ae6fc5ba07dc314423a518f93b8ad69a5730df780669fd3b40283c32b24a56fc

Analysis

user interaction
yes
max time kernel
100s
max time network
105s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
25/08/2026, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Xeno-v1.3.60/Xeno.exe
Size 164KB
Sample260825-pg14xaha86
SHA256 ae6fc5ba07dc314423a518f93b8ad69a5730df780669fd3b40283c32b24a56fc
MD5 6156707c90644ea4edb71f3044d1c8d9
SHA1 237a4262696840719021a53e9322ca1fd0d6fb0d
SHA512 8fc14005a4ec1cc372e7be1d64c12899a9f304f6002ef1c87bf510697c3ee9fb8753a042e6d2ef5dde6805f349b96847f09a19ab0fa5385ea7e7ee915054d13d
SSDEEP 3072:520jWfVKLer59aSpfO9D/87jXEkeFZA4nsSyU3i4w:MIhSpfO9jC/44Uhw
TLSH
T189F34B07A6A840BEE1B7D679C9924941FB723C558B71A6CF03507AB60F777D0AE39302
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence ransomware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
91	3584	msedge.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000\Control Panel\International\Geo\Nation	windowsdesktop-runtime-9.0.19-win-x64.exe
Key value queried	\REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000\Control Panel\International\Geo\Nation	windowsdesktop-runtime-9.0.19-win-x64.exe

Executes dropped EXE 9 IoCs

pid	Process
6120	windowsdesktop-runtime-9.0.19-win-x64.exe
5880	windowsdesktop-runtime-9.0.19-win-x64.exe
1712	windowsdesktop-runtime-9.0.19-win-x64.exe
5836	windowsdesktop-runtime-9.0.19-win-x64.exe
4332	windowsdesktop-runtime-9.0.19-win-x64.exe
4896	windowsdesktop-runtime-9.0.19-win-x64.exe
1788	windowsdesktop-runtime-9.0.19-win-x64.exe
2044	windowsdesktop-runtime-9.0.19-win-x64.exe
5184	windowsdesktop-runtime-9.0.19-win-x64.exe

Loads dropped DLL 17 IoCs

pid	Process
5880	windowsdesktop-runtime-9.0.19-win-x64.exe
5836	windowsdesktop-runtime-9.0.19-win-x64.exe
460	MsiExec.exe
2044	windowsdesktop-runtime-9.0.19-win-x64.exe
460	MsiExec.exe
652	MsiExec.exe
652	MsiExec.exe
4504	MsiExec.exe
4504	MsiExec.exe
3164	MsiExec.exe
3164	MsiExec.exe
1240	MsiExec.exe
1240	MsiExec.exe
5596	MsiExec.exe
5596	MsiExec.exe
4284	MsiExec.exe
4284	MsiExec.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{7a013c32-dd46-48f5-81b1-2576c92468db} = "\"C:\\ProgramData\\Package Cache\\{7a013c32-dd46-48f5-81b1-2576c92468db}\\windowsdesktop-runtime-9.0.19-win-x64.exe\" /burn.runonce"	windowsdesktop-runtime-9.0.19-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{7a013c32-dd46-48f5-81b1-2576c92468db} = "\"C:\\ProgramData\\Package Cache\\{7a013c32-dd46-48f5-81b1-2576c92468db}\\windowsdesktop-runtime-9.0.19-win-x64.exe\" /burn.runonce"	windowsdesktop-runtime-9.0.19-win-x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.19\System.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.19\Microsoft.Win32.Registry.AccessControl.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.19\pl\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.19\ru\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.19\fr\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.19\fr\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.19\System.Diagnostics.TextWriterTraceListener.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.19\System.Runtime.Serialization.Primitives.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.19\fr\WindowsBase.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.19\de\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.19\Microsoft.NETCore.App.deps.json	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.19\zh-Hant\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.19\tr\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.19\pt-BR\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.19\es\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.19\zh-Hant\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.19\System.Security.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.19\it\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.19\System.Threading.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.19\zh-Hant\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.19\System.Reflection.TypeExtensions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.19\cs\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.19\zh-Hans\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.19\tr\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.19\cs\WindowsBase.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.19\WindowsBase.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.19\System.Private.Xml.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.19\System.Net.Mail.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.19\tr\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.19\System.Windows.Forms.Design.Editors.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.19\System.Security.Principal.Windows.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.19\System.Runtime.CompilerServices.Unsafe.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.19\System.Collections.Concurrent.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.19\it\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.19\msquic.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.19\System.Globalization.Extensions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.19\System.Xml.XDocument.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.19\tr\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.19\System.Text.Encoding.Extensions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.19\System.Reflection.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.19\PenImc_cor3.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.19\zh-Hans\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.19\System.IO.FileSystem.AccessControl.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.19\System.IO.FileSystem.DriveInfo.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.19\tr\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.19\ru\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.19\System.Net.Security.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.19\System.Diagnostics.DiagnosticSource.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.19\mscorlib.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.19\PresentationFramework.Luna.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.19\System.ObjectModel.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.19\System.Security.Cryptography.Algorithms.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\LICENSE.txt	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.19\ja\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.19\cs\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.19\Microsoft.VisualBasic.Forms.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.19\ko\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.19\System.Threading.Overlapped.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.19\System.ComponentModel.DataAnnotations.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.19\System.Runtime.Handles.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.19\tr\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.19\System.Xml.XmlSerializer.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.19\createdump.exe	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.19\System.CodeDom.dll	msiexec.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5492_1981859722\_locales\bg\messages.json	msedge.exe
File opened for modification	C:\Windows\Installer\MSI78D2.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5492_1981859722\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5492_1981859722\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5492_1981859722\_locales\as\messages.json	msedge.exe
File created	C:\Windows\Installer\SourceHash{B482E2FD-38BB-43F2-8E97-0B7CB485EF18}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI45B4.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5492_1981859722\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5492_1981859722\_locales\lv\messages.json	msedge.exe
File opened for modification	C:\Windows\Installer\MSI35B0.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5492_1981859722\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5492_1981859722\service_worker_bin_prod.js	msedge.exe
File opened for modification	C:\Windows\Installer\e590427.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149\fileCoreHostExe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7498.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5492_1981859722\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5492_1981859722\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5492_1981859722\_locales\en_CA\messages.json	msedge.exe
File opened for modification	C:\Windows\Installer\MSI41DB.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7CCB.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5492_1981859722\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5492_1981859722\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5492_1981859722\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\Installer\e590432.msi	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5492_1981859722\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5492_1981859722\_locales\ca\messages.json	msedge.exe
File opened for modification	C:\Windows\Installer\MSI34C5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5492_1981859722\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5492_1981859722\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5492_1981859722\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5492_1981859722\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5492_1981859722\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\Installer\SourceHash{13EF0513-4B2F-4375-B65B-2C89BFCFFB83}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2B3E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7610.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5492_1981859722\_locales\fa\messages.json	msedge.exe
File opened for modification	C:\Windows\Installer\MSI18CF.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3B03.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5492_1981859722\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5492_1981859722\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5492_1981859722\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5492_1981859722\_locales\be\messages.json	msedge.exe
File opened for modification	C:\Windows\Installer\MSI7D2A.tmp	msiexec.exe
File created	C:\Windows\Installer\e590422.msi	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5492_1981859722\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5492_1981859722\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5492_1981859722\_locales\ms\messages.json	msedge.exe
File opened for modification	C:\Windows\Installer\e59041d.msi	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5492_1981859722\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5492_1981859722\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5492_1981859722\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5492_1981859722\_locales\vi\messages.json	msedge.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149\fileCoreHostExe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7789.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5492_1981859722\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5492_1981859722\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5492_1981859722\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5492_1981859722\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5492_1981859722\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5492_1981859722\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5492_1981859722\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\Installer\e59042d.msi	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-9.0.19-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-9.0.19-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-9.0.19-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-9.0.19-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-9.0.19-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-9.0.19-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-9.0.19-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-9.0.19-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-9.0.19-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3584	msedge.exe
5268	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 17 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2C	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134321340411553026"	msedge.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2D	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2e	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2B	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2d	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DF2E284BBB832F34E879B0C74B58FE81\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{B482E2FD-38BB-43F2-8E97-0B7CB485EF18}v72.76.56792\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3150FE31F2B457346BB5C298FBFCBF38\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3150FE31F2B457346BB5C298FBFCBF38\SourceList\Media	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D512842CB6C6A404BAE605D564042E50\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\F71950C1A6A51F479A1ED20855BD5918	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DF2E284BBB832F34E879B0C74B58FE81\Version = "1212997080"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DF2E284BBB832F34E879B0C74B58FE81\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D512842CB6C6A404BAE605D564042E50\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D512842CB6C6A404BAE605D564042E50\SourceList\PackageName = "dotnet-host-9.0.19-win-x64.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_72.76.56792_x64\DisplayName = "Microsoft .NET Runtime - 9.0.19 (x64)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\F71950C1A6A51F479A1ED20855BD5918\D512842CB6C6A404BAE605D564042E50	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\windowsdesktop_runtime_72.76.56849_x64	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3150FE31F2B457346BB5C298FBFCBF38	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E5C0ADD8E0EECDA4DA4CA11836363A2D\Provider	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E5C0ADD8E0EECDA4DA4CA11836363A2D	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_72.76.56849_x64\Dependents\{7a013c32-dd46-48f5-81b1-2576c92468db}	windowsdesktop-runtime-9.0.19-win-x64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-101591186-421676486-4137282292-1000\{A20B51E4-C5B2-4100-922C-2EE27D25086A}	msedge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DF2E284BBB832F34E879B0C74B58FE81\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_72.76.56792_x64\Version = "72.76.56792"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D512842CB6C6A404BAE605D564042E50\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{7a013c32-dd46-48f5-81b1-2576c92468db}\DisplayName = "Microsoft Windows Desktop Runtime - 9.0.19 (x64)"	windowsdesktop-runtime-9.0.19-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_72.76.56849_x64\DisplayName = "Microsoft Windows Desktop Runtime - 9.0.19 (x64)"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\dotnet_runtime_72.76.56792_x64	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_72.76.56792_x64\Version = "72.76.56792"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3150FE31F2B457346BB5C298FBFCBF38\PackageCode = "652B868464BE6014585FA77FD788C4D8"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D512842CB6C6A404BAE605D564042E50\MainFeature	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D512842CB6C6A404BAE605D564042E50\Version = "1212997080"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{7a013c32-dd46-48f5-81b1-2576c92468db}\ = "{7a013c32-dd46-48f5-81b1-2576c92468db}"	windowsdesktop-runtime-9.0.19-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{7a013c32-dd46-48f5-81b1-2576c92468db}\Version = "9.0.19.36321"	windowsdesktop-runtime-9.0.19-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DF2E284BBB832F34E879B0C74B58FE81\PackageCode = "3A99BBF1BD19E224EA5D4A9A80592FBB"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_72.76.56792_x64\Dependents	windowsdesktop-runtime-9.0.19-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D512842CB6C6A404BAE605D564042E50\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{7a013c32-dd46-48f5-81b1-2576c92468db}	windowsdesktop-runtime-9.0.19-win-x64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\dotnet_runtime_72.76.56792_x64	windowsdesktop-runtime-9.0.19-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DF2E284BBB832F34E879B0C74B58FE81\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DF2E284BBB832F34E879B0C74B58FE81\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{B482E2FD-38BB-43F2-8E97-0B7CB485EF18}v72.76.56792\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3150FE31F2B457346BB5C298FBFCBF38\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3150FE31F2B457346BB5C298FBFCBF38\SourceList\PackageName = "dotnet-hostfxr-9.0.19-win-x64.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D512842CB6C6A404BAE605D564042E50	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D512842CB6C6A404BAE605D564042E50\ProductName = "Microsoft .NET Host - 9.0.19 (x64)"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DF2E284BBB832F34E879B0C74B58FE81\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3150FE31F2B457346BB5C298FBFCBF38\Provider	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3150FE31F2B457346BB5C298FBFCBF38\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_9.0_x64\ = "{C248215D-6C6B-404A-AB6E-505D4640E205}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D512842CB6C6A404BAE605D564042E50\Provider	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E5C0ADD8E0EECDA4DA4CA11836363A2D\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E5C0ADD8E0EECDA4DA4CA11836363A2D\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{8DDA0C5E-EE0E-4ADC-ADC4-1A816363A3D2}v72.76.56849\\"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3150FE31F2B457346BB5C298FBFCBF38\Clients = 3a0000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D512842CB6C6A404BAE605D564042E50\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E5C0ADD8E0EECDA4DA4CA11836363A2D\MainFeature	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E5C0ADD8E0EECDA4DA4CA11836363A2D\Version = "1212997137"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DF2E284BBB832F34E879B0C74B58FE81\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DF2E284BBB832F34E879B0C74B58FE81\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_72.76.56792_x64\Dependents\{7a013c32-dd46-48f5-81b1-2576c92468db}	windowsdesktop-runtime-9.0.19-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\1DFE801FFE05A51535EB09EA1301FFC3\E5C0ADD8E0EECDA4DA4CA11836363A2D	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\382D11B6C0A571C7388421ED311DB9E3\DF2E284BBB832F34E879B0C74B58FE81	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D512842CB6C6A404BAE605D564042E50\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{C248215D-6C6B-404A-AB6E-505D4640E205}v72.76.56792\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E5C0ADD8E0EECDA4DA4CA11836363A2D	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_72.76.56792_x64\Dependents\{7a013c32-dd46-48f5-81b1-2576c92468db}	windowsdesktop-runtime-9.0.19-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DF2E284BBB832F34E879B0C74B58FE81\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_72.76.56792_x64	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_72.76.56849_x64\Dependents\{7a013c32-dd46-48f5-81b1-2576c92468db}	windowsdesktop-runtime-9.0.19-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_72.76.56792_x64\Dependents\{7a013c32-dd46-48f5-81b1-2576c92468db}	windowsdesktop-runtime-9.0.19-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E5C0ADD8E0EECDA4DA4CA11836363A2D\SourceList\Media	msiexec.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4204	msiexec.exe
4204	msiexec.exe
4204	msiexec.exe
4204	msiexec.exe
4204	msiexec.exe
4204	msiexec.exe
4204	msiexec.exe
4204	msiexec.exe
4204	msiexec.exe
4204	msiexec.exe
4204	msiexec.exe
4204	msiexec.exe
4204	msiexec.exe
4204	msiexec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5492	msedge.exe
5492	msedge.exe
5492	msedge.exe
5492	msedge.exe
5492	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4332	windowsdesktop-runtime-9.0.19-win-x64.exe
Token: SeIncreaseQuotaPrivilege	4332	windowsdesktop-runtime-9.0.19-win-x64.exe
Token: SeSecurityPrivilege	4204	msiexec.exe
Token: SeCreateTokenPrivilege	4332	windowsdesktop-runtime-9.0.19-win-x64.exe
Token: SeAssignPrimaryTokenPrivilege	4332	windowsdesktop-runtime-9.0.19-win-x64.exe
Token: SeLockMemoryPrivilege	4332	windowsdesktop-runtime-9.0.19-win-x64.exe
Token: SeIncreaseQuotaPrivilege	4332	windowsdesktop-runtime-9.0.19-win-x64.exe
Token: SeMachineAccountPrivilege	4332	windowsdesktop-runtime-9.0.19-win-x64.exe
Token: SeTcbPrivilege	4332	windowsdesktop-runtime-9.0.19-win-x64.exe
Token: SeSecurityPrivilege	4332	windowsdesktop-runtime-9.0.19-win-x64.exe
Token: SeTakeOwnershipPrivilege	4332	windowsdesktop-runtime-9.0.19-win-x64.exe
Token: SeLoadDriverPrivilege	4332	windowsdesktop-runtime-9.0.19-win-x64.exe
Token: SeSystemProfilePrivilege	4332	windowsdesktop-runtime-9.0.19-win-x64.exe
Token: SeSystemtimePrivilege	4332	windowsdesktop-runtime-9.0.19-win-x64.exe
Token: SeProfSingleProcessPrivilege	4332	windowsdesktop-runtime-9.0.19-win-x64.exe
Token: SeIncBasePriorityPrivilege	4332	windowsdesktop-runtime-9.0.19-win-x64.exe
Token: SeCreatePagefilePrivilege	4332	windowsdesktop-runtime-9.0.19-win-x64.exe
Token: SeCreatePermanentPrivilege	4332	windowsdesktop-runtime-9.0.19-win-x64.exe
Token: SeBackupPrivilege	4332	windowsdesktop-runtime-9.0.19-win-x64.exe
Token: SeRestorePrivilege	4332	windowsdesktop-runtime-9.0.19-win-x64.exe
Token: SeShutdownPrivilege	4332	windowsdesktop-runtime-9.0.19-win-x64.exe
Token: SeDebugPrivilege	4332	windowsdesktop-runtime-9.0.19-win-x64.exe
Token: SeAuditPrivilege	4332	windowsdesktop-runtime-9.0.19-win-x64.exe
Token: SeSystemEnvironmentPrivilege	4332	windowsdesktop-runtime-9.0.19-win-x64.exe
Token: SeChangeNotifyPrivilege	4332	windowsdesktop-runtime-9.0.19-win-x64.exe
Token: SeRemoteShutdownPrivilege	4332	windowsdesktop-runtime-9.0.19-win-x64.exe
Token: SeUndockPrivilege	4332	windowsdesktop-runtime-9.0.19-win-x64.exe
Token: SeSyncAgentPrivilege	4332	windowsdesktop-runtime-9.0.19-win-x64.exe
Token: SeEnableDelegationPrivilege	4332	windowsdesktop-runtime-9.0.19-win-x64.exe
Token: SeManageVolumePrivilege	4332	windowsdesktop-runtime-9.0.19-win-x64.exe
Token: SeImpersonatePrivilege	4332	windowsdesktop-runtime-9.0.19-win-x64.exe
Token: SeCreateGlobalPrivilege	4332	windowsdesktop-runtime-9.0.19-win-x64.exe
Token: SeRestorePrivilege	4204	msiexec.exe
Token: SeTakeOwnershipPrivilege	4204	msiexec.exe
Token: SeRestorePrivilege	4204	msiexec.exe
Token: SeTakeOwnershipPrivilege	4204	msiexec.exe
Token: SeRestorePrivilege	4204	msiexec.exe
Token: SeTakeOwnershipPrivilege	4204	msiexec.exe
Token: SeRestorePrivilege	4204	msiexec.exe
Token: SeTakeOwnershipPrivilege	4204	msiexec.exe
Token: SeRestorePrivilege	4204	msiexec.exe
Token: SeTakeOwnershipPrivilege	4204	msiexec.exe
Token: SeRestorePrivilege	4204	msiexec.exe
Token: SeTakeOwnershipPrivilege	4204	msiexec.exe
Token: SeRestorePrivilege	4204	msiexec.exe
Token: SeTakeOwnershipPrivilege	4204	msiexec.exe
Token: SeRestorePrivilege	4204	msiexec.exe
Token: SeTakeOwnershipPrivilege	4204	msiexec.exe
Token: SeRestorePrivilege	4204	msiexec.exe
Token: SeTakeOwnershipPrivilege	4204	msiexec.exe
Token: SeRestorePrivilege	4204	msiexec.exe
Token: SeTakeOwnershipPrivilege	4204	msiexec.exe
Token: SeRestorePrivilege	4204	msiexec.exe
Token: SeTakeOwnershipPrivilege	4204	msiexec.exe
Token: SeRestorePrivilege	4204	msiexec.exe
Token: SeTakeOwnershipPrivilege	4204	msiexec.exe
Token: SeRestorePrivilege	4204	msiexec.exe
Token: SeTakeOwnershipPrivilege	4204	msiexec.exe
Token: SeRestorePrivilege	4204	msiexec.exe
Token: SeTakeOwnershipPrivilege	4204	msiexec.exe
Token: SeRestorePrivilege	4204	msiexec.exe
Token: SeTakeOwnershipPrivilege	4204	msiexec.exe
Token: SeRestorePrivilege	4204	msiexec.exe
Token: SeTakeOwnershipPrivilege	4204	msiexec.exe

Suspicious use of FindShellTrayWindow 17 IoCs

pid	Process
5492	msedge.exe
5492	msedge.exe
5492	msedge.exe
5492	msedge.exe
5492	msedge.exe
5492	msedge.exe
5492	msedge.exe
5492	msedge.exe
5492	msedge.exe
5492	msedge.exe
5492	msedge.exe
5492	msedge.exe
5492	msedge.exe
5492	msedge.exe
5836	windowsdesktop-runtime-9.0.19-win-x64.exe
2044	windowsdesktop-runtime-9.0.19-win-x64.exe
5492	msedge.exe

Suspicious use of WriteProcessMemory 61 IoCs

description	pid	Process	procid_target
PID 1208 wrote to memory of 5492	1208	Xeno.exe	82
PID 5492 wrote to memory of 1884	5492	msedge.exe	83
PID 5492 wrote to memory of 3584	5492	msedge.exe	85
PID 5492 wrote to memory of 4200	5492	msedge.exe	86
PID 5492 wrote to memory of 5288	5492	msedge.exe	87
PID 5492 wrote to memory of 4200	5492	msedge.exe	86
PID 5492 wrote to memory of 4200	5492	msedge.exe	86
PID 5492 wrote to memory of 5288	5492	msedge.exe	87
PID 5492 wrote to memory of 4116	5492	msedge.exe	88
PID 5492 wrote to memory of 4116	5492	msedge.exe	88
PID 5492 wrote to memory of 5840	5492	msedge.exe	89
PID 5492 wrote to memory of 4116	5492	msedge.exe	88
PID 5492 wrote to memory of 5840	5492	msedge.exe	89
PID 5492 wrote to memory of 5840	5492	msedge.exe	89
PID 5492 wrote to memory of 3368	5492	msedge.exe	93
PID 5492 wrote to memory of 3368	5492	msedge.exe	93
PID 5492 wrote to memory of 2236	5492	msedge.exe	94
PID 5492 wrote to memory of 2236	5492	msedge.exe	94
PID 5492 wrote to memory of 1520	5492	msedge.exe	96
PID 5492 wrote to memory of 856	5492	msedge.exe	99
PID 5492 wrote to memory of 856	5492	msedge.exe	99
PID 5492 wrote to memory of 856	5492	msedge.exe	99
PID 5492 wrote to memory of 4028	5492	msedge.exe	101
PID 5492 wrote to memory of 4028	5492	msedge.exe	101
PID 5492 wrote to memory of 2728	5492	msedge.exe	102
PID 5492 wrote to memory of 2728	5492	msedge.exe	102
PID 5492 wrote to memory of 2728	5492	msedge.exe	102
PID 5492 wrote to memory of 5344	5492	msedge.exe	103
PID 5492 wrote to memory of 6032	5492	msedge.exe	110
PID 5492 wrote to memory of 2516	5492	msedge.exe	111
PID 5492 wrote to memory of 4344	5492	msedge.exe	112
PID 5492 wrote to memory of 5532	5492	msedge.exe	113
PID 5492 wrote to memory of 5532	5492	msedge.exe	113
PID 5492 wrote to memory of 5200	5492	msedge.exe	114
PID 5492 wrote to memory of 5200	5492	msedge.exe	114
PID 5492 wrote to memory of 4536	5492	msedge.exe	116
PID 5492 wrote to memory of 4536	5492	msedge.exe	116
PID 5492 wrote to memory of 6120	5492	msedge.exe	117
PID 6120 wrote to memory of 5880	6120	windowsdesktop-runtime-9.0.19-win-x64.exe	119
PID 5492 wrote to memory of 1712	5492	msedge.exe	120
PID 1712 wrote to memory of 5836	1712	windowsdesktop-runtime-9.0.19-win-x64.exe	121
PID 5836 wrote to memory of 4332	5836	windowsdesktop-runtime-9.0.19-win-x64.exe	122
PID 4896 wrote to memory of 1788	4896	windowsdesktop-runtime-9.0.19-win-x64.exe	126
PID 1788 wrote to memory of 2044	1788	windowsdesktop-runtime-9.0.19-win-x64.exe	127
PID 4204 wrote to memory of 460	4204	msiexec.exe	128
PID 5492 wrote to memory of 4968	5492	msedge.exe	129
PID 5492 wrote to memory of 4968	5492	msedge.exe	129
PID 4204 wrote to memory of 652	4204	msiexec.exe	131
PID 4204 wrote to memory of 4504	4204	msiexec.exe	132
PID 2044 wrote to memory of 5184	2044	windowsdesktop-runtime-9.0.19-win-x64.exe	133
PID 4204 wrote to memory of 3164	4204	msiexec.exe	134
PID 5492 wrote to memory of 5604	5492	msedge.exe	135
PID 5492 wrote to memory of 5604	5492	msedge.exe	135
PID 4204 wrote to memory of 1240	4204	msiexec.exe	136
PID 5492 wrote to memory of 1512	5492	msedge.exe	137
PID 5492 wrote to memory of 1512	5492	msedge.exe	137
PID 4204 wrote to memory of 5596	4204	msiexec.exe	138
PID 4204 wrote to memory of 4284	4204	msiexec.exe	139
PID 5492 wrote to memory of 4780	5492	msedge.exe	142
PID 4780 wrote to memory of 3140	4780	msedge.exe	143
PID 4780 wrote to memory of 5268	4780	msedge.exe	144

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.60\Xeno.exe
"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.60\Xeno.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.NETCore.App&framework_version=9.0.0&arch=x64&rid=win-x64&os=win10&gui=true
  2⤵
  - Drops file in Windows directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x374,0x7ff9331fc188,0x7ff9331fc194,0x7ff9331fc1a0
    3⤵
    PID:1884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1932,i,12556215882597402654,1833595594600768740,524288 --field-trial-handle=2296,i,13742661151004089913,8137172436379038664,262144 --variations-seed-version --mojo-platform-channel-handle=2968 /prefetch:3
    3⤵
    - Downloads MZ/PE file
    - System Time Discovery
    PID:3584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1836,i,6369566549097627614,14893390171448705201,262144 --field-trial-handle=2296,i,13742661151004089913,8137172436379038664,262144 --variations-seed-version --mojo-platform-channel-handle=2196 /prefetch:2
    3⤵
    PID:4200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2448,i,14252776329689807187,16093641916150789305,524288 --field-trial-handle=2296,i,13742661151004089913,8137172436379038664,262144 --variations-seed-version --mojo-platform-channel-handle=3000 /prefetch:8
    3⤵
    PID:5288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,8172451133714427975,15934411829074199847,2097152 --field-trial-handle=2296,i,13742661151004089913,8137172436379038664,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
    3⤵
    PID:4116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3424,i,18383217028648115095,2283066336049073311,2097152 --field-trial-handle=2296,i,13742661151004089913,8137172436379038664,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
    3⤵
    PID:5840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4264,i,16746456716845628194,10038686564549222145,524288 --field-trial-handle=2296,i,13742661151004089913,8137172436379038664,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:8
    3⤵
    PID:3368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4812,i,18032753757291415854,2443197509450995907,524288 --field-trial-handle=2296,i,13742661151004089913,8137172436379038664,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:8
    3⤵
    PID:2236
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5640,i,12099747386807939332,11435626748644087164,524288 --field-trial-handle=2296,i,13742661151004089913,8137172436379038664,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:8
    3⤵
    PID:5224
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5640,i,12099747386807939332,11435626748644087164,524288 --field-trial-handle=2296,i,13742661151004089913,8137172436379038664,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:8
    3⤵
    PID:1520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=6032,i,6372334670244486163,238581887888316507,2097152 --field-trial-handle=2296,i,13742661151004089913,8137172436379038664,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:1
    3⤵
    PID:856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6164,i,3186113694492750516,17233087410067172445,524288 --field-trial-handle=2296,i,13742661151004089913,8137172436379038664,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:8
    3⤵
    PID:4028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6248,i,7004522474161492624,12645566464529011757,2097152 --field-trial-handle=2296,i,13742661151004089913,8137172436379038664,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:1
    3⤵
    PID:2728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6840,i,16628578868984553333,16061145341202898304,524288 --field-trial-handle=2296,i,13742661151004089913,8137172436379038664,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:8
    3⤵
    PID:5344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5724,i,5038275591731503820,264936175502866466,524288 --field-trial-handle=2296,i,13742661151004089913,8137172436379038664,262144 --variations-seed-version --mojo-platform-channel-handle=6840 /prefetch:8
    3⤵
    PID:6032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5652,i,7455058852092310314,3325764076540146664,524288 --field-trial-handle=2296,i,13742661151004089913,8137172436379038664,262144 --variations-seed-version --mojo-platform-channel-handle=6852 /prefetch:8
    3⤵
    PID:2516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,318364336126545506,2506965041660418611,524288 --field-trial-handle=2296,i,13742661151004089913,8137172436379038664,262144 --variations-seed-version --mojo-platform-channel-handle=6772 /prefetch:8
    3⤵
    PID:4344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6732,i,10334782030377239270,1310833982130728195,524288 --field-trial-handle=2296,i,13742661151004089913,8137172436379038664,262144 --variations-seed-version --mojo-platform-channel-handle=6764 /prefetch:8
    3⤵
    PID:5532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6820,i,2685846706406499234,1045913108405816497,524288 --field-trial-handle=2296,i,13742661151004089913,8137172436379038664,262144 --variations-seed-version --mojo-platform-channel-handle=6732 /prefetch:8
    3⤵
    PID:5200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2772,i,9334510309591414680,6711560355279123877,524288 --field-trial-handle=2296,i,13742661151004089913,8137172436379038664,262144 --variations-seed-version --mojo-platform-channel-handle=2764 /prefetch:8
    3⤵
    PID:4536
- - C:\Users\Admin\Downloads\windowsdesktop-runtime-9.0.19-win-x64.exe
    "C:\Users\Admin\Downloads\windowsdesktop-runtime-9.0.19-win-x64.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6120
  - - C:\Windows\Temp\{054430A4-A1BC-415C-8518-5F49A662DB8D}\.cr\windowsdesktop-runtime-9.0.19-win-x64.exe
      "C:\Windows\Temp\{054430A4-A1BC-415C-8518-5F49A662DB8D}\.cr\windowsdesktop-runtime-9.0.19-win-x64.exe" -burn.clean.room="C:\Users\Admin\Downloads\windowsdesktop-runtime-9.0.19-win-x64.exe" -burn.filehandle.attached=572 -burn.filehandle.self=680
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:5880
- - C:\Users\Admin\Downloads\windowsdesktop-runtime-9.0.19-win-x64.exe
    "C:\Users\Admin\Downloads\windowsdesktop-runtime-9.0.19-win-x64.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1712
  - - C:\Windows\Temp\{C3B0B8D4-0487-4243-9960-CF18A39C19D9}\.cr\windowsdesktop-runtime-9.0.19-win-x64.exe
      "C:\Windows\Temp\{C3B0B8D4-0487-4243-9960-CF18A39C19D9}\.cr\windowsdesktop-runtime-9.0.19-win-x64.exe" -burn.clean.room="C:\Users\Admin\Downloads\windowsdesktop-runtime-9.0.19-win-x64.exe" -burn.filehandle.attached=660 -burn.filehandle.self=688
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:5836
    - - C:\Windows\Temp\{1B860867-ED97-4871-B221-1639D93BDC85}\.be\windowsdesktop-runtime-9.0.19-win-x64.exe
        
        "C:\Windows\Temp\{1B860867-ED97-4871-B221-1639D93BDC85}\.be\windowsdesktop-runtime-9.0.19-win-x64.exe" -q -burn.elevated BurnPipe.{B281E3CF-9E70-4374-8761-6ABAABC45247} {BBE1892C-35EB-4B22-AE8F-1E06802E6789} 5836
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5180,i,9126867915115197091,5272201340665970345,524288 --field-trial-handle=2296,i,13742661151004089913,8137172436379038664,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:8
    3⤵
    PID:4968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5772,i,6933251877678888419,6348094879936279121,524288 --field-trial-handle=2296,i,13742661151004089913,8137172436379038664,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:8
    3⤵
    PID:5604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5272,i,14120116030548500134,3979576630735358441,524288 --field-trial-handle=2296,i,13742661151004089913,8137172436379038664,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:8
    3⤵
    PID:1512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Enumerates system info in registry
    - Suspicious use of WriteProcessMemory
    PID:4780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x308,0x7ff9331fc188,0x7ff9331fc194,0x7ff9331fc1a0
      4⤵
      PID:3140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1852,i,1586034767714874243,9591890935738606265,524288 --field-trial-handle=2504,i,9079205287926731785,4448775842610669109,262144 --variations-seed-version --mojo-platform-channel-handle=2644 /prefetch:3
      4⤵
      System Time Discovery
      PID:5268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1672,i,4091829983195820583,3204746117034341087,262144 --field-trial-handle=2504,i,9079205287926731785,4448775842610669109,262144 --variations-seed-version --mojo-platform-channel-handle=2500 /prefetch:2
      4⤵
      PID:5152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1992,i,15640719754571434324,495551447526118640,524288 --field-trial-handle=2504,i,9079205287926731785,4448775842610669109,262144 --variations-seed-version --mojo-platform-channel-handle=2668 /prefetch:8
      4⤵
      PID:3316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4392,i,4457061628207929278,1162908303440243951,524288 --field-trial-handle=2504,i,9079205287926731785,4448775842610669109,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:8
      4⤵
      PID:4160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4392,i,4457061628207929278,1162908303440243951,524288 --field-trial-handle=2504,i,9079205287926731785,4448775842610669109,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:8
      4⤵
      PID:1536

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3344

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5160

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4204
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding FB8BFA6F8A3774A532A8B7916CB9F779
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:460
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 989FD9AAB5F56D86F0EE8B141193C590
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:652
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 1ECFC67DEADB3D6EBAB23D2300F70603
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4504
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 8EBCDAB41DDA48EBDD2D1A25E5C6F299
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3164
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 10B0AD17EB955B20C2BAC1E8A922A4BA
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1240
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding FEB579BB659F098407DD68DA4907DD84
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5596
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 94B9CCED61B32FAB6AD210034B727442
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4284

C:\ProgramData\Package Cache\{7a013c32-dd46-48f5-81b1-2576c92468db}\windowsdesktop-runtime-9.0.19-win-x64.exe
"C:\ProgramData\Package Cache\{7a013c32-dd46-48f5-81b1-2576c92468db}\windowsdesktop-runtime-9.0.19-win-x64.exe" /burn.runonce
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4896
- C:\ProgramData\Package Cache\{7a013c32-dd46-48f5-81b1-2576c92468db}\windowsdesktop-runtime-9.0.19-win-x64.exe
  "C:\ProgramData\Package Cache\{7a013c32-dd46-48f5-81b1-2576c92468db}\windowsdesktop-runtime-9.0.19-win-x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_9.0.19_(x64)_20260825132122.log"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1788
- - C:\ProgramData\Package Cache\{7a013c32-dd46-48f5-81b1-2576c92468db}\windowsdesktop-runtime-9.0.19-win-x64.exe
    "C:\ProgramData\Package Cache\{7a013c32-dd46-48f5-81b1-2576c92468db}\windowsdesktop-runtime-9.0.19-win-x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{7a013c32-dd46-48f5-81b1-2576c92468db}\windowsdesktop-runtime-9.0.19-win-x64.exe" -burn.filehandle.attached=528 -burn.filehandle.self=544 /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_9.0.19_(x64)_20260825132122.log"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2044
  - - C:\ProgramData\Package Cache\{7a013c32-dd46-48f5-81b1-2576c92468db}\windowsdesktop-runtime-9.0.19-win-x64.exe
      "C:\ProgramData\Package Cache\{7a013c32-dd46-48f5-81b1-2576c92468db}\windowsdesktop-runtime-9.0.19-win-x64.exe" -q -burn.elevated BurnPipe.{1E8D5305-1A0B-480A-B5A4-C3E13870B4F2} {33EBA1D7-0715-404A-BF59-F9E5FFA2C3CD} 2044
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:5184

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5512

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e590420.rbs

Path C:\Config.Msi\e590420.rbs
Size 48KB
SHA256 4ac4160f8273548b2fbfca026af076c9821b615fa2b0182daf7cf0b9b4d9848e
MD5 80ef1e37eae6483f49e2bd7fb728ebeb
SHA1 f615e23e240221a5c303f882e6ecd1c751d2ee63
SHA512 99f2bf3325e3ca224d7363e3d6dcfa54bcd73988b4c406c839af33c2c6c891dfb44987fbaf20431a1dca58fcb3f386c0e50953f58c2684386081338c8147b282
SSDEEP 1536:qfw7X9a/uKqjSnQ36UoEW8o2kqkWB7Wue3JJzqADk7x/PxoCtPVAULwXLDJw2WdW:vkqiT
TLSH
T188233294EB00C3F3E6332E987F21EE0937194E9B5B41448E57C5510BD9D6EF8EAA82C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e590425.rbs

Path C:\Config.Msi\e590425.rbs
Size 9KB
SHA256 5df446d00a476113fe4b25b6d2199c8e3a7261fa2d4f944307207ed5a944433f
MD5 42c8293fe5c9aa72a3d1cae211fafbc9
SHA1 abbfdd4eca7ebde37e7de1901a811abceaf682f3
SHA512 e69d113cf882301a11b57d155cf4c355141ceddc8fe2b5c060631762501d4b568355cdbbb97d68eabac4616f9afe33c119b8d3cf333a2d8fb1b98f54ed689290
SSDEEP 192:ldnPjn8ntznPDwnnezKrn1nsn/iZCI8n5rn1nsn/iZCov8niEcxn6IpFkncnK:ldPj8tzM7r1s/iZu5r1s/iZgs2cK
TLSH
T103126056B60499E2DCB60F74CB0B1B2437B6E3C98354875B448ED5680F437C8DEAE39A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59042a.rbs

Path C:\Config.Msi\e59042a.rbs
Size 10KB
SHA256 3888d03c69ba419afe3cb147991ca712270277d30b057290fba79afc4abf8cf2
MD5 59f4dc3364e0499d2c8dd090210346b1
SHA1 e2bb78af15f4cf1fdb5ccd35a7e9b0d6423ad681
SHA512 12518e2881a769d9f08ca59cc09d01e8b0d0da020c8d0e407040e1bd4ba4fe22f85b749991a913a962633c4659ad041aad8982f3762aed7aa57b609fd6f0b39e
SSDEEP 192:lOpreKo5H5GX/efK76iZCI176iZCHpE9QmzIp+:lOpreKo5HAj76iZT76iZZz
TLSH
T10F220E02AB40D2E3E8672776CB032B213762C3D99300579B55CCE9648F1AB8D7F6978D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e590431.rbs

Path C:\Config.Msi\e590431.rbs
Size 88KB
SHA256 a811ffc23e641c5a927f0c09be689af1f88b5f23a52cb96a2454983ffb649d36
MD5 01d7e571853c0fedfb4d571808fc9385
SHA1 c8b478b8e4d87f3bcb9cca6287612d3cd122d0b0
SHA512 0402b6ce3e22974124284db40092980f56874e69722531612b447deb022a878a89f9160e5d93430139c645f80d9c9c75c13b0a896a7e04961c077e668557252d
SSDEEP 1536:fMb2rekZzNoT5MV4JrH66HteA3Y4MxPXlgUm/Qg2bLqQCyI3VVTGnq17AWW1Jany:fQb0v2AttOKmWjKK3f72y2mfkiIaynV8
TLSH
T15B938E9DAB01C3D5A8373B449B3FEF086E0A8CAB57489A1F17C44526D8E1F876B794C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e590435.rbs

Path C:\Config.Msi\e590435.rbs
Size 3KB
SHA256 59233549b4a92936f7c7a76c167dc0ac004523766dc64c49bd9d4b803b6721fc
MD5 1807c94dde4c655fa3935056c8c78376
SHA1 c8780c9bb38b233f80ea51a0bea594b4c217f26a
SHA512 026c9a768399600a9f715db80b244b9ba38fab9c69cba768fe545b469fac22067d565326a91eb0f19d4f083b006c6b116210823333568ab1e237e5ac564ac20a
TLSH
T14B816B02EA04E993DCB22F71CD1B0B243377E7DA97248347448C95740E47BD5EEEA68A
MD5 SHA1 SHA512 TLSH

Submit Download

e590438.rbs

Path C:\Config.Msi\e590438.rbs
Size 3KB
SHA256 1febbd67349e9b0e5de88c930b55793ca0b221cb0e341912c932a08d1f9906ed
MD5 021524a605e2d0ce0a06f28e1229763f
SHA1 e7b5bf21559fe7a96001f85d6c6a36bf8a40d120
SHA512 2e862196ea42c6f533e9791171442faa7f5ccda7dc1d9003329b22e958a37ead0c004497750181629304d2edff8532f82ed5e6e9a9ffc5db556aa142cc30e264
TLSH
T1D27158039A44E293EC632B71CE171B1133B7D3DAD7258387508CA5B44E4BBC9AFE9649
MD5 SHA1 SHA512 TLSH

Submit Download

e59043b.rbs

Path C:\Config.Msi\e59043b.rbs
Size 3KB
SHA256 26011d7b1320bd42820574d6f45354253ff41b4e52c18a84a7d33839de3e06a2
MD5 77462ecc43245dea7443df76cb4147a7
SHA1 58fad71d86d21c5da1978f25fcb091b1bb2b267a
SHA512 ebffdd6717ded500797d8513650b6213408a85cf92ed86de2f1d210223f4f537f28f2cd930e7474fae79e4c68e58aaf3983fb217e05530006635de2d0a157018
TLSH
T123816B439A04D6D2ECA71B30CD2B0B16337BC6DB9715838B04CC91715E87BD6AFEA54A
MD5 SHA1 SHA512 TLSH

Submit Download

ThirdPartyNotices.txt

Path C:\Program Files\dotnet\ThirdPartyNotices.txt
Size 77KB
SHA256 e8ddd95ac905467e4e519b446ca023fa00c31732bebd9b66e65101c712092ee7
MD5 406d07d20e58568365df0557629fadc6
SHA1 9ab5ba1ef3866afa75b8cf3c392b7dd3d7f52026
SHA512 c6025a947faa5dc2b41a14d75e228ca2bd0df094e8cef914c58a6d2f5854424972a647b2c8ca8173345e40ba7557843d03efa85c5098c6e0e6726377efc8a38f
SSDEEP 1536:HA9jHwsGfgg39/zwgAVkguQxrDjugtSEGepkWvrpX7anuqdLSVnfiStPq+3Lefrb:HA97w/ogz1AVxuMjHtSFULryLOgrGWwa
TLSH
T1F573A45F7E45077319E2C3916569A8C5F22FA02E3B6B2A44346EF248133B42DD6FF858
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

state.rsm

Path C:\ProgramData\Package Cache\{7a013c32-dd46-48f5-81b1-2576c92468db}\state.rsm
Size 932B
SHA256 988473f95bdfd249e3a0e2a3bea2f9c224e743e1882217ab9db7dad62f1a674b
MD5 6dc7e45b2c2839f6ca1bd090cbb69678
SHA1 0ece8faa4879e86809edfc88a462e6288e4733b5
SHA512 b806f7c44caea54b81e9232b258e79b21054bfc5c0cddbc45be3e16ada841e55d3e050a84886e9b7b721fd6c6fe57ebc81d859ac3dfd13b8d10ccee5fc07c725
TLSH
T140119A515FFA0129E3FA6B3069F52721643ABC160D32C16C0001318A8E32BA0C8B0F77
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 604f2b08c352d2054515105fa8752c7c4641fa2a3dec9504a19689d22139f892
MD5 5d42d0843e9db69a0f52fc9e765991a1
SHA1 b03ac141b107b9f8a15dca26fdfc9eac3dccd045
SHA512 7686192d80e74fb6e26b538662bf60f088cde7af69836166bbba7f6406dd95ad4200c323a192dca47e2af839c5fd6390dbc43fa70b32370e887449a378c6c8a5
TLSH
T199D0232459ADF9F0E13E103D4210031133CC05927B232217F010400ECC3418383C44C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 bf194dd4d5a8f2937d5cecf04b5fbd5f1eff282fe941b70190b14d81d8b3a9cf
MD5 b7f55f74fd4fbbba2e91b702ca4bf03e
SHA1 f9f0e8a6e6630efe7ba2f3c8004869bf51d62a20
SHA512 2c9d449bbfbefa6cf3606950b063e424983646446500e8b4532bfe09ec489fd165ee2c9dca0635106db0ab4bf5439c1d78749ebc3af3b52e2856462c7f041b9c
TLSH
T14ED0A769565EFC10D11B103A85105662379E55A175225127E054414A883B682A2D5086
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 35cc5409a0e92c7b1f173401d1114c9d5fdc977752a8e45ce9068d8101c9a651
MD5 4177a98ec95c7b8511089a1be66e9e7b
SHA1 523d632928047252508b7d45169327ef4523179e
SHA512 d9e67625f1cfcaf9b90149a3ed0ce8899f43e93e14c729f7cf114adedf8a6a345c93240cebfa58351038924578a437d9d7144c7dcd826b1b8892dc523920e947
TLSH
T17AD08077670FF411E36D5131D503C75117AE547179625723F118C40D99741D693C51C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9e9b606cfbfc7b0fcbfab1ff9a90d94ddcf0c4033903cc47f13cbcd8bcac95cc
MD5 66bd1dbef8b4df50e7a09a2d2848fb79
SHA1 69983a576369225e69f3c4e38eef011e7e436249
SHA512 7f8546014287d3ced2b59766b273c8d8981aee3ef643630332615e594a89f92a95f1ce112c2fa889b0e249a10643792bfc57043bfc523d6ada97b8bc7d6e7d6c
TLSH
T17CD080776B0BF411E35D5131D503C75127BE507179625723F158C41D99B41D697C51C2
MD5 SHA1 SHA512 TLSH

Submit Download

6950e17d-828b-4ebb-957b-afb72f42ad4c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6950e17d-828b-4ebb-957b-afb72f42ad4c.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 6c2075993b83af611d1f87f92bbde6bfb341ef5e96044c3f4e4b444f4331e4ba
MD5 02ed001daff5ae24a66f0fb43478f0db
SHA1 b46dd28b1831ac5cd828c87be5382b4170f47654
SHA512 c4dc817ce33c4cfae9f18b51b59f6662d54701320b7944c297f404365268d97e73506a50c36a71cd571d1e360d1a681e3623ee3649332eae0cde3e095c181a9b
TLSH
T19DE0209F57B6C2641D81994FA07DB3340F627F85938CDCDD7A04A484A4D425457624B4
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 268B
SHA256 ae99fdfc3fbac7deff206af98556f3993f1c3f40fe1176939f3effc93833bc8d
MD5 9683ee0effa2bfca240118d3a9a92e68
SHA1 7f5846f3cd2adc8fd0788f67733e1a66a9a4502d
SHA512 063dd8a1a4838b395fcd50939ca3e5b24ac72a8407ffd4463838b0b2ee5bb8d41938609e4216ead91f6f1a45a694113987c815ba88fb7d83f6eb6cc2fa33d737
TLSH
T194D02B9AFDEC9E5ED7E41ABD5BA5B4000A4802A2840B9B1300747EC03495AF01E25030
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 2358e6b65d6482397e94563ef7c32f3f34c92896642a87daba3a5ec5ce0bc320
MD5 b2ddf3701e673967954e3f705363f907
SHA1 14462c4914792b15b207c73abff4bd88a646f686
SHA512 ed78b97ff7e71a090a83307e17ad7a8a6f1c719da6ab0cad64958cabfc4141c0685ab350f007b5edbc80c0088ed572d0abc6488ca68f4bdf1e08d083ccf2229d
TLSH
T153E0E5AEC921AC2708FC176C69154A87D60013172A418A1B3B3D911D8FB173B1586C5C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 58a5d5151aa9fbf2b58b3aa0735ced1b71e4ae9742597b8fe1e543c00dca76a2
MD5 be0c718bd35ad0ed79758ce08d935b78
SHA1 255f326c54d2d515d93b86e74392aae98f2e3fbb
SHA512 93b179aab71a750170267e7573cd279e3373cf80512b602595f830cddc3c2603293e5bc30e6da77f87f50bdafb24f0f988ab2190c02b34626458a111458a4834
TLSH
T199812B18CED134F0EB3EC276A8E21694F67982B50E573E57B1186B323D15F604978C08
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58d81b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58d81b.TMP
Size 3KB
SHA256 9ff9e6e03b06347d7caf627734cc3c3bc47227441ed48fa8940a6c28b1e9849c
MD5 290c2e370f76e26e9c959a4dbeed508a
SHA1 64ac48e59c622cd11ab6048fad658ce7c71ddcd2
SHA512 5b0a6bf9724db99cc58fe95fa1ae33aea3a6aa73620bc5ba0e45174bb24d2168010d06bd11578c7facaf5871b931d2c342717239191a918e9667d0439f063021
TLSH
T1AC71F818CEC238F1E73EC27299E20294F67986754E573E9770146B333D15F218978C58
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 7ef1ca648f11ca6aaaa12b53276db8d8dd79ddc8bd709f7a15cbfb31aaa40f5f
MD5 56ebc97f94193cbb3df1e2464eda96bd
SHA1 8621d8a861013dc82c8e534577eafdae9ffc3b68
SHA512 9ca3cd451b256f8ea77f934704b6559dedd4bdbe03d802be690fc4e04e70255da1b037c6350a0661c47c133c2718ed1ec3d12831db177e47f959219d7d4923e3
SSDEEP 3:MsEllllkEthXllkl2zE/l2Kl/:/M/xT02zPKt
TLSH
T1DF440204AB80440AC514117040A193516370D82016166753249108325DC56400C50000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 b6520d96dc5bab60e517d3ed751827a5c498cf8dcf2c970fe4ddd453b4930e55
MD5 5c5bfacf27e6f90c277e22e2d7e14127
SHA1 45bd96a5cef333e211f672b946e74cfff1e7bad9
SHA512 fd168d92741f1249bfc86a92356dbf05b3151ee2b953e83f2455e9a0a6001a72535a036c033f2d201e74a076a03c63f9b5de288d29c4cdaa8f4baaafcd89b9d0
TLSH
T1E8618CF747B4856EDA1196F0DA18EE2FDF2D0215431C7CA989E0AE27D7E3472E00265B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 3fffdf431221bd0267a821c456034f23f6d02936a1670d71a0b13b20712d9951
MD5 f5416c2718b66d545a433e099d5e5802
SHA1 3fb32349273c7c8d05a057105dae9ca0505ecf2f
SHA512 2b294a95bf9f05846af93ca82e8c55f18510b5f8fcc47f07fd0912cc0c4a3b133615cc41dbeec42cff20eb09ba2b28724cb86e4116ed5173408c2474b2159486
TLSH
T192618CF747B4856EDA1196F0DA18EE2FDF2D0215431C7CA989E0AE27D7E3472E00265B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 79728f6e3dfabca1503c38a09d49f8c76ecdb655e3990164e04439a6f51f5105
MD5 ec4baecdb16a2bba00e63e2f065e4793
SHA1 f7c2f50349fe39451e26aa46d6ab54c7ffc24d4b
SHA512 4cdc155ff4b720c7b17dd938cc80707f3cf6dc1269cfc5450dc405d44bd7a255756198806b7f212a3d50c5b7463397f37f48e7c84d830f361f85646aa39afa79
SSDEEP 192:sxZDRIyMqZjK1Ml8xmPj/fLs0WpVrg+uo43+g1zodp6WHW6+WNs3Fi/YXBBeBIgW:sxZDT9b/fLs0Wvrg91gtHbl/Zg1
TLSH
T1AB72E805AA34993BCCD7D219FA457FA3D3F9552392905E4499FC8A1C04E7BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 97140629de0146da1410407390b09f131fb98906d513951de24e1cf800ae7305
MD5 6e3109c19bf3f5d33088bed980e77bd1
SHA1 66a0d921531322f6092e86da8ebbfa8a6ccda375
SHA512 1352aaeabf6f131bb379b368ff4554ec13894c101bd130781cd023db23a817b8e406de4e533735a99e3fa7caa330d5cb4cc54694b60d4988ea36d639d3f6ce3b
SSDEEP 192:sxZDRIyMqZjK1Ml8MmPj/fLs5gBuo43kg1zodp6WHW6+WNrFi/YXirY4rIg54YJ:sxZDTub/fLs5gw1ytHb0/fd+8
TLSH
T18272D815AA349937CCDBD209FA457FA3D3F9456392405E48AAFC8A1C04E7BDD220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 f619439e588a86b33cdddff505984705f31c0d2826ef9cecfa6829f1b5b725b3
MD5 0f787dfca0e326b19f12f206d492cdc4
SHA1 a561957d882a2365dbf99221424af21148a7ac19
SHA512 a9a16aca47f95051019c5a9b2c1b75f6bbb6997c02c3683013fe40bdbaec2b998a6e4a03b0e01215aae776fc04b2c6bba6ea786df819441724ba3452685877a5
SSDEEP 192:sxZDRIyMqZjK1Ml8MjPj/fLsJgBuo43kg1zodp6WHW6+WNrFi/YXirY4rIgjYJ:sxZDT7b/fLsJgw1ytHb0/fdj8
TLSH
T12562D915AA349937CCDBD219FA457FA3D3F9456392405E48AAFC8A0C04E7BDD221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 574c4bd444d6e2be3b8660e036653f1c153dd70e37dfa5530b42c7616871b907
MD5 e521573e899785a82be98e596b7ba796
SHA1 59e7e4dba050d6d08f7501957bd32d833fabd7ae
SHA512 db03d7dcfecadb4e7eb2a7aeef763a09696430ce11ac5006bcc7b4462a8e4bcd62c70d352c806cc23df1cc01c7628f41d06187dee58bf9746b5454352ac2ec54
SSDEEP 768:/Zk4Pfe7pLuLnXDWvXt4h8F1+UoAYDCx9Tuqh0VfUC9xbog/OVLeHiLl42vJ4roR:/Zk4PfeEnXDWvXt4hu1jaKeHiL+QJDWy
TLSH
T16AF2FB3B680CCB7E4F804E9CEC2ABE9A6EE8018F5698CD5447FA444C03C76EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 b9b8001c2834edafe87a6db348b68bc178319f18210c303438372d85e00cb75f
MD5 435483264373456cc3e2b8003a4147fd
SHA1 1391c3c467ac2fa4d94b05928be086fc9d2dea4e
SHA512 6f9bb77192e8c0bbfe1ec24c167956e3168d008a3c855de6ef762701373e20bfc3af336852459876e66810aa0be39ebc80c2afd6bcdf5a9c7940fee92308580a
SSDEEP 192:EtjGz7Y1/St59NZp1ZVzDqHgnmz3th9AZkzPr1PVIfPU1ud/A:EJGnYNSv9PpHV/qjQNA
TLSH
T150B22B13313A03423CBE2909A3A696779E4231B33019EA6F77A904764E67E124DFDDDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 ac4a8e1bc1c4264cfde3fe9c5cceba78b5e4cbcd7946fc33f480627a66e00b98
MD5 322a81b6410871d15c33e1941311e105
SHA1 9062321253d2176228b5f8648db52605db5a74a3
SHA512 ee53bab0ab25b56d2bfdb967aa59afec74208d2097e63fe6e1fa57f4fbfe4f4bbe3d376e6fa4ce6dc4edd4b12fc081f6267a59763d31196960581ac6a86cd198
SSDEEP 768:rFgkgLwgestVOZCjOiS1SgXKMO4Qirlf4w:Gkg0DCjOvXKx4QihQw
TLSH
T1800380F184D78DB6D89D87C7973DAD12A9BCC123B5885948B3E8692DEC5B0BFC306411
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 b150935760f228af88560dca590a4b14d485f8d48d179aa4b94de7c4c469ae05
MD5 3165ba33d4639bf398f7305f3080ae58
SHA1 c7d4ba1d021cdeab26a37928ce152157c6c13649
SHA512 5a146f1066e0436cb2a25a05ebd068da81b414d14afb28f96adf67fe990e82a23e2c4a1035172f1ac36d6c2f4716aaa4836813ae72377ea98c8dc20dfb4ab677
SSDEEP 768:mBFccps31wglxFVOZCj6+Q1IhkoFYS/Gt:mls35qCj6+QOhkoaH
TLSH
T1ADB24C36D898DEBBECE64F99B74E7A07EEE002A7C58859C4DAD81D1D00971DD130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 557d585afd42c2a33d95e230c1aebc6c38eed82c41a0baccb48f017a97619bc6
MD5 446cded72673197f15d6d07d63ac7067
SHA1 a2d140bd07ee97b222c629476c3c7d4bfa994c6f
SHA512 9ba4e2d408cd623b4230d4b40acbc6ea4e3aadd958f4dcebefe98135142e4ef6fbb807adda8eb418a526a3da832ccb3d7d45599d396f7ffdda55b2d0c752b89e
SSDEEP 384:nniFKVZcIs3sNw8TUNTUlI4AQzoNmXA/OuwBfcVOFgpo18jOFRQll58ivT+afbH9:iFKts3vwgeJABVOZCjOXQl4irlf4w
TLSH
T1ECC23A72DCA4C9A7EDEA8B89B74A7A17EEF001A385CC59C4D9D85E1D00972DD130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 6c1e006b2f60310e3809372ddd91df139a6aa9f4aacb6da837dc2a1117e442a7
MD5 66d34be8c6a59fa7d0bcedb0d172cf30
SHA1 635161526bb4287710a5f1be6f0419d7bb7831ae
SHA512 9eb099cb7e0c7664913d4a8277abe1f52caf409cf4193531f88e075f309579e47bcc911b7006209b56e44d7c794b930842ab9f807b3e2a268459ecce16d3bf0b
SSDEEP 384:nniF9CcmyWCs3sNU8TUNTUlImkrzoNmxdgwBfcVOFgpo18jOFRQ6l58hkP+lFYS6:iFccps3/wgldgVOZCjOXQ64hkoFYS/Gt
TLSH
T146C25C32DC98DDABECE64F9AB74E7A47EEE002A7C58859C4DAD81D1D00971DD130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 031f494b5b1e1fc504069b4f17366db5788928be9c29c0df5ec978a8cc3eeebe
MD5 930c1e287b9fe667024293cad4f58500
SHA1 5d4b827de988c02453ff0bbaab5942f18bf26a9c
SHA512 9a478d7f4e15a0737c191c394f98f06f18682702e5894a8923a5a84e26f27cfc017dfc39959d7578772a6e5b5cfe06da371c208f5dadb222bbb52246a6adad7c
SSDEEP 384:nniFiZcIT3sNw8TUNTUlI4kQzoNmw/OuwBfcVOFgpo18jOFRQll58ivT+afbHy/8:iFQT3vwgqWBVOZCjOXQl4irlf4w
TLSH
T18FC24B72D8A4CDA7EDEA8F89B74A7A17EEF001A385CC59C4D9D85E1D00971DD130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 9bce6f8627a825725dc39450e59b0d0d841cb9d2cae05c77e45575c8d8bc5b02
MD5 bf08176d452c08255c535fb7a9901904
SHA1 f19774e62db08962153428478589c602445bbf62
SHA512 5d1487708a5e44b3d7743ab766f5ec9345dcb05d125825c29e34cdc374d8d79a5c403a697d549d3e2eaed4cf1533b01c833eb4e8359d1e55cd2ff9a4b73dc27c
SSDEEP 384:nwiFiZcIT3sNw8TUNTUlI4kQzoNmY/OuwBfcVOFgpo18jOFRQll58ivT+afbHy/8:LFQT3vwgqGBVOZCjOXQl4irlf4w
TLSH
T1DDC24B72D8A4CDA7EDEA8F8AB74A7A17EEF001A385CC59C4D9D85E1D00971DD130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 4fd334136bdea8a17a247e9ef1d159184d12233213f5b9a3d6a71b60c9e4e638
MD5 acc85a40f22bd60d346acfecb22b37ab
SHA1 4401e6ec0fe09b8ce7cf6b28e81c211a7bf98a03
SHA512 5551c14ba045778fbbe1b25cbcd561a9ec0dbdf8144301d9e483352b6217ceba42b66ab6fbb847d783e7f1d17350722982539fb559793c2ca05c1258c4f6ca1b
SSDEEP 384:nQiFKVZcIU3sNw8TUNTUlI4AQzoNmXANOuwBfcVOFgpo18jOFQl58ivT+afbHy/8:rFKtU3vwgeJuBVOZCjO64irlf4w
TLSH
T1A8E2A1F198D789B6E8AE4B87A77D2E069EFCC153B5885984B7D84D1CCC421BFC30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 a6a8a2d4fe6e74e59136c8aaffd761c33ac89bd4169349ebb3843e13117290a8
MD5 1edad49398bf73cd68a9728ea73bd243
SHA1 3d1e94c14d9f8008c9c6e780ee742a4256d8df33
SHA512 86df733f9224edbad2bd05a90db1d5f8c2f4b14f8bb9fe5db6c0b7cbd55675b286393ed352d138368b24dbf1cf8400c1aa35c818ca5ac41e0803791e85099114
TLSH
T1043100D158380FD1C4BD0AAEB48738FC44E8D32AB1A8707D5898E9A81B2E64D745583F
MD5 SHA1 SHA512 TLSH

Submit Download

e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 a0b1a35a86cbd2e671521525fc6903162d450e3b301948d913d05ef458794c20
MD5 22215f69c4a5231b8c568620e783d7fe
SHA1 c64663b6efe0023ca5978374d785f1202d924d1b
SHA512 9e38513132672de4a65c01a6eca3c8c3a878cc6e11e2c0d2235798b78e3338c9a13a15d261c4b4fc6c60657f42407b98c8435aa4352366d1809843ddda068e22
TLSH
T1A5C02B79481924CC2B00043C6004012B19B0560023C413F48C1B8D80007537CD30817F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 682d8ae403e66f7d696d70af3bd67b82dfd3b8625694859cfe555fb7f17b9f34
MD5 5204d77de65068aaf9453fc7594c1673
SHA1 878476641faaf0df38c55ce5b887bf06da8abb2c
SHA512 358a92b647135a865d345b06b90b9ac79cc22948573c0fc608a8b1b2bf8a023b52e94936c7905b4eef837f7c490586f7daec12eeb5e50c3f9dd1a836122921d8
TLSH
T17F410958A6F91149B3776F56ABF6A8AE543F7D732F06D45E10110D4E0A22B40C8A1737
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_9.0.19_(x64)_20260825132122_000_dotnet_runtime_9.0.19_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_9.0.19_(x64)_20260825132122_000_dotnet_runtime_9.0.19_win_x64.msi.log
Size 4KB
SHA256 2b66039f6775cb34dbd2cf1de44f94c973d6a64ca1bdac33b32eac96eb7dfa22
MD5 ac4525e1faba8102722893be18d323b7
SHA1 267a3891b979b4ed41e7152e6ad1f6f587e8af67
SHA512 a71e0010d888c3bef6b1189ead21cd1ae8932e1cd6552fce65d6dabac6e60704de268c012cb0f348f53ace29abf20b841d17b2879a0d1df66ec3423363b912a6
SSDEEP 96:YX+/4JMwGSOe1f8iwGi/aDKawGLDQA9eKFMMC:67GSOeIGMGeKF8
TLSH
T14181CA2E1EE80905B2F2DA475EF3C4625A33FDA75934CF4C23C54219465B90578ACBBE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_9.0.19_(x64)_20260825132122_001_dotnet_hostfxr_9.0.19_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_9.0.19_(x64)_20260825132122_001_dotnet_hostfxr_9.0.19_win_x64.msi.log
Size 2KB
SHA256 a59fba96020b1d72747c0030e2ee8e0960aef59c1a1bacfad79e07f7572ccb45
MD5 be4850572ec43709c9a03de1a03a41eb
SHA1 bae8b7b5e5fcce5f404033236c12eefe4ada3973
SHA512 a99e41f57b3f0cea549b1445e5342450560f5022aadf410eeae36f384cb4adccf0ee21ca20e9d26406723226b6c0e5f0caa4a5f7f0f6554d7434fd751861daee
TLSH
T11041D7651AE90905B1F69A8B5EF3C4325E33FDE66838CF4D12854219076BD006DA8BBE
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_9.0.19_(x64)_20260825132122_002_dotnet_host_9.0.19_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_9.0.19_(x64)_20260825132122_002_dotnet_host_9.0.19_win_x64.msi.log
Size 2KB
SHA256 64b766250010e8bd6a2377cb927aa0f8a6d2dab119f9d583751808705c3cba5f
MD5 bcbdfc59e7e6607cbbfafa134e012215
SHA1 a18668bb3dc80191aad3d68580fdbb2587ff377f
SHA512 cbc565ee6a9f6a981a2cb4b4602da574edb8042e48c213e29a94aac52c8c45bf27cf1cf8196415fe7b4ba18c7c68f2d209960f82c930aecc551d9023e8b40157
TLSH
T1EE41FA691BE90905F1F25B479FF3C4621E33FDA76834CF4C12C54219066BD0168A8BBA
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_9.0.19_(x64)_20260825132122_003_windowsdesktop_runtime_9.0.19_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_9.0.19_(x64)_20260825132122_003_windowsdesktop_runtime_9.0.19_win_x64.msi.log
Size 2KB
SHA256 8f600e609093e5208ed1fdfd55163facc905e2f0136ebdbf939c4f7699f10e40
MD5 c1b6c351b39965d72ed94caff2c8d601
SHA1 7ca82b3528b715fa3ae804be783549759fa716e1
SHA512 9bb8c0b73b709bb69a48d96cd8753e1e2cbaea5f5f031b123dba0c00f6c159b414080550b1bb8f204bd7bb1b56f4e05f311755263a8e71a94a96aa92ef49f60d
TLSH
T1F64106152FFC0905B1F65A979FF3C5225A33FDA66870CF4C22854219066BD00A8A8BBE
MD5 SHA1 SHA512 TLSH

Submit Download

MSI142A.tmp

Path C:\Windows\Installer\MSI142A.tmp
Size 219KB
SHA256 2bf33a9b9980e44d21d48f04cc6ac4eed4c68f207bd5990b7d3254a310b944ae
MD5 928f4b0fc68501395f93ad524a36148c
SHA1 084590b18957ca45b4a0d4576d1cc72966c3ea10
SHA512 7f2163f651693f9b73a67e90b5c820af060a23502667a5c32c3beb2d6b043f5459f22d61072a744089d622c05502d80f7485e0f86eb6d565ff711d5680512372
SSDEEP 3072:FVzl3qiEZybztEwiUx6D02cWVsV1v2vZR3X6j7zo6k2FkngTLrOrORT9flQnS6lg:FVIMEgXmEAR3oHon2VaFuG0eEp
TLSH
T1AF248D217494947EEAFA0832A57EDA71BF3DF2241760C8AEC3409D1E6D604C167B7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windowsdesktop-runtime-9.0.19-win-x64.exe

Path C:\Windows\Temp\{054430A4-A1BC-415C-8518-5F49A662DB8D}\.cr\windowsdesktop-runtime-9.0.19-win-x64.exe
Size 607KB
SHA256 21ee8ba010669a3814268926875d3565b7166ee62db8a41b9f717b111190f119
MD5 5887634f8042d630c771b773b1adf4c4
SHA1 05f24f02f5d10601b8749457052776dbbe640fde
SHA512 723b1cef6a79828ca170840dc68079d5298f9b33bd94def165c8b815f62ce2d59985cf2ffb2ce3f2060fa605f2702c049640a6486ec16d67a187f639b8a37e7d
SSDEEP 12288:tmEsd9PZfePv3xl7ft7V+6uC+zd5qLl8S3wBfiy7nlEM0DnmX:tm39PZfePv3r7fm6t+jqpB3ipzCM0c
TLSH
T1CED47D32A5614032E7F10673B928D6303E3CE328175488AAE7D4AD1D7EB88D667F7257
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bg.png

Path C:\Windows\Temp\{0B68C7DE-D4FB-4CA0-B44C-61299AF14D8B}\.ba\bg.png
Size 4KB
SHA256 9095bf7b6baa0107b40a4a6d727215be077133a190f4ca9bd89a176842141e79
MD5 9eb0320dfbf2bd541e6a55c01ddc9f20
SHA1 eb282a66d29594346531b1ff886d455e1dcd6d99
SHA512 9ada3a1757a493fbb004bd767fab8f77430af69d71479f340b8b8ede904cc94cd733700db593a4a2d2e1184c0081fd0648318d867128e1cb461021314990931d
SSDEEP 48:u+Xg+NXWbdlIr33lx9W5OstaDIy3r5XpPyvZKmXYTDeiByNxcaaaaaaaaaaaaaaE:AaXWPIrHT932JsdpPyjqDeioatEn
TLSH
T19891B4D8FCF95322C6002BF255F4C0735A0215B713ABFEC82F496BD90E6878E25058B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixstdba.dll

Path C:\Windows\Temp\{0B68C7DE-D4FB-4CA0-B44C-61299AF14D8B}\.ba\wixstdba.dll
Size 190KB
SHA256 dcea15f3710822ffc262e62ec04cc7bbbf0f33f5d1a853609fbfb65cb6a45640
MD5 f1919c6bd85d7a78a70c228a5b227fbe
SHA1 71647ebf4e7bed3bc1663d520419ac550fe630ff
SHA512 c7ff9b19c9bf320454a240c6abbc382950176a6befce05ea73150eeb0085d0b6ed5b65b2dcb4b04621ef9cca1d5c4e59c6682b9c85d1d5845e5ce3e5eedfd2eb
SSDEEP 3072:sjEoXsLW9OLG8Qp51ySdjDXY33b+Av7O5IkI+/AYkPAEc527uu3k/gLtxavf0ir2:sjEo8LW9553hXWy15I2YrAW7FUVEihs3
TLSH
T1FF14AF1176D0A07AEBFB16307A39A5216E7DBA200FA0C9DF63449D2B1D715C19B36B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{1B860867-ED97-4871-B221-1639D93BDC85}\.ba\1033\thm.wxl
Size 5KB
SHA256 81a68046b06e09385be8449373e7ceb9e79f7724c3cf11f0b18a4489a8d4926a
MD5 d5070cb3387a0a22b7046ae5ab53f371
SHA1 bc9da146a42bbf9496de059ac576869004702a97
SHA512 8fcf621fb9ce74725c3712e06e5b37b619145078491e828c6069e153359de3bd5486663b1fa6f3bcf1c994d5c556b9964ea1a1355100a634a6c700ef37d381e3
SSDEEP 96:MT0abTxmup/vrCKATQdYQHdYCwgoVOBq9LjP5dbSE7:OQNkdYQHdYCYXt7
TLSH
T1F1C1DBA778CF53C128731255EA925AAA5911C19C537F2DF4FC8B454B838A827A373F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet_host_9.0.19_win_x64.msi

Path C:\Windows\Temp\{1B860867-ED97-4871-B221-1639D93BDC85}\dotnet_host_9.0.19_win_x64.msi
Size 704KB
SHA256 0d81a9e820be226d2b15f8dc90e05b475871a5b0250a7d4a6d4083c88cd63b16
MD5 0368681ab717bb62e0906d84fe6e97f6
SHA1 26c3f93fc63167f8531081b169cfc980ef439e7e
SHA512 a016334e43c8aac45ed92fc1b2101d4276db0275550d20ebd835e1e43b40e0d18593c377086d27e7232d892b8326b7cc502f3daacda22b6d6833c87dca76dae6
SSDEEP 12288:KBiLV1EgXmEI3os2Qx7E4D4Rxbp4K+1uiqb:KBiLXdc3/7Rin+sj
TLSH
T152E49D137D80803AD9BA0D31853AD7B16F3DBD204A64899B6380B91DDDF15C0AF76BE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet_hostfxr_9.0.19_win_x64.msi

Path C:\Windows\Temp\{1B860867-ED97-4871-B221-1639D93BDC85}\dotnet_hostfxr_9.0.19_win_x64.msi
Size 776KB
SHA256 abf0fb7ef359426b67121e4c2b8bb4674ea791623bca73baccabaed390d89d9f
MD5 d211fbd50bc22ef313880510d7f88179
SHA1 3abc891ffc635b7dc5fc96e9baf559d238f5b2d2
SHA512 f314eb999541ed2a86e057411d140ca26e4705ed3c9481f077db9fe305f32ec3731b32bfe2cdcc059689b4bf3cbf2933e7f6ba38e8edc2c597140e10be8513b2
SSDEEP 12288:vwr8yrpGw29DV1EgXmEI3os2Qx7E4D4Rxbp4K+1uiq:vqrpOJXdc3/7Rin+s
TLSH
T132F4AD137D80903AD9BA0D719539D7B16F3DBE208A64889B5380B91DDDF11C0AF76BE2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet_runtime_9.0.19_win_x64.msi

Path C:\Windows\Temp\{1B860867-ED97-4871-B221-1639D93BDC85}\dotnet_runtime_9.0.19_win_x64.msi
Size 27.4MB
SHA256 6cdb76b8df3e2e119a6895dfc6fcc0f0d895f268bc4435f6b6ee3c294060af09
MD5 937c53d23701feb18ef5f7fafe2eee6d
SHA1 1aa155c421045d72a03551fd8f6667a4e9d9bd33
SHA512 19c1a9d2f592873cb2659024340e877ce0b764b94711cdf0b3280fe76473764d7e6916d099372524a2a640a061a314bb242344f39197194f4361cc90e30b60f7
SSDEEP 786432:I0lTuzwaHTJkMwXUoZV3KleHhUGSU7+Jnx:MzF1kMwXnZV6gHVSAAnx
TLSH
T1D6573323BE969839C4390D7215BE73611F3DAD285761C9CB57103828EDF65E09BF2AC2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windowsdesktop_runtime_9.0.19_win_x64.msi

Path C:\Windows\Temp\{1B860867-ED97-4871-B221-1639D93BDC85}\windowsdesktop_runtime_9.0.19_win_x64.msi
Size 29.8MB
SHA256 8bed48caee2da4c4b2da97c937f189283ab84b964a48d05ec1ccfb44a42a26a3
MD5 1eafbc1cf9459ed37429ff67fee4262a
SHA1 ad410825d89b1e43d82a48d6763d403c64b78100
SHA512 bf55d974d53593a6f2ca30cf9f7da6c6c0f4ffeb7e3ab1dc49e19e3c8612d74131737683ba4ae4e9b79304ec23a27d59095298231cdbb9e4179a7ea28a8c8598
SSDEEP 786432:sEsegWkun91a6F/T/DWsezaLlT3H+eYzW3W0R:sbCnXp9P+aAfz4W0R
TLSH
T1916733173D939539D4AA0C36C57AEB30133E7D008F19881A92A0B91DDDF51F09EAEBD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BootstrapperApplicationData.xml

Path C:\Windows\Temp\{4C3897B6-2FB9-478A-BC1C-CEB80B9D70D3}\.ba\BootstrapperApplicationData.xml
Size 7KB
SHA256 94036bac4c6091a212223e14af580d8dbac997b7a5260aaceb1970bd8f8037e1
MD5 d3e0fdfae5b89193db3c4fa4ae739ffa
SHA1 70d998ebad608662fa46213215246e16db4a258b
SHA512 3ce20c585b84f417500a8892c647323ebf67287304066b23efc4d188064c2a828bbe33681028b439cad7a6ba3207a07277e2348d94f2d78da03dc0c1000fa7f0
SSDEEP 192:X0sesv61rlcGiu9ntgEJuJW6QoxouQu1Rp:X0sessi7t
TLSH
T108F17A142FFD0325F0F35F84EAF455265A35BC926D38CA5D01642E0E8973B8199A2FBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.xml

Path C:\Windows\Temp\{4C3897B6-2FB9-478A-BC1C-CEB80B9D70D3}\.ba\thm.xml
Size 11KB
SHA256 83ca096f7ba2c83fc3b3aeb697b8139a788fa35eb8632943e26bb9fff7c78e63
MD5 302563a713b142ee41b59e3eeac53a90
SHA1 1340e90cc3c6c5fc19a7feb61d7779f4a4f0fdb5
SHA512 c9d4dfc20802bb542178300d1044bb94b35593b834ab0b50875a32953f890e48da456199128500e2c1fee26eaaf8c2c4fcaffb308b37914215f900cdd5c4cbc8
SSDEEP 96:eCdhlFGZRd4UyAi0Rz96zYFGiRdl6dXXdT9gUoLNEmRG3QBinRFRK03K8+GGI9ki:eCSfiozEW/A
TLSH
T1A2325BA986DE7C00D232E711ABF271D6AF126862C4C46E58F94C39BB4FE25406C7727D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1520-217-0x000001DD127B0000-0x000001DD137B0000-memory.dmp

Download