43e332faef4019a95d3b72205da7ce72bc4ccd25f53399352b68442f0b55dad2

Analysis

user interaction
yes
max time kernel
899s
max time network
738s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 06:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Xeno-v1.3.60/editor/index.html
Size 164KB
Sample260820-gsa3vsfl2w
SHA256 43e332faef4019a95d3b72205da7ce72bc4ccd25f53399352b68442f0b55dad2
MD5 b33eb96a570d0cdf6ded11ff199d0de3
SHA1 47c7c58cefda42ca2a5ec53af727d34aa0663136
SHA512 409771d5941dc934b46c3a1d906bbc352bb9c1684c4bc585d7d884acc8d8ea93661637cbf047d02b96a17ab978419f8c116097226b89898007eaf3a8e7d976a5
SSDEEP 3072:Nk4J09UmmJv8kBpZaFD48VOAGUWYPjDZlLJbRBiPEP8yKUz2Ojmjr8zM3KP7pbl8:64J09BA3pZaFD48VOAGUWYPjdlLJbRBW
TLSH
T1E7F3F19AF1122D5226C79230619BBE297FF19490BE766B424B9CF3201091FDF116FBB4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
8	raw.githubusercontent.com
9	raw.githubusercontent.com
16	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2668	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134316795759616198"	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3986082593-3624157295-3514260330-1000\{6B099288-8850-4D7F-B1B4-C8FFDC039956}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5664	msedge.exe
5664	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 4660 wrote to memory of 2240	4660	msedge.exe	89
PID 4660 wrote to memory of 1852	4660	msedge.exe	90
PID 4660 wrote to memory of 2668	4660	msedge.exe	91
PID 4660 wrote to memory of 1852	4660	msedge.exe	90
PID 4660 wrote to memory of 1852	4660	msedge.exe	90
PID 4660 wrote to memory of 4248	4660	msedge.exe	92
PID 4660 wrote to memory of 4248	4660	msedge.exe	92
PID 4660 wrote to memory of 5516	4660	msedge.exe	94
PID 4660 wrote to memory of 828	4660	msedge.exe	95
PID 4660 wrote to memory of 5516	4660	msedge.exe	94
PID 4660 wrote to memory of 5516	4660	msedge.exe	94
PID 4660 wrote to memory of 828	4660	msedge.exe	95
PID 4660 wrote to memory of 828	4660	msedge.exe	95
PID 4660 wrote to memory of 2472	4660	msedge.exe	96
PID 4660 wrote to memory of 2472	4660	msedge.exe	96
PID 4660 wrote to memory of 2472	4660	msedge.exe	96
PID 4660 wrote to memory of 5060	4660	msedge.exe	97
PID 4660 wrote to memory of 5060	4660	msedge.exe	97
PID 4660 wrote to memory of 5060	4660	msedge.exe	97
PID 4660 wrote to memory of 1168	4660	msedge.exe	99
PID 4660 wrote to memory of 1040	4660	msedge.exe	100
PID 4660 wrote to memory of 1168	4660	msedge.exe	99
PID 4660 wrote to memory of 1040	4660	msedge.exe	100
PID 4660 wrote to memory of 552	4660	msedge.exe	102
PID 4660 wrote to memory of 3156	4660	msedge.exe	106
PID 4660 wrote to memory of 5840	4660	msedge.exe	107
PID 4660 wrote to memory of 6132	4660	msedge.exe	108
PID 4660 wrote to memory of 4888	4660	msedge.exe	109
PID 4660 wrote to memory of 4888	4660	msedge.exe	109
PID 4660 wrote to memory of 5664	4660	msedge.exe	111
PID 4660 wrote to memory of 1976	4660	msedge.exe	112
PID 4660 wrote to memory of 1976	4660	msedge.exe	112
PID 4660 wrote to memory of 5924	4660	msedge.exe	113
PID 4660 wrote to memory of 5924	4660	msedge.exe	113
PID 4660 wrote to memory of 3836	4660	msedge.exe	114
PID 4660 wrote to memory of 3836	4660	msedge.exe	114
PID 4660 wrote to memory of 2764	4660	msedge.exe	115
PID 4660 wrote to memory of 2764	4660	msedge.exe	115
PID 4660 wrote to memory of 6088	4660	msedge.exe	117
PID 4660 wrote to memory of 6088	4660	msedge.exe	117

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.60\editor\index.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x284,0x7ffb7c4ec188,0x7ffb7c4ec194,0x7ffb7c4ec1a0
  2⤵
  PID:2240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1660,i,16110158795888069019,6466698725430678595,262144 --field-trial-handle=2304,i,15404395560205255494,16585808774744162234,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:2
  2⤵
  PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1868,i,4432604349763356549,8382648536526414108,524288 --field-trial-handle=2304,i,15404395560205255494,16585808774744162234,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2368,i,10306348166882580307,15244229547448012652,524288 --field-trial-handle=2304,i,15404395560205255494,16585808774744162234,262144 --variations-seed-version --mojo-platform-channel-handle=2796 /prefetch:13
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,15030685842719464308,16355076808160825079,2097152 --field-trial-handle=2304,i,15404395560205255494,16585808774744162234,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:5516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,10200407711692558106,15071129061713151041,2097152 --field-trial-handle=2304,i,15404395560205255494,16585808774744162234,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4180,i,14021851249365423933,4415987109415878964,2097152 --field-trial-handle=2304,i,15404395560205255494,16585808774744162234,262144 --variations-seed-version --mojo-platform-channel-handle=2588 /prefetch:9
  2⤵
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4168,i,16258061363893630053,4619139072716466016,2097152 --field-trial-handle=2304,i,15404395560205255494,16585808774744162234,262144 --variations-seed-version --mojo-platform-channel-handle=4820 /prefetch:1
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3988,i,1319623465573186301,3205887804804536928,524288 --field-trial-handle=2304,i,15404395560205255494,16585808774744162234,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:14
  2⤵
  PID:1168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,2281690583369197373,18262383900306298371,524288 --field-trial-handle=2304,i,15404395560205255494,16585808774744162234,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:14
  2⤵
  PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,5513360917840849246,769575327886160547,524288 --field-trial-handle=2304,i,15404395560205255494,16585808774744162234,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:14
  2⤵
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,5513360917840849246,769575327886160547,524288 --field-trial-handle=2304,i,15404395560205255494,16585808774744162234,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:14
  2⤵
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5060,i,6915604415293412656,17393704881184663345,524288 --field-trial-handle=2304,i,15404395560205255494,16585808774744162234,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:14
  2⤵
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5064,i,956065603336837168,18146878416289808001,524288 --field-trial-handle=2304,i,15404395560205255494,16585808774744162234,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:14
  2⤵
  PID:5840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5048,i,8423264741718869177,17182485845096172111,524288 --field-trial-handle=2304,i,15404395560205255494,16585808774744162234,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:14
  2⤵
  PID:6132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1892,i,7985439419221647178,4618303715020657954,524288 --field-trial-handle=2304,i,15404395560205255494,16585808774744162234,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:14
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6460,i,317693034904903760,3542067922591582473,262144 --field-trial-handle=2304,i,15404395560205255494,16585808774744162234,262144 --variations-seed-version --mojo-platform-channel-handle=6568 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3636,i,11728503123712315372,2693109923927923382,524288 --field-trial-handle=2304,i,15404395560205255494,16585808774744162234,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:14
  2⤵
  PID:1976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5632,i,11058097105359749942,2842428238430718415,524288 --field-trial-handle=2304,i,15404395560205255494,16585808774744162234,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:14
  2⤵
  PID:5924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6648,i,17098170703435696546,18158027658033744949,524288 --field-trial-handle=2304,i,15404395560205255494,16585808774744162234,262144 --variations-seed-version --mojo-platform-channel-handle=6788 /prefetch:14
  2⤵
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3340,i,8620871259754511496,9932266185034723500,524288 --field-trial-handle=2304,i,15404395560205255494,16585808774744162234,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:14
  2⤵
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6760,i,8732593286337660493,6471524731614466969,524288 --field-trial-handle=2304,i,15404395560205255494,16585808774744162234,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:14
  2⤵
  PID:6088

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2800

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1472

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1244

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:6020

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 da739d58d61b2ac7b5d9bb7ad60982cb15b364d9c7c9297fd0c9719c271cd985
MD5 2d2e0ac0da9a175b4b6a8be7c9d51cce
SHA1 ff15c8a5ff11faefae3f7491c7968a2163702b81
SHA512 0ae78f15909f04e1a81109917b8eeb5b8062a49558d8a40f15c02076b087f36e82b88b329e9d984fc68c62cb15408123b9db7f705f2745bfefc30b5aa2e164e6
TLSH
T1EAD09B5A72455D4CD641343224E55217E3108821754546194253F0768DD668717ABD9E
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 18a644ba613d5b4137dabc346f57eca622b6888922eaec751025ab3c0a002fd5
MD5 5eddc74c05def624cfd47ea0a7e304a5
SHA1 b5f795fcc3846bb781e66e0373fce119975b2659
SHA512 1c777d774c154e89b80817ce7344495d83eecf133c36e0ad7c60dd14d76e628697535cc3fc379ca4eeb776f3bea5096f94d0fd76a2394ecd2e52f5ca8dc0053f
TLSH
T133D09B5672455C4CD641343224E55217E3008821654546194353F0768DD668717ABD9A
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 c3f52db704ccb69d0f0c56785e648f0daeb9fead409c0a7ed4dfd9919c9ebd50
MD5 f317fc8338353d3d3dbf9b7ba5f5870f
SHA1 431714eae885444a06e38428abde6e14e849e2e1
SHA512 221061b365b705ff870f250c283a37432a5e99892995e274793bf7d25f18da4c565c4c1cd53dd814b238b0552124a7201ff0562df0d7e539fbb0969c21e9ba96
TLSH
T1E3E026E84CCCC22EE68868C751F8539ED2B03A0E93CCED1A5B048BC87002440F7C66D0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 2f1ae168a1cbea27e79fda52e973fa20682942c02ff95e3ffa1ec3940313316b
MD5 c54d00b1b506fa02524a6165e04a5288
SHA1 23fa31100dffc00d333ba5340487753387260d47
SHA512 c6cb7d0b5ceb30c879401380f47cb9034e2581fdcd90ee8be0a23dfcc3b85e8b80b1d9566547287e84eb1b826981723a9fa07b7ecc6401f5531e0d09e14583d3
TLSH
T197E026A886CCC22EF7087547D568838EC2A0B60B92C8EA1A37049BC97281440E6827D0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 f4188cddb8866f995ec17ae2b1927bec5d71bf7f14a4e12d7137a0f204caa6ce
MD5 4eb114be8011893546388049b4a2892e
SHA1 56e5e4f5937c6a8e0d0168adc637520ce2ea3542
SHA512 ea23f6ac1fb4f2a62282b98f8dd446b5b66208bad0c18b172e97eced608a8afa676318cbfbcfcf7b8ac6b323245ffc44929bc7d4220c7e59a80806a86492a4d5
TLSH
T17CE026AA54CDC62EEA4C64475178878FC2A0374F92C9F96A1704AD8D7043580F3A2690
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 b912c4f5bce486c036a24a8dc0af7a60c3440e6917ec9b94712e4724f2409890
MD5 a3fcc57afcca97da22a77c7fead37714
SHA1 43fbdf01e4bdc43f8b6160a19345e6b8be9760b1
SHA512 71db81f5bd8556571145cff68ddf716fea5b7343606245d2f60633572c3f9956c6da30a5aac28ab8cf22d5d011c55d9d4a0714e5c298e4ed06e2b6ec5487d9dc
TLSH
T18F61D674432229C1F7A499BA20E51294FBFEBC96A1072FD1C1409D31428EFF4A5F18E3
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59acff.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59acff.TMP
Size 3KB
SHA256 3f18c8a58bfc2e9cc9bb4cfdda8b48e37f7709f2daf39d3a8fe77e2dc8a1ecd3
MD5 7dddbcc7920d44b3e55a7363e0f2539b
SHA1 33810ba1b2e9c51165c4f13a81fab9085868fb5b
SHA512 c767704d23c82b5b10a5d0ad2718ed062ed019a81724b406015c15cde2d2e623634a9dbf5c95aee8325eaa7dad3052ce4213d52fd71a4a067cca530c476fa0ae
TLSH
T16361A474432229D1F7A499BA21E51285FBFEBC96A1072FD5C1409D31428EFF4A5F18E3
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 a79648b3d3793c8c3b5c364c0f194ab9c505cf7260015e6008033dc671fa1bb9
MD5 e8995f452c21bf6a3624c63e7101a394
SHA1 327b1a65313d9237670d3d73485d9a430d101b2e
SHA512 47a1ee8a38976324283e8c14616c1e5b3aa894f8c8e1248ce811a1f3155dbbf1c28c349da3403a0d653eef38545fd7d547b78a55abd4fecca1580a3ac5f82903
TLSH
T12F3180F747B5966EDA1196F0AA14AF1FCE2C0511431C7C6985E0AE2793F3472E041B6B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 35cb2f72824a5e1d60086bd0eca03bf75517caed20e88cb17606cfc2675e913d
MD5 b880e1021b2b01ebe955c9677f4e5a5f
SHA1 9e6591862f29e2c31d9986ab7dd3ff94746c3a61
SHA512 49c8d095ef7d2ba0577fd6d742d7d8635a9516194b5081d25408f1c70c16b742b54e5ba4215f027e37b53ffeab82c98c00402c0cd6d7010c0a7d229a175c6a74
TLSH
T1C43180F783B5857E8A1196F0AA14AE1FCE2C0515435C7C6589E0AE2793F3472E041A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 fad73881645c3ffd32981a3d83c6c5449a0e59c73f2cec0e8105457f265f5f32
MD5 5a58996d1ccc3be78590c932436714d8
SHA1 c1baa0140c0616ff6937a1b731fb4847f899d2e0
SHA512 1d36aceb274f4adb10c7d2a2d8845a72202e82d948a9bc7350fe88178b78b16163330e0b9b3cdd7da1d1decea815b3eea141951ee0b0fb344b1316fd8eb161e2
SSDEEP 192:sxR9RWbH/f+sROJYCbxzoA8p46/g6+WNIYEFy3DGPRIgDZJ:sxR9+H/f+sRoPsH/5IU4H
TLSH
T1B142B7156E28A93B9CC7E25DBA55BF53E7F9503260941E48BAFC861C00E76DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 03aedd43d9de6f5470782f99153420ca51d5f18bfb76000144850acf151a3eb2
MD5 d85d50a488c64f70723f39587f1cbaca
SHA1 749e4f405462a2c2651836260851156e2add4a60
SHA512 75311ac2efd49e2f92dc79738676504c066c25377f708799938417d63742c4c732c461e5fd737657cfee035360566fefdf4867724adcca5ccb6eee08bd8909fc
SSDEEP 192:sxRKRWbH/f+saOTYCbxzoA8p46/g6+WNIYEgM3DGPRIgIJ:sxRK+H/f+saWPsH/5I94s
TLSH
T12D32C7166E28A93B9CC7E25DFA65BF53D7F95032B0901E48BAFC861C04E76DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 5cc3b0804a1ed876b61e643d8f3899c5fe267d61855907a0ef89e1d58146745b
MD5 1fb6b54f208c3ec65c5c6b877dcc56c1
SHA1 ddcce4f6c648438149e276f6680f6c9f4ba415be
SHA512 abcfeabb6d6f9dd17805ff35a19e1e2a5d8a212bb4844146711ee9086af37462065a2a5545706499e14705814b1ab7707e59244540a3db5b7633cd70351f5e00
SSDEEP 192:sxR9RWbH/f+sROTYCbxzoA8p46/g6+WNIYEgM3DGPRIgDHJ:sxR9+H/f+sRWPsH/5I949
TLSH
T1FD32C7166E28A93B9CCBE25DFA55BF53D7F95032B0941E48BAFC861C04E76DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 2a2fdfbba475627b0b15d3543567280d0c97673f4feed7adb00954c3805909ce
MD5 b394ce7e8662d3bce46d8e589a740469
SHA1 08bb9ae549e9d16a3aa9350186fe7bcec88c993c
SHA512 3417c626be42d603048a3d225a476e10b517d8a77276603bd8c94dcefb023aa1d82100389ed6b0f8b0e30ab3499957f84a7bdb7afb5054c1fff19852cc3e590e
SSDEEP 384:40DxK6DJQD810DrfCtgQ6DRFfIQDFKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OV6:40Dk6DJQD810DbWgQ6DjfIQDF8F1+Uof
TLSH
T158B2DA2F640DCB7F5F804A9DAC196FDB6D9802C796988D8047FE990C02C77EE92194DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0c259ee3-ec75-49af-a8ff-a5f337b654d2\index-dir\the-real-index
Size 504B
SHA256 8ca9c98dcfa8014bb2aae661d9669706bca68e3034ba776a7e03dae075a4cee5
MD5 d1e6be53f53d968e87770e40faf4e10f
SHA1 766078714f6ebc0391fdded19dfaf388a621c522
SHA512 3ed8105911c4bc7efe55b981d3381196c0e32e65a04f4f31e18b475f38f3c800257afb2d6f39dbc8743c29d36b8e745a70a4016614ab11237c5bb9ca0ebb25b9
TLSH
T13BF068AF8CA5A847E926ACBB163A260A333F02FE21069E5E10AD6029A9155384650282
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5deb6c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0c259ee3-ec75-49af-a8ff-a5f337b654d2\index-dir\the-real-index~RFe5deb6c.TMP
Size 528B
SHA256 115911b313abf37e1bb1b8c531abb0f61fddff10adf0613c31d1bb0ee4d9be8e
MD5 8b56faf46011a0543eeb99291c33a4a7
SHA1 d7f978acce53424c2f7a192c1224f162ba93b900
SHA512 3793d680f2bc730222ca35eb0922fe64656e6083713dc266ecca45750cf93dbe310f700fbdaec268f622c5c8fc069ec4f71f99212b6f6eccee83567b08deea68
TLSH
T140F0C0EB40A1FC52D915A4F56216601A333F0C303775DA9FA09B342E5933ABC8682A46
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 9f3a6a010d284f343c76e910ca179025d01170f1e9d19ebd7ef8c40f3017fe42
MD5 893e228fe9d263214dd4945d20d2d2c6
SHA1 378ee834f99ed1b3d449fe1080a7539fc425e2a5
SHA512 8fb23ec9971d3cfcaee25455376b99042e534c3c99b1a816ac6ac9accc9746ee5f358ea57a91b6c665b335c464439932231a7fd8e0a8d8b60751ce16b0b8e9df
TLSH
T13CE0C0FB2CE71828EC7F83C32570C67101017828D148EC4E011A92C300B1376A88AD31
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 9d7eff99fef9358694e0c4450c4ab7f671ee62a553ba91fe1a701ad555eca54b
MD5 396ba2685494f9655e6cfdba74d53b9a
SHA1 970bd26fcf51ada86b51358762df6a5039f032b9
SHA512 da1c23ddfb58e0d31966deee7c59078ebd772e9693d58a24e1f18bb7391a5f762be1bbd8c8802564b6a255847a5942dec2844f6b9c08dcf74bb24ba74158508c
SSDEEP 96:KRVCbvlfjHWLQeg3HK4LURlTp5FWtC4gNFK40gjFcrzKtZ+2PaKQUOaiwKf5:CVCbvlfj2LQ/3dLURlTp5wtCZNv0gjaX
TLSH
T19591750072BF53003CBF6A0C91B499FB5283B0617019A56B7BA81596CFAAE07DDFD5C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 fa77c2bccf0c25a68562e9c605291ea7a19168b8d2b02ec18bcbd8fe63d3f40b
MD5 2f8a9300f6ca74ac87726cad79cae369
SHA1 80293f235339cbe3f982ea54aa0ffbfd134f1a27
SHA512 c452977914dd85ab6e483ba6be3b85f2c8bb0925af56943dbdeb5f08a0f50cf0c50b41816284f6e488ce81effa4e47db473c425ad2cc9902cb08ecf5ebdfc36e
SSDEEP 768:3rv+4UNbdG3qNvDTd+ZfIReX6+qTko0u229a4vsSyueVH1SdW:3bsbU3pfIgvVTVKa4jEH1h
TLSH
T1E903BE32E86999378DE2C7C5714B754B2FB95263C7C80B9098DD6B4C068B5AC230FE27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 9eb228d6608d9bdaf633780bd3e9c0707fbdef87a2ba1b877bfcf16c4dcc06f9
MD5 36e51597127f27b6c5fa5de86b0cf216
SHA1 f0817566825ed1c597cd9c19fa7774379dfebf4f
SHA512 09aad1a20f9d96cff5be5112bbbc1af03c11053863cb178b15f9c90b3e403e1778577a16c520c7753d1f8c2989308f0e448e46cbe28dc979f6590e91063ba93d
SSDEEP 768:WC3pVHU1DTd+ZfIieX6+qTko0u229a4vsTyuf5i:WC3pVffIRvVTVKa4Mf5i
TLSH
T1A9F2BE32ACA59C734CEAD3C5B21736476FB95263D7CC2A4099DCAB1C058B66C230BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 06b3ec082e3f575e1c48adbc1fb73623f8a2f22dc4e75e0249fa682ff6abf1b3
MD5 0a69d6d20323bfb4d03c403c302c03cc
SHA1 8471222849d61d28b1eee62646fdc9f2d9f8359f
SHA512 da6e99df9c2476a6557ab3a78c5fd8c695f09b0856678f7f5b4c04ac768e53c00923c5747c441ef70726ea2893d1f01d506e9eb44576170431ab7053d0557b14
SSDEEP 768:pC3YVHk1DTd+ZfIbeX6+qTko0u229a4vsTyuf5i:pC3YVPfIKvVTVKa4Mf5i
TLSH
T155F2AE32ACA59C774CEAC3C5B21736476FB95163D7CD2A4098DDAB1C058B66C230BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 27f880360f487bf48372181adcc2821b08ea20d0436f15c5ad49e562c16d75a5
MD5 5eff35cbd2b1ffa7784743297b1be764
SHA1 ee30620df1f7f238b6e074e070d4cbebd1094d99
SHA512 44000a64f8901c42fbc6f38065432f86ccee5442be142355bc20bd558a7a0da5cc390c9dc26e8e0bb0e073e233c89fd708bd8de1b19b8cb99adea6439c0b6856
SSDEEP 768:oT3pVHU1DTd+ZfIweX6+qTko0u229a4vsTyuf5i:oT3pVffIfvVTVKa4Mf5i
TLSH
T126F2AD32ACA59C774CEAD3C5B21736476FB95263D7CC2A4099DDAB1C058B66C230BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 d2155d34c490b53dd0b3417968a6191a20b4fb45aebf992e32debfc9b9b00a9e
MD5 b87fdd1490381538d02482c669228b76
SHA1 eddf25a6e440864f8b140bffbdc385a609b85562
SHA512 3196d00e4f2ad2a7169ebc892ac73606e03939988fd1f62d5faa75ce6559f9be72cc63966bcf70bbd126142775f783f599a6cb7e279c6b1d1105d97217f30b01
SSDEEP 768:prv+4UNbdG3JaqDTd+Zf3eX6+qTko0u229a4vsDyheVH1SdW:pbsbU3+fGvVTVKa4XEH1h
TLSH
T11203CE32E8A589778DE7D788724B75472FB95163C7C80B80D8ED6B0D069B1AC230BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download