Overview
overview
8Static
static
5Xeno-v1.3....re.dll
windows10-2004-x64
1Xeno-v1.3....re.dll
windows11-21h2-x64
1Xeno-v1.3....ms.dll
windows10-2004-x64
1Xeno-v1.3....ms.dll
windows11-21h2-x64
1Xeno-v1.3....pf.dll
windows10-2004-x64
1Xeno-v1.3....pf.dll
windows11-21h2-x64
1Xeno-v1.3....on.dll
windows10-2004-x64
1Xeno-v1.3....on.dll
windows11-21h2-x64
1Xeno-v1.3....er.dll
windows10-2004-x64
1Xeno-v1.3.40/Xeno.dll
windows10-2004-x64
1Xeno-v1.3.40/Xeno.dll
windows11-21h2-x64
1Xeno-v1.3.40/Xeno.exe
windows10-2004-x64
8Xeno-v1.3.40/Xeno.exe
windows11-21h2-x64
8Xeno-v1.3....UI.exe
windows10-2004-x64
1Xeno-v1.3....UI.exe
windows11-21h2-x64
1Xeno-v1.3....-0.dll
windows10-2004-x64
1Xeno-v1.3....-0.dll
windows10-2004-x64
1Xeno-v1.3....-0.dll
windows10-2004-x64
1Xeno-v1.3....-0.dll
windows10-2004-x64
1Xeno-v1.3....-0.dll
windows10-2004-x64
1Xeno-v1.3....-0.dll
windows10-2004-x64
1Xeno-v1.3....-0.dll
windows10-2004-x64
1Xeno-v1.3....-0.dll
windows10-2004-x64
1Xeno-v1.3....-0.dll
windows10-2004-x64
1Xeno-v1.3....-0.dll
windows10-2004-x64
1Xeno-v1.3....-0.dll
windows10-2004-x64
1Xeno-v1.3....40.dll
windows10-2004-x64
1Xeno-v1.3....40.dll
windows11-21h2-x64
1Xeno-v1.3....x.html
windows10-2004-x64
6Xeno-v1.3....x.html
windows11-21h2-x64
6Xeno-v1.3....ain.js
windows10-2004-x64
3Xeno-v1.3....ain.js
windows11-21h2-x64
3Analysis
- user interaction
yes - max time kernel
149s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
11/05/2026, 19:42
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
Xeno-v1.3.40/Microsoft.Web.WebView2.Core.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
Xeno-v1.3.40/Microsoft.Web.WebView2.Core.dll
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
Xeno-v1.3.40/Microsoft.Web.WebView2.WinForms.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
Xeno-v1.3.40/Microsoft.Web.WebView2.WinForms.dll
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
Xeno-v1.3.40/Microsoft.Web.WebView2.Wpf.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
Xeno-v1.3.40/Microsoft.Web.WebView2.Wpf.dll
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
Xeno-v1.3.40/Newtonsoft.Json.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
Xeno-v1.3.40/Newtonsoft.Json.dll
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
Xeno-v1.3.40/WebView2Loader.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
Xeno-v1.3.40/Xeno.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral11
Sample
Xeno-v1.3.40/Xeno.dll
Resource
win11-20260130-en
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral12
Sample
Xeno-v1.3.40/Xeno.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
22 signatures
150 seconds
Behavioral task
behavioral13
Sample
Xeno-v1.3.40/Xeno.exe
Resource
win11-20260130-en
windows11-21h2-x64
14 signatures
150 seconds
Behavioral task
behavioral14
Sample
Xeno-v1.3.40/XenoUI.exe
Resource
win10v2004-20250619-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
Xeno-v1.3.40/XenoUI.exe
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
Xeno-v1.3.40/api-ms-win-crt-convert-l1-1-0.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
Xeno-v1.3.40/api-ms-win-crt-environment-l1-1-0.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
Xeno-v1.3.40/api-ms-win-crt-filesystem-l1-1-0.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
Xeno-v1.3.40/api-ms-win-crt-heap-l1-1-0.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
Xeno-v1.3.40/api-ms-win-crt-locale-l1-1-0.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral21
Sample
Xeno-v1.3.40/api-ms-win-crt-math-l1-1-0.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral22
Sample
Xeno-v1.3.40/api-ms-win-crt-runtime-l1-1-0.dll
Resource
win10v2004-20250619-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral23
Sample
Xeno-v1.3.40/api-ms-win-crt-stdio-l1-1-0.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral24
Sample
Xeno-v1.3.40/api-ms-win-crt-string-l1-1-0.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral25
Sample
Xeno-v1.3.40/api-ms-win-crt-time-l1-1-0.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral26
Sample
Xeno-v1.3.40/api-ms-win-crt-utility-l1-1-0.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral27
Sample
Xeno-v1.3.40/concrt140.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral28
Sample
Xeno-v1.3.40/concrt140.dll
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral29
Sample
Xeno-v1.3.40/editor/index.html
Resource
win10v2004-20260130-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral30
Sample
Xeno-v1.3.40/editor/index.html
Resource
win11-20260130-en
windows11-21h2-x64
13 signatures
150 seconds
Behavioral task
behavioral31
Sample
Xeno-v1.3.40/editor/vs/base/worker/workerMain.js
Resource
win10v2004-20260130-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral32
Sample
Xeno-v1.3.40/editor/vs/base/worker/workerMain.js
Resource
win11-20250610-en
windows11-21h2-x64
1 signatures
150 seconds
General
- Target Xeno-v1.3.40/Xeno.exe
- Size 164KB
- Sample260511-ye16kahs91
- SHA256 55dfcbdfed962883c5bbdc874953bba5f9202a94640fe64acf489f5ef067149d
- MD5 0d914dd413567a6296118586079be43e
- SHA1 3903fe4414de8ee01e6061ea8ea81ad64175d38c
- SHA512 1a6fcd8d0fd22f1a604637ab74e57eb3f0837c8601be35305c90d93f75812bf31627ebea689af7674c3c3e2db350975d7dace04fedf61de7c307b552a05e844d
- SSDEEP 3072:v9G2U1qr+Len2dIrOaWkQI1RcCtZKeL7GVs5FCsx7VP:vMOgIrOa17vDt467VP
- TLSH T1BFF34A07A6A850FEE1A7D679C9924941FB723C594B71A6CF03507AB60F377D0AE39302
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Downloads MZ/PE file 1 IoCs
flow pid Process 65 4708 msedge.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\Control Panel\International\Geo\Nation windowsdesktop-runtime-9.0.15-win-x64.exe - Executes dropped EXE 6 IoCs
pid Process 5736 windowsdesktop-runtime-9.0.15-win-x64.exe 5024 windowsdesktop-runtime-9.0.15-win-x64.exe 5656 windowsdesktop-runtime-9.0.15-win-x64.exe 5984 windowsdesktop-runtime-9.0.15-win-x64.exe 4268 windowsdesktop-runtime-9.0.15-win-x64.exe 5088 windowsdesktop-runtime-9.0.15-win-x64.exe - Loads dropped DLL 10 IoCs
pid Process 5024 windowsdesktop-runtime-9.0.15-win-x64.exe 3488 MsiExec.exe 3488 MsiExec.exe 4200 MsiExec.exe 4200 MsiExec.exe 4208 MsiExec.exe 4208 MsiExec.exe 5088 windowsdesktop-runtime-9.0.15-win-x64.exe 4552 MsiExec.exe 4552 MsiExec.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{e29f6a15-9665-4b06-8024-06f270a032b8} = "\"C:\\ProgramData\\Package Cache\\{e29f6a15-9665-4b06-8024-06f270a032b8}\\windowsdesktop-runtime-9.0.15-win-x64.exe\" /burn.runonce" windowsdesktop-runtime-9.0.15-win-x64.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\chrome_Unpacker_BeginUnzipping3380_748905684\_locales\ml\messages.json msedge.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.15\System.Xml.XPath.XDocument.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.15\System.Xml.XmlSerializer.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.15\ja\UIAutomationTypes.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.15\ko\System.Windows.Input.Manipulations.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.15\es\UIAutomationClientSideProviders.resources.dll msiexec.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3380_1158569028\manifest.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3380_748905684\_locales\en_GB\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3380_748905684\_locales\sv\messages.json msedge.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.15\System.Runtime.Intrinsics.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.15\it\UIAutomationClientSideProviders.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.15\de\UIAutomationClient.resources.dll msiexec.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3380_748905684\_locales\hu\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3380_748905684\_locales\pa\messages.json msedge.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.15\System.Private.Xml.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.15\System.Net.Quic.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.15\zh-Hant\UIAutomationTypes.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.15\System.Security.Cryptography.X509Certificates.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.15\System.Collections.Specialized.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.15\fr\PresentationCore.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.15\pt-BR\System.Windows.Forms.Primitives.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.15\ko\System.Xaml.resources.dll msiexec.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3380_748905684\_locales\my\messages.json msedge.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.15\System.Security.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.15\System.Configuration.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.15\System.Transactions.Local.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.15\zh-Hant\System.Xaml.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.15\ru\UIAutomationClient.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.15\zh-Hant\WindowsFormsIntegration.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.15\tr\UIAutomationClientSideProviders.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.15\System.ComponentModel.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.15\Microsoft.NETCore.App.deps.json msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.15\mscordbi.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.15\it\WindowsFormsIntegration.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.15\tr\ReachFramework.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.15\System.Xml.Linq.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.15\System.IO.FileSystem.DriveInfo.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.15\System.ComponentModel.Primitives.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.15\ko\System.Windows.Forms.Design.resources.dll msiexec.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3380_748905684\offscreendocument.html msedge.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.15\System.IO.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.15\Microsoft.WindowsDesktop.App.runtimeconfig.json msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.15\zh-Hant\WindowsBase.resources.dll msiexec.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3380_748905684\_locales\fil\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3380_748905684\_locales\mk\messages.json msedge.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.15\netstandard.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.15\de\System.Windows.Forms.Design.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.15\es\System.Windows.Forms.Primitives.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.15\System.ComponentModel.DataAnnotations.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.15\System.Security.Cryptography.Primitives.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.15\System.Linq.Queryable.dll msiexec.exe File created C:\Program Files\dotnet\dotnet.exe msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.15\it\System.Xaml.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.15\ru\UIAutomationProvider.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.15\UIAutomationProvider.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.15\System.Data.Common.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.15\System.IO.Compression.Brotli.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.15\ja\System.Xaml.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.15\pt-BR\PresentationFramework.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.15\System.Web.HttpUtility.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.15\cs\UIAutomationClientSideProviders.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.15\ru\System.Xaml.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.15\cs\UIAutomationClient.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.15\pt-BR\WindowsBase.resources.dll msiexec.exe - Drops file in Windows directory 35 IoCs
description ioc Process File opened for modification C:\Windows\Installer\e593890.msi msiexec.exe File created C:\Windows\Installer\e5938a0.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\SourceHash{04C98367-FC14-4376-8866-17AD112FB6B9} msiexec.exe File opened for modification C:\Windows\Installer\MSI4A23.tmp msiexec.exe File opened for modification C:\Windows\Installer\e593895.msi msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149 msiexec.exe File opened for modification C:\Windows\Installer\MSI4F66.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{49C0C973-52B5-4F6D-AD4F-9B9DF928BAC6} msiexec.exe File created C:\Windows\Installer\SourceHash{97184660-56D3-4CCB-8919-34067AB40CD6} msiexec.exe File opened for modification C:\Windows\Installer\MSI3F81.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI460A.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI4CC5.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI4B0E.tmp msiexec.exe File created C:\Windows\Installer\e593895.msi msiexec.exe File created C:\Windows\Installer\e59389c.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI542B.tmp msiexec.exe File created C:\Windows\Installer\e59388f.msi msiexec.exe File created C:\Windows\Installer\e593890.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI483D.tmp msiexec.exe File created C:\Windows\Installer\e593894.msi msiexec.exe File created C:\Windows\Installer\SourceHash{FCBBC2DC-2AD7-4F1F-A444-87A9FA94C6BA} msiexec.exe File opened for modification C:\Windows\Installer\e59389c.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI51B9.tmp msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI3C92.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI4D91.tmp msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1 msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149\fileCoreHostExe msiexec.exe File created C:\Windows\Installer\e59389b.msi msiexec.exe File created C:\Windows\Installer\e59388b.msi msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149\fileCoreHostExe msiexec.exe File opened for modification C:\Windows\Installer\MSI63CC.tmp msiexec.exe File opened for modification C:\Windows\Installer\e59388b.msi msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language windowsdesktop-runtime-9.0.15-win-x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language windowsdesktop-runtime-9.0.15-win-x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language windowsdesktop-runtime-9.0.15-win-x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language windowsdesktop-runtime-9.0.15-win-x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language windowsdesktop-runtime-9.0.15-win-x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language windowsdesktop-runtime-9.0.15-win-x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - System Time Discovery 1 TTPs 2 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 4884 msedge.exe 4708 msedge.exe - Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier msedge.exe - Enumerates system info in registry 2 TTPs 6 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe - Modifies data under HKEY_USERS 12 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29 msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29 msiexec.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry msedge.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134230022634549599" msedge.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b msiexec.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry msedge.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CD2CBBCF7DA2F1F44A44789AAF496CAB msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\0BA790D55315D4F481BA1C7E37CEBF42\76389C4041CF6734886671DA11F26B9B msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\76389C4041CF6734886671DA11F26B9B\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CD2CBBCF7DA2F1F44A44789AAF496CAB\PackageCode = "5DA03486F1441C74DBF5BCEA4E256F5E" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\76389C4041CF6734886671DA11F26B9B msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_72.60.50518_x64\Dependents windowsdesktop-runtime-9.0.15-win-x64.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CD2CBBCF7DA2F1F44A44789AAF496CAB\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CD2CBBCF7DA2F1F44A44789AAF496CAB\SourceList\PackageName = "dotnet-host-9.0.15-win-x64.msi" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\379C0C945B25D6F4DAF4B9D99F82AB6C\Assignment = "1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\066481793D65BCC498914360A74BC06D msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\066481793D65BCC498914360A74BC06D\Version = "1211942230" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\066481793D65BCC498914360A74BC06D\Assignment = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\066481793D65BCC498914360A74BC06D\SourceList\PackageName = "dotnet-runtime-9.0.15-win-x64.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_72.60.50518_x64\Dependents\{e29f6a15-9665-4b06-8024-06f270a032b8} windowsdesktop-runtime-9.0.15-win-x64.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CD2CBBCF7DA2F1F44A44789AAF496CAB\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\76389C4041CF6734886671DA11F26B9B\PackageCode = "ECCC83C01EC2B32458B507010217CA50" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\066481793D65BCC498914360A74BC06D\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{97184660-56D3-4CCB-8919-34067AB40CD6}v72.60.50518\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\76389C4041CF6734886671DA11F26B9B msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\379C0C945B25D6F4DAF4B9D99F82AB6C\InstanceType = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CD2CBBCF7DA2F1F44A44789AAF496CAB\Assignment = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\F71950C1A6A51F479A1ED20855BD5918\CD2CBBCF7DA2F1F44A44789AAF496CAB msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\379C0C945B25D6F4DAF4B9D99F82AB6C\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\76389C4041CF6734886671DA11F26B9B\ProductName = "Microsoft .NET Host FX Resolver - 9.0.15 (x64)" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_72.60.50518_x64\Dependents windowsdesktop-runtime-9.0.15-win-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\76389C4041CF6734886671DA11F26B9B\MainFeature msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\76389C4041CF6734886671DA11F26B9B\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CD2CBBCF7DA2F1F44A44789AAF496CAB msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CD2CBBCF7DA2F1F44A44789AAF496CAB\Provider msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_72.60.50530_x64\Version = "72.60.50530" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\379C0C945B25D6F4DAF4B9D99F82AB6C\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\066481793D65BCC498914360A74BC06D\MainFeature msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\066481793D65BCC498914360A74BC06D\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\066481793D65BCC498914360A74BC06D\SourceList\Media\1 = ";" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_72.60.50518_x64 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\379C0C945B25D6F4DAF4B9D99F82AB6C msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\76389C4041CF6734886671DA11F26B9B\Provider msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\76389C4041CF6734886671DA11F26B9B\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{04C98367-FC14-4376-8866-17AD112FB6B9}v72.60.50518\\" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\379C0C945B25D6F4DAF4B9D99F82AB6C\AdvertiseFlags = "388" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ msedge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\E1BACE52D1E5A276E37807BAD88CEE75 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\066481793D65BCC498914360A74BC06D\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_9.0_x64\ = "{FCBBC2DC-2AD7-4F1F-A444-87A9FA94C6BA}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_72.60.50530_x64\DisplayName = "Microsoft Windows Desktop Runtime - 9.0.15 (x64)" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\066481793D65BCC498914360A74BC06D\PackageCode = "85A3B229CD36C1E4B8F0C080D4A9868E" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\2AAAD14945F5BF17026218A18E771A20 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CD2CBBCF7DA2F1F44A44789AAF496CAB\Version = "1211942230" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CD2CBBCF7DA2F1F44A44789AAF496CAB\SourceList\Net msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\379C0C945B25D6F4DAF4B9D99F82AB6C\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1609746302-1884177235-1125644204-1000\{1934228E-6669-4AD7-B551-C75791882D1E} msedge.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{e29f6a15-9665-4b06-8024-06f270a032b8}\Version = "9.0.15.35926" windowsdesktop-runtime-9.0.15-win-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CD2CBBCF7DA2F1F44A44789AAF496CAB\ProductName = "Microsoft .NET Host - 9.0.15 (x64)" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\E1BACE52D1E5A276E37807BAD88CEE75\379C0C945B25D6F4DAF4B9D99F82AB6C msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_72.60.50530_x64\Dependents windowsdesktop-runtime-9.0.15-win-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_72.60.50518_x64\DisplayName = "Microsoft .NET Runtime - 9.0.15 (x64)" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\2AAAD14945F5BF17026218A18E771A20\066481793D65BCC498914360A74BC06D msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CD2CBBCF7DA2F1F44A44789AAF496CAB\MainFeature msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CD2CBBCF7DA2F1F44A44789AAF496CAB\Language = "1033" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\0BA790D55315D4F481BA1C7E37CEBF42 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CD2CBBCF7DA2F1F44A44789AAF496CAB\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\379C0C945B25D6F4DAF4B9D99F82AB6C\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{49C0C973-52B5-4F6D-AD4F-9B9DF928BAC6}v72.60.50530\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\379C0C945B25D6F4DAF4B9D99F82AB6C\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{49C0C973-52B5-4F6D-AD4F-9B9DF928BAC6}v72.60.50530\\" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\windowsdesktop_runtime_72.60.50530_x64 windowsdesktop-runtime-9.0.15-win-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\76389C4041CF6734886671DA11F26B9B\SourceList\PackageName = "dotnet-hostfxr-9.0.15-win-x64.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CD2CBBCF7DA2F1F44A44789AAF496CAB\SourceList\Media\1 = ";" msiexec.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1320 msiexec.exe 1320 msiexec.exe 1320 msiexec.exe 1320 msiexec.exe 1320 msiexec.exe 1320 msiexec.exe 1320 msiexec.exe 1320 msiexec.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 3380 msedge.exe 3380 msedge.exe 3380 msedge.exe 3380 msedge.exe 3380 msedge.exe 3380 msedge.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 5656 windowsdesktop-runtime-9.0.15-win-x64.exe Token: SeIncreaseQuotaPrivilege 5656 windowsdesktop-runtime-9.0.15-win-x64.exe Token: SeSecurityPrivilege 1320 msiexec.exe Token: SeCreateTokenPrivilege 5656 windowsdesktop-runtime-9.0.15-win-x64.exe Token: SeAssignPrimaryTokenPrivilege 5656 windowsdesktop-runtime-9.0.15-win-x64.exe Token: SeLockMemoryPrivilege 5656 windowsdesktop-runtime-9.0.15-win-x64.exe Token: SeIncreaseQuotaPrivilege 5656 windowsdesktop-runtime-9.0.15-win-x64.exe Token: SeMachineAccountPrivilege 5656 windowsdesktop-runtime-9.0.15-win-x64.exe Token: SeTcbPrivilege 5656 windowsdesktop-runtime-9.0.15-win-x64.exe Token: SeSecurityPrivilege 5656 windowsdesktop-runtime-9.0.15-win-x64.exe Token: SeTakeOwnershipPrivilege 5656 windowsdesktop-runtime-9.0.15-win-x64.exe Token: SeLoadDriverPrivilege 5656 windowsdesktop-runtime-9.0.15-win-x64.exe Token: SeSystemProfilePrivilege 5656 windowsdesktop-runtime-9.0.15-win-x64.exe Token: SeSystemtimePrivilege 5656 windowsdesktop-runtime-9.0.15-win-x64.exe Token: SeProfSingleProcessPrivilege 5656 windowsdesktop-runtime-9.0.15-win-x64.exe Token: SeIncBasePriorityPrivilege 5656 windowsdesktop-runtime-9.0.15-win-x64.exe Token: SeCreatePagefilePrivilege 5656 windowsdesktop-runtime-9.0.15-win-x64.exe Token: SeCreatePermanentPrivilege 5656 windowsdesktop-runtime-9.0.15-win-x64.exe Token: SeBackupPrivilege 5656 windowsdesktop-runtime-9.0.15-win-x64.exe Token: SeRestorePrivilege 5656 windowsdesktop-runtime-9.0.15-win-x64.exe Token: SeShutdownPrivilege 5656 windowsdesktop-runtime-9.0.15-win-x64.exe Token: SeDebugPrivilege 5656 windowsdesktop-runtime-9.0.15-win-x64.exe Token: SeAuditPrivilege 5656 windowsdesktop-runtime-9.0.15-win-x64.exe Token: SeSystemEnvironmentPrivilege 5656 windowsdesktop-runtime-9.0.15-win-x64.exe Token: SeChangeNotifyPrivilege 5656 windowsdesktop-runtime-9.0.15-win-x64.exe Token: SeRemoteShutdownPrivilege 5656 windowsdesktop-runtime-9.0.15-win-x64.exe Token: SeUndockPrivilege 5656 windowsdesktop-runtime-9.0.15-win-x64.exe Token: SeSyncAgentPrivilege 5656 windowsdesktop-runtime-9.0.15-win-x64.exe Token: SeEnableDelegationPrivilege 5656 windowsdesktop-runtime-9.0.15-win-x64.exe Token: SeManageVolumePrivilege 5656 windowsdesktop-runtime-9.0.15-win-x64.exe Token: SeImpersonatePrivilege 5656 windowsdesktop-runtime-9.0.15-win-x64.exe Token: SeCreateGlobalPrivilege 5656 windowsdesktop-runtime-9.0.15-win-x64.exe Token: SeRestorePrivilege 1320 msiexec.exe Token: SeTakeOwnershipPrivilege 1320 msiexec.exe Token: SeRestorePrivilege 1320 msiexec.exe Token: SeTakeOwnershipPrivilege 1320 msiexec.exe Token: SeRestorePrivilege 1320 msiexec.exe Token: SeTakeOwnershipPrivilege 1320 msiexec.exe Token: SeRestorePrivilege 1320 msiexec.exe Token: SeTakeOwnershipPrivilege 1320 msiexec.exe Token: SeRestorePrivilege 1320 msiexec.exe Token: SeTakeOwnershipPrivilege 1320 msiexec.exe Token: SeRestorePrivilege 1320 msiexec.exe Token: SeTakeOwnershipPrivilege 1320 msiexec.exe Token: SeRestorePrivilege 1320 msiexec.exe Token: SeTakeOwnershipPrivilege 1320 msiexec.exe Token: SeRestorePrivilege 1320 msiexec.exe Token: SeTakeOwnershipPrivilege 1320 msiexec.exe Token: SeRestorePrivilege 1320 msiexec.exe Token: SeTakeOwnershipPrivilege 1320 msiexec.exe Token: SeRestorePrivilege 1320 msiexec.exe Token: SeTakeOwnershipPrivilege 1320 msiexec.exe Token: SeRestorePrivilege 1320 msiexec.exe Token: SeTakeOwnershipPrivilege 1320 msiexec.exe Token: SeRestorePrivilege 1320 msiexec.exe Token: SeTakeOwnershipPrivilege 1320 msiexec.exe Token: SeRestorePrivilege 1320 msiexec.exe Token: SeTakeOwnershipPrivilege 1320 msiexec.exe Token: SeRestorePrivilege 1320 msiexec.exe Token: SeTakeOwnershipPrivilege 1320 msiexec.exe Token: SeRestorePrivilege 1320 msiexec.exe Token: SeTakeOwnershipPrivilege 1320 msiexec.exe Token: SeRestorePrivilege 1320 msiexec.exe Token: SeTakeOwnershipPrivilege 1320 msiexec.exe - Suspicious use of FindShellTrayWindow 16 IoCs
pid Process 3380 msedge.exe 3380 msedge.exe 3380 msedge.exe 3380 msedge.exe 3380 msedge.exe 3380 msedge.exe 3380 msedge.exe 3380 msedge.exe 3380 msedge.exe 3380 msedge.exe 3380 msedge.exe 3380 msedge.exe 3380 msedge.exe 3380 msedge.exe 5024 windowsdesktop-runtime-9.0.15-win-x64.exe 3380 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4844 wrote to memory of 3380 4844 Xeno.exe 85 PID 3380 wrote to memory of 3468 3380 msedge.exe 86 PID 3380 wrote to memory of 2348 3380 msedge.exe 88 PID 3380 wrote to memory of 4708 3380 msedge.exe 87 PID 3380 wrote to memory of 2348 3380 msedge.exe 88 PID 3380 wrote to memory of 2348 3380 msedge.exe 88 PID 3380 wrote to memory of 2040 3380 msedge.exe 89 PID 3380 wrote to memory of 2040 3380 msedge.exe 89 PID 3380 wrote to memory of 3956 3380 msedge.exe 90 PID 3380 wrote to memory of 3956 3380 msedge.exe 90 PID 3380 wrote to memory of 3956 3380 msedge.exe 90 PID 3380 wrote to memory of 1004 3380 msedge.exe 91 PID 3380 wrote to memory of 1004 3380 msedge.exe 91 PID 3380 wrote to memory of 1004 3380 msedge.exe 91 PID 3380 wrote to memory of 5184 3380 msedge.exe 95 PID 3380 wrote to memory of 5184 3380 msedge.exe 95 PID 3380 wrote to memory of 5184 3380 msedge.exe 95 PID 3380 wrote to memory of 1528 3380 msedge.exe 96 PID 3380 wrote to memory of 1528 3380 msedge.exe 96 PID 3380 wrote to memory of 5492 3380 msedge.exe 97 PID 3380 wrote to memory of 5492 3380 msedge.exe 97 PID 3380 wrote to memory of 5492 3380 msedge.exe 97 PID 3380 wrote to memory of 3096 3380 msedge.exe 98 PID 3380 wrote to memory of 1636 3380 msedge.exe 99 PID 3380 wrote to memory of 3096 3380 msedge.exe 98 PID 3380 wrote to memory of 1636 3380 msedge.exe 99 PID 3380 wrote to memory of 1544 3380 msedge.exe 102 PID 3380 wrote to memory of 5828 3380 msedge.exe 105 PID 3380 wrote to memory of 2828 3380 msedge.exe 108 PID 3380 wrote to memory of 2340 3380 msedge.exe 109 PID 3380 wrote to memory of 5952 3380 msedge.exe 110 PID 3380 wrote to memory of 5780 3380 msedge.exe 111 PID 3380 wrote to memory of 5780 3380 msedge.exe 111 PID 3380 wrote to memory of 5572 3380 msedge.exe 112 PID 3380 wrote to memory of 5572 3380 msedge.exe 112 PID 3380 wrote to memory of 4908 3380 msedge.exe 116 PID 3380 wrote to memory of 4908 3380 msedge.exe 116 PID 3380 wrote to memory of 4908 3380 msedge.exe 116 PID 3380 wrote to memory of 4672 3380 msedge.exe 117 PID 3380 wrote to memory of 4672 3380 msedge.exe 117 PID 3380 wrote to memory of 5736 3380 msedge.exe 120 PID 5736 wrote to memory of 5024 5736 windowsdesktop-runtime-9.0.15-win-x64.exe 122 PID 5024 wrote to memory of 5656 5024 windowsdesktop-runtime-9.0.15-win-x64.exe 125 PID 5984 wrote to memory of 4268 5984 windowsdesktop-runtime-9.0.15-win-x64.exe 129 PID 4268 wrote to memory of 5088 4268 windowsdesktop-runtime-9.0.15-win-x64.exe 130 PID 1320 wrote to memory of 3488 1320 msiexec.exe 131 PID 1320 wrote to memory of 4200 1320 msiexec.exe 132 PID 1320 wrote to memory of 4208 1320 msiexec.exe 133 PID 1320 wrote to memory of 4552 1320 msiexec.exe 134 PID 3380 wrote to memory of 5152 3380 msedge.exe 135 PID 3380 wrote to memory of 5152 3380 msedge.exe 135 PID 3380 wrote to memory of 1664 3380 msedge.exe 138 PID 3380 wrote to memory of 1664 3380 msedge.exe 138 PID 3380 wrote to memory of 2580 3380 msedge.exe 139 PID 2580 wrote to memory of 4172 2580 msedge.exe 140 PID 2580 wrote to memory of 1792 2580 msedge.exe 141 PID 2580 wrote to memory of 4884 2580 msedge.exe 142 PID 2580 wrote to memory of 1792 2580 msedge.exe 141 PID 2580 wrote to memory of 1792 2580 msedge.exe 141 PID 2580 wrote to memory of 3476 2580 msedge.exe 143 PID 2580 wrote to memory of 3476 2580 msedge.exe 143 PID 2580 wrote to memory of 5784 2580 msedge.exe 146 PID 2580 wrote to memory of 3024 2580 msedge.exe 153 PID 2580 wrote to memory of 2996 2580 msedge.exe 154
Processes
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.40\Xeno.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.40\Xeno.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.NETCore.App&framework_version=9.0.0&arch=x64&rid=win-x64&os=win10&gui=true2⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2ec,0x7ff83e96c188,0x7ff83e96c194,0x7ff83e96c1a03⤵PID:3468
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1896,i,14714422760221979813,12670735582367675069,524288 --field-trial-handle=2376,i,9321560359328583537,2417560989400017457,262144 --variations-seed-version --mojo-platform-channel-handle=2412 /prefetch:33⤵
- Downloads MZ/PE file
- System Time Discovery
PID:4708
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1804,i,1084163791771882945,14672137075845763859,262144 --field-trial-handle=2376,i,9321560359328583537,2417560989400017457,262144 --variations-seed-version --mojo-platform-channel-handle=2384 /prefetch:23⤵PID:2348
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2424,i,17533198691034212031,11731927168139694407,524288 --field-trial-handle=2376,i,9321560359328583537,2417560989400017457,262144 --variations-seed-version --mojo-platform-channel-handle=2968 /prefetch:83⤵PID:2040
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,7143618335627732258,3221718962970146700,2097152 --field-trial-handle=2376,i,9321560359328583537,2417560989400017457,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:13⤵PID:3956
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,8157751686211619961,267810546479366968,2097152 --field-trial-handle=2376,i,9321560359328583537,2417560989400017457,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:13⤵PID:1004
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=3412,i,358552938369889442,18137872798473103921,2097152 --field-trial-handle=2376,i,9321560359328583537,2417560989400017457,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:13⤵PID:5184
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5196,i,1921920124169821820,6054937534324072142,524288 --field-trial-handle=2376,i,9321560359328583537,2417560989400017457,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:83⤵PID:1528
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5212,i,8886594239896821843,6107483802450205902,2097152 --field-trial-handle=2376,i,9321560359328583537,2417560989400017457,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:13⤵PID:5492
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3504,i,16499853235432259343,7994765441772929308,524288 --field-trial-handle=2376,i,9321560359328583537,2417560989400017457,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:83⤵PID:3096
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5692,i,10374223906931745295,11291302204453564684,524288 --field-trial-handle=2376,i,9321560359328583537,2417560989400017457,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:83⤵PID:1636
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6504,i,15385810116521161031,1576116374309537244,524288 --field-trial-handle=2376,i,9321560359328583537,2417560989400017457,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:83⤵PID:396
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6504,i,15385810116521161031,1576116374309537244,524288 --field-trial-handle=2376,i,9321560359328583537,2417560989400017457,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:83⤵PID:1544
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,11135340506619932100,9691916210776467695,524288 --field-trial-handle=2376,i,9321560359328583537,2417560989400017457,262144 --variations-seed-version --mojo-platform-channel-handle=3412 /prefetch:83⤵PID:5828
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6584,i,8875219796566555794,2290000170375359919,524288 --field-trial-handle=2376,i,9321560359328583537,2417560989400017457,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:83⤵PID:2828
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6596,i,15835325218175351790,1765166488385580823,524288 --field-trial-handle=2376,i,9321560359328583537,2417560989400017457,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:83⤵PID:2340
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5732,i,7326697169922445228,4278863370912620211,524288 --field-trial-handle=2376,i,9321560359328583537,2417560989400017457,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:83⤵PID:5952
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4996,i,5530434418126941315,4065406635130377049,524288 --field-trial-handle=2376,i,9321560359328583537,2417560989400017457,262144 --variations-seed-version --mojo-platform-channel-handle=6796 /prefetch:83⤵PID:5780
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5004,i,975561426964187642,1470797975470990399,524288 --field-trial-handle=2376,i,9321560359328583537,2417560989400017457,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:83⤵PID:5572
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=4192,i,8652095213984341382,176852865544883458,2097152 --field-trial-handle=2376,i,9321560359328583537,2417560989400017457,262144 --variations-seed-version --mojo-platform-channel-handle=2836 /prefetch:13⤵PID:4908
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5836,i,13343320197327271962,5008576348121877290,524288 --field-trial-handle=2376,i,9321560359328583537,2417560989400017457,262144 --variations-seed-version --mojo-platform-channel-handle=1940 /prefetch:83⤵PID:4672
-
-
C:\Users\Admin\Downloads\windowsdesktop-runtime-9.0.15-win-x64.exe"C:\Users\Admin\Downloads\windowsdesktop-runtime-9.0.15-win-x64.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5736 -
C:\Windows\Temp\{C4D9F334-C43E-4412-8CF7-BAA2EF9B79E0}\.cr\windowsdesktop-runtime-9.0.15-win-x64.exe"C:\Windows\Temp\{C4D9F334-C43E-4412-8CF7-BAA2EF9B79E0}\.cr\windowsdesktop-runtime-9.0.15-win-x64.exe" -burn.clean.room="C:\Users\Admin\Downloads\windowsdesktop-runtime-9.0.15-win-x64.exe" -burn.filehandle.attached=584 -burn.filehandle.self=7204⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Windows\Temp\{F2F63197-6B89-4807-B5E8-D1E754B926E3}\.be\windowsdesktop-runtime-9.0.15-win-x64.exe"C:\Windows\Temp\{F2F63197-6B89-4807-B5E8-D1E754B926E3}\.be\windowsdesktop-runtime-9.0.15-win-x64.exe" -q -burn.elevated BurnPipe.{EF638B0C-3F97-4913-9108-51F81B36DF4A} {66F518E7-01EA-4788-85B5-33B2897D2951} 50245⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:5656
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5024,i,7990336058655024931,14387093330364339804,524288 --field-trial-handle=2376,i,9321560359328583537,2417560989400017457,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:83⤵PID:5152
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6892,i,4167168024907621066,14233412908795108723,524288 --field-trial-handle=2376,i,9321560359328583537,2417560989400017457,262144 --variations-seed-version --mojo-platform-channel-handle=6860 /prefetch:83⤵PID:1664
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window3⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff83e96c188,0x7ff83e96c194,0x7ff83e96c1a04⤵PID:4172
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1736,i,17726376615082400183,17769116211145902024,262144 --field-trial-handle=2324,i,6409737026738769371,9205474478924448543,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:24⤵PID:1792
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1940,i,819689224452758919,2014455836710620332,524288 --field-trial-handle=2324,i,6409737026738769371,9205474478924448543,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:34⤵
- System Time Discovery
PID:4884
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2356,i,14518402357880116557,7877346690320063852,524288 --field-trial-handle=2324,i,6409737026738769371,9205474478924448543,262144 --variations-seed-version --mojo-platform-channel-handle=2928 /prefetch:84⤵PID:3476
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4512,i,4583796309868168554,2086683068973266779,524288 --field-trial-handle=2324,i,6409737026738769371,9205474478924448543,262144 --variations-seed-version --mojo-platform-channel-handle=4552 /prefetch:84⤵PID:1864
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4512,i,4583796309868168554,2086683068973266779,524288 --field-trial-handle=2324,i,6409737026738769371,9205474478924448543,262144 --variations-seed-version --mojo-platform-channel-handle=4552 /prefetch:84⤵PID:5784
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4588,i,3508545500215451640,3471787829256623693,524288 --field-trial-handle=2324,i,6409737026738769371,9205474478924448543,262144 --variations-seed-version --mojo-platform-channel-handle=4720 /prefetch:84⤵PID:3024
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4740,i,5325324356373422712,8153320185374233072,524288 --field-trial-handle=2324,i,6409737026738769371,9205474478924448543,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:84⤵PID:2996
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4788,i,869177079765973152,7027295423651052842,524288 --field-trial-handle=2324,i,6409737026738769371,9205474478924448543,262144 --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:84⤵PID:684
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵PID:4036
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵PID:3720
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1320 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 99BB0986F6E2EF3D3D614EEEF4B463462⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3488
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 3204533C5D20335579321A98796D29132⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4200
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 3B26D5F2F33BB792CF9B6445B4EF9FDD2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4208
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 504CBAF15EC0F9D94136B3C8C36C195C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4552
-
-
C:\ProgramData\Package Cache\{e29f6a15-9665-4b06-8024-06f270a032b8}\windowsdesktop-runtime-9.0.15-win-x64.exe"C:\ProgramData\Package Cache\{e29f6a15-9665-4b06-8024-06f270a032b8}\windowsdesktop-runtime-9.0.15-win-x64.exe" /burn.runonce1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5984 -
C:\ProgramData\Package Cache\{e29f6a15-9665-4b06-8024-06f270a032b8}\windowsdesktop-runtime-9.0.15-win-x64.exe"C:\ProgramData\Package Cache\{e29f6a15-9665-4b06-8024-06f270a032b8}\windowsdesktop-runtime-9.0.15-win-x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_9.0.15_(x64)_20260511204515.log"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\ProgramData\Package Cache\{e29f6a15-9665-4b06-8024-06f270a032b8}\windowsdesktop-runtime-9.0.15-win-x64.exe"C:\ProgramData\Package Cache\{e29f6a15-9665-4b06-8024-06f270a032b8}\windowsdesktop-runtime-9.0.15-win-x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{e29f6a15-9665-4b06-8024-06f270a032b8}\windowsdesktop-runtime-9.0.15-win-x64.exe" -burn.filehandle.attached=520 -burn.filehandle.self=540 /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_9.0.15_(x64)_20260511204515.log"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5088
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2124
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵PID:1620
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e59388e.rbs
- Size 48KB
- SHA256 1627d838d85b438f3a332fa5b0e065f89995b928a07631da7f146533dcd5055b
- MD5 777e3c48f7b5e6edaaf29ec7a48acf5b
- SHA1 58e26d7dedbd95b676e788b3d860727cf6500e87
- SHA512 1d2f34b55aed42bf80dab77de7f22ce462f192b8d67f6b706930acd9eaaa77884d3f6a6c7c1d8e8c79ca180820f7047e5beed6ce94953d7a3505217bd2517a33
- SSDEEP 1536:ISq28RQMMYEYJMB8WEc4t5+Nc70EvrcRlpKBc5oggcqj1KePE24DfdQ02zZA4071:yq
- TLSH T18723A17CFB41C0E3E1336DE06765AA0973148D9F0B498D8E12C95226CEFAAD89EDD1D1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e593893.rbs
- Size 9KB
- SHA256 2568bc3de47e2366ffd8aeb737bbb1068285a49a25b9b72b3840467cf26675ee
- MD5 77660ad0f49b3f992875a511322967c0
- SHA1 6aee22d8b740f12a17dc77d0f053402b281eb6de
- SHA512 97647e5cdbe4cde6ebc5b3db76e0a99fe238f579e159902cd53d9f65d815948ff3432322bb67fb6a56488982112a45346fffd16d9b8b1ed3c53372a54e0355f8
- SSDEEP 96:HmyDWDS153rMDTveiDbZDb6QUjeD2NDwoCsTl4UjeD2NDwoC6jeb1DbfDbRYDdTZ:GgDbqeVvFDwfIRFDwfSlEuxLuWvs3p0
- TLSH T1B1127200771083D2E99BAB34C7071B2437B3D2DAA214936B15CDA1309F537CE9E696EE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e593898.rbs
- Size 10KB
- SHA256 ba5c853ebaaf47432405a2085887e09a8bae05898769b592a5a6e2a1cbaec73e
- MD5 7a95afe30fbf545efc2dfce406496ca2
- SHA1 e29d4b51595a39f80ac70adf1926e9253eddbbf6
- SHA512 d065687249db3397e18f41df6b4f9d5515c164c6c8357e0c61c017a274feea3f11e66c9bffa9d94eee46363e3ae783ec2c5fcab27dbe11ed16cb4e798bc1979d
- SSDEEP 192:78dk2vzN5HHY7/ejvINDwfIJINDwfgbE4ZN7s3px:7Gk2vzN5H4uINDwWINDwQY/
- TLSH T1EF228381770882E3FDA65F76C7031BA63BA3D7DA87154B5B14CD8128AF033851FB9186
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e59389f.rbs
- Size 88KB
- SHA256 70b4b4c6b61cb7dc73ee9e923b91f6e7282073512d77cbbba65b5786c16b66ab
- MD5 b215e4bea090738f1d854dc04871e530
- SHA1 a072088b51665b6b6c9d73c86dd1125fc23d7435
- SHA512 52fcda276feec52ae1fa8cf42d60306dcf57d5d871236a807041912cac0224483c105082bf7a01554dc98f72250ea95cc13576e803faf43ad1c13c35788df567
- SSDEEP 1536:xbeuT35vTQVbIbMYnDWHCC2AWclWww/6L9aXbYcBJ2VObfVz5YjdJVc7fvPcNK3R:9PkHkt7qz2/P+OSvuYYeW+FGCi
- TLSH T17B93CF5DA710C1C6A9327989573FF6896E124CBF43C9992617C4022BFDE1E976BF88C0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\chrome_Unpacker_BeginUnzipping3380_1158569028\manifest.json
- Size 177B
- SHA256 096e772e0f2e8c15e6dec9087ee0a1fb8b0c56b25061626aedc9e7e705adfc2e
- MD5 2714a51ed8c2a891ad73b7488ab655b9
- SHA1 9a8cc479aec8de1b4eb678e5d68b23b16a39dc99
- SHA512 4811522c06ad6946626a9f4d12eb62a1d623825d18a1cd0ad7b628f4c059f37d299b5857abffd959e4ea53239412490539f5705b4aa6c6951d13c68e6d5b72ad
- TLSH T1E6C012EFDC509DB215EB4323156D43C4E733CF4B1546490935FB66082A25981C193500
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\chrome_Unpacker_BeginUnzipping3380_365952605\keys.json
- Size 8KB
- SHA256 ae6e69a145f84c0a261b4e82888779fbf137f193881d687588e1af71609ae947
- MD5 d3ebc1cb4b692c6e2d29a4625420fe73
- SHA1 4ce74c1e9af6fd34d6379ec0fec6afb24082a7c1
- SHA512 e34b855615e6a3bf770f27d85aa29ca57a324c08bd8f8d9c0130e2a142c0e4a5f17bffd0861b725acc8a2316f73b7fe50406b0af26264a5c2d8f37599b260860
- SSDEEP 192:uNtGbR+mFGfvPNyR9Pm4lOvMwkoR9PuGMXcy:ORmqwKjA
- TLSH T18402A57F14A41181CE7FC1698F0B78B78FA038065BCA3A83539BFA49494296D173B5B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\chrome_Unpacker_BeginUnzipping3380_365952605\manifest.json
- Size 79B
- SHA256 7ea98f2308a9c51d17a1ac71b64afbe2a41ff0a083a166a0e4cc428bf44f0715
- MD5 817fea104100763cd1bf4f15a51bfe94
- SHA1 589717cf98cf7e2d55fc0d6025a4b8e215ed13d6
- SHA512 da7b959d93113c5a6be360f90d9c721989c5e7acad7fa592081b582c4c3a0c4a9066a71473fd8492ce7fe7b0fbfd6870d939428a67fbd508fcf6b2c6dc1a41ea
- TLSH T15EA0122058019233108407600360478243551C022015244809461041258813A12A3128
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\dotnet\ThirdPartyNotices.txt
- Size 77KB
- SHA256 e8ddd95ac905467e4e519b446ca023fa00c31732bebd9b66e65101c712092ee7
- MD5 406d07d20e58568365df0557629fadc6
- SHA1 9ab5ba1ef3866afa75b8cf3c392b7dd3d7f52026
- SHA512 c6025a947faa5dc2b41a14d75e228ca2bd0df094e8cef914c58a6d2f5854424972a647b2c8ca8173345e40ba7557843d03efa85c5098c6e0e6726377efc8a38f
- SSDEEP 1536:HA9jHwsGfgg39/zwgAVkguQxrDjugtSEGepkWvrpX7anuqdLSVnfiStPq+3Lefrb:HA97w/ogz1AVxuMjHtSFULryLOgrGWwa
- TLSH T1F573A45F7E45077319E2C3916569A8C5F22FA02E3B6B2A44346EF248133B42DD6FF858
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Package Cache\{e29f6a15-9665-4b06-8024-06f270a032b8}\state.rsm
- Size 932B
- SHA256 11f28a477eb3897c60791991d5a33d408964661a9da2cdf53c1338ed933903b8
- MD5 52f5d312e07e7b65a7c244ca366ca1bc
- SHA1 1aff2ca1b41b8fba5356637f4fb264c18695786b
- SHA512 3cd33aee4e70e2fafe2bc7e371b6508dc6add8a8728f19e14b48cccde7b765ac82ea42be23f9c0d6b9e2c50f32f8ace272f7076c6bf09f0eb0556aba4957da65
- TLSH T102119A515FFA012EE3FA6B3069F52711643AB8120D32C16C0001318A8E31BA0C870F7B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 09b2ccab80e9693369ad57866d01203db5e1b075ae5fb95a8aeb8f833a1e9eb1
- MD5 23cbdfaf1eb53a5b0b82bb26100c4e50
- SHA1 353a5f1f100a1ab39f60ae5dd18a6e4a5de94db0
- SHA512 39f78eaba49e932f15b631b7bae0dc88bbb7c5721372889b660d2c2eb1074cc904bafdb6246e062706d42969d112367d8772846838a9a6e471c9b394e1060027
- TLSH T1ADD0A7763B49700AD72D51715113C749261B845024878715F218859C98F80DD67D15C3
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 10f0f01b3aa93ff5cfc118d5d00d38c9f43f51bb2d3a7ec6362607fb07bdc28f
- MD5 b6f1222550ed4374c468d0986fc42534
- SHA1 54783af999c4d1c0b70ee8d9ed4efb259b981203
- SHA512 30e083a626fdd033f427d16b4ca67f13a1a41cdf960cfe1b06b490eaf0589924904ef2a325397b99e9b7f5de32788c554a5e54ca090a6d2a6fea3a1735ceb698
- TLSH T156D023B73B4DB457F71D52319413CB4916678091284AD745F324855CDCB51CC67855C3
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 90b41d16afbe5e33216003a19202cf15c61bce40ff0973bc43a46963d27607a5
- MD5 edc45b2ebff2e907427acbe33f0cb940
- SHA1 9895d003339727b0332d267b3eb40fecedaba574
- SHA512 fea2335d267b19e0111d7a6aa3515ee5ac4f7a678ff8aa1c46fc086d7c6dfd334253c27518ffcf377c2da8ec9ca130356a81f643b7de4614c81cc018fa638f40
- TLSH T195D023B73B4DB457F70952319453CB4916678091284AD745F324855CECB51DC67855C3
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 c7296caf0e9cce556825f28f3642cb5ac31e31a0ff760d227744d879c3a93dee
- MD5 1fd2da899cebd4d5aac2a3d85c0bfd18
- SHA1 3f4e6dbc96df63582e9ba17acceda5012e453d7a
- SHA512 840622178b39a880be2d80a1349d1dc0f7bfb63bf38c38c71fd96b89033d54de3e6a88f15ad237f3b66a8ebbff2bcfb19f5b6a6e94882c94044f73046f231584
- TLSH T1D5D0C0CC33B13C26C58C807004457F4D340BC4A20D42C3263433297C0CC30C428514C3
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 cd04dec9a65c9ebbd9698b7d59631c916e6b6a0a7afdb22ef48d8a4a82d902d0
- MD5 5491f296a003c3ba16025eb18fdfb799
- SHA1 8104d473f5d8f681400a64b5d0ac5523a5d56b8e
- SHA512 118ab6dad3343099380a953888db90a14fe8c7dcb62f906e55a163cdde9b95460d37b865178c48bfd20c166ef6b725e5b61ca55fc83a0221383e062a36b68b84
- TLSH T1CAD080D837B16C26C589947104857F4D351BC4A24D46D7267477297C5CC30C46D555D7
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 e74efd35f96ad594f55e94258743c715b03d50c19c641e7bac8026d988eed490
- MD5 331d9b862a81d2f9899f836c9c163503
- SHA1 56a617dbd720ebaa894fc1b10af57e4eaaeba35f
- SHA512 7487adb810c764a803eaa802a50c42397ec44c30c32604066a0dc87eabe28ecf446d2cadb9e052d711a38dc09151c8a6112aaea1e5ce59a89eaaa0edb7c5b2fa
- TLSH T1FDE0E5AAC9219C6B14FD1B1920128646EB52235B6F50884B3B3D920C8FB0637155686C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 2KB
- SHA256 fe10c3fbccefeabf929d9322414887696a13715155fba3ecc53eecf10fcbbb32
- MD5 51a23a6fd86b49865c4b42c07c7f64ac
- SHA1 a7ddc5b9852d682ff603a6ff36d8f11acf7c3a6f
- SHA512 518c77c38aeed8eb73780f0a784f0d72260dd07d96ba34d5308389f26730e55d024318cc89d91141585b369343eeb5a8e176f8dc41b24c157ae9a96bdfd1b926
- TLSH T1CC512A889BF58039EBE95BF01DE20D153B3188240937CE8288C3D4BC9BA1F530033B6A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58a728.TMP
- Size 2KB
- SHA256 838ad4d2818f75496047fcecc52c8cd986ea45f4565b5cbbab82a3845fae9553
- MD5 6b43e487021bc53e516dcbe6067b8a73
- SHA1 0ccbc4cb66ebb51509119ffe4c99af39a8e36523
- SHA512 c4d46e71f17eddeb818480e35973008709e51b219b516c5f2de167ebd8cf661b86db95435c320541da868b9dfeda2d5c33a1ec718cbdf972e66a5bc564976e03
- TLSH T1C151F99893F58039FBE847705DE119563B7198280837DE9288C3D4BC1F95F530037B6A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
- Size 264KB
- SHA256 c5205b75ffdc870809aca79f6f70a25cf29041237b3ebf685f3283776569654f
- MD5 26ca0d12bcbf1c66fa5c37f0c26c1bce
- SHA1 3f749230991bb67b032ee03a31e0bf0a352e456b
- SHA512 18441504dc87540d6fef89ab3cd6fb9d970b066eb34db79d36935be76cc934d99101253b208eff57b8dce00abbdf6ab687e2f33e23abdafd80456e25210621d2
- SSDEEP 3:MsEllllkEthXllkl2zEZvkl/:/M/xT02z+vs/
- TLSH T18444041C7FC00C05CF0010304453F350D370D4100511D75334514513DCD75C00C11001
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
- Size 2B
- SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
- MD5 99914b932bd37a50b983c5e7c90ae93b
- SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
- SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
- Size 106KB
- SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
- MD5 25dca813dd764f2197142ef84bc5ce66
- SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
- SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
- SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
- TLSH T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
- Size 3KB
- SHA256 041b8fcb76864dca3d67899111c09b1405c7a3d3f2df1b1973ab2db82c3c86ca
- MD5 a085c980bd526afb5c90698f76d9493d
- SHA1 ec018f8537b4bcc73e9ecf984f13e9f97cdbbda7
- SHA512 3b2309466fc67d9fa59e0805de8449ff45d744fc5c6c1b957ecf23e6f00c19dbaa29ac71b81cb4018a36fffc68f38b80646c2df23a713fb33b4a38b4b1915f42
- TLSH T19C51DFF783F485AE8A0195F0AA18AE2FCF2D0515435C7C5989E4AE17D7E34B1E10165F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
- Size 3KB
- SHA256 350b1834b9ddd8bc5bca5bd7f0f23e4db577d6439cfd27d239c5fc7ce37a11ed
- MD5 55fe11310b9b6872b41d7560d46372db
- SHA1 80b43affeb6dcc078c5075dffad8f1e5a50a6644
- SHA512 7691a3a46f9dc23ef544ad9fb6a826182e5a68b6ed77e9f8f1182f8fb20bca1b767387a461ffecd8dfe5e0bc1efe08c76352a814876bb6b22e552c70b0886c94
- TLSH T10251DFF783F485AE8A0195F0AA18AE2FCF2D0515435C7C5989E4AE17D7E34B1E10165F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
- Size 40B
- SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
- MD5 20d4b8fa017a12a108c87f540836e250
- SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
- SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 17KB
- SHA256 3cd4a173c2c0a0acf572de6b832a9abc854f26936e0e9956c0636192ed7a8bbf
- MD5 ce6022da8e6e1f3eefcac82069071b4f
- SHA1 3da866a160206e15e0888745ed2096dc04b58f03
- SHA512 5e4dfe2ac4dee6532204892de04c6666bfed846d769c3c8255a78f236b35263dcb15213aa2908f28e2c80cd630f09a994452ed7958d21b5350a4509c7b7fbe4b
- SSDEEP 192:sxZ0RiyMqZ/K1Ml8Dmw/fHsuWpVXiXcvOvezodp6NHW6+WNqc3OkXYuCfcNHXdq4:sxZ0FPw/fHsuWvXibvFWHbV9XZNHgNa
- TLSH T13C82E8166A389D77CCD7D319FA457F63D7F9156296804E44A9FC8A0C04E6BED220382F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 15KB
- SHA256 21a6675ec53315c14d68640a71fb592496b7ce60c89eb75f6d408b2d482e41ec
- MD5 ca5735274efbda75d60d29ff6f5fc9dd
- SHA1 83015f8a67fcac0ecd23dd9069dbecbf3691be7b
- SHA512 ee90203e6dada67a3b9f2b489ac623f7b67e44a5df9edb0c597559ba5fbb4dd9079d22d69617627535318a2b65c4f46db03e8874462b46b5241909e7f113bbf5
- SSDEEP 192:sxZ0RiyMqZ/K1Ml8Mmw/fHspTpZZELgvzzodp6NHW6+WNrTm6/YKRD77NH+nqIgG:sxZ0Fuw/fHspN3hvoWHbj/dNHZj6
- TLSH T18F72E8156A38AD7B8CDAD309FA457F53D7F5156392804E44AAFCCA0C04E6BED220382F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
- Size 35KB
- SHA256 9874a528a210872bdbfc9175eef91e16a780bc485f9bc01484ff898b5312549c
- MD5 5faa0f94b95d350f68ce13faf44b65b6
- SHA1 7f4e0f4a88c5d2cc7a2c69a700f35d97e5b9fff4
- SHA512 5846b468b6d47a4f3d3f8490beb012c2c405ab592011f297ad345e51158756b4868f327aed0e2f96c5e1def2f892140e1c97b0df3ab27b01c926c6cbb581c230
- SSDEEP 768:AasqZl+7pLuL/BlWvBDeT8F1+UoAYDCx9Tuqh0VfUC9xbog/OVzEx4Llhf51Yroc:AasqZl+E/BlWvBDeTu1jamEx4LXB1jAZ
- TLSH T100F20A3B2C0CCB7E4F804E9CDC2A7E9A6DE8028B96D8895447F9841C03D66EB55175DB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
- Size 24KB
- SHA256 f1b099898e311f7ccbf3bfdd8056124c97a1bc16163aee3e26ef216bfbc76ff7
- MD5 704f2a8cfe43c8e9d8666267b0f4b900
- SHA1 810b57e33fb8e8d16a9dfb723c163c748fe88aaa
- SHA512 4fab96ea18259aa783a706b445bfe49456e57ea6f64636cf2d307f99199ace4a63362cfd59f387658fa1bf8baf60b0fba089a749add59e3adfe23c49bc952aef
- SSDEEP 192:+HhOVXSe5i+EkETc3+uWvwAn+mPoOTR7uVhrx9aVYh5D+wHMT7glRZVrd9th/qnk:+BOVglYXrbtZqRvJJ7/S
- TLSH T160B24B11753A0380397E255E81A4B56F66C270A37098B82B3BB944B64F6BF20CDFD9DD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
- Size 41B
- SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
- MD5 5af87dfd673ba2115e2fcf5cfdb727ab
- SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
- SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\cbfff9aa-4a62-404c-a341-ca8cf3b2cbf2.tmp
- Size 1B
- SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
- MD5 5058f1af8388633f609cadb75a75dc9d
- SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
- SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
- Size 14B
- SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
- MD5 8297da058a737611abcc3a0ede9ffc24
- SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
- SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 38KB
- SHA256 11c1325452f8148d4e64960dedaa7aa897f4a58f8b687089e3d35e81e258996b
- MD5 0ad0e48dac84948d6af2171e59ba6194
- SHA1 f06c9a793d21f5e061a0a82651f3e18a0affb954
- SHA512 51564d1743d36f0ee1df265e8a8b872d6106df92e996ec94e43a3c3fb0c8053ccbf5fb7e2d23623eb481735de1169802f1229539a8a23ad9b908964d8d98e720
- SSDEEP 768:SFNcpHguwgU3AiL3Y6abSe1SoYXKqb63hkoFYS/EG0l:1HgT3A4abvYXK+63hkoagG
- TLSH T1740390F194D78DB6D89D87C7972DAD0269BCC123B1884958B3E96D2DEC8B0BFD306811
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 38KB
- SHA256 ae1f14927e0eced154d2d5f68fb2535963b189f9f85cecfd1bfce131991e715a
- MD5 efd42613aceb1f49a462e5c79fddf68e
- SHA1 340071d1dd1ea05d59d007994919acd40ba891eb
- SHA512 2ea5e6d6ac380dd864a0bd38cbb31e3560a01e12c22a05bbbfc25ab6a2e147321912704325f45f805896453c1543bc466a3edc0b344dfe4a62ecb10dadf5e7e1
- SSDEEP 768:SFNcpHguwgU3Aie3Y6abSe1SoYXKqb63hkoFYS/EG0l:1HgT3A7abvYXK+63hkoagG
- TLSH T1D8039FF194D78DB6D89D87C7972DAD0269BCC123B1884958B3E96D2DEC8B0BFD306811
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 25KB
- SHA256 0727d7930cfbdfc42d12cf30cbe2f3c1cd1dd9fb2a487fd340def743a6b45245
- MD5 51c1fce124c76ca19423037d5471e0c1
- SHA1 9b059eb27344b62761d64762a1842115b8f40035
- SHA512 914bc85efe83f66edbcb5ed848440cefcd94043424c128548a0dbfc472e6d53b222adc0f672f2b9c145af20df3ffa741a4d257d36de80039b1f28d47584050b9
- SSDEEP 384:ndiFavqM43sNR8TUNTUlI4J3WRihjuPfmvffYiQ8aMQpiEQnq5D2rN1k+rvI+C:UFayP3iwgA3AiaeY6abKq5Da4
- TLSH T1EFC22971E8A8DDA7EDDB8B89B74A7643DEE011A3858C4ED8D6D85E0D00C719D270BC26
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 27KB
- SHA256 33e48188f09fffe0c2cc3ece0567df4c5d53bddd4392fd2522b6ac9f0ae81b25
- MD5 b9d435f0102f01ef4d3243901558891a
- SHA1 8af942ee154324e46aece3a54bb17668637055f5
- SHA512 3b142fe5784199e02ed85f3178b8b5e57f855079a5eeed96b13fa9c29ee98a1e7aaa05a6096a137bb1a0b5bb872c1716bca6e6655fb3ba8c5f81e9ca077efd59
- SSDEEP 768:SF9cpN3iwgU3Ai3eY6ablqhkoFYS/EG0l:FN3f3ApabchkoagG
- TLSH T1EFC24B31E8A8CDB7ACD64B89F74A7A47DEE001A3C5889EE4D5D95E0D00C719D270BD26
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 26KB
- SHA256 e412fa441c00a8472d603bb46188ff1e0f7fa1ff43741711a7c2c29e9294a5e7
- MD5 32e265d3fb23d20a0857b36faa537103
- SHA1 a83aee76d6519bbfb720512788de33cc269798f3
- SHA512 eae434ea0d0176f473d16246c2c9b99f1c89469ea99784af01fdda6e9bcc3d1b68c11de77a0a4ed4c8454e35a08c0636febce8a24f67b6db1810886b3662f549
- SSDEEP 384:nuGiFavqMg3sNK8TUNTUlIm2RihY9brmvffYiQ8aMQpgQOS7o1dKuiNTWrN1k+rp:utFayv3hwgTi8KY6ab7Omo1ti567
- TLSH T161C24B35EC98D9BBECE64F89EB497A07DEE001A7C58C4AD8D5E85D0D10D369D230BC26
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 27KB
- SHA256 cea5b43e21706f4845f1b91809aac6db6228fbb7b995ebaaab36b2de88bc11a4
- MD5 f6ebff60e0395e0a3e823628df9f6c31
- SHA1 f4182fa20df8d933cee6c954f2c87c28f96a82c6
- SHA512 bc80f49dbb24c8cda7e26f1dc212df6ebbe6734c2e63e80833597af7e2efe5dcd40ea4fa0473bcafc012d9790b8af2b6af24b59b38ac52dd96edaf85a5e1b6aa
- SSDEEP 768:fFccp03iwgA3AiUeY6abyqhkoFYS/EG0l:H03v3Aoab/hkoagG
- TLSH T1A4C24B31E8A8CDB7ACDA4B89F74A7A47DEE001A3C5889EE4D5D95E0D00C719D270BD26
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 27KB
- SHA256 17200331fd087728c5f28acd4654bd43f3aad5bde5e27c74bd14ce821ae62dbb
- MD5 6bd105eb685f3c7586cf857769150726
- SHA1 784f7a59d1bc729217201457ed7858cd0497f288
- SHA512 c79048f43b14d4d6b8a967dcc2ebd2653807e3ede3fb5749d39ef8e550ac3aaca6b92d3b27262631f8ada95932cb9bb5c6453f941d6438fcaee81f1a9b7ece77
- SSDEEP 768:UFccp03iwgA3AiUeY6abyqhkoFYS/EG0l:E03v3Aoab/hkoagG
- TLSH T167C24B31E8A8CDB7ACDA4B89F74A7A47DEE001A3C5889EE4D5D95E0D00C719D270BD26
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 27KB
- SHA256 7ff77413fc53e52b9379f8b8f0c8c8a86907291abfa709e97b5af1293e469bb6
- MD5 e5d3cf41484a9f89b8fc40578690849f
- SHA1 f7b6fb1f29be29bac721264309ab0d8ad20c08e7
- SHA512 f883c0b1e842a97b88e0177748b4fa1a42849a541d826988dc712f71375b74827ffd34507fccdf815977bea51f1685383544b5946ff70df7bda062e96bec33d0
- SSDEEP 384:nXiFavqMg3sN18TUNTUlIm2Rihv/68mvffYiQ8aMQpiEjnqS7o1dKuiNTWrN1k+t:SFayv3ywgTi4TY6abzqmo1ti567
- TLSH T1B8C24B71E898C9BBECDB5B99EB4A7647DEE002A3C58C4ED4D5E85D0D00D329D270BC26
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
- Size 86B
- SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
- MD5 961e3604f228b0d10541ebf921500c86
- SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
- SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
- TLSH T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
- Size 1KB
- SHA256 3e31ab4c03313041287b1d609526ae84a3f0088136408e58802e2454cc027b0d
- MD5 69628bf98b1192b494d84f7d8c552ec4
- SHA1 2626bae7a6b3f71997f1e06bea8217b6f249c301
- SHA512 a7ab7a992e7f0b896f6ee1cb7c8d49f80fc32738b6d7894864f33604300bdc66871c29986bee1787fb5679f084c881344aad24f6f99efa411fd0ea489afa7e7c
- TLSH T1BC3100E1583C2AD1C4FD0A6EA45B78FC84D8D32AF5A8717D5824DE98473AA4EA04143F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
- Size 1KB
- SHA256 3f0f1cb5eb3be23c424bbf1a3af1f661a7725103db1cba7fb4146de106bbe2d6
- MD5 d8bbb26a89c49335191da2076710d8e6
- SHA1 5212b5b10fdddd8c3f9801151ec85011f8cf0e40
- SHA512 86b7534afc0c08717ef4586ad7a61bdf46b7b910bd774766fd787efea9d1f2440554e2be4693d64b4b00cd319bcd304acad3c97ec71a67094d0f69ee8707055a
- TLSH T1CF311FE1483D26E1D4FD0E6EA05B78FC84D8D32AF5B8717D5824EE98063A91EA00143F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
- Size 147KB
- SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
- MD5 9c670f04d98ab7404f16423f6ee6cdfa
- SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
- SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
- SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
- TLSH T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
- Size 132B
- SHA256 54f761e00d363bd15db7bae3cc55144c80148a5fa1db7c3c2049e0e406a9142c
- MD5 b1ac780361002049b0a10a7fd30fd809
- SHA1 0ee0a7dc27fd175ab7abd6e5649890be3e2795b5
- SHA512 1bd8b1d2dc30bc62728d3d08085a446e8c037b02499687affa9a0bb18c6bdfee19104eabdcd8a52c2d0b542046abf26b7fdf81815037d4923e31231b0dfb7d60
- TLSH T156C02B5538F9488C2FA5257ED238092E12E4C912310022B0002ED804103465C13A0C2F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
- Size 2KB
- SHA256 0f891d8d4cd1fc604a6765ac185f4c3b8582c81635a75da3651933a4373ae672
- MD5 b4cd38e78f744ea62e8618fc5aefd887
- SHA1 9a4852c0252c8068a3290a375a72cc61e96d9492
- SHA512 0a4bdcfdf50317ecbcd09b2332bb55f22ba89d319be1c84c3c471ef54276237bff2f64fb6098fc2b3cc38d9f0b44a8c545d0f2b7232e31d2edbdf6b81e93acce
- TLSH T12841275CB6ED1148B3B36E5A9FF6A86E487E7C772E06C49D00010E4E0A32B41C8A1737
- MD5 SHA1 SHA512 TLSH
Microsoft_Windows_Desktop_Runtime_-_9.0.15_(x64)_20260511204515_000_dotnet_runtime_9.0.15_win_x64.msi.log
- Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_9.0.15_(x64)_20260511204515_000_dotnet_runtime_9.0.15_win_x64.msi.log
- Size 3KB
- SHA256 3a14df71d46061764e3250998474954d6d5c9d5d610ade7f388dcba8321f6b17
- MD5 c5f1699faa1eaa646dc41085a039ca89
- SHA1 bd36049808e71bf80033f267a497369720285be9
- SHA512 0dbf6cff2398db5ab25ed0381b1a269d60c3bfba839b26e237bde4559430f4d17325b1548ab6819a9d410e66319dff483cbfca2b32f3dd1d58abd0063df1164c
- TLSH T10C810B391BE80846F2B397479DF384136B33FDC26C34DB0D1386431946A7805A968BEB
- MD5 SHA1 SHA512 TLSH
Microsoft_Windows_Desktop_Runtime_-_9.0.15_(x64)_20260511204515_001_dotnet_hostfxr_9.0.15_win_x64.msi.log
- Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_9.0.15_(x64)_20260511204515_001_dotnet_hostfxr_9.0.15_win_x64.msi.log
- Size 2KB
- SHA256 0371e8afb92c29a52670edc2cfb1c989ba064a5a8887f9ef812073869e9ceb9a
- MD5 f1edb9307aef66d1690f5702485f44c8
- SHA1 20be2cfc781dc6ff3cb1a27c537f7325229aaed5
- SHA512 b6c4db1ca41cdf2c152337bf4ec5ca25863ae6b32b1a6c470b4240a5dae393e361796ebd4c6bf9592ed83a3b43bdeb6b3243fd1407eaf748c9926c2fe059bb0c
- TLSH T1E0411C391BD50807F2B297879EF7C1525A33FC916838DB4C538582194A6B805BD9CBEF
- MD5 SHA1 SHA512 TLSH
Microsoft_Windows_Desktop_Runtime_-_9.0.15_(x64)_20260511204515_002_dotnet_host_9.0.15_win_x64.msi.log
- Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_9.0.15_(x64)_20260511204515_002_dotnet_host_9.0.15_win_x64.msi.log
- Size 2KB
- SHA256 aa96c85198e890c66739a4b5b2d04088451b152cf999312eb487bffeab074c36
- MD5 af0711d3712d14fec823d541bd4dc404
- SHA1 fe6fef5544cd921cc6af9b43f510b3cec89ac514
- SHA512 3209c18e0db10ebc532d5f2c494508861e8ba32dd4787af5e6855143f5a313c633eff85b2e701956a70336bd2e28be4adb1269997ccfb40d535e7ffec4677295
- TLSH T18D411B691BE44906F2B6D747DEF7C051DB33FC92A838CB0C138642190A6B805A95CFAF
- MD5 SHA1 SHA512 TLSH
Microsoft_Windows_Desktop_Runtime_-_9.0.15_(x64)_20260511204515_003_windowsdesktop_runtime_9.0.15_win_x64.msi.log
- Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_9.0.15_(x64)_20260511204515_003_windowsdesktop_runtime_9.0.15_win_x64.msi.log
- Size 2KB
- SHA256 705148b8f3321b2381c74a204725a3e5e57bba7e070ccefea5cc5785c45d0f8e
- MD5 aa9216cc9f162aeb8b8d1d66eb080f17
- SHA1 3ed672106a0d10f7638aeba90cfbe5c28f17f05d
- SHA512 193d1b46f652b526ab0401093f2fce67ca0445b17dc855f8ad5c52eb93da2907dc534249c7863c3c2e8fd304147a5fe56471a61d41e15e02e8034ab8f5834b60
- TLSH T1EB4106591BE40846F2B297479EF3C112AA33FCC16838CB0D1386521A4667D04BD5CBEF
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Installer\MSI3C92.tmp
- Size 219KB
- SHA256 2bf33a9b9980e44d21d48f04cc6ac4eed4c68f207bd5990b7d3254a310b944ae
- MD5 928f4b0fc68501395f93ad524a36148c
- SHA1 084590b18957ca45b4a0d4576d1cc72966c3ea10
- SHA512 7f2163f651693f9b73a67e90b5c820af060a23502667a5c32c3beb2d6b043f5459f22d61072a744089d622c05502d80f7485e0f86eb6d565ff711d5680512372
- SSDEEP 3072:FVzl3qiEZybztEwiUx6D02cWVsV1v2vZR3X6j7zo6k2FkngTLrOrORT9flQnS6lg:FVIMEgXmEAR3oHon2VaFuG0eEp
- TLSH T1AF248D217494947EEAFA0832A57EDA71BF3DF2241760C8AEC3409D1E6D604C167B7B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{BEAE6870-A5DD-4A4E-B68F-8F880CF57EB1}\.ba\1033\thm.wxl
- Size 5KB
- SHA256 81a68046b06e09385be8449373e7ceb9e79f7724c3cf11f0b18a4489a8d4926a
- MD5 d5070cb3387a0a22b7046ae5ab53f371
- SHA1 bc9da146a42bbf9496de059ac576869004702a97
- SHA512 8fcf621fb9ce74725c3712e06e5b37b619145078491e828c6069e153359de3bd5486663b1fa6f3bcf1c994d5c556b9964ea1a1355100a634a6c700ef37d381e3
- SSDEEP 96:MT0abTxmup/vrCKATQdYQHdYCwgoVOBq9LjP5dbSE7:OQNkdYQHdYCYXt7
- TLSH T1F1C1DBA778CF53C128731255EA925AAA5911C19C537F2DF4FC8B454B838A827A373F23
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{C4D9F334-C43E-4412-8CF7-BAA2EF9B79E0}\.cr\windowsdesktop-runtime-9.0.15-win-x64.exe
- Size 608KB
- SHA256 5cc9d684684e68e7832baff3de444a0e093b41e5283e10fed4d5d6fee1b14e79
- MD5 f93c07e69cb57f1a1229c7a3dc9340c4
- SHA1 247e240b422d38dd45162a051fba9601a639f4a2
- SHA512 f4f5122e684b48a7454bc79e425a288eb7076e254ddb893aa2d8696e90e161cb0843cc5f5d1d6d43ac48b42b41a08ecf896d295ae7aab64f30bfe6cbf07e5202
- SSDEEP 12288:pmEsd9PZfePv3xl7ft7V+6uC+zd5qLl323wgiy7nlEM0Dnm:pm39PZfePv3r7fm6t+jqpG3ZzCM0
- TLSH T112D48D32A5614032E7F10273B928D6303E7CE328175488AAE7D4AD1D7EB88D667F7257
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{F2F63197-6B89-4807-B5E8-D1E754B926E3}\.ba\bg.png
- Size 4KB
- SHA256 9095bf7b6baa0107b40a4a6d727215be077133a190f4ca9bd89a176842141e79
- MD5 9eb0320dfbf2bd541e6a55c01ddc9f20
- SHA1 eb282a66d29594346531b1ff886d455e1dcd6d99
- SHA512 9ada3a1757a493fbb004bd767fab8f77430af69d71479f340b8b8ede904cc94cd733700db593a4a2d2e1184c0081fd0648318d867128e1cb461021314990931d
- SSDEEP 48:u+Xg+NXWbdlIr33lx9W5OstaDIy3r5XpPyvZKmXYTDeiByNxcaaaaaaaaaaaaaaE:AaXWPIrHT932JsdpPyjqDeioatEn
- TLSH T19891B4D8FCF95322C6002BF255F4C0735A0215B713ABFEC82F496BD90E6878E25058B2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{F2F63197-6B89-4807-B5E8-D1E754B926E3}\.ba\wixstdba.dll
- Size 190KB
- SHA256 dcea15f3710822ffc262e62ec04cc7bbbf0f33f5d1a853609fbfb65cb6a45640
- MD5 f1919c6bd85d7a78a70c228a5b227fbe
- SHA1 71647ebf4e7bed3bc1663d520419ac550fe630ff
- SHA512 c7ff9b19c9bf320454a240c6abbc382950176a6befce05ea73150eeb0085d0b6ed5b65b2dcb4b04621ef9cca1d5c4e59c6682b9c85d1d5845e5ce3e5eedfd2eb
- SSDEEP 3072:sjEoXsLW9OLG8Qp51ySdjDXY33b+Av7O5IkI+/AYkPAEc527uu3k/gLtxavf0ir2:sjEo8LW9553hXWy15I2YrAW7FUVEihs3
- TLSH T1FF14AF1176D0A07AEBFB16307A39A5216E7DBA200FA0C9DF63449D2B1D715C19B36B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{F2F63197-6B89-4807-B5E8-D1E754B926E3}\dotnet_host_9.0.15_win_x64.msi
- Size 708KB
- SHA256 59dd9b47e60b23ff7e21e32a70ca365cd9e4c204636fdc9202d61f7b866336c4
- MD5 3e1e92339938a9934cc1a1a4f3c11db6
- SHA1 d848ea4a9e82c20784f3a6057b78814e96e81af7
- SHA512 a80571ad608581afb227de38241d5ddc05f9d65942dc34c28adbbefefc645e10d34d61443e0f945ba1ff9b335ab840dab2063c06a654afd7582b0381d680cd7f
- SSDEEP 12288:6oCAD7V1EgXmEI3os2Qx7E4D4Rxbp4K+1uiq:6oCAPXdc3/7Rin+s
- TLSH T1D4F48C237D80803AD9BA0D71853DD7B16F3EBD204A64889B6380791DDDF15C0AF76AE6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{F2F63197-6B89-4807-B5E8-D1E754B926E3}\dotnet_hostfxr_9.0.15_win_x64.msi
- Size 780KB
- SHA256 8f459f87c9a8d47deb8d1f36865f539be5373a78c3c1b06c584984d165d7e402
- MD5 6acfac61baad6dffb6f566969fecf6e5
- SHA1 fb0f71885ffed0a59cdb9b296c93dce688e46fe4
- SHA512 77233a68c5a22a740d2e27a3c720c22e780e558a97c920ece5f8f8a74bcfbdaac609a587f7a0f924de92240bbbc789ffc3ed391885d89c207a3bb5656e9c69eb
- SSDEEP 12288:2HrIz5ZDBJZnVV1EgXmEI3os2Qx7E4D4Rxbp4K+1uiq:2LE5ZVJ/Xdc3/7Rin+s
- TLSH T15505AE237D80903AD9BA0D719539D7B16F3DBD204A64889B6380B91DDDF11C0AF36BE6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{F2F63197-6B89-4807-B5E8-D1E754B926E3}\dotnet_runtime_9.0.15_win_x64.msi
- Size 27.6MB
- SHA256 3ac0633e90a3c773fbc9ecd195af6a99b50f3bd9f024c9823759084e4f455f3e
- MD5 8984c1e2017c5d69492d641113e5c1f0
- SHA1 8f3f3e4cd9c265d3ae9c6787fd85e57292258b03
- SHA512 fba80b1d4f78c3cfb3c4d78417afb20ba0986c010de6989734ae284a568a4e08a580a89663c93cff446a916e4f8db912600d6bd7e3fa121aee848fc9a9b95983
- SSDEEP 786432:Pof1aN36BB+3AG+syG8HRy5yrv9lO6Eo2ZiWMAcx4Oor+:P61dY3AG+shiRysj7O22Z7zr+
- TLSH T17A5733177C12C531CC6D0D3A9276D3A50B3EAC244B2189CB7798B529DDF11C0AE6A7FA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{F2F63197-6B89-4807-B5E8-D1E754B926E3}\windowsdesktop_runtime_9.0.15_win_x64.msi
- Size 30.0MB
- SHA256 74d9e0b189bfc226a854d07c95cfb1cf5d4c9e223cf629bd7b967d2597797978
- MD5 985b36bc5ffee9636303d2db49c0aa95
- SHA1 0623287bda68b1b800aeb0cb133fa8be1386bfd8
- SHA512 d3fae9cd7db00b7c6dfc05bc914e6038485fb9670f25fc99f3077071b83455bae30a798550ef52db1ccbfb856b779131ad04afec6a98c904d394fc9bab9afd49
- SSDEEP 393216:Tu1CUK6Jik9EyAYe9N/KY5I5LRRex9uDfX918dtOaj+LKmc7/Zaccf3am8isoFVz:Tu1CUKwhKDP5Ih4IV2+DU8pam8iscKg
- TLSH T1166733937D83C836CD6E1C769136E7601E3E6C608B1888EF5352B51ECDF25D086B6AD2
- MD5 SHA1 SHA512 SSDEEP TLSH