Overview
overview
8Static
static
3Velocity.7z
windows10-2004-x64
1Microsoft....re.dll
windows10-2004-x64
1Microsoft....re.xml
windows10-2004-x64
3Microsoft....ms.dll
windows10-2004-x64
1Microsoft....ms.xml
windows10-2004-x64
3Microsoft....pf.dll
windows10-2004-x64
1Microsoft....pf.xml
windows10-2004-x64
3Microsoft....ET.dll
windows10-2004-x64
1VelocityApi.dll
windows10-2004-x64
1VelocityApi.pdb
windows10-2004-x64
3VelocityLi...s.json
windows10-2004-x64
3VelocityLite.exe
windows10-2004-x64
1VelocityLite.exe
windows10-2004-x64
8VelocityLite.pdb
windows10-2004-x64
3VelocityLi...g.json
windows10-2004-x64
3WinRT.Runtime.dll
windows10-2004-x64
1XamlAnimatedGif.dll
windows10-2004-x64
1runtimes/w...er.dll
windows10-2004-x64
1runtimes/w...er.dll
windows10-2004-x64
3Analysis
- max time kernel
119s - max time network
123s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
12/09/2026, 15:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Velocity.7z
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
120 seconds
Behavioral task
behavioral2
Sample
Microsoft.Web.WebView2.Core.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
120 seconds
Behavioral task
behavioral3
Sample
Microsoft.Web.WebView2.Core.xml
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
120 seconds
Behavioral task
behavioral4
Sample
Microsoft.Web.WebView2.WinForms.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
120 seconds
Behavioral task
behavioral5
Sample
Microsoft.Web.WebView2.WinForms.xml
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
120 seconds
Behavioral task
behavioral6
Sample
Microsoft.Web.WebView2.Wpf.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
120 seconds
Behavioral task
behavioral7
Sample
Microsoft.Web.WebView2.Wpf.xml
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
120 seconds
Behavioral task
behavioral8
Sample
Microsoft.Windows.SDK.NET.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
120 seconds
Behavioral task
behavioral9
Sample
VelocityApi.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
120 seconds
Behavioral task
behavioral10
Sample
VelocityApi.pdb
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
120 seconds
Behavioral task
behavioral11
Sample
VelocityLite.deps.json
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
120 seconds
Behavioral task
behavioral12
Sample
VelocityLite.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
120 seconds
Behavioral task
behavioral13
Sample
VelocityLite.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
12 signatures
120 seconds
Behavioral task
behavioral14
Sample
VelocityLite.pdb
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
120 seconds
Behavioral task
behavioral15
Sample
VelocityLite.runtimeconfig.json
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
120 seconds
Behavioral task
behavioral16
Sample
WinRT.Runtime.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
120 seconds
Behavioral task
behavioral17
Sample
XamlAnimatedGif.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
120 seconds
Behavioral task
behavioral18
Sample
runtimes/win-x64/native/WebView2Loader.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
120 seconds
Behavioral task
behavioral19
Sample
runtimes/win-x86/native/WebView2Loader.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
120 seconds
General
- Target Microsoft.Web.WebView2.Core.xml
- Size 566KB
- Sample260912-tdf2saec22
- SHA256 d2e44139c2e8e30fecb99112516964143be130c58960a2c65cabc6a2a7c35ca0
- MD5 d1757131496940abcc30af78d34598a3
- SHA1 446944afcdfaee9c22320e1f80e9ff43de92e6fc
- SHA512 c779c90b4e6b6d54bd745954185659e9eb5c76e72cb2222f373a3b0d3ad3de4307a5b306e6832a4d721b2da3836851b05655c6e90f944488674cddbc5cb66ae6
- SSDEEP 12288:rWynTLhgqUDx4OfmwT2DRG3Vt5InEvs//BKoeUvSRyGOtQ/AgJSeLdLGz40cS+jw:CNcoUCF2
- TLSH T1FDC43F01668CD6310DF50ACA69B8B6D8FF2D666731D3AA21348C0F570F739A2E1BF591
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31277969" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\UpgradeTime = 16fc18bd3942dd01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "361139557" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTTopResultURL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IENTTR" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\SuggestionsURLFallback = "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}§ionHeight={ie:sectionHeight}&FORM=IE8SSC&market={language}" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\User Preferences iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\URL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\User Preferences\2BB20B33B4171CDAAB6469225AE6A582ED33D7B488 = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000053a5c49a9d82d8449ce7d7575a6bd78800000000020000000000106600000001000020000000f55e09ebe78c292c9ff76e2477f779f24aafb3eacff202372e055a81dfd55db7000000000e80000000020000200000006890ceca34fbb0e38abd60cecbc673df93df6a5f95cf098ac285b8ef966b053d10000000821065fc3c779804efaac1bd02e34a4f4000000045726c1a175d5b71241bd541fbba145f01d0a103d6bb9454b312e01969447ccb1c53879f9c265b02ba008b740c5186c93153d8147845dfff7a10efb75f72d613 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconURLFallback = "http://www.bing.com/favicon.ico" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTSuggestionsURL = "http://api.bing.com/qsml.aspx?query={searchTerms}&market={language}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}§ionHeight={ie:sectionHeight}&FORM=IENTSS" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTLogoURL = "http://go.microsoft.com/fwlink/?LinkID=403856&language={language}&scale={scalelevel}&contrast={contrast}" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTLogoPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3327137" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000053a5c49a9d82d8449ce7d7575a6bd788000000000200000000001066000000010000200000009648332cf8d256cc56b5327b8ff0ed05a025e00d0ba517937165fb6b1b85ab1d000000000e8000000002000020000000af279c11b2409f0f027f6656e91a5a1e2f94264d8d13919dce96dd0f3aab052620000000d36191b0224a78a05dd233ed55027ce81ca2f04fd3a8e1801d07ad8ed5266fdc400000002afea53f63f5e5d872c7cbbe9bcec5ba5be05a8d7d41052cb9a0b926a4f9e9474a8f642ca115820ec3e9f0e0d43ec68ddcdd940e1a5620e27e13ada09a25ea06 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\DisplayName = "Bing" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconURL = "http://www.bing.com/favicon.ico" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTURL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IENTSR" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31277969" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\Version = "5" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\SuggestionsURL = "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}§ionHeight={ie:sectionHeight}&FORM=IE8SSC&market={language}" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 402a86629943dd01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{2AD14430-AF84-11F1-B7E7-C6B1AE79E33D} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\User Preferences\3DB9590C4C4C26C4CCBDD94ECAD790359708C3267B = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000053a5c49a9d82d8449ce7d7575a6bd78800000000020000000000106600000001000020000000db07e1b33fd0c7d6b87ddcc0605a0b520941360d36990effb7d1a8b4da300321000000000e80000000020000200000003161c76afb516f4a0dff9042b86ce462eb0bbd29083e4f50a66f3e42ceddf52b500000009c8e619e8a2c6140392d79cf0f39cb3d74102c6ab593f543fdc809d93af98f6a73f78e2209ffb5182a9352014bacec59f54127d27d78df469c4b08c5ff252a8e72d84f51497e0a6a15ab50cfe210eaba40000000d5f7ff90dac36c88bd86a4dd30d63796d09a6fec0ae19f74680db468b6d440a4532a11d9846831e50e0c5f66f7881cb27d9c6d5d858f5baf460bd519227714dd iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000053a5c49a9d82d8449ce7d7575a6bd7880000000002000000000010660000000100002000000050d3439300022bb0fdba89052d054e7c50be3af214d81156ed7042b0e2cc7a60000000000e8000000002000020000000782156adfd7919f102d8eac41dd0a63e2f0b377967727380f004365747e5945d20000000b5e861cec9be0c6655e40b8800848dcb5aad69b564160d7973d16ddbdf02c54f4000000022334a68ee073a8217cd2b63c3ddbf26c4e69d3c7b083ad97a5ac6fbf92d1a361b81990d745e9507842b34f95decdb18e4380622832b4b8f57056f3963370265 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20a08f629943dd01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "496076737" iexplore.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1604 iexplore.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1604 iexplore.exe 1604 iexplore.exe 5048 IEXPLORE.EXE 5048 IEXPLORE.EXE 5048 IEXPLORE.EXE 5048 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2600 wrote to memory of 1604 2600 MSOXMLED.EXE 81 PID 1604 wrote to memory of 5048 1604 iexplore.exe 86
Processes
-
C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\Microsoft.Web.WebView2.Core.xml"1⤵
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft.Web.WebView2.Core.xml2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1604 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:5048
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
- Size 471B
- SHA256 4e7a238af8cdf358b0b95ec7d9de2ccfd81b9c245944f0833125e22ecd0ac662
- MD5 cd9a639522269bdc8f64cca5ee9261ae
- SHA1 66e7c3aec64d16c772caf7f7b2db671daf34b4f0
- SHA512 c24073e9639f874f6e6fa8a82f0cf473ed45ede2955b33043d400e4c785ec2ca2db09949abaf4c4c707995ffdf99a6e30d702d230a4d97f2133fc00af591a44e
- TLSH T129F0975164BDD8F26A8024CC12E48FFE7025A0B720811099917C8AF2874AFBFBA1E03C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
- Size 416B
- SHA256 267fb04275ee6a83312084cba1f291285bc699ab54c00b753c091941082f052c
- MD5 94473ebb4feb48d60c66fb7c9252f1f1
- SHA1 1efb0499fe4ea6a90545f08d4fed57ab63be6cc4
- SHA512 9ce7e7a56dd010a307f1911fd5379788c45478f3fb4805d9f7de628b0c6aec7095895dac7c8055d1e41964fb5708cf8f4be87ec473f845d9aa7c83ca032e7bd0
- TLSH T19DE0C03822FA011EE0F8E0358BD674228869F236142EA2F42DC48B04F703BC09D02A36
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
- Size 4KB
- SHA256 5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
- MD5 da597791be3b6e732f0bc8b20e38ee62
- SHA1 1125c45d285c360542027d7554a5c442288974de
- SHA512 d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e
- SSDEEP 24:suZOWcCXPRS4QAUs/KBy3TYI42Apvl6wheXpktCH2Yn4KgISQggggFpz1k9PAYHu:HBRh+sCBykteatiBn4KWi1+Ne
- TLSH T1B9919C8A6AF4CD28CE621D24C53C52FD016BDE1DD19C2087D9E67F92323B96F91232C5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\SZA3OMON\suggestions[1].en-US
- Size 17KB
- SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
- MD5 5a34cb996293fde2cb7a4ac89587393a
- SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
- SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
- SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
- TLSH T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
- MD5 SHA1 SHA512 SSDEEP TLSH