43e332faef4019a95d3b72205da7ce72bc4ccd25f53399352b68442f0b55dad2

Analysis

max time kernel
899s
max time network
734s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/08/2026, 06:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Xeno-v1.3.60/editor/index.html
Size 164KB
Sample260820-gsa3vsfl2w
SHA256 43e332faef4019a95d3b72205da7ce72bc4ccd25f53399352b68442f0b55dad2
MD5 b33eb96a570d0cdf6ded11ff199d0de3
SHA1 47c7c58cefda42ca2a5ec53af727d34aa0663136
SHA512 409771d5941dc934b46c3a1d906bbc352bb9c1684c4bc585d7d884acc8d8ea93661637cbf047d02b96a17ab978419f8c116097226b89898007eaf3a8e7d976a5
SSDEEP 3072:Nk4J09UmmJv8kBpZaFD48VOAGUWYPjDZlLJbRBiPEP8yKUz2Ojmjr8zM3KP7pbl8:64J09BA3pZaFD48VOAGUWYPjdlLJbRBW
TLSH
T1E7F3F19AF1122D5226C79230619BBE297FF19490BE766B424B9CF3201091FDF116FBB4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
11	raw.githubusercontent.com
12	raw.githubusercontent.com
39	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1752	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134316795725015148"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{6F5C56C0-C045-4285-8491-63B17663D7C3}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1004	msedge.exe
1004	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 1060 wrote to memory of 2972	1060	msedge.exe	83
PID 1060 wrote to memory of 1752	1060	msedge.exe	84
PID 1060 wrote to memory of 4900	1060	msedge.exe	85
PID 1060 wrote to memory of 4900	1060	msedge.exe	85
PID 1060 wrote to memory of 4900	1060	msedge.exe	85
PID 1060 wrote to memory of 2136	1060	msedge.exe	86
PID 1060 wrote to memory of 2136	1060	msedge.exe	86
PID 1060 wrote to memory of 2840	1060	msedge.exe	89
PID 1060 wrote to memory of 2840	1060	msedge.exe	89
PID 1060 wrote to memory of 2840	1060	msedge.exe	89
PID 1060 wrote to memory of 2964	1060	msedge.exe	88
PID 1060 wrote to memory of 2964	1060	msedge.exe	88
PID 1060 wrote to memory of 2964	1060	msedge.exe	88
PID 1060 wrote to memory of 4628	1060	msedge.exe	90
PID 1060 wrote to memory of 4628	1060	msedge.exe	90
PID 1060 wrote to memory of 4628	1060	msedge.exe	90
PID 1060 wrote to memory of 4148	1060	msedge.exe	91
PID 1060 wrote to memory of 4148	1060	msedge.exe	91
PID 1060 wrote to memory of 4148	1060	msedge.exe	91
PID 1060 wrote to memory of 1916	1060	msedge.exe	96
PID 1060 wrote to memory of 1916	1060	msedge.exe	96
PID 1060 wrote to memory of 1056	1060	msedge.exe	97
PID 1060 wrote to memory of 1056	1060	msedge.exe	97
PID 1060 wrote to memory of 648	1060	msedge.exe	99
PID 1060 wrote to memory of 4196	1060	msedge.exe	108
PID 1060 wrote to memory of 3368	1060	msedge.exe	109
PID 1060 wrote to memory of 3104	1060	msedge.exe	110
PID 1060 wrote to memory of 4120	1060	msedge.exe	111
PID 1060 wrote to memory of 4120	1060	msedge.exe	111
PID 1060 wrote to memory of 3380	1060	msedge.exe	113
PID 1060 wrote to memory of 3380	1060	msedge.exe	113
PID 1060 wrote to memory of 1004	1060	msedge.exe	114
PID 1060 wrote to memory of 4872	1060	msedge.exe	115
PID 1060 wrote to memory of 4872	1060	msedge.exe	115
PID 1060 wrote to memory of 4344	1060	msedge.exe	116
PID 1060 wrote to memory of 4344	1060	msedge.exe	116
PID 1060 wrote to memory of 616	1060	msedge.exe	117
PID 1060 wrote to memory of 616	1060	msedge.exe	117
PID 1060 wrote to memory of 1768	1060	msedge.exe	118
PID 1060 wrote to memory of 1768	1060	msedge.exe	118
PID 1060 wrote to memory of 828	1060	msedge.exe	119
PID 1060 wrote to memory of 828	1060	msedge.exe	119

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.60\editor\index.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b4,0x7ffb719fc188,0x7ffb719fc194,0x7ffb719fc1a0
  2⤵
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1924,i,3054902748952368618,17771002386660343309,524288 --field-trial-handle=2128,i,2742249431343715581,9634187376302166795,262144 --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1724,i,7367793613195933605,7809419518348527818,262144 --field-trial-handle=2128,i,2742249431343715581,9634187376302166795,262144 --variations-seed-version --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2604,i,10030257302164465678,143082364999114660,524288 --field-trial-handle=2128,i,2742249431343715581,9634187376302166795,262144 --variations-seed-version --mojo-platform-channel-handle=2756 /prefetch:8
  2⤵
  PID:2136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,18189062926874700079,5769195397674495769,2097152 --field-trial-handle=2128,i,2742249431343715581,9634187376302166795,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,2463519302371595525,7425761658647874223,2097152 --field-trial-handle=2128,i,2742249431343715581,9634187376302166795,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:2840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4244,i,683598721135355798,11009728649900295977,2097152 --field-trial-handle=2128,i,2742249431343715581,9634187376302166795,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:1
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4256,i,2431964347805285931,13736601014315967068,2097152 --field-trial-handle=2128,i,2742249431343715581,9634187376302166795,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:2
  2⤵
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,5052043093978377765,7910109060007988389,524288 --field-trial-handle=2128,i,2742249431343715581,9634187376302166795,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,8446854287465952732,1449981559605227969,524288 --field-trial-handle=2128,i,2742249431343715581,9634187376302166795,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,15731212272419829679,12617897329487171590,524288 --field-trial-handle=2128,i,2742249431343715581,9634187376302166795,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,15731212272419829679,12617897329487171590,524288 --field-trial-handle=2128,i,2742249431343715581,9634187376302166795,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  PID:648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4560,i,9646441342217533817,11764698272299538598,524288 --field-trial-handle=2128,i,2742249431343715581,9634187376302166795,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
  2⤵
  PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4544,i,14759662768897999210,6884806831571196433,524288 --field-trial-handle=2128,i,2742249431343715581,9634187376302166795,262144 --variations-seed-version --mojo-platform-channel-handle=1712 /prefetch:8
  2⤵
  PID:3368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4548,i,6371938397267309265,3468666601593959085,524288 --field-trial-handle=2128,i,2742249431343715581,9634187376302166795,262144 --variations-seed-version --mojo-platform-channel-handle=6436 /prefetch:8
  2⤵
  PID:3104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5708,i,539513364650885269,14056407961971942257,524288 --field-trial-handle=2128,i,2742249431343715581,9634187376302166795,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:8
  2⤵
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=708,i,11194300654850060600,15515209502959795872,524288 --field-trial-handle=2128,i,2742249431343715581,9634187376302166795,262144 --variations-seed-version --mojo-platform-channel-handle=696 /prefetch:8
  2⤵
  PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5224,i,5371667043605862155,4067200872348041042,262144 --field-trial-handle=2128,i,2742249431343715581,9634187376302166795,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6428,i,13210530426942949230,16669112209718751215,524288 --field-trial-handle=2128,i,2742249431343715581,9634187376302166795,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:8
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5336,i,348294251092106899,9125648353367590472,524288 --field-trial-handle=2128,i,2742249431343715581,9634187376302166795,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:8
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6392,i,4722473592315243773,11982120591280753881,524288 --field-trial-handle=2128,i,2742249431343715581,9634187376302166795,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:8
  2⤵
  PID:616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,3150742067901329330,13695631018384801997,524288 --field-trial-handle=2128,i,2742249431343715581,9634187376302166795,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:8
  2⤵
  PID:1768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5336,i,3103839914915565542,1106067087363943110,524288 --field-trial-handle=2128,i,2742249431343715581,9634187376302166795,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:8
  2⤵
  PID:828

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2096

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cc11c2ba3ec4cb292b61dd36af338e083bb0ce5868e654b17f3c58ecf3c8fdfb
MD5 22bfe5ff5070c92c37e54f6f278efd25
SHA1 2fc94025f3a738879f1fcececb95937cbaa0cdd1
SHA512 b57abd220e674cf733b39ea299fc66d6fe964ab448ae0758482efe80597e3678909cd989b9635acc0317001af0fe6dbbbccfd3cf110ec5ad1b9e4c084de22188
TLSH
T16FD09220B719A2C3E24704BA94A6AB52A916C57AA0B7F7017232640CAE65089F28F192
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 201729318e073e437978c4f830a6df095e397d14193bbab8cb94016e3e0e1540
MD5 038903102cb76ddedd18207430e00005
SHA1 e694b970e01eb43fddfb00d36857e2b64f8c931b
SHA512 bacb50167c8d736bccc259f2ffbffff915c7c6dc188c6c2c1476ded8cbd822ff968f690173d1b8e35c352ec62f9ace3913a556b80bc1a59211be000ee9ea7447
TLSH
T17DD092207759A6C3E24704BA94A5AB52A916C57AA0B7F7027232640CAE66089F28F192
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 d08badd6fa2769aa0736a5c6b18e2d58af18ffb7b753c3f47b51fb56b7d00ce8
MD5 3d994130407abbd1a703a692beb9bec9
SHA1 f56dad9f182c69f615ba4a43efba40583152ad70
SHA512 2bca3e78bf1ab2f05e2750a8b00b17a010628667855f48fbf0542db8b5aa4f58afea32f3ce02a28d81f6b46d72850eae1e8a5b2e594abd8034661e9cc519e04e
TLSH
T159E026A444CCC32EE70CB8875278438DC2E2360A92C9E95A170486CD7142A50F7867D1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 56bc5df099e1d17a0752a5bf5248c9963e96e6f782f572de4feaf333c6e40785
MD5 2e41d3a57dc1fb67b071eeeff288716e
SHA1 fdd1612efb501b2574e05ae6d40cff75e4bd7f80
SHA512 913d18d6335e9a56493852a106269a8c2fb417cbc71bb899dacb783a9e9d5c6d5d94308ca018f7c1286751bf1769720a4b68a367db787b9d77e9ea88ad1f6461
TLSH
T13CE07DA447CCC23EEF286447556C534CC2A13E4BD2C8E96A6B04A7887601A94F3D37D0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 3a9a72d0cae87bf026380b49662aeb10249e9d6b6cb2e5a99b757820ab850514
MD5 b5d7ed7ed61ca7b556f9eb0a1de13482
SHA1 f792b42f5ba4aaf3d225fc46af48c79e813c9607
SHA512 df8afe128fee6924a367226b7e3bc12b31871ef10d4b173b44ddb1170a60be72d7114159ff38813e7257aac912cb57c538c6b014ce4fd05b71a34155b23a8514
TLSH
T1A8E07DA449CDC26FF70AB44B55E8474CC2A03A0ADBC8EA1A3B08C7CC72068D1F2C26D0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 ca1a4b8de25a16ddec632222ac20e9be9607837d6828897bdc3c6c238d913dfd
MD5 47cac3225f1c5fc054f30a6fc420bc5e
SHA1 1482edd32e064f3ae53fccfe248b224af9da0df5
SHA512 ea74e71dbb2cb50d87d0aa0a4f2660eba23d0401170915c08dd4a7b0f2e29be5d5554ec046e7961e690b48a1b0989c7f40973958e2d5fe0c6a6113ca3aaa102c
TLSH
T1207119370BF74062DB65B7B1ACE0C1033475C6C7F527AE66ACE4AABD1D187518D98009
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5882c7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5882c7.TMP
Size 3KB
SHA256 80517a149e96fb855b1f1c3bec5f67db62f68314fb362de32c62809e2bf99acb
MD5 a72e21ff4688a166208718a58787ddfe
SHA1 dd1f0a99f1e21a9d16f7de9bd8f5f5b22c9166d1
SHA512 ee01ad4a70334abe5cc91ff32e791cedbb356b33272fa010b937496912fcd8b5ae8ff4d8b1ae278c7c94a2945ddbb3b7b1d4f2b2d230834b5817152651a5f428
TLSH
T1457119370FF70062DB61B7B1ACE0C2033475C6C7F527AE66ACE4AABD1D287418D98008
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 e7632a0b0076fb0a82cb3c46fe85be478cd00b6f648736abc2f4baf7e6d132c7
MD5 18af7be09a1f127523dbed681049495a
SHA1 2e02c9c5f60926f6ba0d68f3dac60b8fe1f459e3
SHA512 10a814c36c3b3d343d0fdd1153b908e553a49f61442fe8a3484d26d82e5395fb34df02752588b94421cccae81daa3c67f1808d5baf22693cce62ac99fe628ce8
TLSH
T1BF1150F383D5856E8A1156F05A24AE1BDE2D0516832C7C2589E4FF2B93E3475E10255F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 158b5f39ea6fef148b7d17d260c152c80718158ab2d9b39134884008d0a3556f
MD5 bd9f81d395bbf73fce6855583149110b
SHA1 1dcc4877614807145df3f69aa901c94d6b7a8cd3
SHA512 747aa3d9bf434b57f9dc9c5d3e70ceab9f42fc19df1d986aafcaa1f962da569b9ea41428e6ea4c0009d989c5cce3c3bbbeadcae82d317b3cec6a3da97cc7ff0b
TLSH
T11E1160F787E1866EC91156F05A14AE1BDE2C0516431C7C6985E4EF27D3F3071E00266F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 d24d75ba247ddafa68a5c4569c5f693ce1619bbf2a0eb72bd1b3acdacb6066a4
MD5 79610fd2c524faf6bd700eecb9410645
SHA1 b590ee2aa0a2e8c472ae02885bc2c4e6f5645e32
SHA512 fd9578a4c9cae30896cf13d576d18d792b8e7342b99af914d24cb5384e01306e4257c1db38745aaee9c9f9d30e5570759e1a9bc8cdf7eac7c7370b4f787a57a4
SSDEEP 192:sxZrRFiyM/jK1Ml8Mk+/flsSdQYIdpdNHW6+WNGYIkU0KIgrJ:sxZr6M+/flsSdQpTHbGX9
TLSH
T16D42E8116B346977CCDBD209FA557F93D6F81472A2900E44ADFCCA1C04E6AEC220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 236d028afe9f9a0f6483963fa23597cc257ee19980f2deb7d5bd010f4cc48a65
MD5 53cd49e13ddbfba76b18e2dd87cd82ce
SHA1 cc74971cc0bf60a3183daad5b36f63b8722b804b
SHA512 7b630a3aed8cf942572061a35e88b73cbd6db6a6900c42228e765e5ff27893da66d88eac11e11f141a153f3d8519ea6f9793db0452d4eff37a9472c1da955859
SSDEEP 192:sxZrRFiyM/jK1Ml8UQ0k+/fls2d9YIdpHNHW6+WNGYIAf0KIg5XrJ:sxZr6qP+/fls2d9ptHbGkx9
TLSH
T17752D7116A346977CCDBE209FA557F93D6F45472A2900E44ADFCCA1C04E6AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d6179f83fc1e9618359a11c64d3de36a70fd628121f8e810371de4e0e6e7d50c
MD5 85ea2090d5b10ba80327c271538b112c
SHA1 693a08b5302e360d45cacdff1630e6b10462aef1
SHA512 2c12a8f539ce9ea0898ccba5873a4196c8e8e87b2be4a272705136907f7485d92cfd5bf2e6e405efb1f88fc1f53c0bcace1cf74e103179d0d5adef67d057b38c
SSDEEP 768:0SsqxXlWvJD6T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVk4Ll6AR9ProfZl:0SsqxXlWvJD6Tu1ja54LAs9cfX
TLSH
T1B7D21B3B694CC77E4F840E6DEC266FD76ED801CB66988D5447FA880C03CB2EA51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ee743e92-8f67-4188-9bcc-a865d9829eff\index-dir\the-real-index
Size 1KB
SHA256 ba0520f9afe174ddebad0322118e72161bf71a54d07dfcd08d2ca9fe07461bcb
MD5 06193a5c5a54eff849104569606d6dc2
SHA1 350ee0fb1bce2da11619f08215153b03da938354
SHA512 31274a6d0f7d4e609251caeb388b15d08deccc04674ad3435fe0433fdebea0b0efeda57a8d58836c53b027ceee11dc444f2b73e931c949c356c835f217404228
TLSH
T1422110CE4EA5A95FF9A589B30032A1E073B0C9CC6B11E7235D7D32772C22399295B5C8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5cc9df.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ee743e92-8f67-4188-9bcc-a865d9829eff\index-dir\the-real-index~RFe5cc9df.TMP
Size 1KB
SHA256 db19707cd677382110737c814ad321a1438876b412770844338b47a3a4806d3e
MD5 6cd55daaed0b1521a0bafa2ca2a4d04f
SHA1 e68eb26a5da72dc2d022795583339c23532feaba
SHA512 baef456b3e4e2da68766b8e982338f4a993d2a6a2c1cf8712626d4b582a973e46caf4131ca7ebbd0a3d6bfc0923d0e211711d349bba0bc0d3263ef34c93a0573
TLSH
T1EC2163C64692590FEDD540760143B4F43374CD00A322B3D3A97E223E5C3579D1E4B1C8
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 fe14a99596c5836c49d56e10a18b06a0bf7f1fc3c53460ecb22908461de4104d
MD5 d7554a226455d23a61d75ff863fae759
SHA1 b9862fc4effac20c5517d88b28c517296e80a828
SHA512 eff729813596098283c5b90e4d257cbadee4c43370b0998f63a599779e009f30d1589b6197ab47ca846304ba737388971280c0a799665522c09e27328892f467
TLSH
T15DE06FBA2AE70800A8ABC3EA187284A64418F828CD91EC4F0029A28314622B02832C26
MD5 SHA1 SHA512 TLSH

Submit Download

d45bc515-17d4-4c8f-873f-d7a56b880a52.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\d45bc515-17d4-4c8f-873f-d7a56b880a52.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 3673c652eba065bc934035b3ce397cc677607edeebf201cb16bb8faad89f28c5
MD5 bea8479a99ca5b68c5ec533bf36a4a87
SHA1 d93f4a0d669ec9179c602f090ae55b8679c84658
SHA512 8ac4388170c6052841e46f892bf106ca2e7276c6deeafbfe09113430c926685698acdd32d004aec182206e1db7c258f9ded3996b7599862bc43a10de3b419870
SSDEEP 192:udLsN4iQKzimkRbvzQmiU11Ap4VRNPOmlhPoB9SFiSRWCq5mU8:6sN4iwbto2VRNPOwG9OBWwU8
TLSH
T150321835AC389C779EE3A544F58736539FB4406BAB882F80D5DD1A0C01EB69C230BD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 0abee9ed780f37e48a5e8d88f599ec870e5aa3fb583cb33a9bc49a3fd6609570
MD5 054237d843da8ed118e4b591a4be47c3
SHA1 9a40f288833fd860988bbf1a9388060f5bd6c590
SHA512 6f51fabd892d65d33a19ca588b896562d5a731bce3e9097e27c48bf5d5eac5a5bf2e6e1bde473eb83fedf5012ee101372b47388f91f3956ab2dd3840fc00d7a1
SSDEEP 384:4iFiZcIdsNo8TUNTUlIlywbto2VRNPOwG9O4WwivyfoU:DFQdZwg6UHPOwG9JWwiyz
TLSH
T171A26D725D648C77ADF6EA84FA4A31078FB44077E6C9AA50D6CC5E1C01EB5DC130BD25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 299826c5bc65d5c1da70c2a768abeeadb65ecebedb221900e3daba281a830155
MD5 46fea3bd8e147d2cc26103ec9a1d0d81
SHA1 5a56f462c59407e3152152bba3675d48266d626f
SHA512 a5f31a9e8a629eb19377274b949bb0d3b5fb214e010b610d0ccb32b035906624174583f3aa6823298b8e983254e873827026421ff2cde11d04a013475009da64
SSDEEP 192:tONY6JkRtQmiUy/5W+RNPOmlhPXh3WjRmoU6:tONY6UrWW+RNPOwvWBU6
TLSH
T1FB02C735AD386C7B9EE3AE09B98727175FA4206BB9952B80DAD81F0C01D765C2307836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 e379a21e2f41a6dc40910fbae6b49d65000ef6a777f2778d19d4cc74c5b3ef30
MD5 18de3dad7c8c8fd36ff50a6f74b8d81d
SHA1 f1ba96dd5be6cae39edb5ea24ef7d4530f680662
SHA512 6d72c41deecd07586ca376bac2ae097d4b734493f4cdbf0c71175af2428e47d519adef15ab26a213b2089d2d433978484fae835c00766fe5b8aec80ea273aeb4
SSDEEP 192:uxm+xasuheOwQxMGsN4BQKzimkRbvzQmiU11Ap4VRNPOmlhPoB9SFiSRWCq5mt4c:3ZcIhsN4Bwbto2VRNPOwG9OBWwivyfoU
TLSH
T1F0827C715C349C7369F6E189FA8635079FB8906BA7CC5E80D4DC6B1C01EAA9D230BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 af48997a48fccaad3ecd3ba8836e6e36d6e321604158cbf3ae076e43fb161825
MD5 3200553f86cda9c2d7e7bb63b6bb58fc
SHA1 679386042a7a51241a82d94c3c580bb2b91944ca
SHA512 b5eca5dc3b8c73cb7c8b0b5d71c3ad543f58fac937467828d4dc7c37e08f649b1915fa00738369fa5a61fc6b5ee0dbf8a4d47bf34d61a6476cc9c07b6881d7fd
SSDEEP 192:+ONh6JkRnQmiUyj5i+RNPOmlhPoB9SFvVcWCq5mU6:+ONh6UJci+RNPOwG9OOWwU6
TLSH
T1F7120932AD385C775EE26945F58736138FB4512BFA896F80D5DD2E0C01EBA9C234AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5f879527-81f6-4a2f-bf4b-82a2af3613b0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\5f879527-81f6-4a2f-bf4b-82a2af3613b0.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 a1964a45c7dc42368a4c4db9c64740f5bda214a4f8757aa0a69e6e1a936b00bb
MD5 84d7306623dc9a375d5d89cbd9344498
SHA1 24fe7a3a0fa23b12fd0d8fc7c1545a9cbb96e943
SHA512 93c52faeea02558cec136fd67424e687a55a9853cdf598fec34eaddad9ca9b8c6b825547552d05a7c79913897b1237284f6fbb5426313877f853f7a7e06188c0
TLSH
T16E411A5CBAEE1118B3B77F5A9BF6786E487A7D372E0A855D10010E4F0622B40CCA1B37
MD5 SHA1 SHA512 TLSH

Submit Download