hxxps://www[.]xeno[.]now/

Analysis

user interaction
yes
max time kernel
40s
max time network
41s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/05/2026, 15:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.xeno.now/
Sample260524-tbe2psdt2x

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
54	discord.com
56	discord.com
53	discord.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
468	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134241115999543574"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{6F799F1E-F3E6-43C9-8177-65FC7EC69C70}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4344 wrote to memory of 5852	4344	msedge.exe	87
PID 4344 wrote to memory of 468	4344	msedge.exe	89
PID 4344 wrote to memory of 2108	4344	msedge.exe	90
PID 4344 wrote to memory of 2108	4344	msedge.exe	90
PID 4344 wrote to memory of 2108	4344	msedge.exe	90
PID 4344 wrote to memory of 5256	4344	msedge.exe	91
PID 4344 wrote to memory of 5256	4344	msedge.exe	91
PID 4344 wrote to memory of 5656	4344	msedge.exe	92
PID 4344 wrote to memory of 5656	4344	msedge.exe	92
PID 4344 wrote to memory of 5372	4344	msedge.exe	93
PID 4344 wrote to memory of 5656	4344	msedge.exe	92
PID 4344 wrote to memory of 5372	4344	msedge.exe	93
PID 4344 wrote to memory of 5372	4344	msedge.exe	93
PID 4344 wrote to memory of 5164	4344	msedge.exe	99
PID 4344 wrote to memory of 5164	4344	msedge.exe	99
PID 4344 wrote to memory of 5208	4344	msedge.exe	100
PID 4344 wrote to memory of 5208	4344	msedge.exe	100
PID 4344 wrote to memory of 2936	4344	msedge.exe	102
PID 4344 wrote to memory of 5908	4344	msedge.exe	110
PID 4344 wrote to memory of 5316	4344	msedge.exe	111
PID 4344 wrote to memory of 576	4344	msedge.exe	112
PID 4344 wrote to memory of 3952	4344	msedge.exe	113
PID 4344 wrote to memory of 3952	4344	msedge.exe	113
PID 4344 wrote to memory of 3952	4344	msedge.exe	113
PID 4344 wrote to memory of 3376	4344	msedge.exe	116
PID 4344 wrote to memory of 3376	4344	msedge.exe	116
PID 4344 wrote to memory of 3376	4344	msedge.exe	116
PID 4344 wrote to memory of 5108	4344	msedge.exe	117
PID 4344 wrote to memory of 5108	4344	msedge.exe	117
PID 4344 wrote to memory of 5108	4344	msedge.exe	117

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.xeno.now/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffc25fbc188,0x7ffc25fbc194,0x7ffc25fbc1a0
  2⤵
  PID:5852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,4045534652708393053,6210447009990313010,524288 --field-trial-handle=2244,i,4844432744195689016,17036838195991794287,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:3
  2⤵
  - System Time Discovery
  PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1704,i,9468157189164641648,6270806014594390594,262144 --field-trial-handle=2244,i,4844432744195689016,17036838195991794287,262144 --variations-seed-version --mojo-platform-channel-handle=2028 /prefetch:2
  2⤵
  PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2572,i,7389149391971039908,14656556993239815155,524288 --field-trial-handle=2244,i,4844432744195689016,17036838195991794287,262144 --variations-seed-version --mojo-platform-channel-handle=2708 /prefetch:8
  2⤵
  PID:5256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3508,i,4744871706029017519,507899852242291859,2097152 --field-trial-handle=2244,i,4844432744195689016,17036838195991794287,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
  2⤵
  PID:5656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3512,i,3696781607990103363,4952057151672074710,2097152 --field-trial-handle=2244,i,4844432744195689016,17036838195991794287,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
  2⤵
  PID:5372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5180,i,13099489893159888106,4880453756511494403,524288 --field-trial-handle=2244,i,4844432744195689016,17036838195991794287,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:8
  2⤵
  PID:5164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5184,i,1758173918524221067,4740102999188485964,524288 --field-trial-handle=2244,i,4844432744195689016,17036838195991794287,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:8
  2⤵
  PID:5208
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,6209952573689794822,9349999652893404979,524288 --field-trial-handle=2244,i,4844432744195689016,17036838195991794287,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:8
  2⤵
  PID:5756
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,6209952573689794822,9349999652893404979,524288 --field-trial-handle=2244,i,4844432744195689016,17036838195991794287,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:8
  2⤵
  PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,17124315554427811246,9270685127855947512,524288 --field-trial-handle=2244,i,4844432744195689016,17036838195991794287,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:8
  2⤵
  PID:5908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,18174171911302651881,4410821585644358381,524288 --field-trial-handle=2244,i,4844432744195689016,17036838195991794287,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:8
  2⤵
  PID:5316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,14493179715612606444,12422459955924766203,524288 --field-trial-handle=2244,i,4844432744195689016,17036838195991794287,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:8
  2⤵
  PID:576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6208,i,9454960668054681964,17857037218594986234,2097152 --field-trial-handle=2244,i,4844432744195689016,17036838195991794287,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:1
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6288,i,8146893653707728026,22385889940923701,2097152 --field-trial-handle=2244,i,4844432744195689016,17036838195991794287,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:1
  2⤵
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6424,i,14551496465290375959,3384793732181461683,2097152 --field-trial-handle=2244,i,4844432744195689016,17036838195991794287,262144 --variations-seed-version --mojo-platform-channel-handle=6436 /prefetch:1
  2⤵
  PID:5108

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4724

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2280

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 5598a238f1d68ad9136eb6e698c5ca9f4315094d2bccf6013a48f9051bd77b80
MD5 2ecc46963607c61fe8aa6236e61866bf
SHA1 348a4190b3ba58e73cc7b926b7492f66c78360f1
SHA512 fb549933c3da8511817c9dc5154796e056e184a1e6aacb7f705c0371ace3e60773c17a5e87d5c39dff11c6f0dadc62d466cb6c1756f174b55eac0b6b1ebc6240
TLSH
T141F0F4B6C821EC2718FD0B6970594B4BE75023A72B90889B3B3C930D8FB463B859985C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000087

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000087
Size 23KB
SHA256 4d374f815118157d4ec62c285937df74fec28c75d9eec110f48d3e04cb321ba8
MD5 ce7b262351203b245322fe75044fb61e
SHA1 46fc201fa3a9a56cb91f3a08f4a380f6d2283e0a
SHA512 0af2f8fa0171107ca26b73d1eeed9599c0b67953e163441bf65dc3a5bae5c9aa82bdcc54255996e8d1d472db1b09ba3286859d595619f1706a8e61c464081dff
SSDEEP 384:zApz2RXdsOYVa2CE00K/4dJfoLdmiJo0zADElg9jIKauH6CwJ6k5zRv2LbFq:oamOTZE0hAdJfoxmiJ9zdC9SpCwJoFq
TLSH
T130B2E1833404A6947BFF27130CF66A08E6B2B67BF63273054465483E42B52FA5B5977C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 23b52f38b6614f29e8c1f5fe6af2ab11026cf390b8ae852e2522d257a817a257
MD5 1e10a0ade1390043edc33a537bd087d7
SHA1 28125e4621b9f961def447a3cf3106be8b0c7d1c
SHA512 a75fdc976e9ec60f5fbab7fd33af3556b74fde1023a60d53c88710cb261089c8b389c3e6f1428d515dabceee4124a69526d801dd684290538245ecc8b5b09c97
TLSH
T16471193E11026C60E7117CF4A4D37639B4BEC6CAFA1BCE55C20539375E1B75B4325688
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58e2d9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58e2d9.TMP
Size 3KB
SHA256 5f492cdb2e5e04789d5476b78a641a8cb9376a5d1927c72c2c474ab0f651710d
MD5 b19e0e8efb5257c6cf4197d1bb479390
SHA1 d5e49ab5fcfb90aebec49128a2f11aeeb2d41945
SHA512 3b12a43cb2acb7b4bd4f94d64a81fcb29632c383dcc08c09724a0be750c3145a61c310697c5103d30b22309054713f687d28d9269c7dd4b9b529a31e0d84fa82
TLSH
T1D471193E05016C60E7257CF5A8E37639B8BEC5C9FA1BDE54C50035375E1B35B4329288
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 16c1e253f34a264c2d2ae8680ee207d28fc2e302d3be27a869b9bf1460c4c633
MD5 b32054e751a153f1a62491567bff54c3
SHA1 72bd8c5c0f20b8437769de409edeb03fc6a29db7
SHA512 b73fae2fd6fecc0ff0496d1262d57a35466187bd83d0a1eaf4a426048b4abaa376cf69c277c9fde3650f73383c6e651f3e6f54499ad07bd1e51b6a1ca1aba941
SSDEEP 192:sxZtRiyMqZjK1Ml8Mk3/fXsjgvZdIaRuv4zodpH5yHW6+WNxJWXe3WUskE5FXvb2:sxZt/M3/fXsEvzIKYL0Hb+XeoGf8BI
TLSH
T17E72D8176A38497B8DDBD21AF545BB57D7F9016392944E44AAFCCB0C01E7AEC220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 325a38f80b4d742cc0edccfca0489427b77233e82e256cd5b32d97a15618b4e0
MD5 13a97e706c80054fa0613485c14cdfc9
SHA1 f1a255229b67c7c6d64794cb8377386b94ee105f
SHA512 a0e471241757acbc3c7f00ed6189ef73cbac9da6eded3366ef71125f82341f7a181ee6054f0e5c1eb387028cf7e7b9d4ae160074b1f8655f6da4b13994e060e6
SSDEEP 192:sxZxRiyMqZjK1Ml8Mk3/fXssqgjaZdIaRuv4zodpnyHW6+WNxCp/Yv2C+7RZIgjJ:sxZx/M3/fXss7jazIKYLyHbC/nfjJ
TLSH
T1B362E8066A38997B8DD7D209FA45BB53D7F9116392945E449AFCCB0C05E7AEC220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 be5dc1d7ac3e429791cc03cdf153c703d7f307d9fac95e1b608d20b08cc795de
MD5 9b0c43b81a9c01aa8447433c5058bebf
SHA1 2ba7a255051adddf179e9f0dbb51d47689ed07ea
SHA512 515de00de30e8b5aa78b677e389a5a521a60ae8163fc018ca940a93c46a7b262da1455acc3029501c3f4e540db1bf3b8801771549208b3e29f34c70e9b09f7b6
SSDEEP 768:ZYsv8OdF6ssi7pLuLnFhWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhysy10Lln:eY8Od/HEnFhWvFvmXu1jaRt10Lm2NuPQ
TLSH
T196F2EB3B6C0CCB7E4F844E9CEC2A6F8A6DE802CB5698895447FA844C02C76EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 e7e3f8e3bbfc6066528f95eccfcf31d2fd55e37866fa6883749ad07d9bc3fde3
MD5 6d60e9b0917defa32fdfc4f711909666
SHA1 cd5409ef18f00d95e6e73c516f273ed2123a8e8c
SHA512 c88e7f896f4a011a3918420336b60755f8b37d80d90465e3361af2f3a1e4c4342389769fadf2c427707322ecdb1d127f01de035f9e935c9ad7d63c6f5152844a
SSDEEP 384:0LppY93PBZJPtN53ATy3jJlZEdQ3bvV7RMrbAxzd5:0LppY93PBZJPtN53ATy3jJlZEdQ3bvVN
TLSH
T1D6B26B5A703E0211393E2988B39696364F4235A37058E4EF7FB814A54F67E225CFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 cde38e4706b84b2cc5a063ad6af5c9b7938c17c9c6ea858713845e8bf6b47c81
MD5 c87de49b263323da0e0a0590abc35bd6
SHA1 e356eaee8c785b97679d119c08ba4132a0cfe259
SHA512 7a6d43574e7cf025c6b6028e7630c382067745a2a91aace316bf5817a7e66612a4f29f310ef0095d593e726a6415826428a7c02339967929e35fedaffd7d3d1c
SSDEEP 384:npBiF9CcmyWCs3sNK8TUNTUlIm2QckCr9lxKphiftGfFmmEEXIQ/4dWnj2apde4a:poFccps3bwgbkUDkoGpENdwj2uI8p0KS
TLSH
T1E0B25B36E868DEABEDE74F89B74E7A07DEE0122785DC59D8DAD85D0D009319C430B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 5534251c05aea74f04d7c38b28b269636453a57addd169c56f7115fc7be6fdd4
MD5 9bdbf812301998c7d8ad3e68ba9f6f84
SHA1 463a8a0d524ebb20b6f044890564662979def7da
SHA512 ba3b6dd66fc42689a09375e2beb496f63d6c6a16606a600c1e779b1b6bfacf16582cea7ad02c9601420c1e5794c32bc7366a395508194c726900ed4ed1272b42
SSDEEP 768:sF1jZbr3HwgOkCaooGpENdwjnwLsYkPmSX:4H3w3HOBsYkuSX
TLSH
T172D25B36D864DEABEEE74F96A30E3643EFF401A7858C59D8D9D85D4D008719D030BD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 aa977c609bb345e4d70e6d08096885b38bcb3d76e0fe6ad26a01f8b167bc2a00
MD5 ebd709dfdc62d491ecad303f339ab195
SHA1 42e664ea2ff8baeb3c6e437d35329b16d6e90ac7
SHA512 1710232c48a7ae0b124f23fc0eeef881fdf69082673853beae6ca40c46798a3ecda43acd7ec7edd19a2a7496f5a3ebbbe27e9da147503349ea3efa0f379991b9
SSDEEP 384:npJiF9CcmyWCs3sN28TUNTUlI4iZQckCrVfRphiftGfFmmEEXIQ/4dWnjnw1pjX5:pgFccps3HwgxkgvoGpENdwjnwLX5
TLSH
T168B23936E8A8DEB7EDE74FD9A75E3A47DEE41163858C49D8DAD84D0D008719D030B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 6b162ddd53d9811a1931e8235ca0c4958b3d9e3c0830f988a607037315733a55
MD5 da58ef363613f56407e4ff8a2c5913d8
SHA1 cd50251df8d74903855c2e993f3f63f3b53a753a
SHA512 35fe0b4272413eef6e5b04e43e6d46ebae3e9c3a47b5e8fc6796d2af7d56cebdba743b89b9135558894caa35b34f7b4caf0db9ae8f2c06e305f97673304cb3b0
SSDEEP 768:pgF1jZbr3HwgOkgvoGpENdwjnwLsYkPmSX:mH3wVHOBsYkuSX
TLSH
T165D25B36E864DEABEEE74F96A30A3643EFF401A7858C59D8D9D85D4D008719D030BD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 9cc15a74f117a4708f576e67b4e594fdf47d1ed8b49089240b5df35a8c30b1d2
MD5 7758c80f1edd24b001ebed76272042f8
SHA1 1d392cd76e1bbab389feaa2390b45678a35b1190
SHA512 bb3722d1b26af91a87fbebdabb5c7ca9c224a002dd114e0ccc4b0a9451657d1788707966a325830aab55c092836423f33a86972de799b0f1d2ca8d0c77fe24c9
TLSH
T123412D4CA6EA1148B3B76E5AABF7A46E847F79772F0AD49E10110D4F0667E00C8B1737
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2936-288-0x000001E0C26E0000-0x000001E0C36E0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads