413a7a3288903ac934469d411f583fdbdfa464748cdcda72aca84118554fab88

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/05/2026, 03:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Xeno-v1.3.40/Xeno.exe
Size 164KB
Sample260519-dp3f6afv41
SHA256 413a7a3288903ac934469d411f583fdbdfa464748cdcda72aca84118554fab88
MD5 de61c081ab7e6fcc475fea97319e22aa
SHA1 2b50080915f72079c1d4e657eb69737dd347a3b6
SHA512 246f928696fecee01307d837a22f5c023fe5c901df13d5a3323c0443ef9ace53bad04507e881dc8a7d4bebea23fb777d68111642ce7215ea729dd481d68890d5
SSDEEP 3072:e9G2U1qr+Len2dIrOaWkQI1RcCtZKeL7GVs5FCsxmVL:eMOgIrOa17vDt46mVL
TLSH
T135F34B07A6A850BEE1A7D679C9924D41FB723C594B71A6CF03507AB60F377D0AE39302
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1060_505233923\typosquatting_list.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1060_288136674\data.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1060_288136674\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1060_505233923\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4632	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134236835320892805"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{6E5934D5-4D14-4925-8991-9143306AC6B4}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3588	msedge.exe
3588	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1060	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 4364 wrote to memory of 1060	4364	Xeno.exe	83
PID 1060 wrote to memory of 6044	1060	msedge.exe	84
PID 1060 wrote to memory of 5764	1060	msedge.exe	85
PID 1060 wrote to memory of 4632	1060	msedge.exe	86
PID 1060 wrote to memory of 5764	1060	msedge.exe	85
PID 1060 wrote to memory of 5764	1060	msedge.exe	85
PID 1060 wrote to memory of 1636	1060	msedge.exe	87
PID 1060 wrote to memory of 1636	1060	msedge.exe	87
PID 1060 wrote to memory of 3392	1060	msedge.exe	89
PID 1060 wrote to memory of 2072	1060	msedge.exe	90
PID 1060 wrote to memory of 3392	1060	msedge.exe	89
PID 1060 wrote to memory of 3392	1060	msedge.exe	89
PID 1060 wrote to memory of 2072	1060	msedge.exe	90
PID 1060 wrote to memory of 2072	1060	msedge.exe	90
PID 1060 wrote to memory of 3712	1060	msedge.exe	94
PID 1060 wrote to memory of 3712	1060	msedge.exe	94
PID 1060 wrote to memory of 3712	1060	msedge.exe	94
PID 1060 wrote to memory of 1992	1060	msedge.exe	101
PID 1060 wrote to memory of 4056	1060	msedge.exe	100
PID 1060 wrote to memory of 1992	1060	msedge.exe	101
PID 1060 wrote to memory of 4056	1060	msedge.exe	100
PID 1060 wrote to memory of 760	1060	msedge.exe	104
PID 1060 wrote to memory of 3264	1060	msedge.exe	115
PID 1060 wrote to memory of 2916	1060	msedge.exe	116
PID 1060 wrote to memory of 3876	1060	msedge.exe	117
PID 1060 wrote to memory of 1552	1060	msedge.exe	119
PID 1060 wrote to memory of 1552	1060	msedge.exe	119
PID 1060 wrote to memory of 4200	1060	msedge.exe	123
PID 1060 wrote to memory of 4200	1060	msedge.exe	123
PID 1060 wrote to memory of 3588	1060	msedge.exe	126
PID 1060 wrote to memory of 4060	1060	msedge.exe	127
PID 1060 wrote to memory of 4060	1060	msedge.exe	127

C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.40\Xeno.exe
"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.40\Xeno.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.NETCore.App&framework_version=9.0.0&arch=x64&rid=win-x64&os=win10&gui=true
  2⤵
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2d4,0x7fffcecac188,0x7fffcecac194,0x7fffcecac1a0
    3⤵
    PID:6044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1764,i,15116710110024681808,3999993680004262249,262144 --field-trial-handle=2256,i,3662269200383125655,13160586832232630140,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:2
    3⤵
    PID:5764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1984,i,10107579268551832236,1359243842060924716,524288 --field-trial-handle=2256,i,3662269200383125655,13160586832232630140,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:3
    3⤵
    - System Time Discovery
    PID:4632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2504,i,5600005098874674936,8755223371986503196,524288 --field-trial-handle=2256,i,3662269200383125655,13160586832232630140,262144 --variations-seed-version --mojo-platform-channel-handle=2676 /prefetch:8
    3⤵
    PID:1636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,9244377677860672549,16325751495274072772,2097152 --field-trial-handle=2256,i,3662269200383125655,13160586832232630140,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
    3⤵
    PID:3392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,1131805522086599633,18306013077671135300,2097152 --field-trial-handle=2256,i,3662269200383125655,13160586832232630140,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
    3⤵
    PID:2072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5028,i,11605208274343986403,4554426348194907787,2097152 --field-trial-handle=2256,i,3662269200383125655,13160586832232630140,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:1
    3⤵
    PID:3712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3548,i,12456457894594436412,9674628851032452553,524288 --field-trial-handle=2256,i,3662269200383125655,13160586832232630140,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
    3⤵
    PID:4056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3572,i,12281673234901650108,2660964972540928036,524288 --field-trial-handle=2256,i,3662269200383125655,13160586832232630140,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
    3⤵
    PID:1992
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,1872336073447038609,10500823825887253308,524288 --field-trial-handle=2256,i,3662269200383125655,13160586832232630140,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:8
    3⤵
    PID:5752
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,1872336073447038609,10500823825887253308,524288 --field-trial-handle=2256,i,3662269200383125655,13160586832232630140,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:8
    3⤵
    PID:760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,14525596636501614177,14108890043860345038,524288 --field-trial-handle=2256,i,3662269200383125655,13160586832232630140,262144 --variations-seed-version --mojo-platform-channel-handle=700 /prefetch:8
    3⤵
    PID:3264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,1868832605805536518,11584702368101026394,524288 --field-trial-handle=2256,i,3662269200383125655,13160586832232630140,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:8
    3⤵
    PID:2916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5776,i,214611499180439232,6932242266314548615,524288 --field-trial-handle=2256,i,3662269200383125655,13160586832232630140,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:8
    3⤵
    PID:3876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5564,i,14781850120285535480,16716980264889390633,524288 --field-trial-handle=2256,i,3662269200383125655,13160586832232630140,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:8
    3⤵
    PID:1552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=864,i,9816710216057975782,15828196437521353329,524288 --field-trial-handle=2256,i,3662269200383125655,13160586832232630140,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:8
    3⤵
    PID:4200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6000,i,16712243362750947155,3813817967062255522,262144 --field-trial-handle=2256,i,3662269200383125655,13160586832232630140,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6396,i,8881306838010224718,6241522230442896326,524288 --field-trial-handle=2256,i,3662269200383125655,13160586832232630140,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:8
    3⤵
    PID:4060

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5680

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3872

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

data.txt

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1060_288136674\data.txt
Size 145KB
SHA256 5f9da8ac4889421d2020e6246daa63b3d5d4fb5a19019b1c20fc803481f01484
MD5 b4802e5464604d772904c865a0d5e532
SHA1 77d577350787cc6d5fe65bdcb5e2a574f552fcf7
SHA512 05205448cf3424787f64bc99dd6b958ec497f1963a2d37a7fcac3cc9676b389e151ea456913c36358d07a92b6864557927fe0f53c37f890bb285a0e5446fd31f
SSDEEP 3072:UPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEgG5v7UFSk8KH99jo:4X1aI5aZoKzMJ07NJB7U58KPo
TLSH
T15CE3F220CDC45FD8DFAC252C90BE0B1DA391C69D842A7686E763FE4ABF9760452271CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1060_288136674\manifest.json
Size 52B
SHA256 90f59dd0f7cd3fb4906d133943819da7aaf33f7ae5b5a0241e03ddea2611885d
MD5 c86c55c53e2bf572642bd11d17a15dff
SHA1 dd16da5cbdc5519179a01396cb94f1194a814939
SHA512 a079421f077a5f2b822469efb6f4b1822e095beff27b2d1551c74d1d880c9fe085bc0f64ea040d17be2d2ad2969051e13f3a782e72bfa692752a16c3316fa49d
TLSH
T185900270042591172AC10E506570F8859391661955860D1D08551548029546CE4502D8
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1060_505233923\manifest.json
Size 118B
SHA256 4b3be55f09ddc486485a1e8b1d551f970646384a8bf530a9211a47a68bfb5058
MD5 9a19fd388e446c195b1b6e81936be92e
SHA1 33ecabb6c265eb85b65df37d776167cf6c422e6d
SHA512 84fda76a03333473d738e218e25e261c2dfede223d45e9a39c2f0a1b486dd162889580361f2988e7d04d16be70fb62ccdeacf135b1b3d071e14bcb0c09b9da94
TLSH
T118B092B00C5AA47B22C09360ECA06A8283F81218E8061B1A089036482F9817880362F2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 a3a0c0c63e7ab274a64ad6a740f96b551d026bbd3d3479c01d73c2e5d297870d
MD5 d89245e78bbf723e45e4d9b58f50dddf
SHA1 a4971d0c7c0d247d54594218651e96b4e32aeb6f
SHA512 87cb215f6a9294c0dce8544f5d44b8d4e547d204db768c89bfcb46bd5b5172ad003604add451c96e63ab7dce5a7e8264674f09be36e9745d66954c193e466247
TLSH
T1EFE022B6D862FC2708FD07A8A4098746EB1013173B80896F3B3C82088FB473B45DAC5C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 2847c6c846688013bdf009bb5bf3ea8256d6f07e00b3c900dcb2a2062566867d
MD5 d1b2592e6adcfebc28949849762861a3
SHA1 4806390b20600e78affab692f274e6b99e36a96c
SHA512 1f3973189e6e5513a9b33aa9a8d91f602531458011da58ec853eeac62750d7a1f0d6354084fe01045f5aa3ab7b15dee9faeebbc81dd162c63809ccfff8c6383c
TLSH
T1A641BDF3C7E8856E891196F0BA18AE2FCE1D0910432C3D9A85E4EF1B93E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 7b0e90316b7dcd0f918fe4d6ef4c6cac071adf5808f8d812994cfab2a3259026
MD5 e9d852edaca1f20808ce5affd48cb357
SHA1 ebe18077f07122d70c8844a9334ecccc08cae605
SHA512 41ace623d6f03b0abe3a2171c4989144d0ac01cbd568e12a61e7e1156159acf2503265421c6e02f20219fb960a131db3c109c60ee7bb08683b4bccd277aa2248
SSDEEP 192:sxZURByMqZjK1Ml8Mjo/fCssjJaZdIaRuv1zodp6mHW6+WNredI/YvSC+UEVIgj3:sxZUK7o/fCssjJazIKYexHbT/7bj3
TLSH
T1A862E80A6A34597B8DDBD209FA45BF53D7F80563A2944E4499FCCB0C05E7AEC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 4488383e89ab040f535e4f32cce606267a860c4c11c5f7bd976ec1923726b9b6
MD5 61d5930c1a0235e2efb6c8e7c4710add
SHA1 c9d3d56e702f01bcac4348eab20d2a2e7acef211
SHA512 02a7cf233a263c84345a9a47af5dea41ef231c38df6227eb6b2f0d163c4a3405430c5ae5bb35a1aac6967bc11d3216585febadcab756f98f4312435df0284343
SSDEEP 192:sxZURByMqZjK1Ml8UQVjo/fCsKYZdIaRuv1zodp6mHW6+WNredI/Yvi+UEVIg5Iz:sxZUKqxo/fCsKYzIKYexHbT/Sby5p
TLSH
T1D172E91AAA34597B8CD7D219FA45BB53D7F80563A2944E4499FCCB0C05E7AEC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 d4f350fe97b5057b1e00c40e312cf04f37711d8880d85a43dcdbad1a21643481
MD5 67abcc5035e5fa322c0464724116151b
SHA1 da34898f4a80d5325a6c1bb841bd657176711c21
SHA512 87dba719701ac4f2bc437450e864ed055a0160d5facdbda3293bc400a3fc5a4fc9430eb2ae8c1f6ead8fbff0703cdb7b414e9fb4e86c3a6788bb8fcfc7fcaf39
SSDEEP 768:ZYsv8OdF6ssi7pLuLnFhWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVVysy10Lli:eY8Od/HEnFhWvFvmXu1ja9t10Lm2Nus4
TLSH
T151F2FB3B6C0CCB7E4F844E9CEC2A6F8A6DE801CB5698895447FA844C02C76EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 1f2944489d5db73ded2c35c6675a1e3560d460fd038c7f33480b38f35dc1dd48
MD5 23d28c5e56e3d5be160d7687ef4ec989
SHA1 3beba04592107f6941770530e925d71eaa147e6b
SHA512 dcb2fe420f16afc88157102c885b22957358d04a7d85a0e8f841a25f596b25239e291bdc3207c1c0cf4ff2d2e6345a0c091c30fd0ded0eff0cab2a875a230e01
SSDEEP 96:Ko7iKcsW23iKoM7LKKc026WEKjKkAAK9Gq+xGKqkJ7yKkc++dmKWI94gK966GbGU:05ppxnY753RNBvRJJdt7p5J95JnQ
TLSH
T187B27D5A703A0211397E2998B39696364F4135A37058F4AF7FB814A54F2BE224CFDCED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 377d7eb60ac7eaf19eb68bb5087e03d46b365bdf0428d1d858fd6931cbf18175
MD5 3739ccc4a927ab7aa8f3daf05628da83
SHA1 4db0d4d981259299a16085f8cc94c1d2361cde97
SHA512 a98763d7b1fa1041b2fefb5462d709a5de704c707109723e1ce0411b708eefe0ebcbc81140ca2bd78ac9b42080d3878b02f6d0a70165b9d7c68b8529ca5f7bde
SSDEEP 384:nviF9CcmyWCU3sNq8TUNTUlI4LQckCr6BkphifGGJf4KqPL7Wuo5pie4KV8p0ILL:6FccpU3bwgCkTCFGPqPnWuoWI8p0ILL
TLSH
T185C25B36EC68CDB7ECE74F89B75A3607DEE4516386DC99D8DAD85E0D00871AC034B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 31KB
SHA256 65543eaa65d108a40b60a49a645bbe41d053fd0b4a03841b29b9225638f00488
MD5 cb8fd52db58543d8b394030ca24bf2d8
SHA1 8d98b447c89156bcb9f6137149dfbafd55e5ec80
SHA512 9d2abe37fb4a9158fa8f4393aa14ca379fa83d7a4feff9deb637e14bf1c835221386405cf18f09c55e5ddc5789abacf24426107e27d34d6e851bff1329eaac15
SSDEEP 384:nNiF9CcmyWCeY3sNq8TUNTUlI4LQckCr6HkphifGGJf4KqPL7Wyo5pie4KV8p0If:EFccpv3bwgCkVCFGPqPnWyoWI8p0ILL
TLSH
T1C3E2A1F598E789B6D8AE4B4B673E2D069AFCD16375884994FBC44D0CCC861BFC306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 f0fbf718f75d1171ed227e27c1f3c2a4cc7807980efdf001f75974072a1a0917
MD5 eaf0f4bbdaf5ca8c3a8337e618f01799
SHA1 b1d7846509347fe5562f4407af7e46bd45439315
SHA512 d20960b0f599ab864beb7ac0cb61a616c854ab9b5c4e75b94170284e4100b96bcaeaa511c9e7a712fbfbdea8a7cc4917a34ca5ea7b56891611144dce81ed2d10
SSDEEP 384:npkiF9CcmyWCs3sNX8TUNTUlImpcmQckCr9lDKphifGGJf4Kqho8pwe4KV8p0vHO:p/Fccps3Wwg4cCkU5kFGPqhoVI8p0vzC
TLSH
T133C25C36EC68CEFBECE74F99B74A3A07DEE01263859C99D4DAD85D0D008719C530B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 56a2999c39463c8c755d87bf264380cae0d29168e03895b1acae091c1dcf0154
MD5 c32c1c3d99987b520718dd473fc50836
SHA1 55d0a0999da5b428a36b45bb7732acf14aef2afa
SHA512 8fabe91199e425148b35fd49d2ea9019a11630f2ea642238daa5799a0ad9df0e466e0c2ece75cb3959ec7c8fe8e0072a5a08d755187accabc7b0abfdc2079481
SSDEEP 384:np7iF9CcmyWCU3sNq8TUNTUlI4LQckCrNBkphifGGJf4KqPL7Wuo5pie4KV8p0If:pWFccpU3bwgCkuCFGPqPnWuoWI8p0ILL
TLSH
T1D6C25B36EC68CDB7ECE74F89B75A3607DEE4516386DC99D8DAD85E0D00871AC034B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.5.19.1\typosquatting_list.pb
Size 397KB
SHA256 a2ce65565de87ad65e06a827fa388c975c9231d335beaf67ec4011b39f3e69f7
MD5 88ff091d8125bda1a06ed624cbb39219
SHA1 3ba3dd813cf25e39d8118ac38c98d58d80107f9b
SHA512 c48448a9028b059e9a0f6651c8552782472fd5efc77d35464b7acbc2b1a3d782adf6f48056779c6f67ae3bac6f20761c760d36cc543ab3a730c7de4ef528e27d
SSDEEP 3072:nOmXKKKxPTa5ORUEaT7sfD0yTFSp1+A9q9JyNrylwks:baKKxe8avgVr9YN6wks
TLSH
T10D84A3B9DFC00150DB78112D20BE71D8181412A580E9DFEAFE7D865F2BC2AC977E85E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 76c44ef7f20dc5bd1d62411666a6fb62dfd05af663de30bc86be860e2640f317
MD5 733a4f8548d1aeb13b233fb4c685fbd9
SHA1 4b83cd3d84d27dacff9bdf40faf8f19dce98ccc7
SHA512 3f27bfa73db7d9723ff11f37f47907f60ecef2cff2b81ad7d484a26ed1433ae41f9cc082027422b7a3946eab97b7802f53791f8e0cbfc507afc5c050c2cf1500
TLSH
T11B4142E15C385AD1C4BD0E7EB4CB74FCC5E8D629F5A0717E6C58EA940A2DA0D648143F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 0e426fb96184e2c1639f5631cc13f3774ef0507a37b01382b28500629f0ba230
MD5 4607fae3db63fb2c17ea4a470bf2ea8b
SHA1 eb9f515ba45b8a5653520104ef99937f8b30f63d
SHA512 513687eb2b736b379657b8fb069147502c803bd1becacd9d44c280c020465d96ccb97dcd68081a835525679b17736fa61aac59e4790bd346ce20c79629d0afe3
TLSH
T167414D58A6F91148B3B76F5A5BF6B45E487FBE372E07945D00110E4E0A66B40CC71733
MD5 SHA1 SHA512 TLSH

Submit Download

memory/760-171-0x000001E1E85F0000-0x000001E1E95F0000-memory.dmp

Download