3ceb6546978c249ea684b461104da02586ba5d405e6a7a99b29c55a949951153

Resubmissions

23/06/2026, 16:29

260623-tznnraet7t7

23/06/2026, 16:09

260623-tl8f1aet2z7

Analysis

user interaction
yes
max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/06/2026, 16:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ZN-Desktop-Link-Installer-v6.6.0.msi
Size 2.9MB
Sample260623-tl8f1aet2z
SHA256 3ceb6546978c249ea684b461104da02586ba5d405e6a7a99b29c55a949951153
MD5 6ddad8354687c175d849c6bc9128f62f
SHA1 46ed10dca4b67ffffb3395c72ed418e39e07fac4
SHA512 1e762f59ee1cefc962e18114a61f81f30171a991ec7bc4fa82fe674abf0bbdedba4aca01285559d422b5213479ad01b7de97c81cac020af8313b1d6f174c34fb
SSDEEP 49152:ZheBYEt/5WWUN8LeQW92mK4NZP5Os2LFgfoEvOsXIDUmZyQMMQGI:XW0WUCe/2OHP54L+foLsXsUmZyQ
TLSH
T145E52212B6C68632C1AA0531713F93945F7DBD305EB18A1F63A4BA1D3DB02906366FB7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence privilege_escalation ransomware

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4768	ZN-Desktop-Link.exe

Loads dropped DLL 10 IoCs

pid	Process
2288	MsiExec.exe
2288	MsiExec.exe
2288	MsiExec.exe
5112	MsiExec.exe
5112	MsiExec.exe
5112	MsiExec.exe
4768	ZN-Desktop-Link.exe
4768	ZN-Desktop-Link.exe
4768	ZN-Desktop-Link.exe
4768	ZN-Desktop-Link.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Ty Bayn (Zero-Network)\ZN-Desktop-Link\System.Text.Encoding.dll	msiexec.exe
File created	C:\Program Files (x86)\Ty Bayn (Zero-Network)\ZN-Desktop-Link\System.Collections.NonGeneric.dll	msiexec.exe
File created	C:\Program Files (x86)\Ty Bayn (Zero-Network)\ZN-Desktop-Link\System.Runtime.Handles.dll	msiexec.exe
File created	C:\Program Files (x86)\Ty Bayn (Zero-Network)\ZN-Desktop-Link\System.Collections.dll	msiexec.exe
File created	C:\Program Files (x86)\Ty Bayn (Zero-Network)\ZN-Desktop-Link\System.ServiceModel.Duplex.dll	msiexec.exe
File created	C:\Program Files (x86)\Ty Bayn (Zero-Network)\ZN-Desktop-Link\System.Xml.ReaderWriter.dll	msiexec.exe
File created	C:\Program Files (x86)\Ty Bayn (Zero-Network)\ZN-Desktop-Link\System.Xml.XPath.dll	msiexec.exe
File created	C:\Program Files (x86)\Ty Bayn (Zero-Network)\ZN-Desktop-Link\System.Security.SecureString.dll	msiexec.exe
File created	C:\Program Files (x86)\Ty Bayn (Zero-Network)\ZN-Desktop-Link\System.IO.UnmanagedMemoryStream.dll	msiexec.exe
File created	C:\Program Files (x86)\Ty Bayn (Zero-Network)\ZN-Desktop-Link\System.Numerics.Vectors.dll	msiexec.exe
File created	C:\Program Files (x86)\Ty Bayn (Zero-Network)\ZN-Desktop-Link\System.ValueTuple.dll	msiexec.exe
File created	C:\Program Files (x86)\Ty Bayn (Zero-Network)\ZN-Desktop-Link\System.Diagnostics.Tools.dll	msiexec.exe
File created	C:\Program Files (x86)\Ty Bayn (Zero-Network)\ZN-Desktop-Link\Microsoft.Bcl.AsyncInterfaces.dll	msiexec.exe
File created	C:\Program Files (x86)\Ty Bayn (Zero-Network)\ZN-Desktop-Link\System.IO.FileSystem.dll	msiexec.exe
File created	C:\Program Files (x86)\Ty Bayn (Zero-Network)\ZN-Desktop-Link\System.Xml.XDocument.dll	msiexec.exe
File created	C:\Program Files (x86)\Ty Bayn (Zero-Network)\ZN-Desktop-Link\System.IO.Compression.FileSystem.dll	msiexec.exe
File created	C:\Program Files (x86)\Ty Bayn (Zero-Network)\ZN-Desktop-Link\System.Drawing.Primitives.dll	msiexec.exe
File created	C:\Program Files (x86)\Ty Bayn (Zero-Network)\ZN-Desktop-Link\System.Diagnostics.Process.dll	msiexec.exe
File created	C:\Program Files (x86)\Ty Bayn (Zero-Network)\ZN-Desktop-Link\System.Linq.Queryable.dll	msiexec.exe
File created	C:\Program Files (x86)\Ty Bayn (Zero-Network)\ZN-Desktop-Link\System.ComponentModel.Annotations.dll	msiexec.exe
File created	C:\Program Files (x86)\Ty Bayn (Zero-Network)\ZN-Desktop-Link\System.Reflection.Emit.Lightweight.dll	msiexec.exe
File created	C:\Program Files (x86)\Ty Bayn (Zero-Network)\ZN-Desktop-Link\System.Diagnostics.StackTrace.dll	msiexec.exe
File created	C:\Program Files (x86)\Ty Bayn (Zero-Network)\ZN-Desktop-Link\System.IO.FileSystem.Watcher.dll	msiexec.exe
File created	C:\Program Files (x86)\Ty Bayn (Zero-Network)\ZN-Desktop-Link\System.Diagnostics.Tracing.dll	msiexec.exe
File created	C:\Program Files (x86)\Ty Bayn (Zero-Network)\ZN-Desktop-Link\System.Security.Cryptography.Primitives.dll	msiexec.exe
File created	C:\Program Files (x86)\Ty Bayn (Zero-Network)\ZN-Desktop-Link\System.Net.Http.dll	msiexec.exe
File created	C:\Program Files (x86)\Ty Bayn (Zero-Network)\ZN-Desktop-Link\System.ComponentModel.TypeConverter.dll	msiexec.exe
File created	C:\Program Files (x86)\Ty Bayn (Zero-Network)\ZN-Desktop-Link\System.Net.NetworkInformation.dll	msiexec.exe
File created	C:\Program Files (x86)\Ty Bayn (Zero-Network)\ZN-Desktop-Link\System.Threading.Tasks.Parallel.dll	msiexec.exe
File created	C:\Program Files (x86)\Ty Bayn (Zero-Network)\ZN-Desktop-Link\System.ServiceModel.Security.dll	msiexec.exe
File created	C:\Program Files (x86)\Ty Bayn (Zero-Network)\ZN-Desktop-Link\System.Text.Encoding.Extensions.dll	msiexec.exe
File created	C:\Program Files (x86)\Ty Bayn (Zero-Network)\ZN-Desktop-Link\System.IO.Compression.dll	msiexec.exe
File created	C:\Program Files (x86)\Ty Bayn (Zero-Network)\ZN-Desktop-Link\System.Security.Cryptography.X509Certificates.dll	msiexec.exe
File created	C:\Program Files (x86)\Ty Bayn (Zero-Network)\ZN-Desktop-Link\System.IO.FileSystem.DriveInfo.dll	msiexec.exe
File created	C:\Program Files (x86)\Ty Bayn (Zero-Network)\ZN-Desktop-Link\System.ComponentModel.dll	msiexec.exe
File created	C:\Program Files (x86)\Ty Bayn (Zero-Network)\ZN-Desktop-Link\System.Xml.XmlDocument.dll	msiexec.exe
File created	C:\Program Files (x86)\Ty Bayn (Zero-Network)\ZN-Desktop-Link\System.ServiceModel.Http.dll	msiexec.exe
File created	C:\Program Files (x86)\Ty Bayn (Zero-Network)\ZN-Desktop-Link\System.Data.Common.dll	msiexec.exe
File created	C:\Program Files (x86)\Ty Bayn (Zero-Network)\ZN-Desktop-Link\System.Buffers.dll	msiexec.exe
File created	C:\Program Files (x86)\Ty Bayn (Zero-Network)\ZN-Desktop-Link\System.Net.Ping.dll	msiexec.exe
File created	C:\Program Files (x86)\Ty Bayn (Zero-Network)\ZN-Desktop-Link\System.Net.WebSockets.Client.dll	msiexec.exe
File created	C:\Program Files (x86)\Ty Bayn (Zero-Network)\ZN-Desktop-Link\System.Memory.dll	msiexec.exe
File created	C:\Program Files (x86)\Ty Bayn (Zero-Network)\ZN-Desktop-Link\System.Diagnostics.Debug.dll	msiexec.exe
File created	C:\Program Files (x86)\Ty Bayn (Zero-Network)\ZN-Desktop-Link\System.Runtime.CompilerServices.Unsafe.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Ty Bayn (Zero-Network)\ZN-Desktop-Link\System.Text.Encodings.Web.dll	msiexec.exe
File created	C:\Program Files (x86)\Ty Bayn (Zero-Network)\ZN-Desktop-Link\System.AppContext.dll	msiexec.exe
File created	C:\Program Files (x86)\Ty Bayn (Zero-Network)\ZN-Desktop-Link\Microsoft.Extensions.Configuration.Abstractions.dll	msiexec.exe
File created	C:\Program Files (x86)\Ty Bayn (Zero-Network)\ZN-Desktop-Link\websocket-sharp.dll	msiexec.exe
File created	C:\Program Files (x86)\Ty Bayn (Zero-Network)\ZN-Desktop-Link\System.Runtime.CompilerServices.VisualC.dll	msiexec.exe
File created	C:\Program Files (x86)\Ty Bayn (Zero-Network)\ZN-Desktop-Link\System.Diagnostics.TraceSource.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Ty Bayn (Zero-Network)\ZN-Desktop-Link\System.IO.Pipelines.dll	msiexec.exe
File created	C:\Program Files (x86)\Ty Bayn (Zero-Network)\ZN-Desktop-Link\System.Console.dll	msiexec.exe
File created	C:\Program Files (x86)\Ty Bayn (Zero-Network)\ZN-Desktop-Link\Transitions.dll	msiexec.exe
File created	C:\Program Files (x86)\Ty Bayn (Zero-Network)\ZN-Desktop-Link\System.Xml.XmlSerializer.dll	msiexec.exe
File created	C:\Program Files (x86)\Ty Bayn (Zero-Network)\ZN-Desktop-Link\System.Linq.dll	msiexec.exe
File created	C:\Program Files (x86)\Ty Bayn (Zero-Network)\ZN-Desktop-Link\Microsoft.Win32.Primitives.dll	msiexec.exe
File created	C:\Program Files (x86)\Ty Bayn (Zero-Network)\ZN-Desktop-Link\System.Net.Http.WebRequest.dll	msiexec.exe
File created	C:\Program Files (x86)\Ty Bayn (Zero-Network)\ZN-Desktop-Link\System.Resources.Reader.dll	msiexec.exe
File created	C:\Program Files (x86)\Ty Bayn (Zero-Network)\ZN-Desktop-Link\System.Runtime.InteropServices.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Ty Bayn (Zero-Network)\ZN-Desktop-Link\System.Net.Http.dll	msiexec.exe
File created	C:\Program Files (x86)\Ty Bayn (Zero-Network)\ZN-Desktop-Link\System.Runtime.Serialization.Formatters.dll	msiexec.exe
File created	C:\Program Files (x86)\Ty Bayn (Zero-Network)\ZN-Desktop-Link\System.Reflection.Emit.ILGeneration.dll	msiexec.exe
File created	C:\Program Files (x86)\Ty Bayn (Zero-Network)\ZN-Desktop-Link\System.Diagnostics.Contracts.dll	msiexec.exe
File created	C:\Program Files (x86)\Ty Bayn (Zero-Network)\ZN-Desktop-Link\System.Security.Cryptography.Csp.dll	msiexec.exe

Drops file in Windows directory 17 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3532_2101958927\manifest.json	msedge.exe
File created	C:\Windows\Installer\e58f18f.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF3F0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF692.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\~DF592DCC94FC771EE0.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF2573702A9CB3DD4B.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e58f18f.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFB75.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF5F5.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\e58f195.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{F3C036CF-D649-48C3-B70A-7BB426DFC65C}	msiexec.exe
File created	C:\Windows\SystemTemp\~DF3212226AD07838E3.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF2302F5DF219828E9.TMP	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
980	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZN-Desktop-Link.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3192	msedge.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ed6836836fe2a8780000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801ed6836830000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101ed683683000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3ed68368300000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6ed68368300000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134267046775797564"	msedge.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\zndl\shell\open\command	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\zndl	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\zndl\shell	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\zndl\shell\open	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\zndl\ = "URL:protocol"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\zndl\URL Protocol	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-537605601-1362463912-856654178-1000\{EE716B8E-6850-40FB-97C1-08B7B7BFA89C}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\zndl\shell\open\command\ = "C:\\Program Files (x86)\\Ty Bayn (Zero-Network)\\ZN-Desktop-Link\\ZN-Desktop-Link.exe %1"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3244	msiexec.exe
3244	msiexec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	980	msiexec.exe
Token: SeIncreaseQuotaPrivilege	980	msiexec.exe
Token: SeSecurityPrivilege	3244	msiexec.exe
Token: SeCreateTokenPrivilege	980	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	980	msiexec.exe
Token: SeLockMemoryPrivilege	980	msiexec.exe
Token: SeIncreaseQuotaPrivilege	980	msiexec.exe
Token: SeMachineAccountPrivilege	980	msiexec.exe
Token: SeTcbPrivilege	980	msiexec.exe
Token: SeSecurityPrivilege	980	msiexec.exe
Token: SeTakeOwnershipPrivilege	980	msiexec.exe
Token: SeLoadDriverPrivilege	980	msiexec.exe
Token: SeSystemProfilePrivilege	980	msiexec.exe
Token: SeSystemtimePrivilege	980	msiexec.exe
Token: SeProfSingleProcessPrivilege	980	msiexec.exe
Token: SeIncBasePriorityPrivilege	980	msiexec.exe
Token: SeCreatePagefilePrivilege	980	msiexec.exe
Token: SeCreatePermanentPrivilege	980	msiexec.exe
Token: SeBackupPrivilege	980	msiexec.exe
Token: SeRestorePrivilege	980	msiexec.exe
Token: SeShutdownPrivilege	980	msiexec.exe
Token: SeDebugPrivilege	980	msiexec.exe
Token: SeAuditPrivilege	980	msiexec.exe
Token: SeSystemEnvironmentPrivilege	980	msiexec.exe
Token: SeChangeNotifyPrivilege	980	msiexec.exe
Token: SeRemoteShutdownPrivilege	980	msiexec.exe
Token: SeUndockPrivilege	980	msiexec.exe
Token: SeSyncAgentPrivilege	980	msiexec.exe
Token: SeEnableDelegationPrivilege	980	msiexec.exe
Token: SeManageVolumePrivilege	980	msiexec.exe
Token: SeImpersonatePrivilege	980	msiexec.exe
Token: SeCreateGlobalPrivilege	980	msiexec.exe
Token: SeCreateTokenPrivilege	980	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	980	msiexec.exe
Token: SeLockMemoryPrivilege	980	msiexec.exe
Token: SeIncreaseQuotaPrivilege	980	msiexec.exe
Token: SeMachineAccountPrivilege	980	msiexec.exe
Token: SeTcbPrivilege	980	msiexec.exe
Token: SeSecurityPrivilege	980	msiexec.exe
Token: SeTakeOwnershipPrivilege	980	msiexec.exe
Token: SeLoadDriverPrivilege	980	msiexec.exe
Token: SeSystemProfilePrivilege	980	msiexec.exe
Token: SeSystemtimePrivilege	980	msiexec.exe
Token: SeProfSingleProcessPrivilege	980	msiexec.exe
Token: SeIncBasePriorityPrivilege	980	msiexec.exe
Token: SeCreatePagefilePrivilege	980	msiexec.exe
Token: SeCreatePermanentPrivilege	980	msiexec.exe
Token: SeBackupPrivilege	980	msiexec.exe
Token: SeRestorePrivilege	980	msiexec.exe
Token: SeShutdownPrivilege	980	msiexec.exe
Token: SeDebugPrivilege	980	msiexec.exe
Token: SeAuditPrivilege	980	msiexec.exe
Token: SeSystemEnvironmentPrivilege	980	msiexec.exe
Token: SeChangeNotifyPrivilege	980	msiexec.exe
Token: SeRemoteShutdownPrivilege	980	msiexec.exe
Token: SeUndockPrivilege	980	msiexec.exe
Token: SeSyncAgentPrivilege	980	msiexec.exe
Token: SeEnableDelegationPrivilege	980	msiexec.exe
Token: SeManageVolumePrivilege	980	msiexec.exe
Token: SeImpersonatePrivilege	980	msiexec.exe
Token: SeCreateGlobalPrivilege	980	msiexec.exe
Token: SeCreateTokenPrivilege	980	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	980	msiexec.exe
Token: SeLockMemoryPrivilege	980	msiexec.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
980	msiexec.exe
980	msiexec.exe
3532	msedge.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
980	msiexec.exe
3244	msiexec.exe
2288	MsiExec.exe
5112	MsiExec.exe

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 3244 wrote to memory of 2288	3244	msiexec.exe	89
PID 3244 wrote to memory of 1348	3244	msiexec.exe	94
PID 3244 wrote to memory of 5112	3244	msiexec.exe	96
PID 4768 wrote to memory of 3532	4768	ZN-Desktop-Link.exe	99
PID 3532 wrote to memory of 3396	3532	msedge.exe	100
PID 3532 wrote to memory of 3192	3532	msedge.exe	101
PID 3532 wrote to memory of 6128	3532	msedge.exe	102
PID 3532 wrote to memory of 6128	3532	msedge.exe	102
PID 3532 wrote to memory of 1140	3532	msedge.exe	104
PID 3532 wrote to memory of 1140	3532	msedge.exe	104
PID 3532 wrote to memory of 1140	3532	msedge.exe	104
PID 3532 wrote to memory of 6140	3532	msedge.exe	105
PID 3532 wrote to memory of 5488	3532	msedge.exe	106
PID 3532 wrote to memory of 6140	3532	msedge.exe	105
PID 3532 wrote to memory of 6140	3532	msedge.exe	105
PID 3532 wrote to memory of 5488	3532	msedge.exe	106
PID 3532 wrote to memory of 5488	3532	msedge.exe	106
PID 3532 wrote to memory of 2632	3532	msedge.exe	107
PID 3532 wrote to memory of 2632	3532	msedge.exe	107
PID 3532 wrote to memory of 2632	3532	msedge.exe	107
PID 3532 wrote to memory of 5028	3532	msedge.exe	108
PID 3532 wrote to memory of 5028	3532	msedge.exe	108
PID 3532 wrote to memory of 5028	3532	msedge.exe	108
PID 3532 wrote to memory of 5956	3532	msedge.exe	110
PID 3532 wrote to memory of 5956	3532	msedge.exe	110
PID 3532 wrote to memory of 5252	3532	msedge.exe	112
PID 3532 wrote to memory of 5252	3532	msedge.exe	112
PID 3532 wrote to memory of 4592	3532	msedge.exe	113
PID 3532 wrote to memory of 2980	3532	msedge.exe	114
PID 3532 wrote to memory of 4592	3532	msedge.exe	113
PID 3532 wrote to memory of 2980	3532	msedge.exe	114
PID 3532 wrote to memory of 988	3532	msedge.exe	116
PID 3532 wrote to memory of 3872	3532	msedge.exe	117
PID 3532 wrote to memory of 3872	3532	msedge.exe	117
PID 3532 wrote to memory of 5612	3532	msedge.exe	120
PID 3532 wrote to memory of 5612	3532	msedge.exe	120
PID 3532 wrote to memory of 5612	3532	msedge.exe	120
PID 3532 wrote to memory of 892	3532	msedge.exe	121
PID 3532 wrote to memory of 892	3532	msedge.exe	121
PID 3532 wrote to memory of 2632	3532	msedge.exe	123
PID 3532 wrote to memory of 1760	3532	msedge.exe	124
PID 3532 wrote to memory of 2820	3532	msedge.exe	125
PID 3532 wrote to memory of 2116	3532	msedge.exe	126
PID 3532 wrote to memory of 2116	3532	msedge.exe	126
PID 3532 wrote to memory of 5004	3532	msedge.exe	130
PID 3532 wrote to memory of 5004	3532	msedge.exe	130

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\ZN-Desktop-Link-Installer-v6.6.0.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:980

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3244
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 18CA48A78B189771222B87CDC842DAA0 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2288
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:1348
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 5AFE70E9B6A5E187E49355409E43B767
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5112

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:3508

C:\Program Files (x86)\Ty Bayn (Zero-Network)\ZN-Desktop-Link\ZN-Desktop-Link.exe
"C:\Program Files (x86)\Ty Bayn (Zero-Network)\ZN-Desktop-Link\ZN-Desktop-Link.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://tybayn.github.io/phasmo-cheat-sheet/?autolink=true
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ffa8793c188,0x7ffa8793c194,0x7ffa8793c1a0
    3⤵
    PID:3396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1896,i,18319416976607427765,2339493436868330474,524288 --field-trial-handle=2616,i,11890714691356214179,14409612674775317605,262144 --variations-seed-version --mojo-platform-channel-handle=2648 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2264,i,5162690994061984149,2253350924379972174,524288 --field-trial-handle=2616,i,11890714691356214179,14409612674775317605,262144 --variations-seed-version --mojo-platform-channel-handle=2500 /prefetch:13
    3⤵
    PID:6128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1704,i,7180769080185660685,4978359494690232751,262144 --field-trial-handle=2616,i,11890714691356214179,14409612674775317605,262144 --variations-seed-version --mojo-platform-channel-handle=2612 /prefetch:2
    3⤵
    PID:1140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3644,i,17498293549330157101,2286774092719359136,2097152 --field-trial-handle=2616,i,11890714691356214179,14409612674775317605,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:1
    3⤵
    PID:6140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3648,i,17131873954261524655,12688688362336134113,2097152 --field-trial-handle=2616,i,11890714691356214179,14409612674775317605,262144 --variations-seed-version --mojo-platform-channel-handle=3720 /prefetch:1
    3⤵
    PID:5488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4368,i,95770196294859248,1781704395429588565,2097152 --field-trial-handle=2616,i,11890714691356214179,14409612674775317605,262144 --variations-seed-version --mojo-platform-channel-handle=4532 /prefetch:1
    3⤵
    PID:2632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4384,i,11792162694902249311,901855511516844108,2097152 --field-trial-handle=2616,i,11890714691356214179,14409612674775317605,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:9
    3⤵
    PID:5028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3836,i,8805568267964227550,618689098809400548,524288 --field-trial-handle=2616,i,11890714691356214179,14409612674775317605,262144 --variations-seed-version --mojo-platform-channel-handle=3852 /prefetch:14
    3⤵
    PID:5956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5444,i,1644701074330988566,7053793626203798433,524288 --field-trial-handle=2616,i,11890714691356214179,14409612674775317605,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:12
    3⤵
    PID:5252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,1789705312044345630,979176857703395479,524288 --field-trial-handle=2616,i,11890714691356214179,14409612674775317605,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:14
    3⤵
    PID:4592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5620,i,18119086414636104007,3411199867290187512,524288 --field-trial-handle=2616,i,11890714691356214179,14409612674775317605,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:14
    3⤵
    PID:2980
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6220,i,16838826082983568983,1898498271071403287,524288 --field-trial-handle=2616,i,11890714691356214179,14409612674775317605,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:14
    3⤵
    PID:5036
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6220,i,16838826082983568983,1898498271071403287,524288 --field-trial-handle=2616,i,11890714691356214179,14409612674775317605,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:14
    3⤵
    PID:988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6424,i,7951321729117448554,3527709792507303114,524288 --field-trial-handle=2616,i,11890714691356214179,14409612674775317605,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:14
    3⤵
    PID:3872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=7068,i,5240583846832969777,433043126254471174,2097152 --field-trial-handle=2616,i,11890714691356214179,14409612674775317605,262144 --variations-seed-version --mojo-platform-channel-handle=3888 /prefetch:1
    3⤵
    PID:5612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5088,i,13238604335902610222,17624050317652230879,524288 --field-trial-handle=2616,i,11890714691356214179,14409612674775317605,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:14
    3⤵
    PID:892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6304,i,5963739413698073701,16855492355658879144,524288 --field-trial-handle=2616,i,11890714691356214179,14409612674775317605,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:14
    3⤵
    PID:2632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,11854948075745571265,5494039969847334195,524288 --field-trial-handle=2616,i,11890714691356214179,14409612674775317605,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:14
    3⤵
    PID:1760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,7371033867153891615,16721203228021673886,524288 --field-trial-handle=2616,i,11890714691356214179,14409612674775317605,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:14
    3⤵
    PID:2820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5180,i,14505826759823362286,2435993729844572514,524288 --field-trial-handle=2616,i,11890714691356214179,14409612674775317605,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:14
    3⤵
    PID:2116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,13761851809273216419,3786975826799217945,524288 --field-trial-handle=2616,i,11890714691356214179,14409612674775317605,262144 --variations-seed-version --mojo-platform-channel-handle=6804 /prefetch:14
    3⤵
    PID:5004

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2704

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1056

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1412

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e58f190.rbs

Path C:\Config.Msi\e58f190.rbs
Size 87KB
SHA256 448252ecaf63741fc0fa4b756aa0d5c8011f94dce97b0f1bf404da52eae9477c
MD5 c22536a512379318b7c555d1b581bd7d
SHA1 f15a5513d6ac2ba570dbfffdbf5b7da0a76f5dda
SHA512 774bd46f5f2204ac27bd5c4322fcc4bd9db05900587c104e57660754eacc2d245102f1dd0841075fb577a3b0d62a57749ff62659617c2d5e4a3213ae2c7b1f26
SSDEEP 768:+cZTi+c6q5Dt9vQEc4N1PvKyRmj7C85WWdZ:3Z2974Ec4NbRmjLW6
TLSH
T1269341917B41C1D2D852DB7163817B0EA3229F87C1D666EE7AC5CF8F8AC5A4E132C2D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Newtonsoft.Json.dll

Path C:\Program Files (x86)\Ty Bayn (Zero-Network)\ZN-Desktop-Link\Newtonsoft.Json.dll
Size 695KB
SHA256 e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
MD5 195ffb7167db3219b217c4fd439eedd6
SHA1 1e76e6099570ede620b76ed47cf8d03a936d49f8
SHA512 56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac
SSDEEP 12288:GBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUO:GBjk38WuBcAbwoA/BkjSHXP36RMG/
TLSH
T166E4394123F98F2BE1AF6B75B4704E1543F9F917A6B5E78F9A04D9A91C43B408E403A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.IO.Pipelines.dll

Path C:\Program Files (x86)\Ty Bayn (Zero-Network)\ZN-Desktop-Link\System.IO.Pipelines.dll
Size 82KB
SHA256 d881b5e01c527bb7cafa3c2482f7cbfbf158fcbb6f93efb4381b638c2d4ea6f7
MD5 6c1158f437026832e069e757e02030c4
SHA1 e0f6e168f17ed935bc189edce13f15b77c12bab0
SHA512 b0f6621b47f07b81d348c687221b86ce47f95bc79219365af3f2f628136dc7b16c2dd9909ba0de39fc55b1b39dd512f8ca645486ceccf2af86cbf5f0fa5b397e
SSDEEP 1536:AOBEtNwWq02pH6ZafBzoGrriJNNjrgFX94bsAbYo4bgN0xeR5evOjvjDXT4Oe5Jt:3BSNTAl6ZcBzoGQ8XkJYo4bgN0xeR5e9
TLSH
T1EC836B6853BC472BEFDE1ABDA57096020FB7D7166913F34AAC4CB9ED188738046142B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Net.Http.dll

Path C:\Program Files (x86)\Ty Bayn (Zero-Network)\ZN-Desktop-Link\System.Net.Http.dll
Size 84KB
SHA256 cb1b1ac1c1a435f7ea7ee75914aa7bb1324bfafb7910d8c814db62a77b09ffa0
MD5 cfaedd3de549e3cb02f8bb77a28bc076
SHA1 859c5f82a2fc22a6bcfbee92b841761a1b5b08b2
SHA512 d0cb88b8a6e6b27c159d609069ac4c586e0236dd0721c8c51e7e64202a17fda3084d0c035da8009162f8a00d20ef70f3b296c00b3096e87ab1819fe0e276956d
SSDEEP 1536:nC3UkaSGZKFcLZBPH5bdlY/zLcKAViCu8:nC3xaSGZKmBPJdlYrYK0u8
TLSH
T1A3833B0857E4832DE9B70BB0F8F5C5A7AA38F7823921C79D2485134D189274F97627EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Text.Encodings.Web.dll

Path C:\Program Files (x86)\Ty Bayn (Zero-Network)\ZN-Desktop-Link\System.Text.Encodings.Web.dll
Size 77KB
SHA256 ad6be4be7e0183f3eabac3f747b834c557156942c7d2ce12039477ad0874fbfb
MD5 56a2b64c40502852dacef02240ad46bc
SHA1 4019d0f80c83dedfea9820f91650bfae817451ba
SHA512 19c5fa4a067332268b9043ee57c6e66a8692ee0d16d1c82d08de68eecca327886aaa2c69f179d60b1818acf079aecf961f6feea0234dbf4a75ab51f008b34490
SSDEEP 1536:uOOUnOOOc++v9mBkdQ3IWIxL1HFkzoA4Vnrpwp77ojJjn7NoWgzInv:c+FmCQ3I077oljRoTEnv
TLSH
T1BC735C26A788872EC73E16305570857097B0BF9E1263F7825894B40F1B777CAA71D2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.ValueTuple.dll

Path C:\Program Files (x86)\Ty Bayn (Zero-Network)\ZN-Desktop-Link\System.ValueTuple.dll
Size 24KB
SHA256 e905d102585b22c6df04f219af5cbdbfa7bc165979e9788b62df6dcc165e10f4
MD5 23ee4302e85013a1eb4324c414d561d5
SHA1 d1664731719e85aad7a2273685d77feb0204ec98
SHA512 6b223ce7f580a40a8864a762e3d5cccf1d34a554847787551e8a5d4d05d7f7a5f116f2de8a1c793f327a64d23570228c6e3648a541dd52f93d58f8f243591e32
SSDEEP 384:VyPa16oAL4D+wW9IWmDIW4IWYDMFm0GftpBjMIraQHRN7VlmTpF0:VWs6oqDjADKeDYViG+LN
TLSH
T1DBB23955DBFC5143EEA35E7066B4D6873C3EF7C35D21862E106AE14A1CA37C1AB20B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ZN-Desktop-Link.exe

Path C:\Program Files (x86)\Ty Bayn (Zero-Network)\ZN-Desktop-Link\ZN-Desktop-Link.exe
Size 595KB
SHA256 7da05e8ac033975e1a427640de2c509234f88a2080715eca084052fa64bd3cd7
MD5 0915de292c4931bfa28ebd9dc2460751
SHA1 cbcc7daa1479272c1faa324a3204cf9850aa0ce6
SHA512 2a67c1e8514b13b752da49832d875e342facf303a6105bab986fbb28e727ebc6f61dd481beb12ec96fe1489ee5b724f77db5d039d715f93d97bd3bfdac8c908d
SSDEEP 12288:gvAK3q/KJuERcVUqFXcs6ByVfD5oEoK+Syj65y/9W+w0Jb/kkCdxElEDn9SpDob/:kDobwFKEbbVD
TLSH
T173D4285132AC5EA7E5BAEBF745621081CBB63A1A252DEBCD0DC626CE14F4B500593F33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ZN-Desktop-Link.exe.config

Path C:\Program Files (x86)\Ty Bayn (Zero-Network)\ZN-Desktop-Link\ZN-Desktop-Link.exe.config
Size 2KB
SHA256 43a9a00c771b6108ae83fd9332a7964d4259e665964c5daa8b541c091bae20a3
MD5 91df25a9c32d91e361c99a6d4987ecac
SHA1 a03a4f1dbbb91aa03820c1499b43b4a0652595a7
SHA512 a0706ba493acd78084b32b141e9a6dcad5bea92f2e2a884bf843ebfe4e6ca77061f93f6020bd3c80dc9927bbf3bf2f341244d194914aee14840970615646dfd0
TLSH
T1D6510D11A1C8BFA00B724AB27E5FA858CB7D03B72D4C0A4DB5DE5B478F35A5A4307176
MD5 SHA1 SHA512 TLSH

Submit Download

websocket-sharp.dll

Path C:\Program Files (x86)\Ty Bayn (Zero-Network)\ZN-Desktop-Link\websocket-sharp.dll
Size 221KB
SHA256 697f13f09cb2c425ddcfe1aa167d698f7af5aea48d03d5370143bc00e9bbfa2e
MD5 e67544b112f568f13b17d72189fda007
SHA1 b75b79c65330a77fe7aea5ef6c319d7f3d1865d4
SHA512 5a3381c0be69df8dc5a8c7c931b14919a189a8d03d2128d3848fbf73e3fd21631fe44eccd9baf97a15f646d0fcc5b3263b6eac2f98d67557a07ad6fb4f91c402
SSDEEP 6144:aG6L6WIqe9bjj1OLNryn2aJJJnoQCSJgI:aG6L6WTeBjKsn2aJPoQ
TLSH
T17324180427F85A2AF3FF9778D1B455248BB6F957BA2AE75D9C8450E90C23B80CE10763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bf637ca0b28ebd6e948876848ccfe71d201158d460d4ad944f124f9d17ee5472
MD5 827e00d89fccbbde703c679b5c7ff536
SHA1 6d9e235782beb4e6b38fd4db2946f9bfc725110c
SHA512 1d18100db386f25678d8dabb492ab6e15d08e2c5a7d7e6c76bc253df648e2b5438cbc4fcb5a4033a1e14afbda93b271225eb5f545f12663d6bc35ca51239fcc3
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7X:fwUQC5VwBIiElEd2K57P7X
TLSH
T148B3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5f46172781024fe58b7a7d87a406b81679d17de445e9e90110d33f5747ecc226
MD5 08a5ef0e8eb4590a7f0e6f821698071e
SHA1 1b756aceae48cf2649d310d7ab4883595c2e5bde
SHA512 95c72989df00c3caf1230ca41b6dcbc24f8a592c45202f7b16044b8d574fe569d4db8614652b0d1695d3fe1d795b07ea334de5b4fa9dcbb9d27de40a55592586
TLSH
T155D080757B467A11D58F0476D424E271A737455125D296057170C10E55602D1FFC90A7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ff19e848916f9346514f95113e3d80cd569935b36d785719b19d90f9f740fbd6
MD5 5ab41182d14eb22e7143c63d2e18b77b
SHA1 ca8c747e1a5e38b0f0a08b492fcea6d3a75865c2
SHA512 bbecb67f89826ee2bd219f14bbc8ca87fb260f8a22bd2d52b6ccdb72d47a4b58eeb897a42a6e591bd4e75fe870419162172353d5d3ec7f1fb0fbc7b5dc6adcf1
TLSH
T1AED080757B467B11D58F0472D424E271A737455135D296057170C10E55602D1FFCA0B7
MD5 SHA1 SHA512 TLSH

Submit Download

0cd4a8c4-2363-4db2-8c64-c70f4624bf47.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0cd4a8c4-2363-4db2-8c64-c70f4624bf47.tmp
Size 32KB
SHA256 08a778115fd04cb45ff2808314932670fa39e87f4f50b30de874ab9d37189095
MD5 e5f2e3c00c1546687710ab78fdf47c41
SHA1 a093a652542da7c8c060ecf42fbb7634b187c123
SHA512 9a8fce79d15dc59d2bc5d0794631c5c5edfe2e4ac527541740539b942d8ece763fbf1322938528ca03a10d49ac834cd2a1b1eb5703e482de81c9d8c5315e1f42
SSDEEP 768:Nmymm/7pLuL7YpWgvHfSv8F1+UoAYDCx9Tuqh0VfUC9xbog/OVqr3LxgQroRLGng:Nmymm5E7YpWgvHfSvu1jaRr3Ng7RLG2D
TLSH
T1D0E2EC3B680CCB7E4F844AADEC29BD9A6DD801CF5A98CD5447EA840C03C67FB511A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000082

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000082
Size 1024KB
SHA256 396f0602ea9d058599e4bf80d862247592a5137cc210531af6835c7262c4a6cb
MD5 deb1d6fc4900e4fd9da772725fe1ec9d
SHA1 67993990cddecda3e865917fcc55294e139497d7
SHA512 b5f2489048a8063f44798f3ec617a8f263e9ce1d31dd0bea736b79ee98f59d3d425f59c5b30e6b8a020119e6dd07b17904c6417860892629c76a79ff07253846
SSDEEP 24576:K9KUWPsrtRpOopvvgnVC5F1DlvxVBqj75qsy1oNXkv+omUH:CWipOoxUEdxVBqvjF4+omm
TLSH
T13A2533B8A1D8B81F2148738F9BB932479C9A6FBA5CB9655FC0471CBA03441E70A3775C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 5b754d1361cfc1784f7a7cf7e0929e807f361608d266caa696fc45acec6191a9
MD5 efe5873f1c1603db985b278c23a59d25
SHA1 a76afd0ab92b73ae101dcd23d70a3f08a4247c87
SHA512 f977bcc85cd5c7f93dbeec626be59889c4d2d12b831e94dc5b1faf37fb8851ef1cbcb3e1931326e6b6af0589b2d632bb744471d12b124668e95b24dd7b67fa42
TLSH
T1EF81C8E158E32825DFF0A9B4D1C1249B3BFAD06C71275E3B36AD73FF5926740AA41050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a202c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a202c.TMP
Size 3KB
SHA256 42994ef021c9b3075f7d94687d125d58d5652c0e2e47ff3a52cc458f5eb95d3d
MD5 32e38bbe7b03b7f9d64d62780d8fec3c
SHA1 3a1b817d985855ed655baad0c721f5ac46b18f91
SHA512 432d5debb1aaae35a017a241ffaa575e8ea0d132283678125ed604c236250429e024db023ec645d7aa4b671ad09abaaf1c43d010d8f6c64b4d25b9e348cf90de
TLSH
T10161B8D1A8E32819DBF0B1B5D1D1209B37FAD04D35275D3B7BAE73BF6506700A841080
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 c126f1f0b9ec0ab882877a16fd1201cb4cb9bb1bf1df8944d24985bfba0f6c12
MD5 98f4e9a19f50b98c6d95e587cc1ad39b
SHA1 09d3d769cbc44d1de1f25fd8e2aecf9a5e8ec585
SHA512 6447f79f9f310b67d8738ee30364f24bcd9a0834413e80408b19c920222ba13c6ed0604cceed2568e9d5a5c427da76824ba3b2de920ae3ea527d9f4a0999459d
SSDEEP 48:YALlN5O1hT1kP1s13u1QgyjzAs+RsEfoKsUzBcMJsnCgcVs7BsGCKs8gPsRosKcT:DjOvmiE+V2bzzBcMwFcEpbgk6c8chl
TLSH
T1F1A17FB7C2E8C93DD91196F0AB542927CE1D0A18532C3D59C8E5AF8B6BE74B0D24160F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 b56aba978d36babcd8427281888c72a877af854a6ae10d5889303ecf9bacf8ca
MD5 fd1b72166289085182acb38792caf570
SHA1 e21a56bd3a161a0cba32cd4821d269ade3326218
SHA512 2c57817834f3821ac854a7fd528a1237b8cf1cb518baee4fdd35b281ce6ba0b108042ca99cee54bb2644505f5605d4881d9464e349f39424435324478c92042e
SSDEEP 192:sxRwRryM/jK1Ml8wce/ffsLyiaUZkIzoA8poly/g6+WNuIs/Y4pTTGRDIgtJ:sxRw1Ce/ffsLCqkR7/5e/m73
TLSH
T17C62DA156A3899778CDBD309FA557F53D6F91573A2901E44AAFCCA0C04F6AEC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 3cba93371593daeb13ca1bd348917844d38cb13101b9ee2ea737530dbf8b0e7c
MD5 d65d04509018c4ec490f8a880c3f081e
SHA1 630a45120bcfcf5201a85acfb6691506b162f6d5
SHA512 9b06491cae7ae3e89664326043ea57bdcad97cb95b4ccb42ed0d9b116115421bbb6dd8e499498021fd2be1c3c61b1c28ee15b7ace41da6692fb7d3262f6fc5a0
SSDEEP 192:sxRHRryM/jK1Ml8wce/ffs8yiaUZkIzoA8poly/g6+WNuIs/Y4pTTGRDIgDEuJ:sxRH1Ce/ffs8CqkR7/5e/m7f
TLSH
T12262DB156A3859778CDBD309FA557F53D6F91573A2901E44AAFC8A0C04F6AEC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 09c6bc70f2fc6ff9155447b69151337daf1e2e5b8b459bd39a8a33befd9e1761
MD5 46f9a108b149852a9997d7826b907c02
SHA1 90464298a6f33ad617a65aba37112d2c9b3fdbf4
SHA512 78cb76d5b7cc3c84f9c1b6cb4f4f88e68ae98b7812242a8df23d3143bd9fec0d4fcfc2c32af0c9a3253aad45b4b38aefabe6992a18df9b7fa71410c472627f3d
SSDEEP 48:KQFINKWg4/yZIILKpK8BFIBKOE8TyJcIjK5ikT:KQFyKWgiKIoKpKKF+KOES6cwK5iE
TLSH
T1F2B1820475FF260138FEA4589171D91F264230F6315AA93B3BEC70E61D66E409EFE9E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a8b49.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a8b49.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 dad3b549c4faf360d79098878ff0f6dc938accf420cd3d3934700457f52e7f31
MD5 0cc2cd695347f636ee6a44f9c242fd3e
SHA1 7b8d0085619cffc700584b5cc4c2e5269bf6150c
SHA512 ac6a9d149e36cf9ba1f7ee67fa976a58cd6482eb73167aba56e77f9dbe9f240679cc902ea69857b6b07c3bec0b9d8ca1c272e3ab625399fddc2219e4292af623
SSDEEP 768:qj+9g3Rqfy4faifmtBA7NpespIRM0UmkTziwjgzSS8+0qvu:J9g3ofTf9f9QsZ0UmYy8uvu
TLSH
T1D7F2AF7198219EA34DF6E6897507374B6EF0126380C52E899DDD5F0D48C77AC2B0F92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 786513bc79dd0568cb2e425b74bd30cc54194a5245220126445ae26a63684c10
MD5 bbdc5181257e593adcd8a50514e712e3
SHA1 0d19fc3dd6dee37bb07b7ba7382ee8d9ca57abae
SHA512 f8449cbf1fd763dc3925aad532049586d48d87f794b65f4793ce8d2b9b0219140f6d17230449970f01b05e34609f98f005176f27bbd2c4f024a52e07370dbb19
SSDEEP 768:vjaeqD4MlshiLdMme3uqfy4faifmtxA7NpespIRM0UmkTziwjgzSS8+09TA:vqcjhIdMN3vfTf9fLQsZ0UmYy8e
TLSH
T1EA13C071D8645DA78DB6E64A660337976FF001A3C1C53E89ADDA5E0D44932EC270F82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 685836d45f7d0e75299ed0758f6d8862f95febcf058a14e33f5c76415ce0fa07
MD5 2ee79ad982ceef6a3c570132ffb8a4a0
SHA1 69839fca4a0e833b599a18733e9b81fe1128b779
SHA512 eee87e044a79eca38384ac522c0082f776f87ff796bd5410316a764bc91cebda47b3535cd81c2f49afdb66340058b01d0d44401734d30b85c20a30179df67d25
SSDEEP 768:8j+9g3Mqfy4faifmtBA7NpespIRM0UmkTziwjgzSS8+0qvu:b9g3BfTf9f9QsZ0UmYy8uvu
TLSH
T1B3F2AF7194219EA34DF6E6897507374B6EF0126380C52E899DDD9F0D48C77AC2B0F92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 317a2f71f957388f4aa7a42d70151cec45c0ba3b9a46afde10bfa3ef026c42a4
MD5 21ba6ae7fd0105aa22cceb3c01252cf0
SHA1 4772e5a7f63d687ec06b76aad28f4d5506eea6fb
SHA512 2f6eb87dc1b210e4e76ed656f014593c973490d33ac4ef67cd67ef62de45cff5cfb945d2451386682fde8c8428c15ba01c304cfe166985bcfe880f76b756fecc
SSDEEP 768:3jaeqD4MlshiLdMmf37cfy4faeA7NpespIRM0UmkTziwjgzGJnApXLPQTU:3qcjhIdMo3AfTfiQsZ0UmYBnKXD
TLSH
T15403CF3698605EB78DB7E68A264376576FB00293C2C43BC8DCED6E0D41936DC530B96B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 45KB
SHA256 df8d08c1d8e306e2138a5bf2b02a5712b81f397a2e6f6e3ac394648e009f2b37
MD5 c0238f7ac8ca47513546befeebb838db
SHA1 0f841c7130253e96bc1a4613f6ba9861c02a701b
SHA512 aeca1083889e0d06913ad7ea6e163eca6dc899df2027929603816a27ffee83751b19027e85943f1a5501112840a24d145da7874bbba86bb6ceaf951cb0029d2c
SSDEEP 768:qF1j+903HwgTicfy4faifmtYA7NpespIRM0UmkTziwjgzSS8+0qvu:v9039fTf9fgQsZ0UmYy8uvu
TLSH
T180234AF184D38A77D9AE9787673D2E4699FCC163B0845984BBC85D0CCC821BFD70A916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b1270353-4b32-4dd4-8f81-a340bcbe0160.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\b1270353-4b32-4dd4-8f81-a340bcbe0160.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

MSI8056.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI8056.tmp
Size 285KB
SHA256 f74c97b1a53541b059d3bfafe41a79005ce5065f8210d7de9f1b600dc4e28aa0
MD5 b77a2a2768b9cc78a71bbffb9812b978
SHA1 b70e27eb446fe1c3bc8ea03dabbee2739a782e04
SHA512 a8b16bc60f8559c78c64ca9e85cd7fd704bba1f55b362465b7accef1bb853d1c9616995a35f972256c57fbe877ce880398ba1fbceaa658604883aa12dcbc4f57
SSDEEP 6144:cAOfnUdzb4m26KFHF/jliAYktxjw0gCvo5VGWg6AZzGbasKHr45I:cRUFb4H6KJF/pDYkw0gCvoKWg6AZznX4
TLSH
T18B547C117AD5D432E1BE0530397DABA52ABEF8316DF0C68F9384566D2D712C0A728F27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3532_224779259\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_4E5C120927FD079B13FC56.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Installer\{F3C036CF-D649-48C3-B70A-7BB426DFC65C}\_4E5C120927FD079B13FC56.exe
Size 4KB
SHA256 b2f77ffa78059698124564b634fda8f5dce8e182ee1d66f57fc789ad1d646233
MD5 ab7159fade5d3a7016f204316b0bba6c
SHA1 4e64c77a6f6bc916298bba3bfd12888b4b25e3c6
SHA512 ab0a9504ff7bed9766bab2713bf104d1d6d75859637c4e8038df14cdc1c6b0b17268a5bb52e100e42e3708785ccc39c06e2e53259310011c783af3df59067b60
SSDEEP 96:hlwNxW7O14ZutNfUNT8mLRqqYDjQdvbA/EGsqz:TwHua48SpLVyQNbTG
TLSH
T1F59107395FAFE0B4C4855DF98B4BB25BEA92EEDB1563831B311ED51B6970CD182020F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ZN Desktop Link.lnk

Path C:\Users\Admin\Desktop\ZN Desktop Link.lnk
Size 3KB
SHA256 80bb9c1e465fd050539ca197e28b9da1dd9fb35dc06b037e387538650b083202
MD5 8d17a64a0600aa1a864466ec60690293
SHA1 246c76d056dbebeb526106a30efd8aff83772ed8
SHA512 1b8e2e10c999472f5352c3491e3727825221092cfb250381b410f908796052e2ea5385c7bd81fe65e5d11aa4314211a477db98dc8df26999a691d5b6881eac44
TLSH
T16F51A1641EFD0221F2B1CBF16FE35636B577F82336055C25809246084272A90F9B7B3A
MD5 SHA1 SHA512 TLSH

Submit Download

e58f18f.msi

Path C:\Windows\Installer\e58f18f.msi
Size 2.9MB
SHA256 3ceb6546978c249ea684b461104da02586ba5d405e6a7a99b29c55a949951153
MD5 6ddad8354687c175d849c6bc9128f62f
SHA1 46ed10dca4b67ffffb3395c72ed418e39e07fac4
SHA512 1e762f59ee1cefc962e18114a61f81f30171a991ec7bc4fa82fe674abf0bbdedba4aca01285559d422b5213479ad01b7de97c81cac020af8313b1d6f174c34fb
SSDEEP 49152:ZheBYEt/5WWUN8LeQW92mK4NZP5Os2LFgfoEvOsXIDUmZyQMMQGI:XW0WUCe/2OHP54L+foLsXsUmZyQ
TLSH
T145E52212B6C68632C1AA0531713F93945F7DBD305EB18A1F63A4BA1D3DB02906366FB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 ddd27bd60199f6c91a3cac8657838b87da999fee709c9ad73215313d4dd21577
MD5 920540367335edbd32a14aad9ca4a5ac
SHA1 08f793bc80f776d1a4e1d038e57f450dde945f70
SHA512 68437644f98317f7f2725793c04a89c1d10c92ac87af311adb4d191819895c497017ab2424cc8ca93a9f152fb8e63231f99cd7335fbd3778e87e323b55268061
SSDEEP 24576:HFo3DMPJdoO/vvTL/iQrLyVwvbOxwLsoUmdJN2Vj9OFKZsaL84xG7CRa/ef:zHk
TLSH
T1F557942436F92100E7F79E3CA8F46A23493ABD5BAC15DE8D45411B4E0922F71E872F67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{2d4932db-0f15-4c7e-be30-665291a594da}_OnDiskSnapshotProp

Path \??\Volume{833668ed-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{2d4932db-0f15-4c7e-be30-665291a594da}_OnDiskSnapshotProp
Size 6KB
SHA256 61afc91b3f24e5efd28b3635b65efd93eaff789c2ea0e4c884c856e8f7c75d3f
MD5 cdfa073531744eb3a1c9d24e33af3e21
SHA1 4483190eeec8a0572b01a6142a6643c4a60e56e9
SHA512 f0c07895cc975e13c999e0fd4ef52478b94d70805166ae246a28f85b0bc8eb5c6937a1b0412130292b1bf13e59a203ce4104348a5cf09e2bc1b6c55ec3abcf63
SSDEEP 96:FCCuDrWvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:9uab++uVm
TLSH
T151D188085AE54311E2F3AB3169F14557A877B812FF33CB8E0198238E6631A10F975F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3244-31-0x0000012A99120000-0x0000012A99AC4000-memory.dmp

Download

memory/4768-258-0x0000000009DA0000-0x000000000A0FB000-memory.dmp

Download

memory/4768-248-0x0000000000420000-0x00000000004BA000-memory.dmp

Download

memory/4768-249-0x0000000005650000-0x0000000005C0A000-memory.dmp

Download

memory/4768-250-0x0000000005090000-0x0000000005122000-memory.dmp

Download

memory/4768-254-0x0000000005130000-0x00000000051E2000-memory.dmp

Download

memory/4768-255-0x00000000055A0000-0x00000000055AA000-memory.dmp

Download

memory/4768-263-0x000000000A730000-0x000000000A76E000-memory.dmp

Download

memory/4768-257-0x0000000009D70000-0x0000000009D92000-memory.dmp

Download