hxxps://dl[.]visla[.]us/pkg/win/visla-win-client-3[.]0[.]14[.]msi

Analysis

user interaction
yes
max time kernel
101s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/11/2026, 14:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://dl.visla.us/pkg/win/visla-win-client-3.0.14.msi
Sample261110-r4btmsgb43

Score

7^/10

defense_evasion discovery persistence privilege_escalation ransomware trojan

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 1 IoCs

pid	Process
3428	Visla.exe

Loads dropped DLL 34 IoCs

pid	Process
3040	MsiExec.exe
3040	MsiExec.exe
3040	MsiExec.exe
4260	MsiExec.exe
3428	Visla.exe
3428	Visla.exe
3428	Visla.exe
3428	Visla.exe
3428	Visla.exe
3428	Visla.exe
3428	Visla.exe
3428	Visla.exe
3428	Visla.exe
3428	Visla.exe
3428	Visla.exe
3428	Visla.exe
3428	Visla.exe
3428	Visla.exe
3428	Visla.exe
3428	Visla.exe
3428	Visla.exe
3428	Visla.exe
3428	Visla.exe
3428	Visla.exe
3428	Visla.exe
3428	Visla.exe
3428	Visla.exe
3428	Visla.exe
3428	Visla.exe
3428	Visla.exe
3428	Visla.exe
3428	Visla.exe
3428	Visla.exe
3428	Visla.exe

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
49	3348	msiexec.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Visla.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e59110d.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI12F2.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI165F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e59110d.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI143B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{B2EC7AB6-F0E2-4DD2-B3EB-4F98254AC011}	msiexec.exe
File created	C:\Windows\Installer\e59110f.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2544.tmp	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Visla.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Visla.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1460	msedge.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000087bc5fd0f69d84a90000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000087bc5fd00000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff00000000070001000068090087bc5fd0000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a87bc5fd0000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d87bc5fd0000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Visla.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Visla.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 11 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	Visla.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	Visla.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	Visla.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key created	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Visla.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Visla.exe

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\Colors	Visla.exe

Modifies registry class 16 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1696934516-3600988056-1840298893-1000\{F5041CC6-8D76-4787-B436-F2ABA0FC6532}	Visla.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1696934516-3600988056-1840298893-1000\{8A30F0C9-888A-4015-9F8A-29E442651945}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Visla\shell	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Visla\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Visla\\Visla.exe\" \"%1\""	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\CLSID	Visla.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\CLSID\{23A5B06E-20BB-4E7E-A0AC-6982ED6A6043}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Visla\\Visla.exe\" -ToastActivated"	Visla.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Visla\ = "URL:Visla Launcher"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Visla\shell\open	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Visla	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Visla\DefaultIcon\ = "Visla.exe"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\CLSID\{23A5B06E-20BB-4E7E-A0AC-6982ED6A6043}\LocalServer32	Visla.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Visla\URL Protocol	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Visla\DefaultIcon	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Visla\shell\open\command	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\CLSID\{23A5B06E-20BB-4E7E-A0AC-6982ED6A6043}	Visla.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3040	MsiExec.exe
3040	MsiExec.exe
3916	msiexec.exe
3916	msiexec.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3428	Visla.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
5248	msedgewebview2.exe
5248	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3348	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3348	msiexec.exe
Token: SeSecurityPrivilege	3916	msiexec.exe
Token: SeCreateTokenPrivilege	3348	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3348	msiexec.exe
Token: SeLockMemoryPrivilege	3348	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3348	msiexec.exe
Token: SeMachineAccountPrivilege	3348	msiexec.exe
Token: SeTcbPrivilege	3348	msiexec.exe
Token: SeSecurityPrivilege	3348	msiexec.exe
Token: SeTakeOwnershipPrivilege	3348	msiexec.exe
Token: SeLoadDriverPrivilege	3348	msiexec.exe
Token: SeSystemProfilePrivilege	3348	msiexec.exe
Token: SeSystemtimePrivilege	3348	msiexec.exe
Token: SeProfSingleProcessPrivilege	3348	msiexec.exe
Token: SeIncBasePriorityPrivilege	3348	msiexec.exe
Token: SeCreatePagefilePrivilege	3348	msiexec.exe
Token: SeCreatePermanentPrivilege	3348	msiexec.exe
Token: SeBackupPrivilege	3348	msiexec.exe
Token: SeRestorePrivilege	3348	msiexec.exe
Token: SeShutdownPrivilege	3348	msiexec.exe
Token: SeDebugPrivilege	3348	msiexec.exe
Token: SeAuditPrivilege	3348	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3348	msiexec.exe
Token: SeChangeNotifyPrivilege	3348	msiexec.exe
Token: SeRemoteShutdownPrivilege	3348	msiexec.exe
Token: SeUndockPrivilege	3348	msiexec.exe
Token: SeSyncAgentPrivilege	3348	msiexec.exe
Token: SeEnableDelegationPrivilege	3348	msiexec.exe
Token: SeManageVolumePrivilege	3348	msiexec.exe
Token: SeImpersonatePrivilege	3348	msiexec.exe
Token: SeCreateGlobalPrivilege	3348	msiexec.exe
Token: SeBackupPrivilege	4392	vssvc.exe
Token: SeRestorePrivilege	4392	vssvc.exe
Token: SeAuditPrivilege	4392	vssvc.exe
Token: SeBackupPrivilege	3916	msiexec.exe
Token: SeRestorePrivilege	3916	msiexec.exe
Token: SeRestorePrivilege	3916	msiexec.exe
Token: SeTakeOwnershipPrivilege	3916	msiexec.exe
Token: SeRestorePrivilege	3916	msiexec.exe
Token: SeTakeOwnershipPrivilege	3916	msiexec.exe
Token: SeBackupPrivilege	1276	srtasks.exe
Token: SeRestorePrivilege	1276	srtasks.exe
Token: SeSecurityPrivilege	1276	srtasks.exe
Token: SeTakeOwnershipPrivilege	1276	srtasks.exe
Token: SeRestorePrivilege	3916	msiexec.exe
Token: SeTakeOwnershipPrivilege	3916	msiexec.exe
Token: SeRestorePrivilege	3916	msiexec.exe
Token: SeTakeOwnershipPrivilege	3916	msiexec.exe
Token: SeBackupPrivilege	1276	srtasks.exe
Token: SeRestorePrivilege	1276	srtasks.exe
Token: SeSecurityPrivilege	1276	srtasks.exe
Token: SeTakeOwnershipPrivilege	1276	srtasks.exe
Token: SeRestorePrivilege	3916	msiexec.exe
Token: SeTakeOwnershipPrivilege	3916	msiexec.exe
Token: SeRestorePrivilege	3916	msiexec.exe
Token: SeTakeOwnershipPrivilege	3916	msiexec.exe
Token: SeRestorePrivilege	3916	msiexec.exe
Token: SeTakeOwnershipPrivilege	3916	msiexec.exe
Token: SeRestorePrivilege	3916	msiexec.exe
Token: SeTakeOwnershipPrivilege	3916	msiexec.exe
Token: SeRestorePrivilege	3916	msiexec.exe
Token: SeTakeOwnershipPrivilege	3916	msiexec.exe
Token: SeRestorePrivilege	3916	msiexec.exe

Suspicious use of FindShellTrayWindow 47 IoCs

pid	Process
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
3348	msiexec.exe
3348	msiexec.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 1648 wrote to memory of 3264	1648	msedge.exe	85
PID 1648 wrote to memory of 1460	1648	msedge.exe	86
PID 1648 wrote to memory of 4268	1648	msedge.exe	87
PID 1648 wrote to memory of 4268	1648	msedge.exe	87
PID 1648 wrote to memory of 4268	1648	msedge.exe	87
PID 1648 wrote to memory of 4308	1648	msedge.exe	88
PID 1648 wrote to memory of 4308	1648	msedge.exe	88
PID 1648 wrote to memory of 4140	1648	msedge.exe	89
PID 1648 wrote to memory of 2012	1648	msedge.exe	90
PID 1648 wrote to memory of 4140	1648	msedge.exe	89
PID 1648 wrote to memory of 4140	1648	msedge.exe	89
PID 1648 wrote to memory of 2012	1648	msedge.exe	90
PID 1648 wrote to memory of 2012	1648	msedge.exe	90
PID 1648 wrote to memory of 1444	1648	msedge.exe	92
PID 1648 wrote to memory of 952	1648	msedge.exe	93
PID 1648 wrote to memory of 1444	1648	msedge.exe	92
PID 1648 wrote to memory of 1444	1648	msedge.exe	92
PID 1648 wrote to memory of 952	1648	msedge.exe	93
PID 1648 wrote to memory of 952	1648	msedge.exe	93
PID 1648 wrote to memory of 4524	1648	msedge.exe	98
PID 1648 wrote to memory of 4524	1648	msedge.exe	98
PID 1648 wrote to memory of 4240	1648	msedge.exe	99
PID 1648 wrote to memory of 4240	1648	msedge.exe	99
PID 1648 wrote to memory of 3920	1648	msedge.exe	100
PID 1648 wrote to memory of 3920	1648	msedge.exe	100
PID 1648 wrote to memory of 4988	1648	msedge.exe	101
PID 1648 wrote to memory of 4988	1648	msedge.exe	101
PID 1648 wrote to memory of 4988	1648	msedge.exe	101
PID 1648 wrote to memory of 3932	1648	msedge.exe	103
PID 1648 wrote to memory of 1808	1648	msedge.exe	106
PID 1648 wrote to memory of 3348	1648	msedge.exe	112
PID 1648 wrote to memory of 4224	1648	msedge.exe	118
PID 1648 wrote to memory of 3080	1648	msedge.exe	119
PID 1648 wrote to memory of 4216	1648	msedge.exe	120
PID 3916 wrote to memory of 1276	3916	msiexec.exe	123
PID 3916 wrote to memory of 3040	3916	msiexec.exe	125
PID 1648 wrote to memory of 2356	1648	msedge.exe	127
PID 1648 wrote to memory of 2356	1648	msedge.exe	127
PID 3916 wrote to memory of 4260	3916	msiexec.exe	128
PID 4260 wrote to memory of 3428	4260	MsiExec.exe	129
PID 3428 wrote to memory of 5248	3428	Visla.exe	130
PID 5248 wrote to memory of 5268	5248	msedgewebview2.exe	131
PID 5248 wrote to memory of 5648	5248	msedgewebview2.exe	132
PID 5248 wrote to memory of 5648	5248	msedgewebview2.exe	132
PID 5248 wrote to memory of 5648	5248	msedgewebview2.exe	132
PID 5248 wrote to memory of 5676	5248	msedgewebview2.exe	133
PID 5248 wrote to memory of 5820	5248	msedgewebview2.exe	134
PID 5248 wrote to memory of 5820	5248	msedgewebview2.exe	134
PID 5248 wrote to memory of 5432	5248	msedgewebview2.exe	135
PID 5248 wrote to memory of 5432	5248	msedgewebview2.exe	135
PID 5248 wrote to memory of 5432	5248	msedgewebview2.exe	135
PID 5248 wrote to memory of 5752	5248	msedgewebview2.exe	136
PID 5248 wrote to memory of 5752	5248	msedgewebview2.exe	136
PID 5248 wrote to memory of 5752	5248	msedgewebview2.exe	136

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://dl.visla.us/pkg/win/visla-win-client-3.0.14.msi
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x240,0x244,0x248,0x23c,0x2c0,0x7ff9bd0cc188,0x7ff9bd0cc194,0x7ff9bd0cc1a0
  2⤵
  PID:3264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1792,i,14877623287872049416,5205517738488003210,524288 --field-trial-handle=2888,i,12780027969804645596,13923583287069461970,262144 --variations-seed-version --mojo-platform-channel-handle=2912 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1704,i,16857972518747325079,3954252092545864489,262144 --field-trial-handle=2888,i,12780027969804645596,13923583287069461970,262144 --variations-seed-version --mojo-platform-channel-handle=2884 /prefetch:2
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2236,i,9491152545836510324,14745247523541962935,524288 --field-trial-handle=2888,i,12780027969804645596,13923583287069461970,262144 --variations-seed-version --mojo-platform-channel-handle=3000 /prefetch:8
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,5090141876050847995,6311338110923784985,2097152 --field-trial-handle=2888,i,12780027969804645596,13923583287069461970,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,11204301003933750446,6378394884205755132,2097152 --field-trial-handle=2888,i,12780027969804645596,13923583287069461970,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4164,i,10974813554986497315,18281690345360465593,2097152 --field-trial-handle=2888,i,12780027969804645596,13923583287069461970,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:1
  2⤵
  PID:1444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4180,i,11798563342950380536,2142700658263789988,2097152 --field-trial-handle=2888,i,12780027969804645596,13923583287069461970,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:2
  2⤵
  PID:952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,18225305041555883801,15913520903248160163,524288 --field-trial-handle=2888,i,12780027969804645596,13923583287069461970,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,16929171728957295732,12781448088424963282,524288 --field-trial-handle=2888,i,12780027969804645596,13923583287069461970,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5648,i,13019753503819214244,17487304080800760348,524288 --field-trial-handle=2888,i,12780027969804645596,13923583287069461970,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:8
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5664,i,12246495764677882089,11324075590704040926,2097152 --field-trial-handle=2888,i,12780027969804645596,13923583287069461970,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:1
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6480,i,11971811844116528754,16095644702497552004,524288 --field-trial-handle=2888,i,12780027969804645596,13923583287069461970,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:8
  2⤵
  PID:2532
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6480,i,11971811844116528754,16095644702497552004,524288 --field-trial-handle=2888,i,12780027969804645596,13923583287069461970,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:8
  2⤵
  PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,5714124743848189586,4350472404465688828,524288 --field-trial-handle=2888,i,12780027969804645596,13923583287069461970,262144 --variations-seed-version --mojo-platform-channel-handle=6928 /prefetch:8
  2⤵
  PID:1808
- C:\Windows\System32\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\visla-win-client-3.0.14.msi"
  2⤵
  - Badlisted process makes network request
  - Enumerates connected drives
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:3348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6900,i,10160046792156381863,3152688523380151588,524288 --field-trial-handle=2888,i,12780027969804645596,13923583287069461970,262144 --variations-seed-version --mojo-platform-channel-handle=6876 /prefetch:8
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6908,i,16583165442455929595,14051506898286770267,524288 --field-trial-handle=2888,i,12780027969804645596,13923583287069461970,262144 --variations-seed-version --mojo-platform-channel-handle=6828 /prefetch:8
  2⤵
  PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6916,i,7484193675074417251,17244035225548545215,524288 --field-trial-handle=2888,i,12780027969804645596,13923583287069461970,262144 --variations-seed-version --mojo-platform-channel-handle=6792 /prefetch:8
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5552,i,3757216621461485010,15479436946501039483,524288 --field-trial-handle=2888,i,12780027969804645596,13923583287069461970,262144 --variations-seed-version --mojo-platform-channel-handle=1000 /prefetch:8
  2⤵
  PID:2356

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1392

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3916
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1276
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 48678DAFEA357500F77EF8A8FA119443
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3040
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding DF87EEBD916AB0AD294A4E5881B9F989 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4260
- - C:\Users\Admin\AppData\Roaming\Visla\Visla.exe
    "C:\Users\Admin\AppData\Roaming\Visla\Visla.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks whether UAC is enabled
    - Reads the TCP/IP host and domain name from the registry
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies Control Panel
    - Modifies registry class
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of WriteProcessMemory
    PID:3428
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Visla.exe --webview-exe-version=3.0.2680.1016 --user-data-dir="C:\Users\Admin\AppData\Local\Visla\WebView2Cache\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --mojo-named-platform-channel-pipe=3428.5240.16750742612836024211
      4⤵
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of WriteProcessMemory
      PID:5248
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Visla\WebView2Cache\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Visla\WebView2Cache\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ff99d4fb078,0x7ff99d4fb084,0x7ff99d4fb090
        5⤵
        
        PID:5268
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Visla\WebView2Cache\EBWebView" --webview-exe-name=Visla.exe --webview-exe-version=3.0.2680.1016 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1720,i,7640995758776401412,11474631091376491160,262144 --variations-seed-version --mojo-platform-channel-handle=1716 /prefetch:2
        5⤵
        
        PID:5648
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Visla\WebView2Cache\EBWebView" --webview-exe-name=Visla.exe --webview-exe-version=3.0.2680.1016 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1336,i,7640995758776401412,11474631091376491160,262144 --variations-seed-version --mojo-platform-channel-handle=2040 /prefetch:3
        5⤵
        
        PID:5676
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Visla\WebView2Cache\EBWebView" --webview-exe-name=Visla.exe --webview-exe-version=3.0.2680.1016 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2352,i,7640995758776401412,11474631091376491160,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:8
        5⤵
        
        PID:5820
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Visla\WebView2Cache\EBWebView" --webview-exe-name=Visla.exe --webview-exe-version=3.0.2680.1016 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3656,i,7640995758776401412,11474631091376491160,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:1
        5⤵
        
        PID:5432
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Visla\WebView2Cache\EBWebView" --webview-exe-name=Visla.exe --webview-exe-version=3.0.2680.1016 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=4044,i,7640995758776401412,11474631091376491160,262144 --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:1
        5⤵
        
        PID:5752

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4392

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e59110e.rbs

Path C:\Config.Msi\e59110e.rbs
Size 27KB
SHA256 c093a40dcb97a5267ee436217bf4c7fd07d932600894ff4038a1e2ebcc21b6cb
MD5 7d8930d5eacdfbf9ead4c663ba24ac7e
SHA1 e81a540e90985a5cd53716e86ebf5f182ae4769d
SHA512 f20228fc0a31f76593c68015416de6cabb20cfefdac1c4d0e0a29346537627f4d79a3b7e2012d28f235d0ecb45f17e8b4824a39df33737c3b604c9e27dc691d8
SSDEEP 768:kwsLMZRHsob6Vm5VZDFdqgIO3JrNh3PMfrq+MbMkOzdsSTnHAze5abR9AzQeCqyt:BsLMZRHsob6Vm5VZDFdqgIO3JrNh3PMI
TLSH
T17BC202B44AC0CB8EEA9E9DF31FF2E58CA6E487807F10651C974EC49CEF605E5B848165
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 471B
SHA256 e692b8539b252cd40bbe7f0015eaaf466298c96f8883acebbfa24bb99c333b0d
MD5 68d1cc52e27fc473258166544cfbb919
SHA1 0822191b3e94f17ccae91aea7355f61ca7a1e80b
SHA512 4c41197390b44d68458bd50fb8ee437e01e25d257f012a3c9029e0ec8ad2e784bedf63898a11db95c2fe1cde831c2051144b75307899b501e9d47b6559c18901
TLSH
T1EEF0D4A3DAED7CB17403450C1BA9481425F1753D4A85849A2D389FD0548FFE1722A409
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_CC865F00D5EF180FC67D806536E3B2A6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_CC865F00D5EF180FC67D806536E3B2A6
Size 727B
SHA256 d4fea886ffdfcf2bb87f20269112348260c977e9cc5b2a5e46299419e8f8d966
MD5 7e72581e8aa1105d5e446eac76dc2dc0
SHA1 4d1d506541375132c5baa3d5add5c7f4239c333b
SHA512 08b1d40615f0255afc4a36ead448f23cb75d1026403770715af3445af4a3387128ed1c5c9fd9a9ab6d5e44a437d5a4a01e0ec370e49b13ab90ec8aad444b7aa7
TLSH
T169016511EAB9FDAA39117848EB550C237D03051237DE278F363B305671403E76306D02
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 727B
SHA256 9fbf78682aafa571331eb73dd361eed2a906eef684a92a28e29be4b610e48b20
MD5 7bbc5a956c1b34df7cbbae498a22f2dc
SHA1 fdf8095ce6cdecb4d1e2eefa865f3d9f6d45470d
SHA512 6fc60a9d9fa0bad869d430cf261d14e4a9fd44e83185fc10f4bdc367c38e7ffcc940cf96531e40161f35a1cb7bbbc09a0d525484214eb922a8818f8f27522c34
TLSH
T12701991B5860DA123C100C23C7BADFA2AD70523659C447B021E485CF53BC36E6AE5B64
MD5 SHA1 SHA512 TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 400B
SHA256 0ae8f7e8e0dacf3a84e4e864dcc563e309fd29ffa6c466bbae50636a9dc5ef04
MD5 570646421affc8081803e2311fdbe5a7
SHA1 c2f0e6be637f700a98469e247a587ef78a0f3a3f
SHA512 54fa3988156c9ee880a9aeb18449b14b13acf147ba9e4e1859f4072789f4ee09739fe5e1455f61691ed336a8aa6329dcdaa216a065824df0a1ba98e41973cdf6
TLSH
T16AE0203427FA51AEF1B4577443D99095AF2AF1076C5492BE0E81595D990B9005C62C71
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_CC865F00D5EF180FC67D806536E3B2A6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_CC865F00D5EF180FC67D806536E3B2A6
Size 404B
SHA256 15c5cadb951b50b62e6fccf242b4ebf8008fdc53b38d37347cf9ea841319fb93
MD5 d3e08723cf51048026719d0d49de3fa0
SHA1 69d7f5d0dddd094f2938d54ebabfc55acbe5089e
SHA512 48ef8fc863bbbda2d3be514898dfa266d9ecd29b998d40cedc86f5745b13025a6c8af482ee7e689f849c40cadafaf88e814bbea970f1defd782831e2fb1012b6
TLSH
T1F7E0203832F9058DF6A0E57C57F6DC12A95EF1171501D3A9254057469E24B405CD7568
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 412B
SHA256 e9250ecd415bea1e538951f2647ddb37aa7eb457b70b0cb79ba868cdc874651c
MD5 4e9c9806663b1a7243df0f741dd93200
SHA1 6910907386bd928fe31bca1f806739dbd0ae83a1
SHA512 a1659a07ec6162846f4aee40b276e566c06f3e22e92e633def8ff684b93f31ece6a98b36f05707e8a6f4335b873409dd03aca236d5a179bce273e9a62df6c78c
TLSH
T1B1E0D83826EFA51EF050AD3546F7A5B61D89E2462404D6791695430DA70AF406C519F8
MD5 SHA1 SHA512 TLSH

Submit Download

21966dcc-1acf-4749-ba42-87b814bd22bc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\21966dcc-1acf-4749-ba42-87b814bd22bc.tmp
Size 8KB
SHA256 0d3ee38edc05b041e197546a9698e96c1448f4792969a7afae94a20eef95a521
MD5 be63ae883d1096acf982e0432d456820
SHA1 63625df7238325dd154205c3ed116508430f1653
SHA512 bbe7dbfc941cf34f2409d907fd020442c005d3c4fec49c77f81914fa63aaca7e0ec34237372fbcbe262faf90db7322865e3570483cbc2a1b5c216a4f543f85d6
SSDEEP 192:LONe6AmwprQmiUyiG6siX5FvY+9JiUXU6:LONe6ipdk6siX5FA+qCU6
TLSH
T171020B35AD786C7B8AF3AE15B48B37239FA5117BD6942F84D9E81B1C01D768C1307832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4fdc2f21-ec6e-410f-a4cf-c3953eacde22.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4fdc2f21-ec6e-410f-a4cf-c3953eacde22.tmp
Size 21KB
SHA256 2377e20d9d8057f547dc71c1553859a164e8b175e8651b248a2ebe99eb89d431
MD5 4a949e0a2b5da11d55269a215728e522
SHA1 41f90ce126ae1d5bc3ddef333a8c6aa8c1ba5576
SHA512 e48386eee09ee51bdb2fa3a297ce5a541121c9d5a48389c60f05cf7ce718fda66126554f0ab3d88e609d339dc8efaf3ab09d425ed29aad19b8fa4175add271a4
SSDEEP 384:IiFgQkUSv1nsN48TUNTUlIlLsHOpuYLh+9iX5FA+eM66vaTZcZIIlA:TFIptwgSOrNqaE+66vaTZcZLK
TLSH
T154A26D3398A8AC3F9DA69B51F54E3603CEB05167CAD86F94E6DD5A2C02DB1DC134BC21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

525e4423-aa7b-465a-9ece-63883fe8fcc1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\525e4423-aa7b-465a-9ece-63883fe8fcc1.tmp
Size 8KB
SHA256 9caf4ae0243ef0da0572dc62aa0ea4d0f8089a922f005803525742c62fb0166c
MD5 645a3aabc192776cedb5d49c72cfe9ab
SHA1 70d0b7a4a30102381eaab9f70247df2e095e765a
SHA512 ce297addd386cc3f728ffa3a124a6837362f7c1572a828f130bfe6ef01d8c1ff19c4e8b488b1e881af4be7421540e06feab34d8854b3f2c3b29e484e54a3957c
SSDEEP 192:wONZ6AmwpLQmiUycG6siX5FvY+eMjlRQqAU6:wONZ6ip946siX5FA+eMX6U6
TLSH
T1D1123B35B878AC3F5DD2A951F44735139EB5426BDB886F84D4EC2B2C06DF598530B823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

96931b13-3c0b-4ef0-b2ac-0f8a18373c46.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\96931b13-3c0b-4ef0-b2ac-0f8a18373c46.tmp
Size 21KB
SHA256 5270952145bde154663e0422c5908bd9f93de38b87c364b37f104931b8c6ac7f
MD5 caad937487134c172927a68baa997f8d
SHA1 9f07dd3c31b5b26085769aa4ba34271851027b9c
SHA512 5dbae39f4a3650abb80e80171f006c6d07cd453f2afaaf060a563ca16524573160522f0eb16f9c0ef5859f72c7df731a33180eaeecfe787642fa3a9a01b388f9
SSDEEP 384:IiFuQkUSv1ssNX8TUNTUlIlLsHOpuYLh+9iX5FA+eMq6vaTZcZIIlA:TFeKgwgSOrNqaE+q6vaTZcZLK
TLSH
T148A25C3398A8A83F9DA69A51F54A3603CEF05167CAD86F94E6DD5A1C02DB1DC134BC11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

48f15841-c9f4-49b1-bd33-fb3a6c1e621c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\48f15841-c9f4-49b1-bd33-fb3a6c1e621c.tmp
Size 105KB
SHA256 4906252f6281d196a543eda93e216f207bc816191d336ac13ebee2fe8e92d0db
MD5 525adfa7f4c9c62e2bfd6d38e3ef8bb7
SHA1 cf1e52f484b9136072df53b0dfe9a1db7a601078
SHA512 ba66195f52e8f39228f71bed65496540db92c32f0816c10abf3895f73790506d1cbf9ed17ac1a7712f6be0cc72154bf861ba0708d29ad243a4bb8e197eb7b106
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7y:fwUQC5VwBIiElEd2K57P7y
TLSH
T1AFB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3a9e2856f7b8bdcf4e651903050a9f78a4dcadbc91b2bacca38c04067256642f
MD5 8eed843072749c683b08c3e5dbce9bd8
SHA1 87464a0b34e45a134ed6f01b613378b3b1c952ad
SHA512 ce7dc7d95703c8a1e763fcb3eae4091d89a746632583bc1fc73a8c189a11f08c6f50e2ee328053aab1da82c11d6f5f81942259c5654861d13f267c34e76feb7c
TLSH
T199D02B6CBE989EA0E40210340231910431CBC8178442200648B1065708003C303448B0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 221e3dccb30d516b1b3c2d51c604a308dfba3aa3dbe8e11c2d09e185e21df465
MD5 7c97d945db36fde78f76660ee3165916
SHA1 fa851b1197f5a5f6ba4d935baba30b0465e8ad12
SHA512 73a256bc0b95a0662925ed2ac0e1668d7a760da5001e2b32fe139724419020254e080420b21ccad1896c60c44ca2663c2a3d2eccb8cb4180b6b0ad628c68d676
TLSH
T14FD02B6C7ED89EA0E80210340230910431CBC8178442210748B1065708013C303448B0
MD5 SHA1 SHA512 TLSH

Submit Download

42199724-ed1f-486a-897b-1d2076d315e2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\42199724-ed1f-486a-897b-1d2076d315e2.tmp
Size 9KB
SHA256 05cd9162252a95ea857d70a5b53c1ab075d19ab61e0b640214481998c73af2fe
MD5 6578b6f4556e4837ca35bf4e1f1eaea2
SHA1 06fc4a5ee54594ba64d5fe4bcadc8d6b8ee49f4e
SHA512 52317a689e064b061c67863613bc7ef571710d08b6025cd98a57b6524da367ea72bd8f12dbec1a2db273f4014e33eed29bf1ca59d28ae4a3dc852c089c2b3944
SSDEEP 192:sxZ5R9nR/fss1dfIdpJHW6+WNGY3eAHYIgrJ:sxZ53R/fssXQJHbGj9
TLSH
T1A022B6126E28B97B8CCBD20DBB257F53E6F9503291D41E58AAFC861C05E7ADD124740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4243a7b8-60cb-4e13-a32a-82d3c965c3ad.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4243a7b8-60cb-4e13-a32a-82d3c965c3ad.tmp
Size 9KB
SHA256 a4dcbfb06c7cda765da3b1af3a68b5852caa042dfda40e622864e8cb9965e954
MD5 24642bfa35c583ce8f091edd6ce293eb
SHA1 3b93e83f04b427b62b46c0f9bf3c9ed94a4c5cdc
SHA512 8bbd2f3a262e9fabfec402ebae42ef2b8cded88bf97cc5a9d90229f3aecf73ea299f91e07b4f16d3ffe739745e4ba8fc79ffb8598b2d5a59c994f9ef805b30bb
SSDEEP 192:sxZ5R9nR/fssFdfIdpJHW6+WNGY3eAHYIg5JJ:sxZ53R/fssHQJHbGj1
TLSH
T1AE22C5126E28B93B8CCBD21DBB25BF53E6F9503291D41E48AAFC861C05E76DD124740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

664270a4-8ca0-406c-ab4c-68073584f60a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\664270a4-8ca0-406c-ab4c-68073584f60a.tmp
Size 10KB
SHA256 c6f5275cb541d513f7f01c467d49c84c3fa8c021bd3868e73ee994cfc1ab5cbb
MD5 64bf91b001b50c0ea92cab86a2691af0
SHA1 46b256f8b496f72b36582692e602ffb71c62ae46
SHA512 e0eee773a57bcde40b44100ce449cea9ffba2cf20cb23dfba313efae8655137e14fd6b44c7072e6151e44efda37ed0631d281c81aa65341d5b739c43484c84de
SSDEEP 192:sxZ5R9nR/fssFNDfIdpLHW6+WNGY3S8XYIg5zJ:sxZ53R/fss7DQLHbG7b
TLSH
T1F422C6126E28B93B8CC7E21DBA257F53E6F9503291941E48AAFCCA1C05E7ADD120740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6bba2f19-e90e-4c07-a0ae-52e3ed871854.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6bba2f19-e90e-4c07-a0ae-52e3ed871854.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 f4de3db122d91fe94f3d1837471eae36900d19e32595d159c18fae4b1c57e096
MD5 0f0996b609073da365608a8352f9e7de
SHA1 d4b59392c509a1aa5d9210e769fdac6a91175cc5
SHA512 b7101abc236e17efbecd89361b5a3c27e37878f16c6fd5b3301528e04fc199e3a0e2f0315287855075267f99f17e62f23b9c05c97dbedb50ddf8664b3466425b
TLSH
T1ED6183C1649240BDD79803B07DED2CE7B53C5AB966A3BD10C59BE43DBB4A7B412072C4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 569965d4ad5883d5f161dce0be1aaed8ad25eb761e8b65c2c3363042104b8ea0
MD5 b98ff0915cee489c63b9095823c19110
SHA1 2d2c219050fd2e682498eae39209ebb747f251ae
SHA512 455ebac943a8cfe50e2abcdbacb3e9f4209c6e0f81fbf3b35a36eadc5f0106cf57dd354c9b16c87f9b66e4c48000b3dbf0f5edd6dba6417c6bac03f9b7fca64a
TLSH
T1166183C1649240BDD79803B0BDED2CEBB53C5AB966A3BD10C59BD43DBB4A3B412072C4
MD5 SHA1 SHA512 TLSH

Submit Download

27659bb3-d188-476c-bdb7-c391d6aa1144.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\27659bb3-d188-476c-bdb7-c391d6aa1144.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

60504b60-a32c-4b62-95af-bbfa99feeea7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\60504b60-a32c-4b62-95af-bbfa99feeea7.tmp
Size 949B
SHA256 9f771741be0572afeb0e4331d30dee3e12ba3c6a9be411c3b7882683b36856dc
MD5 983a3940802b880990dfe137b9c44010
SHA1 ccacfd9e0e4635df89e51621af01a4e471dea043
SHA512 988864423103fd024aa7ece6387c677c2454272b43a12c00fb1478acc63ebb2e013df2e463e21be95f29413c646e1c68d350330affba5562aff6b5a691cea3ce
TLSH
T152115CF7C3D5856E890516F05A28AE2BCE2D0606821C7C59C9D4EF2BD3F3475E10259F
MD5 SHA1 SHA512 TLSH

Submit Download

d3e87550-8a60-4c5a-bb67-f825bde4a140.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\d3e87550-8a60-4c5a-bb67-f825bde4a140.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

dbd041f5-acec-42b9-a8dc-a1ee962151e0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\dbd041f5-acec-42b9-a8dc-a1ee962151e0.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 d8de179ed5a00bb5b93f7b2aa77a64654be7c507e285b2bb2896b7a73f9aba03
MD5 9e0f97d16c4fbb596a1ecb474061ba79
SHA1 b42d1d7629b3ef7b3d88702f9369c0616d07a920
SHA512 155c5afcef56e997acd0e2bad762edf5096b34f4b0b5abe64a4a5689bb0cf9444b0c0a38773001c9e2171b1d8443c25e9fed7945712f7a96940c21b02c229444
SSDEEP 48:K06lI064I5bkjUISs5K9Q1K5xipYb8IKyLWRsQO00tbYvAISotK9M1OtxG9Yn4cI:KwhyKSQSmdiK2oxeoK/aqyC8KTa2
TLSH
T19EB10029306B564079FD3D4D4AB5862A128235B33016E56B7BB884F94E2FF524CFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a2ed097b-deaa-4810-bc7b-d707f295a611.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a2ed097b-deaa-4810-bc7b-d707f295a611.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cd19b789-94c9-4d7a-b6da-ec9b2f57349e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\cd19b789-94c9-4d7a-b6da-ec9b2f57349e.tmp
Size 10KB
SHA256 de9f8301056a9b9e51539b02a31968c38fc236fa0ff0b91737cbced3be73f1aa
MD5 7f27fdf6d5995f01acea1704244ab4a4
SHA1 00fb696a80ce59589a4e8e545de628a24bf35e69
SHA512 05d51117d826c5682bdd8c7e61477a3035cc84857c45d1dc71ca6a1e687f323e630f989a583115917ab7c3969d2af04fbb80622b2107a774771db289830a50a5
SSDEEP 192:sxZ5R9nR/fssFNDfIdpJHW6+WNGY3G3HYIg5zJ:sxZ53R/fss7DQJHbGIb
TLSH
T12622B5116E28B97B8CCBE21DBA257F53E6F9503291D41E48AAFCCA1C05E7ADD124740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cee3485d-4a71-44e5-b409-f3f1ef03feef.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\cee3485d-4a71-44e5-b409-f3f1ef03feef.tmp
Size 27KB
SHA256 c54771aa2ef836b9d3a9ea5259de9e3b6a0f667d731da400e55b87a212345951
MD5 98c614a463e3022f805620da81cb4d50
SHA1 fac4dda4eefdb7b2831fe7e049436df49ccd6e6b
SHA512 4d06e8a0b5caf0d6ad5e756366da212c46a3e5e72568d59fe011cb5f43c62aea214f4369f9a8c31c2eac89ca321cfc0489c0d306c3467e09ce0c61056781a730
SSDEEP 768:L130AbSWvS2l98F1+UoAYDCx9Tuqh0VfUC9xbog/OVGmLlLJ72krolZMBn:L130AbSWvS2l9u1jaLmLZ12vMn
TLSH
T16BC2DB3B640CCB7E4FC05A9DDC6AAF9B6E9C02C796548D4047FA984C02C77EA911B4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

99276fd8-e436-4ac6-9890-9886e60c6708.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\99276fd8-e436-4ac6-9890-9886e60c6708.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

bb8330a7-b9fa-4736-8493-12be96f8382e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\bb8330a7-b9fa-4736-8493-12be96f8382e.tmp
Size 18KB
SHA256 229b0f6a1cf51ea9ff746d4ef15bde7c4003b02aed48a5e8c0c8a7f9ef3863f4
MD5 957092592ab5b150c0a06fc78404a674
SHA1 2de9a2bf6f2e8899a9be7404abb9d04b3eb65229
SHA512 0a4511bd7f832a5e5b2110f14cb5a027c22653fee4f52a3d08ea1d28199b5b4d95f5320ae296d23b993a217ab8cab8dd863c6e211e25f633c8bf534ca4f89983
SSDEEP 384:NQkUSv0sNIasHOpunh+9iX5FA+eM/6vaTZcZIIlA:30DO0qaE+/6vaTZcZLK
TLSH
T10C827D31A8787C3B4DA29661F14B3603CEB49167CAC81F94D9DD6B2C06DE1D8235B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c453f4b2-02e3-431a-a0d2-0371f5bfcc42.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c453f4b2-02e3-431a-a0d2-0371f5bfcc42.tmp
Size 18KB
SHA256 30929902637fdad6c4b766b8bbb6e643a94f70aa18c5ad29235bde5fe9fb40a7
MD5 48b8d9da52fbe4676405ddf4a46fd592
SHA1 070ab8dd81970cea7b836342520ac11ace492ee0
SHA512 445823ad44fd939df93a1fb6a8a4cd8ce507445d14e13be2c041d133883eb16e28d14cc533f97b6e3dc48a298da721fdecf34d59bc3aa139070b97fc2a6cf455
SSDEEP 384:8QkUSv0sNILsHOpuch+9iX5FA+eMU6vaTZcZIIlA:80IOZqaE+U6vaTZcZLK
TLSH
T1DF828D31A8787C3B4DA3D651F14B3603DEB4916BCAC81F94D5DD6B2C06DB2D8235B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ebaa6833-43ca-42ed-8528-92aba89748d1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ebaa6833-43ca-42ed-8528-92aba89748d1.tmp
Size 18KB
SHA256 944eb88bb0ef74dc124e84f5550fe0430022e7c81b96a65c6f18dc7ce6e8a0e5
MD5 dd994bff8c6c211308a293f55f717767
SHA1 317b0049f8d34541319bc0a09c6328a108eaa6c8
SHA512 8e36e4e3514aa4835edaed22bd82c523769dbc874ca6adcd91795e26692d9049e9efcfd3ed37d410f981dd7a4378828c6eb50a801ebb92fea1eee7a0438ac7ab
SSDEEP 384:AQkUSv0sNIOsHOpuch+9iX5FA+eMU6vaTZcZIIlA:o0POZqaE+U6vaTZcZLK
TLSH
T1AA828D31A8787C3B4DA3D661F14B3603CEB49167CAC81F94D5DD6B2C06DB2D8235B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

30d39bf3-57e8-45e1-84b2-9a52917ec46e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\30d39bf3-57e8-45e1-84b2-9a52917ec46e.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 20a2a275ba3d58195ba8c0bc68a6a65fbfd235e3617691e4a1c85ad219a83e14
MD5 59b9c224ec8e359901b2856904333ee5
SHA1 0df124b1b60691c491e33aae68c23c64d9dd60eb
SHA512 ebab7a3d54564633606149d153c6cf292d9224e76813dbe825a23522ebc647520a03bcaf7164bc9e83704d38a88f027d56c31fba31f2fdad8372b59342ef058a
TLSH
T1B4413798B6EE1148B3B36E5A9BF6982E487E78372E0BD45D00110E4F4672A01C971B37
MD5 SHA1 SHA512 TLSH

Submit Download

1d680a35-7012-41f3-86d1-17601dc3adf8.tmp

Path C:\Users\Admin\AppData\Local\Visla\WebView2Cache\EBWebView\1d680a35-7012-41f3-86d1-17601dc3adf8.tmp
Size 16KB
SHA256 6da0e4beb56be4378a79c78c58a45fb5fc1f7d5cfd7689defd990275a700b816
MD5 a46f0a9990874f7d5891cbddea2ab7d4
SHA1 863a1a99b9780afa77fb5a83460b8398d7725e22
SHA512 2efe2f9c4a10b8cd6159c99739b4f794e593b059b69242ca2db8e13a6bfebd6f84de3f41019c5ec7f59322f1e7f0d5bee274873fc86ef9e4db6d6ae03b392e68
SSDEEP 384:zu+OBqImmJvGBLx3NaFMJFNNbiC5pLkLCg6rI:ncvGtlNR3WEk
TLSH
T1F2729D7618797A232CE7C94AF98E278BCB3111A7C0D46AF9DCFD8F0E019B5851352D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

241beeee-33a8-47ec-bfb0-5653189dffba.tmp

Path C:\Users\Admin\AppData\Local\Visla\WebView2Cache\EBWebView\241beeee-33a8-47ec-bfb0-5653189dffba.tmp
Size 1KB
SHA256 0ca3c563adecf97280ce5ed10cb0f386001b982afd2497f31ce530312d656e72
MD5 f02a53abf23a323c8407c9a89b5a6abf
SHA1 bcb5e448f9a6d8b6489167b4b202843a5dd6ef44
SHA512 4f64da1ccf3b281e6ca53ac364058eceb85008f4b61d45976defe369bcbee188fffa0ba2c0aa127f55fbcbd334a2aac181e4f9a1bed138f39819fcbd5e9cf485
TLSH
T1F231ACB1E0643B316C856503B15A7AA77F20107DC5404DA8F5EE472C05D75CC8259D33
MD5 SHA1 SHA512 TLSH

Submit Download

4a550314-df10-4ce5-95ed-b2aab3cfbca2.tmp

Path C:\Users\Admin\AppData\Local\Visla\WebView2Cache\EBWebView\4a550314-df10-4ce5-95ed-b2aab3cfbca2.tmp
Size 2KB
SHA256 8f7510094e8b5ccd5db67a35105ace2118ffd06a37dd398bfaf5d17bcdfb3293
MD5 5b0cae71738d52e374f42f244c4b3370
SHA1 e78c7b7d76851b0eaffbb712d358e7e99c42288a
SHA512 1ec552f888e7106b376002f8bbc3a8a2f1390d29e4fa61fec92840d301a48d7b5469ddad4b2a87572f7d90e43d2201fb2dc90b858bf8d171fa1712093f30420a
TLSH
T10E51C872B4287B3789E25A05BD4A3F27EB355075DA501FB0E9ED1B2C01D769C2381C27
MD5 SHA1 SHA512 TLSH

Submit Download

6b3ba491-d73e-459f-af1f-f8da78759edf.tmp

Path C:\Users\Admin\AppData\Local\Visla\WebView2Cache\EBWebView\6b3ba491-d73e-459f-af1f-f8da78759edf.tmp
Size 3KB
SHA256 31e769cc6ac5d27b043c61096604e8df33c518db81887d487b13beb77e32e3ba
MD5 3074fb6ea806a61d615e85f94356192a
SHA1 6e7019f3ba62c0a224d4107827899d98c5f2f68c
SHA512 367ce0b81f957c058c7b36f4cd6324f958c6ea5868c8cb97de51e137dcc9f0005dd76bad3dc734b9db6b9147d721e8a34e619f5d49112140e44dbf5b359ba1be
TLSH
T1BA719572A478BA374DE29A06B98A2B17F7655136D5802FB8D9ED0F1C01D77D81381C17
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Visla\WebView2Cache\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 c859f1042c39c58d4c97cb97949871cf80dc95356b8e5d50b26093af3f21a8a0
MD5 65ca97cc46d1b421d51d8a57479fd1f0
SHA1 a103b2dcecebc9813131138ea1a1e9eabd7c6d16
SHA512 21ad774f7cdeb59ae42360059b605ecbb7865a66e816dfdc7fdc17fc76dbc876be01223fef45a5f24a527b267dc4e01a18272b8a36890773470ffcc3db0ddea2
TLSH
T182D0243F33C14174C01431731003714D0C00C10F40074000543DCF5F5F144500D03CD5
MD5 SHA1 SHA512 TLSH

Submit Download

f_000003

Path C:\Users\Admin\AppData\Local\Visla\WebView2Cache\EBWebView\Default\Cache\Cache_Data\f_000003
Size 351KB
SHA256 3fe90e0e5787638faec9dbbe15ffed7f89575f952316d1aa1b4b1efd7f311f9e
MD5 177db3ca83855050190c58b9c71d3cd9
SHA1 21fb057e463f4237191d645a21a2a3400672d15b
SHA512 f2629f151db750cc78bad4416de2df6c6940a95b5dd1039b515d17cac48e5ca9ffb4bbc86a4e7d83ed3f62b520a294ce409028a5673fe28e69f4b8d48b4860f2
SSDEEP 6144:oaGsIQecJMjhhC8i6HmsMpFPUn8eIPUrXvT1IBgsiYkkQMI3hkKxdlxQQRFJD:TGsIQJJUhhCbgSs8eqCXfdYRpMh5xdlh
TLSH
T1E47422A98FF18BF50A635D4C6CBFC1250CB6C7E9818837582934B5004F99986FEDEA85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Visla\WebView2Cache\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 48B
SHA256 a537a44644a12c2b0b30274de3600975a9439ddff1de4137077278c23bf3b39f
MD5 6ace024fa84758ad042aaf99cba7927d
SHA1 4e8a7c2314738444ba194c295237d99f78d5a972
SHA512 57577477000167e2b1354c38a569f6448ebe8146033c6416f7c43cdb2f1bfc3e01e5144459e479f79556e877ffdaf3564703e95b88c7e46c99182e4b3b6f3de2
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Visla\WebView2Cache\EBWebView\Default\DawnWebGPUCache\index
Size 256KB
SHA256 db5a4235b887a40921f0daa3c7a7482adf6f9e0ef19f919245c133198e51ab46
MD5 25a3b3d46e268c47b56a25a601991202
SHA1 af07c2ade29beba794d1b1bbf132aff2bfbffef0
SHA512 3ce89ca70978e92d6880bf1b05bbf32a53b8385e9a21148fefc3fe3485dfc7df8a2b790bf624e88d3ab8894874de9c454ad01ff4e44286b12446c97195324b18
SSDEEP 3:LstlNllkll/lB/6/:LsX3lEtB/K
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Visla\WebView2Cache\EBWebView\Default\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Visla\WebView2Cache\EBWebView\Default\GPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Visla\WebView2Cache\EBWebView\Default\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Visla\WebView2Cache\EBWebView\Default\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

3ff24860-9283-4df3-bcbf-ebe3ef51d71b.tmp

Path C:\Users\Admin\AppData\Local\Visla\WebView2Cache\EBWebView\Default\Network\3ff24860-9283-4df3-bcbf-ebe3ef51d71b.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Visla\WebView2Cache\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Visla\WebView2Cache\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Visla\WebView2Cache\EBWebView\Local State
Size 1KB
SHA256 f0cf04a99dce05f69e4634d8ae04387e4904cf7579e684178edf70fea525394b
MD5 2c8d2491b3b6e7f9dcefb6855512bd5f
SHA1 22d5425ac59222108dca333b661c2581d74a75a5
SHA512 360510d611c1fa3fdf313307711054a6d542cfaa2b554c84646020a31c060409fac2b65587538f58932611377c367f16cff3cb6ba23769240ef177cb03870326
TLSH
T10A21B7B2C0A43B32B9415813F25ABADB3F105079C5400E6CF8EE062C02D79DC826AC33
MD5 SHA1 SHA512 TLSH

Submit Download

Visla.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Visla\Visla.lnk
Size 945B
SHA256 df5e1899cddbbe4a86a4b3a151182cb339a4da6939089a28cfadeaac5f79f114
MD5 57e80db28f703095d719279d5d823800
SHA1 2b9bd038fd525f54d7cfd2468848d4ff0d2479fe
SHA512 bacb5fc7623695f2edc25488ba536e1746dfd73780f76836fa3af2666b492054ea0dbbb8ce1e28ea16e2eeb9ee1e3c36a24754205a7fe1044bf9357d83142403
TLSH
T1EC1125602BDA4F49E3F71DB222775734E2739E80EF72E3895181A5406D61540D825F26
MD5 SHA1 SHA512 TLSH

Submit Download

~isla.tmp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Visla\~isla.tmp
Size 1002B
SHA256 b8b480aed1900a1689a3526446a72cd6a2848f5cc6a80ea5c4db9a8c8f5f67d7
MD5 b949bcabc86cef5a1b4f466af850c974
SHA1 65856406f8a0f72537db0a02432cbf75414991e1
SHA512 f6c333ec94ac112cf71cd0c6f86ceb0977c961907fb1339b93e545647664daddd11e47799d519a3ccd02209be94018e4a340d4934c7c49405ebe481d95a46000
TLSH
T1CD1186602BCA4F05E3F70CB226774734E2738EC0FF61D3484281A6807D65140D828F26
MD5 SHA1 SHA512 TLSH

Submit Download

~isla.tmp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Visla\~isla.tmp
Size 1KB
SHA256 031c0c142bdfe4d7bd1dbcbde6980e71b21973f9bb6975993d3b02fd21219999
MD5 f6653e9e4098d2a64a9ad252fe118d02
SHA1 50f4dcef5ba0971556a9b0a16d45ee8266f8a59b
SHA512 6f5dd6fb0357974a7ee9e96da6117884d552d6dfbf23438924fa569525f60d1a72e653c6d0f531dce996c24fba2ac6037d95826123aa33e7366de656c95eae35
TLSH
T1E51152612ACA4F09E3F71CB226774735A2739E80EF62E3495282A6806D65540D82CFA6
MD5 SHA1 SHA512 TLSH

Submit Download

Visla.exe

Path C:\Users\Admin\AppData\Roaming\Visla\Visla.exe
Size 187KB
SHA256 ab3c92fcd8e73701b92b9aada8a3fd9b2ff7c4b16eb28483ee9e9e2e33e6c48b
MD5 2f1b9c6cdfb1071c29f58e405f484fa8
SHA1 0045521f0e0910cae2362a64d06940fb98fe708d
SHA512 078f7e637a58e9abc625e6b29d66439f896aedc7aaf235e7b74510eee624781196c5c45a6ebe060ab390afe7fc9490684185ef7407f1b6fa5f7be8635b6847d0
SSDEEP 1536:5VAK43yM3uqclPXvxp1A69fDdmDOacfHi6Era7qKlS:5VAK43/clPXxA69fDd9ijra2WS
TLSH
T1E514F75EA6DD38E8D162E63482B1CAA1E3B27D4197D673CF1360B12E0E722C35F75A11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VislaServiceCore.dll

Path C:\Users\Admin\AppData\Roaming\Visla\VislaServiceCore.dll
Size 9.3MB
SHA256 be3cc59a719ee1ea8d96b69d7e79f8276478cb1d0340179a244aa7967d8cf71d
MD5 bbac82eeb834dad7ae25a553d8c5cdad
SHA1 aefd037d2af398de91587b78e02f4b66c3e145e9
SHA512 877d52b9d6e20315fad81b64fca17e7e7a58d152c188ac2c8b16882c73010b7b5274ef88958987bdbc7de7e976a876b987cc90c7ea99aa28b86076098d22b947
SSDEEP 49152:TIsZ9jjGb0YbGTpp2jYhkcdXDh5MB2dwvqU8Sd+rSb3wQe/spkQiP2mTsgn7FUCs:phBZDcwFdWQt1e7556deC26omxnG
TLSH
T149A67C5B766800ADC1BAD1BC8E0BD907E772B45903A193DF12E1D7566FA73E08E7E210
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

avcodec-61.dll

Path C:\Users\Admin\AppData\Roaming\Visla\avcodec-61.dll
Size 25.1MB
SHA256 4917724d0a2ca881c5aec8cdeb7f0ce4f698de891438ce7515250b7c1bd5139b
MD5 4d40187def2f263d27f425bf47ab6f6e
SHA1 9ab64fd837ff1846a84c34a2f59c753f8886430e
SHA512 534253a635268d093770d876d7092cf6b2196187de21f445b1f9c34bb7aa406597239ed28915a6d781535411b22734b0fdc29d248bbef57f30896d5e2f44cef7
SSDEEP 393216:cKgKKQjSdxQPkJeuhyjrFH22+tLhHf+saV7mavZjQkmB740hnrJZZUdIz1ZouUIf:NgEmsjl5x8
TLSH
T1F047AE46F3A251E4C57BC434C26AAA17FB6834AE432057FB66E096752F33BD05A3E740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

avfilter-10.dll

Path C:\Users\Admin\AppData\Roaming\Visla\avfilter-10.dll
Size 4.1MB
SHA256 ceeef847292cbc007ee1c2e58f02806d41b0f4abd9a850ddf2ef9d62afe63e8c
MD5 5b689a9f2fb5324720ff7aaa0caea699
SHA1 968ed43f7988b58d911d6ddd9fd426b1771a273a
SHA512 d1e4f8ef317ce812e9580c1a5846942f4eb7708fbc196a5df6b6ebf3a3e73c00f56f653ed7f7279e55ef694a552de843b6d90e0e2c94f63279f7ed187c4c7851
SSDEEP 49152:SO8gsUCmd8yhavltQWTd3HEjBDtUtNeewRoLE4KW4rVx8qhkayuE4gB/SU7l+cas:MeC7kjfe57Jxa8d
TLSH
T185168D42F2A651DDD03B843481FB720BFB70385903705BEB87A0865A6F67BD06A7B716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

avformat-61.dll

Path C:\Users\Admin\AppData\Roaming\Visla\avformat-61.dll
Size 2.5MB
SHA256 105e3bbc4ce6156c3f9d53edef4ef0ef482775cf1d6d8c6dc45442177c9d082f
MD5 95a04ab58186ef801ba49a7cf5cafd61
SHA1 92a82d330b9fce2c15d08dc4e9512935e4a49b6b
SHA512 2f2f398a81cee6966a8891f5859ed8813be0ccf7967074b9cce3742166da58570093a9cc9912101fb9f86adca81c2d3e1abe4a16341bae1701d319c90dfd6d52
SSDEEP 49152:PKCnqA70cz0ifr8pa++858AppJpCJXY4QPsrl/xzUjC3p8sDtsk8dbHWGz:HqSz6paV8FpSQUrKHJ
TLSH
T15DC59E47B7B411ACC6BBC17886474717EBF1B4591360ABEB066087792F63BF1663A310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

avutil-59.dll

Path C:\Users\Admin\AppData\Roaming\Visla\avutil-59.dll
Size 1.2MB
SHA256 4ff8ca42ef4146c81c629958ffebb96468cf5692d625308bf3cd97b5afaabe85
MD5 6aa2f0ef961d695dc3479d79072c4154
SHA1 cd2a46cb358713ff233320373d1436960dffa7a1
SHA512 8d5a6fa555b32df3d2fdc83cc0b90c65441ddd8ae39685474149083c279de6ba35458d14da1f071ac225cb620da6213404e12db7ee44cf30382350ba7d8d0bea
SSDEEP 12288:v35tH40S95Bczio/bTAJjzgYszd12bOO312mxmIhQJI8PAVRoVaS12GA:v35d4v7VPjzgYszd1gOO31Pxl2AzOa2A
TLSH
T102458E05D6E1047AC46A5034C6A7590AF6723412C760BAFF27E14A683F23BE25DBFB35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-1_1-x64.dll

Path C:\Users\Admin\AppData\Roaming\Visla\libcrypto-1_1-x64.dll
Size 2.8MB
SHA256 4552c7ea151bb345a9b00cab5165e23bd451af3a4f45db551da78cbe18aed7e0
MD5 98690b895926fd25ad083f28775d914c
SHA1 7ce7f04e03a871b5723a6550edde370d9dca9f3b
SHA512 95b072d70556f42740726b5abcec2322ccaf8b1d6563b70aa468c8e7d2a52df160d5698ae250af6c00d879e0b1d3f471f665f2a7295a500c63498e4226ea755a
SSDEEP 49152:aPKWI8vhpw3C1ZdjsE50lI/hEpz6QOr6MOGJpTZINPensPh1CPwDv3uFfJvHf:8NFOcsgpZI0nsJ1CPwDv3uFfJn
TLSH
T1FFD58C5AA7AC0584E9BAC27C89534627E3F1F95903B09BCF09A685780F23FD6273D744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcurl.dll

Path C:\Users\Admin\AppData\Roaming\Visla\libcurl.dll
Size 500KB
SHA256 a0cad3254e9ee21d0b29a9fa934c2fca69d920f6a9da90813e58920acdabaf13
MD5 4abd8565fcc5d8baad105392a7dc8c0d
SHA1 336e98be1f82c47649951fec47cadd90099ed0ef
SHA512 2425e16dd9c70f2a13892d0ccd1cd31ae3e8fe635dc2ac9185b1cc519402690710bfe6ca738f89746a5d86992adc6a0d1f7abfc20e72f1ee827305fbd9a6eae5
SSDEEP 12288:6NK2Z+n8l2NqXvd4sm+MxbLgos6DWTdRXG:CK2Mn8sNqXV4f+M5koZDWxR2
TLSH
T11AB46B96A3B409A9D5A7C13CC2538A03E3B2B0591361D3CB17B4D6BA2F53BD6663B350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libprotobuf-lite.dll

Path C:\Users\Admin\AppData\Roaming\Visla\libprotobuf-lite.dll
Size 540KB
SHA256 6cb714a9d2e8fd3952ed4f2aec36eee1c83c6ff2f9edcadfb9c95d32c532d589
MD5 3a13e21108a82902c163d6ef770a919a
SHA1 aac4f04d9d4ab65687acbf30c72668ce67b53720
SHA512 10eb49f44d83d2631b45c3599827b089b68b4f0a3733f2030b9bcb19246fb74ef4151a2c378d70356f95667903275340ad6d9466b93e3b1ddfd4ebbd34d31914
SSDEEP 6144:SED5Kkz0fqNeGOlU5aVmwI62q2P8XuFFxpxxp3kCy/S+NUish:Tzz0NuM0wI6nZGvh
TLSH
T1A8C4D723B29A06E6D067D17895CA4305D3F678029B9347CF46B6AD01356B6C6CB3F3B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-1_1-x64.dll

Path C:\Users\Admin\AppData\Roaming\Visla\libssl-1_1-x64.dll
Size 686KB
SHA256 707c38d4853f1ead13d7f9d56b0894b8dd3a621d328b0e7a754e1f7327143445
MD5 a18a8d952fb8a3f2a17813aa161d2978
SHA1 6f67ef4332bfccd8dd40c124bccacc048ee14fb1
SHA512 141257b69915eb1ec945a9186eda3d394307e12916d95c3ea776111554a2b39754a6ad56ba77739c475f63a35ba7aee2a86f458475030bf232ac2c909c60c54e
SSDEEP 12288:UM9+sTvv9F8ghRJ6v0hvw9asneRJejBuLo528oXJTPU2lvzV:TT397RJ6v0x428qJTPU2lvzV
TLSH
T14FE44A91ABB51498D9E6C17C8A534A33F3BAF4141330AFCB0655893E0F17BD92B3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libvme.dll

Path C:\Users\Admin\AppData\Roaming\Visla\libvme.dll
Size 20.2MB
SHA256 56a75c990bfe89b2ffb05994cf8d05cf66d6eeec06f12033068586666e308aae
MD5 5c63dc3693ef02f4c413bdf13d6267f9
SHA1 2a33802f35a701a2493fcea6739f789103297b5e
SHA512 fbaba801aba80231da895b18fa73a2792af3c5906e2c1b0291e9a9dc3b21c8ef6ec17710d0b6068256a380b49fedc4c8bde65f8b1df013b8bfd87a4bdcf7ae6d
SSDEEP 196608:9n6ToimaXxazA3KVR0yM3Mox30c3KMjQXnxzQr75:9nLMXxazZuOc3mne5
TLSH
T13F279D47F29640E8C46AC174872BAA27FB71345A0320A6FF27D14A652F67FD05F3AB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Users\Admin\AppData\Roaming\Visla\msvcp140.dll
Size 562KB
SHA256 9057d39b36b6c7d054865ee2bf9cde7a490fe3b01ec4e82514687e24f576269f
MD5 cfdf6eaf5328fecbdec268b7f9e21f3a
SHA1 100c8a08de6544b8554a542ad55af831f86565e7
SHA512 a81feb56ae3e4939abb21597f4f60429b704e04e6c20fac402a0518fe7b29606bf8824347a7570d98f3c44684c15bf6b520e350321bfc2a42ec5597989215782
SSDEEP 12288:N9W8APqgSqvJP85TAv/kLRNKjxDJN7e12QEKZm+jWodEEVx7/:NPW9ILRwjxD62QEKZm+jWodEEb7/
TLSH
T1ABC40823B74D05E0E195E3B8A1878306D7F1BC4A8312A3C792EAD69D2F577D1673B290
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

swresample-5.dll

Path C:\Users\Admin\AppData\Roaming\Visla\swresample-5.dll
Size 236KB
SHA256 66ad70ce5b7f4bf0d717eca55eb776c0445d772c49ba588d25da2e3dc0f41f6c
MD5 3249c6969d004e05639817dde3ee95d9
SHA1 af6f8309c3c582f83c5a98dbf198b4622ae09bce
SHA512 4248d2ce2abf304ffa63bbe24c4c6296c3b9d313a017f68fbe55fe11df99398e6693b7c74e5a9bca569bfac21d1f742c1337aa4a176f0ee684aef2bc58f31c88
SSDEEP 3072:nCRPn7nzV3+tFDjqbnky2UJ5q1fr/IaRU4W2cZj6g/cQXL2DzV:o/7psjqzJ2d1r/tRFCTcQsx
TLSH
T190346C46B6E61CFCDDA78135C1671602EB7138610391EEFF07D186269E2B7D0993BB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Roaming\Visla\vcruntime140.dll
Size 117KB
SHA256 da72e6677bd1bcd01c453c1998aaa19aeaf6659f4774cf6848409da8232a95b2
MD5 943fc74c2e39fe803d828ccfa7e62409
SHA1 4e55d591111316027ae4402dfdfcf8815d541727
SHA512 96e9f32e89aee6faea6e5a3edc411f467f13b35ee42dd6f071723daeba57f611dbd4ff2735be26bb94223b5ec4ee1dffedf8dc744b936c32a27d17b471e37dcf
SSDEEP 1536:R9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaWEoecbdhUoTtHez9FazR:REnsvReGsWyxLizXFCecbd1Tt+i1
TLSH
T168C37C8572A002FBD17AC274C1A36A17FB75B94487A0A7CF03B58A660F53BE09E3D355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\Users\Admin\AppData\Roaming\Visla\vcruntime140_1.dll
Size 48KB
SHA256 26e470b29bed3d873e0c328186e53f95e9edbfe0b0fd0cda44743a0b1a04a828
MD5 05052be2c36166ff9646d7d00bb7413f
SHA1 d8d7c4b322d76e3a7b591024c62f15934979fe40
SHA512 0460cc66d06df9a2941607473f3eccfd909f2adab53a3328fadcedd1b194b388eca738c2c6c2e193de33606925fbed1fe39efa160015128e93f5e3a03c62170d
SSDEEP 768:qzzO6ujT3MbR3v0Cz6SKLq83yN+iRxw9zv6JmEpw9zF:3q/o1j3c+iIzv6JmEp4zF
TLSH
T181236B9417784482D4AB99B0C0DBEF577D7CF6964750A28F0BA0D1981F237D0EB3D21A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zip.dll

Path C:\Users\Admin\AppData\Roaming\Visla\zip.dll
Size 84KB
SHA256 8fd4534faa3ec7a926efbfeb1021ca7ae6347579ee279f580e069c344beb8c0b
MD5 9cc083f924b8f59af03c947ed9190a8d
SHA1 124e758669ca52e6702c84b970858f83d58f6290
SHA512 37de5d8fc2cc269809228a7611161914d8c4060949c35ed41102fd3890ba4447e4576465a5001aab15b55825766ecf7070a60a8be1b7259f1ea77886758540d6
SSDEEP 1536:ylexpmC18+A1gNGtUtaWSCLgQ5yfwozz0Rb7q+:Yexyj0fSab2+
TLSH
T128839E4A6AB4949DE9A7C334C406861FD3B6B428036193FF2B94C65A1F237C16E3DF16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fe38defa-a875-4204-a0e4-fa4da454092b.tmp

Path C:\Users\Admin\Downloads\fe38defa-a875-4204-a0e4-fa4da454092b.tmp
Size 3KB
SHA256 53e283c4aead385cc9c542c1dff032994dba42b45bcd6f614bee8aec769d82ba
MD5 06595174d9692a554176fc91822a2518
SHA1 b12240c4128daf1466f5ac8de6adf58616b6363e
SHA512 8f126963777d9552892bf3e42fbfa1c7928bc576ddeba2d3e5cfa1ac2485e7bb2502f9b99e7f1603a24f86f755fde97a08f3797c84d9252a33cf5dfeaa570f1c
TLSH
T1987112037210C175C148023C8CC7C10817A47C018D43440A3055B30F35302200128880
MD5 SHA1 SHA512 TLSH

Submit Download

MSI12F2.tmp

Path C:\Windows\Installer\MSI12F2.tmp
Size 211KB
SHA256 c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74
MD5 a3ae5d86ecf38db9427359ea37a5f646
SHA1 eb4cb5ff520717038adadcc5e1ef8f7c24b27a90
SHA512 96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0
SSDEEP 3072:/Jz/kyKA1X1dxbOZU32KndB4GLvyui2lhQtEaY4IDflQn0xHuudQ+cxEHSiZxaQ:/t/kE1jOZy2KL4GBiwQtEa4L2sV
TLSH
T1ED249D316094943EE7FA0936997ED671AE3DF2341760C9AEC3848C0E6D644C16BB7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.1MB
SHA256 2df88cd4ae69f7202915da5ebfbaf62888a48b87a7c3356c90aff2cb1f6a62ff
MD5 7d375168ee999439a122f1645aa0d907
SHA1 d6488003b82628d9347f7fe9a62053ffeba78ecc
SHA512 6ecafc53d2ac4cc6e8d805b85d80ef3401394d6b57bcb8f2c910407a92c3f90d4b150dedfa2bb939a44ecd46de52bb130878629ea8aa3992dc1497e2516a04b8
SSDEEP 24576:Ou8m+1zBdoO/vvTLrWUehm6w1dEzc10CIS2Nm7lFMka1ej9ZYfFtsSPBB:g
TLSH
T12247C52436F92100E7F79E3CACF06A674D3A7D579C159E8D05411B8E0922FB1E8B2F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{999af8dc-97fd-4500-9e01-a5a7e4f7ca3c}_OnDiskSnapshotProp

Path \??\Volume{d05fbc87-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{999af8dc-97fd-4500-9e01-a5a7e4f7ca3c}_OnDiskSnapshotProp
Size 6KB
SHA256 94db8e638b8e1c357e90dea0d74eb8743ef56acca9a7315f8f2909b778cdc65f
MD5 b8641f1b0874fd2a8ade311ea9d87841
SHA1 be1755f4ec79b70fb2a27c7ba3e68c41044d425e
SHA512 505112ee1da20301007cee3fbe032b212efcf51e3a6dedf7da5a33cd2cefa19dc373afbb7ae103a01ecb2869429cef578b1988046a3f534bfe8a95edf004a412
SSDEEP 96:F+pPwqvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:ABb++ZVmN
TLSH
T177D199085AF54711E2B3AB3229F14557A877B911EF33CB8E0298638E6670A10F875F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3428-481-0x0000027FF46B0000-0x0000027FF46B1000-memory.dmp

Download

memory/3916-433-0x0000029F553D0000-0x0000029F55E91000-memory.dmp

Download

memory/5432-654-0x00007FF9CCA70000-0x00007FF9CCA71000-memory.dmp

Download

memory/5648-523-0x00007FF9CCA70000-0x00007FF9CCA71000-memory.dmp

Download

memory/5820-536-0x00007FF9CB350000-0x00007FF9CB351000-memory.dmp

Download

memory/5820-537-0x00007FF9CC330000-0x00007FF9CC331000-memory.dmp

Download