48f1689eb31a2ab45ff2fd45d04ef231be843e4500664ac9a6cee8efbadebc5a

Analysis

user interaction
yes
max time kernel
144s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/11/2026, 18:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Velocity.exe
Size 34.5MB
Sample261107-w3bjpse15q
SHA256 48f1689eb31a2ab45ff2fd45d04ef231be843e4500664ac9a6cee8efbadebc5a
MD5 4c97c96c77a567df0aa6806a19255619
SHA1 56b5a0e8a3f57a2818ea35f2f945cbcb2f0164e6
SHA512 0126c7ed05d07ff85f255c204d6a0d6c58700d860b5d40946f39ea6696ddaafcf300c8ddcfa6a4be4828c41219fc4b077e74533bb6ad691e4a6c3f7abb422eb9
SSDEEP 393216:zuOZ/WRuuO+hHsPq7aMaO971yI5hFqAFLKnCTMGPjH:zuOZ/7LcHsg97hhCCTMGbH
TLSH
T18487AE2293A44E3DC99F6773E4B203254335CA06AB4393EE581C969D1F933460B69BF7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
99	4812	msedge.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	windowsdesktop-runtime-10.0.14-win-x64.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	windowsdesktop-runtime-10.0.14-win-x64.exe

Executes dropped EXE 7 IoCs

pid	Process
5748	windowsdesktop-runtime-10.0.14-win-x64.exe
1480	wixstdba.exe
4300	windowsdesktop-runtime-10.0.14-win-x64.exe
1544	windowsdesktop-runtime-10.0.14-win-x64.exe
2544	windowsdesktop-runtime-10.0.14-win-x64.exe
4968	wixstdba.exe
212	windowsdesktop-runtime-10.0.14-win-x64.exe

Loads dropped DLL 10 IoCs

pid	Process
3848	MsiExec.exe
3848	MsiExec.exe
5224	MsiExec.exe
5224	MsiExec.exe
5988	MsiExec.exe
5988	MsiExec.exe
6032	MsiExec.exe
6032	MsiExec.exe
2168	MsiExec.exe
2168	MsiExec.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{29A18B06-B190-4463-9FFC-BC0D70D80B7C} = "\"C:\\ProgramData\\Package Cache\\{29A18B06-B190-4463-9FFC-BC0D70D80B7C}\\windowsdesktop-runtime-10.0.14-win-x64.exe\" /burn.runonce"	windowsdesktop-runtime-10.0.14-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{29A18B06-B190-4463-9FFC-BC0D70D80B7C} = "\"C:\\ProgramData\\Package Cache\\{29A18B06-B190-4463-9FFC-BC0D70D80B7C}\\windowsdesktop-runtime-10.0.14-win-x64.exe\" /burn.runonce"	windowsdesktop-runtime-10.0.14-win-x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\pt-BR\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.14\System.ObjectModel.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.14\System.Runtime.Handles.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.14\System.Security.Principal.Windows.dll	msiexec.exe
File created	C:\Program Files\msedge_url_fetcher_4376_1871120602\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_111_1_0.crx	msedge.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\.version	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\ja\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\tr\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.14\System.Threading.Tasks.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\ja\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\ThirdPartyNotices.txt	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.14\System.IO.dll	msiexec.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4376_1469802678\_locales\en_CA\messages.json	msedge.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\ru\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.14\System.Diagnostics.Tracing.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.14\WindowsBase.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\de\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\ru\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\zh-Hans\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.14\System.Collections.Concurrent.dll	msiexec.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4376_1469802678\_locales\pa\messages.json	msedge.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\ko\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.14\System.Reflection.Emit.Lightweight.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\fr\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.14\System.Runtime.Loader.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\PresentationFramework.Luna.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\de\WindowsBase.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\pt-BR\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\ru\UIAutomationTypes.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\cs\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\ja\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.14\System.Runtime.Serialization.Formatters.dll	msiexec.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4376_1469802678\_locales\no\messages.json	msedge.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\PresentationFramework-SystemCore.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\PresentationNative_cor3.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\System.Diagnostics.PerformanceCounter.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\System.Formats.Nrbf.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.14\System.Net.Http.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.14\System.Net.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\System.Windows.Primitives.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\de\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\pt-BR\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\pt-BR\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\cs\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\it\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4376_1469802678\_locales\kk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4376_1469802678\_locales\fi\messages.json	msedge.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\de\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\tr\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.14\System.Security.dll	msiexec.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4376_1469802678\page_embed_script.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4376_1469802678\_locales\eu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4376_1469802678\_locales\sq\messages.json	msedge.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.14\System.Numerics.Vectors.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.14\System.Runtime.Extensions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\System.DirectoryServices.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\cs\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\de\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.14\System.Transactions.Local.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.14\System.Collections.NonGeneric.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.14\System.Net.Requests.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\PresentationFramework.Fluent.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\System.Windows.Forms.Design.Editors.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.14\es\UIAutomationClient.resources.dll	msiexec.exe

Drops file in Windows directory 38 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSID252.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEADD.tmp	msiexec.exe
File created	C:\Windows\Installer\e59ba24.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8A8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149\fileCoreHostExe	msiexec.exe
File created	C:\Windows\Installer\SourceHash{3887007B-C74B-4DF7-8155-F3838C013D2C}	msiexec.exe
File created	C:\Windows\Installer\e59ba1a.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC251.tmp	msiexec.exe
File created	C:\Windows\Installer\e59ba1f.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{64BFC674-D664-480B-AFF2-D47C5531D6D2}	msiexec.exe
File opened for modification	C:\Windows\Installer\e59ba0f.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBF60.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID522.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC446.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e59ba20.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6A4.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e59ba16.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDCA.tmp	msiexec.exe
File created	C:\Windows\Installer\e59ba0f.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149	msiexec.exe
File created	C:\Windows\Installer\e59ba15.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC1A4.tmp	msiexec.exe
File created	C:\Windows\Installer\e59ba1b.msi	msiexec.exe
File created	C:\Windows\Installer\e59ba20.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBB47.tmp	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149\fileCoreHostExe	msiexec.exe
File opened for modification	C:\Windows\Installer\e59ba1b.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE48.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBCEE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1	msiexec.exe
File created	C:\Windows\Installer\e59ba16.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC0F8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC6B8.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{7A1A9C6B-1386-478E-9C35-7242968A5634}	msiexec.exe
File created	C:\Windows\Installer\SourceHash{941B1F64-FCD9-4C40-B927-E75F49DD96D8}	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.14-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wixstdba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.14-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.14-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wixstdba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.14-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.14-win-x64.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4812	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 11 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2B	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A8A84F1AA6E5EFD5BE00C8237B84D6D4	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.56.61678_x64\ = "{3887007B-C74B-4DF7-8155-F3838C013D2C}"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\46F1B1499DCF04C49B727EF594DD698D\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\476CFB46466DB084FA2F4DC755136D2D\Provider	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\476CFB46466DB084FA2F4DC755136D2D\Version = "1345908974"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B7007883B47C7FD418553F38C810D3C2\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{3887007B-C74B-4DF7-8155-F3838C013D2C}v80.56.61678\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\46F1B1499DCF04C49B727EF594DD698D\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{941B1F64-FCD9-4C40-B927-E75F49DD96D8}v80.56.61678\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\dotnet_runtime_80.56.61678_x64	windowsdesktop-runtime-10.0.14-win-x64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2091445952-3649787497-104050984-1000\{9206759A-0836-41B4-9768-90F69572187E}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B6C9A1A76831E874C953272469A86543	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x64\Dependents	windowsdesktop-runtime-10.0.14-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B7007883B47C7FD418553F38C810D3C2\MainFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\46F1B1499DCF04C49B727EF594DD698D\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_80.56.61678_x64\Dependents\{29A18B06-B190-4463-9FFC-BC0D70D80B7C}	windowsdesktop-runtime-10.0.14-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\476CFB46466DB084FA2F4DC755136D2D\SourceList\PackageName = "windowsdesktop-runtime-10.0.14-win-x64.msi"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6C9A1A76831E874C953272469A86543\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\476CFB46466DB084FA2F4DC755136D2D\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\476CFB46466DB084FA2F4DC755136D2D\SourceList\Media\1 = ";"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B7007883B47C7FD418553F38C810D3C2\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\476CFB46466DB084FA2F4DC755136D2D\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{64BFC674-D664-480B-AFF2-D47C5531D6D2}v80.56.61678\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6C9A1A76831E874C953272469A86543\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{29A18B06-B190-4463-9FFC-BC0D70D80B7C}\Version = "10.0.14.50000"	windowsdesktop-runtime-10.0.14-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\476CFB46466DB084FA2F4DC755136D2D\ProductName = "Microsoft Windows Desktop Runtime - 10.0.14 (x64)"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x64\Dependents\{29A18B06-B190-4463-9FFC-BC0D70D80B7C}	windowsdesktop-runtime-10.0.14-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B7007883B47C7FD418553F38C810D3C2\ProductName = "Microsoft .NET Host FX Resolver - 10.0.14 (x64)"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B7007883B47C7FD418553F38C810D3C2\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_80.56.61678_x64\Version = "80.56.61678"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\46F1B1499DCF04C49B727EF594DD698D\MainFeature	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\46F1B1499DCF04C49B727EF594DD698D\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\46F1B1499DCF04C49B727EF594DD698D\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{29A18B06-B190-4463-9FFC-BC0D70D80B7C}\DisplayName = "Microsoft Windows Desktop Runtime 10.0.14 (x64)"	windowsdesktop-runtime-10.0.14-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6C9A1A76831E874C953272469A86543\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.56.61678_x64\Dependents\{29A18B06-B190-4463-9FFC-BC0D70D80B7C}	windowsdesktop-runtime-10.0.14-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6C9A1A76831E874C953272469A86543	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.56.61678_x64	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B7007883B47C7FD418553F38C810D3C2\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\007A2BFF36C5CA36A6411A17467A45A8	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{29A18B06-B190-4463-9FFC-BC0D70D80B7C}	windowsdesktop-runtime-10.0.14-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6C9A1A76831E874C953272469A86543\ProductName = "Microsoft .NET Host - 10.0.14 (x64)"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6C9A1A76831E874C953272469A86543\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B7007883B47C7FD418553F38C810D3C2\Provider	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B7007883B47C7FD418553F38C810D3C2\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B7007883B47C7FD418553F38C810D3C2\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\E722D4588785E715C945C436088B77AA\476CFB46466DB084FA2F4DC755136D2D	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.56.61678_x64\Version = "80.56.61678"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_80.56.61678_x64\Dependents\{29A18B06-B190-4463-9FFC-BC0D70D80B7C}	windowsdesktop-runtime-10.0.14-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_80.56.61678_x64\DisplayName = "Microsoft Windows Desktop Runtime - 10.0.14 (x64)"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\476CFB46466DB084FA2F4DC755136D2D\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x64	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A8A84F1AA6E5EFD5BE00C8237B84D6D4\B6C9A1A76831E874C953272469A86543	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\476CFB46466DB084FA2F4DC755136D2D\MainFeature	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\476CFB46466DB084FA2F4DC755136D2D\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\476CFB46466DB084FA2F4DC755136D2D\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{64BFC674-D664-480B-AFF2-D47C5531D6D2}v80.56.61678\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_80.56.61678_x64\Dependents\{29A18B06-B190-4463-9FFC-BC0D70D80B7C}	windowsdesktop-runtime-10.0.14-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6C9A1A76831E874C953272469A86543\Version = "1345908974"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{29A18B06-B190-4463-9FFC-BC0D70D80B7C}\Version = "10.0.14.50000"	windowsdesktop-runtime-10.0.14-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6C9A1A76831E874C953272469A86543\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6C9A1A76831E874C953272469A86543\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{7A1A9C6B-1386-478E-9C35-7242968A5634}v80.56.61678\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.56.61678_x64\DisplayName = "Microsoft .NET Host FX Resolver - 10.0.14 (x64)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\9CB77BF103B5F05757987B6130E13954\B7007883B47C7FD418553F38C810D3C2	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\46F1B1499DCF04C49B727EF594DD698D\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{941B1F64-FCD9-4C40-B927-E75F49DD96D8}v80.56.61678\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\E722D4588785E715C945C436088B77AA	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_80.56.61678_x64\Version = "80.56.61678"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B7007883B47C7FD418553F38C810D3C2\SourceList\Media	msiexec.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4344	msiexec.exe
4344	msiexec.exe
4344	msiexec.exe
4344	msiexec.exe
4344	msiexec.exe
4344	msiexec.exe
4344	msiexec.exe
4344	msiexec.exe
4344	msiexec.exe
4344	msiexec.exe
4344	msiexec.exe
4344	msiexec.exe
4344	msiexec.exe
4344	msiexec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4300	windowsdesktop-runtime-10.0.14-win-x64.exe
Token: SeIncreaseQuotaPrivilege	4300	windowsdesktop-runtime-10.0.14-win-x64.exe
Token: SeSecurityPrivilege	4344	msiexec.exe
Token: SeCreateTokenPrivilege	4300	windowsdesktop-runtime-10.0.14-win-x64.exe
Token: SeAssignPrimaryTokenPrivilege	4300	windowsdesktop-runtime-10.0.14-win-x64.exe
Token: SeLockMemoryPrivilege	4300	windowsdesktop-runtime-10.0.14-win-x64.exe
Token: SeIncreaseQuotaPrivilege	4300	windowsdesktop-runtime-10.0.14-win-x64.exe
Token: SeMachineAccountPrivilege	4300	windowsdesktop-runtime-10.0.14-win-x64.exe
Token: SeTcbPrivilege	4300	windowsdesktop-runtime-10.0.14-win-x64.exe
Token: SeSecurityPrivilege	4300	windowsdesktop-runtime-10.0.14-win-x64.exe
Token: SeTakeOwnershipPrivilege	4300	windowsdesktop-runtime-10.0.14-win-x64.exe
Token: SeLoadDriverPrivilege	4300	windowsdesktop-runtime-10.0.14-win-x64.exe
Token: SeSystemProfilePrivilege	4300	windowsdesktop-runtime-10.0.14-win-x64.exe
Token: SeSystemtimePrivilege	4300	windowsdesktop-runtime-10.0.14-win-x64.exe
Token: SeProfSingleProcessPrivilege	4300	windowsdesktop-runtime-10.0.14-win-x64.exe
Token: SeIncBasePriorityPrivilege	4300	windowsdesktop-runtime-10.0.14-win-x64.exe
Token: SeCreatePagefilePrivilege	4300	windowsdesktop-runtime-10.0.14-win-x64.exe
Token: SeCreatePermanentPrivilege	4300	windowsdesktop-runtime-10.0.14-win-x64.exe
Token: SeBackupPrivilege	4300	windowsdesktop-runtime-10.0.14-win-x64.exe
Token: SeRestorePrivilege	4300	windowsdesktop-runtime-10.0.14-win-x64.exe
Token: SeShutdownPrivilege	4300	windowsdesktop-runtime-10.0.14-win-x64.exe
Token: SeDebugPrivilege	4300	windowsdesktop-runtime-10.0.14-win-x64.exe
Token: SeAuditPrivilege	4300	windowsdesktop-runtime-10.0.14-win-x64.exe
Token: SeSystemEnvironmentPrivilege	4300	windowsdesktop-runtime-10.0.14-win-x64.exe
Token: SeChangeNotifyPrivilege	4300	windowsdesktop-runtime-10.0.14-win-x64.exe
Token: SeRemoteShutdownPrivilege	4300	windowsdesktop-runtime-10.0.14-win-x64.exe
Token: SeUndockPrivilege	4300	windowsdesktop-runtime-10.0.14-win-x64.exe
Token: SeSyncAgentPrivilege	4300	windowsdesktop-runtime-10.0.14-win-x64.exe
Token: SeEnableDelegationPrivilege	4300	windowsdesktop-runtime-10.0.14-win-x64.exe
Token: SeManageVolumePrivilege	4300	windowsdesktop-runtime-10.0.14-win-x64.exe
Token: SeImpersonatePrivilege	4300	windowsdesktop-runtime-10.0.14-win-x64.exe
Token: SeCreateGlobalPrivilege	4300	windowsdesktop-runtime-10.0.14-win-x64.exe
Token: SeRestorePrivilege	4344	msiexec.exe
Token: SeTakeOwnershipPrivilege	4344	msiexec.exe
Token: SeRestorePrivilege	4344	msiexec.exe
Token: SeTakeOwnershipPrivilege	4344	msiexec.exe
Token: SeRestorePrivilege	4344	msiexec.exe
Token: SeTakeOwnershipPrivilege	4344	msiexec.exe
Token: SeRestorePrivilege	4344	msiexec.exe
Token: SeTakeOwnershipPrivilege	4344	msiexec.exe
Token: SeRestorePrivilege	4344	msiexec.exe
Token: SeTakeOwnershipPrivilege	4344	msiexec.exe
Token: SeRestorePrivilege	4344	msiexec.exe
Token: SeTakeOwnershipPrivilege	4344	msiexec.exe
Token: SeRestorePrivilege	4344	msiexec.exe
Token: SeTakeOwnershipPrivilege	4344	msiexec.exe
Token: SeRestorePrivilege	4344	msiexec.exe
Token: SeTakeOwnershipPrivilege	4344	msiexec.exe
Token: SeRestorePrivilege	4344	msiexec.exe
Token: SeTakeOwnershipPrivilege	4344	msiexec.exe
Token: SeRestorePrivilege	4344	msiexec.exe
Token: SeTakeOwnershipPrivilege	4344	msiexec.exe
Token: SeRestorePrivilege	4344	msiexec.exe
Token: SeTakeOwnershipPrivilege	4344	msiexec.exe
Token: SeRestorePrivilege	4344	msiexec.exe
Token: SeTakeOwnershipPrivilege	4344	msiexec.exe
Token: SeRestorePrivilege	4344	msiexec.exe
Token: SeTakeOwnershipPrivilege	4344	msiexec.exe
Token: SeRestorePrivilege	4344	msiexec.exe
Token: SeTakeOwnershipPrivilege	4344	msiexec.exe
Token: SeRestorePrivilege	4344	msiexec.exe
Token: SeTakeOwnershipPrivilege	4344	msiexec.exe
Token: SeRestorePrivilege	4344	msiexec.exe
Token: SeTakeOwnershipPrivilege	4344	msiexec.exe

Suspicious use of FindShellTrayWindow 15 IoCs

pid	Process
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
1480	wixstdba.exe
4968	wixstdba.exe

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 1060 wrote to memory of 4376	1060	Velocity.exe	104
PID 4376 wrote to memory of 1300	4376	msedge.exe	105
PID 4376 wrote to memory of 4812	4376	msedge.exe	106
PID 4376 wrote to memory of 3976	4376	msedge.exe	107
PID 4376 wrote to memory of 3976	4376	msedge.exe	107
PID 4376 wrote to memory of 3976	4376	msedge.exe	107
PID 4376 wrote to memory of 1532	4376	msedge.exe	108
PID 4376 wrote to memory of 1532	4376	msedge.exe	108
PID 4376 wrote to memory of 2800	4376	msedge.exe	109
PID 4376 wrote to memory of 1720	4376	msedge.exe	110
PID 4376 wrote to memory of 2800	4376	msedge.exe	109
PID 4376 wrote to memory of 2800	4376	msedge.exe	109
PID 4376 wrote to memory of 1720	4376	msedge.exe	110
PID 4376 wrote to memory of 1720	4376	msedge.exe	110
PID 4376 wrote to memory of 2216	4376	msedge.exe	115
PID 4376 wrote to memory of 2216	4376	msedge.exe	115
PID 4376 wrote to memory of 2216	4376	msedge.exe	115
PID 4376 wrote to memory of 5648	4376	msedge.exe	116
PID 4376 wrote to memory of 4784	4376	msedge.exe	117
PID 4376 wrote to memory of 5648	4376	msedge.exe	116
PID 4376 wrote to memory of 4784	4376	msedge.exe	117
PID 4376 wrote to memory of 4784	4376	msedge.exe	117
PID 4376 wrote to memory of 4792	4376	msedge.exe	118
PID 4376 wrote to memory of 1004	4376	msedge.exe	119
PID 4376 wrote to memory of 4792	4376	msedge.exe	118
PID 4376 wrote to memory of 1004	4376	msedge.exe	119
PID 4376 wrote to memory of 6100	4376	msedge.exe	122
PID 4376 wrote to memory of 4836	4376	msedge.exe	123
PID 4376 wrote to memory of 5748	4376	msedge.exe	126
PID 5748 wrote to memory of 1480	5748	windowsdesktop-runtime-10.0.14-win-x64.exe	128
PID 5748 wrote to memory of 4300	5748	windowsdesktop-runtime-10.0.14-win-x64.exe	129
PID 4344 wrote to memory of 3848	4344	msiexec.exe	131
PID 1544 wrote to memory of 2544	1544	windowsdesktop-runtime-10.0.14-win-x64.exe	134
PID 4344 wrote to memory of 5224	4344	msiexec.exe	137
PID 4344 wrote to memory of 5988	4344	msiexec.exe	139
PID 2544 wrote to memory of 4968	2544	windowsdesktop-runtime-10.0.14-win-x64.exe	141
PID 4344 wrote to memory of 6032	4344	msiexec.exe	142
PID 4376 wrote to memory of 2236	4376	msedge.exe	143
PID 4376 wrote to memory of 4892	4376	msedge.exe	144
PID 4376 wrote to memory of 1920	4376	msedge.exe	145
PID 4376 wrote to memory of 6064	4376	msedge.exe	146
PID 4376 wrote to memory of 6064	4376	msedge.exe	146
PID 4376 wrote to memory of 4832	4376	msedge.exe	147
PID 4376 wrote to memory of 4832	4376	msedge.exe	147
PID 2544 wrote to memory of 212	2544	windowsdesktop-runtime-10.0.14-win-x64.exe	148
PID 4344 wrote to memory of 2168	4344	msiexec.exe	150
PID 4376 wrote to memory of 1152	4376	msedge.exe	152
PID 4376 wrote to memory of 1152	4376	msedge.exe	152
PID 4376 wrote to memory of 1596	4376	msedge.exe	155
PID 4376 wrote to memory of 1596	4376	msedge.exe	155
PID 4376 wrote to memory of 1596	4376	msedge.exe	155
PID 4376 wrote to memory of 1960	4376	msedge.exe	161
PID 4376 wrote to memory of 1960	4376	msedge.exe	161
PID 4376 wrote to memory of 4896	4376	msedge.exe	165
PID 4376 wrote to memory of 4896	4376	msedge.exe	165

C:\Users\Admin\AppData\Local\Temp\Velocity.exe
"C:\Users\Admin\AppData\Local\Temp\Velocity.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.NETCore.App&framework_version=10.0.0&arch=x64&rid=win-x64&os=win10&gui=true
  2⤵
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2d4,0x7ffe543bc188,0x7ffe543bc194,0x7ffe543bc1a0
    3⤵
    PID:1300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,14530867615039667590,526274853574736209,524288 --field-trial-handle=2248,i,2321827778668686499,6144209721462828959,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:3
    3⤵
    - Downloads MZ/PE file
    - System Time Discovery
    PID:4812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1660,i,5699977709971750314,17359221799420895524,262144 --field-trial-handle=2248,i,2321827778668686499,6144209721462828959,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:2
    3⤵
    PID:3976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2568,i,8907129022914689210,859738774509922934,524288 --field-trial-handle=2248,i,2321827778668686499,6144209721462828959,262144 --variations-seed-version --mojo-platform-channel-handle=2740 /prefetch:8
    3⤵
    PID:1532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3416,i,13026828619201141568,14030894483075773490,2097152 --field-trial-handle=2248,i,2321827778668686499,6144209721462828959,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
    3⤵
    PID:2800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3420,i,2539204014054034377,10036629369822863022,2097152 --field-trial-handle=2248,i,2321827778668686499,6144209721462828959,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
    3⤵
    PID:1720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4768,i,8963351945119472887,6848679269795581815,2097152 --field-trial-handle=2248,i,2321827778668686499,6144209721462828959,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:1
    3⤵
    PID:2216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3476,i,16309667049306238866,6402842565719859365,524288 --field-trial-handle=2248,i,2321827778668686499,6144209721462828959,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:8
    3⤵
    PID:5648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5116,i,9069520143537398660,9999782301607779226,2097152 --field-trial-handle=2248,i,2321827778668686499,6144209721462828959,262144 --variations-seed-version --mojo-platform-channel-handle=4732 /prefetch:1
    3⤵
    PID:4784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5620,i,16728965714527430532,13905073446227064021,524288 --field-trial-handle=2248,i,2321827778668686499,6144209721462828959,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:8
    3⤵
    PID:4792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5604,i,1486423954060418574,9516478916620502490,524288 --field-trial-handle=2248,i,2321827778668686499,6144209721462828959,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:8
    3⤵
    PID:1004
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6452,i,8253423574425380179,10986461481432452450,524288 --field-trial-handle=2248,i,2321827778668686499,6144209721462828959,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:8
    3⤵
    PID:2360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6680,i,11647622824610801712,13792907116212118625,524288 --field-trial-handle=2248,i,2321827778668686499,6144209721462828959,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:8
    3⤵
    PID:6100
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6452,i,8253423574425380179,10986461481432452450,524288 --field-trial-handle=2248,i,2321827778668686499,6144209721462828959,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:8
    3⤵
    PID:4836
- - C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.14-win-x64.exe
    "C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.14-win-x64.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5748
  - - C:\Windows\TEMP\{DBF4331A-959A-4373-B006-C380852F8B13}\.ba\wixstdba.exe
      "C:\Windows\TEMP\{DBF4331A-959A-4373-B006-C380852F8B13}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{9332A06B-850B-49D9-A01B-DAFF577CB985} {ADE9BFF9-D54B-4823-9185-BA4D992EA3D9}
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      PID:1480
  - - C:\Windows\TEMP\{DBF4331A-959A-4373-B006-C380852F8B13}\.be\windowsdesktop-runtime-10.0.14-win-x64.exe
      "C:\Windows\TEMP\{DBF4331A-959A-4373-B006-C380852F8B13}\.be\windowsdesktop-runtime-10.0.14-win-x64.exe" -q -burn.elevated BurnPipe.{F022FAB9-ACFB-4C1E-A4E2-E1F44B140126} {AF318A08-43A6-4BEE-BD3E-385B5B4FB1FE} 5748
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      PID:4300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6732,i,2691186990515765823,11862736494023415084,524288 --field-trial-handle=2248,i,2321827778668686499,6144209721462828959,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:8
    3⤵
    PID:2236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6744,i,5302761955756001961,1658775522933859981,524288 --field-trial-handle=2248,i,2321827778668686499,6144209721462828959,262144 --variations-seed-version --mojo-platform-channel-handle=6880 /prefetch:8
    3⤵
    PID:4892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6716,i,16115711441592607021,12566437077983401946,524288 --field-trial-handle=2248,i,2321827778668686499,6144209721462828959,262144 --variations-seed-version --mojo-platform-channel-handle=6916 /prefetch:8
    3⤵
    PID:1920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=700,i,18184935189451972278,15181813846354425365,524288 --field-trial-handle=2248,i,2321827778668686499,6144209721462828959,262144 --variations-seed-version --mojo-platform-channel-handle=6932 /prefetch:8
    3⤵
    PID:6064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6976,i,6849833679987393058,5588173931165047358,524288 --field-trial-handle=2248,i,2321827778668686499,6144209721462828959,262144 --variations-seed-version --mojo-platform-channel-handle=7004 /prefetch:8
    3⤵
    PID:4832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5640,i,5390257846416953170,17455517176437380143,524288 --field-trial-handle=2248,i,2321827778668686499,6144209721462828959,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:8
    3⤵
    PID:1152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=5824,i,13713451667073865155,3501726208756755921,2097152 --field-trial-handle=2248,i,2321827778668686499,6144209721462828959,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:1
    3⤵
    PID:1596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5008,i,12513548081290687441,10816957049469976990,524288 --field-trial-handle=2248,i,2321827778668686499,6144209721462828959,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:8
    3⤵
    PID:1960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6664,i,8295555302998660380,16007907107385769873,524288 --field-trial-handle=2248,i,2321827778668686499,6144209721462828959,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:8
    3⤵
    PID:4896

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4756

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3824

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4344
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding A0CEF4886A5E1D368C1DB1E9C5BCAFAE
  2⤵
  - Loads dropped DLL
  PID:3848
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 2AD56C77B9C5DD29C0DE759783EB005C
  2⤵
  - Loads dropped DLL
  PID:5224
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 34296D52EE90B03AE48F10C481C568F4
  2⤵
  - Loads dropped DLL
  PID:5988
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding B9EAC8FEC41C579B17BF1C0DE5F78D3F
  2⤵
  - Loads dropped DLL
  PID:6032
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding F38A3F010BDD41F6A83A720D1791C3F7
  2⤵
  - Loads dropped DLL
  PID:2168

C:\ProgramData\Package Cache\{29A18B06-B190-4463-9FFC-BC0D70D80B7C}\windowsdesktop-runtime-10.0.14-win-x64.exe
"C:\ProgramData\Package Cache\{29A18B06-B190-4463-9FFC-BC0D70D80B7C}\windowsdesktop-runtime-10.0.14-win-x64.exe" /burn.runonce
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1544
- C:\ProgramData\Package Cache\{29A18B06-B190-4463-9FFC-BC0D70D80B7C}\windowsdesktop-runtime-10.0.14-win-x64.exe
  "C:\ProgramData\Package Cache\{29A18B06-B190-4463-9FFC-BC0D70D80B7C}\windowsdesktop-runtime-10.0.14-win-x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.14_(x64)_20261107182812.log"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2544
- - C:\Windows\TEMP\{ACDE86E2-831D-424B-B82C-3A301864A2C0}\.ba\wixstdba.exe
    "C:\Windows\TEMP\{ACDE86E2-831D-424B-B82C-3A301864A2C0}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{99D50304-1D9B-42C6-8EC1-ABE633124941} {2795A303-5C3B-4BAD-B758-10026E924F26}
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:4968
- - C:\ProgramData\Package Cache\{29A18B06-B190-4463-9FFC-BC0D70D80B7C}\windowsdesktop-runtime-10.0.14-win-x64.exe
    "C:\ProgramData\Package Cache\{29A18B06-B190-4463-9FFC-BC0D70D80B7C}\windowsdesktop-runtime-10.0.14-win-x64.exe" -q -burn.elevated BurnPipe.{F64B6ECA-545D-4DF1-A718-DD2AC2028E7B} {D76C92E2-2FE4-4155-86D0-BB912F8060A2} 2544
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:212

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5992

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e59ba12.rbs

Path C:\Config.Msi\e59ba12.rbs
Size 11KB
SHA256 9e331bec1f93abe82c8751fc1d0ca095e7c4cd92b356f6e3a06b6d0d64238f73
MD5 fc9b2c86aa028bfec23683011df87335
SHA1 0e3ba3f3815261cc7fd71d2c9ea45cd325bd04fe
SHA512 367d07f9fdd9844979ba26c0131916acbbc9bb718fe370fcd03e65a94496b3cda84db426af8590b24df4ea1c7a85a2cb0dec151335134d3ed530df4bda331ba4
SSDEEP 192:JQZ9fX3LXC8XLXTXbTtrKMW5HRa7R/eEG0mPLvIz70mPLvCzXEBXgCoLpUAuYSKR:JizC0D7ntrKV5HqsDsDr4
TLSH
T19C3220A2A701C1E3FA972735CB0B2B163F63979E8304134F49ACC1259F437D92EA55DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59ba19.rbs

Path C:\Config.Msi\e59ba19.rbs
Size 9KB
SHA256 07bc36befd98a31c4095d1ff06c3ce5f4b659e3a539a0082e4eb3774d2e4e87f
MD5 128372501f9690b234e40691b1292e72
SHA1 780efc36eb3705257c2c6656a1907407f899cae3
SHA512 9cac7dca667c95ff6f22b4f2e819b250a2a9199cc2110f4d702866b50beeca668fcd72767c07681a631ce6326a5e2b782009ed07640390fd20664f5a12acde06
SSDEEP 96:5mwA7ZCVrc2Leup3pttUyReD2PYCsTl8UyReD2PYC6jiWpUponyTlanEI+E5pl7O:0NVKXeYGkvIVkvxdEVPkpLpdZ
TLSH
T1D01234456A0086E2EC931B34EB032F323F66E39AE344575B1DCE81704F477D85EA929E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59ba1e.rbs

Path C:\Config.Msi\e59ba1e.rbs
Size 49KB
SHA256 f329246bcd351dc87a7ef823d5b4b30e60eec2e8cbf88a7d4efe3a4fb86b896a
MD5 a8c4eb974206902d18ec9c3c082082f0
SHA1 0d73ea8bf2fc456962e9d2e1a1ca5edbb3ed9da3
SHA512 2bb7b6d6dbc6b728d3e848a5fe8f5a2cc990e4ac6c542f59bec320f488c6184c29dc0712514e63f8f9c5a581400d1d90549da508b6a3a8ce6604c1252f09ddcb
SSDEEP 1536:WpzILbIIwdeizGKApN+B277ffOM9JyZneajISfvz2WJEtPV+Gtig/W5RW3ZVScgP:qL
TLSH
T10F33B3A8FF04C2E3F13A7D602761DE04B3158D52D72495AA92CE4319DF4A7D8AEEC1D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59ba23.rbs

Path C:\Config.Msi\e59ba23.rbs
Size 71KB
SHA256 39c6058198d77738009f8abc862d6c16356eff9210fa3cceac1bb72de87e7cee
MD5 d8f729cf5353a48fdf218eeaa235ceaf
SHA1 b7d69dc12966243a4004a047b7276f769c622874
SHA512 d1302afddf4f558f9da0b44620ef34e12cf6d0641fec60f0d1dd9257f508ef570f3c9a78d575dce6a41b75baa98bbce64a1ab8b2103387c1929adb57d3f0a683
SSDEEP 1536:rraavi1jDWKS0dN97p9t4Gu4C6jLepO4BqH8Zd4WY0fZf8Fmi9xGpD/gsLtdlInO:bLn6ju1WMCy0sKy4WOsh
TLSH
T11A6322999748C096FD322990FBBFF604BB119DA2B60E45AA11CCD63DDDE52C61FA4CC0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59ba27.rbs

Path C:\Config.Msi\e59ba27.rbs
Size 3KB
SHA256 4a54f9041cca20e178c530de6de48fdedc212eece7ea3e81cddef46a2b3416da
MD5 c8bf6893e8ae3047926f34c94c1d417f
SHA1 c33749b6431ef1cdaca6432b6bb52d9fd3a331c1
SHA512 24b44b8aa9b8c971944a3c9050124b8ab2e90df6ccabd239f01b2915e96f811b0218e082c91e92c40f756deb3f583f09657996ee49060130fe9b4671649e8cbc
TLSH
T1AA818B03AA54E683ECA21B30CE2F57127377D7DAD719438744CCD1311E877CAAE9A685
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4376_1249878809\LICENSE
Size 1KB
SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
MD5 ee002cb9e51bb8dfa89640a406a1090a
SHA1 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
SHA512 d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
TLSH
T17D31535723840B9306DA2B4566AEBDC4B0DDC02D7F27AE05186EF394537B52ED8B3443
MD5 SHA1 SHA512 TLSH

Submit Download

verified_contents.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4376_1249878809\_metadata\verified_contents.json
Size 1KB
SHA256 c9e76a313bb06d9d761611d7cb8c2ab8de59eb9959b77458138630dacebaeb0e
MD5 243afa1f565d5789d05d9762162cfa32
SHA1 7c7b6757be9b6ae391a59b940ddfb646cf6ce732
SHA512 671b53dd21e4566df6fb4ef811fb95382447f57a82d497de029ce1528aaaa47f26277615f6ca91ffe4834598b2a0b5b78ec2f2dabed2ef704581cbb990ad67a2
TLSH
T11F3119B8380E324F90A7E30425BB9D33534570BE13E0A517B1C26A4E5598A40B2732FA
MD5 SHA1 SHA512 TLSH

Submit Download

ThirdPartyNotices.txt

Path C:\Program Files\dotnet\ThirdPartyNotices.txt
Size 77KB
SHA256 deb4427a295e1ed474b0d81c5a0d972c1b550b9a715cda939cdfa9236b1b418f
MD5 0d8867a25ba926e6e40cd52ab3536b5c
SHA1 89390dc8b8318d0bfef1c6a2fb4783537e28a465
SHA512 317ca335405274f4f91b173651ca2826760acb5ba5cf41aff51adc55c2cda9059fb268333665f13f62fa48119e55a303720a780dd58d28dd9967db4c88407d61
SSDEEP 1536:HA9jHwsGfgg39/zwgAVkguQxrDjugtSEGepkWvrpX7anuqdLSVnfiStPq+3LefrL:HA97w/ogz1AVxuMjHtSFULryLOgrGWm+
TLSH
T17773A45F7E45077319E2C3916569A8C5F22FA02E3B6B2A44346EF248133B42DD6FF858
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 163KB
SHA256 1e881ec1786c31ba712d052258b4ad4202ac155df5965794030037878abb822f
MD5 d62fd28f725a7e0200ae19e07c2b2b8f
SHA1 2163a2c5955d66baaa4b7aef85029ba153ca2e60
SHA512 dc86819bf5c0652f7426c4da70858079eb0ec4bf6c2c416b29ad0c0d92057d3baa2d3dcc54472b6577b24ac3858c6e6222eecf256a80cfc81d4167a7370d574f
SSDEEP 3072:JGgPR9lIuvTSBbQ/09n4SbDqIG/0k7l55wK4pQaa:JGalIubgbQoDvqIUtyu
TLSH
T176F3061AD65811AAD06E9575CB528941BB337C668BE0E3CB53C0F8BE0F726905EF9703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft Windows Desktop Runtime 10.0.14 (x64).swidtag

Path C:\Program Files\dotnet\swidtag\Microsoft Windows Desktop Runtime 10.0.14 (x64).swidtag
Size 490B
SHA256 68f62eefe404c684a5e068589de7b45e114c9a22e014be62177f74ce07830248
MD5 91cd81c0e252b915b33c772420dfac3c
SHA1 b357f10337cd62c6127578a59c91ba07b21e491e
SHA512 ae8dc4fce60da8933f455028260cc94ba57ac89f2f57774cd351382c648b175d1e57e62a061e92a4617470b262815cb08795ea8613e36c6c1023859f3fe12898
TLSH
T12DF09EC9F581BA3342F21B54E55DA042F349B2D3CCCC66C48D99C859119A5E64376500
MD5 SHA1 SHA512 TLSH

Submit Download

DotNetRuntime

Path C:\ProgramData\Package Cache\.unverified\DotNetRuntime
Size 28.1MB
SHA256 36c8067684aeb83228b44ecb3d4c103379017ca87e3e007e51105a91e404d97a
MD5 448a27c46800f17819be6847fb737e07
SHA1 aba29671dc9f147325ddea11ecb3cf909179d92d
SHA512 78ed4db54b0ac78211d9b03d94866a681367d80ef244779cfe60686aafb81795c13120a29baa0967ceeced71ef13e8d0e8c6a24cb4cb055cf9d135dc826fdbf9
SSDEEP 786432:nl9er4PCV9IzzrRov6dz5dcdtDzClZNWYihY:nl9erfqzz1r5SXzCuF
TLSH
T1A557331B7F9204A9D9260EB1C17A8765AB367D082320D2AB47B4711CDEFB3E564F63C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

state.rsm

Path C:\ProgramData\Package Cache\{29A18B06-B190-4463-9FFC-BC0D70D80B7C}\state.rsm
Size 1KB
SHA256 3296f0328f727e192bf47f8eb4bce12615c3aa5000d14f6d265b63ac24de58a9
MD5 aa4e9bdbdbfdf03ed17d9a35c9257706
SHA1 3fdbfb9dcab863b858ab763a0ac9ffa7b53ec522
SHA512 baf04e927b4bfc496cac227bb78a76ea19fd5ded76266bea558717b0edc5501134cc6e2eba0f16f0f7d885886e4a19bd53cf0224346799b8b784d33de11e778f
TLSH
T1A221D1515BF6092DF3F6AB34A9F96725443BBC121C20C16E0001318A9E32BD0CCB4B37
MD5 SHA1 SHA512 TLSH

Submit Download

04ba9b86-97f8-4a1a-b317-9bdc72baf1da.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\04ba9b86-97f8-4a1a-b317-9bdc72baf1da.tmp
Size 26KB
SHA256 c5a48f0809025fb2b48394acbcac3087063000dd4c65d1bbb8b5659f760ac32d
MD5 b340b67dfe3c6f6a728c611fe6b4114a
SHA1 108db4bab49d052116821e99ef039cbd4862431d
SHA512 91ba4f7f57569b723eeb850a0925ce6c406cf415b84c335c8377b7e314cf74246181258aa11103de380bf833ab4d3680a62928dd8ea432a59f7196318787bed3
SSDEEP 384:nviFqQkUSvN3sN18TUNTUlI4FaKMydZwzfvBCT40Hnz5io4H7vBEnSVgL/7IzUa4:6FSN34wg3cyBCb9io4H75ESvLs
TLSH
T19AC24A35E894EABBEDE78F95B30A3A47EEE0515399DC4AC4D9D90D2C00835DE134BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

28d728ae-101b-4f48-9491-735bba0c5a32.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\28d728ae-101b-4f48-9491-735bba0c5a32.tmp
Size 26KB
SHA256 5b2363e10f6832aaaf3156b56630502d9b203a65182b57a0c6405a594ae0b6db
MD5 9c80b2418c8bfed9c98357f2e8615b40
SHA1 7ce76a7994c28174956cd3cf218307c4e63d3a58
SHA512 dd4450f8e2c43c3f9037530e8553c9304200564ea44786e9c2f420a9bb88e702928e814efcafa15c5a75d39385bacef4c6555697497e880ec8d5396371a7ff22
SSDEEP 384:nIiFzQkUSv13sN18TUNTUlI43aKMKdZwzfvBCT40Hnz8io4H7vBEnSVgL/7IzUa4:TFd134wgPgyBCbQio4H75ESvLs
TLSH
T1D9C24A35E894EABBEDE69F95B34A3A47DEE01263D9DC4AC4D9D90C2C00835DE1347C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5db1ea38-ba98-4e92-9741-4486dbadf1f9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5db1ea38-ba98-4e92-9741-4486dbadf1f9.tmp
Size 26KB
SHA256 eec72accb47d1af2dd670619924d3aa29c1d16416b4febc9e26b76ce31414c1d
MD5 e55dd118ae8aa864814709a2822e404b
SHA1 0ca983b53cf59573814454ecb4cce0b5461b0418
SHA512 058f2e4388ff97ae289f359196d3f51b2226537245381740f245f269a4e3b989d436eb44374611861f704a59ff3e6dea50a648ff9fe28a340547eb6d0bbe0276
SSDEEP 384:nviF6QkUSvi3sN18TUNTUlI4FaKMmdZwzfvBCT40HnzVio4H7vBEnSVgL/7IzUa4:6Fii34wg3gyBCbJio4H75ESvLs
TLSH
T15AC24A36E894EABBEDE68F95B30A3A47EEE0515399DC4AD4D9D90C2C00835DD134BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8ef2f433-d769-43b1-8247-e0e85e0813c2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8ef2f433-d769-43b1-8247-e0e85e0813c2.tmp
Size 27KB
SHA256 1be218856e350551b69d663076e7b0376adebf9bd5dc801bff9430cc890ac94c
MD5 e553510f88ba0ae074d2a5526b8bd7f3
SHA1 f2aa1cf3c1ede29526845657bc2f296b97586500
SHA512 73c90d57875c855759d3778652a1d05f49591f094d024a6288266a1f9892e444152eb16d841da9575a0344f673e2f489c0c29f2ed28f3fd42c5d9d38a254afec
SSDEEP 384:n5iF6QkUSvE73sN18TUNTUlI4FaKMmdZwzfvBCT40Hnz0mo4H7vBEnSVgL/7IzUN:QFiW34wg3gyBCbImo4H75ESvLs
TLSH
T11CC24A35E894EABBE9F68F95B30A3A47DEE0515399DC4AD4D9D90C2C00835DD134BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9a3a58fd-7773-4b8e-9bae-1dd74602831d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9a3a58fd-7773-4b8e-9bae-1dd74602831d.tmp
Size 25KB
SHA256 3a4b05cb7474b17c3876085f0ce7d5c54f1b54a70af339fcd8c0bc9e26d70a36
MD5 ac61bb2f1f8f626f942cc9bc18b3bbf3
SHA1 0dd86ca7ff0bf6d3e1fede7b783afe615e97f89d
SHA512 17616c38ec02e592508d7a84a21ba40e32bf00de8a147cf1ece5cd239f53c97fb4b333c15ed87fbbb216a159e6416a7b19070a17573213598d91bce2c8fa7e59
SSDEEP 384:ngiFiZcI63sNZ8TUNTUlIm2aKMw5KwzfvBCT40HnzYio4sa+VY1wgL/7Izaof:7FQ63IwgcW9BCbUio4hguY
TLSH
T1CDC23936E898DABBE8E68FD6B74A7647DEF0026395DC5AC4CAD91D1C009359D0307C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9dac3e88-089a-40a3-a2d5-3a702e4fb09a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9dac3e88-089a-40a3-a2d5-3a702e4fb09a.tmp
Size 25KB
SHA256 7b308067c3b8a7f330e813ab3960a7fb82dd448d50c7b045c256a268ddfaee4f
MD5 22c5a14b2bb385992d16210f614d00b1
SHA1 34567076f4508ff642d70ec4bef4ac1d8ce97676
SHA512 8ab579e026be57b296b9e49a9c69acfb0b31e45789842cc49ec4b72c4371480b81e7f6badff0a39885fa163590d57461e072f97fcf1fac20a5524da7a8605567
SSDEEP 384:nwiFiZcI63sNg8TUNTUlIm2aKMiB4wzfvBCT40HnuFowsa+VY1wgL/7Izaof:LFQ635wgcGPBCbOFowhguY
TLSH
T123B23936EC94DABBE8F68FD6A74A7607DEF0026395DC9AC4CAD91D1C108359D0307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3c1c88a1dc8e5439a1a520e9db930955bf4755654f664147c54e6cba8b43ed4c
MD5 22184503a294aa98846d9a4c3975971b
SHA1 44809070563819cceeff10eeef861544783faf98
SHA512 5d29c381872b72159a2d05366e0578c0ad56eb5ef51240db505660b787e0b3b88212c74bad2c16783f95846d95fdad86172cdc01a84d34426cca804e937a679d
TLSH
T1F4D02B24B2AC7654E01A343C0114428C30CE5970140BB400805413940FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2f67a665126f0d437497b394b50cc87ce72773b6abd85385bb78adf0ad326302
MD5 a98f4348736e1c7c5e70799864c15774
SHA1 fa2e3725e970aab935f77d155b649177f50be7d6
SHA512 c1dd68c743d45af6f713c7d8fade4a675abe4d224e86b956c5aaf959ccda0a92b9824b0e784a0ee9992843bfc2a7a73f85267479d6e5ffa0aa5827760492419d
TLSH
T19ED02B20B6A87654E006343C0114428C31CE5570140BB400809413A40FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

142c9e9a-09d4-4bc6-9650-8d82130c2532.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\142c9e9a-09d4-4bc6-9650-8d82130c2532.tmp
Size 32KB
SHA256 62166509e0890efddeddd62322d02a9905e0b356891250f35aed2037faf6924d
MD5 cf7e2605f8d10a3eb82e2b79846b8fe1
SHA1 b0f6e97fc0f57d1f55dc83422161736d716b359d
SHA512 851106dc9aeb7773de6e0f1cd994ae02a95d001952309b5c4f0aa6563f19610d9b17cac80bc7a6ebc59517adfe5ac179b1fbb13062c929aeb0390badda8c0d96
SSDEEP 768:Px6r8sW7pLuLbG+WviyUK8F1+UoAYDCx9Tuqh0VfUC9xbog/OVm1qpLlvVajYrop:Px6r8s2EbG+WviyUKu1jaz1qpLd4jjoA
TLSH
T1E5E2E97B780CCF7E4FC05A9DDD1A7F8A6DA802CB9698C94087FA945C02C67EA51170DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

37ffff2e-1310-43fa-8825-d8acdbcb7f11.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\37ffff2e-1310-43fa-8825-d8acdbcb7f11.tmp
Size 13KB
SHA256 4882f705eca800aa74e0ec66a87b071bfc9d1bb4447cbc93ce670055d667652c
MD5 2c67c394a5cc9236bf4ac2f5d569bd59
SHA1 921daefd9d4ace3ee24fcbd38e477f75f7afe896
SHA512 cf54f2ba25783a2917cde85ba35f625a088fa731291148aadadaedf4b228599fa9a8416d8a618262a8caa179b7a3d5e9873c7fc87aa5737aacf077cfa54ca7b6
SSDEEP 192:sxZnR6jV/f2sC/QZLjI8fzodp67HW6+WNr8l/YoVrDQSC+Ig5NbNtjJ:sxZnIV/f2sGOPf0oHbE/ESPLNtV
TLSH
T1B852D819AE24A93B5CC7D219FB567F53E3F9503294850E88AAFC8A2C14E76DD620341F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

454b6f73-63ec-41e3-9819-37510d972c04.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\454b6f73-63ec-41e3-9819-37510d972c04.tmp
Size 414B
SHA256 4764550b0d2aa15a7a485e8ffa0aa8774e26f8e15936037ad1c4d2d2b1371de1
MD5 687174a69dac3585905fccbbb50294ac
SHA1 2c55c2187f3a9cb20263a71b4ae8327a0040030e
SHA512 bda694425dbc4fdf97e39312903073758d531e413f53cc2a9cbec8478af6500f8260925904a3eec44ce90d89549da312d786a5efc0d3ee24823b8e3d354a68bd
TLSH
T147E02B6AC821FC3B18FD5B7954940A46EB0023672A819D4B3B3E81088FB1A364186D6C
MD5 SHA1 SHA512 TLSH

Submit Download

9df4247e-8ff1-4a76-ac55-6cab206719c2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9df4247e-8ff1-4a76-ac55-6cab206719c2.tmp
Size 12KB
SHA256 848bcd602785902871d54c63c00c2f98c33fd097e7127d1bf16ae610b10a35ee
MD5 4d03a7763ccb1de102e713515f23e580
SHA1 6d5844ef633a091d1db6b136b325e92adbf922b3
SHA512 6923c85ca9c82a63b78514e470f20d6a71b03e3e4cef1c387247f90356b4699d9eaa5ab5a5dca03a3e0a3e65b0f3d1ea12d90075b434052fb24241b83383aeea
SSDEEP 192:sxZhR6zV/f2sYaQZLjI8fzodp67HW6+WNr8l/YoM2SC+IgjtUAJ:sxZhIV/f2sROPf0oHbE/jSPjtZ
TLSH
T1CA42D615AD28A93B9CC7E219FB157F53E3F9503394850E48AAFC8A2C15EB6DD220341F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9eb13738-dcf1-45c3-9ea1-6bbc680c111d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9eb13738-dcf1-45c3-9ea1-6bbc680c111d.tmp
Size 13KB
SHA256 1130fbaee3378cb36107abe840d0b0550066d660f2f54a1cd558348221593012
MD5 04a5a44e8406c9439e683f69cb2dbaf7
SHA1 27425dc86908f7ea07b3142968d4a895c28da4b7
SHA512 cd12e113043a16dcfee0bfc0a8ce0344cced7a482f07f162684dfc58660b2645ac1f83c5f4ddac16aa1dba8c4b3631c9052f03b5306b9365944ce2b9be3cc211
SSDEEP 192:sxZhR6mV/f2sCVQZLjI8fzodp67HW6+WNr8l/YoVrfQSC+Ig5NbNtjJ:sxZhVV/f2sOOPf0oHbE/4SPLNtV
TLSH
T10E52D815AE24A93B5CC7D219FB567F53E3F9503390950E88AAFC8A2C15E76DD220341F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 dc26abf7640573935ecba91a5303316b46a279205a7b26aaa8f97f421fb4804e
MD5 7d7c621ecd864fffdbbcf7bfb403e00a
SHA1 5b6f66cc7ccba9f19a072f5effc42d91265b1700
SHA512 80d1f39e40b907a9025a320b87e83a8b40eb7d6d739981739552958b4019f3efe954d3ad6685efbe4573cbafa091b580183db930d1e4bff494524644e956d4dd
TLSH
T193E026C408CCC22EAB08A44702AC570C82E13B1AA7C07FFE1758F48C7A42448A2876A0
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 0c5585b4d9518f9faff36fc0ffa3a07035993f15ae86f4b1ce023e724625273b
MD5 7797d410edf9917e7876ef5955acc4b6
SHA1 dd84d2c1ee99038c89a6cb6492f2a376cbcc25af
SHA512 40b6d5a6e748e840407c1af28cd26822bcf8d3143f04f1aeca3dd6ad01425e9c53d009cf98b2ce3fe43a6520c45ab1f5c4dcd4a47f62c2d8cf318d6d5cd80c32
TLSH
T160613F818699E15DFB9477B285CF20AA367849BCDF835FF25E94E87C5C0EB1446380D4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 657269d23334545b8a183313e74b14f5031cdde2e3f7087906934d4d0388828f
MD5 4aee6daa0fff75a1750febbb8a2569f1
SHA1 231d554c6d00669c3e6247f908976a4e80cf33a5
SHA512 15ebf0a918a9f2f95942824f89f79771bf4536d14bc124ca8c73d86f23715e2c3d93ce52dc8fadd49ad91fe60ae57bd7a01e465d3de1a05b4a250959beb70265
TLSH
T1A4510A8596A1C19DFB9473B181CF218B39784ABCEF825FF21DA4E8BC5C0EB5442390D4
MD5 SHA1 SHA512 TLSH

Submit Download

495d4ca3-c115-4c4d-95e6-db2648bdb98e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\495d4ca3-c115-4c4d-95e6-db2648bdb98e.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.111.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

064e7c7e-9096-4e7c-847d-9e2d7912b59d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\064e7c7e-9096-4e7c-847d-9e2d7912b59d.tmp
Size 3KB
SHA256 04c729810f472eae2032c5fc48678c52fbf090f79039e2d2491d6b587b80733c
MD5 c4871ec39aae3dc6b86ecfad68feca4d
SHA1 0209ed08caed0e1447862c68c0b0f1b26ffc5cf2
SHA512 8e8485b8dc84a79759b1d9dabf77dad2aa33a18d4e7a8492dc56d5925f1d62f0bd6cefe61ca57ad5681955a45ab2b46f006077f80609197272a1f89211427119
TLSH
T14B61ADF787B4856E9A019AF09A18EF2FDF2D0615431C7C6989D4AE27D3F3472E00265B
MD5 SHA1 SHA512 TLSH

Submit Download

2a857d34-e37b-489c-8c30-4c9eea7a5cd0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\2a857d34-e37b-489c-8c30-4c9eea7a5cd0.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

acc15b84-4cdc-44cb-af12-46a9313b9cd7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\acc15b84-4cdc-44cb-af12-46a9313b9cd7.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 28KB
SHA256 6e989f8a9f7d9c464766d3d4ff6f510a24dabdb37fe95756f0c1e41670ea4a4b
MD5 00de0a73ef8f5808cf1ef3f0195f26f6
SHA1 06b2788b7ef948a42b4d9e4f690fb3991ea615aa
SHA512 f9a0ea0ce11e9b60c7f255c5f99102065d3c5880accef611094156f40d585b361f74e1a97cbcf93b62d5e5366bb6006c76a7f0b259fb39adab037240f9de4f27
SSDEEP 768:SL29ObJffppdNlrtONqq7+agMIdMZWC2Beot6a5g6hElY:SL29ObJffppdNlrtONqq7+agMIdMZWCE
TLSH
T1A9D2225571BB421039FE295C82B6972E064231733118EA6F7FBD44A68E2BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c925b142-fe76-468b-8162-b2b2a25b15be.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c925b142-fe76-468b-8162-b2b2a25b15be.tmp
Size 12KB
SHA256 975f491161dd1a800105926eb40a78111242c901ea9e66150151da17bd849c14
MD5 04d90f04cc9b884fc6f229f3cd88ed10
SHA1 8ff62b6b5048349cdb99707b7f73480e2c5dbc62
SHA512 3985a48b34cd7adbdef5236568504b962ffe04c15f8a1c2b2537a3ec0d59b737b94f24cc3041d82ba6239c29eccc3fbfbbd78fe1b36e1d867b1e87d257cbb0a3
SSDEEP 192:sxZhR6mV/f2sCsaQZLjI8fzodp67HW6+WNr8l/YoxrfQSC+Ig57tUAJ:sxZhVV/f2s6OPf0oHbE/MSPFtZ
TLSH
T1F252D615AD28A93B9CC7D219BB567F53E3F9503390851E48AAFC8A2C15E76DD220341F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d86a0775-e8b4-4288-9ec4-506182bc5343.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d86a0775-e8b4-4288-9ec4-506182bc5343.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

keys.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2026.10.12.1\keys.json
Size 3KB
SHA256 b0724d5592e6441a840c6622d7ad51caad2564a3746e563ce1f1bbde30944b2b
MD5 a86e3ddeb60db5984686f5bd89a95646
SHA1 e5f417a8f70c34b293ee20bb9f54a423a07982ec
SHA512 f3df95b51940a12ffd2d58648c302fbd649dc3097e0961a86da65e324690488d1b3d80c6267a6a0685f220a89c279ba54cb56fc02f19860e99ffcd6448cf0db5
TLSH
T19971D6BF14A40082CF3BD16A8F0735A78FB23C0623C67AC3965FE94A04425AC276F475
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2026.10.12.1\manifest.json
Size 80B
SHA256 abe933f0db95b1a75786da21de82feb5270ffa7ae072270923da2437710d93ba
MD5 3790d9257ba14f8be2ba08acf259a57f
SHA1 c54ab2e79d0ac9dc27425c7450e01ad593f02d60
SHA512 9568fef732369f06aafd8270638a38531a26f6f40a1c7c65fb7254eed36807789756e1c6efabaec86017b3decead2773de9ef5814650dbb334e6000ebd44a467
TLSH
T1A8A012605811E13310C403700260438243E01C112015240405461140218823713A3129
MD5 SHA1 SHA512 TLSH

Submit Download

c6791ced-06ef-43c3-94a9-b7fcd5a81939.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c6791ced-06ef-43c3-94a9-b7fcd5a81939.tmp
Size 26KB
SHA256 354b91708ab232fe44c9e37ee32bfd2956416dce89acb025a53569fe62bd2241
MD5 8dfd57fc2fe2c57e29e6075b7732e33b
SHA1 6add71b409a44a6d9eb61f1e1d0069ec45deabfb
SHA512 c0919b3c039da4d9dccc77ce46c70633665ea3ab26dae734dbd01f13cc77b958612a6a2b0f8b27382f8e716eb0d8592cd4a2d7f72edb81055242dce83122c1c7
SSDEEP 384:nIiFqQkUSvN3sN18TUNTUlI4FaKMydZwzfvBCT40Hnz5io4H7vBEnSVgL/7IzUa4:TFSN34wg3cyBCb9io4H75ESvLs
TLSH
T1E4C24A35E894EABBEDE78F95B30A3A47EEE0515399DC4AC4D9D90D2C00835DE134BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
Size 158KB
SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
MD5 9c18c4721b560ec55f0d5de055144d5c
SHA1 6af37a3bda916cac276ad5879c9f61262d9ae523
SHA512 51466928eb8d3cf7b917919c98bd8168453583d2c3dc5836036d87ffd0d2c732ab8450212a880fc6de199ea569a96993ba0d250a5012160d2d72211880695f92
SSDEEP 3072:5ZwEurOxn8zXnHc2qHNYEU/rUHCVJWGdi0Ha5HnXk9TFzBsuht7yGik:5ZwPOx8D85UIHEI0HaZ09JzKStjik
TLSH
T1CFF3E13E7EDE891AD80B10BB7F16B18BD80D8E0B460AB44B769D80155B3668D1BD1CFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f1d24222-aa91-4959-9ea6-54d1e2b198f7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\f1d24222-aa91-4959-9ea6-54d1e2b198f7.tmp
Size 132B
SHA256 cf4125d94d82b448cb33d6f462cf53eec00f2ee8165fa00f1b9c3bdba48e3328
MD5 8126a600a3d95922fb651e3a6f104f68
SHA1 e386add1c2c1d9ca74461e5ce0d1b271d689160f
SHA512 5a0e81111f0d9a0f7943b99f7bad8162de0d3f99fffa9d8f8ab466fa9c7c4249808bedfa6e4d26426bc2d1a422e2155900ba71adc222617a5f0880dc60b89a93
TLSH
T122C02B8F542E47CBBAA5152D42D40B3B4690CD60F199E6B449FA5640006435CC608C47
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 985fc73ffa2376ab59df8a605d3494a3b857a856fbf9710f3a6e1ae2dcecc633
MD5 0017f0d5e6332889e64f03441be89011
SHA1 3c80468b98582f33f0b02bd0020b10abd7a2af44
SHA512 eabe80fc8b3c67dd681cdeeb99ca17c7db97b23bdfc35389af734c4c09cf0b640d46e9530c75d42ccc6c102d8f9a055adb5015cfa26d5cf75f737e74eef4fc55
TLSH
T19C41049CB6E91148B3B7BF1A9BF6A86D48BFBC272E07945D10110E4E0A62A41D871737
MD5 SHA1 SHA512 TLSH

Submit Download

4953843a-a600-4382-b666-5c59fb1be582.tmp

Path C:\Users\Admin\AppData\Local\Temp\4953843a-a600-4382-b666-5c59fb1be582.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.14_(x64)_20261107182812_000_DotNetHost.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.14_(x64)_20261107182812_000_DotNetHost.log
Size 2KB
SHA256 60da906be8da589ee5bba5c34da55c95c40a9fff616d45cc3da8b0611cf8add9
MD5 30861ea66706883a734bb81036b8dd81
SHA1 8390f8690a06b5e2444cc09714f397b9e24c42ae
SHA512 3b67c3753e870dd93f95a5f2b6b00066699adbefc4fde9a5269a0be23d946d7090ddb5d72fb6d0275abcef48df9d9894d39764b17672cdce4cb89a2dbd299917
TLSH
T13141EB691AE50905F5B357C7DAF7C0612A33FCE6A834CF4D13858219066B9067CBC7AA
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.14_(x64)_20261107182812_001_DotNetHostFxr.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.14_(x64)_20261107182812_001_DotNetHostFxr.log
Size 2KB
SHA256 32447354c7e0acaefc7bfd21464e9c18949799493b859cc26666c25aaddf5f74
MD5 0991204f9f58bec345cda721bbc539da
SHA1 7eea02a399aa75f29571a0f9a1280350c5a3d250
SHA512 121ddbf3b68c5997d45d7f0bbb8ecff1950160906fb366a7761a22012e2a0c93c22bbec8da49bd911c8f8d3112c4eaf4184b05a41a62c2e6f6a5025f1bbbd197
TLSH
T1C24104252AE50904B1B657C7DDF78152AA33FDD7A830DF4C234A4219066B90768BCBBE
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.14_(x64)_20261107182812_002_DotNetRuntime.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.14_(x64)_20261107182812_002_DotNetRuntime.log
Size 2KB
SHA256 e395e08a40f8b87a0c36aa74d653317603dc68a5015d2eb2431d46a25a7216bf
MD5 bd3ec316ab016dd38f080744e8ca7d2b
SHA1 cc32e57fcecda8a1ee135dc752892f735dc58461
SHA512 db0976e63f472cef01d56fcd77cb10cd28672bff40baa3feb13a6707b4004c70f79fc6aca17d25a5877374ab639576295565d6610fe49e2276417f2b58d0c1ec
TLSH
T1A141D2151BE80915F1B656C7DEFBC0926A33FCD66835CB4C22858219066BD066CBCBAE
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.14_(x64)_20261107182812_003_WindowsDesktopRuntime.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.14_(x64)_20261107182812_003_WindowsDesktopRuntime.log
Size 2KB
SHA256 4b5da0fb09051c08ca10afb46fcbbcade16d6e2cd9190625368ab2ea3533f712
MD5 64c6912dfe51cfe747019ae56f475002
SHA1 f39ec6249741285d8a46ea27ecc81adb754809cb
SHA512 6b1a805446ce009b348d7bf3e8348c3e8ab4adb74453981935982ed6c506933fed8c743c37ea192fd112e1363c8c199f162ef185e58c740dbba7404c975e7fb5
TLSH
T1B441D65A1FE40905F1B29787DEF3D0525E33FCE6A834CB4C1385421A06ABD02787CBAA
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4376_555303263\CRX_INSTALL\_locales\en_CA\messages.json
Size 711B
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
TLSH
T1460197136240AF18470BF05BB9023442A0B44AC62384E0B775EC982C6656DAFB20B3B0
MD5 SHA1 SHA512 TLSH

Submit Download

DotNetHost

Path C:\Users\Admin\AppData\Local\Temp\{DBF4331A-959A-4373-B006-C380852F8B13}\DotNetHost
Size 848KB
SHA256 abf9056691ac5c463120c59943bcc7b3ff8cc45e9430f5260d6383108f0f2839
MD5 533c8600ced609c8c4293ffcf5795817
SHA1 a7cc343e6a9e2d2eecaf468d19b99d2f35de768e
SHA512 d0a4a2ee79d39cd9f7a910d7d5f3f86e47cbf41ae8bf7a963fd1dfebc83455eea346174719127549f9e67bb2618e24613a94c9d4928e73c7e9af4f33c7fbd675
SSDEEP 12288:eBGQ4cABdUb/aVo/2WCsT7pXJS5qgBwhYysWPuoi:6GyASwoO2T7RgZMYnGi
TLSH
T157055A1BBF9414A9D8A24EB1C4B78721FE357C082320959F46A4B12CDEFB6E4647B7C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetHostFxr

Path C:\Users\Admin\AppData\Local\Temp\{DBF4331A-959A-4373-B006-C380852F8B13}\DotNetHostFxr
Size 920KB
SHA256 b26eb4b947543ee2becaf5f71d8736f5bbdcb340eb1259856bdaf64bc11c7782
MD5 db32bbb9ac147022d38539d078207f81
SHA1 3f896332365a4ae79b8aeb632a1a66e4f1a323eb
SHA512 940497d8c9316abf312a32a1ad06fe3a8a6cbb498bf9c2c461f28871b0488f2295d77d0aaa3699ce16bb873234dd4ab58f17d0e91c34f7433f3b185c41478162
SSDEEP 12288:lBGQ4cABdUb/aVo/2WCsT7pXJS5qgBwhYPVJTJ+VDD:TGyASwoO2T7RgZMYPVJTJ+VD
TLSH
T17D156B1B7FA404A9D8A24EB1C5B78321EE357C082320959F47A4B12DDEFB6E4647B7C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsDesktopRuntime

Path C:\Users\Admin\AppData\Local\Temp\{DBF4331A-959A-4373-B006-C380852F8B13}\WindowsDesktopRuntime
Size 28.7MB
SHA256 cd1659987ad005184e83139f89fd0f073005916311f3426ae2152e0fc942a2c9
MD5 0b2ce5df5008f401e907bf1e6cfa29f5
SHA1 c89c7788f505ec043ffc7501c88c1cbe0c7f431a
SHA512 325d3d756a05c96bd78558daf998a9c4a4df47f6e1c1cd5c6b426e7942a25be6c46b8dc13d1581942097b2889dd6ec79af14e6b5fc9ef57b1caab932f85ae1c5
SSDEEP 786432:rS0wapy/3xUTNEO3BpWyEtxhzdlR8vQdVl5cSpxf4WCy5UgmHM5:m0wX3mTOQcvtHzdz3VxAkvmo
TLSH
T1A967332B7FA1189AD5778EB584BB9314AE3A3C082700954B4268B54CEFFB3E41577BC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

211b7391-fc93-4c7b-a912-644ac2a2a932.tmp

Path C:\Users\Admin\Downloads\211b7391-fc93-4c7b-a912-644ac2a2a932.tmp
Size 34KB
SHA256 40494a962e50be01596c40dc2698ee20357c78538514b0f2e593f3e365c9937d
MD5 15b012080a023eae0d9f07bf33ee6f3a
SHA1 8d55da72f58fed656d94493b2f25c6a762e72ae9
SHA512 08e43c57eb17fb4d9ace33fc82b6ee8bdbecbc5bac8eb3290f21049513a9de21a123eb13edc30d740278017c96fce4930a592b02797b6e720338fd8fc3d2254b
SSDEEP 768:VFgJVPizl7IU831N0q7bYdRU6dAZMhjq5pfvWN/xuqh44KWqZfAUM:VFgklMvNJblGoK02cqh44KWq8
TLSH
T180F20841EC83D07BDBD232339D2B6F21319F6F2411E89547DB45894238A1AE26FBB716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIBB47.tmp

Path C:\Windows\Installer\MSIBB47.tmp
Size 411KB
SHA256 ac54078e0387d2a8ddcdbee3967da6ea6ec6508172505aca3d27a75fa43ce34f
MD5 1981cd407f5b5e81c70ba2729c56b381
SHA1 e0b6d311930ab3557d5a0a8769edefb49c32aa3f
SHA512 3b7c18ca780cf05a01062661156d71e0a4626469f28040e46f07c7deb8f9a643b838bbc88eda515362c5895171a337a3f5d9b8e321e539408fc1ae47e6ae4181
SSDEEP 6144:GDvoaVoIMrKAzCsTI+q6JL9eZYr1JJS5qZ47BwhYjzmHim:QvoaVo/2WCsT7pXJS5qgBwhYg
TLSH
T135947B29B3E418EDD4B682B6C5A78430FF75744D332095AF8BA4916D1F3BAA470BB701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BootstrapperApplicationData.xml

Path C:\Windows\TEMP\{DBF4331A-959A-4373-B006-C380852F8B13}\.ba\BootstrapperApplicationData.xml
Size 9KB
SHA256 2994ce2de1b0a3527527b3e0e914d389fd9f4d9dbc1e22f30b1f385c8565e525
MD5 43522e625b3970b2941b2d9f89b389e1
SHA1 e342fb9b2bd871fd620ed1dcff9aa29573b3bf0f
SHA512 8b62ff64eef47e1c7cbc16a9c1f51500481be0442cfbf0640abf3f5a353635c49e79d3779dd63db36c406ef38eb625d3305c8fa311a79514ffacac37d9a440dc
SSDEEP 192:aTzanZTH49/rvBnAXzaHatVA8ff6TsCsysR:JnNJJQsCsysR
TLSH
T15C12D6513BFD0219F0F35F88EBF6A5556A3ABD552E39C82D01201D0F49B2E818962FB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetLogo_256x.png

Path C:\Windows\TEMP\{DBF4331A-959A-4373-B006-C380852F8B13}\.ba\DotNetLogo_256x.png
Size 2KB
SHA256 0f571f95d8eab48dbc81b0ec5e9f7225e349e26ef50868bfaab556f3c2443b01
MD5 39aa52615723b782c92dec710caaec7f
SHA1 760b49e256a7979fe50a56a2b1be3688a474b886
SHA512 89d1baa3820154667747b25e9e2fd321bfb2ec71dc309915b0a28dacdc80822a4943b639ebb37c37bd2559d5a4306d2096119cd970c84a0d331f6c68b0456dc9
TLSH
T1534195CF1BFD78D7E6E557918E1A8DD232738483B4B3A42CCE7B10B8274A5642B87940
MD5 SHA1 SHA512 TLSH

Submit Download

dotnet.ico

Path C:\Windows\TEMP\{DBF4331A-959A-4373-B006-C380852F8B13}\.ba\dotnet.ico
Size 44KB
SHA256 61a2cbd12868cb9b359e0c78961d409b7875f072eb8e53ea88d3e6bfe2961a18
MD5 b8096652d9ec286709a2c863b244b110
SHA1 b3b7f0f4d608fad7cb59ba499d4d17c2b873a7af
SHA512 492a5aa83220bb77c178b7c5b50bf44968c0427e9e45bb97a33df14d7fb4c667ca7adde0ebb3874c7b6011057b01144e4e6651fbad62c6bcf5e0b93586c4bc7a
SSDEEP 96:r+gfbzo+wHK9NbwOY4tIWQeVlV1W9+H+guapUjFamINUItzf1dBNaIZ:ro5HuNcH4tIzeVlV1WEOFDgUWzf1PIm
TLSH
T1E913EF6DE68547C1C10C2032DB4AC792B5233C72E4DAE0C4F9D4FA7E177906965C6E6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\TEMP\{DBF4331A-959A-4373-B006-C380852F8B13}\.ba\thm.wxl
Size 7KB
SHA256 b00edd703dd8a475119d0e4dd70a3aaa47f0e95361af290e76d367a8edef3432
MD5 8b2c667a8bbad3153068c0ed90df7ec4
SHA1 c9e04a3a37e5e6262ab9bfecf78280171b8f7b74
SHA512 5269f00d474acccb4c48cb7bcfdf19e63557a388572d3a6335aa39191319691d924e27f70da3f3495387c319396476c63a8fd7b35835cca0901220e39783847b
SSDEEP 96:HiTgM1+XSNEzA0HtYQstYCpCwZQpCeyk5HQJM9ouvj9urz8:Ew9EmtYQstYCPC9e8
TLSH
T191E1026F68DFDEE03A732651B2B3698D6919C29A136F1CF0F869084B47635016377A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.xml

Path C:\Windows\TEMP\{DBF4331A-959A-4373-B006-C380852F8B13}\.ba\thm.xml
Size 11KB
SHA256 dfee8e2d075087227f19c835c145c5bb8e72a46880ea24080bb2472fd3a521be
MD5 4329e418dc56b1386d7ea29a0dcfab5b
SHA1 58387f92e89ca21b4179fb697c7de9675c59142f
SHA512 6934873d27e6efbb94da4f13ee8369b29995490051016fdf82800256b924902306d328bf1d4ebbf266d1a53eb24adb6478d1a67de4ecc3e3bcbe561968f24922
SSDEEP 96:HgvPkoeWEH3IWTaQfSJgHzth5mFahbuB8pR5+Vpwe+UIJLg1gEp+6F5pQnxc:AvoWydmQfVHMyyj5Z
TLSH
T14B42FC6851DC7811C532D702AB9371D3FF12BDA6C6C85A58B48E256B1FF262028B739C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixstdba.exe

Path C:\Windows\TEMP\{DBF4331A-959A-4373-B006-C380852F8B13}\.ba\wixstdba.exe
Size 431KB
SHA256 e9aad13949cd910523bf9547fc5c23bd2c26595e024809a9f8fa866c8d8e555b
MD5 14e0c606e68508fa618bd5c514015577
SHA1 f8c28db9d2810e872f6ffe7607019851f250c5f9
SHA512 c29fedca692ca2f9c5e63f360aeb95399f2f15f1576a0d06fcf9f0919f6b658329973803bc870b0b1e954b0105757630ca3f4b3ac64f4b80e91742d612fd5b73
SSDEEP 6144:N7lQcp03E0PKVMP/PwMFJ3zdoZmb8LSQsCjzYkffTTp6EoNXJrprSU0e:Np6mM/wML3/QsJDLXJrow
TLSH
T16D942A3165F04023D6F94572E915FA30AF39F208670085EBA3C0DD297968AE6A7FB357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{DBF4331A-959A-4373-B006-C380852F8B13}\.ba\1028\thm.wxl
Size 7KB
SHA256 43e1e134d0591532323dfcd138ac8f5e99096cb6cb0213a486bbb3ecc5c47aad
MD5 2d7b0d29deaa836b538baaae8378ba48
SHA1 85d86c566f601ad6e22301183771b9cc7e5062e9
SHA512 ecc84dafe21bf858eb4693fd7c0802cf28dc5fcaf43eccc4ded3c4a83bd550e3dbf58012be695cf267917c39f6047eac89fd0cdec090e253c283783d01d8a916
SSDEEP 96:E5TrTfb5joKvyvOj8USd4sZij7N4WoWKWvsNMNizchn/hD2Rd0E/aQpSK1nuQKbm:4r5owj7NgwsNMNSiK1gd6r
TLSH
T1ECE10F5F7CEFCED46A332A0176B32989191DD28A13AE6CF4F5580C478B634216B73A07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{DBF4331A-959A-4373-B006-C380852F8B13}\.ba\1029\thm.wxl
Size 7KB
SHA256 2f174b5eed2a84e43396f3cae2e6521c9247bb0deccb16e7f9b461233c363534
MD5 f483510f350ad116c5c81468ad609bdf
SHA1 5343a3a695e6149c7a7ba831be75a91138763e44
SHA512 a39f3ebedb06361d95c39e4b7c5020d70be0e1e4654d5d5dfe254b44a7fa3a9c9c02659a28acc7ea8294620aa77818fb53609d7a2f6c9b6ae8d9adf9f2ac844c
SSDEEP 192:qxwpVLBj5iGRxrFe+4Lzv3zLfqRBxOTyv354+F:qxwNj5RxrF2PbLfWBETyv354S
TLSH
T17AF1FF1F58DFEED07B33194572B36A88681AC292035FACF5F8AE085787235059677E03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{DBF4331A-959A-4373-B006-C380852F8B13}\.ba\1031\thm.wxl
Size 7KB
SHA256 2589887424dd4b0b27d36f7aa36d07fb6fa8d1c4dbe50059248a24823c742f92
MD5 4e98d12cfce46c393dcdf2736a2bda95
SHA1 aaf6a00e50cdf19f1c4fc6256ac040a750ca97af
SHA512 314d712f8fcb2a44abe1920aa9f44d2fef626732397d3d77e4ad0ea6a003b0ea38e361c96515c8e6f8cf7d61ab96de9a349a228522a9f4b81d82c8a8f1962662
SSDEEP 96:jgl95EIQ8+nPQP6Zc0y7jOROgYmwitzvzB5xz2kSl+ACIw052Q/LKtkCGpUvgd/q:jEpcoPWc0y7jGhYmdtzvzr8/oa/Lt/hQ
TLSH
T134F1425BA8EFDAD077332611B3736989791AD2C6136F1DF4F8A9480B8763501537BA03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{DBF4331A-959A-4373-B006-C380852F8B13}\.ba\1036\thm.wxl
Size 8KB
SHA256 ecdd5f7b7ed65bef8e3eec00537da44939b8e8f8f604e9b39329b45ec210efde
MD5 7673a053117454b94ff8155b9f06da1e
SHA1 2143896f16e8ec6d52eecb773e99d9a2f9daa4b9
SHA512 0d20a4d6819fc64e36cfcd9c029542d6ef834faa3c74dd636bc1b6697f92d8822cd19c1692c500956fdfe69a3278a84c0545c799878107d0d56520053b9ae266
SSDEEP 96:lsZt1vwZI+XNHwt/o5HezMxzMEy0vBW4eAQf49QcyhZpuWcK61xrG32gUgGv:o1wPWto5+zwzvWhvgYUgg
TLSH
T1E202105F58DBCFE06BB31717B6639589A839C286235F58E4F86B08078763914D337A43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{DBF4331A-959A-4373-B006-C380852F8B13}\.ba\1040\thm.wxl
Size 7KB
SHA256 c536f3f85936f6b38782df30a7bf88c7e7e66fa1e3257b20b75f9a4f0112b184
MD5 21fe14f06f2e38ca565581045a67eaba
SHA1 fe56b260ea7986f6234aeaa9f3adb010b01a0ff5
SHA512 a87e53dbcab33b95d78f67c7e62f0c3fa50711f54b11efee890b749dd21f42e68db185dc5a99160dd37403612abb9609d311dea1254c126b1e96ecf7aab67051
SSDEEP 96:p0NpgwGrmKmuaXo+Hnxy7McLi4vgjzH9euz3KLrQTNRREhZDWDIQ0gwZKWakCRos:wNBoJvUzH9euz3tTDCnZKWzDU+c
TLSH
T1BFF1EF7B68DFDDD0BA332748B2B3B589B51ED586235F19E0F4AA094B4753500A27BA03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{DBF4331A-959A-4373-B006-C380852F8B13}\.ba\1041\thm.wxl
Size 8KB
SHA256 000e1508d9bacb7156951988ba1d6dc36165facd2163352a93b9a66e8c642089
MD5 e29c1d15cf0eeb5fb10a6f0e92b041fc
SHA1 68cd096f0135524d5d07a9ec1fbcb69e1a1084de
SHA512 47d3acdafbc3dc960d569976fe3c635613608f08102a6cd0c246f8ebe0f3343e73fc9d87a673035a46fbc4de21c59b97054dfd596dde2f5f6eea25f6ff7b7d96
SSDEEP 96:/x55EeSXkI6+QsPIVLYitzzus2iK5EmV26W/0zYe9YQfNpYjruBzUYwvdCz1Q:/BQFPIVLYszzutz8yzYUO/CxQ
TLSH
T1B702102EA5DB89E06A331611756776C8680BCC85DBAB1CF0B07DC817977341DE237A32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{DBF4331A-959A-4373-B006-C380852F8B13}\.ba\1042\thm.wxl
Size 7KB
SHA256 09c51c910f7142ab7f73db8e826f3daff1525eea765d03bcd934cba53bc689d3
MD5 095c8d4db15a85c0c62842d0192202ad
SHA1 d703ab6b95a8190a3187a65ba1b779d856eff7b8
SHA512 86860b18e9101c2d27359e53e21c7f2fe939031850387a6a55c12d23b7dbe4133722b5fdf4364dc896d5aac5744b470b45198a47da6912a4827b88f433a79796
SSDEEP 96:YWnvHZWx805aEfLW344uU5OsW+yvuE4uU5J+jpD2kUcdkAdiY10IHDWw/fPb8Qhk:kjcuYhu5jx2kP1/3bmk9d4
TLSH
T1E8F1429B78EFDED026732C413AF36A95591AC2DA235B08F0F9254C878B738114637E27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{DBF4331A-959A-4373-B006-C380852F8B13}\.ba\1045\thm.wxl
Size 7KB
SHA256 209911674536ad5976dad21ae1e96a9fdfa61270120a94bbe0e8ae32a67239a2
MD5 4e407f5d7e06084cb9ec7b41b1f4b992
SHA1 0aa44f39e522935de900449937af13df18a6ef44
SHA512 926daa3c9d92b7f0e910101d6482ce6e153af13dd3f59236d3418df4a158857f00ea565869312f35c0bf6e689b6f1a0bead71f54e77783d65311838dc980c996
SSDEEP 96:vz5E6U+A8fOIZcvYqUC/W5TqUbFaOa0Q9zSzfmZ5AKgY1ou5DQ7JPy+u1/8X3vCH:ln9BmNUCqeUJaOaHNCPA/zGYP
TLSH
T1D5F1005FA4EFCED127331A45B6B369C9680AC5CA136F1CE4F8AE081B87675019337A43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{DBF4331A-959A-4373-B006-C380852F8B13}\.ba\1046\thm.wxl
Size 7KB
SHA256 7b095c32d1fbdd924d710d18d51a88a710bc152c8b30c6051524583bfabe38c0
MD5 13d65c9d4996d93edafb2696cc2a90b3
SHA1 80047984b6cee842764b24ef33a5c67eaabab2f3
SHA512 14ceaf26e16cfd039e18614d40148c44e09cc2e7130b19a3024aabb46bac77c1445cd7de84ef46577ae1ab4cf15cd0152a3ccd6fe070ee0a34b06f8f29ba0af0
SSDEEP 96:TD5ED4lH+wLwdBc7tlqIz5Vv0gpK0rD45g5q8MSQ7EugTuo6RADvAbK:Z1kvg7xlVv0gpXMfgLGK
TLSH
T1D9F1121F68DFDED037331A42B2B36A8A6509C2C5135F5DF4F8AA494B87A3500A637A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{DBF4331A-959A-4373-B006-C380852F8B13}\.ba\1049\thm.wxl
Size 9KB
SHA256 3c911848f83d269fa2cd64bbfd7b5e88eb3a621bdd42c564c69100a8e8a40494
MD5 7904c2832b3cedabcdf0ec49dd8040ba
SHA1 2a7f428568ab6ea5fd54bb80376c552d80a0e7a3
SHA512 3c881efc2b611bda02b290bc79948818ce6e6a495dcf2dc938047875f301f18f9eae37ba109fd9b453504173cb9209192e0d2cd4603c7bf105042bc9775829e0
SSDEEP 96:C7lv+VxxVUC7bqFdwkd/XQF+L++qFQEemLq9OJRgcnZKQ8VXoshXuOxMvlmV3p/n:zVPVU//y+L++9wpZ/oRZ1
TLSH
T1A022FD2615EFA8D81222B117E9626E0E3C5B81FF3B6B5BF174641C6F76B3000833B606
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{DBF4331A-959A-4373-B006-C380852F8B13}\.ba\1055\thm.wxl
Size 7KB
SHA256 56d76adc63b71879e3291f0f306e54081e9e80f463fcb41dc6896ecd2298deae
MD5 e2fabe4eb312645c1231029191458f7e
SHA1 f9f143535ba48d9aeb791c62e79ed687911927b1
SHA512 ddf60df1ee2f00561bc806e384478b105182a4bec673b5eb26b1db7f88adb297af80b7bdfeecd5e0aefc3579bf20a84bc9bacdcfb727b9d1af2865cdcdc48a37
SSDEEP 96:YMANNFTFhC4h4bNReiNxfufGzzzSkbAS37lsu+wzPwQT8gpwMu7kVS0uuM/r+9Hc:YlFJydNxfu+zzzgoZ7Twh/6H/0
TLSH
T1DCF1231F78DFEDD467332A56B2B3268CB84EC382132A9CE0F52944479BA351152B7B07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{DBF4331A-959A-4373-B006-C380852F8B13}\.ba\2052\thm.wxl
Size 7KB
SHA256 340154c87016bd6af740e6a91ea86d722817f6dc2bc675c33133901443658179
MD5 e89b4290f9255b428cc21e217dc8e5e7
SHA1 84f78df432e53426412e2123c1990acfb743f6c9
SHA512 b313de643859aca6b9b2f05f88efd130c900065c08d2279af6f7d8dd0301a7a762ee0e051ccc76c737c68c86e51decd48287529e7fc9a25c0cb1228151447105
SSDEEP 96:dLf2DllNpoNWZd9rCfE4d57afwUtn93K248RYCPr/I5Qqj9BQru0iCiBkz6/3PPx:d0Np6fHGwMn93MRoL+u0x
TLSH
T11EE1119F78EFCEE02A332A5132B325CC2819D28957AB5DF0F4641C4B8B634205777A07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{DBF4331A-959A-4373-B006-C380852F8B13}\.ba\3082\thm.wxl
Size 7KB
SHA256 2416f9a3daa6767f418c5ab94edb8a83dc9326fcaf13de1186e61b5248349edc
MD5 65b3aa6dd10a5b8db1b7f7faa4c4c7e1
SHA1 ca32c8b853681960c86d19d533dff4ff1137a1c6
SHA512 d7fce89011c24d0c3928807293d42a3f694ef4357d3c42a84d9294de000b291279671e2059e063ac58806b8e718654260ce5c9ae8c748d3a0a8c9ce0e23ac55a
SSDEEP 96:oEBx4+Ck8rL6j+zTnnq6LuSznTUzO1GKW+gepaU5/QxANuRypklEDhmh8asuBtz:aX6qfxLzznAzO1G0ERdiu/z
TLSH
T132F1412F68CFDEE27B73194472F3958DA808C295235ECDE0F468085B8793905D637A83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BootstrapperExtensionData.xml

Path C:\Windows\Temp\{DBF4331A-959A-4373-B006-C380852F8B13}\.ba\BootstrapperExtensionData.xml
Size 276B
SHA256 258fac237622533e7f9ec3f95bcec8abcc31ae87e2017e5717af0841c61e9df4
MD5 240bac991e5860465ce0dfd580ea7cb3
SHA1 a352934cbb14ab877883ac219ceb78c92e27f495
SHA512 67ff8063a071436ae7dca8ee12ad1991bb70752dcc63f00f129f38dffa1aaf9299fff591fc67dbf4d2fdc57a9242831b149d575181b84857cd4f22463076f315
TLSH
T1DAD05E432FBE2304F1B30F49A6BA94102475BE009D78CC6D0228080C0573D92C8B2F77
MD5 SHA1 SHA512 TLSH

Submit Download

license.rtf

Path C:\Windows\Temp\{DBF4331A-959A-4373-B006-C380852F8B13}\.ba\license.rtf
Size 215B
SHA256 75cf03762aea3f3ef6ae0dc0290c4426052549a0b4335bcc3ba9ca30391e0751
MD5 5f5db41d3f86258e4b6f8b08ef870d0a
SHA1 3c02aea43c2bc7dff281ec8e5ad01abf058c1ed6
SHA512 26344831d563e95a26126f2d99ce9b773017596001fbf3d7f56b9a84c77a69240640b7bb191ec8ec7fa66d424134805113be8b9503adae19554aaba6c98223ee
TLSH
T19BD022EA15CC11AA3FB80A8CEB04D029ED7E419DBC41D682B1313A90F81192DB2C76A2
MD5 SHA1 SHA512 TLSH

Submit Download

logo.png

Path C:\Windows\Temp\{DBF4331A-959A-4373-B006-C380852F8B13}\.ba\logo.png
Size 852B
SHA256 cd2e8ed1fbb308d9d166f49794d323a9b22efba1033cdf906d1f4b030319e01b
MD5 8346e21859a269dccf1e408dc7593cca
SHA1 239f10674bf6022854c1f1bf7c91955bde34d3e4
SHA512 de9a54e7067fe4feade10f48d7c2bb4169f50efa0b06d3310421376690712af4d55dbc24dc5accc5013379b11abb59cc8c85896fe9f2a7c6a7ea2e28f6feac9f
TLSH
T16B0152E8C16455ACA24E76BA91F32450B653B46010C5CD8EBE00DF3442F4522AB976A6
MD5 SHA1 SHA512 TLSH

Submit Download

windowsdesktop-runtime-10.0.14-win-x64.exe

Path C:\Windows\Temp\{DBF4331A-959A-4373-B006-C380852F8B13}\.be\windowsdesktop-runtime-10.0.14-win-x64.exe
Size 968KB
SHA256 4234cb04b518dd990fd7053a16584dc37400465686ec0ef288d410e3ba304f17
MD5 381fc2e7514b8ea1ec9e03e3d1a67621
SHA1 348068dde0267de196d91f143db25b7f7064c4f7
SHA512 f3c8fe2b69c6a64a3cdbcbbbd2c5f5d93290f1f5b00ba10cb3a8755b0341e3739f8d0a70652a5f1d3234755d730c76c326cf58a57bab0e9c1a598731073a0e0c
SSDEEP 12288:C/hzPsOEX5eZbWC1I0iqm+4/Pm0zykD7x4zKoM0zpC6jUywy:CZzPRq5eZbpTh47zykJiG6gW
TLSH
T193256D31A166242BE6F40973F914D6307E28E7082B5C55B6C6D0DD0C39A89FA6FF724B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4836-437-0x0000024300000000-0x0000024301000000-memory.dmp

Download