43e332faef4019a95d3b72205da7ce72bc4ccd25f53399352b68442f0b55dad2

Analysis

max time kernel
899s
max time network
718s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
25/06/2026, 13:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Xeno-v1.3.55/editor/index.html
Size 164KB
Sample260625-ql86ract2t
SHA256 43e332faef4019a95d3b72205da7ce72bc4ccd25f53399352b68442f0b55dad2
MD5 b33eb96a570d0cdf6ded11ff199d0de3
SHA1 47c7c58cefda42ca2a5ec53af727d34aa0663136
SHA512 409771d5941dc934b46c3a1d906bbc352bb9c1684c4bc585d7d884acc8d8ea93661637cbf047d02b96a17ab978419f8c116097226b89898007eaf3a8e7d976a5
SSDEEP 3072:Nk4J09UmmJv8kBpZaFD48VOAGUWYPjDZlLJbRBiPEP8yKUz2Ojmjr8zM3KP7pbl8:64J09BA3pZaFD48VOAGUWYPjdlLJbRBW
TLSH
T1E7F3F19AF1122D5226C79230619BBE297FF19490BE766B424B9CF3201091FDF116FBB4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
11	raw.githubusercontent.com
12	raw.githubusercontent.com
17	raw.githubusercontent.com

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1188	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134268677249164256"	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3054922120-1500138384-519748408-1000\{58635BA6-036E-4BF4-8168-52366C47D0FB}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4136	msedge.exe
4136	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 3592 wrote to memory of 1704	3592	msedge.exe	83
PID 3592 wrote to memory of 1188	3592	msedge.exe	84
PID 3592 wrote to memory of 640	3592	msedge.exe	85
PID 3592 wrote to memory of 640	3592	msedge.exe	85
PID 3592 wrote to memory of 640	3592	msedge.exe	85
PID 3592 wrote to memory of 5088	3592	msedge.exe	86
PID 3592 wrote to memory of 5088	3592	msedge.exe	86
PID 3592 wrote to memory of 5092	3592	msedge.exe	87
PID 3592 wrote to memory of 5092	3592	msedge.exe	87
PID 3592 wrote to memory of 5092	3592	msedge.exe	87
PID 3592 wrote to memory of 1184	3592	msedge.exe	88
PID 3592 wrote to memory of 1184	3592	msedge.exe	88
PID 3592 wrote to memory of 1184	3592	msedge.exe	88
PID 3592 wrote to memory of 3608	3592	msedge.exe	90
PID 3592 wrote to memory of 2024	3592	msedge.exe	91
PID 3592 wrote to memory of 3608	3592	msedge.exe	90
PID 3592 wrote to memory of 3608	3592	msedge.exe	90
PID 3592 wrote to memory of 2024	3592	msedge.exe	91
PID 3592 wrote to memory of 2024	3592	msedge.exe	91
PID 3592 wrote to memory of 4588	3592	msedge.exe	97
PID 3592 wrote to memory of 4588	3592	msedge.exe	97
PID 3592 wrote to memory of 3076	3592	msedge.exe	98
PID 3592 wrote to memory of 3076	3592	msedge.exe	98
PID 3592 wrote to memory of 2084	3592	msedge.exe	100
PID 3592 wrote to memory of 4144	3592	msedge.exe	107
PID 3592 wrote to memory of 2284	3592	msedge.exe	108
PID 3592 wrote to memory of 4252	3592	msedge.exe	109
PID 3592 wrote to memory of 2656	3592	msedge.exe	110
PID 3592 wrote to memory of 2656	3592	msedge.exe	110
PID 3592 wrote to memory of 4136	3592	msedge.exe	111
PID 3592 wrote to memory of 2580	3592	msedge.exe	112
PID 3592 wrote to memory of 2580	3592	msedge.exe	112
PID 3592 wrote to memory of 1580	3592	msedge.exe	113
PID 3592 wrote to memory of 1580	3592	msedge.exe	113
PID 3592 wrote to memory of 3900	3592	msedge.exe	114
PID 3592 wrote to memory of 3900	3592	msedge.exe	114
PID 3592 wrote to memory of 184	3592	msedge.exe	115
PID 3592 wrote to memory of 184	3592	msedge.exe	115
PID 3592 wrote to memory of 1728	3592	msedge.exe	116
PID 3592 wrote to memory of 1728	3592	msedge.exe	116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55\editor\index.html
1⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x274,0x7ffd4e49c188,0x7ffd4e49c194,0x7ffd4e49c1a0
  2⤵
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1804,i,7918739695765585231,12910640895537729760,524288 --field-trial-handle=2608,i,976830757098292742,8323767178706240195,262144 --variations-seed-version --mojo-platform-channel-handle=2680 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1704,i,1340029383654897462,10249881923152893438,262144 --field-trial-handle=2608,i,976830757098292742,8323767178706240195,262144 --variations-seed-version --mojo-platform-channel-handle=2604 /prefetch:2
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2284,i,2122163204135752744,17945724481408563922,524288 --field-trial-handle=2608,i,976830757098292742,8323767178706240195,262144 --variations-seed-version --mojo-platform-channel-handle=2728 /prefetch:8
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,18316521685104885630,1657697563698909450,2097152 --field-trial-handle=2608,i,976830757098292742,8323767178706240195,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,14232163217920143751,712981635057759000,2097152 --field-trial-handle=2608,i,976830757098292742,8323767178706240195,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:1184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4188,i,5490782409978482582,9734710262060308199,2097152 --field-trial-handle=2608,i,976830757098292742,8323767178706240195,262144 --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:1
  2⤵
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4216,i,8866491337406013769,9902240255775237601,2097152 --field-trial-handle=2608,i,976830757098292742,8323767178706240195,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:2
  2⤵
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,11246109604646914222,11286974703739682737,524288 --field-trial-handle=2608,i,976830757098292742,8323767178706240195,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3780,i,13753929171465374638,8343281645041587052,524288 --field-trial-handle=2608,i,976830757098292742,8323767178706240195,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:8
  2⤵
  PID:3076
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3660,i,674392745194335748,6779518596158675149,524288 --field-trial-handle=2608,i,976830757098292742,8323767178706240195,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:8
  2⤵
  PID:420
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3660,i,674392745194335748,6779518596158675149,524288 --field-trial-handle=2608,i,976830757098292742,8323767178706240195,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:8
  2⤵
  PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4284,i,7690767973515531361,11905375522593618000,524288 --field-trial-handle=2608,i,976830757098292742,8323767178706240195,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:8
  2⤵
  PID:4144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4208,i,14234870053004111426,4217978431416684502,524288 --field-trial-handle=2608,i,976830757098292742,8323767178706240195,262144 --variations-seed-version --mojo-platform-channel-handle=600 /prefetch:8
  2⤵
  PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5008,i,11539519456573679172,17131866229609217635,524288 --field-trial-handle=2608,i,976830757098292742,8323767178706240195,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:8
  2⤵
  PID:4252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5208,i,4457977881653385403,7872708612227445791,524288 --field-trial-handle=2608,i,976830757098292742,8323767178706240195,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:8
  2⤵
  PID:2656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6088,i,4736247250403123766,16161721812109263142,262144 --field-trial-handle=2608,i,976830757098292742,8323767178706240195,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5260,i,13438820619797672564,12913624623054413739,524288 --field-trial-handle=2608,i,976830757098292742,8323767178706240195,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:8
  2⤵
  PID:2580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6304,i,9399764244298597896,17097131876570536801,524288 --field-trial-handle=2608,i,976830757098292742,8323767178706240195,262144 --variations-seed-version --mojo-platform-channel-handle=1100 /prefetch:8
  2⤵
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5420,i,6542483886892959775,137213262847448523,524288 --field-trial-handle=2608,i,976830757098292742,8323767178706240195,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:8
  2⤵
  PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5636,i,1701899526152458082,9957926256155223478,524288 --field-trial-handle=2608,i,976830757098292742,8323767178706240195,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:8
  2⤵
  PID:184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6188,i,13294181930752112450,15294318895613164385,524288 --field-trial-handle=2608,i,976830757098292742,8323767178706240195,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:8
  2⤵
  PID:1728

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4024

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 fb2adc73b0e2921e667c28899e7c4f830fbb29c7f563ca0b3319ac4cd7007983
MD5 5a6df42dd698122d665520fb12140c37
SHA1 9d09f6fa2f10e669a83386ff53aae5fba73effeb
SHA512 52513e0bbf5b162ddc3643441c215f197264c32736ed560286ad3dcfba5831b89dd961ff3c2ddda1a50ae1bbaf4589e17ef43817fe8c3294ca18c88dec2e21b4
TLSH
T15DD012317B5BF001C6C120B2D8348B79923F889A74D7C652B024C88EFDF625DA3D6067
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c2c9a9ffe645bb4483011279363f1d6b7efe3d1311c969002595db89e2e28e26
MD5 fd1a71c5f52353ab70a63caeadd8a35f
SHA1 1c2efede69f9484a6b25dfb9879b2e134c0c04fe
SHA512 53bb310c44087d0ad54291ea32ae8e6708d9e6675875d074264aa49b27317393b3c1f0758bd53b04795df767f42392d93ad325da28f085258329151e4a47a03d
TLSH
T12ED09B213756A001C5811071D4244765512E44557497C6527014844DEDB61595395057
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log
Size 2.1MB
SHA256 838dba79670d89090652f08dc5e8bca4800b2f74a89fbcefbac75e298672a92a
MD5 0ee2832d3b3b54a8464dd4d4bb57a9d2
SHA1 d64ac1a1cdb2d0c5f39e977657b0a82b8366ec57
SHA512 bd3c90e87e7496dedabc11eb11b1e533fed0e58fe8abea2999e5c84ca6835274702457c7701bbe15765f6afbcae9542fbd8100208bdc6119a84a543c166955ab
SSDEEP 12288:il3bBKnx0TGS3MOEhBYAbFg7G8FcPA73KZEB3tKBck75I+ZLZux/Gv48GPbx7mcq:il3Qr0EZUKZEB3tKBck75TDFCo5
TLSH
T1ABA5004A8553FEEF12347C776836B4CDAA6807E74290FD2BBDFC857D9756AA80803250
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 6KB
SHA256 b8bd4ef6012a431423adb2bedf2b5e2f3f91b1387cf631f8e3310887bbf7fa39
MD5 91d40c3c7d67109ff4ff91f5e7939779
SHA1 6444866ad2d72cacc2032ff5d637d044f258b432
SHA512 20a665178fac075cf3f6362426e4eee5f11f070797b3f5c5d93f38c45b7164f4661b2ec542744b9a7edeeae889eed0fa2f6a13f1ecd9f1270ed557168fef2fda
SSDEEP 192:ezjJbL+L6nLA7K9c333xxeeefffEENNNaaaLLLQQTLO:ezjJbL+L6nLA7K9c333xxeeefffEENNL
TLSH
T1BCE1689386D5D39A8F0911CB49A4675C027A370DEBECE90C038CDDDD308E5AAB6E26D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 2bb1b3711bf078785df56095b7bb67e047bb69b188bfb9e593dea84a75e3a3d1
MD5 af4f355d2b63cae1f273d0ab97976999
SHA1 9ec7fd6fab0dbe63e503f042b9b1ce8481ef2249
SHA512 756b6bcf450e97b654cfbda204b9b1759b047af7d1de869dd75150dcc8a53d5e6cedd133d09607c7cf018a14502f2587f4d050d55a2c80daea92b768932b0ded
TLSH
T1FDE026E4A9EBC32EA200A487C17CB30CC3803B0F92C8BDDE1708C4847081680A7C3690
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 98fd45b556efff218aca64fbdabc418d14cef26e683660e4a9d9ee2f6e8a0881
MD5 3a66726dd6575d3a351d7feb75878f25
SHA1 9b515561b10f2b0ef3d39b068d5ae3017fc6b55e
SHA512 d8fae298f45d11872d3618c0a255f8d587fffca14332838c114f3168e01679deb991d0d7417ec5e534c7363b5884521fc777a7f8ed69ed473a94d55f9efb787b
TLSH
T16B6172B9C22281F1E7A3D072A3C3423479F99A77B957DE82A1A8D4797D32F327014218
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a284.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58a284.TMP
Size 3KB
SHA256 472f88f7baac4eac0674408055d3d219f2a255617a9bd81b968c09a47721cd0a
MD5 a813617810bf208b6049ecb9187c75b5
SHA1 24dd6bb92c72bac3785632f91e287127eb5a2a0e
SHA512 54031298b16c36e07f1ced8fcb9f19b4f542f78bd7bc8f01b13a156786ce9acd6ec2713f5cac1cbec026d28a27659deb4e0a9b5aeb2ff200a5ba2da18d3e03ff
TLSH
T1196171B5C22281F1E7A3D07267C3423479F99A77F917EE82A198D4797D32F327014218
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 720ad693727285cd0b632eff7f6ee30cbd79ef8d650112b5587caddc7ac44620
MD5 b251b8f94c24f866352858c017f7c432
SHA1 df698e2e7e14a5ab61ca84657a3d41b3a19b80ee
SHA512 13860899beb55e977f2df9c6cf71b7dbd04b233d703c3794f8606d53fa3d6ee01efeb2ca65daee9fe5467867d4a5ece2012519ce65c79f7ea3201688c358613f
TLSH
T1F011C3F3C3D5856ECA1156F0AA247E2BCD2D0516432C7C5695F4EF1B93E2475E00195F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 b58506abdad8dd5f1947aed7200afb87977f33a99607fde227e91d0443f0ec06
MD5 a8cdec3e7a347003636613f762ea21b3
SHA1 5cd2efd73d797e2a042f5b2b28c2794bf2499ce1
SHA512 403c995f99d6d25edc679d849c4e11d7514329d7bf250b39de8da0d0a947b27761d771f8b51724d7fdb6ed6726b152d9a32b2f2ed7119c18c495cabf8986c0f8
TLSH
T16D21A0F783E1866EDA1156F09A287E2BCE2D0511432C7C6985E0EF1B93E2075E002A5B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 5254ba4839b34b3e602fe3e7b3e201281b26eaa98c4a6f3e52a897fc4e65f1df
MD5 8eee9f34c8ee626b14034d92abc5b0b7
SHA1 ec377e8650aca3130088891263ccd7807de0258e
SHA512 5a15e29e842fb3bd4520e028cee15aaa6dafb28fee209ed638c7a743b24cc67e69e5bc578d7fe217103c75326844fac83849c7f6663840096785e2ce4a497a57
SSDEEP 192:sxZwRiyM/jK1Ml8UQfkN/f9XshGNE1IdpHiHW6+WNGYnu6qGg2Ig56J:sxZwsqMN/f1shGCGCHbG7EY
TLSH
T11352F912AA385977CCDBD609FA51BF53D6F94472A2900E44A9FCCB0C00F6AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 60cced4099a7c11069734bd29dd15a3f6126e86d5fa76bfb233b62b8160ff232
MD5 eb0808810232e3d296a3bc00c551ed71
SHA1 a6323edc1c2e719fedf37fe54cb66bdd352165fb
SHA512 6105c0b25dd46a8afc4738b15da54e501925ab3af25a62f279e02b55e8a62b831155939b4aa693a906a153226c03fd4cae1b5cd563f4431617cca8045d18fbb8
SSDEEP 192:sxZwRiyM/jK1Ml8MkN/f9XsK6NE1IdpdiHW6+WNGYnyDqGg2IgrJ:sxZwsMN/f1sK6CGoHbGEE9
TLSH
T14542E912AB349977CCDBD209FA55BF53D6F95572A2900E44ADFCCA0C04E6AEC221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 65ba67440a089dde5f90e9f11d1fb3f71d996cde0f7ab88b40892df8bdbb68f4
MD5 6ebcee01a756ffc83d1dc69719083ca0
SHA1 d35a2694e30079bd1293799b108fb0fa8ae66218
SHA512 927af97e6816ebb68453c80cf245fb6453cd868cd9e392fb0314c4521e1ab368a9ea7b89724253467b65917a188bd4dc910307af471d6c08085a3515705ae74b
SSDEEP 192:sxZwRiyMqZjK1Ml8UQfkN/f9XshGNE1IdpHiHW6+WNGYnu6qGg9Ig56J:sxZwDqMN/f1shGCGCHbG7LY
TLSH
T10D52F912AA389977CCDBD609FA55BF53D6F90572A2900E44A9FCCB0C04E6BDC221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 6ee990899b306c687da4f60822bdd5c2c22707c08106e81f1d02d241de4ddb3a
MD5 5b872abb39b583eb4ed0612f7067a914
SHA1 8ba3f6caf6617c045e95e2b2e10205a2774d9b07
SHA512 b8b7abbfa703edc652bf0d945a9f3337ecf41f6f7c70819d8e20826093a43c14086a783eb1beb838a83ea950dda49b32e6f6a7f5eecfcb1ac95b04579855b01a
SSDEEP 768:25QRMvUWv0sTg8F1+UoAYDCx9Tuqh0VfUC9xbog/OVFTLlTBshBro/ErxDf:25QRMvUWv0sTgu1jakTLROh6/Erxb
TLSH
T1BED20B3B284CCB7E4F841E6CEC26AF976DD801CB67988D5447FA884C03C77EA511A59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\6265b350-bfe0-4fa4-9770-1f37078466b1\index-dir\temp-index
Size 1KB
SHA256 db1cae8051b13c96a41c93584e95b85927f97e54e96797077622c09fb54ca6c4
MD5 99a58ebd0eea1c659bbb8755500804a3
SHA1 37b869748b05f70148bd972ffd997a83ebd34843
SHA512 9582040201486c5bc16477c0606dd8554f94523623986a12136269a4eaae5f0fdf7ff481079297ee52f482a3ee53c97da8aa5319343183e954ee837da91f05a0
TLSH
T11D2154498E52851FF9B58DB2107768E033B0C9DC2715A363587C633B2D2235A2D0B1C8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5ce97d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\6265b350-bfe0-4fa4-9770-1f37078466b1\index-dir\the-real-index~RFe5ce97d.TMP
Size 1KB
SHA256 e7b9631b9b4e8f3f7b9a5affa9770c4e58262105e2b4bdc64b4f23dbdf85c3f5
MD5 11268e6136bae68df0d5e67c7741dce9
SHA1 ce99987ce94950d8af046341dae198e0b9c4c1df
SHA512 641c571719eaad7ea77f6efd8a6a92f1be753a720d928f6fe38e7af98bed258f5626d2a1b7baac3f566162201b3b1a70d0075bd15c6744821690c69891ce401c
TLSH
T1CB21408A47924A0FECD055B60563A4F433B0C9006322B3C39839273E5C3579E5E4F0C4
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 ca89893aefb5e08d16d06bfb8d901bf063aa5484553b112af09163c9ed72a0fb
MD5 ef0842def227d993da89567a3ca209ec
SHA1 f17d1697751eeb909a6676e00b0d6179b62dadbf
SHA512 324d02b61f843236a5da2535871546b928eac4475d67b3662daf2683905031b8e4f00a3fcd4a62f817375e6a53ac9ae1635f71175f198f27661ad6361cde8f40
TLSH
T1E7E068B23EEB2920A86F87D2283200A901997A58D408BC9E002672D3E0B57213801C51
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 a1814e427d5ad92ae169cb4229471b9875dbf88d3a534b6fad94db571e986953
MD5 d9fd1b9cbebd3c8230c953442ac82c09
SHA1 490494ee543d6204bfccdd1cb155cc305f39e201
SHA512 2a42b8813f0a59000ab6f977cfa16aabdb73ae8b8b420af057975838ae63206bdf5a2eb396361d589d9d70e051abc66c4ef2681731c5835508d6823d55731ac2
SSDEEP 384:CtNn/s3n9SfsNBk/DdeJNCX54attKE+wulk19mn15wbAjEGe:Cj+9UbWAxzKE7T9mn12bfGe
TLSH
T1B6927D3798382C371EE39885B4472A176FB8867797C52BA485EC4F0D45EF39C131BA1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 f0aa73cc00fe4aba06a06fc8fd86318b86817a5b56dc8722c22637cceeee603b
MD5 a447508a589a421c2e7dd3bb4ce3a845
SHA1 2870f1a54d67deb16ea062d5edb227c081fa44ce
SHA512 4ba92d21beaca6c26b480795872465343ca5381c2e31df82a93f9be03b2db140f21453d98c13c1c38e77cb978f363901705ac06db5f7f55ff3601accd21ffa52
SSDEEP 384:MF1tNn/s3n9S5zsNT8TUNTUlIlk4DdeJNCX54attKE+wulkY9mn15wbAjEGe:MF1j+9WKwgvWAxzKE7W9mn12bfGe
TLSH
T13DA25B379878983A5EE38E85F54B26179FB44167D6C16AA096DC4F0C01EF2DC130BE15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 aba0e2da867a31a049a8bcd67f4d522664d41a2382ebba0f7450cfc378b6b351
MD5 633398cc743380da8fc897431adacae7
SHA1 55c2c0b63de30729a70410c669f015c221998da5
SHA512 5c6b4952c62f474ba36f41472e41f821ec25b45684ce3d803704cff18c78f843923611878adc6992f65810427eb6cb0e4e833ee0a4c1a3fd4d8e7026d35ed225
SSDEEP 384:XtNn/s3n9SfsNBk4DdeJNCX54attKE+wulk19mn15wbAjEGe:Xj+9UKWAxzKE7T9mn12bfGe
TLSH
T186927D37A8382C271DE39885B4473A176FB8863797C52BA485EC4F0D05EF39C131BA1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 01d72319a763eb4977bf032c0b4da85a93132fd2061a0656ca53346f210f64b4
MD5 95d88bb46e0892d25365f41483ed536a
SHA1 bcdc6b1d75ebbf3de5222d05fb81550dc0538992
SHA512 0918350e6ae76cd834405ac909bc3d44aa90f15552bf17806ab4b69e5c742aa75fe9267890e6e7b9dd15ce63abe0a08b8d55b998de2f1b6abcba3049f754976e
SSDEEP 192:iONLI6G+b5QmiUysBeE54aP1tK9y+wulDnIL8ShMqONMU6:iONk6HX9eE54attKE+wulkp9U6
TLSH
T1CC120B36A8787C7B5EE3A881B0873A136FA95227E785BB94D5DC1B0C05EF25C130F526
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 94ef0c804a213a6e66173370fe553800b6399ab419212134c366e59361eee312
MD5 91ea41da025db4c763abfcadfd8adf7e
SHA1 c5daf9c0d90d10bacb27d97e5e343bad6355a235
SHA512 e77e17c1d21f4384a6382e71e138a912079f5b089c26b31196fe114b22fef823ce6812d2dc559791a8dbcead3ee8498299bcf69b7b107b95f824d08e7ef697c3
SSDEEP 192:CONw6G+bgQmiUyKBDE54aP1tK9y+i8OyyRU6:CONw6Hg7DE54attKE+pKU6
TLSH
T13902E935A8782C7B9EF39D46B5872B276F95112BE6806B94DAEC1B0C41DB24C130B537
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 5cea1a70f81477967de92bcb567cf35fbb651812b47db0a2268addba5397b99c
MD5 a2e7ab40ee4af0ac8dfc43c0a4cefdbf
SHA1 ce846487a465273b8ea61480fbc69d9167eb6cd6
SHA512 9651ccf532c60505e06e02e65014dacb93ce20b611edc46e3a673bb8dc067451aabb35168b89c6f01eb5cb3de44afd8b792eaec34f520692db9337974c337944
TLSH
T175412A5DAAE9114CB3B76E5A9BF6686D887B78372E06D59D00110D4F0663B40CC71737
MD5 SHA1 SHA512 TLSH

Submit Download