ae6fc5ba07dc314423a518f93b8ad69a5730df780669fd3b40283c32b24a56fc

Analysis

user interaction
yes
max time kernel
39s
max time network
84s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
08/09/2026, 18:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Xeno-v1.3.60/Xeno.exe
Size 164KB
Sample260908-xend2axblh
SHA256 ae6fc5ba07dc314423a518f93b8ad69a5730df780669fd3b40283c32b24a56fc
MD5 6156707c90644ea4edb71f3044d1c8d9
SHA1 237a4262696840719021a53e9322ca1fd0d6fb0d
SHA512 8fc14005a4ec1cc372e7be1d64c12899a9f304f6002ef1c87bf510697c3ee9fb8753a042e6d2ef5dde6805f349b96847f09a19ab0fa5385ea7e7ee915054d13d
SSDEEP 3072:520jWfVKLer59aSpfO9D/87jXEkeFZA4nsSyU3i4w:MIhSpfO9jC/44Uhw
TLSH
T189F34B07A6A840BEE1B7D679C9924941FB723C558B71A6CF03507AB60F777D0AE39302
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence ransomware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
97	2908	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2908	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134333668500285935"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-42486406-2033776002-1658862356-1000\{53BB931D-11BF-4C72-8246-6903BCB76F08}	msedge.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1052	Notepad.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe

Suspicious use of FindShellTrayWindow 12 IoCs

pid	Process
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 3576 wrote to memory of 4564	3576	Xeno.exe	83
PID 4564 wrote to memory of 4600	4564	msedge.exe	84
PID 4564 wrote to memory of 2908	4564	msedge.exe	85
PID 4564 wrote to memory of 4828	4564	msedge.exe	86
PID 4564 wrote to memory of 4828	4564	msedge.exe	86
PID 4564 wrote to memory of 4828	4564	msedge.exe	86
PID 4564 wrote to memory of 2380	4564	msedge.exe	87
PID 4564 wrote to memory of 2380	4564	msedge.exe	87
PID 4564 wrote to memory of 4076	4564	msedge.exe	89
PID 4564 wrote to memory of 4076	4564	msedge.exe	89
PID 4564 wrote to memory of 4076	4564	msedge.exe	89
PID 4564 wrote to memory of 1648	4564	msedge.exe	90
PID 4564 wrote to memory of 1648	4564	msedge.exe	90
PID 4564 wrote to memory of 1648	4564	msedge.exe	90
PID 4564 wrote to memory of 5096	4564	msedge.exe	91
PID 4564 wrote to memory of 5096	4564	msedge.exe	91
PID 4564 wrote to memory of 5096	4564	msedge.exe	91
PID 4564 wrote to memory of 2448	4564	msedge.exe	92
PID 4564 wrote to memory of 2448	4564	msedge.exe	92
PID 4564 wrote to memory of 2448	4564	msedge.exe	92
PID 4564 wrote to memory of 2160	4564	msedge.exe	95
PID 4564 wrote to memory of 2160	4564	msedge.exe	95
PID 4564 wrote to memory of 3632	4564	msedge.exe	96
PID 4564 wrote to memory of 3632	4564	msedge.exe	96
PID 4564 wrote to memory of 2080	4564	msedge.exe	98
PID 4564 wrote to memory of 2984	4564	msedge.exe	99
PID 4564 wrote to memory of 2080	4564	msedge.exe	98
PID 4564 wrote to memory of 2984	4564	msedge.exe	99
PID 4564 wrote to memory of 4700	4564	msedge.exe	100
PID 4564 wrote to memory of 4700	4564	msedge.exe	100
PID 4564 wrote to memory of 4700	4564	msedge.exe	100
PID 4564 wrote to memory of 3616	4564	msedge.exe	102
PID 4564 wrote to memory of 2156	4564	msedge.exe	103
PID 4564 wrote to memory of 2156	4564	msedge.exe	103
PID 4564 wrote to memory of 3796	4564	msedge.exe	104
PID 4564 wrote to memory of 3796	4564	msedge.exe	104
PID 4564 wrote to memory of 4260	4564	msedge.exe	108
PID 4564 wrote to memory of 572	4564	msedge.exe	109
PID 4564 wrote to memory of 4260	4564	msedge.exe	108
PID 4564 wrote to memory of 572	4564	msedge.exe	109
PID 4564 wrote to memory of 4380	4564	msedge.exe	110
PID 4564 wrote to memory of 4380	4564	msedge.exe	110
PID 4564 wrote to memory of 4432	4564	msedge.exe	120
PID 4564 wrote to memory of 4432	4564	msedge.exe	120
PID 4564 wrote to memory of 3820	4564	msedge.exe	121
PID 4564 wrote to memory of 3820	4564	msedge.exe	121
PID 4564 wrote to memory of 3820	4564	msedge.exe	121
PID 4564 wrote to memory of 1856	4564	msedge.exe	123
PID 4564 wrote to memory of 4876	4564	msedge.exe	124
PID 4564 wrote to memory of 4664	4564	msedge.exe	125
PID 4564 wrote to memory of 4340	4564	msedge.exe	126

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.60\Xeno.exe
"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.60\Xeno.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.NETCore.App&framework_version=9.0.0&arch=x64&rid=win-x64&os=win10&gui=true
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x314,0x7ffb8b48c188,0x7ffb8b48c194,0x7ffb8b48c1a0
    3⤵
    PID:4600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1860,i,5029945163904970830,2688370059096658061,524288 --field-trial-handle=1900,i,9226676892616121,16796731108985772369,262144 --variations-seed-version --mojo-platform-channel-handle=2084 /prefetch:3
    3⤵
    - Downloads MZ/PE file
    - System Time Discovery
    PID:2908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1692,i,2923495839356026222,739267382022403525,262144 --field-trial-handle=1900,i,9226676892616121,16796731108985772369,262144 --variations-seed-version --mojo-platform-channel-handle=2044 /prefetch:2
    3⤵
    PID:4828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2548,i,15171292091506857510,3586382613929222909,524288 --field-trial-handle=1900,i,9226676892616121,16796731108985772369,262144 --variations-seed-version --mojo-platform-channel-handle=2708 /prefetch:8
    3⤵
    PID:2380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3476,i,15093180226108918265,9844238603876403034,2097152 --field-trial-handle=1900,i,9226676892616121,16796731108985772369,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
    3⤵
    PID:4076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,4534550643996962727,10717109269941793802,2097152 --field-trial-handle=1900,i,9226676892616121,16796731108985772369,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
    3⤵
    PID:1648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4232,i,335587672350624867,17961973677133023917,2097152 --field-trial-handle=1900,i,9226676892616121,16796731108985772369,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:1
    3⤵
    PID:5096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4248,i,17615024406197662617,9991928233005819662,2097152 --field-trial-handle=1900,i,9226676892616121,16796731108985772369,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:2
    3⤵
    PID:2448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4644,i,17807165202180658742,10765366516336175250,524288 --field-trial-handle=1900,i,9226676892616121,16796731108985772369,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:8
    3⤵
    PID:2160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4572,i,9472129134836021280,10796936752810434513,524288 --field-trial-handle=1900,i,9226676892616121,16796731108985772369,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:8
    3⤵
    PID:3632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5180,i,5818286185020464006,10937798813196840110,524288 --field-trial-handle=1900,i,9226676892616121,16796731108985772369,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:8
    3⤵
    PID:2080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5232,i,7580795423156857241,14662079309170728068,524288 --field-trial-handle=1900,i,9226676892616121,16796731108985772369,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:8
    3⤵
    PID:2984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5132,i,16896845986100251063,6677481920672481928,2097152 --field-trial-handle=1900,i,9226676892616121,16796731108985772369,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:1
    3⤵
    PID:4700
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6052,i,14144485312649559671,14231796391322982003,524288 --field-trial-handle=1900,i,9226676892616121,16796731108985772369,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:8
    3⤵
    PID:1728
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6052,i,14144485312649559671,14231796391322982003,524288 --field-trial-handle=1900,i,9226676892616121,16796731108985772369,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:8
    3⤵
    PID:3616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6200,i,11386085200867444134,4969519532447030248,524288 --field-trial-handle=1900,i,9226676892616121,16796731108985772369,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:8
    3⤵
    PID:2156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6344,i,13503652263532017318,17491111022345567661,524288 --field-trial-handle=1900,i,9226676892616121,16796731108985772369,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:8
    3⤵
    PID:3796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3776,i,1085851308570613050,4251964579475431366,524288 --field-trial-handle=1900,i,9226676892616121,16796731108985772369,262144 --variations-seed-version --mojo-platform-channel-handle=3768 /prefetch:8
    3⤵
    PID:4260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3464,i,12734682335230765437,6071169407369857942,524288 --field-trial-handle=1900,i,9226676892616121,16796731108985772369,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:8
    3⤵
    PID:572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3532,i,8002666415479139315,16836866511724517565,524288 --field-trial-handle=1900,i,9226676892616121,16796731108985772369,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:8
    3⤵
    PID:4380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3772,i,5791096648554691487,7296688736668130076,524288 --field-trial-handle=1900,i,9226676892616121,16796731108985772369,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:8
    3⤵
    PID:4432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=3760,i,6755079363679533298,6759835800813989466,2097152 --field-trial-handle=1900,i,9226676892616121,16796731108985772369,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:1
    3⤵
    PID:3820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6832,i,13619927898460811769,5060351513381272674,524288 --field-trial-handle=1900,i,9226676892616121,16796731108985772369,262144 --variations-seed-version --mojo-platform-channel-handle=6844 /prefetch:8
    3⤵
    PID:1856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6820,i,5952542385417874056,9952830916426506656,524288 --field-trial-handle=1900,i,9226676892616121,16796731108985772369,262144 --variations-seed-version --mojo-platform-channel-handle=6884 /prefetch:8
    3⤵
    PID:4876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6836,i,8996371683960722567,3100747739576087134,524288 --field-trial-handle=1900,i,9226676892616121,16796731108985772369,262144 --variations-seed-version --mojo-platform-channel-handle=6928 /prefetch:8
    3⤵
    PID:4664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6960,i,13326009548200393963,15330455168714870227,524288 --field-trial-handle=1900,i,9226676892616121,16796731108985772369,262144 --variations-seed-version --mojo-platform-channel-handle=740 /prefetch:8
    3⤵
    PID:4340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6600,i,4271457861307230835,7778078964688072684,524288 --field-trial-handle=1900,i,9226676892616121,16796731108985772369,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:8
    3⤵
    PID:1396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=5424,i,10266027064504885783,1291626126972661885,2097152 --field-trial-handle=1900,i,9226676892616121,16796731108985772369,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:1
    3⤵
    PID:5064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6868,i,3875262500449925529,11413305807763401985,524288 --field-trial-handle=1900,i,9226676892616121,16796731108985772369,262144 --variations-seed-version --mojo-platform-channel-handle=6876 /prefetch:8
    3⤵
    PID:5732

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1036

C:\Windows\System32\Notepad.exe
"C:\Windows\System32\Notepad.exe" C:\Users\Admin\Desktop\BackupExit.vbs
1⤵
- Opens file in notepad (likely ransom note)
PID:1052

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5364

C:\Users\Admin\Downloads\windowsdesktop-runtime-9.0.19-win-x64.exe
"C:\Users\Admin\Downloads\windowsdesktop-runtime-9.0.19-win-x64.exe"
1⤵
PID:5456
- C:\Windows\Temp\{74064EF0-05A0-45D2-A683-D13001FF2108}\.cr\windowsdesktop-runtime-9.0.19-win-x64.exe
  "C:\Windows\Temp\{74064EF0-05A0-45D2-A683-D13001FF2108}\.cr\windowsdesktop-runtime-9.0.19-win-x64.exe" -burn.clean.room="C:\Users\Admin\Downloads\windowsdesktop-runtime-9.0.19-win-x64.exe" -burn.filehandle.attached=716 -burn.filehandle.self=720
  2⤵
  PID:5544
- - C:\Windows\Temp\{B3DC90E4-40F4-477F-B85B-202F2E125469}\.be\windowsdesktop-runtime-9.0.19-win-x64.exe
    "C:\Windows\Temp\{B3DC90E4-40F4-477F-B85B-202F2E125469}\.be\windowsdesktop-runtime-9.0.19-win-x64.exe" -q -burn.elevated BurnPipe.{5C049F0E-8BAF-4A8B-9DE0-BD33CA52F3B8} {8EB79B3B-D04D-4DA8-83E0-24D1F8D6FAF3} 5544
    3⤵
    PID:5928

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:6108
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 59B75A7EC4B7E822CFA3AFE7F0841C0C
  2⤵
  PID:5364

C:\ProgramData\Package Cache\{7a013c32-dd46-48f5-81b1-2576c92468db}\windowsdesktop-runtime-9.0.19-win-x64.exe
"C:\ProgramData\Package Cache\{7a013c32-dd46-48f5-81b1-2576c92468db}\windowsdesktop-runtime-9.0.19-win-x64.exe" /burn.runonce
1⤵
PID:5136
- C:\ProgramData\Package Cache\{7a013c32-dd46-48f5-81b1-2576c92468db}\windowsdesktop-runtime-9.0.19-win-x64.exe
  "C:\ProgramData\Package Cache\{7a013c32-dd46-48f5-81b1-2576c92468db}\windowsdesktop-runtime-9.0.19-win-x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_9.0.19_(x64)_20260908194832.log"
  2⤵
  PID:5228
- - C:\ProgramData\Package Cache\{7a013c32-dd46-48f5-81b1-2576c92468db}\windowsdesktop-runtime-9.0.19-win-x64.exe
    "C:\ProgramData\Package Cache\{7a013c32-dd46-48f5-81b1-2576c92468db}\windowsdesktop-runtime-9.0.19-win-x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{7a013c32-dd46-48f5-81b1-2576c92468db}\windowsdesktop-runtime-9.0.19-win-x64.exe" -burn.filehandle.attached=520 -burn.filehandle.self=540 /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_9.0.19_(x64)_20260908194832.log"
    3⤵
    PID:5276

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

state.rsm

Path C:\ProgramData\Package Cache\{7a013c32-dd46-48f5-81b1-2576c92468db}\state.rsm
Size 932B
SHA256 988473f95bdfd249e3a0e2a3bea2f9c224e743e1882217ab9db7dad62f1a674b
MD5 6dc7e45b2c2839f6ca1bd090cbb69678
SHA1 0ece8faa4879e86809edfc88a462e6288e4733b5
SHA512 b806f7c44caea54b81e9232b258e79b21054bfc5c0cddbc45be3e16ada841e55d3e050a84886e9b7b721fd6c6fe57ebc81d859ac3dfd13b8d10ccee5fc07c725
TLSH
T140119A515FFA0129E3FA6B3069F52721643ABC160D32C16C0001318A8E32BA0C8B0F77
MD5 SHA1 SHA512 TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 2cfe0e512fe66762495535e6076a96bb4e6ed6f34c98c4a7f8df941ef3c8c17c
MD5 5c148bcc6fa502a2fee964c0dd6afdfc
SHA1 9199b6a7ccde16500ea75a0020ab5db0df5569d4
SHA512 4631fdc4ed2e6e278c330749a012433d939adf4beecbd21c6f7a1cb60fe9640888daa64ec4b81642fafbb45e59921d422ffcb8d6579eb20f08c08622b263623c
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7B:fwUQC5VwBIiElEd2K57P7B
TLSH
T113B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6a64f2ae6a6617d628aecf24522b5fc03d56fd3b87da29c09e359aa8c784278c
MD5 319f3e9547ae8f5bd93b63a209353feb
SHA1 2cbbe39cbb469d1b008a38a5f66950de62d7be5d
SHA512 2335ad7dd232ded853c12042411a51f4c045d5ae5954aac7df9f840b69e4aee72129d3b0d5a528b94f8c84e50d9f92ecc1fcda50496c846e7b2b716f7e287127
TLSH
T115D080F777586105E75DD131EC13CB111B65195215D7DB02E314C99CA4644F566871C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5c85913b3d3cab7ba2879d18441341b2b4fd7ad9ce12d0c3ebfe421e6267c647
MD5 962c87a3f67f82f2083d6294250d9e58
SHA1 cfe9fd1f6729400cde038cbdead8751b96eacaca
SHA512 059eed3376b6b470a0be74a5db7d47fa3bae4b0557c4216789040d711e15417470e3ff6f96808c2e42bf6080c9af25da282ed4dabe378bd81b0971591713ef3b
TLSH
T11FD080F737586105EB5DD131EC13CB111B65195215D7DB03E314C99C94654F566871C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 e1f948d42857aafb044cbd1ba97fd09b949129800f082ff4cc66eed0f47ed440
MD5 6b8d13676b3869022d355f2764de9b1a
SHA1 da5fa949e81264849c1c4c66498c7f55ed688f24
SHA512 9d604b2009bc326e4a00b4441d50fd833b9569169d935651990cd3c9014e5f5ea8717bd4e8bdc4a8129b952d5a18ccb8ff2dffe885cc7dccf923797368acd88d
TLSH
T176814C6C094E48F1EF32CF3E64E1D31D367182B6D74B2E1621DCD4A43412BA24BA179D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 0ff11c503703ead980f7d587c3067d2afa59c93944a6d9488cb0a7cc186f1dc7
MD5 db91386d58730027e3f04e6388532497
SHA1 8f544f400d0e3098cc4327fcdb5cedd0dcb64ecd
SHA512 bb023a9f0d7be703a0c90e4757be290f7e68bcb6704b53121b5330dbe4219284abeb7fbff83119b39e5f85a39e2ba362874db91c27e61c554f340efc4fefb9da
TLSH
T167712B6C094E48F1EF32CF3E64E1D75C367186B6D70B2E1621DCD8A43111BA24B61B9D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589b70.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe589b70.TMP
Size 3KB
SHA256 e3a3fa9b226bab583abc91e8200331013c206c2eafaa12941c10eacf396aabee
MD5 d387ba475ff01d21f66105214c89f458
SHA1 24234fd3e319c448472b73a56beccc1e82d3c837
SHA512 7da80535fc90c77bb87b17ff4a85d544517f4cd0d404090aa2c19684c76d9ce4e6bb14d311a6b42353636cbdfd43ddec0f0c7c33663bbaab1b85c95dd70f96a3
TLSH
T14371086C060E48F1EF21CF3E64E1D35C767286B6C70B2E1621DCD8A93115BA2476179D
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 0cbda243c9cfcecd6076e20a061a0cec11ef94124506d1f5161856e0cef40931
MD5 fec57e237e71caf644ec354f43a57bbb
SHA1 9c4ce391c050da984f0878b0993d351764581880
SHA512 9dbc7daf6313828d0f6e8c5365d5d32ecf56c7d6f867a3ab551cfb64196dfca5bad96d7615a3ec52714dd132c3a64e0516a62788fa75d251dc89b7a3871345bd
TLSH
T1A751AFF787F4856E8A1196F09A14AF1FCF2D0615431C7C5989E4EE27D3E3472E10265B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 79007b0352c2f4a53609493f0cc38cdff0fa1c709f2ee307d83062112630a6fb
MD5 c0fd021e7a462db09c3dd4c4a6eae187
SHA1 970d34f110d12e598ab12bd978a6620913ee6318
SHA512 0ad461a2d56d73bbc59b5bd2ce2efbf7e8a6a6087092c05a6df656c80bdde443ef4b92417b05f940f612cb38c9caab9f5cf58ee353047351a8fe07eb66e5ae19
SSDEEP 192:sxZrRZyM/jK1Ml8MjM/f2sOnX2JUjCIdpwaHW6+WNrzP/AkwwwRN5Ig4J:sxZrt7M/f2sOnXac7HbP/sc
TLSH
T1A252F911AE34697BCCDBD209FA457B53D6F91472D2944E44AAFCCA1C00E6AED2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 b47293f6f6932a91f8277362c1f2c48b61327cbd11e21e50261160beb8d0f076
MD5 c0996df67cb3d0d348ba81442cfc2cba
SHA1 8b2f9b8fcdb97c635d0f58ba7deda0c233745e4f
SHA512 55db065227003cc41374586c413b02ad0455a529795bb863dd9922cdeb2203a3c20b1a4f6bf91956b47dd3d62b1ce0ca5bba593a6713a464647c455cc43b91fc
SSDEEP 192:sxZrRZyM/jK1Ml8MAM/f2syTX2JUjUIdpwaHW6+WNraBXAkwwSsTN5Ig5lJ:sxZrtoM/f2syTXaI7Hb8X7n5
TLSH
T1D862F715AA34A97BCCDBD219F9447B53D6F91432D2844E44AAFCCA1C00E6AED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 2ae5332fec541361c1de53abce2b80b293715661737c6e1b2a50d7a1e95fe8ca
MD5 8f75a30c294fc4d39f74486c4d323014
SHA1 8bc62ff275f0df6ad37917127b84dd63bb56df9c
SHA512 085f2b8d074a08e9793b320b1898827d6671095f05a1b67d0464211da5f8667684576d7a44c178ad8f7a6ebab65c04e128807619068ab7903ad0e24585139ce8
SSDEEP 768:Yl4TaYc7pLuLbyWWvyaZy8F1+UoAYDCx9Tuqh0VfUC9xbog/OVCxDhLlJX65jro1:Yl4TaYAEbyWWvyaZyu1ja7xDhLHq5Qlf
TLSH
T118F20B3B6C0CCB7F4F844E9CED2A7E8A6EE8018B96D88D5447F9844C02C66EF51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 9e09e500ba7b3140cd3a2fa0fdc03ea03b56838742b7cc4995868507dba35f16
MD5 13802c4f5ec30f9d3c169ecce306a0d6
SHA1 529d417268dc66a92dbc5453cab9bb25937f4959
SHA512 9bd718def6724c448ac5d4a4518c1328f1087b66ec2220346aecd45d24cf71ca1faee686f86627a0361fbabaae97b6ebef2d59a9b0ccccfbff24a34d9fe5a38f
SSDEEP 96:KsOeOROAOkOeOQOwOx7OEOrOsJOsOxKhO4JO+OxtOGOOOzOsOwOSGhyKKMaCA+KY:mJIrXJ7bc36rvF4Qpih5yvbSpFKJHF7
TLSH
T1D3E1E222373A028339BE294CA7B7873B4E4231733018E66F7BA850555D66E125DFD9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5924c4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5924c4.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 ee401cad4ae14e7d0cc6db9cb60c9cdbcba8711568331222ffbe30b39c311068
MD5 b6e98753982387107b30ff88deaa4453
SHA1 5a4e2f09237dffb4d1ed0fcd2af957cd38f49ee4
SHA512 6bea91c70c75cb4a26505821c33613a42444e577e92485817dfcbefcf25e59046a48b0e950b4ccefee366943eb998b5622ad0cd409d47eef8ce04d2a65221bed
SSDEEP 384:npZcIrsN1kteu1AZJUyN0UiX1aTzlsa+VY0GroP:hrmG9Yw2lhgZYw
TLSH
T16E828D716965AC7B88FBE151F98B33539EB460B7DAC86F84C6E89B0C00D6294130792B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 f8d2bc533bad84a8ad82aad94b991779090b5afae2744d4aed4ead88e717998b
MD5 0e83fe1261ab91196b588afa2b88ee7f
SHA1 45c70729e102a41ab09e317c089d9a6fe1b025a9
SHA512 2ec848a6d552badc7628de9f7b324ae847609a5c6579205b5f98a851411fa9ce1121365200e5f3bd65d50e3acb065a3c00319c8a674be6d1b3ce07809053a381
SSDEEP 384:nniFPZcIhsNP8TUNTUlIlAIeu1AZJUcN0UgDf4dX1aTBlsa+VY0GroP:iFHhiwgyG9yxtqlhgZYw
TLSH
T150B21976D995DA7BACF79781F64676879EF010A38ACC9EC4DAD85E0C00872DD070BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 29KB
SHA256 f8591bf32aa8c074fbdda9f37b31c1cdda0e2e6a06c08ca236db00f4af69da89
MD5 73a8a5fae55fbdafe852bc44341a25ac
SHA1 88688211a2e3d67c36b4e8664201c6a6a0908637
SHA512 b3ec124ff0d3373a7c229f4af09b5bfbc2473daebe62c5196cdc23ab1600e8d445fdaf544b3483ad0083fb70f803f65836c804ee793471c8aaa179262aea1bf5
SSDEEP 384:nniFmZcIhsNP8TUNTUlIlAIeu1AZJUcQ0UgDf4dX1aTBlsa+VY0GroP:iF0hiwgyG9DxtYlhgZYw
TLSH
T16FD2B5F598D7993AD8AE5383A77E6E429DBCD053B5885A84F7C45E0CCC821BFC306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c09e1935cc38bbe21d03e2c270cf439d623d0c2458705d074c9d0dfe928fb51f
MD5 d6387e0b41d12de176b609b1e5e70135
SHA1 62847131cdff930c4ae7f498025c4908035a7f44
SHA512 9cb94cb35ceb3318310a94f5ec2b30811fa0205b10dc89f081e01cfc80d099966ce3147ddc16b05dbd8aefa9babac576372bef0005fc2c2314577f7924b6e567
SSDEEP 192:mQJONG6zZU77QmiUylwzmaU9X1J3wEJ55U6:m2ONG6t2tRzmaU9X1zxU6
TLSH
T1E9020939A8696C7B8EE3AE45B48B37135FD4203BEA956F94CAE81B1C01D764C1307837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 1659ec977cd027c97f9af02037a83ab3b875b7802c1e1ed5aa33dfdf6e9f5a35
MD5 6610c9ce0a95b1e6f6e01c6c0acf3fae
SHA1 4bc5d464f5d6247e08e039e4cf9b593fe1779c79
SHA512 194e45df1d1bacb24f5a77ee98c565e9aed73fcd105a2ca9683177bff84f445f08dcbdf199947be231ec7c18a279c570daf1dae06d7235243d9b1284f39eab4f
SSDEEP 384:nyMZcIasN1AIeu1AZJUsN0UiX1aTzlsa+VY0GroP:yaatG9iw2lhgZYw
TLSH
T18B827C716D65AC7B88FBE155F58733539EB460B7DBC85F84C6E89B0D00C6284170792B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 1ef526d6cc50da1608f9250036f189e5bfc5b8ed7471c75806d5ff8e755eb0d3
MD5 3b2ddd9ebcfd4cccd182769e8a502c68
SHA1 570edbb6c3300e4870e3e80f1b84d4a96f9e4930
SHA512 6f724f23157f7d7cf8653bb92235e73adb8de671cf64b176061f1807f4e0901160b7f532e2a5f1242d210a6b5c46f5843ac8c1cf32ea21fc9f128acbbb22ff4c
SSDEEP 192:8ONg6zZUt7QmiUyJwzUU9X1JIeE5s/fqRUU6:8ONg6t0tdzUU9X1aT8lU6
TLSH
T114120838A469EC3B4DD7B415F4C73763AE942077DE88AF94DAE85B1C01C72482B0A937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 176ec319696c358c9d06a31960eb8e5c28b0d8bae1aa16fa00feb4e49ae213c4
MD5 863eb0b00441fdce6691d67f980dafa7
SHA1 9c63f9814cd12c79b503a776c2574b43c25dd31a
SHA512 fe4b1a5d7da3533f04a1f6f0fbb85bda968631d18426c2d6f30ec8783cb96609834046b8a77d091f125c9ea8d12bbc090f18a80ff5b8f92ca9d6a078b38f5c7d
SSDEEP 384:nQZcIEsN1AIeu1AZJU8N0UiX1aTSlsa+VY0GroP:uEtG9SwflhgZYw
TLSH
T1E8827C716D65AC7B88FBE151F98733539EB460B7DBC86F84C6E89B0D00C6288170792B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fd06d228-5848-4fe4-b468-a9a3c4720b80.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\fd06d228-5848-4fe4-b468-a9a3c4720b80.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 542b3cf93884ef615d102bce31db9d41ef5ceb2e4d584ea6352cb80d314f9dce
MD5 22b565cef0b25b635fccfe530cfd900f
SHA1 1ab0fec8bcc64017e4a938996b5b8cd7798e8845
SHA512 2f201a207a85650264bfffcdc153638e023ebaedc4ced2810c5a5f46370e572ee06679b0855f483440378bd14bca5167afb567a6efbca798782b4ceced9d0c21
TLSH
T14A412E5CA6F91149B3B7BE5AABF7686E447F78372E0AD45D00120D4F0762B40C861737
MD5 SHA1 SHA512 TLSH

Submit Download

9196dd00-8e4f-4e25-865b-11c36bae621a.tmp

Path C:\Users\Admin\AppData\Local\Temp\9196dd00-8e4f-4e25-865b-11c36bae621a.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

Microsoft_Windows_Desktop_Runtime_-_9.0.19_(x64)_20260908194832_000_dotnet_runtime_9.0.19_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_9.0.19_(x64)_20260908194832_000_dotnet_runtime_9.0.19_win_x64.msi.log
Size 2KB
SHA256 2b6405da6826f39fe392383bd6604b0e6b0b3f998d083f92861aeffde2c97d62
MD5 73c40a607b14ed09ace1cef0a07b54fc
SHA1 f906f729dc215f25ccea7a48cdcd947a5d04d8d1
SHA512 e2b45cf8d578f91116eb51896c8b9d649e6903378846c6e19022c48e481028a7dfdfab71a2a400202c676b006560810315e5760c2bb2cf03d29d0cc7303ac904
TLSH
T198410B681EE40919B1F6574BDEF3C4525B33BDC7A834CF4C23854219066790668ADBAB
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4564_1400641158\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI5E33.tmp

Path C:\Windows\Installer\MSI5E33.tmp
Size 219KB
SHA256 2bf33a9b9980e44d21d48f04cc6ac4eed4c68f207bd5990b7d3254a310b944ae
MD5 928f4b0fc68501395f93ad524a36148c
SHA1 084590b18957ca45b4a0d4576d1cc72966c3ea10
SHA512 7f2163f651693f9b73a67e90b5c820af060a23502667a5c32c3beb2d6b043f5459f22d61072a744089d622c05502d80f7485e0f86eb6d565ff711d5680512372
SSDEEP 3072:FVzl3qiEZybztEwiUx6D02cWVsV1v2vZR3X6j7zo6k2FkngTLrOrORT9flQnS6lg:FVIMEgXmEAR3oHon2VaFuG0eEp
TLSH
T1AF248D217494947EEAFA0832A57EDA71BF3DF2241760C8AEC3409D1E6D604C167B7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e595781.msi

Path C:\Windows\Installer\e595781.msi
Size 10.9MB
SHA256 2085a8a44b6fb3428e0498419ea779c1a2712750b9a885bd1795b294f656df13
MD5 9a02d0fc69f1fdda2252e8cccea91068
SHA1 f0a3deab375b7a7d27c5f55f02dd42de1a20d484
SHA512 850fa1c4bf722804cffa463e51614a96f52fb7ad6671d2f98e821c0d9b803d69d7f5c7483ec0d988e242b38717f6179f7c340e815b3cfda4ce897e4916867f23
SSDEEP 196608:ILAtLZl3gjCT7yz3KB7Za+J6PTP7TyihYqehvMycNwElAvzNLDXGVFt:IIrlTuz3K7abzTPhheMwEQzNKFt
TLSH
T12CC63341767EAA8CC5359B3328FEB5A31E6CEF3F677197C58A00B02554BA1389BCC605
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windowsdesktop-runtime-9.0.19-win-x64.exe

Path C:\Windows\Temp\{74064EF0-05A0-45D2-A683-D13001FF2108}\.cr\windowsdesktop-runtime-9.0.19-win-x64.exe
Size 607KB
SHA256 21ee8ba010669a3814268926875d3565b7166ee62db8a41b9f717b111190f119
MD5 5887634f8042d630c771b773b1adf4c4
SHA1 05f24f02f5d10601b8749457052776dbbe640fde
SHA512 723b1cef6a79828ca170840dc68079d5298f9b33bd94def165c8b815f62ce2d59985cf2ffb2ce3f2060fa605f2702c049640a6486ec16d67a187f639b8a37e7d
SSDEEP 12288:tmEsd9PZfePv3xl7ft7V+6uC+zd5qLl8S3wBfiy7nlEM0DnmX:tm39PZfePv3r7fm6t+jqpB3ipzCM0c
TLSH
T1CED47D32A5614032E7F10673B928D6303E3CE328175488AAE7D4AD1D7EB88D667F7257
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{914A85B9-584C-477E-966A-7AAC0A02889F}\.ba\1033\thm.wxl
Size 5KB
SHA256 81a68046b06e09385be8449373e7ceb9e79f7724c3cf11f0b18a4489a8d4926a
MD5 d5070cb3387a0a22b7046ae5ab53f371
SHA1 bc9da146a42bbf9496de059ac576869004702a97
SHA512 8fcf621fb9ce74725c3712e06e5b37b619145078491e828c6069e153359de3bd5486663b1fa6f3bcf1c994d5c556b9964ea1a1355100a634a6c700ef37d381e3
SSDEEP 96:MT0abTxmup/vrCKATQdYQHdYCwgoVOBq9LjP5dbSE7:OQNkdYQHdYCYXt7
TLSH
T1F1C1DBA778CF53C128731255EA925AAA5911C19C537F2DF4FC8B454B838A827A373F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bg.png

Path C:\Windows\Temp\{B3DC90E4-40F4-477F-B85B-202F2E125469}\.ba\bg.png
Size 4KB
SHA256 9095bf7b6baa0107b40a4a6d727215be077133a190f4ca9bd89a176842141e79
MD5 9eb0320dfbf2bd541e6a55c01ddc9f20
SHA1 eb282a66d29594346531b1ff886d455e1dcd6d99
SHA512 9ada3a1757a493fbb004bd767fab8f77430af69d71479f340b8b8ede904cc94cd733700db593a4a2d2e1184c0081fd0648318d867128e1cb461021314990931d
SSDEEP 48:u+Xg+NXWbdlIr33lx9W5OstaDIy3r5XpPyvZKmXYTDeiByNxcaaaaaaaaaaaaaaE:AaXWPIrHT932JsdpPyjqDeioatEn
TLSH
T19891B4D8FCF95322C6002BF255F4C0735A0215B713ABFEC82F496BD90E6878E25058B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixstdba.dll

Path C:\Windows\Temp\{B3DC90E4-40F4-477F-B85B-202F2E125469}\.ba\wixstdba.dll
Size 190KB
SHA256 dcea15f3710822ffc262e62ec04cc7bbbf0f33f5d1a853609fbfb65cb6a45640
MD5 f1919c6bd85d7a78a70c228a5b227fbe
SHA1 71647ebf4e7bed3bc1663d520419ac550fe630ff
SHA512 c7ff9b19c9bf320454a240c6abbc382950176a6befce05ea73150eeb0085d0b6ed5b65b2dcb4b04621ef9cca1d5c4e59c6682b9c85d1d5845e5ce3e5eedfd2eb
SSDEEP 3072:sjEoXsLW9OLG8Qp51ySdjDXY33b+Av7O5IkI+/AYkPAEc527uu3k/gLtxavf0ir2:sjEo8LW9553hXWy15I2YrAW7FUVEihs3
TLSH
T1FF14AF1176D0A07AEBFB16307A39A5216E7DBA200FA0C9DF63449D2B1D715C19B36B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet_host_9.0.19_win_x64.msi

Path C:\Windows\Temp\{B3DC90E4-40F4-477F-B85B-202F2E125469}\dotnet_host_9.0.19_win_x64.msi
Size 704KB
SHA256 0d81a9e820be226d2b15f8dc90e05b475871a5b0250a7d4a6d4083c88cd63b16
MD5 0368681ab717bb62e0906d84fe6e97f6
SHA1 26c3f93fc63167f8531081b169cfc980ef439e7e
SHA512 a016334e43c8aac45ed92fc1b2101d4276db0275550d20ebd835e1e43b40e0d18593c377086d27e7232d892b8326b7cc502f3daacda22b6d6833c87dca76dae6
SSDEEP 12288:KBiLV1EgXmEI3os2Qx7E4D4Rxbp4K+1uiqb:KBiLXdc3/7Rin+sj
TLSH
T152E49D137D80803AD9BA0D31853AD7B16F3DBD204A64899B6380B91DDDF15C0AF76BE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet_hostfxr_9.0.19_win_x64.msi

Path C:\Windows\Temp\{B3DC90E4-40F4-477F-B85B-202F2E125469}\dotnet_hostfxr_9.0.19_win_x64.msi
Size 776KB
SHA256 abf0fb7ef359426b67121e4c2b8bb4674ea791623bca73baccabaed390d89d9f
MD5 d211fbd50bc22ef313880510d7f88179
SHA1 3abc891ffc635b7dc5fc96e9baf559d238f5b2d2
SHA512 f314eb999541ed2a86e057411d140ca26e4705ed3c9481f077db9fe305f32ec3731b32bfe2cdcc059689b4bf3cbf2933e7f6ba38e8edc2c597140e10be8513b2
SSDEEP 12288:vwr8yrpGw29DV1EgXmEI3os2Qx7E4D4Rxbp4K+1uiq:vqrpOJXdc3/7Rin+s
TLSH
T132F4AD137D80903AD9BA0D719539D7B16F3DBE208A64889B5380B91DDDF11C0AF76BE2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet_runtime_9.0.19_win_x64.msi

Path C:\Windows\Temp\{B3DC90E4-40F4-477F-B85B-202F2E125469}\dotnet_runtime_9.0.19_win_x64.msi
Size 27.4MB
SHA256 6cdb76b8df3e2e119a6895dfc6fcc0f0d895f268bc4435f6b6ee3c294060af09
MD5 937c53d23701feb18ef5f7fafe2eee6d
SHA1 1aa155c421045d72a03551fd8f6667a4e9d9bd33
SHA512 19c1a9d2f592873cb2659024340e877ce0b764b94711cdf0b3280fe76473764d7e6916d099372524a2a640a061a314bb242344f39197194f4361cc90e30b60f7
SSDEEP 786432:I0lTuzwaHTJkMwXUoZV3KleHhUGSU7+Jnx:MzF1kMwXnZV6gHVSAAnx
TLSH
T1D6573323BE969839C4390D7215BE73611F3DAD285761C9CB57103828EDF65E09BF2AC2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windowsdesktop_runtime_9.0.19_win_x64.msi

Path C:\Windows\Temp\{B3DC90E4-40F4-477F-B85B-202F2E125469}\windowsdesktop_runtime_9.0.19_win_x64.msi
Size 29.8MB
SHA256 8bed48caee2da4c4b2da97c937f189283ab84b964a48d05ec1ccfb44a42a26a3
MD5 1eafbc1cf9459ed37429ff67fee4262a
SHA1 ad410825d89b1e43d82a48d6763d403c64b78100
SHA512 bf55d974d53593a6f2ca30cf9f7da6c6c0f4ffeb7e3ab1dc49e19e3c8612d74131737683ba4ae4e9b79304ec23a27d59095298231cdbb9e4179a7ea28a8c8598
SSDEEP 786432:sEsegWkun91a6F/T/DWsezaLlT3H+eYzW3W0R:sbCnXp9P+aAfz4W0R
TLSH
T1916733173D939539D4AA0C36C57AEB30133E7D008F19881A92A0B91DDDF51F09EAEBD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads