hxxps://www[.]mediafire[.]com/file/cl901jhbnvo17w9/XenoWatch_Heavy_EXE_Builder[.]zip/file

Analysis

user interaction
yes
max time kernel
899s
max time network
736s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/08/2026, 14:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.mediafire.com/file/cl901jhbnvo17w9/XenoWatch_Heavy_EXE_Builder.zip/file
Sample260803-r2fd2ss1fv

Score

7^/10

discovery execution persistence ransomware

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5644	XenoWatchHeavy.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3236	powershell.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
616	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Network Connections Discovery 1 TTPs 1 IoCs

Attempt to get a listing of network connections.

discovery

System Network Connections Discovery

T1049

pid	Process
5888	netstat.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1044	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5888	netstat.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134302416822204683"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{2254234D-CDB8-493E-8183-12DA25F5BC64}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
5632	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
3236	powershell.exe
3236	powershell.exe
3236	powershell.exe
5252	msedge.exe
5252	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3236	powershell.exe
Token: SeDebugPrivilege	5888	netstat.exe

Suspicious use of FindShellTrayWindow 50 IoCs

pid	Process
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2576 wrote to memory of 3204	2576	msedge.exe	85
PID 2576 wrote to memory of 3912	2576	msedge.exe	86
PID 2576 wrote to memory of 1044	2576	msedge.exe	87
PID 2576 wrote to memory of 3912	2576	msedge.exe	86
PID 2576 wrote to memory of 3912	2576	msedge.exe	86
PID 2576 wrote to memory of 2660	2576	msedge.exe	88
PID 2576 wrote to memory of 2660	2576	msedge.exe	88
PID 2576 wrote to memory of 5080	2576	msedge.exe	90
PID 2576 wrote to memory of 2280	2576	msedge.exe	91
PID 2576 wrote to memory of 5080	2576	msedge.exe	90
PID 2576 wrote to memory of 5080	2576	msedge.exe	90
PID 2576 wrote to memory of 2280	2576	msedge.exe	91
PID 2576 wrote to memory of 2280	2576	msedge.exe	91
PID 2576 wrote to memory of 2328	2576	msedge.exe	92
PID 2576 wrote to memory of 2328	2576	msedge.exe	92
PID 2576 wrote to memory of 2328	2576	msedge.exe	92
PID 2576 wrote to memory of 5116	2576	msedge.exe	93
PID 2576 wrote to memory of 5116	2576	msedge.exe	93
PID 2576 wrote to memory of 5116	2576	msedge.exe	93
PID 2576 wrote to memory of 1640	2576	msedge.exe	99
PID 2576 wrote to memory of 1640	2576	msedge.exe	99
PID 2576 wrote to memory of 1640	2576	msedge.exe	99
PID 2576 wrote to memory of 3308	2576	msedge.exe	100
PID 2576 wrote to memory of 3308	2576	msedge.exe	100
PID 2576 wrote to memory of 3308	2576	msedge.exe	100
PID 2576 wrote to memory of 5008	2576	msedge.exe	101
PID 2576 wrote to memory of 2484	2576	msedge.exe	102
PID 2576 wrote to memory of 5008	2576	msedge.exe	101
PID 2576 wrote to memory of 2484	2576	msedge.exe	102
PID 2576 wrote to memory of 3728	2576	msedge.exe	103
PID 2576 wrote to memory of 3728	2576	msedge.exe	103
PID 2576 wrote to memory of 3728	2576	msedge.exe	103
PID 2576 wrote to memory of 5084	2576	msedge.exe	104
PID 2576 wrote to memory of 5084	2576	msedge.exe	104
PID 2576 wrote to memory of 5084	2576	msedge.exe	104
PID 2576 wrote to memory of 4148	2576	msedge.exe	105
PID 2576 wrote to memory of 4148	2576	msedge.exe	105
PID 2576 wrote to memory of 2384	2576	msedge.exe	106
PID 2576 wrote to memory of 2384	2576	msedge.exe	106
PID 2576 wrote to memory of 2384	2576	msedge.exe	106
PID 2576 wrote to memory of 3700	2576	msedge.exe	107
PID 2576 wrote to memory of 2752	2576	msedge.exe	108
PID 2576 wrote to memory of 2752	2576	msedge.exe	108
PID 2576 wrote to memory of 2752	2576	msedge.exe	108
PID 2576 wrote to memory of 4640	2576	msedge.exe	110
PID 2576 wrote to memory of 1512	2576	msedge.exe	113
PID 2576 wrote to memory of 1512	2576	msedge.exe	113
PID 2576 wrote to memory of 1512	2576	msedge.exe	113
PID 2576 wrote to memory of 5948	2576	msedge.exe	122
PID 2576 wrote to memory of 5984	2576	msedge.exe	123
PID 2576 wrote to memory of 3772	2576	msedge.exe	124
PID 2576 wrote to memory of 5300	2576	msedge.exe	134
PID 2576 wrote to memory of 5300	2576	msedge.exe	134
PID 3236 wrote to memory of 5512	3236	powershell.exe	137
PID 5512 wrote to memory of 4368	5512	csc.exe	138
PID 3236 wrote to memory of 5644	3236	powershell.exe	139
PID 5644 wrote to memory of 5764	5644	XenoWatchHeavy.exe	141
PID 5644 wrote to memory of 616	5644	XenoWatchHeavy.exe	143
PID 5644 wrote to memory of 5888	5644	XenoWatchHeavy.exe	145
PID 2576 wrote to memory of 4828	2576	msedge.exe	147
PID 2576 wrote to memory of 4828	2576	msedge.exe	147
PID 2576 wrote to memory of 5252	2576	msedge.exe	152
PID 2576 wrote to memory of 4460	2576	msedge.exe	153
PID 2576 wrote to memory of 660	2576	msedge.exe	154

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.mediafire.com/file/cl901jhbnvo17w9/XenoWatch_Heavy_EXE_Builder.zip/file
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffebf3ac188,0x7ffebf3ac194,0x7ffebf3ac1a0
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1740,i,3015668345773271604,17573810030167241178,262144 --field-trial-handle=3060,i,1991157891500176050,6947121606895219563,262144 --variations-seed-version --mojo-platform-channel-handle=3052 /prefetch:2
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1964,i,16597877580030404892,16941440807124175622,524288 --field-trial-handle=3060,i,1991157891500176050,6947121606895219563,262144 --variations-seed-version --mojo-platform-channel-handle=3100 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2352,i,10242950788997837368,2603668345972930829,524288 --field-trial-handle=3060,i,1991157891500176050,6947121606895219563,262144 --variations-seed-version --mojo-platform-channel-handle=3124 /prefetch:8
  2⤵
  PID:2660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,17670627669720673934,6414614315309522639,2097152 --field-trial-handle=3060,i,1991157891500176050,6947121606895219563,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,5495523660853989641,15544526414373839392,2097152 --field-trial-handle=3060,i,1991157891500176050,6947121606895219563,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4160,i,5965173691757836751,2429210125787660223,2097152 --field-trial-handle=3060,i,1991157891500176050,6947121606895219563,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:1
  2⤵
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4188,i,13104658330413045942,2300872145026768943,2097152 --field-trial-handle=3060,i,1991157891500176050,6947121606895219563,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:2
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4972,i,6388367587565440658,5114385514132175126,2097152 --field-trial-handle=3060,i,1991157891500176050,6947121606895219563,262144 --variations-seed-version --mojo-platform-channel-handle=4532 /prefetch:1
  2⤵
  PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5280,i,7353688112860065594,432098769796782145,2097152 --field-trial-handle=3060,i,1991157891500176050,6947121606895219563,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5500,i,15118745313831182482,12450543108735416061,524288 --field-trial-handle=3060,i,1991157891500176050,6947121606895219563,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:8
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5508,i,13091903794031885874,906838771059879867,524288 --field-trial-handle=3060,i,1991157891500176050,6947121606895219563,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:8
  2⤵
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6280,i,7137418369814880418,10298669880850542387,2097152 --field-trial-handle=3060,i,1991157891500176050,6947121606895219563,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:1
  2⤵
  PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6120,i,703098790243996523,10780786646873321638,2097152 --field-trial-handle=3060,i,1991157891500176050,6947121606895219563,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:1
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6424,i,10909898868932608047,6049162784315634501,524288 --field-trial-handle=3060,i,1991157891500176050,6947121606895219563,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:8
  2⤵
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6440,i,1112889972297505692,2079874054091792887,2097152 --field-trial-handle=3060,i,1991157891500176050,6947121606895219563,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:1
  2⤵
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6864,i,9413375391816147388,17962577844395705813,524288 --field-trial-handle=3060,i,1991157891500176050,6947121606895219563,262144 --variations-seed-version --mojo-platform-channel-handle=6836 /prefetch:8
  2⤵
  PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=7056,i,16861153710794953500,1557502203461126942,2097152 --field-trial-handle=3060,i,1991157891500176050,6947121606895219563,262144 --variations-seed-version --mojo-platform-channel-handle=7020 /prefetch:1
  2⤵
  PID:2752
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7328,i,709083724186793502,12836126309142049393,524288 --field-trial-handle=3060,i,1991157891500176050,6947121606895219563,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:8
  2⤵
  PID:660
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7328,i,709083724186793502,12836126309142049393,524288 --field-trial-handle=3060,i,1991157891500176050,6947121606895219563,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:8
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6960,i,15522430755555761746,13418784711624507029,2097152 --field-trial-handle=3060,i,1991157891500176050,6947121606895219563,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:1
  2⤵
  PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3728,i,11086299826905290674,16218793315554555388,524288 --field-trial-handle=3060,i,1991157891500176050,6947121606895219563,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:8
  2⤵
  PID:5948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4396,i,3206575142158884322,7363924882333060234,524288 --field-trial-handle=3060,i,1991157891500176050,6947121606895219563,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:8
  2⤵
  PID:5984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3556,i,3176395015591646291,10956436821428069326,524288 --field-trial-handle=3060,i,1991157891500176050,6947121606895219563,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:8
  2⤵
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5688,i,5895773194899516133,14761389804902846903,524288 --field-trial-handle=3060,i,1991157891500176050,6947121606895219563,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:8
  2⤵
  PID:5300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3680,i,4391251596336003519,9356002641448969162,524288 --field-trial-handle=3060,i,1991157891500176050,6947121606895219563,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:8
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3668,i,16510756477211770800,13351023886998907088,262144 --field-trial-handle=3060,i,1991157891500176050,6947121606895219563,262144 --variations-seed-version --mojo-platform-channel-handle=7400 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,3050701358376170501,5153478962459534161,524288 --field-trial-handle=3060,i,1991157891500176050,6947121606895219563,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:8
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6852,i,17770233837951075881,2779971792754367614,524288 --field-trial-handle=3060,i,1991157891500176050,6947121606895219563,262144 --variations-seed-version --mojo-platform-channel-handle=7536 /prefetch:8
  2⤵
  PID:660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5280,i,7759223819775344774,15252033775020707064,524288 --field-trial-handle=3060,i,1991157891500176050,6947121606895219563,262144 --variations-seed-version --mojo-platform-channel-handle=6940 /prefetch:8
  2⤵
  PID:6036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3384,i,12832467953997013822,13946118686557540665,524288 --field-trial-handle=3060,i,1991157891500176050,6947121606895219563,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:8
  2⤵
  PID:1008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5836,i,1694350726689153941,3509854296593407484,524288 --field-trial-handle=3060,i,1991157891500176050,6947121606895219563,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:8
  2⤵
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3704,i,6769478049890373459,15682416399241508907,524288 --field-trial-handle=3060,i,1991157891500176050,6947121606895219563,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:8
  2⤵
  PID:5008

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:632

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5512

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "-Command" "if((Get-ExecutionPolicy ) -ne 'AllSigned') { Set-ExecutionPolicy -Scope Process Bypass }; & 'C:\Users\Admin\Downloads\XenoWatch_Heavy_EXE_Builder\XenoWatch_Heavy_EXE\BUILD_ONCE.ps1'"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3236
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /nologo /optimize+ /platform:anycpu /target:exe /out:C:\Users\Admin\Downloads\XenoWatch_Heavy_EXE_Builder\XenoWatch_Heavy_EXE\XenoWatchHeavy.exe /win32manifest:C:\Users\Admin\Downloads\XenoWatch_Heavy_EXE_Builder\XenoWatch_Heavy_EXE\app.manifest /reference:System.Management.dll C:\Users\Admin\Downloads\XenoWatch_Heavy_EXE_Builder\XenoWatch_Heavy_EXE\XenoWatchHeavy.cs
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5512
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2948.tmp" "c:\Users\Admin\Downloads\XenoWatch_Heavy_EXE_Builder\XenoWatch_Heavy_EXE\CSC88FADC8E86934450BE33C2A2BE3C78B.TMP"
    3⤵
    PID:4368
- C:\Users\Admin\Downloads\XenoWatch_Heavy_EXE_Builder\XenoWatch_Heavy_EXE\XenoWatchHeavy.exe
  "C:\Users\Admin\Downloads\XenoWatch_Heavy_EXE_Builder\XenoWatch_Heavy_EXE\XenoWatchHeavy.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5644
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /query /fo LIST /v
    3⤵
    PID:5764
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" query type= service state= all
    3⤵
    - Launches sc.exe
    PID:616
- - C:\Windows\SYSTEM32\netstat.exe
    "netstat.exe" -ano -p tcp
    3⤵
    - System Network Connections Discovery
    - Gathers network information
    - Suspicious use of AdjustPrivilegeToken
    PID:5888

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\XenoWatch_Heavy_EXE_Builder\XenoWatch_Heavy_EXE\README.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:5632

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Connections Discovery

T1049

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 81b365ea82409f1ccac31c98ea2ca4cb0be5b910a6b11b18a5c9be98e7453029
MD5 37a277076f38a82edcb5a0af5f60a32c
SHA1 339819b250b6da12057b67147abd36254c573078
SHA512 9e636589953c256d141c7fa0e049bee89baaf40dc67e09598af97004f3b13f57e1f222db27a50ded645e94d608a67a2b2df8f4c430c6547b29ed44a1a383327c
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7Z:fwUQC5VwBIiElEd2K57P7Z
TLSH
T100B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2ce0318c35c33b967098227a805dc29c73a2b7f4330779681222d5705016d45c
MD5 112b4d378fb6de8463c4dac9be8211a4
SHA1 ef5a2d0eae647090adbaddba09b3baa65ba512a7
SHA512 6db3b811f5d6a1814cd36363818d7bb4008a1ac3903c1364e64f611373d1406d3067c52b3b65a5858f72c0e8e0527448185040336ca582baef95a88f336228ef
TLSH
T119D0A722692975D2F32A41799062CB011A15417766637701B215981C9A740C5B5876C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e2b315c59b1bfe8e547b0017a92548af7c81e08409e987a2628ad74667b4fec
MD5 7ab616f55807e9de5195a40c50f65e5b
SHA1 917a7797f800e5f30a1b9b8125127968246d7ce9
SHA512 da10f29803a072f42a2c102da0bee745cf1b1d47836e3d30e38b1e66beeb1abeaf2eb47b6c07b23682098f70fe2a4b29a0777eefa1380d0fff2509ff32d9b356
TLSH
T171D08023771D7182F35B41759053D7025A1680756463B701B325D41C9A740C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b976ac8901ffd41ec02a04aa583bc9d11350f0f9f714fb92d3341bb0bde4629f
MD5 504ce80b644a85a7e68d85bd24169289
SHA1 1f740a722dfa97fc8fb30626b0e3d6217e4a9864
SHA512 9406464a4f6becd85591c12af8a97fdecfa2208649138f347fb50d3e28f1583adec061050924fa0405e46eb75af7e299e6564c2ed039db9d82c50326da32a3c5
TLSH
T19ED08023371D7582F75B41759053D7025A1680756463F701B325D41C9A750C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 6KB
SHA256 bde43437a93c84178c49e17a8a0894c05e0d7daee8c1857aa7db3f3011cde42e
MD5 221347da046b8c7f8834fa5cab2f9397
SHA1 48e4266661f216e8b7e1638797fb0422e7f82fbe
SHA512 ad76ad081e526ca16a908665e1b9c7737cd6d200c51eae7011c81c15555bd91954b95edeeb5a17531f889c225897915a0d4860ed6e0e35125ff330ddddbd3029
SSDEEP 192:pj0160u833HH1cccJJJBBUCVVooDDmmpp88MeLO:pj0160u833HH1cccJJJBBUCVVooDDmmU
TLSH
T140E14E4782E5C79ACF2510DF49B0636C50B13B09FFDCDA08135D99EA304E8DAF6E5AA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 6KB
SHA256 10bf1d047c6664a3f8103008e5b4dce6ac29f50223f4f996099fdfcacf9fd7bd
MD5 dfef9e44d2233d045c0477d434d06176
SHA1 e1812a17137f43b10d0384a1d4b23a80622fb329
SHA512 8e8fb3a659d8ad4cd7de28e8a8fe4855e6c5d5a748b921c1790fd1729f4305fbf5ccc7369a2963074cbb3718c73e3ad5fd195dd44c6f50d7d8c05b11e0b55b5c
SSDEEP 192:0j4A69/ettUllMMpQ77766ZfPzXIdfbaaJJwfwfMyLO:0j4A69/ettUllMMpQ777661PzXIBbaaw
TLSH
T173E14A4692E4CBAADF1910CF4AA0636C44B03B0EFBDCD548079D9DDE304E49AB5F5AE0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00009b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009b
Size 32KB
SHA256 eff9dfe4ebe815c15fa6087a8b712ccacea7a59dddcb55a5c819293252d73c32
MD5 cba69340542e691fa9e4b30334a07507
SHA1 4af443e83868d3a18fc9ad853e58eaf39bb065f7
SHA512 4f8d78c0ae8e04e27dfbcef602d3d46cdefd8f01085cc549edd35805d775065c4f78b75da617adf5f8f699a9edf7fa69db7c267917e5f9cb967e59563f905227
SSDEEP 768:wOsAPzChBrMSp8DxHnpmf3ILP1KpbjtXPgYVkutZ:lsArKDqtO8KZtXPgYXtZ
TLSH
T17AE202DF0C15679A01C371AE6A7C6024EBB3E07B3035CA1B1E764CD250B6660E5DB8BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009c
Size 96KB
SHA256 6c501148aada1207002c4dc6fb8794554897d71abeb97e92d9d15c8cf61a8448
MD5 76c1b9685c996f14f4cc8b585ddfb467
SHA1 e774b883f6b5736a9f0f0f05cfed247fdd8bdf6d
SHA512 d67c98951d327ea38ba3e761a229436782094e823847d989ddda919aa4de613bc7c5bb057968856414ecf2f2fe82e823bf3a04691d62ad7b67f7b6c142a807d1
SSDEEP 3072:rYsgcoaeqVBTILAbL7ABGMeTDm0ZSfKaXH:raU6qL7ABGMMmEFkH
TLSH
T1F7A3127B369F8CD14907CC51321A335688F4D0ADE2BA066B3D102E6A3B0B75F7A86F15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009d
Size 67KB
SHA256 76cf4c97264a6758f3d6ba9b78ce0a4130fe0804100305819fe8e9145526e432
MD5 abae0fb3c48e9ff2101729741f639220
SHA1 3ff3b23eb90676ea32a6c03a454e6d85eb269a0b
SHA512 bf88989d4c60813fd61473092975c79a3e257e2c5d99cc30ec6ed322ba75042cb42e6051e958608033e9e7f8ed60807d8e433793e2528aefbacd46c28e447f9d
SSDEEP 1536:FVlVdK2EiPI19zT1jQrvVqorLuZJHOj5R8v4yPqBpkzTjVRz:Xl3hEiPIr9je5/uTHOj38QySLkzThRz
TLSH
T1A06302F37E5CC85E8EC4B2B837DA19A1B027D4D63E5580F5ABF910C3E1E424A07D949A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009e
Size 405KB
SHA256 2b036b7e09fee4750d77ccd8ad23938777524be6c38c71f7055906813870d60b
MD5 da77c21ff0fb800a00576fbbc57832a6
SHA1 def9ee27b7f44abc2dbeaf1b56f242c140993adc
SHA512 5b463b253d5f9c713e7f89fade6509db42bad397158b5d42bd541b5ca15e79067ae0199d7382de54fae92f9d712b0f66003ede6f5a45d15317023a2c2242c41b
SSDEEP 12288:Wkbz9yLTEpq7JjSozRS7Wlc6YpUl1TQ8cQZB/1wmx:/bxyLYgjrEsuYwmx
TLSH
T1969423D7F25924C0D1A4DB4CCC83102FD55328AA66246B0EDAB8164F3D67D4FFED982A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 c2729d9544eefd58d6366a75fa6be1e371c9300cc7c8d45c2b4f55efe033bfdb
MD5 bf1404baf18ca6601f733140cdc491b3
SHA1 b160f8826ad5c1e82a8816857c17deb8c5072ea4
SHA512 29123382229778db537c209b9c7e0a411b11162feba1a60aff08da304e39e332f0575fe7379d8c334103cd505aa17aecea82bc5f5cca8354152f38fde955210c
SSDEEP 96:3VfNE0RfdbvVg2IsO7NO0g29aaQpFmsEbeqk3PEihy9/CVpIXSP:3VVE2vPI37M28dpj3PEiKKHP
TLSH
T11BF1307A419C28B7DF4C1133D5FA1A463A7254F6F9033F53AA286839601F3D62AA1C29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58e29b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58e29b.TMP
Size 3KB
SHA256 59e706bf3f9f56b48c887e9fdaa9b10980bd63a86d06453d3c81e97ff78403fd
MD5 57f122a007de4e2a3bc06d8e32cbcd3f
SHA1 b785b458dbcd9543fb22defcacdc5d547ab60ec8
SHA512 065d0bea8ef3756df674d840fd196a1e68b9678bcee9baa82faca5db33234c98ce26935c07b2fb86ad65f43caedc4f0136102a00f71857332a54342255aaeaa2
TLSH
T17681A63F110248B7D7921237C0F333867A73AAEBF9236E561374797BA525395B88512C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0d287cf1-10b6-4f99-8acb-30bf798421a9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\0d287cf1-10b6-4f99-8acb-30bf798421a9.tmp
Size 12KB
SHA256 fad8b1c947d7d06c047b007202f5c2b3bd8b0f4fe105d2bf9cc1bba43ce41cf0
MD5 60cf92e12573cac8fb9885d9d267f64d
SHA1 cbf4991446073e5addda8f6a7ebb1c3f93e56737
SHA512 15f584783bb93282b8caba3f14382bb5749c0d7122154b132535750ee33ca48b04ca77b61448fd9972722415a16ab20da08e92f21095fc3e1c8b498bea7067e7
SSDEEP 384:DpaP5z8oY2ksD/QgeYctWIn/y4IGN4qYuYO6hYVgvCxBuxo1yIkAo1V/KQc6JLBr:/INZ8Gv
TLSH
T17D428AF383E6D52E89115BF49A146E1BCE1D0655432C3D268CD5EE8BE3F2032E16A64F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 1403cfda07a90573a7bd414a6179f5f5ecf9ff7bf9064ea8ebb11312c5676574
MD5 56365586c2402e78bc583986bd85c0d2
SHA1 bd6dd916689b6e50fdad3c805aaf52c80ba1e060
SHA512 28a0a4c29a62b8ea48ea024be704eea614cfedf25712ec0f5d91406dbd4055bd39db804112acdd1fbecdb988e21b6b59f7c9175400026c3cc9dfb5d0ccac2e13
SSDEEP 192:DWdEGSkb47fDBteMeiwOIdxPj1y4IGk4qYmYK6hY+sa9Bixo7mfAAoHKQchJRBc5:DWdEGSkb47fDBteMeiwOIdxPj1y4IGkk
TLSH
T16D2269F753A2D55E99115BF49A04AE1BCF1C1616432C3C2589D0FE87E3A2033E16E75B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 13KB
SHA256 2458eb7f3afa91c9e26bf5ef2a001c1f0f6bf327b3363c39f4841e1b42b185c1
MD5 0a9c25a1e2b8befeb1b87116d35a19ae
SHA1 e7c183245ca6315a230f12ebd6d2847bb76dff64
SHA512 d42adbbd26614d15573c225fa36bd14055faeada82c5f138c4aa079cb641049fc7bf4b75dedcff08c0281017e36920a7de5cddb634d0caca556979f55cdccaac
SSDEEP 384:DpaP5z8oY2ksD/QgeYctWIqPu/y4IGN4qYuYO6hYVgvCxBuxo1okAo1V/KQc6JL8:bINZ8Ny
TLSH
T136529AF383E6D61E89115BF49A146E1BCE1D0655432C3D268CD5EE8BE3F2032E16A64F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 e43b105b5af1b615888a779f4e077348e98143ccf0ef87071d83710abd42ab9e
MD5 f08be28188f1b1ff682507e110b78ea9
SHA1 9171c6ba6ba989374911dba060b81c7f9a36ee79
SHA512 c002848b28a9325ae6cb4511ef29a40cccc6a0d29d5d669e957761300e8fe50423d3d33560906a1a1be713e041ddf11531336a263f6b007aca2e2a8a4cacd250
SSDEEP 192:sxZBDUnQSRryM/jK1Ml8UQF2Vs/fdsTeFbeddpuxSNsAHW6+WNqN6CqFJu/YACLS:sxZmnzlqcVs/fdsTeIRfHb7m/iIT7I9i
TLSH
T1D5921842A630497BCDDBD619F9217F13EAF80472DA911E5CA9FCC91C04EA6ED2207C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 c65ae1548d776d18361ed147f0b8141209cbacbd332132a8c8b7019ac9435ae5
MD5 48edb3a5de3c656adc379be56d14feda
SHA1 d525fee66215ed0449c07ae5ebb6698ee3ced621
SHA512 968895c08dde7bdc36444df55f571cfd35d057f446a9c9bb661d0d90bb60476c419e68078bfcedf992d303ab5510da8ed955ad1bd6612eab16693334df7b8043
SSDEEP 192:sxZBDUnQSRryM/jK1Ml8M2Vs/fdsTeFbeddpcxSNsAHW6+WNqN6CqFJu/YA/VUW7:sxZmnzluVs/fdsTeIRBHb7m/h7
TLSH
T153721902A634197BDDEBD21AF901BB53E6F84472D6911E54AAFCDD0C04E6BDD2203C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 43da809487253f8af6e124a8564c32ade5bc883d38b6b79fd7f0182c807e3179
MD5 b264eb5653c575cc2567088d90438c21
SHA1 4bbc21bb44bd2cf308d9c23648b31f21ca543818
SHA512 8c0ec3ef960a5e6c4b3aa6f61ee171a6a2a1f1b04387d544b0f472697e3342b3f07c6b3ca05015602bca153cc9699df41a13022c79e094dcb66478491c32b5cd
SSDEEP 192:sxZQRryM/jK1Ml8MXs/fdsrqSIdpcxJsAHW6+WNqrJu/YIdEUWIgrJ:sxZQrvs/fdsrqb4Hbd/U9
TLSH
T1DC52E702AA38697BCDCBD20EFA45BB53D2F5447292911D54A9FCDA1C04E6BEC2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 a148ff0df1378adef4fe59632da2db9cfece01b94dfec3d74aba2ed7bc250a2f
MD5 b66eb233d9739bdfca25ded5e59122b3
SHA1 bfd70bb358441ed1bd6412f149937425f77b1cf9
SHA512 fdcaec8acbc611766779daf6cc133bd4fdcef68799c47002e0801ec21df87e9e72403790ca0d43dadb37feb707c601b1a68743c04645ab45b0d3628618be94cd
SSDEEP 192:sxZBQUnpRryM/jK1Ml8M2Vs/fdsTqKbesdpcxS4sAHW6+WNqN6vzz/9Ju/YAETEB:sxZpnpluVs/fdsTqVccHb/+/D7
TLSH
T16A722802AA34197BDEDBD21AF902BB53D6F85472D6905E94E9FCD90C04E6BDD2203C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 5866219b17e2fbdf67e57b442e81ffd77618e4367e0e310288edf63f617aae4d
MD5 5a36fc96d1bda9e0f58839f1799ac33c
SHA1 f72486df52b31b4513446ebca318918ebc87bd98
SHA512 a8ba0cee59eafeaffc06e9e63c20e6aca7d45193c4933ac1b17ac90102eb03d6d5432e3a71d739a73b99b5d909b128c397773f0ef2f15e6eea75051ab094fbe9
SSDEEP 768:vbsqxXlWvJD0T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVk4Ll6AR9QroE+Y:vbsqxXlWvJD0Tu1ja54LAs97ED
TLSH
T161E20B3B694CC77E4F840E5DEC26AFD76ED801CBA6988D5447FA880C03CB2EA51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\783ff0be-338c-40ad-8053-33ee09a8d709\index-dir\the-real-index
Size 72B
SHA256 18264a74f91ba77585310bfbc4402ce9ecc149436f0d85ac0ccc580519a604ac
MD5 6442a8052aed0f6d221144392673c156
SHA1 0a9a1100005a296945231e442be8639ed96c08bd
SHA512 de1440d579730dc63adc944bed6609b4d41a8ea7936d388f2ceb4d4d63ca3833095600e8692aab4680d2372ffbdbbc592b95520fa662e8578baa925a58b7cbf7
TLSH
T1E6A0025562803091C46252F227D601A223514ED1024573A74591105ECDE4756499140C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\783ff0be-338c-40ad-8053-33ee09a8d709\index-dir\the-real-index
Size 72B
SHA256 95f02854ea8ae4847c91401cd0a4242e90a46b9959cf57e0ff7c1e8fbf088d0c
MD5 f2c68a18db3a71ceb95c0de2ac82113c
SHA1 5d1b2731e2a523039d0ca132dfa858a4af7fc1bf
SHA512 5af57d4813383cb33fb52afa0bff4f50b4bf4e6d519b9beb12a4a237ecb4ba483eeb603f414f878281ca1d6dea05e46b72daaba9f8aafee166762245cbb8a8dd
TLSH
T183A0022003889105C51611F19D5606823311C8D16100234B41999155CD955805EC249E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ee743e92-8f67-4188-9bcc-a865d9829eff\index-dir\the-real-index
Size 3KB
SHA256 e0800170cdfeae1db6da06e8383efbc064e47a6db719487a73ada4110eaa4db2
MD5 008a22688b409c3c4728fc8f0fabe1fd
SHA1 a009c8634071a4c9a67eec98672c2a5464690694
SHA512 53acce8ad83cf500c637f4c79aa0be601dfdee67894b6c2394eea6fda24aa3ec63bfe20e85053c10ce8b647495f0d4398e23dd81281f3c4b1f75b4c3c7b18e78
TLSH
T1D651D84E4D4B2EAFC9AC00722CFA158433756CDE4689DE1B665DE1307CD33391E1E105
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ee743e92-8f67-4188-9bcc-a865d9829eff\index-dir\the-real-index
Size 1KB
SHA256 6b803cf780a52b8e4913850004414ac9a5f561bc35affa602b5bb2bca5a3f006
MD5 7cee70a77d08563af504473f113343df
SHA1 6104fbf2e676468fac90797d4f7a5eb9155fa635
SHA512 b3cb8f064ba994390a25ac1546e754352e5e82bcc8448ee6f7741eb9d73c2b7a4000e1ee86182de06eafdb20d50b2a37715d93ab8521b41e43ed57a4df9e1777
TLSH
T1C741748D4D90891BEC9444F205B1616832B084DC5B26A6539C3C31367D2336E264B1DC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe585f71.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ee743e92-8f67-4188-9bcc-a865d9829eff\index-dir\the-real-index~RFe585f71.TMP
Size 1KB
SHA256 81e070000fd686fdf0fcae4f71db4041e072c4acb4ede2f8f078531195238361
MD5 781cbc6fdc6cb562a9b3894641a731d3
SHA1 61eeede0f061c32a00e99df102ecc3bb3f78a7de
SHA512 37a76c69a925ca4750a830457a7afa961b4b12fd6c8c9ac5ecab2c7df6091968f6d1f0913f9452294ce49404cf502f15520df2e8bf074ed079cb061c142ecc60
TLSH
T10F41454A4E918A1AE88440B70AD7A4B83335D8405322B797A57C6539BD717FD2A4E0D9
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 c7fbdaac6f878c58c748371fc63f84a920ba92489412f91537862efe92a0bf2c
MD5 073be249ab2417affc3fcec3b8f63c68
SHA1 6acb1307229858b826b8ea089eb70c0e51a6fc17
SHA512 12e9489427a1fb45938ea3c84260cc6a9ec7c7801955515430951f4507e2af680f76e09d011fe3447a2eda37bb02ef6331d297080038243ea2fed75c8355e207
TLSH
T1ADE068B62AE70804A8ABD3DA087254960401F428C851EC5F0029968310722612825C26
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 7832ca94fe53b13aed25e307a05377287db7be6500188db5f86988e45185c10c
MD5 e5f9606ca0dfba2778790d0722a653df
SHA1 668f420e9c9d6a3ce84aec0097b27ae12a63b556
SHA512 a0ee13aaf8df52c1b81f643a52cdadb1b06712a018768a2293ec3515de80a6eb879cccbc74632e6c998d4df9b4e130292f821380ce829cec4b63b1b391c39f8b
TLSH
T12CA00232DA998091E45016B19A6502C46A919CF84606371192FC0054CC681444697144
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b67a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58b67a.TMP
Size 48B
SHA256 bdcbacfd6ba1ff66a27f5c019ba0f2ac5e5a9baa7987c9dddc69dd3c7179f4dc
MD5 fb6e9350d22d01b2fcaf6971a07271a0
SHA1 a49279114d7fc9a0593ac2a83587986d068d9001
SHA512 79e0247404bbecc4e3622300a53f4eaebaa6a4a6033b4e9b97d8a2ec53a2ba868b92adcdd90ddded5fbb2d37cb3ed16d5ac93a241019dfa3ff3121b47cf6cea2
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 64be4f235f9cce2a2d82d39ebcae143bb99ef4370dac17ff14250b2aa9301426
MD5 15dff1cf59c2b1d35956b7d876ad98e2
SHA1 e7726c067d574d100a5eea4b4b0e8e3d06f91822
SHA512 f9e0da6e7ddb64c1cb7f50390c2f1ede47e7bef587f7980c67174162f5ed35bcd89bc861ee78fe6bcc8493189a237678eae24163d73c8c31654ed97cbf183b15
SSDEEP 96:KYbaKYIKCe0K3q6upKb6KMMWKCIK/KgNuBNTbx:ExHfqZvs
TLSH
T1A4D18412B13F0242397D6958A26ACA774E8276B33418A5BF3BB854614D77E125CFCCCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a5f7cbc8-ff1f-4fcf-93fc-ae68d43b1da9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\a5f7cbc8-ff1f-4fcf-93fc-ae68d43b1da9.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 e05566eeb8cf466568fe291770e81159af9454f54aa9e599f168b4f4d4119ec2
MD5 2d04a39e653e9ae886dbae0ff51f863e
SHA1 fb7f902a5a7ed8aa6d3d54d0bcf2dccf6a13ecc8
SHA512 44a8ac5fb2361a9958c266db0b3be823499c29d8ccae8ac5d053a2d6ba1ae0a3c2917bc1519b8230b28030fdcd57bbb5d0a4a6bf3180c010ba03e5df9553832c
SSDEEP 384:yiFIZcI20sNb8TUNTUlIlAT3M43bWw7PBVRNDXOI+W9ZvGk6HlytEDq1vWF:5F2pUwgUTnH7OIL9okoy6DqlWF
TLSH
T1D3B26C3259A4983B9EBBAA45F44A35138FF85067DAC5AEE0E2CD9E0C01DB1DC130BD25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 02dab2229973225712a03ea64c646f1b9015b5f2df6c6294b696ed8babc5d40a
MD5 cff3a1152741cc5effd795dff6e3b457
SHA1 6b7a01d2af66c38a98ad871047c9800729777372
SHA512 9bd31198dbb12e54c9d75656084893fffd8e3737e5a0efc4c8f6556bd972e7370be986e2fa76a632e89e2eb76f32904cc22847b5a997584f8d38286bbd1311c4
SSDEEP 384:yiFNZcI2ZsN88TUNTUlIlAT3M43beB7PBVRNDXOI+W9Zvuk6HlytEDq1vWF:5FVYhwgTTnH7OIL90koy6DqlWF
TLSH
T1BBB27D3259A49C3B9EBBAA45F84A35138FF45063DAC5AEE0E2CD9E0C01DB1DC130BD25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 f01f0411ba53f37b24d2086197a563b8b4d9bc6c441372c3f0aaae5b8e5d1903
MD5 35d2f5140d7f97af4311826827cd7fc2
SHA1 2d61996a325a5e9f59883264efa4909f83d25cf3
SHA512 db06576725e916db728dff109189863562913be721a83020525980edbd6ba80b07206005520458189c3976eb9592545dd8c24ddace18654c6cbda0c1d4f891cf
SSDEEP 384:1ZcIbsN0mkM43biu7EVRNDXOI+W9Zvbk6HlytEDq1vWF:NbD+H7OIL9tkoy6DqlWF
TLSH
T155928D3199785C378EB7A556F48B35138FF89027ABC46FE4A1DDAF1C01CA5AC130B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 41ae11300dfb313b034b3c7d5b34265f95d22d92ce9d983cb0eb4310cf88d880
MD5 d3911d119e8de2fbfc2d69444678a4bc
SHA1 aa92b822bdc32487dc0e4d72572fd9c3f2d5223e
SHA512 0befbf480ea596cd4bad757ff27cfedf8136383d61b51e927e8a59351f1445f4d4ca2401d25a77b5198c49c44ebaab5bfa5f89bfb92708e8633c3d42f4ac4511
SSDEEP 384:yiFPZcI2hsN88TUNTUlIlAT3M43bdG7PBVRNDXOI+W9ZvVk6HlytEDq1vWF:5FHUhwgvTnH7OIL97koy6DqlWF
TLSH
T1DCB26D3259A49C3B9EBBAA45F44A35138FF85063DAC5AEE0E2DD9E1C01DB1DC130BD25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 3a0271e7e541011a8faeb50fe8d719b4bb1aa25b6c986028c94230f981d32509
MD5 b4cefacc49bee7f5389861c1b7db78a8
SHA1 0979ad99dab9d255fb1edecc7030adf46374cbef
SHA512 991c9936a7ac5a8d16a468731570dfb198d26908bb81709972fb5ede82f9aab363619e24d6a427d27db96b58620ce405dd717b2def98f3a4079f8f99f2fe3d06
SSDEEP 192:tONR6JkRtQmiUyf2UW+RNDXOmj+Oh3IRiU6:tONR6UrgW+RNDXOI+mFU6
TLSH
T18102D9356D382C7B9EE26D4AB48B37175FA8207BBA856F90D6E81F1C01D765C2306836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 dd01b1fe7d81f1993152d8eaf7dee9b28a5eafb056fa82b4c3325513b8b5ecba
MD5 e10f48df2cc1bc6e034981e0d87e9868
SHA1 0b28214af6e4cdebb96cd553216d1db7e7b0d652
SHA512 83fdd847bd5935ad2ce988db74e778f1751642b1cf9bbbdad7461cc4a0b473c0bd14bc641f786028a38e2079a3bf84494cee8e4114c86eeeedcf0ad1c7cdb98d
SSDEEP 384:FZcIusN09T3M43bUB7PBVRNDXOI+W9Zvbk6HlytEDq1vWF:9u4TnH7OIL9tkoy6DqlWF
TLSH
T142927D3199785C374EBBA54AF48B35138FF89023ABC42FE490DD6F1C01DA5A8230BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 68034abfe6c5d6de974c9ac0b21603f4132efcb1cd6e113ba0fcf71fa6ac7962
MD5 7354185bc6dbb170ad6fe6799be97c5f
SHA1 146b08372c6f47a90e7ce40f097cda057d63b61f
SHA512 ff9607d02d9c26ca1d2df8e177ebf9355742c67c41b5b3f551654a52b1da7f1abc40bec3785fcf0ae85e7335b5692dc5de336624453e5e9d754aaf4c39b681b1
SSDEEP 192:ZON96JkRKQmiUy+2Uu+RNDXOmj+P+9TFvgVczrqCOU6:ZON96UGzu+RNDXOI+W9ZvHkU6
TLSH
T146121A35AC785C775EE26945F48B35135EA8513BEB897F90D1DC1E0C02DFA9C234AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 1f6c445b08f9d10356574a741e520ccb7ae19d25f41d969a679fb0a68396d7c2
MD5 ec111be09d70422679e322d32854677a
SHA1 d4ddd6f4cfe1a64368966e490be743777ce8a4c6
SHA512 0c105e958d143a100c6163f7487dfe4754035f101ea1f4e462b244ebfa9d657185b2b07c0f17a2c40b98dfbd147d411ac3763901539ff1dac5455867f3f42b9f
SSDEEP 384:IZcI3sN0AT3M43beB7PBVRNDXOI+W9Zvvk6HlytEDq1vWF:235TnH7OIL9lkoy6DqlWF
TLSH
T1E9927C3159785C364EBBA54AF44B35138FF89023ABC46FE491DDAF1C01DA598230B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0b0df0f5-039c-4864-9ec6-99adb8be9893.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\0b0df0f5-039c-4864-9ec6-99adb8be9893.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 4c9de0fe2bd9028f8ad4882e7aa0af32da15d0bd7281351fbaffdb7e399e0a74
MD5 d31bbb3bfcd29966660aeebcc957a3c3
SHA1 4373b0fba4de67b69fc1e41dc65cb446142acd03
SHA512 a4a75b8673c97add278145064de50de9d35eb99f60897980af1fdcb8b37953ab26cce9aaa776954adec6800cf06f1ea43b7e3aaa1892e111df870e5a41d6ac06
TLSH
T10841D49CB6F91158B3B76F5AABFB986E487BB8772B06D05E10010D4F0662E40D861B37
MD5 SHA1 SHA512 TLSH

Submit Download

RES2948.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES2948.tmp
Size 1KB
SHA256 ca6a108c56be95ccb7941476419aa1c69b39366bbf2a24a2b03cc6a84cdc5c9d
MD5 a72b210700e9e471b97d19c360475f11
SHA1 add58c870202f6925e56885ee91739a576510d31
SHA512 1391209a22a11aa3d96d74ecf5b71e06a40e2ddc03f0c778ce771df69f9fad6a52a45067e4979b4f1552999eb9784d58f946edc408569232ecb8cb2020f80078
TLSH
T1DA41245193EC8606F173573215FA230E32767E59DD9A93AEC9804B3C5D51740CE915B2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_3e2iy2ls.4xx.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3e2iy2ls.4xx.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

XenoWatchHeavy.exe

Path C:\Users\Admin\Downloads\XenoWatch_Heavy_EXE_Builder\XenoWatch_Heavy_EXE\XenoWatchHeavy.exe
Size 15KB
SHA256 36c4f4b2ef9f86606cfff1a4c1993162873f64a08f5a2359f2eca942137ff7b1
MD5 756365901ec2b2e85477571e907c2cf7
SHA1 1a3ad15d7a0809ab1d249eefdc84be7b3509a825
SHA512 a379c2ab229766590871afd88b94e9530197d339cab86af1fbba260bb765c15ca879aaecf6a0c41b4556d0179184781a8adf8b94352f4825a9c582b0cd9e13f3
SSDEEP 384:9B7FmrPx2l/2yELtOkUPOZSr5AJGhsSTj/ENR0q:/FYPxCf4tOywNYNy
TLSH
T16D62C40577EC4655F2BF5F785AB003180672BD9B9932EB0E18D0458D8E72AC4CE71BB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSC88FADC8E86934450BE33C2A2BE3C78B.TMP

Path \??\c:\Users\Admin\Downloads\XenoWatch_Heavy_EXE_Builder\XenoWatch_Heavy_EXE\CSC88FADC8E86934450BE33C2A2BE3C78B.TMP
Size 1KB
SHA256 2def3d97b423c3934213c9c8cc3b166830e9d0a3ae296db2117d92b5c30bbc8e
MD5 adf995ccb0706cc4c4bfe3cff05307ad
SHA1 693643bd36e3612e5bac58cbd45d68787ce7e3ed
SHA512 e5551bd1d16eafe5872c7add0931275a52ad232e90d8b786591b290f214d0f1b3c946a6b1f63dc1189c66c006312188246dc254103a0a90f0b934cdc3820ea65
TLSH
T1B621AF81E3F84109F2B34B723AF1935B50B9BF5ADC7653FCD5804B6D5910A00CA92BB1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3236-1198-0x0000022F27CF0000-0x0000022F27D12000-memory.dmp

Download

memory/5644-1209-0x0000000000E00000-0x0000000000E0A000-memory.dmp

Download