43e332faef4019a95d3b72205da7ce72bc4ccd25f53399352b68442f0b55dad2

Analysis

geolocation tags

asiadelhiinindia
max time kernel
898s
max time network
641s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 23:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Xeno-v1.3.55/editor/index.html
Size 164KB
Sample260801-25qdjaac28
SHA256 43e332faef4019a95d3b72205da7ce72bc4ccd25f53399352b68442f0b55dad2
MD5 b33eb96a570d0cdf6ded11ff199d0de3
SHA1 47c7c58cefda42ca2a5ec53af727d34aa0663136
SHA512 409771d5941dc934b46c3a1d906bbc352bb9c1684c4bc585d7d884acc8d8ea93661637cbf047d02b96a17ab978419f8c116097226b89898007eaf3a8e7d976a5
SSDEEP 3072:Nk4J09UmmJv8kBpZaFD48VOAGUWYPjDZlLJbRBiPEP8yKUz2Ojmjr8zM3KP7pbl8:64J09BA3pZaFD48VOAGUWYPjdlLJbRBW
TLSH
T1E7F3F19AF1122D5226C79230619BBE297FF19490BE766B424B9CF3201091FDF116FBB4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
18	raw.githubusercontent.com
11	raw.githubusercontent.com
12	raw.githubusercontent.com
16	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2448	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134301004943247068"	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{4A84FEC7-1754-48B8-971A-070B883645DB}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3740	msedge.exe
3740	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 936 wrote to memory of 5704	936	msedge.exe	89
PID 936 wrote to memory of 2448	936	msedge.exe	90
PID 936 wrote to memory of 4652	936	msedge.exe	91
PID 936 wrote to memory of 4652	936	msedge.exe	91
PID 936 wrote to memory of 4652	936	msedge.exe	91
PID 936 wrote to memory of 568	936	msedge.exe	93
PID 936 wrote to memory of 568	936	msedge.exe	93
PID 936 wrote to memory of 4624	936	msedge.exe	94
PID 936 wrote to memory of 404	936	msedge.exe	95
PID 936 wrote to memory of 4624	936	msedge.exe	94
PID 936 wrote to memory of 4624	936	msedge.exe	94
PID 936 wrote to memory of 404	936	msedge.exe	95
PID 936 wrote to memory of 404	936	msedge.exe	95
PID 936 wrote to memory of 3460	936	msedge.exe	96
PID 936 wrote to memory of 3460	936	msedge.exe	96
PID 936 wrote to memory of 3460	936	msedge.exe	96
PID 936 wrote to memory of 5596	936	msedge.exe	97
PID 936 wrote to memory of 5596	936	msedge.exe	97
PID 936 wrote to memory of 5596	936	msedge.exe	97
PID 936 wrote to memory of 2452	936	msedge.exe	99
PID 936 wrote to memory of 2452	936	msedge.exe	99
PID 936 wrote to memory of 4628	936	msedge.exe	100
PID 936 wrote to memory of 4628	936	msedge.exe	100
PID 936 wrote to memory of 5544	936	msedge.exe	102
PID 936 wrote to memory of 1312	936	msedge.exe	106
PID 936 wrote to memory of 1364	936	msedge.exe	107
PID 936 wrote to memory of 2760	936	msedge.exe	108
PID 936 wrote to memory of 5272	936	msedge.exe	109
PID 936 wrote to memory of 5272	936	msedge.exe	109
PID 936 wrote to memory of 5932	936	msedge.exe	111
PID 936 wrote to memory of 5932	936	msedge.exe	111
PID 936 wrote to memory of 3740	936	msedge.exe	112
PID 936 wrote to memory of 4624	936	msedge.exe	113
PID 936 wrote to memory of 4624	936	msedge.exe	113
PID 936 wrote to memory of 4356	936	msedge.exe	114
PID 936 wrote to memory of 4356	936	msedge.exe	114
PID 936 wrote to memory of 3240	936	msedge.exe	115
PID 936 wrote to memory of 3240	936	msedge.exe	115
PID 936 wrote to memory of 2524	936	msedge.exe	116
PID 936 wrote to memory of 2524	936	msedge.exe	116
PID 936 wrote to memory of 5576	936	msedge.exe	124
PID 936 wrote to memory of 5576	936	msedge.exe	124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55\editor\index.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x370,0x7ff9d7dbc188,0x7ff9d7dbc194,0x7ff9d7dbc1a0
  2⤵
  PID:5704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1916,i,17905504853621481721,5833749537455704708,524288 --field-trial-handle=2120,i,15213519148986824033,7329294039479818525,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1676,i,5158216414717654047,7204120853777810569,262144 --field-trial-handle=2120,i,15213519148986824033,7329294039479818525,262144 --variations-seed-version --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2612,i,560850887415955026,12118825559239759595,524288 --field-trial-handle=2120,i,15213519148986824033,7329294039479818525,262144 --variations-seed-version --mojo-platform-channel-handle=2636 /prefetch:13
  2⤵
  PID:568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3548,i,3258123642598407774,5604099922312093643,2097152 --field-trial-handle=2120,i,15213519148986824033,7329294039479818525,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3552,i,8098129834357329631,14565349768543537994,2097152 --field-trial-handle=2120,i,15213519148986824033,7329294039479818525,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
  2⤵
  PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4284,i,321917643793672934,15695333034383424122,2097152 --field-trial-handle=2120,i,15213519148986824033,7329294039479818525,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:1
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4300,i,7627833645569106979,4141988174254552053,2097152 --field-trial-handle=2120,i,15213519148986824033,7329294039479818525,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:9
  2⤵
  PID:5596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3708,i,14384869194020835225,3285992569101254163,524288 --field-trial-handle=2120,i,15213519148986824033,7329294039479818525,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:14
  2⤵
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3712,i,9362026287416098694,7625062215898793037,524288 --field-trial-handle=2120,i,15213519148986824033,7329294039479818525,262144 --variations-seed-version --mojo-platform-channel-handle=3396 /prefetch:14
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,1007024561114902100,12231371409793974221,524288 --field-trial-handle=2120,i,15213519148986824033,7329294039479818525,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:14
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,1007024561114902100,12231371409793974221,524288 --field-trial-handle=2120,i,15213519148986824033,7329294039479818525,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:14
  2⤵
  PID:5544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6560,i,3674709140872703465,2534922269834571989,524288 --field-trial-handle=2120,i,15213519148986824033,7329294039479818525,262144 --variations-seed-version --mojo-platform-channel-handle=6588 /prefetch:14
  2⤵
  PID:1312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6556,i,13595002389366319723,5898716668862024205,524288 --field-trial-handle=2120,i,15213519148986824033,7329294039479818525,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:14
  2⤵
  PID:1364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4144,i,1979390986283563304,17501864466957685355,524288 --field-trial-handle=2120,i,15213519148986824033,7329294039479818525,262144 --variations-seed-version --mojo-platform-channel-handle=600 /prefetch:14
  2⤵
  PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5620,i,1348897748088702892,17028648049509653870,524288 --field-trial-handle=2120,i,15213519148986824033,7329294039479818525,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:14
  2⤵
  PID:5272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,12044002502662770829,13085990070799810732,524288 --field-trial-handle=2120,i,15213519148986824033,7329294039479818525,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:14
  2⤵
  PID:5932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5512,i,12780467456337185626,14654926480975396591,262144 --field-trial-handle=2120,i,15213519148986824033,7329294039479818525,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5344,i,16527132186692585625,6644336737121081539,524288 --field-trial-handle=2120,i,15213519148986824033,7329294039479818525,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:14
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5980,i,8519534170596226023,1219025120112807856,524288 --field-trial-handle=2120,i,15213519148986824033,7329294039479818525,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:14
  2⤵
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6540,i,16138685041266648646,13376970769686553151,524288 --field-trial-handle=2120,i,15213519148986824033,7329294039479818525,262144 --variations-seed-version --mojo-platform-channel-handle=6616 /prefetch:14
  2⤵
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5704,i,9362967016849588997,2863948278378622920,524288 --field-trial-handle=2120,i,15213519148986824033,7329294039479818525,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:14
  2⤵
  PID:2524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,502433981746503522,9916148072385442533,524288 --field-trial-handle=2120,i,15213519148986824033,7329294039479818525,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:14
  2⤵
  PID:5576

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:792

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4688

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3008

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:2992

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 a89f5d651adae0fac7f142569bf5898ccf48040a9339b867661bec1339323776
MD5 7d4cc3cbd8829f574a6bc96e0444c58d
SHA1 2fb9f0ccec7accfec733493a8a97fe5b42bff3a5
SHA512 34230328ebeea738438bf25be5d54a41be828d36ccfc2b2cbba81152290dc808a9d53a679b3a0e47cbf3aead7487344fb017f1eaa1cfe99f83f0cf5f4a332492
TLSH
T155E0209905C4D21D5A017947629C430CC2D0370BABC4BE1B3704C48D7845194A3C3970
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 9ab86b4eb712644a14b8a5448ea29e2427d306e5099111b38773bdc958f3cc5f
MD5 0365b3e0bf94cf521b62beebd35bb86e
SHA1 03f7f84e449afd49c09318d233b67abf1397109b
SHA512 01cac5f993ebbe1b5fbd76dee1ffc75f3c79da60b5a3f000f5396b9e0bfb58d9a166fbee15027e5f956d8cb049d191ead5bcbb0a734f23cca4639121db58cdea
TLSH
T1FAE026A508CAC27EAA07768751BC430C82E2360FDFCCAE2A1704CCC87245564B2E6FF0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 bc6c48f881fe912088f2cc7a401497a965faea4810460c94ff27cfa023d692b7
MD5 3c7bbc940b6b8ee2c0789099f4040915
SHA1 148c47887772ac71906df334b73c227dd6b88f39
SHA512 91431bc3fa29cd88ca518f67268f8fd626b742be84b03fd243dbb2546ebc32e27aeffb6ad412aefec0a3f1c496b45cde7085b830588f5116cead7c47e310d396
TLSH
T19BE020FB07C4C36DB502648761BC430DD1D03A4F96D4E9251710C44874064407693BA4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 cd79a302613e30df5ca3cd8b1f18e00fc5a697aed16a2829f582ced5b3455331
MD5 7c551d2cf90f665641e7b76a539d79bc
SHA1 576eb6f1572f1723a051c6952cddb33533346183
SHA512 916ce83667b786e7b119fe9ccf5c8e3c33679a2a4a94bc8626b4253a11fe8be2a69deb65694e57fd87cabc2c4fe094e7824d772fe0dbb31d88e28c5419726a8b
TLSH
T103E078D509C4C21D5555758791FC530D81D23E0BD7CCEA551704C4C9710745477C1D60
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 92829ee8714fc13d1bfd26fb8effe90d4e62d75a7dc3ae25f1dea1341cc1da61
MD5 d2d4200a73b7d767a80d1cab5aa52d3a
SHA1 ce131a99e9d01dc54c4b775dc54404ac24d08d1f
SHA512 7a124cf2e7ad637743d584249b83a62ae7e4af2fc7548b5d54483be023b0d6ba16ad895569b87fa900beadfa588e5100f1edeb2b4e5203cf7a8d42142763301e
TLSH
T1AC5152530321CBC1F3E245B261E97549BEF9A8590227AE01834CAD789D72F0C91F9F53
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe599c65.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe599c65.TMP
Size 2KB
SHA256 2b769dde69f801fad37226ad0f13a1918d1173741a4d23b03fdcbf04262bbd2a
MD5 d1d2d6d8f20c1440f476e1bc13d2c8dd
SHA1 1b6d373631f9e18f33b59f30913ef4fdb051d654
SHA512 77d25351ef58ef8dab5b1b3a34cb0f4ea30e6489c720db36037cfdadfa9e45fe31976c0421a0151e20b9ecc4731278949831c900ecbb7b79f38b57a818c755d8
TLSH
T1C75152530311CBC1F3E245B265E97549BEF9A8990227AE01834CAD789D72F0C91F9F53
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 7217e12a25b464b3f60e97617b23c45f580b779902bed05b7d5ec851dcee37b2
MD5 6dd9fc7f26bb5ee4115a9547d162df51
SHA1 c1b6eb835886233911a1da501655491807123b16
SHA512 95e90daa19b25ef763b24827ae63415eb7b088a6cfdc2a57a0a6a4ef4dd93acba81c10c1b0a3977ef592b22f6e865a536929b78707c1385b2f288d60b246661c
TLSH
T10C41D2F3C7E4867D890156F0AB147E2FCE2C0915432C7C66C5E0AE1B93E2471E141A9F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 7f8c70d3f262d0aec17b8e6d2b0deeeff57cfc8db42051eed6382de7d515a31d
MD5 5c521a9761510ea9aa3aa67a4f83da3b
SHA1 64f50ba4297eb91829f6e78fa4bed7afbda774f5
SHA512 ff27478eb79f7c650ba7f5dc92afb4973c0e191ca566672f83cfd2a689732d67dfa96b7e9d51f7adfb892fac246ad934b14ed8f7a926b297b43cfa75b67057c7
TLSH
T1E041C1F3C7E4867D890156F0AB146E2BCE2D0915432C7C56C9E4AE1BA7E2471D14159F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 e1e9c8bf653df19952fb04c0396d270829bdf96a268e3066da52d29212855ab6
MD5 085513c9e4c3ca1b41007383d6ed8a66
SHA1 2669e185781c8f71afe40d3f238e787183e0b0c9
SHA512 dd8f72a060b1a688b0f7a30c3b7ee91b9c80d17921a3575b908c625456bbf30b97ef6dd88cc66079f17ee9389385f45e64629415e3cdb3403011957907e8f7f2
SSDEEP 192:sxRqRTbp/f6sdWDde5lSVzoD8p4f/g6+WNIYCyuOWGWIgIJ:sxRqRp/f6sdWc5lEu/5IQks
TLSH
T12232B8156A28A93B8CCBE24DBB55BF53D6F9503361D01E58B7FC961C04E6ADD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 946ebc38877ff3286fce8cfde0f3f72a48dbf92a97b23255f6711ef553c4cdd9
MD5 58ddbf3d686b6a5ea1c12e847bdfb96f
SHA1 2b89d2ee4dbb1cf3d37318d7c0de050af9c62d5f
SHA512 4914f5b03eee0c74d9e916b8510c2739200d5d131fe562c213281ec04d8fc284448ca4ccaaf012fd3251aa8c6437d8450040242f7087052017fac5ff478cf1c1
SSDEEP 192:sxRNRTbp/f6sIqDde5lSVzoD8p4f/g6+WNIYC3uOWGWIgD1J:sxRNRp/f6sIqc5lEu/5Ifkj
TLSH
T12742C7166928A93B8CCBE20DBB55BF53D6F9503361D01E58B7FC9A1C05EAADD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 6727df2a1c9eeda55406de5905e37fa806787054a1f21490fa82cd5ce3ca19a1
MD5 752c6064478c2e9549aa0242aac3a3a9
SHA1 b03a635143bd46b6fb75217e82c3116e72f241f1
SHA512 d739b4d69443c15f8016ad941466a51a9a74d0685d42bbc718245f310c40481b45627835b9c3534fb7d876686e5a71eb2ae1824680fa8113b2639b9203752836
SSDEEP 192:sxRNRTbp/f6sIWDde5lSVzoD8p4f/g6+WNIYCyuOWGWIgDzJ:sxRNRp/f6sIWc5lEu/5IQkJ
TLSH
T15132D9166E28A93B8CCBD20DBB55BF53D6F9503361D01E58B7FC9A1C04EA6DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 794bdc88ffce92f3e5d757d842121eed7f270401231ce2b79e5864afa1452339
MD5 39ab9781cb77c1af3e1d94ef5884a6e2
SHA1 f182be183fbb7e1930ac79c15126bf525934e29c
SHA512 42625c5787486dc49d0bc8275ec797a85a001125f873f3ac5245476a5e3057d2780c8087ca203ec2beb42513068182b3d542d3da434be60cb35a64e4d8d3aba9
SSDEEP 384:jjm+vhKfCtgQCFf4+KhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVmC9qyRvZroZSD:jC+vhQWgQ+f4+8F1+UoAYDCx9Tuqh0V+
TLSH
T17CB2EA2B600DCB7F5F800AADAC196FD76DA802CB97589D4047FED94C02C77EA92194DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1856727a-518b-4328-979f-4fab57550eef\index-dir\the-real-index
Size 552B
SHA256 1d73073b851f699c138cad7dc160e1e0aab72034df5a3b11f9c88a6cc35ff48f
MD5 fd72645b7ac9645d086ffef5b57ef124
SHA1 ddd053b9ff76803958493137492282e7ad150568
SHA512 9c2c3455f19798e0eb3f2b126f825d07b13469746c82775fae0396bf34abe2f3e7c0f70b99ed912f3fadce3014d362dacf9cd3b5d7d301b07525d0153d866427
TLSH
T19CF0FAAB5CD7E447D93664B615362547333F09FD11117DCF104D3029556353C4781741
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5dd95b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1856727a-518b-4328-979f-4fab57550eef\index-dir\the-real-index~RFe5dd95b.TMP
Size 552B
SHA256 720ab84c1a5fef48978a4b207c9dcb8b48773541dc7900e6614c86a15b49a6e9
MD5 bfe2537a3c4c61931e8dcf12a52fa837
SHA1 117f609933ff33baae8e19ab8f377106da64d2f1
SHA512 1a8a8a2961a076768dbdf912cf6f1c52bc3baa8cde2d38ec8fab27c267ea76db4837028b368cd45b018f39e822d9325a67b506c6cd3283a5f4b516a587b634b1
TLSH
T117F0F1E70091ED42DC2554F521216017333E0C303119DA8FA08B242A583277C8281A51
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 82121d3cf3202b98f83d8680ddde6f666146723cd66688635990612aa04e5300
MD5 d771cebd26df2efcc1412c0badca9b6c
SHA1 ec9a4737332cde3c07e27958f3a893947d04a155
SHA512 056ab5c7b00f4ddbd27dae766718b91b1f3607efbeafb1ef39db2225544a3574f0107b8663e9c348a6ac4ae385fe41ff70e7831b91e7e8a5239a8eeacb59c8a8
TLSH
T17CE0DFF62EFB2934A82F87F7187194E44149B9588525ED4E202AA2C710E1756245ACBA
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 efa8127d72004fafc588f3256ebf6ebe03ccd30141f42f4ac9f19bc5e5b01341
MD5 73801899de8fb3a84162eb8b1efbe39b
SHA1 60617cdb3138b2264df9c35d960a5235921edec6
SHA512 6da93348b893d4ae90eaaea8f617ddecbd1c82e69317d9bb650b7b16e2c970bb77daa487f5b90ffb554ef65cbf501c3c7d92ade044438418c438a78c5f692db8
SSDEEP 96:KRbEBVj5J1WdSIg91K4EgT1c7j6dJOHIuoIuZIusIu4IuqIu2Iu6IugWIueIuDIP:CbEBVj5JAdSp9/EgTK7j6dJOHIuoIuZ+
TLSH
T151912705717A0290787EB50C807D8C2E86C274B33619E52B7BA846661F66F47BEFDCC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a3980.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a3980.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 53f8c84f3b0ec71a891637f4227073e6f2d82b20e1b36ce666866c29e195107c
MD5 de75f72af49f71e700e02a07b6c1d6d0
SHA1 8840cd1b625256f8f6abef38d77d2f7430efba97
SHA512 b64615941f56218ca6da4fd407780501664a895b8ec064d4aae34c1196c0b64b34161a6140af6f5060865ddeecf068bbca5ac7992ee0f865b58ec91d12f23ed8
SSDEEP 768:crv+4UNbdc3h5Kty9oL+p8+p3bd66j+4BRv86aLIWQy:cbsby3ZCL48+p3Z6n4yKy
TLSH
T13103AE72F868AD338CF2C644B2877A437FB4515396C01AE4D8DD6B4D419B1AE270B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 e3050ce1996ba7276fc659af1cf6d0bf8c1a7d161e64963e116fc0cd3ac48ba6
MD5 98c5dbf6e02c83cebc48813565371947
SHA1 7a4a6acc3b86536b8f58a4fa8ed9aa54981cf443
SHA512 cc29f3fd0228d2f6986001446a040b34c24512d2b8ee3ccf1431b7f048b137276e39cb5f4670f0941d581113adb88d997d217bfd8d0d7ef4b3970b2ce2166fc8
SSDEEP 768:sH3v5Kty9oLxp8+p3bd66j+4BRv86aLIWQxLtrAo4KC3ZU8:sH3bCLv8+p3Z6n4yKXAo4L28
TLSH
T104F2AE72EC64AD374CF6C684B6423B43AEF0905396C41EE4D8EDAB1D14972AD130B93B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 85da3a73ca054d69ab8a1c640da686b01cc914cb7af5fc340f7cd42e016dfdb6
MD5 b0413d0efd63feb0b48afd582051d87e
SHA1 4792f6ea44119dedf084f0882e9d0cbb8f337474
SHA512 9009fcd75ce9660336495f72a6ee15050972eb7131815d5e14dc97ce1a9ac5b03d3c34338d98ac51252de80f584028422640d19a2af1ce137e5e7a94b8fb3bc1
SSDEEP 768:AFQB34wgY5Kty9oup8+p3bd66j+4BRv86aLIWQxLtrAo4KC3ZU8:zB3VCo8+p3Z6n4yKXAo4L28
TLSH
T17303AE72DC94D93B9CF6CB84B6463743AEF04063C6C46DE4EADDAA1D109719D130BD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 c86d088f71c87a3ed3bc18771d01ad8489380d052155510cffbdd7c8652c5765
MD5 f08425db4e3e1528d25377ee639d9574
SHA1 c3efde7c5cfa9b6e0da8e045581ba00d09a4b44d
SHA512 cfcaa2835022c9bfc874e211e7029ffb12ec5714446c69f10036b707867fa413fa0dbce5627bf3329c9762dc36a4fddb77bedffe12a4b29bb37ea2c543ee0a1f
SSDEEP 768:cH3a5Kty9oLxp8+p3bd66j+4BRv86aLIWQxLtrAo4KC3ZU8:cH3uCLv8+p3Z6n4yKXAo4L28
TLSH
T107F2AE72EC64AD374CF6C684B6463B43AEF0905396C41EE4D8EDAB1D14972AD130B92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 af944491a3247be6c740b8101de9e979de16b3e58b1e19922e6958de25d1a6b3
MD5 3e726b29c5575888a4d375c334e755ac
SHA1 dcca21c1b155855d2b23da0412f5810116f3507d
SHA512 9b484f31659ab42e1b2f65c6b9cd6d0c9fa79953a147bc36dfe6d8b1d00e6d51c375c3e37ae2acac8dd91edf79ee498aa6a5a24e41b1edbdd55d75d98cde1ef4
SSDEEP 768:Irv+4UNbdD3KcKtyZNp8+p3bd66j+4BRv86aLIi42bwCl1:Ibsbp3LZL8+p3Z6n4yi0ww
TLSH
T1D503CF73F95899339CF2C644B2867B437FF851A396C10AC4E5DD2B4E415A29E230BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0efd5886-c421-4078-aede-b1da903db9f5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\0efd5886-c421-4078-aede-b1da903db9f5.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download