hxxps://www[.]rblxscripts[.]net/executors/xeno

Analysis

user interaction
yes
max time kernel
120s
max time network
118s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/07/2026, 12:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.rblxscripts.net/executors/xeno
Sample260701-ppvbbsgs2z

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4432	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134273826661962791"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{447B2A83-80FB-426B-A9DB-11DA37AC450F}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{B86742C0-BFFB-4C03-A1EB-AF38909ADCAF}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 4536	2172	msedge.exe	86
PID 2172 wrote to memory of 4432	2172	msedge.exe	87
PID 2172 wrote to memory of 2532	2172	msedge.exe	88
PID 2172 wrote to memory of 2532	2172	msedge.exe	88
PID 2172 wrote to memory of 2532	2172	msedge.exe	88
PID 2172 wrote to memory of 2100	2172	msedge.exe	89
PID 2172 wrote to memory of 2100	2172	msedge.exe	89
PID 2172 wrote to memory of 456	2172	msedge.exe	91
PID 2172 wrote to memory of 456	2172	msedge.exe	91
PID 2172 wrote to memory of 456	2172	msedge.exe	91
PID 2172 wrote to memory of 4896	2172	msedge.exe	92
PID 2172 wrote to memory of 4896	2172	msedge.exe	92
PID 2172 wrote to memory of 4896	2172	msedge.exe	92
PID 2172 wrote to memory of 752	2172	msedge.exe	93
PID 2172 wrote to memory of 752	2172	msedge.exe	93
PID 2172 wrote to memory of 752	2172	msedge.exe	93
PID 2172 wrote to memory of 1772	2172	msedge.exe	94
PID 2172 wrote to memory of 1772	2172	msedge.exe	94
PID 2172 wrote to memory of 1772	2172	msedge.exe	94
PID 2172 wrote to memory of 1188	2172	msedge.exe	98
PID 2172 wrote to memory of 1188	2172	msedge.exe	98
PID 2172 wrote to memory of 4656	2172	msedge.exe	99
PID 2172 wrote to memory of 4656	2172	msedge.exe	99
PID 2172 wrote to memory of 4384	2172	msedge.exe	102
PID 2172 wrote to memory of 3332	2172	msedge.exe	103
PID 2172 wrote to memory of 3332	2172	msedge.exe	103
PID 2172 wrote to memory of 3332	2172	msedge.exe	103
PID 2172 wrote to memory of 520	2172	msedge.exe	104
PID 2172 wrote to memory of 520	2172	msedge.exe	104
PID 2172 wrote to memory of 520	2172	msedge.exe	104
PID 2172 wrote to memory of 1064	2172	msedge.exe	105
PID 2172 wrote to memory of 1064	2172	msedge.exe	105
PID 2172 wrote to memory of 1064	2172	msedge.exe	105
PID 2172 wrote to memory of 2168	2172	msedge.exe	106
PID 2172 wrote to memory of 2168	2172	msedge.exe	106
PID 2172 wrote to memory of 2168	2172	msedge.exe	106
PID 2172 wrote to memory of 4616	2172	msedge.exe	107
PID 2172 wrote to memory of 824	2172	msedge.exe	108
PID 2172 wrote to memory of 824	2172	msedge.exe	108
PID 2172 wrote to memory of 5308	2172	msedge.exe	109
PID 2172 wrote to memory of 5308	2172	msedge.exe	109
PID 2172 wrote to memory of 5308	2172	msedge.exe	109
PID 2172 wrote to memory of 5368	2172	msedge.exe	110
PID 2172 wrote to memory of 5368	2172	msedge.exe	110
PID 2172 wrote to memory of 5368	2172	msedge.exe	110
PID 2172 wrote to memory of 5380	2172	msedge.exe	111
PID 2172 wrote to memory of 5380	2172	msedge.exe	111
PID 2172 wrote to memory of 5380	2172	msedge.exe	111
PID 2172 wrote to memory of 5456	2172	msedge.exe	112
PID 2172 wrote to memory of 5456	2172	msedge.exe	112
PID 2172 wrote to memory of 5456	2172	msedge.exe	112
PID 2172 wrote to memory of 5980	2172	msedge.exe	115
PID 2172 wrote to memory of 5980	2172	msedge.exe	115
PID 2172 wrote to memory of 5980	2172	msedge.exe	115
PID 2172 wrote to memory of 5536	2172	msedge.exe	118
PID 2172 wrote to memory of 5536	2172	msedge.exe	118
PID 2172 wrote to memory of 5536	2172	msedge.exe	118
PID 2172 wrote to memory of 6112	2172	msedge.exe	123
PID 2172 wrote to memory of 6112	2172	msedge.exe	123
PID 2172 wrote to memory of 6112	2172	msedge.exe	123
PID 2172 wrote to memory of 4876	2172	msedge.exe	126
PID 2172 wrote to memory of 3104	2172	msedge.exe	127
PID 2172 wrote to memory of 4768	2172	msedge.exe	128
PID 2172 wrote to memory of 5380	2172	msedge.exe	131

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.rblxscripts.net/executors/xeno
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7fff4668c188,0x7fff4668c194,0x7fff4668c1a0
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1916,i,14124205814588690591,5210947319718746763,524288 --field-trial-handle=2268,i,3617048379227667219,9391520571539603419,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1736,i,7174966194803402214,6639988309965730538,262144 --field-trial-handle=2268,i,3617048379227667219,9391520571539603419,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:2
  2⤵
  PID:2532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2580,i,754516736141045365,9975447512481839552,524288 --field-trial-handle=2268,i,3617048379227667219,9391520571539603419,262144 --variations-seed-version --mojo-platform-channel-handle=2736 /prefetch:8
  2⤵
  PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,1022987787098033766,14092055996660101910,2097152 --field-trial-handle=2268,i,3617048379227667219,9391520571539603419,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3412,i,7485404627132667925,10436682799495106372,2097152 --field-trial-handle=2268,i,3617048379227667219,9391520571539603419,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4152,i,14309010411615996203,1328998246953863971,2097152 --field-trial-handle=2268,i,3617048379227667219,9391520571539603419,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:1
  2⤵
  PID:752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4328,i,12515172818411352042,273405269214490979,2097152 --field-trial-handle=2268,i,3617048379227667219,9391520571539603419,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:2
  2⤵
  PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,15697078620660246397,6280654602609608854,524288 --field-trial-handle=2268,i,3617048379227667219,9391520571539603419,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5088,i,18092914802747627100,1257173345610396372,524288 --field-trial-handle=2268,i,3617048379227667219,9391520571539603419,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5956,i,18021799000243776318,17850628644123311687,524288 --field-trial-handle=2268,i,3617048379227667219,9391520571539603419,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:8
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5956,i,18021799000243776318,17850628644123311687,524288 --field-trial-handle=2268,i,3617048379227667219,9391520571539603419,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:8
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6316,i,15424399678999768010,12000418266546274756,2097152 --field-trial-handle=2268,i,3617048379227667219,9391520571539603419,262144 --variations-seed-version --mojo-platform-channel-handle=4000 /prefetch:1
  2⤵
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6332,i,605540481997748856,17996681117008903825,2097152 --field-trial-handle=2268,i,3617048379227667219,9391520571539603419,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:1
  2⤵
  PID:520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4240,i,10616654614969378797,1251391750762488416,2097152 --field-trial-handle=2268,i,3617048379227667219,9391520571539603419,262144 --variations-seed-version --mojo-platform-channel-handle=6616 /prefetch:1
  2⤵
  PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4296,i,7773385323306724107,884333314039766019,2097152 --field-trial-handle=2268,i,3617048379227667219,9391520571539603419,262144 --variations-seed-version --mojo-platform-channel-handle=6776 /prefetch:1
  2⤵
  PID:2168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4304,i,18038486620810869992,14771509151114788316,524288 --field-trial-handle=2268,i,3617048379227667219,9391520571539603419,262144 --variations-seed-version --mojo-platform-channel-handle=6908 /prefetch:8
  2⤵
  - Modifies registry class
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4228,i,18297942489430423350,320527766187254727,524288 --field-trial-handle=2268,i,3617048379227667219,9391520571539603419,262144 --variations-seed-version --mojo-platform-channel-handle=6888 /prefetch:8
  2⤵
  PID:824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=7276,i,6319296142959181139,8053178329160024027,2097152 --field-trial-handle=2268,i,3617048379227667219,9391520571539603419,262144 --variations-seed-version --mojo-platform-channel-handle=7364 /prefetch:1
  2⤵
  PID:5308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7260,i,14023779906359762397,5952535763798768703,2097152 --field-trial-handle=2268,i,3617048379227667219,9391520571539603419,262144 --variations-seed-version --mojo-platform-channel-handle=7264 /prefetch:1
  2⤵
  PID:5368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7472,i,8156984179429108137,7313242257316852985,2097152 --field-trial-handle=2268,i,3617048379227667219,9391520571539603419,262144 --variations-seed-version --mojo-platform-channel-handle=7388 /prefetch:1
  2⤵
  PID:5380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7468,i,14621589388193687563,685773272298267294,2097152 --field-trial-handle=2268,i,3617048379227667219,9391520571539603419,262144 --variations-seed-version --mojo-platform-channel-handle=7612 /prefetch:1
  2⤵
  PID:5456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7932,i,13116000656213937035,18356632437883200062,2097152 --field-trial-handle=2268,i,3617048379227667219,9391520571539603419,262144 --variations-seed-version --mojo-platform-channel-handle=7920 /prefetch:1
  2⤵
  PID:5980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6780,i,14636815030691867003,13010367902754781362,2097152 --field-trial-handle=2268,i,3617048379227667219,9391520571539603419,262144 --variations-seed-version --mojo-platform-channel-handle=7292 /prefetch:1
  2⤵
  PID:5536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7188,i,7245166394609482177,5640773473620448112,2097152 --field-trial-handle=2268,i,3617048379227667219,9391520571539603419,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:1
  2⤵
  PID:6112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6792,i,1404972378369119705,11297224673918711851,524288 --field-trial-handle=2268,i,3617048379227667219,9391520571539603419,262144 --variations-seed-version --mojo-platform-channel-handle=6748 /prefetch:8
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6840,i,3674731551075249207,12462013536964924929,524288 --field-trial-handle=2268,i,3617048379227667219,9391520571539603419,262144 --variations-seed-version --mojo-platform-channel-handle=6808 /prefetch:8
  2⤵
  PID:3104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8120,i,12160391678743451721,15393575512896737441,524288 --field-trial-handle=2268,i,3617048379227667219,9391520571539603419,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:8
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5408,i,16974270328313649424,9008970735688032676,524288 --field-trial-handle=2268,i,3617048379227667219,9391520571539603419,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:5380

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cd640af4b18734f838b65cd3f2b65e25dc669e7cc487a16f826240b353446af4
MD5 337b94f0014654439210355bd20e82dd
SHA1 26e4c8276331781253e2a807dd554b2ee3ad7e8e
SHA512 087107a51c83ccffad34c7d3f5423a0f231d30a9f78e9ed5db98eb770bada291f65c7b34d1e72284571b846a7acdf88b217ef4da25b7acff47964af1551b2e9b
TLSH
T1B6D012323B197041E71A8130E403C74017AE54B524864606A254C50D6DA90C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85f865adbe5e58c0596a4db9b9daa509b8e2bd087dbcc9a01a5a095a266757bc
MD5 29ddc94c4e214fd03f664130dd36edfe
SHA1 10dfd57508ad6ef16445956dc1ee4d8c2bffc4e3
SHA512 fa7477f3f8068f41dae4965a930de8ad11b234c1ccfcd17a84fb2bfe4c289beebc19be8d058f75ed01b6dbe7304af8270da91d31316fc94360f4fa750ab203bd
TLSH
T13AD012323B597441E71A8130E403C74017AE54B524868706A254C50D6DAA0C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_0000c6

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c6
Size 75KB
SHA256 fb69e9604d392d091033826a7598df0959a1f5ce9d49dfa7adf87399fc8d3f0b
MD5 da66738b910f45f955858f413592c54e
SHA1 822c5ef514cd2971d7c6ad7a61fac927139c460f
SHA512 218f50dec6cecbbae73f3cba00c23a3f1cd633ceabbf890bffb3dbe5be5b2afd0b5b70dac392b0469e2657eb9132fd519393740b452bbf4956f6dd79af54e6ba
SSDEEP 1536:JaEjjnn2sMbE748bqoDT+oaLugjr6L6oeK5qO+Ynm+MRTjvy:kyjnRMbEJbqoDEiL6oeK0OZm+Md+
TLSH
T1967302DC92EEEB4E52C448AC75D9690BDA396D9D3D4C5B3D60208D09EAC4A08D4E6F0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 12caeac832cb85d84366a48d6edcacdd4c8961855db8508e9cab9bbaf80bb16b
MD5 43dec848e4a8a93f9add88da6542fed9
SHA1 0b83c21d7bdbc62e874847392ad77336c0fda6e5
SHA512 248f7cd78ff8fbe8f44115c77a575dbeaabae9b39cb018a82e2f985e54c99c614de63abbdea0c9c235173759f1c42b1867cdbe70c8063240b02ebd63e5d30bc2
SSDEEP 96:JuUzFrFccFX4fVijWxK0tBrnYc2Gp9Wnma+NTtOfpqWThrp08Vi33:JVrqu3WD2BKbNT8fp9N+3
TLSH
T11AD12035928711A8CF2921B961DE182C72FB4DE5FEE75F4348D6567B6C237C0A3CA108
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe59017d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59017d.TMP
Size 3KB
SHA256 0c7ae9a8e213661886f7580e189d5a168fcbb426d41d1d61a225e88266813e44
MD5 7793b2a992183a842e739ad0f340e2ad
SHA1 dfcf7e2612107cafd31f426491c16128ad908db8
SHA512 4b60d27c8c46367d13b4ad0a62516f2c0f5074c2c8821bc140ab60a8a200c18dd111f9e2454f78e4da04e8f03b58348148657407b0b62df528a237e46e3e08b0
TLSH
T15A81C739C20301A5DB2D01B8B1CD152C34FB99E9FEAB1E958CD56B7674323D1E39925C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

50d613c6-de28-496e-9824-d1de5e197426.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\50d613c6-de28-496e-9824-d1de5e197426.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 21KB
SHA256 df6e58e6b95ccb5cd875a5cd3c248f76c16b5524ad8de22847ffe887e68348ef
MD5 e57a9bb29f33fad546093e6b65165b47
SHA1 904d8eb4b54c11495c95b5282147eff607318483
SHA512 db1f13e28cfd065b9f6bd16895e7e3a8c05b99c08971cce2f2648451799b4d0f695b30749209b7f137373ee263cdaf9fb5b01de5c23af4bea275f2cfff4c1844
SSDEEP 384:Dhtwxj8ePVLsxrNPDgpim5efYHTxMbQZJSkZazJRJGW7L1RV8VqWaCRVjUjeGlXJ:kMJq+0EN4lO
TLSH
T1B4A2BFFBCAF4C97DA82112F1A664BE1ECE2D0559936C3C1AC4D6DF8793E2071D24198E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 34a14388fc1c36eab0b268489c39b4a2d5e70cf24d13f21054e2ee86204d98aa
MD5 c260dcb1770bed3daa34d5d092ed31c1
SHA1 3b5f45af100a75822028cb4f91ef86c394b5f0f7
SHA512 e0ec6751aed545a045ff3762d2ec23e652f4f4110e56a6625fb7a4251065095ddf1a6e22f260ea27afba4a7cf6521aa039e8e7d8ff407f7cf4c2f15dd3a39b03
SSDEEP 192:sxZVGXRItyM/jK1Ml8MkYa/f47/sco2UaVMDAIdpjVsOVHjVsHW6+WN0VNR/Yz1S:sxZm6M9/f2/scca8Z2HbO/B9
TLSH
T15B52B652AA34997BCCCBD219FA45BB53D6F5146392900D44AAFCCA0C05E7BED231781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 1d3be57d6183d4fadda0d0ab132c43eb205fc4c63dfa4d9e8340050fdda54d61
MD5 45b9cde631b1a0f51acebe4a9d5d3af8
SHA1 57750df4e7f4cb664c4b2a6ae55866f142ce3005
SHA512 93046b96395866b232ae0869b5633e9fe3eedca55e6f7e50641d9a35880d2fafcd1a904d04006978905639a3a82145a16722cf3905c7d912fbe57504c6ca3573
SSDEEP 192:sxZVGXRItyM/jK1Ml8MkYa/f47/sYMo2UaVxDAIdpjVsOVTVsHW6+WN0VNR/Yz1o:sxZmyM9/f2/svcaVYHbO/BB
TLSH
T1AE52C752AA34997BCCCBD219FA41BB53D6F5146392901E44AAFCCA0C05E7BEC631781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 bde515cddc31b93ba6da7198c498d1c5bf2587e8c38a0649c3baeb0f777250af
MD5 0b79554d5f2f51ad706c9e5573c9420b
SHA1 e58952f46506862a982de51c03dc8e39d93c2d67
SHA512 16f83d1cf4e8cea56683b611b5ef0526740256b507afb710e853ef4a0a6595f936ebf72c62f4af5a820ed0ef7d57fc5d9a557acabef9135972d7c60c3b24424a
SSDEEP 768:/2W7kf0Wvqina8F1+UoAYDCx9Tuqh0VfUC9xbog/OVX5LlWYSj4roIh0wY3:/2W7kf0Wvqinau1jaa5LA3jDt3
TLSH
T15FE2FA3B680CCB7E4F841E5CEC266F966ED801CB66988D5487FA884C03CB6EA51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 e2fd7058d1572a18f9b2315f5458ae5884ee7ece41ae93a85447ddfb4a18d812
MD5 64800ad77ce1f9820fac9fb60d207ae4
SHA1 ae14d0687de0e6a8466149f6dd8a56c520fc0a6c
SHA512 41fb0c8db66df69fc29a38d82370e1d63c59b92ec42d609215ee8f06f4dae74c0ec6219ad032bd81c6efb01e5e9c622250c33dd58bc7c5a77d251342d94e55b6
SSDEEP 96:KIbCKcjNmKeQqCIwKJu/fItpfd9xWJmsgRxK44go:s6prGfItpfd9cJmtR74go
TLSH
T148918546703B4A9138BF29889299D5368F8236673518E87F7BB814624F67E114DFC9CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\52c8bc50-e6ab-493c-ad52-e5c1d08fdca6\index-dir\the-real-index
Size 168B
SHA256 efdad9c4d0b88c57218eb37498a08c73a73954d56bde2892c135bc98a72bd6b7
MD5 e877fdc1fad55387222aa675528beb46
SHA1 acaab4dbb8db505c547ade1933cde3962c321f97
SHA512 6fad8a03347040a936a50f68b0d7c84e610bfe75a7e2e6a973b9838dcbaea7ef35af833d6bd9b493bda50065e0b54c15ae55ecbb333c7e0aa6a374fdc55c93cf
TLSH
T1A1C0922CC8580209C0A603B8185626B526660E6AB82E53A3A0D422C9B0861A95A964B8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589db2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\52c8bc50-e6ab-493c-ad52-e5c1d08fdca6\index-dir\the-real-index~RFe589db2.TMP
Size 48B
SHA256 39043fd24d8b1239faefc726b788487c4353bbfefbf6311c226428e788d0ddd4
MD5 b0ff6cfa82b73cd5e3a0e2283d9638c3
SHA1 848fc828a88a0dd3b54ac08eacb5a70519c3386a
SHA512 0e427191e7db2a18cf3b34d5d34901abf74edd6be54dc43aca44f864aaea9055fa163d5081b26f71e2c78c5d03ad8a46126c5fe8c595594b37bcdb3e834bdf37
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 81B
SHA256 94c279d25b256d9b8c60a913a2beac7fa4accfd8f1edf01964ea03b646d69483
MD5 a491005f8110107c10f67632a62d8439
SHA1 645fbf580211b2652a4c008ac67fcd9b96f65bfa
SHA512 0163e0542aa502420de49a3d7666a232f771723889b440dc7c97195015f1d6458f0144f0003c28ada3dc93b2b94cf5d9b5132098b6c03a6e340e6e9aec8a3d4b
TLSH
T14BA001E74C04C4AA4A71B8E96124B35DE15B829C8CC4EDF1D40890462138B774016A14
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 162B
SHA256 17ef8c7b5606a049d9602ac7da71e29be19c620956e563845617c5f9097ba910
MD5 cfb4e9b43954db7f0200a58c42baa49e
SHA1 42d1fdaf0f4042bc94c64731f305f4fd60a9ce8a
SHA512 da949ff19b3b64a89ed4a6c5d2b56bab213b2bb714f7cb506938e113b73a12f9d8780ce6ea82d77f59a9f03b287be468c09a45982c45bdad16062bf9cb4ad4a6
TLSH
T16CC08CD30C298A874B71A9E09020B24CC11BCDAD5CC1DCF4A90930023034A338402E38
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 156B
SHA256 074a729559ad578c2ae7062db6daf6f99de89e7128ac2ee8450bfc78cb055c9c
MD5 23731b90ecd5b4ecffcb4a468bd727bc
SHA1 c65d80d2f9b15153c05bf93355b4e5739e98ce01
SHA512 6b3fd6a52ed78f43508ce772dadbe20a395989ab9a7b5519b903f6031a1f8f889effde1729c31783e831d5601388905acb24eaad6c14fac9251a3eba2be7d12a
TLSH
T1E1C08CD30C15CA874FB0EAE45020B20CC10BC49C6CC0DCF4A90810022034A334402E38
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe588354.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\index.txt~RFe588354.TMP
Size 165B
SHA256 72592fb95adde66c8f782637707aedf82846214f000870010f726361b3daf6c7
MD5 fece9fb4eb0b62809083312de1305f62
SHA1 b8277265e7cd2a2665a4d26c9582f61cfc2fdc31
SHA512 2923b5565a6f4f8b971e2b18fa09cb42e834d88db3b7a53c43ff57bb2d8e3de90314cb18177722a9cef78fdd9d324be9009f1018ecc50951a5ce3e1af61279ee
TLSH
T10DC08CA34C28C4A92A31B8F6A424628CE0138C5C6CD2ECE58505B04BB078323C295A14
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\IndexedDB\indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\IndexedDB\indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

f07bd2bb-343c-4ede-ba80-26a652cbd944.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\f07bd2bb-343c-4ede-ba80-26a652cbd944.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 2cf82af8fe39c2b511aaf0bb311bafefe89c9a57607a0d98f15b6fcf798fe1fa
MD5 83e4047e6a87cd35989707a9da5fc498
SHA1 0500d95140645674a59371cbd0a143f8cdb8354f
SHA512 15945ff64dcfb284f8170365e47e699950673620a689025464b5bcaa0e70b5e797e6e005b993b1e4f6bddab40a2d2d081408b4cae63400d7a14bf31820ea0d7d
SSDEEP 384:mtNn/s3n9SfsNrqHENb+5h2GdpqbDX0IidKzvGuc:mj+9UREN2hNcD78Kze
TLSH
T1FC928D365C655E674E93A184F4473B179FF8827BA3C12E54E2ECAF0C01DA7AC6316906
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 1ab79589c14abc8e512f701b4b311a8ddeb3bc1ddf697e4b9c49de007d9f22d4
MD5 ea858f7139173a61021a3f80cbd81f95
SHA1 454ea0ef253bcfdb3cce7971150495385947cf06
SHA512 e1cd849677e846512ef66c978f75520248d99d52f1b145d280f55cddf2d4a19b0de086736bf45877696852f8984e27a140555d25739cffc96a94f6c2d2270506
SSDEEP 384:5iF1tNn/s3n9SkzsN18TUNTUlIlJHENb+Gh2GdpqaDX0IidKzvGuc:QF1j+9nMwgrEN5hN/D78Kze
TLSH
T1DBC228F248D3893ADD9E4747B73E2E168EBCC167B2815950B3C85A0CCD9A2BFD306805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6b15d6b069553617e684b67df3c9daa5e5a48206cc6f8035308667a914386015
MD5 fe424b4bc996af67cdc8d06f5b17bcf9
SHA1 0f581cab2a2f66a4d58095fcb014ef689e27970d
SHA512 9780fc8f6a37a05ada97b47d633a5888140ea60419214c4e48c9b4118b51310d436c47cecd5a0e168489e7e98efb7bcf2856e059a48a213109fe9d959c784c1f
SSDEEP 192:MON064BAQmiUyVm1VDW5GBPKT++FdGsfaDifouU6:MON06eAP/W1dpc/uU6
TLSH
T1D502FA39AC796C7B9EA2AE45F48637175FE8103BE5C51B44EAE85F1C019774C234382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 18108c485a7cb02036b138eb727ff9b2f3d98d61b94306293a7e82de7f5523da
MD5 2fe0d61284880d034732de827fe8b35e
SHA1 f1e276381040820cff4c07622936f762a2875ea9
SHA512 3edddb0299a9bd4ba9deda1e0b262070775c3fa524ad7be5c68e173565d7a1ce6d1f59175ddb15c310027af7ce9c1e6b67d81fe4f1919b2f0997d606dbc7bceb
SSDEEP 384:/tNn/s3n9SfsNrJHENb+5h2GdpqbDX0IidKzvGuc:/j+9UoEN2hNcD78Kze
TLSH
T14D928C366C655E674E93A184F0473B1B9FF8827BA3C52E54E2ECAF0C01DA79C6316906
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b3b316b3d1a4223c8672e5cb90f61c48bbda86f1cdb7944b8118ac5192ac9f09
MD5 d0f7cf072ba3fee5d36c091d1c8f063f
SHA1 6911ea42243c58a898006fb19b6c9e26bc184f7e
SHA512 260936a2898abe7bef8dc0253421782ac66d4895d0ea446e48ced94e16597529c90f7fa6cee5f04c04f6b545aa2891dd361ee845838634d4f20cf5669494d830
SSDEEP 192:fYONri64BEcQmiUyVaVDfI5GBPKT++FdGsr2PNjWwi2qcrU6:AONm6elDw1dpqvDU6
TLSH
T168123B36AC656C2B5E92A541F48736035EE8423BEBC56F44F6EC6B0C01EF79C6307816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 a1d9d408672fb8a19884fead78db6b81fa7c5388b657d6f0f547d9d290c9fb39
MD5 aeccb82f0e527057c0427bcdb01f7af9
SHA1 ca7e6e10ca5b5b603e4cdff8d4680bfca0ab4fe9
SHA512 80a20bdee31cddf632167b807ef2015bca95df485e08aa4fce6043e413ca7f175393d2269d428701ff987b4c47186ff8b10fd48d77b642a50222ac11a48ccd28
TLSH
T11EE00411D300417CC05D1771055F1F3037D1C11004F30307455147503D133005D30FC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe58aca6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58aca6.TMP
Size 392B
SHA256 1b35be3037bf8138be74af26feb65aceb0888bca96af805e638993cc69632c78
MD5 d37429b4426379b2f2f9f494be350f1d
SHA1 44324e1cfd73d7ebb6addeea995cb92a8579d7c7
SHA512 4e126e6fff5a7e8d19e5d4d87f24cc96b7c7f8c0bd6831493965cf2cf363433cadd23eeb665a5d3e76c987a4bfb81b74e4ae1479cdf47dc4d52e30fa9817b108
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 37b01ba613f8fe80158338fff81d36e842b82f3d956f65af0114f51862019c7f
MD5 8b0f52014f529b4144f6413a4e252a47
SHA1 68e96a247a253c3755e8357edbef71b0cf387dfd
SHA512 2297c7b72cba0dc7ee35d69263dec1ff4d1fa5b43757f7c9ebd2f18fbed6dfa82c1b3594f8380b66afebf14d127d7ce167b5beafd093e5b96800b9e6d0e0dd48
TLSH
T16341E69CB6F91158B7777E56AFF6A86D487FB9372E4B949D00010D4F0A32A40C861B37
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads