413a7a3288903ac934469d411f583fdbdfa464748cdcda72aca84118554fab88

Analysis

max time kernel
148s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
19/05/2026, 03:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Xeno-v1.3.40/Xeno.exe
Size 164KB
Sample260519-dp3f6afv41
SHA256 413a7a3288903ac934469d411f583fdbdfa464748cdcda72aca84118554fab88
MD5 de61c081ab7e6fcc475fea97319e22aa
SHA1 2b50080915f72079c1d4e657eb69737dd347a3b6
SHA512 246f928696fecee01307d837a22f5c023fe5c901df13d5a3323c0443ef9ace53bad04507e881dc8a7d4bebea23fb777d68111642ce7215ea729dd481d68890d5
SSDEEP 3072:e9G2U1qr+Len2dIrOaWkQI1RcCtZKeL7GVs5FCsxmVL:eMOgIrOa17vDt46mVL
TLSH
T135F34B07A6A850BEE1A7D679C9924D41FB723C594B71A6CF03507AB60F377D0AE39302
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 15 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3764_1963228005\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3764_1317469222\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3764_1317469222\us_tv_and_film.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3764_1317469222\english_wikipedia.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3764_1317469222\female_names.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3764_1317469222\model.markov	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3764_1317469222\passwords.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3764_1317469222\test.txt	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3764_1317469222\male_names.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3764_1317469222\surnames.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3764_915812833\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3764_1963228005\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3764_1317469222\ranked_dicts	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3764_915812833\data.txt	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5284	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134236835546551226"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2746394149-3500112804-1243524366-1000\{8D8B5FD6-A63C-490A-8289-1C7DD34DE0E7}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3744	msedge.exe
3744	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
3764	msedge.exe
3764	msedge.exe
3764	msedge.exe
3764	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3764	msedge.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 6072 wrote to memory of 3764	6072	Xeno.exe	81
PID 3764 wrote to memory of 3244	3764	msedge.exe	82
PID 3764 wrote to memory of 4092	3764	msedge.exe	83
PID 3764 wrote to memory of 5284	3764	msedge.exe	84
PID 3764 wrote to memory of 4092	3764	msedge.exe	83
PID 3764 wrote to memory of 4092	3764	msedge.exe	83
PID 3764 wrote to memory of 5984	3764	msedge.exe	86
PID 3764 wrote to memory of 5984	3764	msedge.exe	86
PID 3764 wrote to memory of 6040	3764	msedge.exe	87
PID 3764 wrote to memory of 6040	3764	msedge.exe	87
PID 3764 wrote to memory of 6040	3764	msedge.exe	87
PID 3764 wrote to memory of 1908	3764	msedge.exe	88
PID 3764 wrote to memory of 1908	3764	msedge.exe	88
PID 3764 wrote to memory of 1908	3764	msedge.exe	88
PID 3764 wrote to memory of 2408	3764	msedge.exe	90
PID 3764 wrote to memory of 4620	3764	msedge.exe	91
PID 3764 wrote to memory of 2408	3764	msedge.exe	90
PID 3764 wrote to memory of 4620	3764	msedge.exe	91
PID 3764 wrote to memory of 2924	3764	msedge.exe	93
PID 3764 wrote to memory of 5316	3764	msedge.exe	94
PID 2924 wrote to memory of 3220	2924	msedge.exe	95
PID 3764 wrote to memory of 4640	3764	msedge.exe	98
PID 3764 wrote to memory of 4640	3764	msedge.exe	98
PID 3764 wrote to memory of 4640	3764	msedge.exe	98
PID 3764 wrote to memory of 3252	3764	msedge.exe	99
PID 3764 wrote to memory of 1744	3764	msedge.exe	100
PID 3764 wrote to memory of 1632	3764	msedge.exe	101
PID 3764 wrote to memory of 3300	3764	msedge.exe	102
PID 3764 wrote to memory of 3300	3764	msedge.exe	102
PID 3764 wrote to memory of 4564	3764	msedge.exe	105
PID 3764 wrote to memory of 4564	3764	msedge.exe	105
PID 3764 wrote to memory of 5092	3764	msedge.exe	106
PID 3764 wrote to memory of 5092	3764	msedge.exe	106
PID 3764 wrote to memory of 3744	3764	msedge.exe	107
PID 3764 wrote to memory of 5448	3764	msedge.exe	108
PID 3764 wrote to memory of 5448	3764	msedge.exe	108

C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.40\Xeno.exe
"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.40\Xeno.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:6072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.NETCore.App&framework_version=9.0.0&arch=x64&rid=win-x64&os=win10&gui=true
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x354,0x7ffe74afc188,0x7ffe74afc194,0x7ffe74afc1a0
    3⤵
    PID:3244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1572,i,17616960811727438855,6692671900242840704,262144 --field-trial-handle=2092,i,3111643343161458105,17751407890201100259,262144 --variations-seed-version --mojo-platform-channel-handle=2084 /prefetch:2
    3⤵
    PID:4092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1792,i,15979189926940474556,6123028874680085462,524288 --field-trial-handle=2092,i,3111643343161458105,17751407890201100259,262144 --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2564,i,8917218704674895186,5503619832729181081,524288 --field-trial-handle=2092,i,3111643343161458105,17751407890201100259,262144 --variations-seed-version --mojo-platform-channel-handle=2552 /prefetch:13
    3⤵
    PID:5984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,904473576855457995,1432988140147625539,2097152 --field-trial-handle=2092,i,3111643343161458105,17751407890201100259,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
    3⤵
    PID:6040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,4476652849311212302,379069259324465231,2097152 --field-trial-handle=2092,i,3111643343161458105,17751407890201100259,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
    3⤵
    PID:1908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4956,i,12401070303252396719,9984593691882980078,524288 --field-trial-handle=2092,i,3111643343161458105,17751407890201100259,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:14
    3⤵
    PID:2408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4948,i,16894635494914147783,8525603835861359363,524288 --field-trial-handle=2092,i,3111643343161458105,17751407890201100259,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:14
    3⤵
    PID:4620
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,15398393313314298823,7731104540890860773,524288 --field-trial-handle=2092,i,3111643343161458105,17751407890201100259,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:14
    3⤵
    PID:1008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,10615052987100283109,15434583452152849097,524288 --field-trial-handle=2092,i,3111643343161458105,17751407890201100259,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1128
      4⤵
      PID:3220
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,15398393313314298823,7731104540890860773,524288 --field-trial-handle=2092,i,3111643343161458105,17751407890201100259,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:14
    3⤵
    PID:5316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=6156,i,4346923604823825676,12681054877647648565,2097152 --field-trial-handle=2092,i,3111643343161458105,17751407890201100259,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:1
    3⤵
    PID:4640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,3269731208901470161,5348953019014604538,524288 --field-trial-handle=2092,i,3111643343161458105,17751407890201100259,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:14
    3⤵
    PID:3252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6500,i,2803289151130696823,16281138212845840351,524288 --field-trial-handle=2092,i,3111643343161458105,17751407890201100259,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:14
    3⤵
    PID:1744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,12913086551790699497,1409829281774496105,524288 --field-trial-handle=2092,i,3111643343161458105,17751407890201100259,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:14
    3⤵
    PID:1632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,8315875277928646296,11767772463299477643,524288 --field-trial-handle=2092,i,3111643343161458105,17751407890201100259,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:14
    3⤵
    PID:3300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5988,i,1758833209665025571,16355038757183918039,524288 --field-trial-handle=2092,i,3111643343161458105,17751407890201100259,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:14
    3⤵
    PID:4564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=868,i,14048924131744284463,270957068813029049,524288 --field-trial-handle=2092,i,3111643343161458105,17751407890201100259,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:14
    3⤵
    PID:5092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5168,i,6064492959010117940,15526019664314079034,262144 --field-trial-handle=2092,i,3111643343161458105,17751407890201100259,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6472,i,14569162432282767839,2478788544183259103,524288 --field-trial-handle=2092,i,3111643343161458105,17751407890201100259,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:14
    3⤵
    PID:5448

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4268

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4508

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 79054d3106248f0ce580d1442e78fcc5cc48ea2a5eb3b58c6aad98c7106da4b2
MD5 89a1e1173735f4835befe22b5e8bb285
SHA1 d6f781e38a6443407276a07888372638a8f2106f
SHA512 1f5c9b3554cf3bce4cd1214982a8df00dcc74324e66dbddb67a94598fbc762dc44d06c78c7a30a27a408611eba6e2715e40527ce854f203815d9515ab7dc00ce
TLSH
T129D0C0363A2D3003D3195331E042C703332704701C43E201E110C00C9D784D1D3C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6b09340cb22edbf71e0f90763fd435b35e26e3a84e71f4c033073dc564ceacd0
MD5 de82f6df0733dc6e89fad64d305f5367
SHA1 f27019be86cb5f8ddd353a4dc0ef3c6cfe6da7db
SHA512 b2443f684be01ef337dd32e8e1253d69b81d20f7291a2a1fa8998d0f723bb6bc114ee5bce6cc270ceadc8b45e5d854eb59b93ff60a8a13d338c218e132c169ff
TLSH
T19DD0C0323E293003D3055331E082C703333700701C43E201E150C01C9DB84D1D7C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 1d47b2e9ac08fd9a8432f6e86d1ea25c8934e0e4a027c84bdce9c77637c9469e
MD5 f9d74fee2f1c8e593ce30633c991e5bd
SHA1 6d8c07d210c7a71f3ab4e67a56c16d7e3f352622
SHA512 a3c0091c626ba302f0d6aa9a7c5605cfe62fc0fed9454908eaf3d8e1aa0dd82a45168542789330038ca9d28b0aa8133f216990afc2a4be49792498226461b250
TLSH
T101E02BEBC930AC2718FD4B19A165174AEB51135B2780886F7B3D850C8FF172A0685C1C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 83d2443de524b23b35b302b2cae719599fc187770458795e2870bc99d2998d52
MD5 be43a9588bc483780a2087d71faea8fc
SHA1 89cacf255e568ec0254833235182b6d4f67bfd51
SHA512 1cd7501c53621e31809e0f3cf475d30cf1f70815f644fea82d9ee0c9e59812f1e652795e642bdc44e9e1bf44c958b47b98410711ff9ed9a2485a9586f8f74027
TLSH
T1AA519BF3C3E8856D890156F0AA18AE2FDF1D0A15432C3D5A89E4EF5BD3E3471E102A5B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 a3467aff978a19ce0d5a156ba8827d6034b0e67569eb682454caa6292dc1cd00
MD5 7522857583efc833ae00359304bf41f7
SHA1 88636a006e9a8dab60e3481d5f0f16cb9cf42241
SHA512 c37a0822893aa18380a38a8c47e0ff5703ccd2b638ed7e979f4aac7ca7a1c64d03ddc13e2e26c560806d70c3cef41fd5012de53ea264d23c22eb17a91302ce87
SSDEEP 192:sxZ+bRayMqZjK1Ml8McDm/f7Xs8ceXxE0CXUyynDcMzodp5b/W6+WNryx/Y0dmWp:sxZuz0K/fDs8ceX60Ly8qB/bs/5Nhjn
TLSH
T12362E806AA3899778CDBD209FA457F53D3F9156392504E449AFCCB0C04E6AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 85531c1ec332a9ad6fe148b4e8d7ecb31e6739aac820c947743dc4ca95ded438
MD5 1cefc4313ab51e7f36ef48005f06a438
SHA1 2e58a5bb7154aae67bf661878993b6e98bc19b71
SHA512 fc07e920e26e9ca2e11f9d4cd34e3c7d1ae6a18f17971173d73a59064e8be97a358a9ac0127ff874c4c0bfd04bc49fbdc52c7609986bc193c0a5bf2ed97b346d
SSDEEP 192:sxZ+bRayMqZjK1Ml8UQGVcDm/f7Xs5etE0CXUyynDcMzodp5b/W6+WNryx/Y0dDn:sxZuzqRK/fDs5e+0Ly8qB/bs/5khDo
TLSH
T15772F806AA3899778CDBD219FA457F53D3F9156392504E44AAFCCB0C04E7ADD221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 5b7eb819a7137fb0e6443b545ef4f3ba0a351bb473bdac596b9907f17590ee39
MD5 1213bdc86f5eb7f55891e1f5193c9980
SHA1 cab7b4412122aae0f48e0e2f5a29a3dedd79f496
SHA512 b30d9a9154f62fc23aa7a0b8e55571bb4df1c135a9f5e59ed2fc4eb14ac53ab35b84cd73a8358cc7e64cd1efc2526bb859f8eaad018c50a6a1dbcc103dad5ae5
SSDEEP 768:ciWKy8Eq2A17pLuLn5dWRm5rQW78F1+UoAYDCx9Tuqh0VfUC9xbog/OV3K3pQLls:ciWKy8Eq2ADEn5dWRm5rQW7u1jaKK3pj
TLSH
T1C7031B3B680CCB7E4F805E9CEC266F9A6EE8018B6698895447FA444C03C76EF551B4DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 16f298818193edb6db5f2746fa821c734475344157acd45174adc84c30fb0d5d
MD5 5b7d9be72389e21bb4c0b49fa7f13e9b
SHA1 666eec22d3dc86822451aca16edcf7438f015420
SHA512 7495e7c9a7cc7b29e6267492fe739a25177872f9713f03181529661e5d5e7c4444b85db9d948bf51cf9bb45bd45bb40b2415a67e29ba18ac271ebf8dc50b0eff
SSDEEP 768:AFBHhTofhno2mB21q3Llbfe3sLDdeEpYt1UHv72jTd:AFBHhTofhno2mBea2jTd
TLSH
T187B28E52717B12023C3E290CA7A69B370E4272A3345CA56F3BB900B64E67E615DFC9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 31KB
SHA256 2f4134b77e58902ed30118278fc093c690b0f8466d488d58100950991b75d0ed
MD5 b9b675a9b0ffc5fa8538d5b7f379897b
SHA1 121dd70fe10840c2f01ddcb2c2af7a8ff13a9f70
SHA512 9de211d76dc0ed6216c2298b5ca25f2610d1768f8a99bcdac3036c1e91597c725685bbed4a2ec65d2b8bb25dc014ec3a88fdbd5b0864bc6867a917354d6ed38f
SSDEEP 384:nUiF9CcmyWCk38NN8TUNTUlIR9ytM+F4djf+8oug9FfggF1wKE1hkP+lFYS/CHys:vFccpk3+wg5+F4oug95vTw/1hkoFYS/+
TLSH
T191E2B3F198E78977E8AE4797A73D2D429AFCC063B5888994B7C40D0DCC861BFC746816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 ed3ab34e6ee3c54e6fb130c6d1552bc39a5999e47618a1055385e11e9198929e
MD5 78e2ff654c3700852c9de94d7d76675c
SHA1 612d6144d7de035a4a71438af84f56644b4c7130
SHA512 b0b5e2c4ca13e6dbb9a1b3d603afad7fabc9f3384e0b9cd54ecb90e87685737ce6cdb787eba926a6b2adf2550698b0a510e160594890aab7cac27c6272e1e413
SSDEEP 768:jFccps3/wgq1SvOoug95vTwRVhkoFYS/fz:zs3o1Sl5krhkoae
TLSH
T12AB25B32ECA4DABBECE64F89F74A7A07EEE10163858889D4DAD81D5D00CB19E0747C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 ea53670eacbcaf7868186faf3fea63b2756c27f86f2454ec2581ace84dec55a8
MD5 b4d611a2271ebbc2f82bc4ae1683b3ac
SHA1 192c19522e04f54c30a4f0790e31362e5c2ed0b3
SHA512 9d684fd4e0e508449f8b41b1bd31d0bfc88fde7292affae28c42483d6f9481096120ef7b3848a5a4b48df0e0b159aab5241319b3e62556cb6aacab390c1609f4
SSDEEP 384:niiF9CcmyWCk38NN8TUNTUlIR9ytc4djf+8oug9FfggF1wKu1hkP+lFYS/CHy/7o:pFccpk3+wgh4oug95vTwv1hkoFYS/+
TLSH
T183C25B31E8A4CEB7ECEB5B99F75A3A43EEE0016385888DD4DAD90D1D009B1DE174BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 3ed21fa58526a005d0960d19d369cd4e01390d5c9c1ae8b13f2c7311cc63c919
MD5 4ade99e884bdef92ab9252c8f8032235
SHA1 2a67eaa55131b2811d60ca7796f549237d14bb61
SHA512 082edd25ce2d61495c6afb6ab0c810e82eb6939a2e18b35d04515bdf053f2f4a3402d1ca8f79b0afdf294a1586c1cc481f3bfccb1d993e96834e5a25610bbab1
SSDEEP 384:n5uiF9CcmyWCk38NN8TUNTUlIR9yu3c4djf+8oug9FfggF1wKu1hkP+lFYS/CHys:HFccpk3+wgI4oug95vTwv1hkoFYS/+
TLSH
T1D9C25C31E8A4CEB7ECEB5B99F74A3A43EEE0006385888DD4DAD90D1D009B1DE174BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.5.19.1\typosquatting_list.pb
Size 397KB
SHA256 a2ce65565de87ad65e06a827fa388c975c9231d335beaf67ec4011b39f3e69f7
MD5 88ff091d8125bda1a06ed624cbb39219
SHA1 3ba3dd813cf25e39d8118ac38c98d58d80107f9b
SHA512 c48448a9028b059e9a0f6651c8552782472fd5efc77d35464b7acbc2b1a3d782adf6f48056779c6f67ae3bac6f20761c760d36cc543ab3a730c7de4ef528e27d
SSDEEP 3072:nOmXKKKxPTa5ORUEaT7sfD0yTFSp1+A9q9JyNrylwks:baKKxe8avgVr9YN6wks
TLSH
T10D84A3B9DFC00150DB78112D20BE71D8181412A580E9DFEAFE7D865F2BC2AC977E85E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ranked_dicts

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ZxcvbnData\3.2.0.0\ranked_dicts
Size 865KB
SHA256 5820d0bf9cfc363ff929492b1eb6df430039f4ac0e212a5b5411f7c2614f79d0
MD5 959460a18173908111523bbf4c39073e
SHA1 c42a9a7042f6d87a6a9de7f9bf378f1fe9485fcc
SHA512 291decc0f58cf71d7929a52d2c21a07590c02bcd202b73fb20391d6d0c7dcbe3aec24e02606f22dbd589ee2546a0eb8414c232f74ec646a1f26496c280705600
SSDEEP 12288:8WG0mOflZV35OtQm/b1Ed7pJPR3cjqKMjgP/pwH6sKFbEb3d4CPLsVQCcekWpH6m:k0m0lH35mVb1AJPtOl/06s6Wd4iBSsG
TLSH
T1AB15B071E714177E5A9F23AF98856B4546799302982204EAF7A6034D810BDCC63BFB3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 80f5e0641140c2b188c4fdb52feb8852aaf71530e200df5245752907ad6b231d
MD5 7695b0a8085849d1c41d7315310fd5c8
SHA1 696e45ae5ea2227a4b05247ba6dd46a935fd94df
SHA512 55e69f3bfc83cec6adf1e4c1d40ca1b1f5b83b3edb604af41a21c905a32af1d11eee16c00022e59b8a509e61c84249943a07daa5112be9a31b2b1dcf7a25dca0
TLSH
T16F3165F15D3D2AC1D0BD0EAF648738FC95ECD726F4A471396454EDA8063920E618187F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 5b7334f175da8349c460c141a2f1c15947f122c4165046bd7886bb35010a4707
MD5 8ffe59e3a0954a0a2e2af8867b78b07c
SHA1 eda0189b32b03d4d9b1dba63f50c0d7b19f92414
SHA512 4c85d43010f7f0dfb1dfd5532a7aadff5cf995a3f2fffd39f35d8ccacd0efb928a0934d5e330cef298adf1bb6cdb14d67d1160f580b04cbd658868735dffda7e
TLSH
T1853143E25C3D2AC2D0BE0EAF648738FC94ECC315F4A830396458EAE8463A21D218147F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 9c3ac9af9e96b4cdc83e8dfebee2afe490cb167e18bfb715c0663065629eb709
MD5 6cfac258c7d27d9f2f042ee3c9932db0
SHA1 6bb3e0fd99d90e35ed9e3f8bdb1ca3f50431192c
SHA512 8826d9af65a9f7ea388f0275528961a79ca5e710b0b4ac2cdaba8b40ee6d74baae705cd78cb4f771a3520cec078ac53cb04eff6ae4cd85022d4acf0fd0a9eb8f
TLSH
T1644166E25C3D29C2D0BE0E6FA49738FC95ECC319F4A4743D6858EA98463961D258147F
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3764_1317469222\manifest.json
Size 69B
SHA256 c0622dadf4ec10ce5f4a64e3f24956b750345dcc194d0bd3ff73cfce1bf6081e
MD5 fb0d9796a86299d3689982f7a949dc6e
SHA1 6179cd612ac0dcc44d0659c7c99d1e0aecbf206e
SHA512 e3e1a18be661da9d450a30a37d24dc08dc8de628a104ce0f4197214ce6f27a2bf9de3eca1c1697fcfa3c601787ca7a6b5e30a5fe3d6ae3b2c10f1ab34af22fd0
TLSH
T141A022200C2088FFF200E3CC0020E380CF28A300A2088C0A022220002280CB80200320
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3764_1963228005\manifest.json
Size 118B
SHA256 4b3be55f09ddc486485a1e8b1d551f970646384a8bf530a9211a47a68bfb5058
MD5 9a19fd388e446c195b1b6e81936be92e
SHA1 33ecabb6c265eb85b65df37d776167cf6c422e6d
SHA512 84fda76a03333473d738e218e25e261c2dfede223d45e9a39c2f0a1b486dd162889580361f2988e7d04d16be70fb62ccdeacf135b1b3d071e14bcb0c09b9da94
TLSH
T118B092B00C5AA47B22C09360ECA06A8283F81218E8061B1A089036482F9817880362F2
MD5 SHA1 SHA512 TLSH

Submit Download

data.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3764_915812833\data.txt
Size 145KB
SHA256 5f9da8ac4889421d2020e6246daa63b3d5d4fb5a19019b1c20fc803481f01484
MD5 b4802e5464604d772904c865a0d5e532
SHA1 77d577350787cc6d5fe65bdcb5e2a574f552fcf7
SHA512 05205448cf3424787f64bc99dd6b958ec497f1963a2d37a7fcac3cc9676b389e151ea456913c36358d07a92b6864557927fe0f53c37f890bb285a0e5446fd31f
SSDEEP 3072:UPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEgG5v7UFSk8KH99jo:4X1aI5aZoKzMJ07NJB7U58KPo
TLSH
T15CE3F220CDC45FD8DFAC252C90BE0B1DA391C69D842A7686E763FE4ABF9760452271CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3764_915812833\manifest.json
Size 52B
SHA256 90f59dd0f7cd3fb4906d133943819da7aaf33f7ae5b5a0241e03ddea2611885d
MD5 c86c55c53e2bf572642bd11d17a15dff
SHA1 dd16da5cbdc5519179a01396cb94f1194a814939
SHA512 a079421f077a5f2b822469efb6f4b1822e095beff27b2d1551c74d1d880c9fe085bc0f64ea040d17be2d2ad2969051e13f3a782e72bfa692752a16c3316fa49d
TLSH
T185900270042591172AC10E506570F8859391661955860D1D08551548029546CE4502D8
MD5 SHA1 SHA512 TLSH

Submit Download