e42089f0fbbbad647
SHA512 81bbe41d9bc3f4da804735c4da1f8c0a6ce02ff44ac43caf2c04a003e17080d985c02307a8e1d46b6acd75b10105b149bf18e04ebabe0b3f786f92e141214a0b
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 9a1518a595c09139eada33ffba60c038d64780f2196c76fb06eb67476deb51ed
MD5 895a426d7e587fc16002ea369491401d
SHA1 08e9c98e3bef5377806f99cab171ebb654602cfc
SHA512 831ba6a6116aa38a8144f7f92740a86bfcfb974f680ae3c31b73d5a71c708eee46e295810a236f08374ebb2f4bfc0db86dcb8f3c1ed41bc2b1e7a849ab82b5d6
SSDEEP 48:KsWT8Ae0k1VIRIIqo1K3E/u1r2lQ5Y6HIlKs8gnyp4IXKZO8z:KwX+KUs26H2Ks8Sa4YKZOo
TLSH
T16A914951333702813D7D290895A1852B8E92B1733518A87F7B7859AA4F6BE139EFCCC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\FileSystem\t\Paths\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe60daa5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe60daa5.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9e7fc68d283f815deb8ecf6b7f313f0b0697a043a1baa04ef2a7017e9d2aaef8
MD5 7f716544cbfafd56c61d5bf1463b64aa
SHA1 c34134e9eb157ed15c46ea0c5b88e5f25ddf1ae0
SHA512 b5b31941651b6e3b4440920608c0d07041d8a62e7b6f6b3268151512b16672c9fd9d6cc7bbe6b240920fe47d0dd52a1a4fc4d7c203ff3021bc3a4f0177ccc259
SSDEEP 192:YONa6LCWtDQmiUyfRILSuOCzBSus6m2+JysE2wU6:YONa6mg1AImuO8susK+4rU6
TLSH
T1D402E83AA96D6C779EF37E45B4877B276FA41037E9902F44DAE82F0C01D764C2302966
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 1cb75f5aebf221af5d76cf1ad83ec65d9005aa03b7dc1859ac61c4a15c373d49
MD5 f2da8fa0e895a3d8cbe0e046d1e697c6
SHA1 cb057ff03408b00bcce9d138d46b0887b76007f6
SHA512 5887354ea02295ebb2ed231d19d9adb446d1d053f0cd8dcafda8d09e86c61299a87e6d986c02ee35c0c039e588a970d9f76d2763ce2845f1160554226d3dc8b6
SSDEEP 384:nOZcIhsNikGyGg83GH9uO8susK+Ou1XYoy+OObjI9G6w73bn:shWdnH1KVWa+29MLn
TLSH
T159928C33AC285C339DA3AA51F48636235FF89137D7D82B88A5ED6F0C05DB9AC130581A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 f904dd4a05f3141d5e724bd501c9cbe8dced4f14507324eb92baf9ef86146d9a
MD5 2ca3e633d06fe8bf19e8537b0f9804ff
SHA1 e9b648917e5c568cb181787a3b9c090abcff3d5a
SHA512 a93a6907deee7b9f07f05f85bc584e717d09cfc3920e8575176674582a9491cf8521af0ba76621e21b613b4c79f4ed0afd3baba05150d84ab583a8ccaf1481c6
SSDEEP 384:ngZcI9sNiAjyGg8aGH9uO8susK+Ou1XYoy+OObjI9G6w73bn:e9OdnH1KVWa+29MLn
TLSH
T190928C37AC285D339DA3A951F48636275FF89027E7C82F84A5ED6F0D05DBA9C130681A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 58c9ccf84975235039c71897c461d9639cb944a374a3d79ef3f2b364a8712ae7
MD5 e1e01fb3abd1d1dae178c168c3605628
SHA1 1402d2e472e3b164de0258382be42cf57bb41571
SHA512 d5a523e2399f32861ec5b24ed39fa02d10db09e183bdecb5d49699e9ce4be72cd331be4579581212c3d784ad95e8b7625186464d63ab6fa69f5e270ea812f572
SSDEEP 192:tOND6LCWtiQmiUyZtR1LSuOCzBSus6m2+JtSu1M8Pwo6AI/tqG+U6:tOND6mge21muO8susK+Ou1XYoo+U6
TLSH
T1B212083BA868AC679DE37990F48736175FB44123EA883F44DADC2F0C05DF65C230A926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 1d02af5c6126609175e05506efcff55e3b86833f6f758f640cc5720ceca2c836
MD5 b8919018cf1fffa54b0e97d7e86f57f3
SHA1 b71acbfe3af25fed3ee1bde435b30fd4f0a2950c
SHA512 8cd153d65f4276615ca3197d86e1826612d442120b250eb58a83b2b3dc8568e9a023f8fb9e84b27c0132da82f42aac69f3d78dcc5715e194cb8a7cf55dde1627
SSDEEP 384:n0ZcI1sNiAjyGg8dGH9uO8susK+Ou1XYon+OObjI9G6w73bn:y1NdnH1KVWP+29MLn
TLSH
T184928C37AC285C339CA3A951F48636275FF89027D7C82F84A5ED6F0C05DFA9C130681A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 37a733adc755144e9dd3e7c8f0894e147b3c838ea3f1d3d6faa7c49506901a94
MD5 4dbc2c4f0a1bf6d52d214681fcd9a006
SHA1 d797572922e6e360d0b551738412ef92f5dddf2f
SHA512 05ac76ccf47513f3c98c25447e7610d3b7d7381819afec1d84a65161413cb7c5d39fb405657c0ac3364e0af7627e5299a678597e1ce5be1bd29d48833b507fda
SSDEEP 384:nwiFoZcI2TsN68TUNTUlIlAjyGg8dfH0Dfw8uO8susK+Ou1XYoU+OObjI9G6w73T:LFW2Lwg0z8nH1KVWs+29MLn
TLSH
T11EE2C4F698D78936E8AE5783A77E7D169EBCC113B5885984B7C82E0CCC865BFC305805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 31KB
SHA256 19676af2c702a9fb4a326235889fce91c1572105f54e298ba1b3a0cd17297f3e
MD5 68fd8bddabd01e9f946acf9e384fb916
SHA1 3ef45029fac4fae4100db0af3582a5f00f18f990
SHA512 5e30a284d63d8fb4414b0d0ff564081b764b3c8a4224842ad3e81783498aa1b8e523c5c62df399245dcccc58c10fb70bde22ea0dd8cd32bcdc7509e78b394d6d
SSDEEP 384:nwiFBZcI2NsNu8TUNTUlIRA0TSGg8jOD0ffJ8uO8susK+Ou1XYog+OObjI9G6w7D:LFJ8Xwga+8nH1KVWY+29MLn
TLSH
T1C1E2C4F698D78937E8AE5783A37E7D068ABCC113B5885984B7C95E0CCC965BFC306805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 c6351b01ac13ddeddf7056d5c8b8e0faa849fdb677138c38b7172da023343189
MD5 c889d5b5cdadf8ab72c7ff013199dd7b
SHA1 c9304662baf1c9eb8ef79242c5c4349815a129d8
SHA512 be6a99a3c07b0a72de1da614c0faf872a98f76aa35ed1d03487c4457256a2d2074b1dfd44b3365ea079d0f7014e5897cf656a903d5e83da3b98ed3a83317bbcf
SSDEEP 384:nwiFPZcI2TsNF8TUNTUlIlAjT5Gg8AEI20ffJ8uO8susK+Ou1XYoB+OObjI9G6wP:LFH2iwghIj8nH1KVWp+29MLn
TLSH
T103E2C4F698D78937E8AE5783A77E6D168EBCC113B5885984B7C91E0CCC865BFC306805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 88971519277d2df4079bdbe7e9bc4a81d361156addc6c5ce4010666ca986bbe6
MD5 ab178d069d44e215372983f420fd7c50
SHA1 dcce077797cf92cb1118ec83aaa79b928a549dbd
SHA512 a06f7ac153b53e4067b2e0185463fa41e586f8b002569d5a75412063175f86eb3a847e5b06f0e668c4c3dadbf380a7a9be58a9e72b95c1b1e8e49e0b0b6f809a
SSDEEP 384:nQZcI9sNiAGyGg8aGH9uO8susK+Ou1XYoy+OObjI9G6w73bn:u9XdnH1KVWa+29MLn
TLSH
T143928D37AC285D739DA3A951F48636275FF89027D7C82F84A5ED6F0C05DBA9C130581A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 0b345ed42b94670b11e7a6853cfafe4152c518ed46a0b7d89f720e2ebb141668
MD5 7958c93980d699f1e001fe34a4c309b0
SHA1 315c8dc4286fcd01db94c64e0f9b76b486818c91
SHA512 2259b02856ce4f26b5bb6dceb2677adbba0bad2283e305c717bb36a71cccea57e920499c70c803c5f597e15b7e3ae4a171b2bf4e2454fe7fcff186ab630a0c36
TLSH
T1BFE00180D30200BFC07D437404835B742BF2C06043E31396452149683C2B3202B31FC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 8f9e29d474c2bd8103e0269ee244610bd0cb4285f97f22c8e9ee1c9a6f05bbf0
MD5 80f449bb754e37e381e345852d4a6d14
SHA1 35588d3d684b816ec391b1cdde09ed8e3cf3cfdb
SHA512 3602fc9b914447573eb02120e0e261f9aa23dfdc044fd0d06d78253f718aa5df344a5c0962720a9cb8fd9c6ee8346df8ad14aefb35c05be0245ecb889e51ba0e
TLSH
T133E00980D30200BFC07D437404835B746AF2C06043E3139A462149A83C2A7202B31ED0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 9683905b28f33f26068f36b7a90f4c8582ae050de4e9f6b2615af8bd7b864dcd
MD5 860e68a2d1ddbb369c8c8eabf2788970
SHA1 9d03111ee4c708bd2d07a375fb5c1f2b380c3c78
SHA512 070f5f82e2671b9b021a044d7856ca117fa3bd2685ec3f7cce4f60003192984d80466a2a9be690abc32d3be3de703a597d568b997b46b9201ff67bf57bf1a357
TLSH
T150E009A0D30200BFC47D537400875B74BBF2C06043E7139A462149B93C6B7202B32FD2
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 7824dcc2963fbf05a111e9e44c1626adefe84b698ab6425e42ac3bcd0a4c15b6
MD5 d6565906dfc683c6117eaedff4726d11
SHA1 333de2dcb6b696d5fe4afd56fb595db8dffe9add
SHA512 5f04ed8b7de3497195ec3481d2e938c868623f83089aadc067560b5f9e7f09f2561033047b556c17a3457c4d48337d7d4b1e85f03cc1902b9e0700c114ad1aae
TLSH
T13AE002409302007FC07D03740083577427F1C01043F30316401045743C273202F21F80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 0eadb4dcbd6fe6cd6cfbe93f8009957ae941d3481f149778cfc8a72d05317075
MD5 775ca5554ce9aabd97388b2f1f34f91f
SHA1 b1ac973ee8a71ab7b1638eebd05d42fb18d02190
SHA512 326cf0867af82fccea48a877f524caf779c779d7eec4769181906bd6ddecca72b392d4fb6e7eb74ceaf393fa19b252ff6f21540afe99ff967965427853e4c75f
TLSH
T125E00240D30200FBC07D03740083577427F2C06043F31356441049643C273201F31F80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe61f50e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe61f50e.TMP
Size 392B
SHA256 a178e461e00e65f6d92f558f6bbdffa5f2d99d89dd63036f9fce19c837422355
MD5 27ce0f79a5e0f77c56276e9e5a0831b8
SHA1 24cf850a7edc6082b45c6be9e11b642eb65ad653
SHA512 3f9b1d697df14c87410ee842b894c654e289ba01421ffc40f3613f96c0e9d8d24278931b4aa071e8796a2338a58d668dc035fb93c9abc0c1000bd65b940fa8db
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 612B
SHA256 918167fab0fb4435546513252415c1a2e44b6e8e60caf6f31d07587ba0a71ab0
MD5 5ca920f0e1c81dfb329b916e242a4065
SHA1 1d068ad79883fd23c27647c98e761858e46f48cd
SHA512 2b99239123f922883dea3137835bb8b74713799981e5aa1434ea70db85e7666f2372db684f94bb599ecff70c8c31d02286b0587ffe620333eb1d4bbc7feb84b8
TLSH
T11DF002D04C3E19C3D5B90E6EA40717EC50D45517B0D8383804CDE894D07A05E315183E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 852B
SHA256 51fa2add3b372e4d932d6926ca9be223a98d6ad3b63fcf099338f199d0a4ad28
MD5 0bc15719fed893a50e7e1a0840cebcc2
SHA1 b6b38e62996bd5e878b8bdb423c8908c2c7952d9
SHA512 e8025d1cc226ac64ba4fa534aa9a692475cc6f90a825329d6a12e01c23821f5e08fbdc188e3ec58612b5fc7bedb6f5a7f294d0f22467098763b8949281bee090
TLSH
T1D9011ED158391AC6CA7E0EAFA0472BEC44C8952AB2D834B908CDE8A4957985E304183E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 732B
SHA256 cf5e5467ab3de71fcb419acbbb754c3effd5e787864ffa7c767f24ff9bbe5ae3
MD5 87299a8105078d6252386ba9d333ff05
SHA1 c43e027b4174d2ae2c7f138de07b18ac0407148a
SHA512 f6678cce079ae97838bf5aebf3c195a2c82d27dd6546fd7e5428396130ca4bd2c809f2d2edca4f130da479624c3418beffe998ae1a032451706b9a47bad62885
TLSH
T1670110D14C3E1AC3C6B90EAFE04717EC40C89512B0D8387818CDF8A4917A41E345182E
MD5 SHA1 SHA512 TLSH

Submit Download

7667398f-2add-4507-9eda-dbfe34ec8fea.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\7667398f-2add-4507-9eda-dbfe34ec8fea.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 37b83fe09529a0a386dafafe5772c579a08be3150a973d6404490242a404d1e3
MD5 3321e0ff9259a6b1d578d4cdbab10dcc
SHA1 58946bbd9a39e01d4d333bb3f48f9d71d3a57ee4
SHA512 42c011cb08d7f1ed0f203038a947627aea425b3d5a7ee2f8391f1bafb3ba07aa55716958a6b596fe612e46f5feae3ad5570febdfcbaa11270b55d3128b490836
TLSH
T172411D58B6EA1148B3B77E569BF3A86D447EB9772F0BD45E10110E4F0A22A40C8B1B37
MD5 SHA1 SHA512 TLSH

Submit Download

4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
Size 15KB
SHA256 f1bb76c55d0f4cac58e74fadb4e48902513c6150ecea0d0c9d8046b50fa6ecef
MD5 5aada5fee677692ac0f8aeb440aa2a9d
SHA1 68b7c16d4ee2536be5bfe212e4d52605db813b2c
SHA512 add2e12f192d73edc7c8909a2b6395e47f2b588284b65d3c017c61796995cc5ccd5c0ab0e3437a8213d64437504e9dbaa54bf5931fc920e66b7e66bf69f0b391
SSDEEP 384:HwCe7iO024Y3dcs3hk2nhfdDE2Ba/rIVy8es/+A/+w:QqZY3dv3hk2nhfS2sDIVy8R+k+w
TLSH
T18A729CBB9F516C5D1917D989C9AD43A9DC05F9BBCFF6D0A608243049C78432AB0FA08F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

86F018224EF35405FDA9E5995D740CBE41015A88

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\cache2\entries\86F018224EF35405FDA9E5995D740CBE41015A88
Size 175KB
SHA256 2532abb4177d644734dde4dd3c3388270af453a1805479962d7b4b65232d5fcd
MD5 c663f9f60507ea82dc73e79e880db342
SHA1 8f1ecfabb3b6c500df5099913812f538d7e30326
SHA512 797b2dc50d13e912df24c00edaa56c0badfeed6c54f2ce3373b9b1e98a7a7fc1cc23b93e0334c22239fb494d7246c8004f9e265a7902ab80bc09b11b5cf6746b
SSDEEP 3072:7fCnn1RVVS4TvqoZkyicdYTz07wTdoXkqaJLCER9xaZzNtDKcwsUC+posyg:7fCn1RVVTT73dYHuwTdWapCKmzN11w44
TLSH
T1840412F6FE0E43011C1084EB866BDD4E6CF5238786AE9B79133B674056726E2ABD0C95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VelocityLite.exe

Path C:\Users\Admin\AppData\Local\Temp\7zO8EE9102F\VelocityLite.exe
Size 232KB
SHA256 c4c0b8e1593bc5481521cecfce00b953e3ee6d7323b98e7ddf2e8c90a78ce545
MD5 e4df8ee6e755c3da3088701eb1c05b76
SHA1 c52dbc1190b84555e27649b9b54746b958e5f3cb
SHA512 623ae06db60f42e33c6e94b4d74a20d6e456a1edb94e2b8bc58424532f27bc5baa516465cad455bddc0351e21614d4965919a123b7cb0891b8527021928a09d5
SSDEEP 3072:IlDJk88wN1QI7sxrYL1peQ3lOY9SkHNwG7NzaAT56Q7BQz:UAIwxrI14Q3kYBTM5QNQ
TLSH
T185341903B65890BAE1A2D638CD928981E7727C594F71A6CF37507B7E0F766D09E39302
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_5saiguxi.0pj.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5saiguxi.0pj.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

f7c2a543-33a3-4528-95c5-e822262faae3.tmp

Path C:\Users\Admin\AppData\Local\Temp\f7c2a543-33a3-4528-95c5-e822262faae3.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6040_294511092\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6824f4a902c78fbd.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
Size 12KB
SHA256 36ef961627d4ca5aa15d7c330db53fbc22da2e0a80ae40e0e8e13dee6c4711d3
MD5 e8b8316506cf92dae6a8bb0fdb5e51a8
SHA1 e4bb060273c96dbd42b7e9aaed7fd4ec1ed55ddb
SHA512 292815ff28c0696d06a44b94ead87e3ab8bf85c3044043c27ddeab76c9552c624a6b3e6facf81e12b57c3679ce71ad7d8b8cc6e48e8c915b2d27a5aa06f5ed78
SSDEEP 96:6yEzzYyE/IzgyE/4zMyEVUg8O1MkJys0k0wxBW7rlzTvyEDO+XUIGzPyEGO+rzOk:szzKQzS/4zWVT8I5yQYxzTTDqzzGRzOk
TLSH
T1F642420127FB1599F6F39731BF71B762AB77F8014B0A056E418152494A32B50DCAAFB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6824f4a902c78fbd.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
Size 18KB
SHA256 64248993aa7b2b2b7fdc727a6c11ae7dc2f9b262943e21a26164373b631d4f2b
MD5 36a3c1352714ea6ef570e7609bea7e9e
SHA1 2ae1e066c4ce55524f92b8f0d88300c42061c961
SHA512 3107188ec248232d36e91af337dc5edc7da99d988d1ce599e68a6130a2b7f174b6e75813664ac4f189bc8968f54c48727ef136d039e79c3e79e1b02bd9913f08
SSDEEP 192:0zzmQzC/4zndX2zjdzhVT8I5yQYxzTzDqzLGRzORE6az2:027uZ4v58I5ytVz03RVP
TLSH
T16082610127FB1599F6F39731BF72B356AB73F8115B0A462E408252090E32B50DCA9FA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\AlternateServices.bin
Size 30KB
SHA256 7fb492b8a2c0eb65af35c193ec587e7979c79246857816cbff18c38ac28547bc
MD5 da8bf9134e046745bd3dbefe5346e156
SHA1 2c127eddb2e32ed08b775cc67e672f912d441161
SHA512 ec50791d98fc3dd05398cc29c743130ac0382f93952e5e378916f7c7d261db81a16082b49f127fdf57d302b531e299a485332f52eee7ab8d222b2f15006149a7
SSDEEP 96:ablbyB+GibP1JI+rM/pAoknyx2jDDe4QxOU4+I56GkyuZCogbgz6bxy8tlaPQscz:aQk22cZZYFtsos4V
TLSH
T199D288FB2BB66562F0928FB044A8749CDC3306295DA89594CA44D0FF43A57A4D13FFA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\AlternateServices.bin
Size 30KB
SHA256 8617a88b24159dd009b3c19eb3bde01bc0351b83c0b4765a58ddca903ab50e05
MD5 7d7ef0523096e0c57391c4a02c9df110
SHA1 ae0759a2078f58621ec87fe9233b97fb3bcd208e
SHA512 04500bbe734fb2242fc971aff0f5b519de988ee581fa15641662702ebf58eb3152a71d88e9d915c9512dd5478216b45e03dc338c3bb2010f0bd83d7238dd5302
SSDEEP 96:+b1byB+GibPI+rM/pAoknyx2jDDe4QxOU4+I56GkyuZCAgbgzebxy8tlaPQscQIR:SQk22cZZAFtsos4
TLSH
T184D2AAFB2BB66562F0568FB044A8749CDC3306295DA89984CA44D0BF03E57A5D03FFA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\AlternateServices.bin
Size 30KB
SHA256 448f4d28f5061c0a2684d7079cd0e49d96d7496808fc05bca9a1d769fdb29e18
MD5 39f475b81d3be8c3754df0c19b873ddc
SHA1 e12944e05283822d1f6443b3980ac5d2974ff7f4
SHA512 f06e94a9efd380ebcca207bb85de9285cd93ac31845b8c31440f4df484f595e1c632b6973052ac55dcf958e13a1aefbce6e0e2b7603dbcc74c965de7fdb26810
SSDEEP 96:+b1bLM/pAokDDQxOU4EyuZCAgbgzebxy8tlaPQscQI6yMaRbBbBebVKBb:CQXZZAFtsos4
TLSH
T15FD288FB2BB66552F0568FF040A8749CDC3306295DA89994CA04D0BF03E57A8D07FFA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\AlternateServices.bin
Size 11KB
SHA256 a2371925ecf1f2ff0ff356d72bff033ff69c6309042bb6f54837d42932696a7c
MD5 b5d86377b7cfa331ba57fdf9676c1725
SHA1 1b10cbd36b420bb5d8e196e77248bd4b56ac6cee
SHA512 5c7b32f470ddcad5a5d3f63e904008c0484c87ef484c91071eb01538e3123ed7547d62a2fd957eb6dd8dd52c1a836ba304a66021bfe5a1fab0ad2fc8c60bc86d
SSDEEP 24:ZuhMZdu91ZM9Vvqc9Bg99lFzX9xnC9F8PWN9VxWAQG9Bb+:R03+BqOW3XplwqPM/pQ89+
TLSH
T1F63232F76B7266B2F0968FB14068B19CDC3307255E7C9584C64490FB07E2AA5913EFE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\AlternateServices.bin
Size 22KB
SHA256 67ebe053d158aa93a9cbded713b5c8226d813d7b04a3df0433aa115a9380db1c
MD5 a1ed6bfd9609a56146d08f51f73ede8d
SHA1 9dab86d554e17c910fdc23df1d9900b61fe1501f
SHA512 d8f3de9ebd5469655d55a67fd58b264c9ee2016478134d59ef987b37a36946dc6ed3363ccc5e26a35069de0bfe5461cc32875ab6d9dac6fa0e06b7657be84cab
SSDEEP 96:u3+BqOW3XplwqPM/pQ80Qyx2ij4sZwAyx4B4UI56PTyuZwoze6J0o4y8to:2QP22AZZcFt
TLSH
T109A254F73BB265A2F0928FF14468B19CDC3306254DBC9584C64490FB43E2AA5917FFA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\AlternateServices.bin
Size 27KB
SHA256 01712516787351a0bad251e1d138fb61c2f683604e5bd1ec31531b4cd7521662
MD5 b8a911cd4908415acc80550f32edcb8b
SHA1 e2f1692bbe957246a0b9a66498474f80d149a3a2
SHA512 3afd7f8276b5c9a221a756121113dcf50cb13c02bd8e6af39703e4e48b476110336b8183d3267dffc4d91640b5028c9796c63eed70b8a2c2b7085f9c4ab343dc
SSDEEP 96:7B+GibP1JI+rM/pAokQyx2ij4sZwAyx4B4UI56PTyuZwoze6J0o4y8toDPQslYEJ:eQD22AZZcFtQosDIgo
TLSH
T187C276FB6BB26563F0928FB044A8759CDC3306254DB895C4C64490FB43A6BA4917FFA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

compatibility.ini

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\compatibility.ini
Size 198B
SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
MD5 ce9ef13caa8a74c25157b184aa038475
SHA1 db03a9935d8bb3ce6b120aca98feade536805160
SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
TLSH
T1C1D022818BC7848C9D4AA8E4537C38086BF2EE0E0604492A32827F0B4164F09023C3F9
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 8cbcd8b56c8edd4765d475be4eb4db3546a8fe09cb709e61c902af00219be5ef
MD5 52b8da8153e237a7182544c133e5a91f
SHA1 40c5d140747e9e82e93d20bcc9204add01bc2377
SHA512 113e789f8112280ad470e43386cc70a8a64baa19557d68505d85156d6ca5fe9eb84866084819efaf9c7fa1a2cf283f47734f14c1f01d1fb6ad425bfbec891e76
SSDEEP 192:wa1d66Joz1zgCl6mc0dAOv5zbo4ZJmyjs3Pl:Pd66Joz1zgC1jpbo4ZJmyj+9
TLSH
T1F3E11164EA39867FC404027BCCA51B810F36389B984E7F2935AD641C2D972DE768E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\datareporting\glean\db\data.safe.tmp
Size 119KB
SHA256 c7eb6fa582abe30e73b682ec3e5ba810ec86ce14bcf44bf194ae38081399be6b
MD5 a3b89066bf9671c35d40ff08d0f7232a
SHA1 6a2e859628292cf5c4371b17c36fe34ac715d0ff
SHA512 39ae69906eaa5e6a9e4f66a3f28884f55e030bc39c639b94d7af10396b88eaf125a233122957a394591047299d7c1f436091a4f13347125fb34bc505202d0152
SSDEEP 3072:bV6oEmm8PE8mMVuNL/yrh9NKaNsakQt96094eW4Y:bEoEmm8PE8mMVuNL/yrh9NKaNsakQt9S
TLSH
T1CCC3ADD4DB16407BEC1485BFB495673C2635F4204A599B0B3AEC04762DCB3BF2D0AB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\datareporting\glean\db\data.safe.tmp
Size 120KB
SHA256 530ed64a3eb4dab892df8b6a6d57ecc94d1296fd59911b03b2c3a30bcdd7448b
MD5 b072bde4b33397abc2879198dc92d59c
SHA1 7d06091769efd64dea3b59efddd1fefa130b4921
SHA512 e042e5d590f07be6a4b53e483098f77015a39f91822d33f61df7b3903ed8aa1cd8934b86102afb1d3c0de09fd0e92a1a77ec73465244f4e39479e8d8a3ff1d78
SSDEEP 3072:dV6oEmm8PE8mMVuNL/yrz9NKaNsakQt96094eW4I:dEoEmm8PE8mMVuNL/yrz9NKaNsakQt9O
TLSH
T199C3ADD4DB16407BEC1485BFB495673C2635F4204A599B0B3AEC04762DCB3BF2D0AA6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\datareporting\glean\db\data.safe.tmp
Size 71KB
SHA256 b0bfc7a3cdb0d46b9c36374d8ffe52090a4ea6e1c769e137bd9230de3a08ab41
MD5 699050981d8ce5e99085e30fdd306d82
SHA1 7e0becac5c1609396fd11d996d1f42afba40ff0a
SHA512 ba770118e0de1d4acd7ae9a76d5a8617045242cac4b00fa3575ee7a0fd88e5c7fc08cb601cc9b99a6af67c153fca97de5ecfa4dd59aebb07a54b10af729f6cbe
SSDEEP 1536:DV6V2dktt46vahRPtIR8PeKlCqkoIrKsRzLXX/zTirLK:DV6oEmm8PE8mMVuNL/yr+
TLSH
T19D63F044EB1A553FD868037A9DD21B107F78F8899A0A2BA7371C54386D873DC3D8E16E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 063405fe9341485a65001e778e5e2524a3b3e1570c33484825a91f1281f817da
MD5 fd275101a7acc03f3cf1a2e5e473524e
SHA1 4dada32f8acf899acc60399c150aaad56195e5d5
SHA512 4fbf6b55aef535e8c7815ff1c0ab902c71f5a16bfb8d188d5d98aded71a78b5cd185c48a15881b762cd57fc1fac4949eb24a69d92748837be93dad39bd98582b
TLSH
T1DA61C959F229863FE444423ACC961B411F307453A8AF7F2A39AC604D1E4B2CE768D07E
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\datareporting\glean\events\events
Size 1KB
SHA256 1c60a868129ffc9ef3bde32b424d2bc3fed53b3e58b5a5c3a4a07de7709acc81
MD5 5488c720b3eab53d393602d0618098c5
SHA1 1084175993fea53e5c159c987d96197372384e79
SHA512 d1ffb6519b31547e4ea4d14ded21d10948b7946a56c2e22129845872ba36c94cd140ca20fd405c6f53185235c5af6e5d3ebe64103159da8cb2f8729e19d9c6ef
TLSH
T1C6217FAC39F88D1A58CBE35C7441028E97524E470CC71C470D52EE8DCEE1AD9326B83D
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\datareporting\glean\events\events
Size 5KB
SHA256 ba730b1413a06720fc5e50b7b2999d0d9768806e00379d082d78c1308d43ee68
MD5 306fdcda5ed5003d97643b889b46c755
SHA1 cca89d3860b0b493270380c4360c2851401210f3
SHA512 5c94f45e839661c51397b5a1ec4256223c2bbcc2d5a6af73871151ad7f4c7a403a1ff4b61ad4dc2d8d994e469bcebc356f8fb21632f7f7303f80be389579adad
SSDEEP 48:YaMpbYAuKMPkdzXLuB2A/i/XkCi58k42ZolVAmLEV4n8pAdVwd/W4a8Rrj0u6MQS:CemZkt3nXmA4n8ad2dL0zPf5HeP2W
TLSH
T10CB1205C65B90CBE28DBD399B841029D87CD4B028CCB1C470CDBEE8DCE96A99321F42D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0b0c3321-6568-4264-abc8-9f1b67f048bd

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\datareporting\glean\pending_pings\0b0c3321-6568-4264-abc8-9f1b67f048bd
Size 281B
SHA256 80c57eef2a877e6c7c6ce46066ac6f8c9b1edbd9868f20e20fd7d71f9ae3a35c
MD5 2ac4849c7f397a7202e4fc7bbdc5265a
SHA1 047349ce20626e01a852c5167764a95429e734a0
SHA512 56c9f86150612e58d9f2ea2b2d2e33954b18d2d36a782ed9323535c48ef8c84cc8955b5aee8b7a14c36372f90aafcc11416007075cdf79cf7dbe011f696c3fdd
TLSH
T1BBD0EB80B888731E0C280F07B1B034EB30628C3392F06A20D6910A2895FDDCA8195C1A
MD5 SHA1 SHA512 TLSH

Submit Download

4763fea4-b916-43e9-974d-fc253627ffe3

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\datareporting\glean\pending_pings\4763fea4-b916-43e9-974d-fc253627ffe3
Size 235B
SHA256 44cb82cab626db9f3d12f959a3259f86ee2d3d51c155155100ae6176e29ceabb
MD5 a332fd341a3dd2db59f881789dcfeec5
SHA1 e595044c2ff6c25f504bf972d9ec4485ef8ef31c
SHA512 00f34a538e2529786fb09c15da712fd6d241fb2e61cf97a17babba42dba86d6b4340b3f00b1835140fed5a8bdeeb451a51b249db05597f6397d8983f58055ce1
TLSH
T1AFD09789A8E8632C08040F0BB0E07CE330C98C3330A9A820C750453C9ABCEC8411189B
MD5 SHA1 SHA512 TLSH

Submit Download

598c298c-8643-4f5a-9edc-22206a202954

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\datareporting\glean\pending_pings\598c298c-8643-4f5a-9edc-22206a202954
Size 235B
SHA256 a4ab19f79afbdaf33c73aaeb28ca81f3901d07365178ca07d44fb5c1334c6dc7
MD5 0d8622376645d38c66b68f4b6d505dbc
SHA1 e04d3a2f77b341320189e2ce0c14ba50bb9233d4
SHA512 c16d4e64b2ff9b40644578fd3d55d010d4f974cf3959d8e7cfd264a9a6cd17a45ca1716cf871b164cf6d9511b67b08f854de78497918c3c3dee5c2f68d6a6602
TLSH
T12AD097C028A83B6D08140F06F0A0AAD230D44C3320A0982099911174C9F99D40221816
MD5 SHA1 SHA512 TLSH

Submit Download

5ccfc6ee-997c-4daa-9399-aa8f816f512f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\datareporting\glean\pending_pings\5ccfc6ee-997c-4daa-9399-aa8f816f512f
Size 29KB
SHA256 4936160c4b82a15594a4c2de2fba86f79df0c2083173117cc8c8b16c551282d9
MD5 aee7b4c23abb535bdd6b6d270ee4a365
SHA1 073a8a8c87c0009e459835ed74273994645de09d
SHA512 9331a9909e802693897e9f67011c4a1c64efa89cb102cd19d89b5f6eebfc0466f97f4a5a9a2a97fb1ac1c3ba0006189c1b5595e35a844d0448d2866479b27efa
SSDEEP 768:1CHZYgLAxkF/D758jGKRoFMBli4QBFtv41wU031rKWftYCYH914vSvAncrSdGoxx:E2Xxk9ImPDpLipUvNncO
TLSH
T1E1D20CFDDD1240473E65E51AF2E9AD6B2017083249CDC7CE68FE083A2BC697B1527728
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6324aed4-9125-4023-905a-ca3de33e91ae

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\datareporting\glean\pending_pings\6324aed4-9125-4023-905a-ca3de33e91ae
Size 886B
SHA256 264b95f78bc941b6f8179888759823685dc03472b847e0f124ed11aa8f431bb3
MD5 024903e9bfaedd1189b80cdc59211b26
SHA1 5456196c9eeca61b913e854448fbf76bad129a3d
SHA512 33e212726cfc21033bd8fde1c3811f88dc635fd541e641e113b61e211c10bc223691b43db76c7b81d7b53d0621e2a655dbf87418a0880ebf3fb4f86935e3aac1
TLSH
T1DF110481853576F2CC689347DCA437829AE4B523D0CA4D183E615B144EE754ED75721B
MD5 SHA1 SHA512 TLSH

Submit Download

b165d92b-8daf-47eb-9d28-721f1c1e7f4e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\datareporting\glean\pending_pings\b165d92b-8daf-47eb-9d28-721f1c1e7f4e
Size 15KB
SHA256 12c098c2ee29540fe0a10af45e36b9b9c29536a4084194b4cfad5c06bf78f943
MD5 fedbb8cec3911f56d6e4cf0c58b10b09
SHA1 882e1c63fd8d0604b63e118877d45d4351ef6036
SHA512 f203db33ba63236ebc0b053d29ef86d2cc985708dce1415773de6554bcc3ada9e245aa3837ddfec3bd241955e9356b67af050789791daa60336f13d6f8f9c42f
SSDEEP 192:5ZfGzfydszxsdnUe+DeCOTeOa1zWkQNSBmaOj0mjtOmHE1jCd44qtSq9z30E+hfX:7uzfyKlsdnUTTbO8R9MFvjhMQ
TLSH
T1F572E916287045BA8691E3A998F8BFC3E2F538CF4C419FCE9BE47D0819DE09D512794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c69a5a31-a63e-4441-bfc0-9787f332e5f1

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\datareporting\glean\pending_pings\c69a5a31-a63e-4441-bfc0-9787f332e5f1
Size 1008B
SHA256 1c410cbf2b0b651a94739c84bba592d4ec80b1d337dad4e448d6d07257b990eb
MD5 097fb68eabd3cc7bb11fb1e7ab4fe1c7
SHA1 0d506d720ae7b332ee5745fbc41f5e4df192afc1
SHA512 df45902c4178068d02938228b4460bc472a54e6e6d43074669e55a46d5d3861adae643f0cfc57c6c875e96403765d520ca64122558386a9aecadcf0e0bda2b3b
TLSH
T1471132819824B5B2CC78824BDCA837935AF4B023C0CA8D187E655A140EEA91EE357307
MD5 SHA1 SHA512 TLSH

Submit Download

e8cbd3ea-b088-42d3-a186-1af23096d248

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\datareporting\glean\pending_pings\e8cbd3ea-b088-42d3-a186-1af23096d248
Size 883B
SHA256 cfb5efdb958405a442a34c2df3f42e3ab64cc6c8abf5080146ce6c60469ffdcb
MD5 c6f5b444c18795c496080b17b9f6a9d3
SHA1 afc2befd8ca6761e1f7816924841e3ae26ca133a
SHA512 68bd442cffd39981cf9b92bae45ea0a6beea8e9c692cc85d8a28240a52361f30dc9825518481f80ae144bb5a3b6363572e5c3607a50fa524fad2c771963a05c9
TLSH
T1761104419534B9F2CC68920BCC5537524BE4752380CE851C3DA15A040DBA95E935635B
MD5 SHA1 SHA512 TLSH

Submit Download

eb7b3d3c-2337-4014-9227-85657d8dc722

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\datareporting\glean\pending_pings\eb7b3d3c-2337-4014-9227-85657d8dc722
Size 8KB
SHA256 82769dd60112b73c7c9a79f193d3528cf09482397120873dd7a0cb3ddbed1125
MD5 cceaa26aee04d13b8db57dee11282740
SHA1 08f6ee952c3cd8e6d87dc8af8cadf9b2a6b79db4
SHA512 981c1d5fcc789270305c38ac2dd87a26ec2ea2e1d77e48d1967ac5c78e1c65d4c70acae795a079a7f18e28f96b12dc86b43d45ce39ffd13d66254becdf16a42f
SSDEEP 96:E8QNpEAnoHk33pVmA4n84dMd/0Rx5jWL2a0NAY3Ec04CZ+HTgQWT:1TAnvVmAOm/2jWL2aw8BT
TLSH
T14812636C35790CBA1AEBD799A487039D8AE847438CC52D874CCADE4D8D99F99330F126
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fdb9b125-79ad-48f5-b333-e7a14dee91a0

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\datareporting\glean\pending_pings\fdb9b125-79ad-48f5-b333-e7a14dee91a0
Size 2KB
SHA256 5904805ba1c5921d2055066c8718f15af9bb8dd292aff142a788c2108540a678
MD5 99bbb5f1445c93f7e0271768904e889e
SHA1 0e7e3f30ae0740ca4e6e1c8709fa1ab990da6c02
SHA512 cf991b45597e226008157544418f5c68b7e808e937e765dea76c8e818e02cd4f7e8c62f903b92f897c7617957f806b458408f85a967d906df5146e04907a681d
TLSH
T1D041255C75788CF69DDAE29DD48133CE53A14A0300C62C972E52DE0C8CCB6AD336A53B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\extensions.json
Size 16KB
SHA256 1aadaf3bc611bbc3e0761477f8032bdf7b017396260fe54a4d1e2cecdffa99bf
MD5 10745d36828b49b0486e2e05618971ab
SHA1 586daa6f0f69da847f1c5d6e4c041a186c8450b3
SHA512 755742825176428e1b8d80f68d6c0e9a98dde0e4bfc84a531df23b64531b59ea2b0065d1ceca7437fae9b6e173bcf3bb81e76b398f3237f2349c981df7184c4e
SSDEEP 384:7kI4vGUmldvN8dhWP94z+96ofL4HwL4PVL4HZL4H1L4H4F4hA:II4+Rf+X64m6w4S494x4V4s4i
TLSH
T17972511545049EB8294FA79BAA367E02C37D433B60845C78F4DD8FC842FA5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\prefs-1.js
Size 12KB
SHA256 9ac1c7fdc637016f114fe885e251b2bf078834000540128bb427ad0501fd05eb
MD5 c2231f03e7d29f0222141fbab2d6e862
SHA1 59a5bd7dc76f327b1ff7639678de53497c33f6b4
SHA512 cf409aea5f31fff0411ed97569f34749068dfca5bc76a431b3982b8fa9a50b1b4ed785205066a9b074fbea9bfd68b9bd0938367b93ea6f2127843c1c1988e36b
SSDEEP 192:3tP2CRxf4EvgBSSWALRAdeOBw88QDK98hv0M:3NaRqwFEcM
TLSH
T1D642CC3C51048B3F20B6337DAC2149B119A20227BEBFBCD605F9949E055DF6541EAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\prefs-1.js
Size 8KB
SHA256 750ac7673064f86d7398f4cf7c193c73f589d0058285fd04bb3cfacb4b426895
MD5 ec152527ab414707957df7c8d12d0b95
SHA1 447e9e2c1f53bb4ef2d63204ad964b55d134125b
SHA512 df244e08fd8321a3d4e47cc7c62af894c32a8cc5b00748a3d743e2c0d2764dd7e63aaf4326b692904f9db8fd2211e40fddf6b20b886582f08aa295023a72fb39
SSDEEP 96:xHltPBTUkqGqFQPf4EvNbzS+BSSlndv9janfyHu5dfBw88QR4y8L4cnsr1zTGS:3tPuR4f4EvzBSSW8AdfBw88QRhl
TLSH
T11802107C5104CB7F64B637AC6C644D7059B2023BBABF68D710B65489015CF3842FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\prefs.js
Size 6KB
SHA256 50e10500c52046c196f0dac66aab869994f94b99f62b691b802eeeed6482cacf
MD5 359c84af240242771d64a51eaf3973b4
SHA1 1659ee5b22df7f75c5023ddfe3f2b5640f293b87
SHA512 84461f96011fdddfac4f644ca59f2316d733be4036e1144d8bdd61a0ceca1929b010ac0ab35130e3439cb69d41c47a14edc53654ce603915ec4a8312b0d41f93
SSDEEP 96:xHltPUTUkqGqFQPfaHm1zS+BSSlndv9jVnfyHVd7Bw88P8L4cnsr1z6:3tPHR4faHmXBSSX8Vd7Bw88Bh2
TLSH
T1E2E120789508CB7F64B677ACAC648C315AB2013BB7BF68D650B654C8015CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\prefs.js
Size 6KB
SHA256 f2c89b58965ef4dc9fc174e5172661a918d9257424a20ed4c2193461d9866d82
MD5 52c83a306891ef8525c55369756f1a96
SHA1 32d57fffe4a4ec1e91ee79bc42a94879dfd7a12c
SHA512 281c86a43715ceaf402a76e048f5c7994ef57058d9cf1b87f72fee46d95310f5be330ba7b0e661f4c8142eb31beb1f79a8dcc16723b233d6a5b0907ad6677545
SSDEEP 96:xHltPUTUkqGqFQPfaEvkzS+BSSlndv9janfyHVd7Bw88P8L4cnsr1zTGS:3tPHR4faEvMBSSW8Vd7Bw88Bhl
TLSH
T18BE1207891088B7F64B677AC6C688C315AB2013B7BBF68D750B644C5011CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\prefs.js
Size 12KB
SHA256 b376541f45ee651d3fa0560232d7837f446a22c310a00fcd4e64731d4ebf2455
MD5 220d289384aa1a86fa3df9b8adc94267
SHA1 81a8f8bc1071533809deaea4c290999e47c1fbfc
SHA512 7b1240ade1cf0889f333aaa586bade3161301d2482a3175a404642c8c7c24d5f197bac85e6065473a4414f116c223e99ad31db2e8960b6b73e0fb0f67105ba37
SSDEEP 192:3tP2CRxf4EvzBSSWALRAdeOBw88QDK98hv0M:3NrRqwFEcM
TLSH
T16F42CC3C51448B3F20B6337DAC214DB119A20227BEBFBCD605F9949E055DF2541EAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\prefs.js
Size 6KB
SHA256 57be2ba23211d5b6dabed622ad99c63991bcd6789267787bf64dac2d6b411788
MD5 a3dac1939b6799f5dd5770df2a845f6c
SHA1 3d9f6f35548f91bc18b5c3a407b9c35470f7cd1b
SHA512 8d4e864adce5ac93b5c1f134185d05df8cd254e4bf46524ac98ed8e21859e8d9ced1ae86142278cc0fac8823ac4776f58579c1c5c5c6041567bc7aff2d8a04ce
SSDEEP 96:xHltPUTUkqGqFQPfaEv1zS+BSSlndv9janfyHVd7Bw88P8L4cnsr1z6:3tPHR4faEvXBSSW8Vd7Bw88Bh2
TLSH
T16CE1207895088B7F64B677ACAC648C315AB2013B7BBF68D750B684C9015CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\sessionstore-backups\recovery.baklz4
Size 6KB
SHA256 51bda957260874735a1dc55d30df45c996e55a21dbeb5cc34f41a719ab901bd4
MD5 558383d24a91df587f2ebf4860b8b0c8
SHA1 e4fd0977499d3d7a93696478ce1383dc2d18ad79
SHA512 bded3864f9ae3e3313f5e54462bd5263bb5c4cb52496a9c6dc85332011183d3f52d49cf5581713be31e9b4d413c05e56c05d43e485b1d31d6c64c73207b53706
SSDEEP 192:2nNVhZ26Qy+4m849rC8RgyfOXIi0v/41c:4hZRgJj/fCIpgK
TLSH
T1E6E18DBF7D237DEB1659C4848CD21F8C15D1209589EE98405A3E9F3611FC349ABA82EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\sessionstore-backups\recovery.baklz4
Size 6KB
SHA256 2c439c679dec78d7acac994171db0e1c4b5ab4fe6a658e3058b4f61a46cb1f81
MD5 45d0145f68ebb3f0163a02e3c132fd07
SHA1 b227dcf36aede65783b99a25b4d5edd6a2ca7ead
SHA512 13882fb7013508032d537a518e8458db0eafbd4ab9d18b8e07db861e95e323cc4f18b7b39694e983897d32f3fc6dc3ebc5621b7a5b5ef7a1e2ca829022a8a71c
SSDEEP 192:pnNVhZ26Qy+4m849rC8RgyfOXIi0v/4tqwN:VhZRgJj/fCIpgtjN
TLSH
T15DE19EBF79237EEB0659D4848CD11F9C15D12086C9EE9800593E9E3211FC649B7682EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\sessionstore-backups\recovery.baklz4
Size 8KB
SHA256 db80b89f82b1127897defe448a3ed0fb17d3a283b726300639bfd74999b77ebe
MD5 0dc652e748854fde3e8deccf0717f85f
SHA1 d87d04eb06456900e39dfa6bc36a882c79961e1a
SHA512 c549fb8888a69dd793791823149821cf8222e8a9d1e60f495af97c3bcd35f42a024258d855fd0cccaa4f4ace24621cf7915d3bea8ba129a5d3dc26012ac40ddc
SSDEEP 192:cNVhZ26Qy+4m849rC8RgyfOXIi0v/4bLvkQ5+4sioiwDo:ghZRgJj/fCIpg0kL6ZDo
TLSH
T1B4128EFBFC633EDB069DC44588C21FAC30D21191D9F789454A2D5A3911FC6487AE46EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\sessionstore-backups\recovery.baklz4
Size 6KB
SHA256 4e5de739259d1ffbf3820a0fda8f3996129ae2f52589160a47a62728819e81ea
MD5 b5fdc14e217aaab7d51ff1e078aac446
SHA1 f9ab3ebf59eec0c5b2c704631d66cda5c19713d5
SHA512 6aaec651ed736d282703c0cae10f9e02cccc99ebd87a6f1c27cf759971f1f1830754fcae3e1a1cc40ff4740a7d196cbec44faeb8a12602c0bbe62555a95838c8
SSDEEP 96:l2oVhQ1sWpKJQj2+4mjLk49rQi0a9js6NfgyP7jDT+lOMICd01VrqM4EcZZi6rL9:lNVhZ26Qy+4m849rC8RgyfOXIi0v/4b1
TLSH
T1F1E18CBFB8237DEB4659C8458CD10F9C10D1209588FE9804493DAE3211FC709B6AC1EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\sessionstore-backups\recovery.baklz4
Size 10KB
SHA256 60fbbdf534630000991b2d744b31887b497fe62c6901220fdca6b05011ea1d0f
MD5 82cd707481204967a6ad0a41ced0071a
SHA1 9b20fcceb7e26de150fec390b71f75ef6946a219
SHA512 2470fc9c21004297f861041ecacf9799c08b5b9ec084c9cd9c5f06a1876eb1e4d55b0ee35eec0f34424db35d72fa3a1f74c5de6e2a46266033b6f0dcde7e0ecb
SSDEEP 192:xNVhZ26Qy+4m849rC8RgyfOXIi0v/4YKavQ0pdjQ5efoiwDil:hhZRgJj/fCIpgXspXkeAZDil
TLSH
T14C329FB7FD662DAB466AC481C8C12FE820D11455C5F788005E2E5B3904ECB8C6B946FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\sessionstore-backups\recovery.baklz4
Size 10KB
SHA256 eea149e8f403a84cc01e6c66c050abc91bf47f600ac2d4fb2a163bdbc8d35b63
MD5 abc04ad2f6b8fd54ce7076c4c8d8dde0
SHA1 0ee165145fbd9e1da0f16bab91534a9d5b1837f9
SHA512 df7c4f8511198443c3abf145dc397326f702a5c8fefbf707a8f48e24fb9bcae141b6a4fd50e1738db0dfaf52d7848f7f028f8f39af508fac792cbe40bda444fa
SSDEEP 192:YNVhZ26Qy+4m849rC8RgyfOXIi0v/4YKavQ0pdjQ5efoiwDCduWd:MhZRgJj/fCIpgXspXkeAZDMd
TLSH
T10B329EFBFD622DA7467AC545C8C12FE820D21015C9F688005E6E5F3A05FCB886B946EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 69a178585585b687de42556d28401dcc951588df5f470e618abc8b3243b65fd4
MD5 29791c61b04334b558bd8fa199fcedb3
SHA1 c7475ad0657e2e966cf53d2be809dbebe0816322
SHA512 1dc05989ebab167be0c39eabfa640ee4a6c4231a9a2db3452f0e06c9a7dff5b93ac43ce66b72b43af5886d8b7743b1aec57879190e689784c424de357563d2f4
TLSH
T10421C663C93A1EF96AA14264C0C94F6AC69E34328C69ACF081BE0B0311DD65D734225A
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\sessionstore-backups\recovery.baklz4
Size 4KB
SHA256 e73d806109b377481da10d3f14a7c6d6d7b88e488c1834a1b34a0a50613551f8
MD5 497abd4f6eb5ea7a3d985f686a6df030
SHA1 0d62824a2e516163f2849c3cd3b14b5af5d3a935
SHA512 e1f04eb9e2f27a5451aa31fe4b13aab92b0bb8e51edcd6df5948755c3823800ab2d6711ec4c0deb070b48f3d27c447484b1f07198d9f9b0074ff417f57971636
SSDEEP 96:YC2oVhQ1sWpKJwAjVa9iYHEWpF/LTCd01VrqM4EcZZi6rLKJyrE:YCNVhZ26wAha91HXi0v/4e
TLSH
T1F1A17EBB5C2A6FFE51B5C4984CEA0F4C42E210A0C5F909D3AE3C5F7611D8705A998B5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\sessionstore-backups\recovery.baklz4
Size 11KB
SHA256 ca820eb80cd47951fac87a640df6f3e33360621ee099bea3c103ef489ebb8d71
MD5 8fb622be30418cfac50425460e4041f3
SHA1 dafb80b6c41d7e664fbfbebff0b12017cfabaffd
SHA512 8513833d48ad842e309335d6336919fd79b31e651a94aaa1532bb332328698eef69e9179c1d970ecfbacdfeed4eba1bb055092d015182e8fcf0b3033c4f21a2e
SSDEEP 192:TNVhZ26Qy+4m849rC8RgyfOXIi0v/4YKavQ0pdjQ5efoiwDd6iDQRvA:zhZRgJj/fCIpgXspXkeAZDdYNA
TLSH
T101329EF7BC621D9A5AB9C845C8C12FE830D12016D5F684004E6E5B3944FDB8C6BA86FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\sessionstore-backups\recovery.baklz4
Size 10KB
SHA256 a7066cd7cf703eb147219649051b70127154c604f61f2785c2e189e6957e1265
MD5 48614a036a88031c1090feffbd0fe3d7
SHA1 51dc4dbcbb7021b77836bf99bceeb05df3aa2e60
SHA512 98e0fec8f3b4a3bcf6349b257cefe42cb45a6e1d9f296903ab631d48af153eea9c6b50fd8d1e7aeb6c630be0f410e32dc52943059c58e79c6400089a099fe40d
SSDEEP 192:e1NVhZ26Qy+4m849rC8RgyfOXIi0v/4YKavQ0pdjQ5efoiwDr:eVhZRgJj/fCIpgXspXkeAZDr
TLSH
T1B1329EF7FD666D97466AC481C8C12FE820D11021C5FB88005E2E5F3904ECB88AB946FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\sessionstore-backups\recovery.baklz4
Size 6KB
SHA256 51d2aad93fc856cb55e1ca72d5b98a6d010474157054fe03de74128e688733a3
MD5 6eb1a39d5e4fb2d904c316a0ab4fb263
SHA1 9f7db4605e3b26f57fe191e5770f8c8b7074e30f
SHA512 677ebf8e8c4ae86371709c8588df38f1ec30f0c4cd2035d76a342c53cd5655a14d376c349f9cbfbf63a738e1a23665ff1956d3dc88e0f7d257f5982fb32863ee
SSDEEP 192:ZNVhZ26Qy+4m849rC8RgyfOX2Tgi0v/42:5hZRgJj/fC2Tgpg2
TLSH
T19DD18CFBAD236EEB0159C884CCD61F5C11D12095C9FE9945493E8F3211FC24C6AA86FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\sessionstore-backups\recovery.baklz4
Size 11KB
SHA256 36afd39616fc6eabef4000b47da2b3e5850bda91f9d334e906e2a3d068287de5
MD5 2deebc79edc1f8f1606f07b233e93b1e
SHA1 ce307f2bdbeb6b8413bb82e2762b201d01647ed5
SHA512 1ad4d38669c3f8f645caa10e82715121df9c57881a73d9122eccabc9d8032f8dd47aae096be905f4191d0068574780af6f42c274af4279b1e200969b78e3f341
SSDEEP 192:mNVhZ26Qy+4m849rC8RgyfOXIi0v/4YKavQ0pdjQ5efoiwDa4DQRvcM:ihZRgJj/fCIpgXspXkeAZDONp
TLSH
T134429FB7FD661D9B5A7AC441C8C12FE820D11016D5F788005D6E9B3A44ECB8C5BA46FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{bb773a74-119b-44ae-89d3-9a6c7fa71e3a}.final

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\storage\default\https+++www.youtube.com\cache\morgue\58\{bb773a74-119b-44ae-89d3-9a6c7fa71e3a}.final
Size 192B
SHA256 04cae3c7b208fc55b25763913d0bbdc99232942086efdf705f2a27764be6f5ee
MD5 2a252393b98be6348c4ba18003cc3471
SHA1 40f75302fcbe4a8ac2e33a8d9daf801abc2a9598
SHA512 07af4a7b0d10f1b5e1fe0877b21abc98483d78797608a1763cfb71e25559fdce10d20f03c16f4284d7ae7ab90266f45240425e3a264de9525ec1657345b85198
TLSH
T113C0225846A8EE3620A3CB3CC827E2820A3B831000498484E6F94A540C8BE850129A01
MD5 SHA1 SHA512 TLSH

Submit Download

1841465657LCo7g%sCD7a%taa3b5a3s.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\storage\default\https+++www.youtube.com\idb\1841465657LCo7g%sCD7a%taa3b5a3s.sqlite
Size 48KB
SHA256 57e85288cf995dd9ddf6549666c454a6fbb5a51d09c923caa1f044b90b702e5f
MD5 e5d94a0313c84c5d5d91c3bbc8275064
SHA1 5b3e9dd8caaedad29bdefacebd3c4a9f94948102
SHA512 b0d3661281be17376b3234e2fececb7747b51e566793637a55b9d53f7169288301c27479029f46c0e412c9c6f785dc32dc5cbd93fccb3f534d261a91c86c3f6a
SSDEEP 48:TiaOA65g7LV6CM5znpgBlizb5pxVgnO9zxV+LU7mY2wzY5QcEVdyE9D:Oa16S6CKnqlizbxV+2xVeU7X2B09D
TLSH
T166236F8E3F07E511C53AF0B178A08D51BC5E321E07222AD57990DAE4C8F211AEE5F9B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{9e5fdf6a-0177-4bae-af26-e2dff1c8c361}.final

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\storage\default\https+++www.youtube.com^partitionKey=%28https%2Cgoogle.com%29\cache\morgue\97\{9e5fdf6a-0177-4bae-af26-e2dff1c8c361}.final
Size 404B
SHA256 ba3629c199956f51e9256ed5da1375954a0197263210e8f39a4e002329b71af0
MD5 85051cf42305694e9081822a85c9db9d
SHA1 9a0d7f1155462e0d8ffdf08d3d82057b538726e4
SHA512 3f9214d83f9c947d8f52e0ce2905f67192e15774a1f79a03729b2c32e955a31d2375c4213277e2623cf1f3f5922dece3733a89981e1eaccdbca1a9c89ae3c848
TLSH
T131E0F11BF3E974DC100D5B80BC6E7602ED4034FD83E840D9C5D01D33B364EA25242B98
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 6.4MB
SHA256 34280afb1967696fc73c21272d01bd1e7a020142f86d85bb3cf438cf778f7a14
MD5 19b6a0c12dc7ff75974d80119701717e
SHA1 d4bde53731217223e30c3a372b13bc054b1d96f9
SHA512 c84a1ff3341b8aaa2af697084501f260d3bfa31b04688d1f176d2df86274186a374db9f60012506f41ceddde6862f6e411c4af7052b89c950dd55c65e22f1a19
SSDEEP 49152:ZLqLy/aeUT6QC5zYYXcOJ56R0FZ/GWxJZPKv480PXtJEgaH8+2RduVcYFQde+JJ:722RXIQde+JJbWIC
TLSH
T14E665CE420E29252F34140B3719953EB21EFC01C6077CE445B9896FAA5B8CEB4E977BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 4.1MB
SHA256 97468ccb3af04c0c7005842d62b5ae34b2bd767da775a48bdfccbcd812e8ab13
MD5 155d47986d87af58f9599e5b0868a7b5
SHA1 f2d863508d2768cdbfc89b9f5569a6576237e29c
SHA512 f4b590c55d86de2c8c5af72767a406e37a7b172c07420d06c14c016c1361259c566e7018de1b279734c7390725dd242dab84bb7163f91702e20f931f14eec86f
SSDEEP 49152:x7pnfs6yaP6ryMtpBd5C9S8ARzMUghuRPbPxYUpq:VJfslaP6ryMtpBBRzMUghuxq
TLSH
T1F11639F824D1A257F3818037668563EF21AFD00C6467DD484BE966F990B8CDF9E05B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 4.1MB
SHA256 ac194b91ec64d0aefce2660f29843bdc01610ff71518f2f0afeab7795f5503e5
MD5 dbac1d26e307a2ec18e1bdb7690659b0
SHA1 91891fd1c7c6d117d784dfe8418b8e87a95ce6d7
SHA512 4ba5546315bb03eec3701d34155610d344adc4b937d061f45142d1579278ffb42e8e6f9c02fe0d7801dc59b4a50b029c0907e0d8f0ad268a84d60a068c2cace4
SSDEEP 49152:F7wufs3yaP6ryMtPHd1C9S8rRz3UghkR0bPGYRpqg:RLfsiaP6ryMtPHSRz3Ughk8qg
TLSH
T1661639F824D1A257F3818037668563EB21AFD00C6437DD444BE966F994B8CEF9E05B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 6.4MB
SHA256 81b364e2d967cadc5e6c129a9c22df3ccb346cbd9c1f404df7f7c6935ea116ef
MD5 b505201e0d914b25f0cd4b7f502c0afc
SHA1 ac4e135824601d368e31f834ad9ffcdeec0a0a01
SHA512 f34a1014c4893e42177aa941d1b5ba44ad145a04cc24b59d720c0455051d057354064c05e424bca37c061c8460f5c87205b310e3ab0102ba8998ec137b361fc1
SSDEEP 49152:SciW6R0FZ/GWxJZPKv4y0PXtJEgaH8k2RguVcYFQd6+JJTHXGaqYbMGWRzmiI4xU:jy2RAIQd6+JJBWRC
TLSH
T1F2665CE420E29252F34140B3719A53EB21EFC01C6077CE44579896FAA5B8CEB4E977BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

current_version.txt

Path C:\Users\Admin\Desktop\Velocity\Bin\current_version.txt
Size 5B
SHA256 813b231f281e55d9af5ea2364998b4d88d5d8c59158214c140f2d0f812d36d5d
MD5 7178aad20a4973a4eef42fc1a0145061
SHA1 0992c0f451ab473f8f11480b130bb4f1092476a6
SHA512 83b27147a701dadabe61904de646636c4e0346aa13605a55616293a598f78384ad4100bbd62a4eee237943f4433ed56adf7131cbee69054e66d1b414283241aa
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\Desktop\Velocity\VelocityLite.exe.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 5f3ff8a3663ec678ae31b10434a77d4b1794f0e65cbd76aec447f542edeae29d
MD5 aca380228bc86980dbf065e4ee930e2e
SHA1 73c4bfd07cc1c7863533e1d008504d1771c8e237
SHA512 0db3a75db6d8ceb8f7fd1f722edfbccd5e7a76a6f9d380e8f3a86b7fc5455b29a6f57dac8faba24c534709866999e79d488a25ec54ada0f920b76c66e567f564
TLSH
T1B0D01212724101B4C41025334652760C0408D10F410940005828876D1B044502E26A41
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\Desktop\Velocity\VelocityLite.exe.WebView2\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\Desktop\Velocity\VelocityLite.exe.WebView2\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\Desktop\Velocity\VelocityLite.exe.WebView2\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\Desktop\Velocity\VelocityLite.exe.WebView2\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\Desktop\Velocity\VelocityLite.exe.WebView2\EBWebView\Local State
Size 1KB
SHA256 0a8ecff37012e9b0e530dc3ed977d0bf8f57c97ed2b28d3311076161111709bd
MD5 d3ae09d5ef311bde6e8c6eadec0d0969
SHA1 11e863b2701df4b52ccf3e9f79b4feef0e42889c
SHA512 86a6373f5558ce4fd168398614dbe3bb8f9ddd9130f3ba1a0f1d2dea263e784f3070e93c61370ebfb62b6330a817f22132c8b0eb2b972eda54242d78b7abcc2d
TLSH
T13F3185B6A5546B375CC28A8971477E6B3E205066C351DE88E2CE4B0C02AB2CC6753C2A
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\Desktop\Velocity\VelocityLite.exe.WebView2\EBWebView\Local State
Size 2KB
SHA256 c34602e9ae2ad7e0176ad877e472c650bc16dfa9caf530470cae6893f5f4bfa3
MD5 b78997b6002c4a8b51a8646edf3bc92e
SHA1 1d929df7198dbf262951fc6d90dc1ee7c778733c
SHA512 7374ee259b8b9c938309f7f98c303aa6408584a31bd1e147a0cc416dd03000e4621cd9d7151a389fa2716d75570e5c2d893bfa0944659b784c1e3f473eb08329
TLSH
T13D519773A918AB7B8DD68A48794A3F276A355061D751BF90E6DD0F0C02DB28C3342C2B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\Desktop\Velocity\VelocityLite.exe.WebView2\EBWebView\Local State
Size 3KB
SHA256 730cd0e9bc53052932d378dd563392a7c8df482997a0df9dd379d08a78ca0915
MD5 902fc47ecbd1cc505165b37eb52b531d
SHA1 b804203e86e9a48d458cdcd8a3b263b10bcf8a85
SHA512 ea3901887f63e844f9ac326ba37d1625a3a800073080d5b6bc6fa03a34dad57b2caa502d521d90d39a33dfe797a1d4e9ff1d22f57cfea692c1a9f855bc3890ee
TLSH
T1C671A73A6968E93B4DE29E44B8863F1676655023D3917F94D6ED0F0C02DB3C82382C1B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\Desktop\Velocity\VelocityLite.exe.WebView2\EBWebView\Local State
Size 16KB
SHA256 9c5418237c82f095fca748f9b962bf1f07bf41f6ae2cd83545232d55dc05b18b
MD5 e5d200c08d2bd7799b920c67cd8eb423
SHA1 d6a880f3b6ac34ee5e485b5a7376684f6606de9d
SHA512 89dffdf4d16422805d505f9cc6b9e1ff87e7f3e4134d4af87b9ad5ea913523dc6117f4c8578a06f57503e9694e7ef83f94e6a6aa24e82402c0ea77ae018a75f8
SSDEEP 384:zh+aQikB+z/xvxjg/qhEwNbiWHmxyswybO5r9zG:g/UxvxjgC+N+g7wybO5rFG
TLSH
T140729E3F55296E2395F3EA04794D1B5BEAB99472C1C1BAF88EED4F0D068B2D41342C0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe644c5b.TMP

Path C:\Users\Admin\Desktop\Velocity\VelocityLite.exe.WebView2\EBWebView\Local State~RFe644c5b.TMP
Size 1KB
SHA256 370100f33c1275cc164c5f2db9534b25f7ccab29052e7568c51932a44357ea06
MD5 3dd29e64a7deb31d3aed1275e2c47da8
SHA1 48805a06a77d9c20c6a655321a18e0b787cbafda
SHA512 de18e145d599e9cded632a896655768f09fc50cdbe1717f5465782832c9f168df5f7e79e4ecbd934bef3d1e1749bc3aad797e6c111a001fc37e621dc6cffc388
TLSH
T1DB21657BD4586A765CC54E897147BF8B3E605066D310DA48E2CE070C03AB2C86763C3A
MD5 SHA1 SHA512 TLSH

Submit Download

VelocityLite.runtimeconfig.json

Path C:\Users\Admin\Desktop\Velocity\VelocityLite.runtimeconfig.json
Size 519B
SHA256 96bc2946dff8790400d652ec7f8de7bb043e954980d59470c112788b68a1fbd3
MD5 7e4444b5a3e3cea574693f055f944011
SHA1 04dfc98aa994475e2803241a1d55bb4277dbb8da
SHA512 2fd5e7ffd3b12c6962d3ed7d7b99fa09b870173623701690cc0237529c32b008e219e48818a0bc4b6962fba2e3d161b8fa8ce38c03467329b0ddc9e58ef0ae8b
TLSH
T1BFF0276ACA106DB708B933BAD52AC182EB30532B10041D52B5FC081C6F776B21111F95
MD5 SHA1 SHA512 TLSH

Submit Download

Fishstrap.exe.crdownload

Path C:\Users\Admin\Downloads\Fishstrap.exe.crdownload
Size 12.3MB
SHA256 e76802a98f323e86358521619e207aece51e025c8b9e62de94adf3f04d8d0ce4
MD5 fb54fb1ac28a4324f6408bb6a04e33ff
SHA1 c16d403267cb5c8d6d89ca9c2d1565ebbdf75b13
SHA512 37d31f4c075624d1f73cd4a045dac6ddda7035b6435604dfb127ca98cb21d447a83e9d3973a69a50778226573f0e619a72673d3b4995ed8eb678413c8e5b4fec
SSDEEP 98304:106TRJTsy+as4I/vGWD33iADOYoHwfLk3vSmaR0+Mc4AN0edaAHDfysrTlD:106TzsyDs4I/vGGDObAbN0m
TLSH
T178D69D9527EC1A35E3B74B3599B0A21E0579BC1EE912D78F1B847B1D19B2780CCE0B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Velocity.cJKsvbPq.7z.part

Path C:\Users\Admin\Downloads\Velocity.cJKsvbPq.7z.part
Size 19.7MB
SHA256 f27865ff8f60776ebd4febc0d8528aa3530396d4e4534ebe2b4f765e047b05aa
MD5 34be7067f85591003987566f89d44875
SHA1 7f748c3bda15f3d0e4fde3328256dba7362cec91
SHA512 4b3e5ad786992074a46467e85cb9eaec2de7d729d804ec358ab4c0e239a4a5d463464ba8d203cd8057eb45d2dd9f1ccda5db6784b4180a3fa4ff52a5066f7213
SSDEEP 393216:xR3TMYTPpaIJz3HJedxrwR8+6k2MTYIh8ogjpH/yo+5JUYvaQTzVmeOj12BT:LoYjJz3HJePkR8XvIYIh8ogh/4vaqzHT
TLSH
T1EA2733F8AB8CF8ECB7C73B687D857AC900D446E34249CB30A967A724F2715A651F9530
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI4F02.tmp

Path C:\Windows\Installer\MSI4F02.tmp
Size 392KB
SHA256 a28ed81b8594774c7e1e82f9bbe858c3b36f0d7a93067001387a5a872288231a
MD5 f1fafe5c54813a5d7b60d08b859bd58b
SHA1 95e6598ce1c02220d68edab5474980b7f0f0a12c
SHA512 6dbc8b10277c6fae8d7ba961a843810df0bb11c9c6e3ba54eea1b24e13b1069e454ef5d76d345839a32f94871855928578a15948ba242d03c990b21d8f845df9
SSDEEP 6144:u/VbdUw0z9ursTolCJSqJiIUk8AeWNxFqYrtUc06N:u/VbdJ0zErWolCJ9TeWxqYZfN
TLSH
T1CC846A29F7E418EDD4B782B6C5A68030FF75754D332095AF8BA845291F3BAA470BB701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e6043d3.msi

Path C:\Windows\Installer\e6043d3.msi
Size 1012KB
SHA256 03eb33e8eb7746542febda19278dde1c7bd496396a69a9d625a05f9506a1c3ee
MD5 667bbe018d9a8052f0ed4d4b44a02ec8
SHA1 9af6e69d606a4741ada8a58f36b9c06c9cf22626
SHA512 5e07d476569a3c7bf938278adb2b710be015698e5c3f01a5aab2db319d07b8ea675758aeb201577d3d51394550c313dc4bf401397c44f846154fcec9a445c073
SSDEEP 12288:SN2etgX0xsm7HrObWMInYLE/BbdJ0zErWolCJ9TeWxqYZfDvXNM:i26gG74W6WBbdJwEqECJ9Te7YxDXN
TLSH
T1A2256A1BBFA404A9D8B24E75C5B78321EE357C482320969F43A47229DEFB7D0647A7C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e6043df.msi

Path C:\Windows\Installer\e6043df.msi
Size 28.2MB
SHA256 4af98ab9168f319b9d026e01bd6e9df577799a222b04454579053a5a00abd555
MD5 8fe07617a818797bf2170e4ca5f4bb95
SHA1 126523726901f0a1129d9066c369f963f1ef5854
SHA512 75544a3a9bff83e7fed005ecfd0847ce32442e82c53879097518fd03ef4f6d8364bd5400912613d1eb33f6ae1e262bd1a61087960fbc6655ecd03260072bdaea
SSDEEP 786432:Tg+OS4VhnxfDEAOZGc3PHDOsz1tHDypQp:TF43nxfYnvDOsqu
TLSH
T12A573397BFA408A9D4A24E71C5B78325EF313C182721C59B42607669EFFB3D464BA7C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6040_1230575608\LICENSE
Size 1KB
SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
MD5 ee002cb9e51bb8dfa89640a406a1090a
SHA1 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
SHA512 d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
TLSH
T17D31535723840B9306DA2B4566AEBDC4B0DDC02D7F27AE05186EF394537B52ED8B3443
MD5 SHA1 SHA512 TLSH

Submit Download

BootstrapperApplicationData.xml

Path C:\Windows\TEMP\{118FA235-86EC-4321-B5F3-E5BC80A6BF47}\.ba\BootstrapperApplicationData.xml
Size 9KB
SHA256 b1eda1e98d843eef81232344754cdc0973d9dda1c1790a91a352c167c9a64ca5
MD5 5b54f26d64fb1f7e82bec5b4ff190ba2
SHA1 11d8be75fdb2bded9b835a2d0f6e5bf1848e0ce6
SHA512 3418f51296007c704600edc69c91e26c23e8e159e0a20aadeae06d010c80cb85cb4d86517d9fcf6ec5b150578311cb57592eb220ba0f93c7512d812e29b83fb6
SSDEEP 192:2/zaT1c/ovY9qnpijXjamaD0QP7XsCsysz:9sCsysz
TLSH
T1A912D4112BFD0218F0F3AE48EFF6A4555A3ABD552E39C92D01301D0F49B2E819962FB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetLogo_256x.png

Path C:\Windows\TEMP\{118FA235-86EC-4321-B5F3-E5BC80A6BF47}\.ba\DotNetLogo_256x.png
Size 2KB
SHA256 0f571f95d8eab48dbc81b0ec5e9f7225e349e26ef50868bfaab556f3c2443b01
MD5 39aa52615723b782c92dec710caaec7f
SHA1 760b49e256a7979fe50a56a2b1be3688a474b886
SHA512 89d1baa3820154667747b25e9e2fd321bfb2ec71dc309915b0a28dacdc80822a4943b639ebb37c37bd2559d5a4306d2096119cd970c84a0d331f6c68b0456dc9
TLSH
T1534195CF1BFD78D7E6E557918E1A8DD232738483B4B3A42CCE7B10B8274A5642B87940
MD5 SHA1 SHA512 TLSH

Submit Download

dotnet.ico

Path C:\Windows\TEMP\{118FA235-86EC-4321-B5F3-E5BC80A6BF47}\.ba\dotnet.ico
Size 44KB
SHA256 61a2cbd12868cb9b359e0c78961d409b7875f072eb8e53ea88d3e6bfe2961a18
MD5 b8096652d9ec286709a2c863b244b110
SHA1 b3b7f0f4d608fad7cb59ba499d4d17c2b873a7af
SHA512 492a5aa83220bb77c178b7c5b50bf44968c0427e9e45bb97a33df14d7fb4c667ca7adde0ebb3874c7b6011057b01144e4e6651fbad62c6bcf5e0b93586c4bc7a
SSDEEP 96:r+gfbzo+wHK9NbwOY4tIWQeVlV1W9+H+guapUjFamINUItzf1dBNaIZ:ro5HuNcH4tIzeVlV1WEOFDgUWzf1PIm
TLSH
T1E913EF6DE68547C1C10C2032DB4AC792B5233C72E4DAE0C4F9D4FA7E177906965C6E6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\TEMP\{118FA235-86EC-4321-B5F3-E5BC80A6BF47}\.ba\thm.wxl
Size 7KB
SHA256 b00edd703dd8a475119d0e4dd70a3aaa47f0e95361af290e76d367a8edef3432
MD5 8b2c667a8bbad3153068c0ed90df7ec4
SHA1 c9e04a3a37e5e6262ab9bfecf78280171b8f7b74
SHA512 5269f00d474acccb4c48cb7bcfdf19e63557a388572d3a6335aa39191319691d924e27f70da3f3495387c319396476c63a8fd7b35835cca0901220e39783847b
SSDEEP 96:HiTgM1+XSNEzA0HtYQstYCpCwZQpCeyk5HQJM9ouvj9urz8:Ew9EmtYQstYCPC9e8
TLSH
T191E1026F68DFDEE03A732651B2B3698D6919C29A136F1CF0F869084B47635016377A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.xml

Path C:\Windows\TEMP\{118FA235-86EC-4321-B5F3-E5BC80A6BF47}\.ba\thm.xml
Size 11KB
SHA256 dfee8e2d075087227f19c835c145c5bb8e72a46880ea24080bb2472fd3a521be
MD5 4329e418dc56b1386d7ea29a0dcfab5b
SHA1 58387f92e89ca21b4179fb697c7de9675c59142f
SHA512 6934873d27e6efbb94da4f13ee8369b29995490051016fdf82800256b924902306d328bf1d4ebbf266d1a53eb24adb6478d1a67de4ecc3e3bcbe561968f24922
SSDEEP 96:HgvPkoeWEH3IWTaQfSJgHzth5mFahbuB8pR5+Vpwe+UIJLg1gEp+6F5pQnxc:AvoWydmQfVHMyyj5Z
TLSH
T14B42FC6851DC7811C532D702AB9371D3FF12BDA6C6C85A58B48E256B1FF262028B739C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixstdba.exe

Path C:\Windows\Temp\{118FA235-86EC-4321-B5F3-E5BC80A6BF47}\.ba\wixstdba.exe
Size 431KB
SHA256 2b1cee5e3e24593247854eb7a7c4308937b9c607754ed2fb83520a8706c26f1e
MD5 0e88ffd2e737ac9b9a4241616838bc23
SHA1 3c8beb465d20bcef0cd6ceca9c60286d1d15cebd
SHA512 169b9e08518834c9bc5adfe4ab7b79e07685b72f30ede1c1a386229668bde8c15da378e1274e4013ad7b84d6f7a5acc64ef0806e3b8a66322861efaa7e26b620
SSDEEP 6144:X9vfS1NP+c3ytxmg4Stlqe3B9m2LSLTwGw7C3ZLaov5xZvSdF:X9v+GIyugllqe3wwGfX5/SdF
TLSH
T129943B3165F04037C6F90572AE14FA31BF69F208231095EBA3C0DD293968AE5BBB7657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windowsdesktop-runtime-10.0.10-win-x64.exe

Path C:\Windows\Temp\{118FA235-86EC-4321-B5F3-E5BC80A6BF47}\.be\windowsdesktop-runtime-10.0.10-win-x64.exe
Size 967KB
SHA256 47b74e25c31fceb862dcc4496af4dcce01823094997aba1e88eb936013ffc2f8
MD5 0f57602b1b78b077a5b0e996ef306a7d
SHA1 4c86ca072878cf03f66be4dc721a02d5c6fe76d2
SHA512 b28e50f9ef8debb5e25af797cc9a7ed6882f08425c595ce36eb6d48e0b703c17f619151d84a6d1b8dd8b5f7affc231c19790c46d6224b94279de5a5c568aa1a2
SSDEEP 12288:OVGWl6qCmyZeU6lqlDjC+fScn6X8GwMgJEkqd68Wr//f0ZoiDqIMjFqs:OVGWl6qCmyt6UdmcpMzrI58lDqPxr
TLSH
T1B4257D31A166242BD6F50973F914D2307E28D7082B5C99B6C6C0DD0D39689FA6FFB24B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1100-8385-0x0000018C73EC0000-0x0000018C743BE000-memory.dmp

Download

memory/1100-7932-0x0000018C73EC0000-0x0000018C743BE000-memory.dmp

Download

memory/1100-5734-0x0000018C73EC0000-0x0000018C743BE000-memory.dmp

Download

memory/1100-5425-0x0000018C73EC0000-0x0000018C743BE000-memory.dmp

Download

memory/1100-8386-0x0000018C73EC0000-0x0000018C743BE000-memory.dmp

Download

memory/1100-5377-0x0000018C73EC0000-0x0000018C743BE000-memory.dmp

Download

memory/4448-1622-0x00000141D7230000-0x00000141D73DE000-memory.dmp

Download

memory/4724-3733-0x00000000009F0000-0x0000000000AB6000-memory.dmp

Download

memory/4908-3745-0x000001D3D2B00000-0x000001D3D3028000-memory.dmp

Download

memory/4908-3743-0x000001D3D1F60000-0x000001D3D1F82000-memory.dmp

Download

memory/4908-3744-0x000001D3D2400000-0x000001D3D25C2000-memory.dmp

Download

memory/5248-1015-0x0000023ED9230000-0x0000023ED9231000-memory.dmp

Download

memory/5248-1013-0x0000023ED9200000-0x0000023ED9201000-memory.dmp

Download

memory/5248-981-0x0000023EC8D90000-0x0000023EC8DA0000-memory.dmp

Download

memory/5248-997-0x0000023EC8E90000-0x0000023EC8EA0000-memory.dmp

Download

memory/5248-1017-0x0000023ED9340000-0x0000023ED9341000-memory.dmp

Download

memory/5248-1016-0x0000023ED9230000-0x0000023ED9231000-memory.dmp

Download

memory/7636-8529-0x00007FF9653A0000-0x00007FF9653A1000-memory.dmp

Download

memory/9040-8411-0x000002451D100000-0x000002451D5FE000-memory.dmp

Download

memory/9040-8389-0x000002451D100000-0x000002451D5FE000-memory.dmp

Download

memory/9872-8451-0x00007FF9653A0000-0x00007FF9653A1000-memory.dmp

Download

memory/9872-8638-0x00000238C2C30000-0x00000238C2C5F000-memory.dmp

Download

memory/9964-8530-0x00007FF964C00000-0x00007FF964C01000-memory.dmp

Download

memory/9964-8531-0x00007FF964430000-0x00007FF964431000-memory.dmp

Download