hxxps://xeno[.]now/99aca0c5/3734fe27c699/73662e3d135f

Resubmissions

10/08/2026, 23:53

260810-3xh5xsck3w8

10/08/2026, 22:45

260810-2pc39szhnd8

Analysis

user interaction
yes
max time kernel
42s
max time network
156s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 22:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://xeno.now/99aca0c5/3734fe27c699/73662e3d135f
Sample260810-2pc39szhnd

Score

8^/10

discovery persistence

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
51	4548	msedge.exe

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
62	discord.com
93	discord.com
58	discord.com
59	discord.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4548	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134308755219833575"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{BC2C254B-776A-44D7-A8EB-22EA9F908D3C}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe

Suspicious use of FindShellTrayWindow 44 IoCs

pid	Process
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 1172	2164	msedge.exe	89
PID 2164 wrote to memory of 3224	2164	msedge.exe	90
PID 2164 wrote to memory of 4548	2164	msedge.exe	91
PID 2164 wrote to memory of 3224	2164	msedge.exe	90
PID 2164 wrote to memory of 3224	2164	msedge.exe	90
PID 2164 wrote to memory of 5096	2164	msedge.exe	92
PID 2164 wrote to memory of 5096	2164	msedge.exe	92
PID 2164 wrote to memory of 6112	2164	msedge.exe	93
PID 2164 wrote to memory of 6112	2164	msedge.exe	93
PID 2164 wrote to memory of 6112	2164	msedge.exe	93
PID 2164 wrote to memory of 2860	2164	msedge.exe	94
PID 2164 wrote to memory of 2860	2164	msedge.exe	94
PID 2164 wrote to memory of 2860	2164	msedge.exe	94
PID 2164 wrote to memory of 6064	2164	msedge.exe	96
PID 2164 wrote to memory of 1080	2164	msedge.exe	97
PID 2164 wrote to memory of 6064	2164	msedge.exe	96
PID 2164 wrote to memory of 6064	2164	msedge.exe	96
PID 2164 wrote to memory of 1080	2164	msedge.exe	97
PID 2164 wrote to memory of 1080	2164	msedge.exe	97
PID 2164 wrote to memory of 2036	2164	msedge.exe	99
PID 2164 wrote to memory of 2016	2164	msedge.exe	100
PID 2164 wrote to memory of 2036	2164	msedge.exe	99
PID 2164 wrote to memory of 2016	2164	msedge.exe	100
PID 2164 wrote to memory of 3396	2164	msedge.exe	102
PID 2164 wrote to memory of 3260	2164	msedge.exe	105
PID 2164 wrote to memory of 3260	2164	msedge.exe	105
PID 2164 wrote to memory of 3260	2164	msedge.exe	105
PID 2164 wrote to memory of 5228	2164	msedge.exe	106
PID 2164 wrote to memory of 5228	2164	msedge.exe	106
PID 2164 wrote to memory of 5904	2164	msedge.exe	107
PID 2164 wrote to memory of 5904	2164	msedge.exe	107
PID 2164 wrote to memory of 5904	2164	msedge.exe	107
PID 2164 wrote to memory of 5912	2164	msedge.exe	108
PID 2164 wrote to memory of 5784	2164	msedge.exe	109
PID 2164 wrote to memory of 5480	2164	msedge.exe	110
PID 2164 wrote to memory of 4276	2164	msedge.exe	111

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://xeno.now/99aca0c5/3734fe27c699/73662e3d135f
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x268,0x26c,0x270,0x264,0x330,0x7ffd8df3c188,0x7ffd8df3c194,0x7ffd8df3c1a0
  2⤵
  PID:1172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1524,i,3920305253544057753,10029266363173252583,262144 --field-trial-handle=2664,i,9708941532628841069,2811697912522016537,262144 --variations-seed-version --mojo-platform-channel-handle=2648 /prefetch:2
  2⤵
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,9792886805815147410,9535492111561299547,524288 --field-trial-handle=2664,i,9708941532628841069,2811697912522016537,262144 --variations-seed-version --mojo-platform-channel-handle=3016 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2272,i,5883072648496848193,252248909953892740,524288 --field-trial-handle=2664,i,9708941532628841069,2811697912522016537,262144 --variations-seed-version --mojo-platform-channel-handle=3120 /prefetch:13
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3596,i,14466786659983643578,579208525498162030,2097152 --field-trial-handle=2664,i,9708941532628841069,2811697912522016537,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
  2⤵
  PID:6112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3600,i,573594684316267032,9218266012747192258,2097152 --field-trial-handle=2664,i,9708941532628841069,2811697912522016537,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:1
  2⤵
  PID:2860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4300,i,11839441638918666069,5926352568431088985,2097152 --field-trial-handle=2664,i,9708941532628841069,2811697912522016537,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:1
  2⤵
  PID:6064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4308,i,3722249652972164740,15063983784564456216,2097152 --field-trial-handle=2664,i,9708941532628841069,2811697912522016537,262144 --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:9
  2⤵
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,8520261941245518728,9236503146610105472,524288 --field-trial-handle=2664,i,9708941532628841069,2811697912522016537,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:14
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5368,i,8080047167272693801,3757678299721437575,524288 --field-trial-handle=2664,i,9708941532628841069,2811697912522016537,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:14
  2⤵
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6116,i,9876103191604041717,12709188472881442322,524288 --field-trial-handle=2664,i,9708941532628841069,2811697912522016537,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:14
  2⤵
  PID:2476
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6116,i,9876103191604041717,12709188472881442322,524288 --field-trial-handle=2664,i,9708941532628841069,2811697912522016537,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:14
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6408,i,17673461883091410685,14594968204017908924,2097152 --field-trial-handle=2664,i,9708941532628841069,2811697912522016537,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:1
  2⤵
  PID:3260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6304,i,15690949779653670074,887764286023822242,524288 --field-trial-handle=2664,i,9708941532628841069,2811697912522016537,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:14
  2⤵
  PID:5228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6868,i,10874563516211216286,4672520888826227094,2097152 --field-trial-handle=2664,i,9708941532628841069,2811697912522016537,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:1
  2⤵
  PID:5904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4744,i,10526290904158675705,4221714403443387749,524288 --field-trial-handle=2664,i,9708941532628841069,2811697912522016537,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:14
  2⤵
  PID:5912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=608,i,10240417774816395434,3925770634920575257,524288 --field-trial-handle=2664,i,9708941532628841069,2811697912522016537,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:14
  2⤵
  PID:5784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=808,i,13919026980301722961,17721179785569962798,524288 --field-trial-handle=2664,i,9708941532628841069,2811697912522016537,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:14
  2⤵
  PID:5480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4904,i,10711983079371084320,466660240043075206,524288 --field-trial-handle=2664,i,9708941532628841069,2811697912522016537,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:14
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2028,i,14854143701757309889,6041444980662010683,524288 --field-trial-handle=2664,i,9708941532628841069,2811697912522016537,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:14
  2⤵
  PID:2380
- C:\Users\Admin\Downloads\Xeno-v1.3.60.exe
  "C:\Users\Admin\Downloads\Xeno-v1.3.60.exe"
  2⤵
  PID:4384
- C:\Users\Admin\Downloads\Xeno-v1.3.60.exe
  "C:\Users\Admin\Downloads\Xeno-v1.3.60.exe"
  2⤵
  PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4996,i,9404896424531709914,12464736863039640443,262144 --field-trial-handle=2664,i,9708941532628841069,2811697912522016537,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:10
  2⤵
  PID:1724
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6244,i,12260369744011500555,9394791100508996278,524288 --field-trial-handle=2664,i,9708941532628841069,2811697912522016537,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:14
  2⤵
  PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6384,i,9683941660003557758,10970286324494589638,2097152 --field-trial-handle=2664,i,9708941532628841069,2811697912522016537,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:1
  2⤵
  PID:5724
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6244,i,12260369744011500555,9394791100508996278,524288 --field-trial-handle=2664,i,9708941532628841069,2811697912522016537,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:14
  2⤵
  PID:960
- C:\Users\Admin\Downloads\Xeno-v1.3.60.exe
  "C:\Users\Admin\Downloads\Xeno-v1.3.60.exe"
  2⤵
  PID:3708
- C:\Users\Admin\Downloads\Xeno-v1.3.60.exe
  "C:\Users\Admin\Downloads\Xeno-v1.3.60.exe"
  2⤵
  PID:1128
- C:\Users\Admin\Downloads\Xeno-v1.3.60.exe
  "C:\Users\Admin\Downloads\Xeno-v1.3.60.exe"
  2⤵
  PID:5472
- C:\Users\Admin\Downloads\Xeno-v1.3.60.exe
  "C:\Users\Admin\Downloads\Xeno-v1.3.60.exe"
  2⤵
  PID:3412
- C:\Users\Admin\Downloads\Xeno-v1.3.60.exe
  "C:\Users\Admin\Downloads\Xeno-v1.3.60.exe"
  2⤵
  PID:2904
- C:\Users\Admin\Downloads\Xeno-v1.3.60.exe
  "C:\Users\Admin\Downloads\Xeno-v1.3.60.exe"
  2⤵
  PID:4064
- C:\Users\Admin\Downloads\Xeno-v1.3.60.exe
  "C:\Users\Admin\Downloads\Xeno-v1.3.60.exe"
  2⤵
  PID:6108
- C:\Users\Admin\Downloads\Xeno-v1.3.60.exe
  "C:\Users\Admin\Downloads\Xeno-v1.3.60.exe"
  2⤵
  PID:3388
- C:\Users\Admin\Downloads\Xeno-v1.3.60.exe
  "C:\Users\Admin\Downloads\Xeno-v1.3.60.exe"
  2⤵
  PID:3116
- C:\Users\Admin\Downloads\Xeno-v1.3.60.exe
  "C:\Users\Admin\Downloads\Xeno-v1.3.60.exe"
  2⤵
  PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2612,i,3282937315062370881,8440996621740858302,524288 --field-trial-handle=2664,i,9708941532628841069,2811697912522016537,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:14
  2⤵
  PID:4612
- C:\Users\Admin\Downloads\Xeno-v1.3.60.exe
  "C:\Users\Admin\Downloads\Xeno-v1.3.60.exe"
  2⤵
  PID:5772

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5932

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1636

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5636

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000035

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000035
Size 100KB
SHA256 44e4aba518029fc66a2f7a22a3d8efa75532fe4e87e35097d9924ed20669396f
MD5 8dd3fa0838b79c83788c90fca45e579f
SHA1 e5bc3818e5b5a80d993b445206a8203e71d9c845
SHA512 4558bf5a6b40845f6a2c8dd7896c0b94af0167952d119598b9db9e4a4dea041f6e4f79f5c3bfad1f6a274dde4128c114d0dbb6b1823ff7f1fbf61272672c948a
SSDEEP 1536:hlhCmpVnVsmSFgNRIj9n6d8Dsml+5fIPwKWpPcR8PtCmdUi3Tc2J2L7gmlt:RFnCmigNmjFy8YmlSIPwKWJr+IW
TLSH
T197A3024ED8B9CC710E9B913761353F1DC30044C7A098AA6ED94BB2A58665DFEC7D318E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000037

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000037
Size 429KB
SHA256 dc7b7f4b7f3714b560543a07dfe784a05672e147316e86d49f224e0fb0881e72
MD5 6c03e68993cdbb5acedb4c2d1cb00e40
SHA1 728e9d34137d91445eb521bfed6d03c2639d72ff
SHA512 43971de1e2f1cae2f47c9221b84891c97a8ac675abe3a3756f7eddb268add5f43f67e79d5bc8096469f4bed176e490030ef63001f72123bac5b4cdfc7c0c1274
SSDEEP 3072:zweE9O8TjldExEEOWK4KbBqCio0SPiIKOZdXA/rnI9W:zwr1d/W7aUCH9iIfdXATI8
TLSH
T18C94C0DC9719D428A4BACD3563C6A50C759BB48877CA7E3ED7009FB21DA344DB8322C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000039

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000039
Size 23KB
SHA256 4d374f815118157d4ec62c285937df74fec28c75d9eec110f48d3e04cb321ba8
MD5 ce7b262351203b245322fe75044fb61e
SHA1 46fc201fa3a9a56cb91f3a08f4a380f6d2283e0a
SHA512 0af2f8fa0171107ca26b73d1eeed9599c0b67953e163441bf65dc3a5bae5c9aa82bdcc54255996e8d1d472db1b09ba3286859d595619f1706a8e61c464081dff
SSDEEP 384:zApz2RXdsOYVa2CE00K/4dJfoLdmiJo0zADElg9jIKauH6CwJ6k5zRv2LbFq:oamOTZE0hAdJfoxmiJ9zdC9SpCwJoFq
TLSH
T130B2E1833404A6947BFF27130CF66A08E6B2B67BF63273054465483E42B52FA5B5977C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 42a840a4f8a8787f84022fad0c03bc7d0e8a7c0501ec09809aa073e1e3a672ad
MD5 05c5167bb3182812e88b8285e83b9d9d
SHA1 a97bca9316e1a5924f2319df6a0562f5a942dd70
SHA512 38aed087b5fe639e8b0636fc2a039d05989fffb18debea2c8bdae5332dfa83fe8ba7f3214e2a71ee6fb42a09e74690a68c806f474ff54b44d0abe4b24847f194
TLSH
T128511D56536647C3E7A895BBF4F1DA4532F6E85E4B4F2E1292815E36CA42F8800E2CD3
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5d9ed004-f192-4fc8-be7c-1b222fd39e94.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\5d9ed004-f192-4fc8-be7c-1b222fd39e94.tmp
Size 3KB
SHA256 9b7f2a16f0dfaf4f07096a00facedd97c3a2c1b02a1d0e3af27f002eb1776919
MD5 d6535ab6bb1b9c8eb09898e8f5399a13
SHA1 37bb3bd9a1ce4444f2b6f7bcae43e934cf22c8a8
SHA512 de2de08451069514d56ff8728dc877e4dfd400a0b1b08d413ecbdf03dccea602f3b6cb957f6b9322c31e9b96696a88c96ff42af57783a6d838255f9173d7a30c
TLSH
T14881ACF383E4866ED9115AF0EA146E2BCE5D0515431C3C6AC9E4BF1BA3E6071E151B8F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 7c4fccaba58ba8df43ff47c17ae183a400974279ce721f65c6292e86e94e18a2
MD5 8e05c6f6bd484dbf06e59d542a04e13b
SHA1 a877e8e04c343d6f6919f380bb70d35f58f25750
SHA512 4ec5167c94388b4759aba4e6499740ffe9d9511677067a7b6394e3e4497d68ec92f3f75ab00c683e4c051114143df43ae100677b7f1f8730b39994193ae9dc43
SSDEEP 192:sxR7RyOr/fWsuD8pDde5lSyazoD8p+9S/g6+WN/7U/YCVxHOtGfIgD3J:sxR7br/fWsuSc5l0f/5w/IIt
TLSH
T12442D8156D38AD3B8CCBE20DBA55BF53E6F95032A1912E18A7FC961C04E7BDD620740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 fea2f2dcc0103f7e8be845ab1b08922326d7e727dfd670f8c2a73ada72ef1216
MD5 4c8c27665d790ad3a6bbed58d499014e
SHA1 284ad5ab656abd58f0133cb578a12615f01a4aa2
SHA512 7a3868b779291770694735f20f3f5bc17dc1727f91939e5c21b1b1ec2240ccbef20bbbbae2001737b1d0a4359e72dc5f8e00f18a04cdc66c150f6d5a4b21dfb7
SSDEEP 192:sxRURybr/fWsFD/Dde5lSczoD8p+O/g6+WN/7U/YC4juOtGfIgIJ:sxRUar/fWst/c5lVV/5w/oIs
TLSH
T14632C9155D38AD3B8CCBD21DBA55BF53D6F9103361911E58A7FC961C04E6ADD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 399201c2d2d12128352754c850865cc0d35f6a24a4d0abd999eaaa93e0e7ff52
MD5 e2d0ead0eda20b9b6045e3ddcc9c98b2
SHA1 a692bbad839fd18729843328d4244c88ab97e731
SHA512 c751ede13083c52188cf92e70c4eb195d1b54a1799d2c38386f987c7e743c1840e43c0d13045bf5d49f8c2f8002385a2a46e91cf013bba2b8751b3f71ecc5db1
SSDEEP 192:sxR7RyOr/fWsuD/Dde5lSczoD8p+O/g6+WN/7U/YC4jHOtGfIgD3J:sxR7br/fWsu/c5lVV/5w/VIt
TLSH
T1C742D8156E38AD3B8CCBD20DBA55BF53E6F95032A1D11E58A7FC961C04EABDD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 0f626d4d2e49a45819a974e3108f60f5be9be7843cad0df258e70f022f877d8d
MD5 e5b9a111a2892717a86612a03aa3df5a
SHA1 c508c1d47dbade0a0140a2fd609c4f2bac4ba6f9
SHA512 984be33137b3eda135267a9a4dbfa85e38f90b43a71e070ac615866e94595742c25388516797aaa71f6f206c29db79547f007ee9d6a5796e58f8e44f80f6ac09
SSDEEP 384:jjm+vhKfCtgQCFf4+KhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVmC9qyRv/roZSR:jC+vhQWgQ+f4+8F1+UoAYDCx9Tuqh0Vm
TLSH
T10AB2EA2B600DCB7F5F800AADAC196FD76DA802CB97589D4047FED94C02C77EB92194DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 a88e26ef71248ea9348007394bd5b78c128bf4a644be017735fb43143b86aa4c
MD5 999026ec5eba8b43fc66df91956f2727
SHA1 5be5d71d3656efb75c77f322b2e74d9299552a54
SHA512 15493e4587fb4d0e4368007f238b99dcccc57bf0faae96dd10892c679ca5d97e54b7aacd397e20301fcb02a4108cda05007a3becba286d1bf3106c08e2fc2eb5
SSDEEP 96:KRbEBVj5J1WdSIg91K4EgT1c7j6dJOHWLa2Q44eWIdFgWeK4rgEec+W10m/Hd0dd:CbEBVj5JAdSp9/EgTK7j6dJOHWLa2Q4x
TLSH
T13E915A04343A0650B87E771C81FD8C2E85C578723519E52B3FAC42A60F6AE47ADFDAD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59d74b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59d74b.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 f76d789f9e8438b7718d8d8deb6ff4448ba0470d5d0bf4d052f908fd2fa4e402
MD5 e20f13231e66c53c60b973128f05a84d
SHA1 8d26a01262e0d4f914d7921f85db8b9ab227e222
SHA512 6a70acee4736179e43e134702e2e69379a4a2d33f691fc37845fbab3986010d3c70ddfa45140a2f15c4fb5aac9df22d32d3ec72b2b1e4d61ebd822f99847014b
SSDEEP 768:6rv+4UNbd/3r1FWKp8+p3bd66j+4BRv86aLIW50:6bsbZ3m08+p3Z6n4yH0
TLSH
T1EB03BE72F8A8A9739CF6C684B1473643BFB8516386C01E94D8CD6B5D459B0AE630BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 374d82cdf06c58bf893dd67c85d18491527b2e83b90546cd16927a0e8308e19a
MD5 1b9f171cb615c6d2117c4f6bfbc45497
SHA1 5e09f137f90eb9bcfc0a290406409fa98ad57bca
SHA512 c120a5e45d11b75664a64a585d06e9d5a41892658c7a27f7d056c3c738856009a92e76aee915ebfd76c51423f00b37f04887a67379d8205f304700bd41cfabba
SSDEEP 768:gP3L1FWKp8+p3bd66j+4BRv86aLIW5hy6DqEWG:gP3G08+p3Z6n4yHTXH
TLSH
T1E9F2BEB2E8A499774CFAD344F1863A43AFF8406396D01ED494CDAB1D14871AE530B83B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 ac848d984cdadd57d9031f2807734b66eef9d0d1a3847148a44927e138d13ff3
MD5 deacecc623ef70103aa5548d796984a7
SHA1 51b4da676abc0cc6e43dc5fc199eb9e684b47550
SHA512 37925aa1e54722f110b9934811c0bb291161e61b178061b1ffd706220d4571b487e3655b358cdc91ae53883ddfd6a977062986ec31bd0100024624de42845906
SSDEEP 768:qFQP3CwgG1F2Dp8+p3bd66j+4BRv86aLIW5hy6DqEWG:RP3MV8+p3Z6n4yHTXH
TLSH
T16503AE72D8A4897B9DFADB45F64A36439FF44163C6D06EE4E5CDAA1C10870AE130BC36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 54a84cfff145369fbf683d4b3a2b82abf490ca730bb4ded02470f760f5cc8fb0
MD5 ebd593d7ad586b1ccb133be198f30aea
SHA1 d8bddedbeed07c421becab9f1a96623ba1ba380e
SHA512 12143f2cfefe0196fa00394a5794131d20a60bbd42715c719c4eec9776f9c017daa462b6c5e4459c5b0aef54db3d72404b97dd8730c6d6f14e6b4154a4f1ff19
SSDEEP 768:Irv+4UNbdD3FczNp8+p3bd66j+4BRv86aLIi72bwCl1:Ibsbp3kL8+p3Z6n4yN0ww
TLSH
T1B403CE73F9A899339CF6C644B1467B437FF851A39AC10AC4D4DD2B4E415A19E630BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 cf4b10af8a30ea7daec441b7be75e2198da70190e99a1af8291971a99ff53497
MD5 f437bfe157626122e8be9d6aaea54ba8
SHA1 fdb3ba52686dc4fad1f9aab6972703817420366a
SHA512 da32d9328ed1e8a46805a721e38d09eeff994cc50c35644b4b5d8f08c76efd0e330ffd515f0f73ad0508f9be2d0b366bc8be986d136d3b1a3625ea186b503997
SSDEEP 768:+I3j1FWKp8+p3bd66j+4BRv86aLIW5hy6DqEWG:+I3O08+p3Z6n4yHTXH
TLSH
T19DF2BEB2E8A499774CFAD344F1463A43AFF8416396D01ED8D4CDAB1D14861AE530B83B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 108a62e12545ff2ac5443e9ebbe1838e7011cf1003cbfd42b7baae95f6d34836
MD5 22ef818ffcd14da8fe621d31ff8e5538
SHA1 de33d11b97b5f8c34328242b396543ecc026233b
SHA512 5c9797813e73eb9b6d8d06740f666313cadf0a458bff7c7dd34985309331231c5680093574b802d338a0748ee2fbf592ce8d752698573ba7cd18473111e71b30
SSDEEP 768:0rv+4UNbdD3j/FWNp8+p3bd66j+4BRv86aLIT52bwCl1:0bsbp3oL8+p3Z6n4yU0ww
TLSH
T15403CF73E9A8A9339CF6C644B1467A437FF851A396C10ED0D8CD2B4E419A19E630BC37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7a4ba127-2eb1-4d92-9f43-14f685c8d327.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\7a4ba127-2eb1-4d92-9f43-14f685c8d327.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nskF38F.tmp\System.dll
Size 12KB
SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
MD5 0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
TLSH
T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis7z.dll

Path C:\Users\Admin\AppData\Local\Temp\nskF38F.tmp\nsis7z.dll
Size 424KB
SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
MD5 80e44ce4895304c6a3a831310fbf8cd0
SHA1 36bd49ae21c460be5753a904b4501f1abca53508
SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
TLSH
T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis7z.dll

Path C:\Users\Admin\AppData\Local\Temp\nsx126C.tmp\nsis7z.dll
Size 256KB
SHA256 fff91c3997313eaed20f6d578548be2690516f7249bf612899319d3a12258a25
MD5 1219c48bde16cc2a6bbac7fda45297e3
SHA1 c9108dd88520cef653db32cad84ca79c9378b0eb
SHA512 7fddfcf26052df142d4c1d1788f5dc0e38478ed05ef21a1bd61df7c073a49f098416456a0a736267170bcc2a99a478d8208e966a469677014f56dc26f8ecd436
SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uu:an5QEG39fPAkrE4u
TLSH
T15044BF239AD2853ADA732330CB1C7BB674EEA3701125A65AA35C19596FB04D1F31EF07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads