hxxps://www[.]xeno[.]now/SUT~79~vx~hn_~2j2bk-

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
24/05/2026, 15:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.xeno.now/SUT~79~vx~hn_~2j2bk-
Sample260524-svs71act6z

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2716_514018455\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2716_514018455\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2716_1435286764\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2716_1435286764\typosquatting_list.pb	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5304	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134241100536283413"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2746394149-3500112804-1243524366-1000\{6705A439-F3C7-4EE6-AB0E-4F30AE8BFE8B}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5356	msedge.exe
5356	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2716 wrote to memory of 4232	2716	msedge.exe	80
PID 2716 wrote to memory of 5304	2716	msedge.exe	81
PID 2716 wrote to memory of 4256	2716	msedge.exe	82
PID 2716 wrote to memory of 4256	2716	msedge.exe	82
PID 2716 wrote to memory of 4256	2716	msedge.exe	82
PID 2716 wrote to memory of 3068	2716	msedge.exe	84
PID 2716 wrote to memory of 3068	2716	msedge.exe	84
PID 2716 wrote to memory of 5624	2716	msedge.exe	85
PID 2716 wrote to memory of 5960	2716	msedge.exe	86
PID 2716 wrote to memory of 5624	2716	msedge.exe	85
PID 2716 wrote to memory of 5624	2716	msedge.exe	85
PID 2716 wrote to memory of 5960	2716	msedge.exe	86
PID 2716 wrote to memory of 5960	2716	msedge.exe	86
PID 2716 wrote to memory of 5824	2716	msedge.exe	88
PID 2716 wrote to memory of 5456	2716	msedge.exe	89
PID 2716 wrote to memory of 5824	2716	msedge.exe	88
PID 2716 wrote to memory of 5456	2716	msedge.exe	89
PID 2716 wrote to memory of 2840	2716	msedge.exe	91
PID 2716 wrote to memory of 4652	2716	msedge.exe	92
PID 4652 wrote to memory of 2376	4652	msedge.exe	93
PID 2716 wrote to memory of 5816	2716	msedge.exe	96
PID 2716 wrote to memory of 3628	2716	msedge.exe	97
PID 2716 wrote to memory of 4888	2716	msedge.exe	98
PID 2716 wrote to memory of 1776	2716	msedge.exe	99
PID 2716 wrote to memory of 1776	2716	msedge.exe	99
PID 2716 wrote to memory of 5200	2716	msedge.exe	102
PID 2716 wrote to memory of 5200	2716	msedge.exe	102
PID 2716 wrote to memory of 5356	2716	msedge.exe	103
PID 2716 wrote to memory of 1084	2716	msedge.exe	104
PID 2716 wrote to memory of 1084	2716	msedge.exe	104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.xeno.now/SUT~79~vx~hn_~2j2bk-
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2a0,0x7ffbb11dc188,0x7ffbb11dc194,0x7ffbb11dc1a0
  2⤵
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,202551535775657017,9715949646935923720,524288 --field-trial-handle=2296,i,12161187404798002356,7429799639769465242,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,16945795066722910637,8114441775728155120,262144 --field-trial-handle=2296,i,12161187404798002356,7429799639769465242,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:2
  2⤵
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2528,i,3264445676355151370,9403418940535631448,524288 --field-trial-handle=2296,i,12161187404798002356,7429799639769465242,262144 --variations-seed-version --mojo-platform-channel-handle=2516 /prefetch:13
  2⤵
  PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,12872829184282952457,8396237597089906891,2097152 --field-trial-handle=2296,i,12161187404798002356,7429799639769465242,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:5624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,11274725815729264035,18198715897776223580,2097152 --field-trial-handle=2296,i,12161187404798002356,7429799639769465242,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:5960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4968,i,3217892397802673276,17161567410837843508,524288 --field-trial-handle=2296,i,12161187404798002356,7429799639769465242,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:14
  2⤵
  PID:5824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4988,i,16058902760186488996,9651577517066704891,524288 --field-trial-handle=2296,i,12161187404798002356,7429799639769465242,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:14
  2⤵
  PID:5456
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5768,i,13717604747925412577,1099478121741389154,524288 --field-trial-handle=2296,i,12161187404798002356,7429799639769465242,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:14
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5768,i,13717604747925412577,1099478121741389154,524288 --field-trial-handle=2296,i,12161187404798002356,7429799639769465242,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:14
  2⤵
  PID:2840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,3280396731841699003,4430622724055849196,524288 --field-trial-handle=2296,i,12161187404798002356,7429799639769465242,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4652
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1144
    3⤵
    PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,6173317416890354503,2479473591857069601,524288 --field-trial-handle=2296,i,12161187404798002356,7429799639769465242,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:14
  2⤵
  PID:5816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,664553441162368132,29029218274180557,524288 --field-trial-handle=2296,i,12161187404798002356,7429799639769465242,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:14
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,12940790635202222964,898067394871287977,524288 --field-trial-handle=2296,i,12161187404798002356,7429799639769465242,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:14
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5184,i,11427220383206254315,15797320446438219292,524288 --field-trial-handle=2296,i,12161187404798002356,7429799639769465242,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:14
  2⤵
  PID:1776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=760,i,18150418283189661103,8176882659760884929,524288 --field-trial-handle=2296,i,12161187404798002356,7429799639769465242,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:14
  2⤵
  PID:5200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5880,i,18053311623240914843,1809229026307821944,262144 --field-trial-handle=2296,i,12161187404798002356,7429799639769465242,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5756,i,9947179349250981147,3408641718870977833,524288 --field-trial-handle=2296,i,12161187404798002356,7429799639769465242,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:14
  2⤵
  PID:1084

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:572

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4276

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 79054d3106248f0ce580d1442e78fcc5cc48ea2a5eb3b58c6aad98c7106da4b2
MD5 89a1e1173735f4835befe22b5e8bb285
SHA1 d6f781e38a6443407276a07888372638a8f2106f
SHA512 1f5c9b3554cf3bce4cd1214982a8df00dcc74324e66dbddb67a94598fbc762dc44d06c78c7a30a27a408611eba6e2715e40527ce854f203815d9515ab7dc00ce
TLSH
T129D0C0363A2D3003D3195331E042C703332704701C43E201E110C00C9D784D1D3C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6b09340cb22edbf71e0f90763fd435b35e26e3a84e71f4c033073dc564ceacd0
MD5 de82f6df0733dc6e89fad64d305f5367
SHA1 f27019be86cb5f8ddd353a4dc0ef3c6cfe6da7db
SHA512 b2443f684be01ef337dd32e8e1253d69b81d20f7291a2a1fa8998d0f723bb6bc114ee5bce6cc270ceadc8b45e5d854eb59b93ff60a8a13d338c218e132c169ff
TLSH
T19DD0C0323E293003D3055331E082C703333700701C43E201E150C01C9DB84D1D7C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 9e2097032f08dffdece909e16ce5ef48de9b0705c5d174e745fc55e9473f9e1f
MD5 06656cc7b6a8c9729ae5befff37ff72c
SHA1 97da311da6b68f458e771ee5957298a7b5e1b746
SHA512 28a55298e558e0a771da099c86845904d4e3187348666eca20cc60d3f372edc8953b12831327185ac84fb244a96bef7611765826639d8fdd365833ef35ee1e2f
TLSH
T168F0A9BAC921AC2714FD4B2D70A9574BE75513672780845B3B3E860D4FF563B468581C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 c31fdc7c5835c69a13ca02d25a45ed2e264587a5e8e317f329b48ee4342e48ba
MD5 3e6f642af8e3a6b594d3b813267b328c
SHA1 5655dbcec861b9dd96e2b8fdbcd8f25ad37e9627
SHA512 e936c79e8c04186060d8e0615a9012960dcb68174a435d8e4e10e5186bd6f4b00a84497316955b9f1438c8a5d78bc7e6ba112e31a07e7fe3d275947046e174f0
TLSH
T12271951506F339AFF3632033B1D16448F4BC966DCA777D670B8849B6221AB20CC62468
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58917d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58917d.TMP
Size 3KB
SHA256 8aa3ab9ad1446d45e53a9bc3af0c27a245b7bd74eac6a2d5bb704b5913203a5c
MD5 1afdc1af66b9c3b4aff4455cd2432244
SHA1 3d8a24a3ba48150300d7191eab585fd7fa1f1f19
SHA512 d96a4995d2364c53e10651d4b0620d70c341ba0770d24dd8bd9b4d7e87d7755841d7808f12171c20ea76d295849b293b5b2f8af67fe3f46af41313f705376e29
TLSH
T11A71B91506F33A9FF3632133E1D16158F0FC855DCE737D570B98497A261AB60DC62418
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 553770f81d011e5180719243332920e1bd8a031ef6d2bd382218882781a336b8
MD5 da43e34e571b2990042a93c953a425eb
SHA1 8caff5e98e2cb3477e8426d4fc968704501155c7
SHA512 0f362e13df3e02de996998907becf3c4d872cee726c1c537de215fc0cc4e217f3b19e073451d93f0586913c73b0d6534cf0f39aeccaa867482e1ee6dcbb12445
TLSH
T11651AFF383E4C66EC91156F0BA187E2BCE2D0615832C3D5AC9E4AF1B93E2470E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 70e8ed4bf4d3c940e2d29e4e85f2ced5b520ee8b3802d344bfb0124adddf6cd9
MD5 3cecbbfa02b63768153f28d131c39214
SHA1 41ec7d9d05cd37cf64ab1b41d4204007cc13ce2e
SHA512 79972db95b1f7eec0e397c7c8475d282d87913684df5e6505f0db432d86f5561fcca3b1b2c786933ecad534e4ac144e112a95131294971d60346a17a2a42531e
SSDEEP 384:sxZNEYqGB/fJsmSo0Ly8+H/bd49/5dGNCkE:sVE/GB/ffSo0I/bd4B5doQ
TLSH
T1FB72F916AA3849778CDBD309FA457B53D3F9156292501E449AFCCF1C04E7AEC221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 3ce10ac90a5ebbeb0a7569e697bf9a5d5f1324a6589843e8f5e1c652f281d0c7
MD5 1c6566ccadb849f261327f52f70152a8
SHA1 eee3deef9fcf8d9cf2624cb8ecbe4880b8338d7d
SHA512 4d4078378bc37daf1ac29887de2d44d5f8fa273d7596c6f0beed450320fea7680324881c598535b03cc9be9223289fba6386108bd7e16f6162c2a9f8e82838db
SSDEEP 768:ciWKy8Eq2A17pLuLn5dWRm5rQW78F1+UoAYDCx9Tuqh0VfUC9xbog/OV3V3pQLlF:ciWKy8Eq2ADEn5dWRm5rQW7u1jaKV3py
TLSH
T172031B3B680CCB7E4F805E9CEC266F9A6EE8018B6698895447FA844C03C76EF55170DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 57141cf81d2d61a2dbef0909e6a8fc2f1d19d18d1c9025ed19f4b581ba6e9534
MD5 1010fe5708b59502288862e0fb20e366
SHA1 316c5315c6b78d107f35e281f321443ed9026ea7
SHA512 6959a67f928107d6ad78e496216e124505d4d20a276dec9a7a4a40db74abea0d8e217bdc5bdc37e6612f504a271cc39bd207480a492aefe274ca8156d6a20d66
SSDEEP 768:AFBHhTofhno2mB21q3Llbfe3sLDdeEpYt1UHv741N:AFBHhTofhno2mBea41N
TLSH
T14FB28E56717B12123C3E290CA7A19B370E8272A33558A96F77B800B64E67E215DFCDCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c8e0a907-3bdf-4dc6-9aa2-d0d58204fd1b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c8e0a907-3bdf-4dc6-9aa2-d0d58204fd1b.tmp
Size 15KB
SHA256 8dccda4657a1e630fcdb4e56c3a4d9c34f16bcdf4e02dee861a7d1635bc854a8
MD5 45c9b5b7218288729e148d75249784a0
SHA1 6ecfc30bb77c8341acb34a5d8014ee8470674feb
SHA512 6eaa4e9533d863fa25d6c46ff435873b7e330df55138f76e0db3fae266bbbaccec9ac591bf6ad302ee6085ee8024611dfdd9eb6175045d23f4d3215cdfab1e2c
SSDEEP 384:sxZNEYdB/fJs8bSb60Ly8+H/bd49/5dtNCjo:sVEsB/fPS+0I/bd4B5dfx
TLSH
T19062E816AA3899778CDBD309FA457B53D3F9116392505E449AFCCB1C04E7AEC221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 7420870e6c2248d35a01d3d5f9268a85b891bfe9175c647d14a452ce172533c9
MD5 8839d5572f15f99f8115cac9bccd113c
SHA1 2bf14634fd24d6e2a03cceb885c39dae6d5b32b9
SHA512 7f6770dec52a3d16ea68fb635ae4af60593ea17abc302f0effd8977b3a5a78588278a23ddf140117a75e900636a17dd4e6243869f6516e3515e3fc86fb22ac9c
SSDEEP 384:nNiFptNnNnb9x38Nh8TUNTUlIRfyWd+a7jkpfb7oBuJAOkaG2B872+sRDcSHy/7w:EFpjZbT3awgJ+asJo4wt2ygRDB8q
TLSH
T180F2C4F198D789B3D9AE4B97A33E2E029AFCC157B5881994B7C45D0DCC861BFC30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 a2955917536896a7e3dedbdfb78f8cc1096f3367a38bb5eaac1cacf506cd87d9
MD5 f877af68fd63a273f3473fae6f902513
SHA1 91b0f11491a3a8ad7826ed67ef17a49c46de13b7
SHA512 faa04933f161b8ce13821df533eaa3018864aef6e3d5ff7763578ee17bf84143f2f1ab4550b83dd2d5edee63b6796f3ed1c769ec8e0f7bb3d2a75d9d08a03be3
SSDEEP 384:n5iiF9CcmyWCs38Np8TUNTUlIxBydvEoSajkpfb7oBuJAOkBPhkP+lFYS/D4Hy/Y:/Fccps3Cwgdd7Jo4wBPhkoFYS/s
TLSH
T1C8C23B36EC94CAB7EDEB4FD9E74E7A06EEE00167858859D4DAD81D0D00DB19D130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 20612467148125fe7a35d1753dd3882dcb09e7e0da087d15ecc9dfe30f1d7ff2
MD5 98dca2b9ab4f44a767a5b955677298d5
SHA1 807f2dc15b6aae87e494a85d9e8bfda635a80b01
SHA512 4e156b971fce7b98a58f1d2f91758272301096738c2eda7739de84474af8b800d4477ca3431006c9ac33aa5c15278edc36f02971f8787a2cfc4bb97278c302eb
SSDEEP 384:n5fiFptNnNnb9Z38Nh8TUNTUlIRfyW37jkpfb7oBuJAOka62B872+sRDcSHy/7If:QFpjZbj3awgDsJo4wR2ygRDB8q
TLSH
T18FD23A32E864DAE3EDE74F96B35E3603EFE0015789886AD4EAD85D1D01CB59D130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 dad2064506bd23a76e887fd62b898448adf4df1af78a61595f8323e4311c9f97
MD5 63e949a092f5354b86610db30c07478b
SHA1 91f4569a87f33e32bad22e85ffcc08ca13d1af3c
SHA512 262c309cd3bbd5c1eb3525a683c144419597e90c0e2e8d5af9ff3386d180457dcfdc64d76decd5b7dcb861ba53d95b4ea2485dabb12c604f7ec5f692fe49cff8
SSDEEP 384:n5fiF9CcmyWCB38Nh8TUNTUlIRyiyk37jkpfb7oBuJAOkao2hkP+lFYS/D4Hy/7V:QFccpB3awgsWsJo4w12hkoFYS/l
TLSH
T198C23A31E868CEA7EDE74FD9E64E7A07EEE0016386885AD4DAD85D5D00CB19D130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 79d1b2b43339ef2282c299fe958761739e95716ab6af606f1a69c2c13906c3a2
MD5 864c2f4f3ab9d8446b72afbeb0f94768
SHA1 c16c6259c50b79b26f1654251a8443f11f2ce4aa
SHA512 d735003867337804085edc67b21b32d9e45d5f027eb42de586ce4ac0b18fa0cf48db1574a5d78acc93ba43b1e4bdc989699aa5570594b78291ed44b9b421eef3
SSDEEP 384:nOiFptNnNnb9Z38Nh8TUNTUlIRfyW37jkpfb7oBuJAOka62B872+sRDcSHy/7Ige:lFpjZbj3awgDsJo4wR2ygRDB8q
TLSH
T130D23A32E864DEA3EDE74F96A35E3603EFE0015789886AD4EAD85D1D01CB59D130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.5.21.1\typosquatting_list.pb
Size 426KB
SHA256 dd09485bbf5cc88d4b16947759497eaa159173798917953ed192e4f70f7b5d4f
MD5 03151e6660e6bbfa692924e34f19864f
SHA1 6b6ab73d35013c474e03e864634d05f264c5de22
SHA512 a30e4932722ab12bb106b4727610272a987a9222b15b727bfe062c370fa4234b2c5c82e6858b3454ebe17cdaca02444ff5d9b00df76f41b1fd5a585c4bb981de
SSDEEP 3072:aOtMYwJuo6nLA5ORUEaT7EfDhixsu417P0++di92iLUJs:PMNJuoL8avC3N+09nUJs
TLSH
T1AE94A3B9DFC00150DB78112D20BE71D8181412A580E9DFEAFE7D865F2BC2AC977E85E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 77e70e8b8743a25be5c59f81e522c4ff36a644045bc2ac516b55c20d92ebe356
MD5 c4b0d590ee04da586d12ebc5feb88ba6
SHA1 33e3f5b81fd46087b3774706cadb29c7f2f0d216
SHA512 8f84250c6ca92a38693bcf3125eac4f7ac8a7492e09f3424d24e14dda3b42348d897f9fbe6b93c5b4a0e4a889dca7822dcc924dc6a332f0e796240e7989fc3bd
TLSH
T1BB5160E05C7C2AC1D0BE0E6FA48B38FC82ECC325F4A4357D6818EA88097921D748083F
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2716_1435286764\manifest.json
Size 118B
SHA256 3c286bc18a9899fc2b55d3c55cd8331e6c64b853519149d854d42958b8209b87
MD5 af04c6b51c629f6364ecf578ae4b7127
SHA1 f9226903a59eb69191bc0c37db0c0f0a09c40c4a
SHA512 3aeab2a0269ebc7368d275ea57a7105bf90cbb2a68e7824c3a6d724eef426067c7478cef558d511116a900d13d406d3d92ac32c9fd859e83b95f8b17def8e031
TLSH
T16EB092B10C0AA47B26809720ECA0668283F80218E8065B1A088076881FD817880362B2
MD5 SHA1 SHA512 TLSH

Submit Download

data.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2716_514018455\data.txt
Size 146KB
SHA256 4d3b611b8b664c9b2e4503f41eabf3833860e521447c1dc921f0849e0c8633de
MD5 824a5940f80f495eec4743b1e719aa38
SHA1 1194b5bb383ef6fb33dcf906c99743f23cfaf790
SHA512 979860e2f4dbf25a3562c9e29c218f8d779a98a0f652dbfda04752f537d86f11bf8d27aad22d9b6ce16d34f734f9efb883e89ec326cc645506b7b163e429c2b6
SSDEEP 3072:TBPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEpASogqAlrE7FkEBih5:9X1aI5aZoKzMJ07N8gqAlrE7OXv
TLSH
T1D7E3F110CEC41FDCDFA9291C90BD0F0963E1C79E853BAA85EB63FE466F67A045617089
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2716_514018455\manifest.json
Size 52B
SHA256 98fd5d8bd64136534587ef4cd3f9151defa2a6dae9f0b269a2cbb06433c50336
MD5 4b38fcc473ed6f7c17ddfb82a738f25e
SHA1 ecdc59ae25620ddc8111f05fa358f9bd829ab553
SHA512 8a7b883c0f656ec7bca3c0239dc7f362db0375236f234844d07b4a9639e7c26a3fcefb1b6927e32bda3dfc2ca5cb1872a9b422fa7f8881d56409c33063176a92
TLSH
T114900260042491571AE10E606570F8859395761955950D1D04451548029946CE050298
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2840-179-0x000002A1B92E0000-0x000002A1BA2E0000-memory.dmp

Download