a1bb4867aa671672757bd123ae737c7f2af4bd5bb51b86cf357ae44db4ea0096

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/06/2026, 09:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Xeno-v1.3.55/Xeno.exe
Size 164KB
Sample260605-lrasxset2r
SHA256 a1bb4867aa671672757bd123ae737c7f2af4bd5bb51b86cf357ae44db4ea0096
MD5 3840aa557114e7f6d4654fbd76e721d3
SHA1 c5f5e7e7f1cb945cd1158cbcca8d969aad7c2982
SHA512 cf57e5f80555de35fa51cf210680920ff60173efe1d49fa3eec983b944a7057f795bcb1dfe3b3308a0a02054be3abf1dcb24c797a77729556247ce9c0b2bfbef
SSDEEP 3072:r20jWfVKLer5haSpfO9D/y7jXEkemZA4nsSyU34mVT:qIVSpfO9jkS44UFVT
TLSH
T155F34B07A6A850BEE1B7D679C9924941FB723C594B71A6CF03507AB60F737D0AE39302
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4756_2116046363\_locales\nl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4756_1792228422\hyph-hy.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4756_2116046363\_locales\ms\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4756_2116046363\_locales\sr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4756_2116046363\_locales\fa\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4756_1792228422\hyph-te.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4756_2116046363\_locales\ur\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4756_1792228422\hyph-ga.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4756_2116046363\_locales\af\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4756_2116046363\_locales\de\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4756_1792228422\hyph-af.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4756_1792228422\hyph-ta.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4756_2116046363\_locales\hr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4756_2116046363\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4756_2116046363\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4756_1792228422\hyph-cy.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4756_2116046363\_locales\ka\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4756_2116046363\_locales\vi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4756_1792228422\hyph-ka.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4756_1792228422\hyph-ml.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4756_2116046363\_locales\lo\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4756_2116046363\_locales\en_GB\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4756_2116046363\_locales\kn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4756_2116046363\_locales\sw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4756_2116046363\_locales\is\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4756_1792228422\hyph-gl.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4756_2116046363\dasherSettingSchema.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4756_2116046363\_locales\pa\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4756_2116046363\_locales\fr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4756_170910463\data.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4756_276746031\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4756_2116046363\_locales\mr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4756_2116046363\_locales\eu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4756_1792228422\hyph-bn.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4756_1792228422\hyph-en-gb.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4756_2116046363\_locales\km\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4756_2116046363\_locales\id\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4756_2116046363\_locales\fil\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4756_1792228422\hyph-es.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4756_1792228422\hyph-fr.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4756_1792228422\hyph-und-ethi.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4756_1792228422\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4756_2116046363\_locales\ro\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4756_2116046363\_locales\cs\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4756_2116046363\_locales\fi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4756_1792228422\hyph-el.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4756_1792228422\hyph-sv.hyb	msedge.exe
File created	C:\Program Files\msedge_url_fetcher_4756_1663706266\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_106_1_0.crx	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4756_2116046363\_locales\en_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4756_2116046363\_locales\gl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4756_2116046363\_locales\be\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4756_2116046363\128.png	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4756_2116046363\_locales\ar\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4756_2116046363\_locales\th\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4756_1792228422\hyph-de-1996.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4756_1792228422\hyph-kn.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4756_1792228422\hyph-sq.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4756_2116046363\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4756_2116046363\_locales\ko\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4756_2116046363\_locales\bg\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4756_2116046363\_locales\gu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4756_2116046363\_locales\az\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4756_1792228422\hyph-en-us.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4756_1792228422\hyph-lt.hyb	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5404	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134251263839203253"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{3F93B06F-613A-48D2-A872-2F5F083C9FA8}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
528	msedge.exe
528	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4756	msedge.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 5008 wrote to memory of 4756	5008	Xeno.exe	93
PID 4756 wrote to memory of 2740	4756	msedge.exe	94
PID 4756 wrote to memory of 5404	4756	msedge.exe	97
PID 4756 wrote to memory of 5960	4756	msedge.exe	98
PID 4756 wrote to memory of 5960	4756	msedge.exe	98
PID 4756 wrote to memory of 5960	4756	msedge.exe	98
PID 4756 wrote to memory of 3816	4756	msedge.exe	99
PID 4756 wrote to memory of 3816	4756	msedge.exe	99
PID 4756 wrote to memory of 3096	4756	msedge.exe	100
PID 4756 wrote to memory of 5660	4756	msedge.exe	101
PID 4756 wrote to memory of 3096	4756	msedge.exe	100
PID 4756 wrote to memory of 3096	4756	msedge.exe	100
PID 4756 wrote to memory of 5660	4756	msedge.exe	101
PID 4756 wrote to memory of 5660	4756	msedge.exe	101
PID 4756 wrote to memory of 860	4756	msedge.exe	104
PID 4756 wrote to memory of 860	4756	msedge.exe	104
PID 4756 wrote to memory of 860	4756	msedge.exe	104
PID 4756 wrote to memory of 4328	4756	msedge.exe	107
PID 4756 wrote to memory of 1972	4756	msedge.exe	108
PID 4756 wrote to memory of 4328	4756	msedge.exe	107
PID 4756 wrote to memory of 1972	4756	msedge.exe	108
PID 4756 wrote to memory of 1744	4756	msedge.exe	111
PID 4756 wrote to memory of 3572	4756	msedge.exe	120
PID 4756 wrote to memory of 1848	4756	msedge.exe	121
PID 4756 wrote to memory of 1568	4756	msedge.exe	122
PID 4756 wrote to memory of 3824	4756	msedge.exe	123
PID 4756 wrote to memory of 3824	4756	msedge.exe	123
PID 4756 wrote to memory of 1716	4756	msedge.exe	124
PID 4756 wrote to memory of 1716	4756	msedge.exe	124
PID 4756 wrote to memory of 5244	4756	msedge.exe	131
PID 4756 wrote to memory of 5244	4756	msedge.exe	131
PID 4756 wrote to memory of 828	4756	msedge.exe	134
PID 4756 wrote to memory of 828	4756	msedge.exe	134
PID 4756 wrote to memory of 1548	4756	msedge.exe	135
PID 4756 wrote to memory of 1548	4756	msedge.exe	135
PID 4756 wrote to memory of 528	4756	msedge.exe	138
PID 4756 wrote to memory of 5808	4756	msedge.exe	139
PID 4756 wrote to memory of 5808	4756	msedge.exe	139

C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55\Xeno.exe
"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55\Xeno.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.NETCore.App&framework_version=9.0.0&arch=x64&rid=win-x64&os=win10&gui=true
  2⤵
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2f0,0x7fff09dec188,0x7fff09dec194,0x7fff09dec1a0
    3⤵
    PID:2740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1876,i,8717830327881328204,8328266612005127579,524288 --field-trial-handle=2344,i,7733688651504865164,17852124624975051454,262144 --variations-seed-version --mojo-platform-channel-handle=2384 /prefetch:3
    3⤵
    - System Time Discovery
    PID:5404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1700,i,11651286091067320257,15882478169486287410,262144 --field-trial-handle=2344,i,7733688651504865164,17852124624975051454,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:2
    3⤵
    PID:5960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2600,i,17787113418007631989,8323334607792707340,524288 --field-trial-handle=2344,i,7733688651504865164,17852124624975051454,262144 --variations-seed-version --mojo-platform-channel-handle=2736 /prefetch:8
    3⤵
    PID:3816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,6356850641280147610,15538566844283443420,2097152 --field-trial-handle=2344,i,7733688651504865164,17852124624975051454,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
    3⤵
    PID:3096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,6719089151023526450,3271641712109771952,2097152 --field-trial-handle=2344,i,7733688651504865164,17852124624975051454,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
    3⤵
    PID:5660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4856,i,14472065511004523013,10805875616536329699,2097152 --field-trial-handle=2344,i,7733688651504865164,17852124624975051454,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:1
    3⤵
    PID:860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3576,i,10729140814968180387,4215606236442995179,524288 --field-trial-handle=2344,i,7733688651504865164,17852124624975051454,262144 --variations-seed-version --mojo-platform-channel-handle=3748 /prefetch:8
    3⤵
    PID:4328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3548,i,2268647798760154423,13823504265277529718,524288 --field-trial-handle=2344,i,7733688651504865164,17852124624975051454,262144 --variations-seed-version --mojo-platform-channel-handle=3736 /prefetch:8
    3⤵
    PID:1972
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5668,i,6219402951750737039,1864954738152731023,524288 --field-trial-handle=2344,i,7733688651504865164,17852124624975051454,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:8
    3⤵
    PID:2364
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5668,i,6219402951750737039,1864954738152731023,524288 --field-trial-handle=2344,i,7733688651504865164,17852124624975051454,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:8
    3⤵
    PID:1744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,10663238653279407897,14061964614658581869,524288 --field-trial-handle=2344,i,7733688651504865164,17852124624975051454,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:8
    3⤵
    PID:3572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6092,i,9328092805387665953,11110495537272567872,524288 --field-trial-handle=2344,i,7733688651504865164,17852124624975051454,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:8
    3⤵
    PID:1848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6172,i,1011021334111535661,8512545344070583553,524288 --field-trial-handle=2344,i,7733688651504865164,17852124624975051454,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:8
    3⤵
    PID:1568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6116,i,6178184033541917053,3406353096253231079,524288 --field-trial-handle=2344,i,7733688651504865164,17852124624975051454,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:8
    3⤵
    PID:3824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6200,i,9155904339294295181,12083181169040343543,524288 --field-trial-handle=2344,i,7733688651504865164,17852124624975051454,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:8
    3⤵
    PID:1716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3948,i,14218492358553149935,2361657280944765992,524288 --field-trial-handle=2344,i,7733688651504865164,17852124624975051454,262144 --variations-seed-version --mojo-platform-channel-handle=3068 /prefetch:8
    3⤵
    PID:5244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,12273132527130166408,1570827757587997403,524288 --field-trial-handle=2344,i,7733688651504865164,17852124624975051454,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:8
    3⤵
    PID:828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6172,i,18106355603328581008,16279107342668107309,524288 --field-trial-handle=2344,i,7733688651504865164,17852124624975051454,262144 --variations-seed-version --mojo-platform-channel-handle=864 /prefetch:8
    3⤵
    PID:1548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6236,i,7934879877245750397,17639504392309718512,262144 --field-trial-handle=2344,i,7733688651504865164,17852124624975051454,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=864,i,16861439434113614205,7912714082369438137,524288 --field-trial-handle=2344,i,7733688651504865164,17852124624975051454,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:8
    3⤵
    PID:5808

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4296

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5944

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

data.txt

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4756_170910463\data.txt
Size 146KB
SHA256 ca6b9158b966a4245500d5ba10ea6e123b65f82a4cac4e207cdc21a96406114b
MD5 e28f6cc38e9dfcbb14a5d49174b0e6e5
SHA1 e2f3ee57ee5d91232ac5d1b934c865d8a2a2676b
SHA512 3dd75928b8f59a28fa4ddad1aa08e261318ec4e35a9db9af28b3a5ce09097128088dbfc8946b35d80ce293cdc431a9c27b6ffa8e2dd166ed48f4beb7a9892fd8
SSDEEP 3072:UPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEFq5IDI45/y:4X1aI5aZoKzMJ07NcQI456
TLSH
T1E2E3F115CEC41FDDDEA8261850BE0F1E53D0835E442B6AC9E763BD497F9BA04863B1C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4756_170910463\manifest.json
Size 53B
SHA256 76daf0ebbaf97179fc4ab99dd6cace2b80ede8e39dd50c153e97e6649f6f5773
MD5 58aa82c06223ecd1156ff2fb420bd991
SHA1 8c8b8bb475ab624cf0a2fa4eb88f7053e0992423
SHA512 4e96250fa556ab86538518843cd0455f9df2af58174219b17cc7d64871d5305e011896b454406492b5c5eef6e905e7967fe68c612ae16ab91a47d4fa71081f54
TLSH
T1389002704424951716C20E5065B0B8819391661995854D1E0445155D039546CE050298
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-as.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4756_1792228422\hyph-as.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-hi.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4756_1792228422\hyph-hi.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nb.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4756_1792228422\hyph-nb.hyb
Size 141KB
SHA256 c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
MD5 677edd1a17d50f0bd11783f58725d0e7
SHA1 98fedc5862c78f3b03daed1ff9efbe5e31c205ee
SHA512 c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgk:p73HEUP8dsiinTThjy90VKk
TLSH
T1CCE319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4756_1792228422\manifest.json
Size 82B
SHA256 d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665
MD5 2617c38bed67a4190fc499142b6f2867
SHA1 a37f0251cd6be0a6983d9a04193b773f86d31da1
SHA512 b08053050692765f172142bad7afbcd038235275c923f3cd089d556251482b1081e53c4ad7367a1fb11ca927f2ad183dc63d31ccfbf85b0160cf76a31343a6d0
TLSH
T137A022A0BC0880333E8803A8023E83E3C3BE3E0A20003C0002A33C8022EC33B3038E2C
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4756_276746031\manifest.json
Size 117B
SHA256 1249e6113fdeebcd2284a0e72cb188d8624e06b03a142f8b4c4f49886b0e95ec
MD5 edc953067dfcc7f2c4f36f3dba9a2f6f
SHA1 900442b6d8dc98a2a3acf3ad372f6ba7172c0f7f
SHA512 a48cad8c35e60faf733c3a6b1ea065eb7e280a741bffaad2ee59f127a3a7759d3aaed15b64aeb41befbd168bed3b114cc1e85a320e9a614ab44c4c6cde95a3c9
TLSH
T13AB092B00C1AA43B26809320ECA0A68683F80218E8021B1E08803A481F8867880363F2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 394a0b735f6813b62935292aa4879c229fcf48ddfc78b74bae85c14d3a99f59c
MD5 7238936de0291ec6109f4ba41a83b9da
SHA1 d879c4d45276e315b09a9a9dc02a53a6d9faa5d2
SHA512 f65b3ff6a0f2f14db6d2ac842a5929bbbd9b632f116a17bb9aef826ebd4e7ca79c246007e6f973d7f69ea51f6bafd3fb4c2a8315972daf1fbbed05c8028a0d0f
TLSH
T1B7F0F4B6C921EC3718FD0B6874A98B4AE750132B2780889F3B3C920D8FB567B859585C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 667cfb72c86b5857ce15ce9bc1f04fc73730eb526776e67c6a9241fbfefecd61
MD5 3fdf48d5e52f54a59ddbfaab5b147ee1
SHA1 96887610b3df0b6261c769b46e8da7481ff6cae6
SHA512 2772bcd694759bf5c9320a1ed4c5bd9dc71117416b6c30a3edbd547df343d6e4bf8fc01baa17fda3c050f5614b2c8985f3480158e2b578ca4ba93130cc413c67
TLSH
T12E51ADF7C3E8856D8A0196F0AA14AE2FDE2D0914532C3D9AC9E4AF1B93E3471E14165F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 66048dcaf866ef8a857f7cf5c404f045760c734d5b9643a698c3f87c9d85ba98
MD5 f8e6c0bd3c64c9246c207b4768b317fc
SHA1 847eef0081fd8b15a65fb0f7ee40030ad60f9cbb
SHA512 3f280faac89ad0f2942b670f66025309fb1264914cf27cefa8db7531db73369c2bb3bee2f77f3ed90c1c62886fc42be07471c07e25de06d9a29fac6884f26ba4
SSDEEP 192:sxZnRu9yMqZjK1Ml8Mi0/fOsso6PtaZdIaRuvxzodp6cHW6+WNrnE/YvXCDT+fIR:sxZnFq0/fOssTlazIKY6XHbQ/lT8jO
TLSH
T11362E906AA3459778DDBD209FA45BB53D2F91163A2904D445AFCCF0C44DBBEC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 41f42d941475bd29b5e5abaa9d8ecd8da5cdfd88e0d83bb7cd65f31038009b3d
MD5 a6bbaedad4fad29b57100de53bedd32c
SHA1 b78f6fc651d78b7aa05d54490ea8ad344cb2f77a
SHA512 56a76db0b16c4b644feeb991b98aa3ae66a2722ac08c49940bf1adf50f3bafebed43838220a00f805d61fd6a82cd0fcc4a0da818accde24943a30f8583888336
SSDEEP 192:sxZnRu9yMqZjK1Ml8UQ2i0/fOset6P4ZdIaRuvxzodp6cHW6+WNrnE/YvtDT+fIW:sxZnFqv0/fOseEQzIKY6XHbQ/mT8Ek
TLSH
T1EB72E916AA34597B8CDBD219FA45BB53D2F91163A2904E445AFCDF0C40EB7EC620782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 9284b2038a16a76f373d4d140d94b6593a8d2368cb06c51a28ed6ebd4fe1fe84
MD5 aa225caab4d578416612392eabcf638d
SHA1 90eea5cb12cf1f951d186048f147cf1b374f5994
SHA512 d76c9cd5896a726ec93cdad869703e7fe20827719d017ed68d24852c7698dedd887a1ab4c9be3c7adb3dd7de9759e2c8124463802cc17d5f51f3eddeb29690e7
SSDEEP 768:ZYsv8OdF6ssi7pLuLnFhWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOysy10Llz:eY8Od/HEnFhWvFvmXu1jaKt10Lm2NuLE
TLSH
T1DEF2FB3B6C0CCB7E4F844E9CEC2A7F8A6DE801CB5698895447FA844C02C76EB56175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 7a3343b0998d4f10a45a3ab504cebae002ea4d89f503eccaf1c17829e067fb51
MD5 b397bf9de5c3d7e0f0ba0f49bd9295d9
SHA1 95f89618fcac625fa04012fb70fbdd172f4757f7
SHA512 966bf30e47c4bb885434ce30aedf923fc9aa18a945c853439edb6053e4dc22fcc8c1d9f92947123bb8a8cd9c7a4ef87533f805a19be490502474652415e584da
SSDEEP 384:0LppY93PBZJPtN53TiRMNB7/zy/m1ZVBtTChBG7E:0LppY93PBZJPtN53TiRMNB7/zy/m1ZVm
TLSH
T1F4B2695A713B0211397E2948B39696364F4235A33058E4BF7FB814A14F67E225CFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 b047dda49cc8106bfdefdb952fd51c299edc60f639df4d6124c3fc017c46c2ae
MD5 31764383a18a374008c8651901af867f
SHA1 ef6ce060d3ca53db869d36a7744b63ffac4d5b5e
SHA512 f2ceae84134d30d548dbae1e245197fc4f58d800dbd7d607c5251c089ee4d4fe92bbed5fd88cbac599690d9b53d8f7f918b7fd978576f65481149dabc7bceb46
SSDEEP 768:wF1jZbl3wwg7kR2oGgLggmXLwlt+UKisXIPyn:0Z3EPeXBPKbYKn
TLSH
T109D25B36E864DEB7EDE78F94B70A7743AFF401A3899869D8D9C85D0C008B19D130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 4a47af0832db1fbcf46fe49ce0be1b65d25a1f51a90f27e8829f285721cf0ad7
MD5 1073a0c7bc6a85205d1258cea4e40429
SHA1 ddde14cefc69e198bc84b932c26c0a05b52eb45f
SHA512 5b912d6644e78029380ab3f6dbe556fa759612a4337b2cce9d66caac222291da74e81aa4f776d24dd7a8948fa0bffd7b0f051bc47b4e4110a1cc5d854198e526
SSDEEP 384:npIiF9CcmyWCs3sNy8TUNTUlIm2QckCr9llKphiftGgEM9Dg9gmtRFgtpAe4KV8x:pTFccps3DwgbkU/koGgLggmXOwI8p0KX
TLSH
T1E4B26D36EC68DEBBECE74F89B74E7A07DEE41227859C59E4DAD81D0C009719C130B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 e8347f054a09eadb0e43341f88a3d9a6a9f1c314bf036f8d8cdced4b47ef2a2e
MD5 44d6c23610667d650b12749202ea9227
SHA1 3fe127d4661b29887d65e998377c1d1b3419705d
SHA512 7c0aa0b63cc93b2c18d4668285e1c6293edb987b66e657238daac91ee2ec51f1338966be5db03f4520171367aea8f6ff2cd47468cce540010db72ff2b5298212
SSDEEP 384:npWiF9CcmyWCs3sNR8TUNTUlI4PfQckCr2bhwphiftGgEM9Dg9gmtRFdsl8pw5tr:p9Fccps3wwg0xkR2oGgLggmXLsltD
TLSH
T19DB24B36EC68DEB7EDEB8FC9B74A3A43EEE40163859859D8D9D85D0C009B19D030BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 5e8da1bbc63b82297ee914bb43af1c5fd9506346fe691ca9bff910224adaa983
MD5 c2457ef6199dbf998b5e39d7a1fc5f08
SHA1 c7217a90a5259ae60d7c99f031753a25bdd930fc
SHA512 5d39ad797deb87bfca98c66000b6abcfef10568675d6e631aa3189905b549cefe299ba188099c8748a516378ad421e33625430404e854e7ab7b030e855d40431
SSDEEP 768:6F1jZbO3wwg7kb2oGgLggmXLyQpt+UKisXIPyn:iy3EReX3UPKbYKn
TLSH
T1C4E291F698E79976D9AE4B87633D6E02AAFCC153B4881994F7C81D0CCC861BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 c3b75ab98bf1126c7c14abf03ee684e3da3a946ba66ef9164cc624e72c64d47a
MD5 b76c2213c4d16191b63ceea6db99e5e1
SHA1 cec4350520d1480656722c1185132d7641152e8d
SHA512 e592fa8bfe83968667e3181b2c9224205d1cc137818d0fd61cc6283c485c8970fa310aed6db3626133db732e3ab18b65002df1b88ea6ea89a426f69415ac11ca
SSDEEP 768:p9F1jZbl3wwg7kR2oGgLggmXLwlt+UKisXIPyn:hZ3EPeXBPKbYKn
TLSH
T14ED25B36E864DEB7EDE78F94B70A7B43AFF401A3899869D8D9C85D0C008719D130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.6.4.1\typosquatting_list.pb
Size 555KB
SHA256 a2c4864e010b437f2fc6e371c334b6b37ae3d99366d7586b8b93d3f84c264c3e
MD5 68e42e75d67c5477efd5afd81fcf5f4a
SHA1 4e79846eb347a76c98f31a5c00ebec96b61bf069
SHA512 fa9cf5a456c7f25fe35df270b7610a1d4c87ee2aa2aec8a99610002e04a8a1add7f7489bddef7a117948467f541c4df56ffc676f5df548c2a60bae0cd220feb1
SSDEEP 3072:s04GzK1JtjtczmMtOQvGz1XVK3RqkkGZD9zTiZJil1CN75QG4lsx049WRAOGQxDF:yGKJtjtKRG6qxciXtN7OlsxXU6sVKhds
TLSH
T169C4C5B9DFC00194DB78112D20BE71D8181412A580E9DFEAFE7D855F2BC2AC977E85E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 198f0135148852f0a5fa94a4bffee48ed6f20397549f2f54ec4159e7c06c06e6
MD5 018ac9e4f4e6492dbe837c76f93e9ae9
SHA1 68a7f9d589b6f66a1750f2e1cb58a03755dbfe00
SHA512 832efcf35c8f60fc80a2883878e81b7cc4a5ae524067ac7d05fe9b8740f38aec2f28b86198931a6254c2bbf6aa1a261ab23ac18a3de0c69b907a5d8190cb9fe4
TLSH
T1174130E20D3C2AD1C4BD0A7EB48734FC94D8D726F2E474796858EA880639A4D648143F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 4956ae11389303fddb2b31672c320e241b562ca13bb8840f8d5a2fa2dc633367
MD5 c39b5cff35ae5889cf0df7281074afdb
SHA1 9ebef0b877bcb8d9fca5390aab08a2dcd2ecbb52
SHA512 541d66a01afce5d72636bbec4cad2a30873f3c1ee4aba861c85d5017f0b78138626375e82f0b4613b14c167ce2efe71583f1c993d8c1d5262e350b33636218d9
TLSH
T1EB4131E10D385AD1C4BD0A7EB48B74FC85E8D729F6E034796C58E9880A39A5D648183F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 a6187938f08a9b348d3287d1062b2d2f0912e2a57425a9c1579157a5c92229e5
MD5 202e834b5b0dac873bb5bfb47fec3fac
SHA1 387bf3fce31f9970dddbb24bfc40404957c58df0
SHA512 c354762f75f6efb6ff6aea80b03b0616bfd8cdd7cb5bc48add75b31582a2f2a97a11684688d3d292404420b80ee1943440c2a0f6bbcd72da6345a57225aaf8b2
TLSH
T1114150E11D385AD1C4BD0E6EB48B34FC81D8D625F2E070796858EA84063C94E608183F
MD5 SHA1 SHA512 TLSH

Submit Download

d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
Size 147KB
SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
MD5 a9f7675ff091bb15c88909424bab4a39
SHA1 90f753d8d7e4397de0f49631fcd9222a7f59148c
SHA512 ff1f89fb04ae9c9a4c6cf6b1475f5a77f1c4f90829acda95cb39889b6b15c3b4f0b3b822a668f8ec8520b002cc90dd397cc26d314ac8fd5f3e2c9826bd458df5
SSDEEP 3072:Ph3iICVe1DvTtr/3tOpPu8LdKBTJyU4AshzWnD7UVDvuZE4tkGL:PgTVWvTZPghwln0AD7UV8Eeky
TLSH
T12BE3E01D29E2846EC82B24F4BA4A718FC71ECF07910BE40F25D984A55C7474E17E2EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 d6bb12722d8ec159af735b3270f83013e8b8e2df54df596eac54c458b11d445e
MD5 e6d52bbc2ba6378f83c8e079c3b58d30
SHA1 2768e8f09a3d414aaa25fb104cffb69e02b8198f
SHA512 40af0fc8008a9d3194c4718b4d0a75793b652b2ee28798bc85f27b90ee46c59025f8d0c8abeea9ff371c756962db066f2f00cee485b203e688a9ee8f2e48648d
TLSH
T171C02B8F243E4DCC4E4A02399048032B8FD07518302402388C0BCA00003DB0E5F4405F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 37e898f8b94216fa8ae3f2dc0aec44a5042976e695c2425c2501e459d0b85c78
MD5 1861ce2f651fc7df52a6dbbf5240904d
SHA1 9ad048d8aa9b6f46d4d95f344027012b5e6a1eef
SHA512 00f87185213ae0beb4525bde3a36589e074d1b1bc5c7d4ec0b5d9cd31766a60cead892dc17d02be252dd6640e82fac9f49886a9c404ce383d4c926a35215fe62
TLSH
T12541F658B7FD1148B3B77F56ABF6686D487EB9372E0A945D00020E4E0662B04C8A1737
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1744-171-0x00000189830E0000-0x00000189840E0000-memory.dmp

Download