hxxps://www[.]mediafire[.]com/folder/7uv7v7nmw8xqu/XenoExecutor

Resubmissions

08/08/2026, 12:48

260808-p1w93axcma3

08/08/2026, 12:44

260808-pyg3csxbpb3

Analysis

user interaction
yes
max time kernel
181s
max time network
202s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/08/2026, 12:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.mediafire.com/folder/7uv7v7nmw8xqu/XenoExecutor
Sample260808-pyg3csxbpb

Score

3^/10

discovery ransomware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1228	msedge.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134306666845186791"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{4AB67F41-C6DB-49BA-B464-4B6209CAEC75}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings	OpenWith.exe

Opens file in notepad (likely ransom note) 2 IoCs

ransomware

pid	Process
5600	NOTEPAD.EXE
5240	NOTEPAD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4840	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5720	msedge.exe
5720	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4568	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe

Suspicious use of FindShellTrayWindow 53 IoCs

pid	Process
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe

Suspicious use of SetWindowsHookEx 33 IoCs

pid	Process
4840	EXCEL.EXE
4840	EXCEL.EXE
4840	EXCEL.EXE
4840	EXCEL.EXE
4840	EXCEL.EXE
4840	EXCEL.EXE
4840	EXCEL.EXE
4840	EXCEL.EXE
4840	EXCEL.EXE
4840	EXCEL.EXE
4840	EXCEL.EXE
4840	EXCEL.EXE
4840	EXCEL.EXE
4840	EXCEL.EXE
4568	OpenWith.exe
4568	OpenWith.exe
4568	OpenWith.exe
4568	OpenWith.exe
4568	OpenWith.exe
4568	OpenWith.exe
4568	OpenWith.exe
4568	OpenWith.exe
4568	OpenWith.exe
4568	OpenWith.exe
4568	OpenWith.exe
4568	OpenWith.exe
4568	OpenWith.exe
4568	OpenWith.exe
4568	OpenWith.exe
4568	OpenWith.exe
4568	OpenWith.exe
3744	OpenWith.exe
5548	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4480 wrote to memory of 4560	4480	msedge.exe	86
PID 4480 wrote to memory of 5376	4480	msedge.exe	88
PID 4480 wrote to memory of 1228	4480	msedge.exe	89
PID 4480 wrote to memory of 2120	4480	msedge.exe	90
PID 4480 wrote to memory of 5376	4480	msedge.exe	88
PID 4480 wrote to memory of 5048	4480	msedge.exe	91
PID 4480 wrote to memory of 5320	4480	msedge.exe	92
PID 4480 wrote to memory of 5376	4480	msedge.exe	88
PID 4480 wrote to memory of 2120	4480	msedge.exe	90
PID 4480 wrote to memory of 5048	4480	msedge.exe	91
PID 4480 wrote to memory of 5048	4480	msedge.exe	91
PID 4480 wrote to memory of 5320	4480	msedge.exe	92
PID 4480 wrote to memory of 5320	4480	msedge.exe	92
PID 4480 wrote to memory of 32	4480	msedge.exe	100
PID 4480 wrote to memory of 32	4480	msedge.exe	100
PID 4480 wrote to memory of 32	4480	msedge.exe	100
PID 4480 wrote to memory of 2092	4480	msedge.exe	102
PID 4480 wrote to memory of 2092	4480	msedge.exe	102
PID 4480 wrote to memory of 2092	4480	msedge.exe	102
PID 4480 wrote to memory of 2020	4480	msedge.exe	103
PID 4480 wrote to memory of 2020	4480	msedge.exe	103
PID 4480 wrote to memory of 2020	4480	msedge.exe	103
PID 4480 wrote to memory of 4296	4480	msedge.exe	107
PID 4480 wrote to memory of 4296	4480	msedge.exe	107
PID 4480 wrote to memory of 4296	4480	msedge.exe	107
PID 4480 wrote to memory of 5884	4480	msedge.exe	108
PID 4480 wrote to memory of 5884	4480	msedge.exe	108
PID 4480 wrote to memory of 5208	4480	msedge.exe	109
PID 4480 wrote to memory of 5208	4480	msedge.exe	109
PID 4480 wrote to memory of 5208	4480	msedge.exe	109
PID 4480 wrote to memory of 5140	4480	msedge.exe	110
PID 4480 wrote to memory of 5140	4480	msedge.exe	110
PID 4480 wrote to memory of 5140	4480	msedge.exe	110
PID 4480 wrote to memory of 3452	4480	msedge.exe	111
PID 4480 wrote to memory of 5096	4480	msedge.exe	112
PID 4480 wrote to memory of 5096	4480	msedge.exe	112
PID 4480 wrote to memory of 5096	4480	msedge.exe	112
PID 4480 wrote to memory of 5204	4480	msedge.exe	114
PID 4480 wrote to memory of 5296	4480	msedge.exe	113
PID 4480 wrote to memory of 5204	4480	msedge.exe	114
PID 4480 wrote to memory of 5296	4480	msedge.exe	113
PID 4480 wrote to memory of 2860	4480	msedge.exe	116
PID 4480 wrote to memory of 5520	4480	msedge.exe	120
PID 4480 wrote to memory of 4648	4480	msedge.exe	121
PID 4480 wrote to memory of 3636	4480	msedge.exe	122
PID 4480 wrote to memory of 1776	4480	msedge.exe	123
PID 4480 wrote to memory of 1776	4480	msedge.exe	123
PID 4480 wrote to memory of 1776	4480	msedge.exe	123
PID 4480 wrote to memory of 776	4480	msedge.exe	124
PID 4480 wrote to memory of 776	4480	msedge.exe	124
PID 4480 wrote to memory of 776	4480	msedge.exe	124
PID 4480 wrote to memory of 1720	4480	msedge.exe	125
PID 4480 wrote to memory of 1720	4480	msedge.exe	125
PID 4480 wrote to memory of 1720	4480	msedge.exe	125
PID 4480 wrote to memory of 5256	4480	msedge.exe	126
PID 4480 wrote to memory of 5256	4480	msedge.exe	126
PID 4480 wrote to memory of 5256	4480	msedge.exe	126
PID 4480 wrote to memory of 5952	4480	msedge.exe	128
PID 4480 wrote to memory of 1392	4480	msedge.exe	129
PID 4480 wrote to memory of 1392	4480	msedge.exe	129
PID 4480 wrote to memory of 1392	4480	msedge.exe	129
PID 4480 wrote to memory of 5952	4480	msedge.exe	128
PID 4480 wrote to memory of 5952	4480	msedge.exe	128
PID 4480 wrote to memory of 6072	4480	msedge.exe	132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.mediafire.com/folder/7uv7v7nmw8xqu/XenoExecutor
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffa8163c188,0x7ffa8163c194,0x7ffa8163c1a0
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1624,i,7273004312797560861,17352502410677025434,262144 --field-trial-handle=3804,i,6825792340041002644,1906260665546599910,262144 --variations-seed-version --mojo-platform-channel-handle=3776 /prefetch:2
  2⤵
  PID:5376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1976,i,1907859717890863250,3099610187751417267,524288 --field-trial-handle=3804,i,6825792340041002644,1906260665546599910,262144 --variations-seed-version --mojo-platform-channel-handle=4048 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2316,i,149375012709252496,13768974329485046021,524288 --field-trial-handle=3804,i,6825792340041002644,1906260665546599910,262144 --variations-seed-version --mojo-platform-channel-handle=4120 /prefetch:8
  2⤵
  PID:2120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3068,i,15698768515146257809,4141201977860400566,2097152 --field-trial-handle=3804,i,6825792340041002644,1906260665546599910,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:1
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3040,i,13725411026096379072,1643074014656118823,2097152 --field-trial-handle=3804,i,6825792340041002644,1906260665546599910,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:1
  2⤵
  PID:5320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5136,i,8979030927623013878,3276796095343130971,2097152 --field-trial-handle=3804,i,6825792340041002644,1906260665546599910,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:1
  2⤵
  PID:32
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4932,i,8917455386255195514,1519674229319220453,2097152 --field-trial-handle=3804,i,6825792340041002644,1906260665546599910,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:1
  2⤵
  PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5392,i,3415274000273598831,11334625468117511211,2097152 --field-trial-handle=3804,i,6825792340041002644,1906260665546599910,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:1
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4900,i,16627985456053311754,15506141180043639555,2097152 --field-trial-handle=3804,i,6825792340041002644,1906260665546599910,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:1
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5684,i,15324598040112500639,6604585567664684335,524288 --field-trial-handle=3804,i,6825792340041002644,1906260665546599910,262144 --variations-seed-version --mojo-platform-channel-handle=5740 /prefetch:8
  2⤵
  PID:5884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5764,i,6533081425220088875,17415493331792123967,2097152 --field-trial-handle=3804,i,6825792340041002644,1906260665546599910,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:5208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5640,i,15680742408794971538,3031250770058136156,2097152 --field-trial-handle=3804,i,6825792340041002644,1906260665546599910,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:5140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5324,i,4224296823900966005,10447545271748594684,524288 --field-trial-handle=3804,i,6825792340041002644,1906260665546599910,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:8
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5292,i,9059082003354896019,12646228366358681912,2097152 --field-trial-handle=3804,i,6825792340041002644,1906260665546599910,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:1
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6220,i,3612541057543277924,17774276348496290606,524288 --field-trial-handle=3804,i,6825792340041002644,1906260665546599910,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:8
  2⤵
  PID:5296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5696,i,18362374163097438615,13548431036574835771,524288 --field-trial-handle=3804,i,6825792340041002644,1906260665546599910,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:8
  2⤵
  PID:5204
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6864,i,5354163681230967658,10748510951557610582,524288 --field-trial-handle=3804,i,6825792340041002644,1906260665546599910,262144 --variations-seed-version --mojo-platform-channel-handle=6884 /prefetch:8
  2⤵
  PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6864,i,5354163681230967658,10748510951557610582,524288 --field-trial-handle=3804,i,6825792340041002644,1906260665546599910,262144 --variations-seed-version --mojo-platform-channel-handle=6884 /prefetch:8
  2⤵
  PID:2860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5600,i,1558898941858439,6363344022352514315,524288 --field-trial-handle=3804,i,6825792340041002644,1906260665546599910,262144 --variations-seed-version --mojo-platform-channel-handle=6932 /prefetch:8
  2⤵
  PID:5520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5528,i,7450736119730705049,2275021309922381581,524288 --field-trial-handle=3804,i,6825792340041002644,1906260665546599910,262144 --variations-seed-version --mojo-platform-channel-handle=7164 /prefetch:8
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5212,i,16456873458980754182,985690929043907955,524288 --field-trial-handle=3804,i,6825792340041002644,1906260665546599910,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:8
  2⤵
  PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7180,i,12035833415983539340,922150811312128775,2097152 --field-trial-handle=3804,i,6825792340041002644,1906260665546599910,262144 --variations-seed-version --mojo-platform-channel-handle=7224 /prefetch:1
  2⤵
  PID:1776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7376,i,13723138372590699356,6385041371511704613,2097152 --field-trial-handle=3804,i,6825792340041002644,1906260665546599910,262144 --variations-seed-version --mojo-platform-channel-handle=7372 /prefetch:1
  2⤵
  PID:776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7524,i,5063796266654964357,7914348608309694959,2097152 --field-trial-handle=3804,i,6825792340041002644,1906260665546599910,262144 --variations-seed-version --mojo-platform-channel-handle=7536 /prefetch:1
  2⤵
  PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7580,i,8065820115995581109,14205573204934288623,2097152 --field-trial-handle=3804,i,6825792340041002644,1906260665546599910,262144 --variations-seed-version --mojo-platform-channel-handle=7696 /prefetch:1
  2⤵
  PID:5256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7824,i,10470778911963044582,13736319436804176857,2097152 --field-trial-handle=3804,i,6825792340041002644,1906260665546599910,262144 --variations-seed-version --mojo-platform-channel-handle=7816 /prefetch:1
  2⤵
  PID:5952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7892,i,11845945541276814824,7507229433310926883,2097152 --field-trial-handle=3804,i,6825792340041002644,1906260665546599910,262144 --variations-seed-version --mojo-platform-channel-handle=7868 /prefetch:1
  2⤵
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5712,i,10764065952942527607,3859498233249546339,524288 --field-trial-handle=3804,i,6825792340041002644,1906260665546599910,262144 --variations-seed-version --mojo-platform-channel-handle=6864 /prefetch:8
  2⤵
  PID:6072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7160,i,267613713701341805,378397217599197042,262144 --field-trial-handle=3804,i,6825792340041002644,1906260665546599910,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7004,i,11005693682232076553,11163057924930413077,524288 --field-trial-handle=3804,i,6825792340041002644,1906260665546599910,262144 --variations-seed-version --mojo-platform-channel-handle=6600 /prefetch:8
  2⤵
  PID:5352

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4808

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2696

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1264

C:\Users\Admin\Downloads\Xen\Xen\Xen.exe
"C:\Users\Admin\Downloads\Xen\Xen\Xen.exe"
1⤵
PID:1128

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\Downloads\Xen\Xen\modules\patches\review_table_170.csv"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4840

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4568
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Xen\Xen\modules\patches\Tips.md
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:5240

C:\Users\Admin\Downloads\Xen\Xen\Xen.exe
"C:\Users\Admin\Downloads\Xen\Xen\Xen.exe"
1⤵
PID:2824

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3744

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5548
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Xen\Xen\Dependencies.manifest
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:5600

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1c8e3dda413deb0056300d64212636a6785cc542fbbae4383b4383d4cf0ebbc4
MD5 fb1e85b1485d88ba9cec2cd1f023e621
SHA1 aa0fc9167f42bc9470e917c18515afaaad960620
SHA512 94193e242c6de1dd160dfed5c111ba549c783ae9bd7ef959f60c690664d2f3279ec6a50445fb7fe4b959e2c95eeb27fa56c5920a84e5d00761487e4265cb997b
TLSH
T1CAD0A7B61A1EB490F27D0A32A011C700776D16E32D52A305F32C880CDDBD0D526C66C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 af3eed9ee69ce0d007bc21bfc930d08c4309e0aa6e76e5a69d346f6ae7b6ac6f
MD5 5a66d79582da7072e0076ddc794f6058
SHA1 830419051685ad820dfcd7d253763b5ccc992e0f
SHA512 b0ee8e764b19a6698b7361bcb68b82d9a81314013d36368718f3db24c20917155e5f29fa62f5be141adf3e6ce741cd8ef0a3251c7485f8b6b5199ce3ece92396
TLSH
T114E02B75CC21EC3708FD0758A0194656E74013172A80895F3B7D92098FB462A86D585C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 389a02775e39b9b66222619638c36a96ef2d929cf5a57831f1999ca76da42c55
MD5 117aedcc85b4b24c6313206422970971
SHA1 5e4ef5ec49e8736d1b82f390d583f235fb6e3a6b
SHA512 bd3cb4120736e3d0ed75cb4652fff84b20e32e4035f8581aa2f5b8c7fbbe88ac0b6d6a7fe2f7d712531a82d966991d61a8cce01d987942d40084f909f18f7464
SSDEEP 96:I3hkJxXf8dpjlIT897FSFnwd/ctlWFr8e2g9qT:cqJBEdOWFSFncc/JefqT
TLSH
T15F916EB5E4D00A09F705227AD5D02AA83C39C8DAF9573EDD4B14EE31E8C2BACC12A184
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe594bd4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe594bd4.TMP
Size 2KB
SHA256 68c1e792d239bcc493f8b1e37669be876dc9c5e9e855b27aa62c28bbcf76aa68
MD5 99917ef45460ad91887d62934aa84064
SHA1 046eb5f8fab870c228beadd81c5de4bf26ad14dd
SHA512 d8c8741ee1163d31641d0523f3c4b24e4581f3b5c8f00b96c784ed5b4dcf1285cdf6c2c9592126965eab879c244a0a79ae8ef82ae17103b4c5979c4a8155d3bf
TLSH
T1A151EAB9F9C1099DF316223F61E07618BD29CCE8FD9A0DE11E505138E9D3B64C5769C8
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 26KB
SHA256 c00aedc56ca75befbe84a534937cd34b0f693092ee587b9a193436ddce96e124
MD5 e6786552fa973814ff98a052fe67a2ee
SHA1 7112ee36fe7162d01a1e5c0de05f02148b9b140c
SHA512 e18e60915f82daf92fd456298ed5d60102ff1c1cad125eba8d7423301de307d138a269c6293fbd441983fe9dbb4efa030565116d96d8d508ec324a2133281f60
SSDEEP 384:D1PeD2MosmN9ZHCBeoqRhYF8ep1VJzGpecJeyDeYBex81FJa2aaiGXBhY+c+9G+z:MOTNVwPqvqkrIDDQaWn3
TLSH
T114C298F383E5D96E89115BF85A146E1BCF1D0719432C3C2689D5EE87E3E2432E16A60F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 26KB
SHA256 02dcd8e6b3654d06ef77b6b1aef06e6c179b6c0b0ffbe1758d373de02558ca1c
MD5 39dc376d2efe0c230960bb738682410e
SHA1 20d1ca5be93478e945bad75ce0807df776ffe0df
SHA512 768b4336719048a863843fc299c696f4b299c6cb349dc86068125888e858818304fe12cb1b706571923323b873420b29db2e09c635e07ed6d40914df799e13ba
SSDEEP 384:D1PeD2MosmN9ZHCBeoqRhYF9ep1VJzGpecJeyDeYBex81FJa2aaiGXBhY+c+9G+u:FOTNVwPqvDVrIYPca0nh
TLSH
T1A8C288F383E5D96E89115BF85A146E1BCF1D0719432C3C2689D5EE87E3E2432E16A60F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 17c3ca6bf4be59b9eba76575cc5d2997077a97d67d9ea0faa2d7bcd629b574d3
MD5 c0f4143b9ed8b117574cfbf91194b69b
SHA1 6dee55a7d1bcdf4385a580c754aed3ec43d452e9
SHA512 8ceef82c2c615d5205076ac099ff728de28428a48c2f0a262b9f601ac0b003c4273ee1b85503e2d31321a4c9ed1fefc4e598a63626f775969b18b9b68e87edd2
SSDEEP 192:sxZjRmyMqZjK1Ml8Mmm/fYsmDZdvzodpqEiHW6+WNm44/YvNN7mB+pIg56/J:sxZjfem/fYsmDzkcHb2/eCBs8B
TLSH
T16072F916AA349D77CDDBD219FA55BB53D6F8116392904E44AAFC9E0C04E7BEC220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 7c574d2243b57f45ffcab96ba6f732d7481d77b3ac55a59904333acbbdc8bedc
MD5 7cee8d8bb2026a8186d4c36783034a1c
SHA1 bbe2c414ab9d93b8e97aa30f98330cb76228b105
SHA512 50e58b0d59e4561fd2208e3a7961a27bd5f6c1375ab8233609caa05a706065058eb392c9fa5be988e467f7c18ebd61272cc4e20ed508f305a1aa9964d22a07c6
SSDEEP 192:sxZjRmyMqZjK1Ml8Mcvm/fYsmqaZdvzodpqEiHW6+WNm44/YvoC+B+pIg56/J:sxZjdkvm/fYsmqazkcHb2/tBs8B
TLSH
T15C62E716AA349D77CDDBD219FA45BF53D6F8156292904E44AAFC9E0C04E7BEC220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 eab7703db1b64ee817b94de0376517eda6b9d130dca9129e8d55064e8dc71864
MD5 6b2907b4cf577c697302d34341f42ae6
SHA1 b3491e7821713eb19f63f69dbc927ea0fb64b9a1
SHA512 648d508d2896de917e2ba82de79904e16aee2313dac5ba335dcf914a6cc3784a06fe418711539f34729b344da94403768a7de8c4fddb9035c11bb935417771b8
SSDEEP 192:sxZjRmyMqZjK1Ml8Mkm/fYssMqaZdvzodpuiHW6+WNm44/YvoC+B+pIgj/J:sxZjdMm/fYssMqazkFHb2/tBsjB
TLSH
T10B62E8166A349D77CDDBD219FA45BF53D6F8056392904E449AFC9A0C04E7BEC221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 8add802bd79891cb064a04ed211b8829d032db76d475de94587525750e0b114b
MD5 ea88a8dcca859cc426dce0a2ca6ddb1d
SHA1 0b0c2c72b8e924f123e84a0a2a13355ff420c2bb
SHA512 3070f673de46e4355c3227365eb54f52cafca4500708d4ef87025f8b163a0898f259e533523e020252091f8422b515ab8a06fd989b00035076c76afbd153440a
SSDEEP 192:sxZjRmyMqZjK1Ml8UQ+mm/fYsmDZdvzodpqEiHW6+WNm44/YvNN7jB+pIg56/J:sxZjfqhm/fYsmDzkcHb2/e3Bs8B
TLSH
T16572F916AA349D77CDDBD219F555BB53D6F80463A1904E44AAFC9E0C04E7BEC220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 69690d2198cc306427fbb8202494acb3e58ca790c539ab8396a31bbe3545a3a8
MD5 9166f7b9794665be027a1291532d1ec5
SHA1 48981e4fe99bb26e05e00212afb0383a9fc696cd
SHA512 1519e1ca6e5e68d98f9a18776fedd7dababef57a24ac9285707effaf4f10fe9913e2555e74f75ec093c5981b2a824ccf2c42231e4e98c2f38b6983b65a1cb30a
SSDEEP 768:ZYsv8Od/hWvFvQX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVA0LlEe9NsQro9RLG:eY8Od/hWvFvQXu1ja10Lm2Nu/S
TLSH
T1F8E20C3B284CCB7E4F840E9DEC26AFD66DD801CB66984D5447FA884C02C77EB521B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

87bb314ef09d4bc9_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\87bb314ef09d4bc9_0
Size 63KB
SHA256 e6efd3d0a981ec3636b091054b891e59a5c87a93cf660d1b3d2d7bb4916a0a3b
MD5 10e7c2cc0bed54895b9f3fcc2990d4e8
SHA1 e9a7d80fe522fd3cb1c5c1d0f001c221ff4891a8
SHA512 586e67e4084fb6cc598efa6fc253543c7ca58991c7c01b121e3f61f2082db54e5df652a9cc2ccbadacde503e01fb846e15a24d82b060033671c9f41d1b99bd67
SSDEEP 1536:q8k3vI6lZbRXxyqxn4Y473+KrYF03iRNjkv:q8k3vFpxh4Y473qW
TLSH
T195536BA6337178B3427BA1B1906F130B713EE5A7F40484F8A198EDF44E44AA60267F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 54b601b7b5b70b06d14913281443a49c0cf037e7496e912cc72b0ec0b935c05c
MD5 b7859f450ee25707a8b708210233ac4e
SHA1 6876572340cf383e08dabb637bfc3fe855128e31
SHA512 d6351fcc08eb3e8ae993456a78ff5b93ae2b923aa2c351df796cba9a57e8b43337536b32b59ae05633193a2a90a2a51926710e2f13fb007560789d69283ee9be
TLSH
T1A3A002D49AC53101C00A83719A8501506774599A03C22B49D0D1445AC8AD1468102641
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 28a40f48f8f2ebae3bc4bba988b2abb5c88711a16d9555dc57ee1853c4f061fa
MD5 8d5fea1c316b6a57db63781fa6fd6edb
SHA1 bb2036a76659dc079943e4d2eb769ddd3ede2e3f
SHA512 62fa41b528fe4e9dfb965619ef652bede8bfa3151c75ccd8c727c59131224513bfc042efc2fed39c76037ff5614e97d5ca50915b808cf6daea2884e001a2ca35
SSDEEP 96:Ko7iKcsW23iKoM7LKKc026WEKjKkAAK9Gq+xGKqkJ7yKkc++dmKWI94gK966GbG1:05ppxnY753RNBvRJJdt7p5J97rpXj
TLSH
T1AEB26C5A703E0211397E2988B39696364F4235A37058E4AF7FB814A14F67E225CFDCED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 7416e28fe96926ad76c0fc47d73f8d9898fc8b2f00a2c485144b180f0a5b4608
MD5 54cf9ce377ef50028743c02994eb7ed2
SHA1 9ef5c91301fad93c0b82a5e7f4054efee6804211
SHA512 7c81afe20a675b4161454b68ca1f922e44b42ca8fbc60f68608edfd73a7eb02d4a70226f4b19268461bf585360ac780034e5c322559a2031b316ae0c7594c7f0
SSDEEP 384:npkiF9CcmyWCs3sNG8TUNTUlIm2QckCr9liKpvBftGJXfhT9J84apye4KV8p0/HZ:p/Fccps3HwgbkUEkjGzT9J84FI8p0/Z
TLSH
T1BAB26D35EC68DABBEDE74F89B74A7A03EEE0526785DC59E4CAD85D0D00931DD030B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 bfade0aa1f3dd1296e2078ad5f00b100f582a92f7b23967171ccc62ac8f961de
MD5 aa96b8d861dea164f8ff698687a27d20
SHA1 5eab79f0e3a1766a3635abfa61edff13f06ceef7
SHA512 cc33d5452356c4fcc7fc1407b54ff3e09a39f1d42584f6a14d5cb19e2f3b24b28b2dcba88b789e8deb11417fa0246cd44cdcc93f873991a05ac9493599fb385e
SSDEEP 384:np8iF9CcmyWCs3sNc8TUNTUlI47QckCrjUe2pvBftGJXfhT9J8dL1GMXrty/7IgP:pnFccps3xwg6kneojGzT9J8rGMXS
TLSH
T13BB23A36EC68DAB7EDE74B99E74A3603DEE0426389CC9AE4DAD81D0C11D719D430B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 57761390744f7156913af9c15455abbc92e8987da2b03f32198b90d5979dbb52
MD5 7afb1130e33e2b064d1e4ecec95179bc
SHA1 bd7508c8dcd0a06296305c9259ae18222e02cb02
SHA512 0200e6219b91e676fa88320a214904945426070018300a455bc61db8e737a39b5b3dcff6f2154771a574436a43fb4f06c0edb01d72825b3c058072ad98ca8057
SSDEEP 768:iFbcpn3xwgGkBegjGzT9J8CGMnewBKZO6i:Ln3WgiKInevZ3i
TLSH
T18BD24A36DC68DEB7EDE65B99B75A3503EEE042A389CC5AE4DADC1D0C119719C030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 4ab55ed3a5d37ef96f243452ecaf74aa70aba4e247992ef548ae0fbe54063c6b
MD5 23912b5413d75c98d73bcc0647034f64
SHA1 8657925cd8c7c491f903e3069dfc11bc00012191
SHA512 f3222247108cabd15e1c071052ec5a69f315ca336b3c60d4679933860964fafc5561926ed991de22ba55a66180ab571b82a4c2695d8359866cb36ddcde6d22b7
SSDEEP 768:yFbcpD3xwgGkBegjGzT9J8rGMnewBKZO6i:7D3WgiKZnevZ3i
TLSH
T142D24A36D868DEB7EDE65B99B75A3503EEE042A389CC5AE4DADC1D0C11971DC030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 ca062cdc8c68103cb9a76bf1e393f22b680bbe0ff459f151c93d02e77952135b
MD5 9fccc990ab4f4abec1d157c875724750
SHA1 c62f5f5c1f68331b14c3071caa89ddf604f10d87
SHA512 8a69c03eb83fed11390f13d65ef3ae9ad3287b67931ec8aec3cd9d1a17fc3652f04a8b045754d2432c9c86000a86e799cfa8b404076fc938de9d108de4f72e00
SSDEEP 384:npiiF9CcmyWCs3sNQ8TUNTUlIm2QckCr9ur2pvBftGJXfhT9J8dLVGMe4KV8p0/5:ppFccps3BwgbkUWojGzT9J8fGMI8p0/Z
TLSH
T11FC25C36DC58DABBEDE34B99B74A3503DEE042678ACC5AE4D6DC5D0C11971DC430B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 fe8e8bb97fcea054bc650f60a88b6208a67910be9edb9f530aa818f5cf7a42ea
MD5 25020bd21162a29932563227281f5abc
SHA1 01184069a0e6153db144bafc6ff4405d33dc1376
SHA512 f0c846871d14b7e33f48b9fdbb7de961486f2c2cfc83a9c259ad2adec521bfea8ddd845b05a3ed9fbfe981396ba82ad8a92f3160f4f7da37653c95fea91015f1
TLSH
T1CE410758BAF91158B3B76E5A9BF6A86D487ABD772F16C49E00010D4F0722E44CCB1B33
MD5 SHA1 SHA512 TLSH

Submit Download

8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres
Size 2KB
SHA256 ed836fb7e54fed1c07796b879450de9a341171db4b489e0aa90a56349df4a23d
MD5 22eef43a3e13cf708682546d35177d14
SHA1 1a1a6e741a8ddbbeb7a50a05139d3106882fde00
SHA512 8aceb413ec96ec9514ac31a3f32ec4cb367cb2f9207cf6e4def6fd98ca5d9524ff6170caa683eb8609dc7d7a8bd7fc78493ef5808b5755dfe885dd66239782a3
TLSH
T1DC513B586AEA1158B3776E169BF6A46E84BF78332E07949E10110F4F0623A40CD6173B
MD5 SHA1 SHA512 TLSH

Submit Download

index.dat

Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
Size 442B
SHA256 4dd6a6fe3892c71f6ff497e4325fd160d54cd23ae39006ebd370ffc8a3d267d5
MD5 64402884eb5770ed6ae68bf4989971bd
SHA1 fff3de5932e3577dec9a182542343e93bfb44640
SHA512 86d566eaa60b7b8db671af3a2573451bf0d89474f7b04a7a0a22e10f6bdd5f0c6ac831c7b778bd40c91d96796e3325e5e53947583e543a94a0b674b6024186de
TLSH
T1DFF0151717AADBF6C7BD86F9B8B09CF546F38808C134503218D85CCA0E6264310DB900
MD5 SHA1 SHA512 TLSH

Submit Download

b8ab77100df80ab2.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
Size 4KB
SHA256 b59f58a8b279054a1e49ca46d23c79b56b3ab22692efa2925fd229fe41e7f137
MD5 900b0ab622985d0e5ad0d66fcf991d4e
SHA1 566f4334615e7a0dbe5e0f918c2406b8a46d89e2
SHA512 bb1d6c40337c6cc4116926eaa03338fd98ee8464b331207ff21fd8be77ac846ebf52adc7de76c5efe6f80c11253af510db8beb0a2052c8a875ac3904a3746a2a
SSDEEP 96:UCLnCKV7ZRj7+RNsEb4GYQ3HCT5NzRH7l1rmO9O4Vjb:UCLn/Vbj7SumpYQyT5Jh7fn9O6b
TLSH
T167A10F130BC70A6BE0744677963A431EDA207C13EB32519E67C8525B3C79E405B5EF5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b8ab77100df80ab2.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
Size 3KB
SHA256 8b8c86cf7de2a83444716d9569b37103d3b865ea2c02cd64367daf45299103a8
MD5 debe9896c8d825a598cfc4eac37f1d7d
SHA1 d983bcd37dcd9d40d798d1ad18a8133b97538671
SHA512 d86eff49a978c93d0d8982b29854cdd586eb0501df4c8508457651a098b1bbdc8ac31019a7be17de6ecb673f12bc09cca559b96cf57a2ae718bbf9338bb9ee0c
TLSH
T1FC81FE030BC70A6BE07446769239431EDA607C13AB22519E67C8525B3CB9E805F5EF5B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1128-651-0x0000000180000000-0x0000000180559000-memory.dmp

Download

memory/1128-561-0x0000000180000000-0x0000000180559000-memory.dmp

Download

memory/2824-649-0x0000000180000000-0x0000000180559000-memory.dmp

Download

memory/2824-650-0x0000000180000000-0x0000000180559000-memory.dmp

Download

memory/2860-467-0x00000230A1140000-0x00000230A2140000-memory.dmp

Download

memory/4840-580-0x00007FFA4E980000-0x00007FFA4E990000-memory.dmp

Download

memory/4840-575-0x00007FFA50F10000-0x00007FFA50F20000-memory.dmp

Download

memory/4840-581-0x00007FFA4E980000-0x00007FFA4E990000-memory.dmp

Download

memory/4840-643-0x00007FFA50F10000-0x00007FFA50F20000-memory.dmp

Download

memory/4840-642-0x00007FFA50F10000-0x00007FFA50F20000-memory.dmp

Download

memory/4840-641-0x00007FFA50F10000-0x00007FFA50F20000-memory.dmp

Download

memory/4840-640-0x00007FFA50F10000-0x00007FFA50F20000-memory.dmp

Download

memory/4840-578-0x00007FFA50F10000-0x00007FFA50F20000-memory.dmp

Download

memory/4840-576-0x00007FFA50F10000-0x00007FFA50F20000-memory.dmp

Download

memory/4840-577-0x00007FFA50F10000-0x00007FFA50F20000-memory.dmp

Download

memory/4840-579-0x00007FFA50F10000-0x00007FFA50F20000-memory.dmp

Download