7dfd7fcb9fb1642c1af8d82e33c7547d0bb663eb3bc04c5832c29ab8bcee8c30

Analysis

user interaction
yes
max time kernel
158s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 11:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
XeniteOG_1.rar
Size 2.6MB
Sample260804-nk91jsac94
SHA256 7dfd7fcb9fb1642c1af8d82e33c7547d0bb663eb3bc04c5832c29ab8bcee8c30
MD5 3d542d9d2382219bf117cf30fa1acfee
SHA1 b0913a0b0d23ad32739a513dd9499962ba4b4288
SHA512 a1951e3ef063fe84aaf83f79a5745577abb227271500420c917b3d1bb800e2a2c7d1dcc8df5f7b63f07d8b576408102e8c0dc5056d56df36980faff3b685fead
SSDEEP 49152:3kUcKoBqd7W0CfwdkokFAf9XvwQheHkPmL+vaXnzvvjFtnAEQSSGkNNt:3kUcKoBqd7W0CYdkok6vwQkHT3RtfBML
TLSH
T189D53334A770807FF80443BB2E134DE87F19DB97A48D96AC23219C316B9DAC2595267F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence ransomware

Malware Config

Signatures

Downloads MZ/PE file 2 IoCs

flow	pid	Process
98	2008	msedge.exe
149	4636	msedge.exe

Executes dropped EXE 4 IoCs

pid	Process
4920	Xenite OG.exe
2752	Xenite OG.exe
3540	Xenite OG.exe
2376	Xenite OG.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_134681591\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_134681591\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_134681591\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_134681591\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_134681591\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_134681591\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_134681591\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_134681591\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_134681591\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_134681591\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_134681591\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_134681591\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_134681591\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_134681591\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_134681591\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_134681591\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_134681591\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_134681591\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_134681591\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_134681591\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_134681591\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_134681591\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_134681591\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_134681591\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_134681591\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_134681591\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_134681591\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_134681591\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_134681591\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_134681591\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_134681591\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_134681591\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_134681591\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_134681591\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_134681591\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_134681591\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_134681591\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_134681591\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_134681591\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_134681591\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_134681591\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_134681591\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_134681591\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_134681591\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_134681591\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_134681591\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_134681591\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_134681591\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_134681591\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_134681591\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_134681591\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_134681591\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_134681591\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_134681591\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_134681591\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_134681591\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_134681591\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_134681591\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_134681591\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_134681591\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_134681591\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_134681591\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_134681591\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_134681591\_locales\cy\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2008	msedge.exe
4636	msedge.exe
3484	msedge.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303165764856908"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3989226554-2204910950-1522900112-1000\{87207AD3-56D2-4FA8-9BAC-B6B2BF9B6C6E}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3989226554-2204910950-1522900112-1000\{D5C378EC-24B2-402F-AE40-BFEFAE5DC6C3}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	7zFM.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3989226554-2204910950-1522900112-1000\{F3C33193-9D38-4A75-BAB0-5A8214CF6A8D}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3036	7zFM.exe
3036	7zFM.exe
3036	7zFM.exe
3036	7zFM.exe
3036	7zFM.exe
3036	7zFM.exe
3036	7zFM.exe
3036	7zFM.exe
3036	7zFM.exe
3036	7zFM.exe
3036	7zFM.exe
3036	7zFM.exe
3036	7zFM.exe
3036	7zFM.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3036	7zFM.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeRestorePrivilege	3036	7zFM.exe
Token: 35	3036	7zFM.exe
Token: SeSecurityPrivilege	3036	7zFM.exe
Token: SeSecurityPrivilege	3036	7zFM.exe
Token: SeSecurityPrivilege	3036	7zFM.exe
Token: SeSecurityPrivilege	3036	7zFM.exe

Suspicious use of FindShellTrayWindow 28 IoCs

pid	Process
3036	7zFM.exe
3036	7zFM.exe
3036	7zFM.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
3036	7zFM.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
3036	7zFM.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
6336	ShellHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3036 wrote to memory of 4920	3036	7zFM.exe	89
PID 3036 wrote to memory of 2752	3036	7zFM.exe	90
PID 2752 wrote to memory of 1692	2752	Xenite OG.exe	91
PID 1692 wrote to memory of 4340	1692	msedge.exe	92
PID 1692 wrote to memory of 1992	1692	msedge.exe	94
PID 1692 wrote to memory of 2008	1692	msedge.exe	95
PID 1692 wrote to memory of 1992	1692	msedge.exe	94
PID 1692 wrote to memory of 1992	1692	msedge.exe	94
PID 1692 wrote to memory of 4408	1692	msedge.exe	96
PID 1692 wrote to memory of 4408	1692	msedge.exe	96
PID 1692 wrote to memory of 2236	1692	msedge.exe	97
PID 1692 wrote to memory of 3252	1692	msedge.exe	98
PID 1692 wrote to memory of 2236	1692	msedge.exe	97
PID 1692 wrote to memory of 2236	1692	msedge.exe	97
PID 1692 wrote to memory of 3252	1692	msedge.exe	98
PID 1692 wrote to memory of 3252	1692	msedge.exe	98
PID 1692 wrote to memory of 4596	1692	msedge.exe	99
PID 1692 wrote to memory of 4996	1692	msedge.exe	100
PID 1692 wrote to memory of 4596	1692	msedge.exe	99
PID 1692 wrote to memory of 4596	1692	msedge.exe	99
PID 1692 wrote to memory of 4996	1692	msedge.exe	100
PID 1692 wrote to memory of 4996	1692	msedge.exe	100
PID 1692 wrote to memory of 1052	1692	msedge.exe	102
PID 1692 wrote to memory of 1052	1692	msedge.exe	102
PID 1692 wrote to memory of 5764	1692	msedge.exe	105
PID 1692 wrote to memory of 1524	1692	msedge.exe	106
PID 1692 wrote to memory of 5764	1692	msedge.exe	105
PID 1692 wrote to memory of 1524	1692	msedge.exe	106
PID 1692 wrote to memory of 4764	1692	msedge.exe	108
PID 1692 wrote to memory of 3468	1692	msedge.exe	109
PID 1692 wrote to memory of 3468	1692	msedge.exe	109
PID 1692 wrote to memory of 3816	1692	msedge.exe	110
PID 1692 wrote to memory of 3816	1692	msedge.exe	110
PID 1692 wrote to memory of 2260	1692	msedge.exe	112
PID 1692 wrote to memory of 2260	1692	msedge.exe	112
PID 1692 wrote to memory of 2260	1692	msedge.exe	112
PID 1692 wrote to memory of 4180	1692	msedge.exe	115
PID 1692 wrote to memory of 4180	1692	msedge.exe	115
PID 1692 wrote to memory of 5392	1692	msedge.exe	116
PID 1692 wrote to memory of 5392	1692	msedge.exe	116
PID 1692 wrote to memory of 3116	1692	msedge.exe	119
PID 1692 wrote to memory of 3116	1692	msedge.exe	119
PID 1692 wrote to memory of 3340	1692	msedge.exe	120
PID 1692 wrote to memory of 3340	1692	msedge.exe	120
PID 1692 wrote to memory of 3340	1692	msedge.exe	120
PID 1692 wrote to memory of 3240	1692	msedge.exe	121
PID 1692 wrote to memory of 5680	1692	msedge.exe	122
PID 1692 wrote to memory of 5000	1692	msedge.exe	123
PID 1692 wrote to memory of 3420	1692	msedge.exe	124
PID 1692 wrote to memory of 4488	1692	msedge.exe	125
PID 1692 wrote to memory of 4488	1692	msedge.exe	125
PID 1692 wrote to memory of 4464	1692	msedge.exe	128
PID 4464 wrote to memory of 1168	4464	msedge.exe	129
PID 4464 wrote to memory of 3576	4464	msedge.exe	130
PID 4464 wrote to memory of 4636	4464	msedge.exe	132
PID 4464 wrote to memory of 3576	4464	msedge.exe	130
PID 4464 wrote to memory of 3576	4464	msedge.exe	130
PID 4464 wrote to memory of 4508	4464	msedge.exe	133
PID 4464 wrote to memory of 4508	4464	msedge.exe	133
PID 4464 wrote to memory of 4812	4464	msedge.exe	135
PID 3036 wrote to memory of 3540	3036	7zFM.exe	136
PID 3540 wrote to memory of 2008	3540	Xenite OG.exe	137
PID 4464 wrote to memory of 5604	4464	msedge.exe	138
PID 4464 wrote to memory of 5604	4464	msedge.exe	138

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\XeniteOG_1.rar"
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Users\Admin\AppData\Local\Temp\7zOCDB6F1A9\Xenite OG.exe
  "C:\Users\Admin\AppData\Local\Temp\7zOCDB6F1A9\Xenite OG.exe"
  2⤵
  - Executes dropped EXE
  PID:4920
- C:\Users\Admin\AppData\Local\Temp\7zOCDB6F2D9\Xenite OG.exe
  "C:\Users\Admin\AppData\Local\Temp\7zOCDB6F2D9\Xenite OG.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.NETCore.App&framework_version=9.0.0&arch=x64&rid=win-x64&os=win10&gui=true
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2c8,0x304,0x7ff8900fc188,0x7ff8900fc194,0x7ff8900fc1a0
      4⤵
      PID:4340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2012,i,5620320980116138220,6700351830765529008,262144 --field-trial-handle=2492,i,5858558211063888426,1055698881433594881,262144 --variations-seed-version --mojo-platform-channel-handle=2488 /prefetch:2
      4⤵
      PID:1992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2176,i,1005363619098563431,11541138035648109840,524288 --field-trial-handle=2492,i,5858558211063888426,1055698881433594881,262144 --variations-seed-version --mojo-platform-channel-handle=2568 /prefetch:11
      4⤵
      Downloads MZ/PE file
      System Time Discovery
      PID:2008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2680,i,6432231343590487765,14940067005004734690,524288 --field-trial-handle=2492,i,5858558211063888426,1055698881433594881,262144 --variations-seed-version --mojo-platform-channel-handle=3328 /prefetch:13
      4⤵
      PID:4408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3608,i,2365480808728053773,18019817076017381677,2097152 --field-trial-handle=2492,i,5858558211063888426,1055698881433594881,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
      4⤵
      PID:2236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3532,i,8229691415067702286,5184512541365156596,2097152 --field-trial-handle=2492,i,5858558211063888426,1055698881433594881,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
      4⤵
      PID:3252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4136,i,17038565231008890272,657842755191046305,2097152 --field-trial-handle=2492,i,5858558211063888426,1055698881433594881,262144 --variations-seed-version --mojo-platform-channel-handle=4636 /prefetch:1
      4⤵
      PID:4596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4144,i,5101523283291763144,11512563915992936763,2097152 --field-trial-handle=2492,i,5858558211063888426,1055698881433594881,262144 --variations-seed-version --mojo-platform-channel-handle=4764 /prefetch:9
      4⤵
      PID:4996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,10712079235149394724,13894074159598896816,524288 --field-trial-handle=2492,i,5858558211063888426,1055698881433594881,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:14
      4⤵
      PID:1052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5360,i,4748576578852265337,16668686256622986340,524288 --field-trial-handle=2492,i,5858558211063888426,1055698881433594881,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:14
      4⤵
      PID:5764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5224,i,8112429231133333024,13908456758966360912,524288 --field-trial-handle=2492,i,5858558211063888426,1055698881433594881,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:14
      4⤵
      PID:1524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,18080463807818857451,6176971775461831943,524288 --field-trial-handle=2492,i,5858558211063888426,1055698881433594881,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:14
      4⤵
      PID:5408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,18080463807818857451,6176971775461831943,524288 --field-trial-handle=2492,i,5858558211063888426,1055698881433594881,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:14
      4⤵
      PID:4764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6180,i,8684919204182614059,7079756899982144791,524288 --field-trial-handle=2492,i,5858558211063888426,1055698881433594881,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:14
      4⤵
      PID:3468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5208,i,9883052761009905440,16686746585425517356,524288 --field-trial-handle=2492,i,5858558211063888426,1055698881433594881,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:14
      4⤵
      PID:3816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6564,i,11980860777804508402,8694911676984355461,2097152 --field-trial-handle=2492,i,5858558211063888426,1055698881433594881,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:1
      4⤵
      PID:2260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6568,i,6728649512576567388,6228341921454087062,524288 --field-trial-handle=2492,i,5858558211063888426,1055698881433594881,262144 --variations-seed-version --mojo-platform-channel-handle=3812 /prefetch:14
      4⤵
      PID:4180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6452,i,11868539938634750938,1888655965641292700,524288 --field-trial-handle=2492,i,5858558211063888426,1055698881433594881,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:14
      4⤵
      PID:5392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6436,i,9539389636195529884,12801209610978004809,524288 --field-trial-handle=2492,i,5858558211063888426,1055698881433594881,262144 --variations-seed-version --mojo-platform-channel-handle=6912 /prefetch:14
      4⤵
      PID:3116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7004,i,15962736755300979937,15318676153024668945,2097152 --field-trial-handle=2492,i,5858558211063888426,1055698881433594881,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:1
      4⤵
      PID:3340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6864,i,12610499885762796295,7860094143523265242,524288 --field-trial-handle=2492,i,5858558211063888426,1055698881433594881,262144 --variations-seed-version --mojo-platform-channel-handle=1316 /prefetch:14
      4⤵
      PID:3240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6804,i,13841121642981245507,11254004109337191257,524288 --field-trial-handle=2492,i,5858558211063888426,1055698881433594881,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:14
      4⤵
      PID:5680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6792,i,13359442670690761944,8199245098643992183,524288 --field-trial-handle=2492,i,5858558211063888426,1055698881433594881,262144 --variations-seed-version --mojo-platform-channel-handle=3852 /prefetch:14
      4⤵
      PID:5000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3628,i,14935740749622563484,14466970644274491900,524288 --field-trial-handle=2492,i,5858558211063888426,1055698881433594881,262144 --variations-seed-version --mojo-platform-channel-handle=6768 /prefetch:14
      4⤵
      PID:3420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1400,i,8796908322591533885,15046122105170551896,524288 --field-trial-handle=2492,i,5858558211063888426,1055698881433594881,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:14
      4⤵
      PID:4488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
      4⤵
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:4464
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x274,0x7ff8900fc188,0x7ff8900fc194,0x7ff8900fc1a0
        5⤵
        
        PID:1168
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1612,i,4600923422137329160,5774664446743117415,262144 --field-trial-handle=2392,i,5522443951451440365,9112868901107225158,262144 --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:2
        5⤵
        
        PID:3576
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1796,i,14497894303705741846,9063370599288273607,524288 --field-trial-handle=2392,i,5522443951451440365,9112868901107225158,262144 --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:11
        5⤵
        Downloads MZ/PE file
        System Time Discovery
        
        PID:4636
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2440,i,7351361936713283205,10289440829230222610,524288 --field-trial-handle=2392,i,5522443951451440365,9112868901107225158,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:13
        5⤵
        
        PID:4508
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4448,i,480181502898426684,8045894930101813753,524288 --field-trial-handle=2392,i,5522443951451440365,9112868901107225158,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:14
        5⤵
        
        PID:5932
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4448,i,480181502898426684,8045894930101813753,524288 --field-trial-handle=2392,i,5522443951451440365,9112868901107225158,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:14
        5⤵
        
        PID:4812
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5136,i,6455859608413607428,3949873177677070813,2097152 --field-trial-handle=2392,i,5522443951451440365,9112868901107225158,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:1
        5⤵
        
        PID:5604
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=5148,i,8970379995952748651,8473445489846822021,2097152 --field-trial-handle=2392,i,5522443951451440365,9112868901107225158,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:1
        5⤵
        
        PID:4628
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5664,i,17640070894575022755,1215940832785992547,524288 --field-trial-handle=2392,i,5522443951451440365,9112868901107225158,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:14
        5⤵
        
        PID:1800
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5672,i,4868592975838594688,13358909017922515499,524288 --field-trial-handle=2392,i,5522443951451440365,9112868901107225158,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:14
        5⤵
        
        PID:5884
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=6180,i,3935076013020074573,7070988511785849020,2097152 --field-trial-handle=2392,i,5522443951451440365,9112868901107225158,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:1
        5⤵
        
        PID:4552
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5428,i,16492200926815225285,6495516801350490240,524288 --field-trial-handle=2392,i,5522443951451440365,9112868901107225158,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:14
        5⤵
        
        PID:716
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6412,i,1179845339861518490,12598133822094921705,2097152 --field-trial-handle=2392,i,5522443951451440365,9112868901107225158,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:1
        5⤵
        
        PID:3572
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5504,i,11262258562352131288,760051348160141756,524288 --field-trial-handle=2392,i,5522443951451440365,9112868901107225158,262144 --variations-seed-version --mojo-platform-channel-handle=7028 /prefetch:14
        5⤵
        
        PID:5764
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7140,i,5363161280166047109,14183687131225009248,524288 --field-trial-handle=2392,i,5522443951451440365,9112868901107225158,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:14
        5⤵
        
        PID:2324
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2680,i,16245650947816123706,10364924786294697041,524288 --field-trial-handle=2392,i,5522443951451440365,9112868901107225158,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:14
        5⤵
        
        PID:3300
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7024,i,3901065741001148043,15971252730779981475,524288 --field-trial-handle=2392,i,5522443951451440365,9112868901107225158,262144 --variations-seed-version --mojo-platform-channel-handle=6780 /prefetch:14
        5⤵
        
        PID:4948
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
        5⤵
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        
        PID:6912
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ff8900fc188,0x7ff8900fc194,0x7ff8900fc1a0
        6⤵
        
        PID:6940
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1732,i,14788919970199675376,14841690580244330043,262144 --field-trial-handle=2804,i,4988938124168100335,12705936764099481998,262144 --variations-seed-version --mojo-platform-channel-handle=2800 /prefetch:2
        6⤵
        
        PID:3532
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1772,i,13142036762688476721,4020826449132080798,524288 --field-trial-handle=2804,i,4988938124168100335,12705936764099481998,262144 --variations-seed-version --mojo-platform-channel-handle=2892 /prefetch:11
        6⤵
        System Time Discovery
        
        PID:3484
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2248,i,1970339496882907808,4423422099217308904,524288 --field-trial-handle=2804,i,4988938124168100335,12705936764099481998,262144 --variations-seed-version --mojo-platform-channel-handle=2988 /prefetch:13
        6⤵
        
        PID:4380
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4340,i,16591301219402178324,13779140918917872898,524288 --field-trial-handle=2804,i,4988938124168100335,12705936764099481998,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:14
        6⤵
        
        PID:6468
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4340,i,16591301219402178324,13779140918917872898,524288 --field-trial-handle=2804,i,4988938124168100335,12705936764099481998,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:14
        6⤵
        
        PID:6516
- C:\Users\Admin\AppData\Local\Temp\7zOCDB853FA\Xenite OG.exe
  "C:\Users\Admin\AppData\Local\Temp\7zOCDB853FA\Xenite OG.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.NETCore.App&framework_version=9.0.0&arch=x64&rid=win-x64&os=win10&gui=true
    3⤵
    PID:2008
- C:\Users\Admin\AppData\Local\Temp\7zOCDBCB48B\Xenite OG.exe
  "C:\Users\Admin\AppData\Local\Temp\7zOCDBCB48B\Xenite OG.exe"
  2⤵
  - Executes dropped EXE
  PID:2376

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4992

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4228

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2700

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4904

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:4204

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x0000000000000504 0x00000000000004EC
1⤵
PID:2012

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DevicesFlow -s DevicesFlowUserSvc
1⤵
PID:5932

C:\Windows\System32\ShellHost.exe
"C:\Windows\System32\ShellHost.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:6336

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5304

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5e34bc4625bf22507150f49d8c28444bda8222ea36c2a7d431bbdaae5c134a9d
MD5 e1ae04b3e73ad5ac4854b3b71e22d4d3
SHA1 221461b4f2d9e84e2f881b5a79edfef3705178db
SHA512 58529610d3f5dd7778bff3b81dd8abd9d79702eff78583d0294f3999089de0bbf84f0abad703269c0988835522b1d8d48e9f3c65472a409c5868fc3547c3fb1b
TLSH
T138D02B206A54494CCDC0B03464A3EA18E2004135140013C44001F07988901830B970CB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7f7f7efafb9f87082470af84df3b906033b9d533fb7a188458a4e181362f2170
MD5 8af1f60999c332d8cf9a392cd968a81c
SHA1 93834a1f070ff24041a0deb17d95d868998c98ba
SHA512 95d5c6b0fed3c3dce459178eafa2e9fa13b06caf50a5b294d66ecf16bf91357eccebec57e01d50e054232862c252fc80f7300e865318ec24078f9288a88c63d4
TLSH
T17BD02B206A444A4CCDC0B03064A2EA18E2104135680013C44001B06988901830B970DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 68e33ac4aa2e456ecadc75bb30e4f5fa8ad522042b96390251c948e0c4192090
MD5 e97e97ee93418b9f46e1448fb6a55b7b
SHA1 85bc3b81dd4370b2cd4db1bc6917264763ad3540
SHA512 beacc162d51f58184667637847b08a64cb0cf6ece5c6d0603a03bb429aad1b4236278a8f5022cebcdfd5d53979af5bca87ecc0402b494b862a857fe83e2342c0
TLSH
T194D02370BD79A7E1DE1C51388410DE14623643773AD767C69151680E89B004557D7DEB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9afc2bdbfb9972f868cc29c5854332c41d900b0f4aa2298f96310f5ed7136c16
MD5 4bfefe9cd0ca8ac81a9162cee9771433
SHA1 2772c4436ca9a4a1673fc3a79536f93b625f618b
SHA512 b4f712267ee1e3953886ecb5bf8e802c33a9ea094b561dff5886835aeb9f54f9f8e35621a60ac4f9c76d8cc61c5758dc066ba9a77f36b886d9d36344a6db2562
TLSH
T198D0A770AA5597A0CA0991349811FA25A673427434D79BA29051644E55A405893DB49A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cb4de712b84da50b4fb370b5cc72bf219fa8acf1c6e74e1ede2210b183822148
MD5 73a17e819f8fb0128a46865b4e115f07
SHA1 e9ede7c40ab0acc8957e812bcc0e827bc4755916
SHA512 876e1347c997115bf252639340541156d64fa4a92cf9f538ab7851b5233e3f53ee5fbdce099ede138a570d28f8a416b8c32b5fdbe511345d160f7199d3d3f2c6
TLSH
T110D09770AA0483A0CA0880349800FA20A223423430D79BA28011640E05A001893DA0C6
MD5 SHA1 SHA512 TLSH

Submit Download

433a6788-de4a-4fe9-bfcf-dbe9cc98368b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\433a6788-de4a-4fe9-bfcf-dbe9cc98368b.tmp
Size 414B
SHA256 605ea42b2a8a69237e30282d5e3b2dd67e421b603cb9777eea42276b45f41a35
MD5 c600b0f8645780cb4a8cb8bca5bbf3ee
SHA1 930836276ea3f79ffa1d69e0bd160592c8ea41f2
SHA512 5a04c05882910aeebdd0268a275bb3f4c0d964d871e5bf7b615f0f01e677793116f32e8d1b09b5e62b726f3d5b7d45c7a0e95c25fcc10b27c3bd42856eb0a25d
TLSH
T109E022AAC832EC770AFE9B5920454249EB5023272A50865F3A3D921D8FB462B02E6C5C
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 75bf6f8072a0d1336e44a0bf22d277b12fda628f4b11fc12d7f8a3f0a151acae
MD5 57dd8d9c74ac2572713c4e8fd11cb6a7
SHA1 018272b2061d488d8fc75e54d624da41de08952d
SHA512 545c9c6e7ea97e1a69f5edbe031a6d2d315108b79433622bece8dbecea28f3a00e409676da6691960c929806e568bde48271527865eaca43e5e8b6ebee1c9243
TLSH
T1C96150525372C6B2EB2AC4BAD0D69A4732F8B8C902072F300D009DB46C26F24F4EC297
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 abb2cdeb666069287d731c55c9ed86250454acc3fd042b89c926ca6b5370b0fd
MD5 0b09a3fbb87b2912fc008ca322f28e27
SHA1 93bb7594d3a9a78a6ea5c6d5de1bf57585d4862c
SHA512 5d0565083b55708e8d68fa89c2e193b46d6e2123868e0e9df594b5384c91202900a9e1c032c06293cf4b98bdb76b65404ab0a075191469b2ad48660d73dde120
TLSH
T10D5160124332CAF2EB6AC4BAD0E2594633F8B4D946072F314D005EB46D66F64F5EC267
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a63eb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a63eb.TMP
Size 2KB
SHA256 4be712b3c2ab2c25b242eab4a0072fef4150fbdaaad60c359b8ea805b7f98588
MD5 e135b3906a7177301ef0d0ed8db424d3
SHA1 34e631d2d06f0d62110134c789dc62568afebb98
SHA512 5d9d6041d88611ff2ad1ee03e5169ad6f027a570851bf17b09af4c98e55c5d2c49691a109dc238bd33d68e15e6c6e92d91a63bdacc92a61b9ba16414c966dd8e
TLSH
T15F511D234332C9F1D769C8BAE0E25A4B32F8B8D946076E314C005EB06D26F25F5EC263
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 a0685f5ebc7efe7f80dd8503aca0ba3cac2d4885541c3b6e7018e305e423f7d1
MD5 c85696f8ea920b25c6a4f7bdb0542111
SHA1 0e16d5820d1b8e8a1ae292cd0c6a683d8f53cc89
SHA512 21387b275882b44881d6742281331f19272c05bfd708c8248f3e087656cf4a1c242fff06a3003cd7b7d067f0b1ada7992fa8b30e9f31eee02cccbc0350ec3579
SSDEEP 3:MsEllllkEthXllkl2zE/lnoTKX:/M/xT02zEoTK
TLSH
T12C4404047FC00417DD011130C0D1C3515374D4114713575334510573DCC775C4D04100
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 399B
SHA256 55f8fa21c3f0d42c973aedf538f1ade32563ae4a1e7107c939ab82b4a4d7859a
MD5 a15ac2782bb6b4407d11979316f678fd
SHA1 b64eaf0810e180d99b83bba8e366b2e3416c5881
SHA512 370b43c7e434c6cc9328d266c1c9db327621e2c95ad13d953c4d63457a141fbf2be0b35072de96becc29048224d3646535a149229fc2ba367c7903d3e3e79bdb
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 1a68290d827ff009a00743eb085a30ad60a18ca1f1c87f1b2ac83ade13a49c0e
MD5 8f177aa91cf6db3611b57bf366441f71
SHA1 68c02fa8f49eaa8c667d67faaa86114f32424690
SHA512 d278c4d700c0dfe73d65ffbbc5c622107b560e5bcfa71991c687b83e39426f4256149d7a08b2c3838f8703019548331de3744883bc82e7da31a74298d9b81285
TLSH
T11BE0269884D9C23DB914A897827E630C86E0380BEEC87D96174A8C407202341A2AB6E8
MD5 SHA1 SHA512 TLSH

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.108.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

computed_hashes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json
Size 429B
SHA256 b829b0df7e3f2391bfba70090eb4ce2ba6a978ccd665eebf1073849bdd4b8fb9
MD5 5d1d9020ccefd76ca661902e0c229087
SHA1 dcf2aa4a1c626ec7ffd9abd284d29b269d78fcb6
SHA512 5f6e72720e64a7ac19f191f0179992745d5136d41dcdc13c5c3c2e35a71eb227570bd47c7b376658ef670b75929abeebd8ef470d1e24b595a11d320ec1479e3c
TLSH
T10AE055170A1A50B79BB8DB90EE525CA2E8A0A6B1C50438D63E608234B68A11F738347D
MD5 SHA1 SHA512 TLSH

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\verified_contents.json
Size 1KB
SHA256 d23b2ba94ba22bbb681e6362ae5870acd8a3280fa9e7241b86a9e12982968947
MD5 738e757b92939b24cdbbd0efc2601315
SHA1 77058cbafa625aafbea867052136c11ad3332143
SHA512 dca3e12dd5a9f1802db6d11b009fce2b787e79b9f730094367c9f26d1d87af1ea072ff5b10888648fb1231dd83475cf45594bb0c9915b655ee363a3127a5ffc2
TLSH
T12B317466C8683D56267A63348E2D0602EB57C2BB0050640EB5AC558D4F7115FE242FAF
MD5 SHA1 SHA512 TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 20KB
SHA256 e34677db41a2894de2049098b1794efc26153d915b314b74b175dd01b4884e2c
MD5 d4c6e2e1ac8efd10e82b90ff78e5b8be
SHA1 25279b9af33ed814a3528f06efa16721550e3f98
SHA512 d6149773cbbf7b43a30803e0aeaf79481322309daa48c5d8db4968a97f6b431fec5ee9e05556afb6d5b33c6ae150af03cbd53e9014584f1b3bb0a4c8ecdb0db2
SSDEEP 96:6BCxD3vWRiIOLXqItzIKFWR84LXq6VuXl87A307BPT+QFvWRFIOLXqRIK0hWRk4P:waDOr1j7A307Bbx0XMh
TLSH
T1DC928307EF707803DF201A77336A9434D67B911AAF8BDEC43C654410C8B3A96A0723AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 224KB
SHA256 55bd455635661a007bcf6cd5f65f3a928606867d73d0c9592e4bdfc19466e2d5
MD5 63de4f9467a6c067b77cd3d2a9fee8a5
SHA1 1fbfc389e57a633967b5c58384d0c6c69c7cee3c
SHA512 b3a182b2bda0490268c622ef76347b2fc63119ad147b7bf8f3b40c83ed019ff84267167107386073c2c20c4e4a584967ace309103ce7544926f5c3edd767a46e
SSDEEP 192:qwS2n0H+bF+UI3iWGVoWN3qL/ttkVVV63:qwj0IkUI3ijVoWN3qL/ttkA
TLSH
T11F24364F9F702612CD78913659EB44A39DAEF03BC743A6DA6C611470CEF3A52A01C5AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 c519e2bc16882c2aa6326bb174384d786e9be98d3a67768c3c839feff924c698
MD5 79ca0391f4b5307ac4c1f0657315cda5
SHA1 97cfed9fd5c39154ef0f060662f36096932cf25f
SHA512 761630258716b30d9bf38a104db6548c43263a9d5a3d5d69dd9e6e411a02cf1b3590b5ac10ec2f6aed692ceefc4eb27a7afa0bb649fb9ba76d8623018fece081
TLSH
T18DE0D8A0C4DDC12D6604604B62197B0CC7E03D0BEE896AC51B05B940BA42204E3816E9
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 a67e969c2d7527535ab937754b66c305f5389926658e9b43e9f8f96770f198cd
MD5 becb32d8df8a488490417e2abf6b5372
SHA1 68bc3f53b99ba6396a4bc3cf22673b8ec5661f39
SHA512 79559fecf7c2911842bb37f6f37de269047831a14d81da09c31e9664f72d33c1182476ec9b5b68b26373336f64915d83481670acb65801351fa914e9d4269475
TLSH
T11171AEF787F4856E890196F0AA18AE1FDE2D0615431C3C6A89E4EE27D3E3472E14265F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 c663358593416ad87b6163ffe2afab0fb6809424137a4cd531cc44405f64f1d5
MD5 1345e0069738ef9fbd15f05f6d1a2e81
SHA1 8f341d2baea1d8104e8e9db2ecad60600fe46abf
SHA512 a4e211d3f92d981a37e2a4a0556a80e94e5911e327fa5d7f2942ca4942d91b159a41a4cc737e27f628e0c5e3e56350f32e69ff91c56c1d4ad5f57ecfd81258be
TLSH
T14781CFF787F4856EC90196F0A618AE1FDE2D0615431C7C6A89D4EE27D3E3472E10265F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 97e26a33c19f94c28ca1766972e6e7c954c899c11367a0b0525910c5fb54795b
MD5 50703a482b9be2f976b9259ba020886f
SHA1 5a4ff63405336ebd1439f1ea662e531fa40cedf2
SHA512 4511352a94bf4c2484f8eb3149f6506f9f2dcc4c7a1721241e0d145a4f67bd90d2998122d4f8fef5efd2091ddb372fd5939eaa0970b9d6c811aa7590e2f08ab2
TLSH
T1D7117BA3C77FF45E2029486F0E09BC156E75E430126298F9EB97863CB0414F31B11067
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 99d6e86c71c849380082353f4a4ad68b522f7facfcb44f9a07fdab6e79390dbd
MD5 e7f3c1744519c3953972f7b7b8fd19ec
SHA1 c4342697c9c46d23b568d56d4386fc63ee7cf45b
SHA512 f017ad4ffd7814eaa91108910fcbb48cd8dd7f06525ac8ba98fb1a39eb37535bb86bc7899367d2fc5f0358aab5e9ce2ae7317db4d7694c53d7b82062b1b0310e
SSDEEP 192:sxRkkRhTm/fMms+WrZxSwzoD8p9l/g6+WNZgf/AW3Ci+GUIgDZBZC+J:sxRPPm/fRs+WFRz/5i/FyH
TLSH
T19842C816AE28693B8CCBE21DFB55BF63D2F95032A1945F54A7FC8A0C04E76DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 3fffc0ca270e5935bcfc3cd5479f8507d0f9978ef77c79cd79780961efcb4190
MD5 a11aff9fc1bbee0275ddc0791acd303c
SHA1 0314a541fae2725a7e11ec92f254e8087fc23531
SHA512 70d3ca096c8a7dccdf144abad56addc16d2e9bd2d4ebe62c81edfae18d6a8d5db259d27b8b112c5afcc19e0c143f771e44448900e10101b409ad04b47a6e99f9
SSDEEP 192:sxRkkRBTm/fMmsaWpV+WrZxuwzoD8pLl/g6+WNpggf/AW3QixgUIgDZBZC+J:sxRPXm/fRsaWv+WF9Z/5B/jLH
TLSH
T1E352B716AD28A93B8CCBE21DFB55BF63D2F91032A1945F54A7FC8A1C04E76DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 b3bea83c0d4ca19c3b949eedd46ada853d3dec2ac29cade2c01eeb5c6b80eb33
MD5 206db50f9c2d13fbbfda307811ef4166
SHA1 a89361449c768ef184cf46162f96d42eab0934d6
SHA512 94f82ee268a2fbfbb1a516dbfef36e45a30ab5623d8c4c97bf2435e9f2f54f97845d1b2ef3480854d18c108dc3d87c1950cc45878a0532b822b5740fb723cd1b
SSDEEP 192:sxR/kRhCm/fMmsdfrZxSwzoD8p9l/g6+WNZgf/AW3rLi+GUIgVBZC+J:sxRcOm/fRsdfFRz/5i/5WyH
TLSH
T11E42C8166E28A93B8CC7E21DFB55BF53D2F95132A1945F44E7FC8A1C04E66DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 071f07f9601861425993bffccb3b38af6f545cc5f57f8d92c9a0eb59d0a2c924
MD5 e2632af34fd6fa595aa6bbf59847f2d1
SHA1 52911e502db718277ae4b216cef6751368eed510
SHA512 090029e941184b6791d395676ba9f667513ef4e3d9723921a26b3cac2030887dccd5ffccd0f7de9aecae073789ba12803eb8a3e36e18b629688689c0128b7af7
SSDEEP 192:sxRkkRB5m/fMms9fWpV8qrZxwhxu0wzoD8pLX/g6+WNpgcsfAHf2PiVGUIgDZBZl:sxRPdm/fRsVWv8qFavub/5KfK1H
TLSH
T14F52C816AD28593B8CCBE25DFA55BF23D6FA1032A1D05E54E7FC9A1C00E76DD620740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 fa4a255dddbf1b16334ea8ba0ea3dec1409a9836b157a022fb571055d618aa85
MD5 9059ee20aa627bd7b9c4d8bd179b8901
SHA1 02f62eae8b09fb9cf68a25c8059a94f94b895893
SHA512 1847c475703b1ff8a089c664d9fca2a95ed6360f2b64357643ed6e45e0639ed4caac782ea5e56dfa716ead199d7271783626ba654d5b19530ab4add8d4d07a58
SSDEEP 192:sxRkkRr5m/fMmsgWpV8qrZxwhxucbwzoD8pLX/g6+WN4KdidAHf2ji+GUIgDZBZr:sxRPjm/fRsgWv8qFavwb/5qduynt3
TLSH
T11B62B716AD28593B8CCBE25DFA557F23D2FE103261905F54ABFC9A1C04E76DD620740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 232cfc793d23ba4846fcc330c1f684e7f1d6a60f923188efb987efb01e36ac17
MD5 42689dffa7bd110973b4f157be3d9583
SHA1 ba7cc5cf83c3528c05f3d424da5e880fdc208439
SHA512 658152e622aaeda08712c9dd2ede61b796b2fd33a4a5aad48b6662220d07a633a0e59e79fca209532099049aaad06016b5a648f680661a6f98c789f79a80e5d8
SSDEEP 192:sxRkkRr5m/fMms9fWpV8qrZxwhxucbwzoD8pLX/g6+WN4KdidAHf2jipgUIgDZBF:sxRPjm/fRsVWv8qFavwb/5qdujnt3
TLSH
T13B62B716AD28593B8CCBE25DFB557F23D2FE103261905E54ABFC9A1C04E76DD620740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 f9ebb66be739b03999b7e76a845744ee697c567aede9169b01e28600a2649911
MD5 fa90875fb0c8f46cde33ff66198e4a80
SHA1 584762140ae02b727ebb14a7fa15a29491be6390
SHA512 e5c4416016fd8882447a22a670729ee67dfd7cc1cdc33cafde32c32bdf7b732095f8641ac32f4e02fce994c5bfb7df0a9a2010751cd2bfdbc4edaccecb34b001
SSDEEP 192:sxRkkRhCm/fMms+frZxSwzoD8p9l/g6+WNZgf/AW3rLi+GUIgDLBZC+J:sxRPOm/fRs+fFRz/5i/5Wy5
TLSH
T19942C816AE28A93B8CCBE21DFB55BF53D2F95032A1945F44A7FC9A1C04E66DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 7c9d4f1153ee424ea161c5bffaed0ce6754c97dcdaf90ae495d51caeb9a2af32
MD5 8b5ed946eabe6ca13bba62a8692142d4
SHA1 4dcba6de3a44124412774cc4b034760da3e0d005
SHA512 ca867f512693308e8173388780a0105911a17e4a840db0dfc3c25f54595b1aed5eb71178890530d9a893972b98138c1648a658a584d3a0bedfa445739c2b9c40
SSDEEP 768:GTEbVs7pLuLf3kWg0CfKs8F1+UoAYDCx9Tuqh0VfUC9xbog/OVKagMWczroEmiA:GTEbVQEf3kWg0CfKsu1jaNagFcAEpA
TLSH
T1FED2DA7B640DCB7E4F804ADDEC19BE9B6D6802CB9698CD4047FE941C02C6BFA511A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 e7db041bf1f853d3dbd3b0cbede919ae1a9bb91f8d6a8a15f2e18138bdd0a7c0
MD5 52dc607e0e8b5f498a0739f2d1755099
SHA1 21cfccc3f3c14b106bda1826f3fb0835bd048330
SHA512 2119dad74619e367056e4a35a315a1d69ed886ecfbee57fe76f6e95b35c305c37d40aa5f772fd3a0594b757b9b2a57295ebe06b890d11dfa6e2bde49181c84a6
TLSH
T16CE026D045C8C17D715530830329A30883F5B44BEECA3D862FCDCA447243788B1975EA
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 5c15c1c4552b4d919296320aa82a8b140cff9e7fcc24d9042b9135d09fae65a9
MD5 92c30bc3595c86f1e068cf8d514cd9f7
SHA1 aa1011b71f6b305e3fd265429a2b8fb2f52f545c
SHA512 9c5669fcb1e9d986401055098337439b980bb0d6b1a54750996daa0404ed2d61f59d5350d4ab9d376531304046e4e2ebeb8fa58428bafcc320d137d5a6df4ad2
TLSH
T1BBB01286FB40512AC5DA4C770FD05F806710E852111044038824CF10CD16BA4AE518D8
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 6833127042ed97d2e63174acf3894f52bfd022604135bf3478dea752af288991
MD5 7e869bd6ffd0c82829df8ae00616a135
SHA1 c2703143abc597e94c3072dc920acb4bb47a2e1c
SHA512 c1a01c9ac844353e12e78d9f7703290deec7be3fea09ec1f8e74f38159b8e40d64de20129787a2d3d7b4ba0f48be7cf01a26609507e02ced08b1f06c61ccbd88
TLSH
T1B5E0D8A095C9C77E768570879329F30885E2F44FEFCAA9952F39D984730724072435A5
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 574ce780c7d1525b1d2886e5391860a4d62127bda8c72babc940423261ababfc
MD5 854f8a10488bc12b55300ee1d2470a79
SHA1 1ab16de0b91c42c8ff67437a4ba70941f140d891
SHA512 a388b07daac10be760753563c95dac559058895df0b24cd5628f46ccf8699bc6161b2a945dddded050638adf59164d609617eb1fe753a97b9240e940d7f8c7da
TLSH
T115E080B089D5C63D755460838269E70C86F0B80BDFC67DD9570C4840F24224672655E4
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 d8cdf28f3d99184392e907d56fa93ff82a23211395e98e8596f4808c8198366f
MD5 463ec38ef9357ddd13389dce58668a31
SHA1 6747157c1d6e5a947c56cf5b84c34b214b36c42e
SHA512 c6b714e7c9f5b0e06bb98bec397697e12ba434391eb92a12625eb76fd8215d882a899a3c91e960fd0140e90753d81ec0bbf0e9b14122736708382adf7588a9cf
SSDEEP 96:KR1i7PF/DnWrw+gXnK4mgpnct1o7zsHYp8IamqwWuzjgwwK4lgSwcgwDyYdWB6KU:C1i7PF/DWrwfX9mgpct1o7zsHYp8Iam4
TLSH
T1BE918142307A2250397E690C91AAC91A968374E3351CE52B77B941A63F7BF078DFD8DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 16KB
SHA256 91d6bc4d5593ac2e69c48331488c2d2081a63fd1328057c1fc494653ece5546b
MD5 bc52fb16b8122011fa125669a210af4c
SHA1 dd68443fcdb8cd16cfb73261291a158dda2f9965
SHA512 badd4bea2f30adf0248c74fc5bda99ade6afd6f0b78bffbd6d9e1aa85d168f1addbfd946f2f0d9be5f1564c1bcbb32d81aacd86d9a1e5bfa93a7264802f27470
SSDEEP 192:SQoxIIIRbhMIMr9EYcYeSOYCAskl9wuusZ7NoaRIl:SQoxIIIRbhMIMREBDY7suQs0l
TLSH
T1CD72C75AA3A21B77C16E5F3A037AD280D2E55C020963929C35917C0E9DF3A9BC5D1FF2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 7ddd137eff0ac8df23603cd0b60a4c43fb52a9a61046a0ee4240677625ec11ea
MD5 bef06fd43ae5de5e4451d04d8417488a
SHA1 9005190eb94f6a3064ca5fe64535e51246c0085a
SHA512 18d80eaa3d1719ed25dcaddad1cb048cdb7a127bda4dcd5a6c566eb43333d584540b0a5597134f324aeb91d89c48112f9b3967a704be5a7662ad2f0ba01f4244
TLSH
T152E02694F8C8C17EB924209B3129530882C03E4BEF88AECE2F12C844B302280F2875A9
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 9b6356a594ca2694058ba2d889612cd5d4229f8948e4be78658bc887fcd42e79
MD5 d28cedc895ae5622412dac847826f08e
SHA1 50f2413bd6650fa482a8331c1b575599d777aec5
SHA512 947f99dc075332c3f1f3eb7a8c1d3d019e6f3653b184c1ea3f31d20a1b67717967f7246ebee768c34a0c6138280bb95987dcc4e0d476f6bf2c912eb87510a0d2
TLSH
T1E621D655F330D109E149827EA47F9B291738D816CFBCEC0F547920756E72B440E4B6E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 4c169e11d171c7b05a35effb710aed65124687bae401ff3e4cad0d85ea5721f4
MD5 d528ae24ccb2f574648f2e37be5a26e7
SHA1 7e6290518740d1e11adf8a566723a3009f2b5ec1
SHA512 bb34c9ccace9f6daca81ec33b05df6391896df2f57f1643000f25e39692332f5d8318fba7bba495688328f5193111e93641fe9c3cc9b29d2675d2e77d948b60e
TLSH
T1AAE02054F4C8C17F652020973169A34882D13D47EF846F9D2F12CD447312281B247565
MD5 SHA1 SHA512 TLSH

Submit Download

86343cb1-7d71-4bd5-b3e6-4d42e2bf33db.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\86343cb1-7d71-4bd5-b3e6-4d42e2bf33db.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 48KB
SHA256 a7efe55f9119ad26f6daa83c67409be726f5bf3e2710a3dca6178a35541028e9
MD5 b8d1cd72670ca3c607c91195195f6770
SHA1 bf89407a665e013889b769372c32ef89c7c2131d
SHA512 9417cb371c344eb90d80d7c62bd604f61874c884ec270677a03510c717337fb3d56d7784cdb89c53d76206c16aaa903bd3e241ae24a9b5e63146b9aca402c9ac
SSDEEP 768:GFcq3SwgprgtfZOnfOidfO3vShCQR7ub/jh+ojKgqmUWhOGH:7q3TfQfpdfMvS38/N+fgRUW8GH
TLSH
T16E23D4F98CE3953AD8AE6387573C2E1699BCD133F1A85594F7881A0CCC625BFE306854
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 a3d927c8aa572d91070a06670d995339a646a75a401ab53f679d6541c074c1b2
MD5 7efc89642dd08ab4445283a955cac378
SHA1 5196e04a711b4818e7b46f50b7c709aa52becced
SHA512 0f7d35df31b4279723292ab759e765295105ff31563c43caf522bae4d2625243f25a02179dc644359d22e2e38fc93571e18ac7100407ab0a2afd1181281be568
SSDEEP 768:PFCw3/wggrgtfZOnfOidfOgvShCQa98ojKgqmUWhOGC:Ew3TfQfpdfvvS48fgRUW8GC
TLSH
T17C1328F588E39576D9EE5787A73D2E02ADBDD023B5885990B7D84D0CCC821BFC30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 7cebfa0a83f5b33f385a821ccb28b3efb8a43a4a9aa2e7e5143e5101e1b4989e
MD5 ee6131d9cc0b782a30b07c343cf2d551
SHA1 0d6bde74031ba3ebf4f6b44388540d4171724e93
SHA512 b5ea2fb87f40cce32767032382882bb1f2f0b22c97ce8c0f7e9a0fb5fac5a0fc06961bd2f348d7426db25fad56048d2b7fc26d825ec83c0e366a47dca1ae4a0e
SSDEEP 768:vv317c+wfZOnfOidfOAvShCQRuojKgqmUWhOGH:vv3nwfQfpdf7vSifgRUW8GH
TLSH
T123F2CF70D8756A738DF6A788B7467B03BEE16033D5C85B54DAED9E0C018369E131B83A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 c486048fe4c52ee2f9a91b5c7ff166ea2dca05cd7195581e3f6a9c762bf96aa6
MD5 1aad31d498758a21eb3094469cb44e96
SHA1 bdeab7322a59c75357ef4371c64bb2e084226133
SHA512 669fc75120201b44e3ec2d3b42cf876fea1222eea5e9b7bd4c86f978e6dab71beb286595e92a9b7a2baeba1c7443e1f0428c4e78601f236e17688daa5d533df1
SSDEEP 768:PFHq3/wggrgtfZOnfOidfOgvShCQa98ojKgqmUWhOGC:Bq3TfQfpdfvvS48fgRUW8GC
TLSH
T1051328F588E79676D9EE5787A73D2E02ADBDD023B5885990B7D84D0CCC821BFC30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 70080615664e0d6a1217c7a2a28c41eae2277272ea25c9bacf1ec18b68509ede
MD5 031e1cd41c6e0b90c65a273143eaaf01
SHA1 dfe7619dd3a5ca97bfb1096a3ba8428d1e999694
SHA512 9048c14782ac09a14e4d314b839c085238d504d768b1ccad7635afddd8b6961f899646679c371d539c8cf5390f80223dad155c275e0583ac3bd107ff89d46cb4
SSDEEP 768:Pv3+7c+wfZOnfOidfOAvShCQRuojKgqmUWhOGH:Pv3swfQfpdf7vSifgRUW8GH
TLSH
T120F2CF70D8756A738DF6A788B7467B03BEE16033D5C85B54DAED9E0C018369E131B83A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 49KB
SHA256 5f8368f3991951e8174558f3afceb65f201bdfcd8d759082723046a38a947c23
MD5 379d54fa43cc412af19f94b25f2915b1
SHA1 c7b3d2a55d424b921f3b408c4434651c356b7ba8
SHA512 c83720b838158ac1e45030e6d1089720a73a107a792d38874fd8dbf67831d3b9fe4e99a3738402d7a57e7299a65ac60bb70052955b0f38a784edebf4b23f109b
SSDEEP 768:PF3c/wgSrgtfZOnfOidfOMvShCQaZg9zEIojKgqmUWhOGC:ZcxfQfpdfDvSC4EIfgRUW8GC
TLSH
T13C33E5F98CD3953AD89E6387673C2D1669BDC133F1A89594F7880A0CCC621BFE30A855
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 e9fe5757b4ced65779fbdcc86b01db9c603dec3404b81c06e107ec18ce7683e4
MD5 f3f2f0b698bd9926765513a70cb4e12d
SHA1 9ef67256479e7982a0eccba66adc1ca5ccfd4f8b
SHA512 f7d4a6f1fb3311f77b49707b6bded2ae5627e04d2069cf5fd07e527e0bd9559a90234c957b8df3feab7b9df45c591fde5bd7986cccca8d1973ca64e55b938b5c
SSDEEP 768:Rrv+4UNbd43tgkc+wfZOnfOiavShCQth2bwWV:RbsbO3t1wfQfpavSt0wO
TLSH
T1E303CF32E86899339DE692487646BB637EB86173C8C54784DADD4B0D028269F370BC67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 3dc756d117ae9eeba28be1a02e9cb2e4f75e992a47157f6b0f61b44e4a6f98e7
MD5 970ee536856edf24e172b4c9f4ce68fb
SHA1 97ea375f9e8fbd728166c6feca194cfb285e1807
SHA512 9cc934c1ca61e9676a3ce8ae325c638d90aa416a8f8444d24cbab8370d9617518e491999d40828a4c6a7df1352e8c16d5119a21ae8c34376a33344a299123bad
SSDEEP 768:Zrv+4UNbd43U7c+wfZOnfOidfOGvShCQRuojKgqmUWhOGW:ZbsbO3KwfQfpdfNvSifgRUW8GW
TLSH
T13B13C031E8786A738EF29688B6467B13BFB56063D5C50A94DADD4E0C02835DE231F867
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

campaign_history

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history
Size 20KB
SHA256 4e1e98858e3a096ca3c02edc393de9c9d81bc8e557d559825bea8c3451547f1f
MD5 959d19278de15fd5616f4abce21f7ffb
SHA1 5f038277e2ac11c71b17f5b60a01fa7dc7e0f7d5
SHA512 157676e0df132423a9425365cade88db6aa33d31aee36f8f9da2cdc2fd31dbf20fb45c3b8fefd01ee837ebab2227f5b7f4fd2457d6a79ae57d2e804cc39c130f
SSDEEP 12:TLJYJiEZXiDiIF8izX4fhhdWeci2oesJahvGFUxOUDaa1i3iscQQtyd9zcQAJmdZ:TL+j0afDdWec9sJVUOOw2Vjy
TLSH
T1D892DF2679351473ECDA477ABC5389E10EBC165EC9ABB8548ED40C620AB1BC2A2591FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 918889b413648c1d2fc9d0eef571f89f7083109033f5cadf5933f7c7c7fa919b
MD5 3ba4cce6e366a0a60f8cd4faa38a8745
SHA1 ae67c13e0cec167a33066d487a9cd63976f06c8d
SHA512 5e21384eb5dec72baef854f307cee5015c89d6f2e24c8750afa7d8be4199eea6b6dfd66e805be9bd92a471bd2fa580aabd2e2f67d4017b3ff1c3f3aad1ac1ffd
SSDEEP 3:MsEllllkEthXllkl2zEboTKX:/M/xT02zKoTK
TLSH
T1494404047FC00515DD011030C0D1C3514374D4134511575734510553FCC757C4D04100
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a12b804b-f28c-4a40-9da7-7b16a1b592a7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\a12b804b-f28c-4a40-9da7-7b16a1b592a7.tmp
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

3d520ed9-c358-4690-a62a-c19743675748.tmp

Path C:\Users\Admin\AppData\Local\Temp\3d520ed9-c358-4690-a62a-c19743675748.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

Xenite OG.exe

Path C:\Users\Admin\AppData\Local\Temp\7zOCDB6F1A9\Xenite OG.exe
Size 2.9MB
SHA256 26cb685db18ca8a4ec609cf137bb288d554678f68c2a13c5037bee9c9f9d9ee4
MD5 efff2e91e26a5c894ad1ef20349b1f16
SHA1 babe5432f5b11f4dd2808cc23f193537014be881
SHA512 92014adce8a0b7f8bb722381a248ffe3f392c5ae56ae5b1688bd1ccbf42ad99e1f67386150715daf3e7f9023be613be6871997b29667bbf700b8a3fe3284b96d
SSDEEP 49152:9KFOU1aDVwplohcWnw0mGQACEPMzNBG9t7t600QBwrNU/CAByLQQimN:9KIU1a7wN5MWNBGLE00QBwrNWrwMGN
TLSH
T139D5122DE6B04E53D6691D7AC0A3041297B1F6456B33E7CF37741BA22E133A49E723A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1692_2113992766\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b83cfeca-ea8a-4db3-b05a-c9a27af54cca.tmp

Path C:\Users\Admin\Downloads\b83cfeca-ea8a-4db3-b05a-c9a27af54cca.tmp
Size 15KB
SHA256 da9dc9884888fe7422964471e6f158d6796e57a0a937b4d86a111b2f437fabb4
MD5 e98828ccc7bbba65f2c6e98513ff55a9
SHA1 081262b420d05a549c3b98af210293c790500120
SHA512 97f4feef40afa21993822e857388c20ab9f1473ec5421aa8e1e23cde9331975c0b55c84e4020266755c270fbcde8ab659c8c440559e9298c4a95171a9ae2587b
SSDEEP 384:ILDULILL7EounBaU3VttkZB2hyHIUFfTFYq2Qd1bLYH/:pMX7EounBj3VwZTFPb0f
TLSH
T10F62F612B98995FBDBD20331CF2D393573A8823D0069C59B93586D4176E28438B7FB97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download