hxxps://cdn[.]discordapp[.]com/attachments/1511865529227284624/1531869769148661862/Xeno-v1[.]3[.]55[.]exe?ex=6a6ac865&is=6a6976e5&hm=a79fae7120439ef4c0b23e6c2bade2325e8b3c89e3cac31aba04f26bafcd7547&

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
max time kernel
299s
max time network
281s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
29/07/2026, 03:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cdn.discordapp.com/attachments/1511865529227284624/1531869769148661862/Xeno-v1.3.55.exe?ex=6a6ac865&is=6a6976e5&hm=a79fae7120439ef4c0b23e6c2bade2325e8b3c89e3cac31aba04f26bafcd7547&
Sample260729-eebq5atdrd

Score

8^/10

defense_evasion discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
20	1632	msedge.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Xeno-v1.3.55.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1632	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134297706685418286"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2824035265-2271499813-2042964211-1000\{D1BB2966-0274-4430-9020-1C29F5BFC9B4}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Xeno-v1.3.55.exe:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5952	msedge.exe
5952	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
5124	msedge.exe
5124	msedge.exe
5124	msedge.exe
5124	msedge.exe
5124	msedge.exe
5124	msedge.exe
5124	msedge.exe
5124	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5124	msedge.exe
5124	msedge.exe
5124	msedge.exe
5124	msedge.exe
5124	msedge.exe
5124	msedge.exe
5124	msedge.exe
5124	msedge.exe
5124	msedge.exe
5124	msedge.exe
5124	msedge.exe
5124	msedge.exe
5124	msedge.exe
5124	msedge.exe
5124	msedge.exe
5124	msedge.exe
5124	msedge.exe
5124	msedge.exe
5124	msedge.exe
5124	msedge.exe
5124	msedge.exe
5124	msedge.exe
5124	msedge.exe
5124	msedge.exe
5124	msedge.exe
5124	msedge.exe
5124	msedge.exe
5124	msedge.exe
5124	msedge.exe
5124	msedge.exe
5124	msedge.exe
5124	msedge.exe
5124	msedge.exe
5124	msedge.exe
5124	msedge.exe
5124	msedge.exe
5124	msedge.exe
5124	msedge.exe
5124	msedge.exe
5124	msedge.exe
5124	msedge.exe
5124	msedge.exe
5124	msedge.exe
5124	msedge.exe
5124	msedge.exe
5124	msedge.exe
5124	msedge.exe
5124	msedge.exe
5124	msedge.exe
5124	msedge.exe
5124	msedge.exe
5124	msedge.exe
5124	msedge.exe
5124	msedge.exe
5124	msedge.exe
5124	msedge.exe
5124	msedge.exe
5124	msedge.exe
5124	msedge.exe
5124	msedge.exe
5124	msedge.exe
5124	msedge.exe
5124	msedge.exe
5124	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5124	msedge.exe
5124	msedge.exe
5124	msedge.exe
5124	msedge.exe
5124	msedge.exe
5124	msedge.exe
5124	msedge.exe
5124	msedge.exe
5124	msedge.exe
5124	msedge.exe
5124	msedge.exe
5124	msedge.exe
5124	msedge.exe
5124	msedge.exe
5124	msedge.exe
5124	msedge.exe

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 5124 wrote to memory of 2300	5124	msedge.exe	81
PID 5124 wrote to memory of 1632	5124	msedge.exe	82
PID 5124 wrote to memory of 3768	5124	msedge.exe	83
PID 5124 wrote to memory of 3768	5124	msedge.exe	83
PID 5124 wrote to memory of 3768	5124	msedge.exe	83
PID 5124 wrote to memory of 3520	5124	msedge.exe	84
PID 5124 wrote to memory of 3520	5124	msedge.exe	84
PID 5124 wrote to memory of 3296	5124	msedge.exe	86
PID 5124 wrote to memory of 3296	5124	msedge.exe	86
PID 5124 wrote to memory of 5104	5124	msedge.exe	87
PID 5124 wrote to memory of 3296	5124	msedge.exe	86
PID 5124 wrote to memory of 5104	5124	msedge.exe	87
PID 5124 wrote to memory of 5104	5124	msedge.exe	87
PID 5124 wrote to memory of 4804	5124	msedge.exe	89
PID 5124 wrote to memory of 4260	5124	msedge.exe	90
PID 5124 wrote to memory of 4804	5124	msedge.exe	89
PID 5124 wrote to memory of 4804	5124	msedge.exe	89
PID 5124 wrote to memory of 3232	5124	msedge.exe	91
PID 5124 wrote to memory of 4260	5124	msedge.exe	90
PID 5124 wrote to memory of 4260	5124	msedge.exe	90
PID 5124 wrote to memory of 672	5124	msedge.exe	92
PID 5124 wrote to memory of 3232	5124	msedge.exe	91
PID 5124 wrote to memory of 3232	5124	msedge.exe	91
PID 5124 wrote to memory of 672	5124	msedge.exe	92
PID 5124 wrote to memory of 672	5124	msedge.exe	92
PID 5124 wrote to memory of 4556	5124	msedge.exe	94
PID 5124 wrote to memory of 4556	5124	msedge.exe	94
PID 5124 wrote to memory of 5024	5124	msedge.exe	95
PID 5124 wrote to memory of 5024	5124	msedge.exe	95
PID 5124 wrote to memory of 5280	5124	msedge.exe	96
PID 5124 wrote to memory of 5288	5124	msedge.exe	97
PID 5124 wrote to memory of 5280	5124	msedge.exe	96
PID 5124 wrote to memory of 5288	5124	msedge.exe	97
PID 5124 wrote to memory of 5288	5124	msedge.exe	97
PID 5124 wrote to memory of 5544	5124	msedge.exe	99
PID 5124 wrote to memory of 5472	5124	msedge.exe	100
PID 5472 wrote to memory of 1828	5472	msedge.exe	101
PID 5124 wrote to memory of 5628	5124	msedge.exe	102
PID 5124 wrote to memory of 576	5124	msedge.exe	103
PID 5124 wrote to memory of 5744	5124	msedge.exe	104
PID 5124 wrote to memory of 5976	5124	msedge.exe	105
PID 5124 wrote to memory of 1636	5124	msedge.exe	106
PID 5124 wrote to memory of 1636	5124	msedge.exe	106
PID 5124 wrote to memory of 5952	5124	msedge.exe	108
PID 5124 wrote to memory of 6000	5124	msedge.exe	109
PID 5124 wrote to memory of 6000	5124	msedge.exe	109
PID 5124 wrote to memory of 4548	5124	msedge.exe	110
PID 5124 wrote to memory of 4548	5124	msedge.exe	110
PID 5124 wrote to memory of 5848	5124	msedge.exe	111
PID 5124 wrote to memory of 5848	5124	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1511865529227284624/1531869769148661862/Xeno-v1.3.55.exe?ex=6a6ac865&is=6a6976e5&hm=a79fae7120439ef4c0b23e6c2bade2325e8b3c89e3cac31aba04f26bafcd7547&
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x258,0x7ffeca44c188,0x7ffeca44c194,0x7ffeca44c1a0
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1792,i,7616333941706799988,12191977736641328596,524288 --field-trial-handle=2392,i,7133884396909919042,8562251719607651596,262144 --variations-seed-version --mojo-platform-channel-handle=2448 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:1632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1552,i,9980903132641359890,8340969574867933143,262144 --field-trial-handle=2392,i,7133884396909919042,8562251719607651596,262144 --variations-seed-version --mojo-platform-channel-handle=1856 /prefetch:2
  2⤵
  PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2396,i,4044190566300740532,11168124276260615851,524288 --field-trial-handle=2392,i,7133884396909919042,8562251719607651596,262144 --variations-seed-version --mojo-platform-channel-handle=3056 /prefetch:13
  2⤵
  PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,8041744205067070218,3083891442200074056,2097152 --field-trial-handle=2392,i,7133884396909919042,8562251719607651596,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,7492395138807306965,11231999243681735663,2097152 --field-trial-handle=2392,i,7133884396909919042,8562251719607651596,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4156,i,18126670152178045006,16157254286502597417,2097152 --field-trial-handle=2392,i,7133884396909919042,8562251719607651596,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:1
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4204,i,12510428398721253420,6725061027589346388,2097152 --field-trial-handle=2392,i,7133884396909919042,8562251719607651596,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:9
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4248,i,14670051949348392617,16244319572105856902,2097152 --field-trial-handle=2392,i,7133884396909919042,8562251719607651596,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:1
  2⤵
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4260,i,10934158174512861219,6825116889842894557,2097152 --field-trial-handle=2392,i,7133884396909919042,8562251719607651596,262144 --variations-seed-version --mojo-platform-channel-handle=4764 /prefetch:9
  2⤵
  PID:672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3856,i,7200627133752864569,16911148939542972284,524288 --field-trial-handle=2392,i,7133884396909919042,8562251719607651596,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:14
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3844,i,18254881892151143306,4332686772109045239,524288 --field-trial-handle=2392,i,7133884396909919042,8562251719607651596,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:14
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5320,i,4270735828448709315,5385197193130841796,524288 --field-trial-handle=2392,i,7133884396909919042,8562251719607651596,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:14
  2⤵
  PID:5280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5304,i,13916372744531989804,8316152399468556973,2097152 --field-trial-handle=2392,i,7133884396909919042,8562251719607651596,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:1
  2⤵
  PID:5288
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6540,i,16775252291829255677,13304069779166733448,524288 --field-trial-handle=2392,i,7133884396909919042,8562251719607651596,262144 --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:14
  2⤵
  PID:5540
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6540,i,16775252291829255677,13304069779166733448,524288 --field-trial-handle=2392,i,7133884396909919042,8562251719607651596,262144 --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:14
  2⤵
  PID:5544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6848,i,7839995875197730663,6207070292452306740,524288 --field-trial-handle=2392,i,7133884396909919042,8562251719607651596,262144 --variations-seed-version --mojo-platform-channel-handle=6852 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5472
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:1828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6608,i,13708185187488497151,1854483507286821845,524288 --field-trial-handle=2392,i,7133884396909919042,8562251719607651596,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:5628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4808,i,14877367505746588436,14183450281417847639,524288 --field-trial-handle=2392,i,7133884396909919042,8562251719607651596,262144 --variations-seed-version --mojo-platform-channel-handle=4804 /prefetch:14
  2⤵
  PID:576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,11496547333925179448,5975721716215088497,524288 --field-trial-handle=2392,i,7133884396909919042,8562251719607651596,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:14
  2⤵
  PID:5744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4764,i,15887090060711542923,17351915042449848585,524288 --field-trial-handle=2392,i,7133884396909919042,8562251719607651596,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:14
  2⤵
  PID:5976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,10297164648600495477,4928651840722180340,524288 --field-trial-handle=2392,i,7133884396909919042,8562251719607651596,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:14
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4920,i,2655289982611107946,17090250252048750496,262144 --field-trial-handle=2392,i,7133884396909919042,8562251719607651596,262144 --variations-seed-version --mojo-platform-channel-handle=7116 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6764,i,9304259031592524253,3467951996128222680,524288 --field-trial-handle=2392,i,7133884396909919042,8562251719607651596,262144 --variations-seed-version --mojo-platform-channel-handle=6752 /prefetch:14
  2⤵
  PID:6000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5392,i,4847168684105392544,12905257662735541133,524288 --field-trial-handle=2392,i,7133884396909919042,8562251719607651596,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:14
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,5677931903809545626,4335078472369594265,524288 --field-trial-handle=2392,i,7133884396909919042,8562251719607651596,262144 --variations-seed-version --mojo-platform-channel-handle=7452 /prefetch:14
  2⤵
  PID:5848

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1616

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 3bc6f5c22e10305be021a6318b0eabf0a6abf49a3bdc5b39af41db7ab0278e3f
MD5 04168e374d81980fc5f3466ce4149565
SHA1 292f2330e00859ee9546278a7256f137039595ee
SHA512 87855cfb3a78e7d87b2345fa049ddcadfc780ea959a15238de760aadddea6c61d083e45f41ffc37deb36919420f10e888485a11d7239e8afc3ab6380c8ac066f
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7X:fwUQC5VwBIiElEd2K57P7X
TLSH
T132B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a4b35a6422c1c682176591bd42ebef96b0cb78607f98b3c5ee2c0e2d44e526da
MD5 63b4ddb137c55bd42461aacc1eb4cf83
SHA1 e41f99c448526208c80f1acecf1939a8e3f06728
SHA512 88b7f5970c19ff8d8362281bde3b29f3c7b018ff88c03d8ce082f66572704c79543ea528e6962172f18f1cdde2d1aaad0aca218b732ba8a673b844844d3ae585
TLSH
T125D080B23D4DB010D75B51F1F903D741121A857528536B33E694C54C5DB5CD813C71D3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2e4c78c9d4b6915833ca44ba5f9b735c9d9e0bf49d6aa045c47aaaa63f1f9359
MD5 f7389aaad82eb86ca1896ff3c7af7a86
SHA1 a7833bad037b8c94d375310ccb5bf39c3f9df83c
SHA512 cdfd274480229d612566789a9d9cdf47643a9543e303957436e5121c790936878b1b7eb452100170489121bede724239183c48208033a8c70d6070e93b3f1226
TLSH
T1E5D080B23D4DB010D75B51F1F903D741121A85752853AB33E694C54C5DB5CD813C71D3
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 158B
SHA256 249358b1eab901f0b034023569e7f01b1f94c9179591789d99d6f279761d6e1c
MD5 e3fe72c0f542fbb29d9eb8933eefb382
SHA1 fce9a5a6bf89b76d58b4c0f0c691531330ab3b3e
SHA512 f71315278d44c74df19833e56e16d62705ddd45cc9bbabd13be55f51927a3d7464736846a1c4bcda6770c5b8c0720e1defbfbddb5206de648079efb1a9250340
TLSH
T17EC080D9BD4D845FD385187E5716F00007906511942796171650FDC032419A01E29220
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 465f942d824e8a4da42bc68482beacedad738d59d697119102d7b54fbf388bdc
MD5 a069ba8f878ac338cbc76cd02964561b
SHA1 d7d25d22c1bb0a5ab5bd72ed92a40ca80a92baa2
SHA512 d8cc8be70eafe2a416804a350496d96841d264295f507c163301b1f7453bda70bfc6e8e7cd9ae3094f107fad4c1858575cc681e38dccf190b4183995f5d2c44f
TLSH
T1E871DA390D52605EF3175731B0DB83577575A7A81A83FD56F0CCACBAA71AF278822304
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe585f80.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe585f80.TMP
Size 3KB
SHA256 b8aa27fc2d0d9c84aab07135524c1b33ce17cc486c58beb6eec8cd58f84e7337
MD5 7ecf5385c4875fc71a341bfdfbff2568
SHA1 16a68c2f46a30e0b7a36f80c2e5f2744c2b28cc3
SHA512 9c37cc72f5a5b3814834b8d0b13307101324dea226e1927f14b436ad49fd2eb5662f9c7d7d59fccbf705f75e696c2cf3b32df02f466564e71ffc3af09ce9397a
TLSH
T10E71FB390D52604DF3130B31B0DB83177676A7A81A83FD56F0CC6CBA671AF278822308
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 c1178c836aa95a5e646f5def695a82164f2b098df53241482d81080128c7d731
MD5 33016577527bedd0f06e039ce3f72d02
SHA1 e6b51a210fb33b541a58e3743a643785ac9697ee
SHA512 61cd7712f4cc22f1d0350225843eb892cf52700d1feecf0ef60d9fd706eca03ab8c7469c3f46b1ab5a5b195c1f7207e25e0b3b1996e48c97661e4d708795f9fe
TLSH
T1E0219BF3C3D5856ECA0516F06A24AE2BCE2D051583187D1AC9D4EF5BD7E3076E14194F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 2efd0006c5848634739c41c69489663970733dd18524eafbeff7a6114efa7320
MD5 54cea599432c3ec8155e8dfa4c13f3a5
SHA1 18db8ac77499b7625947bb80dbbc1f6a33e04b41
SHA512 e2d327ccad4adc30f861593cf12ec30c8b59f7769d125f134cd1d9838688eb25adc4c53896c200161d9ac2a23524311143b97afedd9eb5b1ab3de47da8a46aee
SSDEEP 192:sxZGRdyM/jK1Ml8UQ9oM/ftsUAF+IdpW/W6+WNGY050LRZ+oIg5hJ:sxZGxqOM/ftsUAFvW/bG5CzV
TLSH
T12052E8166A345977CCDBD20DFA55BF93D6F9147292900E48A9FCCE0C00E6AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 6a5b93e85956902fc829e15d9469a5a847ee20d83a2e125dd5635dde2f0c4504
MD5 33ab3779acaa7485629421178db5287e
SHA1 53daa926439f51b2019420eb7e38176e94bdaad9
SHA512 6b9484ee7af020e442f45913a71e8c3e5b98a59b613b0dba89bdb24931135166bc5a08fba618fdd0adb66088cf891c258dd07ed20dc6974955ffbf4d3e8032d8
SSDEEP 192:sxZGRdyM/jK1Ml8MoM/ftsGAV+IdpM/W6+WNGY050RL8+oIgrJ:sxZGxQM/ftsGAVvM/bG5pz9
TLSH
T12842F7166B346977CCDBD209FA55BF53D6F91432E2900E48A9FCCA0C04E6AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 c86f19512d4884411ba2aade7c35890d2079e765cc45ae3677b7c3ecc5c3bd2c
MD5 2922f7834cb656e157c7c274b7d4709b
SHA1 df5ad1f52d53ca47bd946b00323fe71be75e790e
SHA512 a147e3b705c81e8a3a03da31884f7e6fc8de2867beb0b44341e3c7212c470b396c4f5881b46d0a6ab05ea588608e52c70e7e0b145fa8c5aa32012c77c9d8e248
SSDEEP 768:Q/zXl8pZ221WRmsYQL08F1+UoAYDCx9Tuqh0VfUC9xbog/OV3u/Ll/df0hxVro0x:Q/zXl8pZ221WRmsYQL0u1jaKu/Lpd8h/
TLSH
T143E20A3F244CCB7E4F844E9CEC266F966ED801CBA7A84D5447FA494C03C67DB522A49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 3766385f93656152b2fcefa1b83c5afa57a93ea09da3861e465a99ac62f509d9
MD5 910a016952e353c7cf27aeee458bd03e
SHA1 cb6af49224fb2603ee086c8e2fe6b85066ff683d
SHA512 ab005a977c6ef8946c3d2746c35354583266d1e08a52245eb74c0de7b8c72295754f8fa502bd90e051842c0d59a1b4486f3a744567a18acb60cdc84e93c74d41
SSDEEP 48:KfTIFK40ovydFIJKG0MypINKaAQHy4C5GyAH:KfT2K40COFuKG0VpqKaAqt
TLSH
T1AD91C84631FA22093C7E6A4C83AB969746C170673294A47B3BE811B64F2BE535CFD5CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f054a403-2f1c-4ab1-9e59-5da0f04ff7a9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f054a403-2f1c-4ab1-9e59-5da0f04ff7a9.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e986848d-fdd3-4aef-9cc8-d92623ca972c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\e986848d-fdd3-4aef-9cc8-d92623ca972c.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 243a7f0a9eafe645d4a4c94a3b60c2a6d8955c78ef91f24e7442f92d4ef3ed83
MD5 1d653b00b488c30a0370711dabf562cc
SHA1 79dec5e2badaba7b49ee6988dd27cbc33f1b4fb9
SHA512 62cc934e9c0e361f5ae1781b4a443c498a3e4f10a89a75bf11846ff09e92e9c23d77f92dd71fcef28dfc48fc57e3ee63dc45bed4504c4ea50f9d3892ef8e99dd
SSDEEP 384:VZcIX8N6UDVEyQ5iK/cVBGtDDVcl1lIO7w/ok/Buu:tX/N/ztDDVcLCO7w/DBuu
TLSH
T147929E32A8B96CBB8CA6A559F44636075FB4C433D7C91F54D2EC6F0D01CEAA80317C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 ad08f4d7f69125adaedc62913af722daa06ad31d56281d0718e422e0c2429b3a
MD5 5ece73a48652c36baace30d00ba53ad5
SHA1 481bccffba14e5fb5ba07a0023650077e68bc58c
SHA512 a98a3663cb2bab38c9e2b25d4484cd64fcd929ad981e6b3388edbb1ea9c5f262b11cbace3c1fce68390a8d62e0ebf4e7791c1e15339a3d865bd1998b70afdb8a
SSDEEP 384:9ZcIX8N6UcVEyQ5iK/cVBGtDDVcl1lIO7w/ok/Buu:lXyN/ztDDVcLCO7w/DBuu
TLSH
T13E929E32A8B96CBB8DA6A559F44636075FB4C433D7C91F54D2EC2F0D01CEAA80317C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 7c6be6b45d9c2179a55661b165b38d5e41ae0e2ca01bbc121c72c7bb69c1d8cb
MD5 3d929bb40baea4b5d47c0549f7181aa8
SHA1 4174ba7834295f6877efbe42e42155112fd5827f
SHA512 2fd8e8f448da0d1170e313e0224f95598860839f2bde2c6d48c834648a61ff6ed1c61341624be05738a3dd7252ae75fcfb036308fb7b0c26a683e215d8784746
SSDEEP 384:1iFsZcI38Nf8TUNTUlIlDVEyQ5iK/cVByZDDVcl1lIO7w/ok/Buu:8F63mwgIN/JZDDVcLCO7w/DBuu
TLSH
T185B26C3398A898BF9DA6AA55F94636079FB48073C7C99E54E2DC6F0D01CA5DC0317C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 6741c683f70b36c1b398a0aa1fcc964a2c834f05b217a828b614858a7dad945b
MD5 bbce1a4edaf250de15fcc197013083f4
SHA1 8da373b96d5720b0d20abae5c90f73c2cd37e673
SHA512 aafd58bdc6729f35a4113592b7caf0cb8240e273c2dbdf89b8c7162070c678a682e440556f3f2d2010a0fbe0ecc10a9faa3102b574f0f94d7707100ee713c23a
SSDEEP 384:xZcIh8N6U4VEyQ5iK/cVBGtDDVcl1lIO7w/ok/Buu:ZhiN/ztDDVcLCO7w/DBuu
TLSH
T1D2929D32A8B96C7B8DA6A559F44636075FB8D433C7C91F54D2ED2F0D01CE9A80327C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f07e51b29d35b41814067ec69802f874c9a00b5f2d3cd7ea2af743a9a0698033
MD5 1b50f4aa24d4510cb968eac9ac3fc93f
SHA1 3922bb257d15cc12418dcee23a5aa586ac50c9a3
SHA512 8068f26a9516aa39faf24f30642fa8d5c14bf34b81295cb0c87fd830db08c23c772694aaae54b14cd88c60497ad0909fca4d539636d1ba9637e786dd5bd5224d
SSDEEP 192:7GNV6fNNQmiUyMOzHjPL/GPTjyIXRHV7qZZSU6:7GNV61L8zDPL/cJUvSU6
TLSH
T1AD02F835B8A8A87B8DE3AE59F5877B279FA4213BDA951F44C6E42F0C00D759C1303836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 49dc96b31f85cd3d3b8a0e89f34a092f0c29cfa427bcaff8b1c1e030b716558c
MD5 466d76a0b113df5d52019d852f6f866c
SHA1 9b1ba92c5c5355178709f36bb809592811f8081d
SHA512 c248eb81c98e9a0a6fd5b800c5c16abb92097f915d6cc22660a8681f073b518edd92bdf649d82fe44f79ba80b94f9a50f8841164c1940d2b6ea21134394670c6
SSDEEP 192:PGNQ6fNhQmiUyMiSj+L/GPTjyIXRXBpYMV3ZGrqHU6:PGNQ61/c6+L/cVBBLDU6
TLSH
T1AC120836B8A8A87B4DD2A969F4473617AEA04167DB896F54D6EC3F0C00DF5EC1307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5e2c908b-68ce-4cb9-bd20-32d59a66aa1c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\5e2c908b-68ce-4cb9-bd20-32d59a66aa1c.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

Xeno-v1.3.55.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\Xeno-v1.3.55.exe:Zone.Identifier
Size 224B
SHA256 c4f445c815c723dde0c6a84d8895169627eda68cae1d7690cca69e276da251c7
MD5 d2bff7e969f19962e91b0a0a11028b08
SHA1 10c767915ab39d570b141d7566924de2dc547945
SHA512 003295fbbdc83b6b1f2eced0465c984cd81e0768487d167e4adf32775c363e16b6c418afb557f4999e5c98b72106cdb5b76bcc5856118fc20598a67994579c38
TLSH
T1D4D023738042D075464F17D859ED8419514C1B97D41F5954D85CC4BAD2805BAB0D9C25
MD5 SHA1 SHA512 TLSH

Submit Download