ae6fc5ba07dc314423a518f93b8ad69a5730df780669fd3b40283c32b24a56fc

Analysis

max time kernel
149s
max time network
154s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
23/08/2026, 03:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Xeno-v1.3.60/Xeno.exe
Size 164KB
Sample260823-dndfmsscnd
SHA256 ae6fc5ba07dc314423a518f93b8ad69a5730df780669fd3b40283c32b24a56fc
MD5 6156707c90644ea4edb71f3044d1c8d9
SHA1 237a4262696840719021a53e9322ca1fd0d6fb0d
SHA512 8fc14005a4ec1cc372e7be1d64c12899a9f304f6002ef1c87bf510697c3ee9fb8753a042e6d2ef5dde6805f349b96847f09a19ab0fa5385ea7e7ee915054d13d
SSDEEP 3072:520jWfVKLer59aSpfO9D/87jXEkeFZA4nsSyU3i4w:MIhSpfO9jC/44Uhw
TLSH
T189F34B07A6A840BEE1B7D679C9924941FB723C558B71A6CF03507AB60F777D0AE39302
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence ransomware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
89	3408	msedge.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1224_1839513180\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1224_1520559776\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1224_965784280\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1224_1839513180\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1224_1520559776\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1224_1270444933\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1224_1270444933\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1224_1270444933\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1224_1270444933\smart_switch_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3408	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134319284995706152"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4146128427-3460078792-3629963422-1000\{864EEE42-8760-4682-8B42-5F1D5A5E26AD}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4292	msedge.exe
4292	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe

Suspicious use of FindShellTrayWindow 13 IoCs

pid	Process
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 560 wrote to memory of 1224	560	Xeno.exe	83
PID 1224 wrote to memory of 2576	1224	msedge.exe	84
PID 1224 wrote to memory of 3408	1224	msedge.exe	85
PID 1224 wrote to memory of 3640	1224	msedge.exe	86
PID 1224 wrote to memory of 3640	1224	msedge.exe	86
PID 1224 wrote to memory of 3640	1224	msedge.exe	86
PID 1224 wrote to memory of 2656	1224	msedge.exe	87
PID 1224 wrote to memory of 2656	1224	msedge.exe	87
PID 1224 wrote to memory of 1476	1224	msedge.exe	88
PID 1224 wrote to memory of 3808	1224	msedge.exe	89
PID 1224 wrote to memory of 1476	1224	msedge.exe	88
PID 1224 wrote to memory of 1476	1224	msedge.exe	88
PID 1224 wrote to memory of 3808	1224	msedge.exe	89
PID 1224 wrote to memory of 3808	1224	msedge.exe	89
PID 1224 wrote to memory of 4324	1224	msedge.exe	91
PID 1224 wrote to memory of 4324	1224	msedge.exe	91
PID 1224 wrote to memory of 4324	1224	msedge.exe	91
PID 1224 wrote to memory of 4812	1224	msedge.exe	92
PID 1224 wrote to memory of 4812	1224	msedge.exe	92
PID 1224 wrote to memory of 4812	1224	msedge.exe	92
PID 1224 wrote to memory of 4456	1224	msedge.exe	95
PID 1224 wrote to memory of 4456	1224	msedge.exe	95
PID 1224 wrote to memory of 5072	1224	msedge.exe	96
PID 1224 wrote to memory of 5072	1224	msedge.exe	96
PID 1224 wrote to memory of 4696	1224	msedge.exe	100
PID 1224 wrote to memory of 4696	1224	msedge.exe	100
PID 1224 wrote to memory of 4696	1224	msedge.exe	100
PID 1224 wrote to memory of 1852	1224	msedge.exe	101
PID 1224 wrote to memory of 2260	1224	msedge.exe	102
PID 1224 wrote to memory of 1852	1224	msedge.exe	101
PID 1224 wrote to memory of 2260	1224	msedge.exe	102
PID 1224 wrote to memory of 2308	1224	msedge.exe	104
PID 1224 wrote to memory of 4688	1224	msedge.exe	105
PID 1224 wrote to memory of 4688	1224	msedge.exe	105
PID 1224 wrote to memory of 1768	1224	msedge.exe	106
PID 1224 wrote to memory of 1768	1224	msedge.exe	106
PID 1224 wrote to memory of 1696	1224	msedge.exe	107
PID 1224 wrote to memory of 1696	1224	msedge.exe	107
PID 1224 wrote to memory of 4120	1224	msedge.exe	108
PID 1224 wrote to memory of 4120	1224	msedge.exe	108
PID 1224 wrote to memory of 824	1224	msedge.exe	109
PID 1224 wrote to memory of 824	1224	msedge.exe	109
PID 1224 wrote to memory of 1480	1224	msedge.exe	110
PID 1224 wrote to memory of 4828	1224	msedge.exe	111
PID 1224 wrote to memory of 1480	1224	msedge.exe	110
PID 1224 wrote to memory of 4828	1224	msedge.exe	111
PID 1224 wrote to memory of 4828	1224	msedge.exe	111
PID 1224 wrote to memory of 4740	1224	msedge.exe	116
PID 1224 wrote to memory of 1788	1224	msedge.exe	120
PID 1224 wrote to memory of 1136	1224	msedge.exe	121
PID 1224 wrote to memory of 3740	1224	msedge.exe	122
PID 1224 wrote to memory of 4984	1224	msedge.exe	123
PID 1224 wrote to memory of 4984	1224	msedge.exe	123
PID 1224 wrote to memory of 268	1224	msedge.exe	126
PID 1224 wrote to memory of 268	1224	msedge.exe	126
PID 1224 wrote to memory of 4620	1224	msedge.exe	127
PID 1224 wrote to memory of 4620	1224	msedge.exe	127
PID 1224 wrote to memory of 4572	1224	msedge.exe	128
PID 1224 wrote to memory of 4572	1224	msedge.exe	128
PID 1224 wrote to memory of 4292	1224	msedge.exe	129
PID 1224 wrote to memory of 4976	1224	msedge.exe	130
PID 1224 wrote to memory of 4976	1224	msedge.exe	130

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.60\Xeno.exe
"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.60\Xeno.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.NETCore.App&framework_version=9.0.0&arch=x64&rid=win-x64&os=win10&gui=true
  2⤵
  - Drops file in Windows directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x2fc,0x7ff95566c188,0x7ff95566c194,0x7ff95566c1a0
    3⤵
    PID:2576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1940,i,8856790949084690996,9637928657260541308,524288 --field-trial-handle=2316,i,17763968125919211619,3066429562950484119,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:3
    3⤵
    - Downloads MZ/PE file
    - System Time Discovery
    PID:3408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1756,i,555998492923320550,15222810723685089321,262144 --field-trial-handle=2316,i,17763968125919211619,3066429562950484119,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:2
    3⤵
    PID:3640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2476,i,1649029546531096816,17912978724008353095,524288 --field-trial-handle=2316,i,17763968125919211619,3066429562950484119,262144 --variations-seed-version --mojo-platform-channel-handle=2604 /prefetch:8
    3⤵
    PID:2656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,3462404277243855570,4606418323610482488,2097152 --field-trial-handle=2316,i,17763968125919211619,3066429562950484119,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
    3⤵
    PID:1476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,6474425201999592899,7442367795678547307,2097152 --field-trial-handle=2316,i,17763968125919211619,3066429562950484119,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
    3⤵
    PID:3808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4124,i,15014014465572873861,11469198558533224606,2097152 --field-trial-handle=2316,i,17763968125919211619,3066429562950484119,262144 --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:1
    3⤵
    PID:4324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4136,i,2887938581917709885,16880215472296777139,2097152 --field-trial-handle=2316,i,17763968125919211619,3066429562950484119,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:2
    3⤵
    PID:4812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3628,i,17287259303712112150,8552310956203229710,524288 --field-trial-handle=2316,i,17763968125919211619,3066429562950484119,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:8
    3⤵
    PID:4456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5020,i,8040914160152653288,4306812013596610784,524288 --field-trial-handle=2316,i,17763968125919211619,3066429562950484119,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:8
    3⤵
    PID:5072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3644,i,8519900819042135239,752914427216227060,2097152 --field-trial-handle=2316,i,17763968125919211619,3066429562950484119,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:1
    3⤵
    PID:4696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3560,i,16562848232695960485,9835212411248717494,524288 --field-trial-handle=2316,i,17763968125919211619,3066429562950484119,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:8
    3⤵
    PID:1852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3548,i,7665585178736515343,6169865155567009437,524288 --field-trial-handle=2316,i,17763968125919211619,3066429562950484119,262144 --variations-seed-version --mojo-platform-channel-handle=2596 /prefetch:8
    3⤵
    PID:2260
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5768,i,14909869638479548616,392143113655941729,524288 --field-trial-handle=2316,i,17763968125919211619,3066429562950484119,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:8
    3⤵
    PID:3812
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5768,i,14909869638479548616,392143113655941729,524288 --field-trial-handle=2316,i,17763968125919211619,3066429562950484119,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:8
    3⤵
    PID:2308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,3793935923921110243,587523535840928012,524288 --field-trial-handle=2316,i,17763968125919211619,3066429562950484119,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
    3⤵
    PID:4688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,15238553514659329625,181147518606000838,524288 --field-trial-handle=2316,i,17763968125919211619,3066429562950484119,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:8
    3⤵
    PID:1768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6180,i,1876766524182517676,2558255880837716177,524288 --field-trial-handle=2316,i,17763968125919211619,3066429562950484119,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:8
    3⤵
    PID:1696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5984,i,16168714998687126915,16404031500381908946,524288 --field-trial-handle=2316,i,17763968125919211619,3066429562950484119,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:8
    3⤵
    PID:4120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5580,i,6915944932088637582,5063027301442703291,524288 --field-trial-handle=2316,i,17763968125919211619,3066429562950484119,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:8
    3⤵
    PID:824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6348,i,9888758536318524167,13902484558212696968,524288 --field-trial-handle=2316,i,17763968125919211619,3066429562950484119,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:8
    3⤵
    PID:1480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6340,i,5129268642038357231,4350163954863131909,2097152 --field-trial-handle=2316,i,17763968125919211619,3066429562950484119,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:1
    3⤵
    PID:4828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6936,i,16822385532344373527,16342895108368823288,524288 --field-trial-handle=2316,i,17763968125919211619,3066429562950484119,262144 --variations-seed-version --mojo-platform-channel-handle=6948 /prefetch:8
    3⤵
    PID:4740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7024,i,6513534395245119414,1265528797010169263,524288 --field-trial-handle=2316,i,17763968125919211619,3066429562950484119,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:8
    3⤵
    PID:1788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7028,i,10001352337574878840,12561757824680910693,524288 --field-trial-handle=2316,i,17763968125919211619,3066429562950484119,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:8
    3⤵
    PID:1136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4576,i,13060543714909128385,6636949163518724305,524288 --field-trial-handle=2316,i,17763968125919211619,3066429562950484119,262144 --variations-seed-version --mojo-platform-channel-handle=4732 /prefetch:8
    3⤵
    PID:3740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,9511331306194474380,6047565058499344753,524288 --field-trial-handle=2316,i,17763968125919211619,3066429562950484119,262144 --variations-seed-version --mojo-platform-channel-handle=6540 /prefetch:8
    3⤵
    PID:4984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5328,i,4359507641449792862,7448101604706493638,524288 --field-trial-handle=2316,i,17763968125919211619,3066429562950484119,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:8
    3⤵
    PID:268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4576,i,10081027987963266367,16630160866753564580,524288 --field-trial-handle=2316,i,17763968125919211619,3066429562950484119,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:8
    3⤵
    PID:4620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4732,i,2140843451145271083,387532331511769958,524288 --field-trial-handle=2316,i,17763968125919211619,3066429562950484119,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:8
    3⤵
    PID:4572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5476,i,2658691643827169703,11820511167044255143,262144 --field-trial-handle=2316,i,17763968125919211619,3066429562950484119,262144 --variations-seed-version --mojo-platform-channel-handle=5740 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5616,i,7033337214719525562,5069897504863627732,524288 --field-trial-handle=2316,i,17763968125919211619,3066429562950484119,262144 --variations-seed-version --mojo-platform-channel-handle=3084 /prefetch:8
    3⤵
    PID:4976

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1748

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bd5dff6b6a2953b678276fe774acb1020dcf956eee918258c4fbcebd9799de50
MD5 ad9e9cc59d40b3c4a865c23e526c194b
SHA1 ec6e5c23153f46461256dc2ee3316df628e2eda9
SHA512 781d6d2d74c84caa1d22367f03cb2eef3a2125624c47277182248dc2b092992ad8756b1ea9759b2d56ee2b90c008cd691688382416e421209d33f546892f8550
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P74:fwUQC5VwBIiElEd2K57P74
TLSH
T14FB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e51b9bee3c2dbb63afcbacc2cde944a53371e66aaf1c8ba0bf71c7ee6eab83a5
MD5 2857cf1b0f1c8c30a6b756a34a37a836
SHA1 b21564c162ba15d8314ad459931f7f7c36b82ddb
SHA512 9fbd8c2a41b37b8a8425570de1371b59602556a9f89dcecaf471ea286b3538f518e368873fcf7b34ac36d9a7de7577953a1abe80c4995e05e1202c1b270d8dab
TLSH
T1F9D012232A5DB011FB695274A812CB00173655A024868711E211C49C96741D862D7587
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7a531d1df9cdae01b650e532ebd4a8c9a4289931e89fb896753dce715d03331d
MD5 e993dcf44300205328a008fa868eaab8
SHA1 005ea0762927bd4df122a5932c9a47e268573e57
SHA512 021dc142847ba30397366fece985ced0649c66fc9ddfa58b99261463107dce9ca4fc43a79aa0b2985989883dd5a6644c2fe5b1c87d24a8455123f7d724943ff2
TLSH
T1D6D012232A9DB411FB695274A812CB00173655A024868711E211C49C86741D862D7587
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 37b02dd93034980d9d51859fc7a2d6c466650377e48433359a11ec24c857ddc9
MD5 9316c6c3e28bb472f075e5141abb9674
SHA1 40d48811518846af3050e5d1dbe313045045959a
SHA512 206e9bdadccc79efee44967a83fc86607d0c4bf6f6a69dd2ad8b7e08e0a36b0e8e39ab4ba97bfe951cc8eca6b7aaddc517b5ebc19b7268c2d256ba7b06c7ed3e
TLSH
T15D816D075D8AA0A0EB0F64FD4881C20A34F1968459575EFE50F0DD34AA397EDB8F6D4D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58bd21.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58bd21.TMP
Size 3KB
SHA256 715c96bf20e6aded172f9bb843fbf6ef59f777185e11315d3469057724144a3d
MD5 87032a06a0f199f830b46f60669dd9d2
SHA1 955fadb70959b2e290c8fa8ca9eaf4d29a29872b
SHA512 f197879579b47ec3ccef5b9d39941024099a5f21bebe30659ec99230bb9aeeb50901ec19607ef8f3174210fbaec7c1522cea2f509d6a80ea7a137fb437cdb1e3
TLSH
T1A9714B074D4A84A0EB5F64FD9982C20834F1969449575EFE40F0DD34AA387EDB8F5D4C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 9cdbcfeeb9e81a641da52debb54a5f2b0c95367d46b0e9e14506d8b35b3425e6
MD5 ee8c60ad56b8abb4d2bcd6ccbdfa6ad1
SHA1 4051ca871d0ccb817a295d22b501324d827c6135
SHA512 25f7b3d4884add9857522f765c20f1c0717180d3ab5b36344e0b104e7a9a7e59feae7918f17525f756779444274e0f1c0c1a4d8a48dd09b167cee5b941ddfd0d
TLSH
T1A8619CF787B4856ECA0196F09A18EE2FDF2D0615431C3C6989E4EE27D7E3472E10265B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 70e06ddde989650c34743ba97e20cdec42752d8e54b60df3715c442b49b03dac
MD5 fe12239170d445aeaeb8993dd21fe999
SHA1 55b69dbf6bda546418a1dfbbbe55de95132f80ed
SHA512 639fadff43fd3c583a47e235a7287e6c580e17bc695507bdc56d246937eec1db93691f4d9c2df31877784e7120d4fb3b1b13f5068fe65e11f5a8cb5382ecee0a
SSDEEP 192:sxZwR6yM/jK1Ml8Mzr/fPs4TYFzbiSp0kmIdpwtHW6+WNr96/AscDNahF5Ig4J:sxZwoLr/fPs4UFfRpnkHbM/bc
TLSH
T1CD52E901AA34A977CCDBD209F955BF53D6F5452392940E88AEFCDA1C00E6AED2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 f5586b811a54db6c83be450cd0efefd5e784ca2e32853214d5c20e1d88b92233
MD5 432ca9408b58aa9f5b747201f602dfd6
SHA1 5873b7fb7e91a2de8aa9495f1145b5c4c355ccbe
SHA512 432604025da9a9662ec39727ca18bf35994c1de9b04a38fa556a3bdcd6cafa9351693c1ae44acfbb0d5c3cb2a70f782c0b05113eded6dfbf64a0f132264cba61
SSDEEP 192:sxZwR6yM/jK1Ml8UQGzr/fPs9TYdzbiSp0kmIdp6tHW6+WNr96/AscDjtncF5IgN:sxZwoqCr/fPs9UdfRpneHbM/wYN
TLSH
T1C862E801AA349D77CCDBE209B555BF53D7F5442292940E88AEFCDA1C00E6AED221BC1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 3a94bd23bd4042c9a402d0a88cd7b0972b35045d5cf03c6093feb0fa76510571
MD5 b378748925a7927d3e20bb85d59480dd
SHA1 92ea8df1c38e76f0edd3e2910baae27ab3257d18
SHA512 6ad87a278394bb30c3f54bd25668f5603f3ffcf31865f3dcac1e6bc527ce46d7106abb4080f04392ea6eb3f9ba57bf43977bba2c5b915050b9d49578b2f5e430
SSDEEP 768:gD4RkYn7pLuLzsUWvssLg8F1+UoAYDCx9Tuqh0VfUC9xbog/OVz8JTLlLBER/rob:gD4RkYhEzsUWvssLgu1jam8JTLBWRsfT
TLSH
T12AF20D7B2C0CCB7E4F844E9CEC2ABE9A6EE8018F9798895447F9444C03C66EB51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 6b245ed2bad4c6eb4927beb65ec07de787d5de90a04c00074330a93e45ea3e5c
MD5 c278b07a51cd4ab8f5c091c6a3837a87
SHA1 532de2e2ba988a604707373809f887a987b70cc3
SHA512 d6f69dea73a0082371f51501f2332e9e807fe43494ccc00229f578b01992cf6583332f875ecece80ecf90f958e7e409ed3563490785d8fe17945ecee28bba05b
SSDEEP 48:KUQI3Kl2cDyJ4IrKFycTyE2dyGUY8c0oDHIb+cKSJqccmWMljEWByEQLQiQdQZQF:KUQwKl2C64wKFyi+/WK08K2BCKSIe
TLSH
T1F8C17802327A0A9138BE65489B73C7375E4231B33018E6AF7B6D45960D6BE115DFCACD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ccd60ad9-a439-4989-81ea-45ee50853ce5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ccd60ad9-a439-4989-81ea-45ee50853ce5.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

5a56efca-9c5d-4eb8-a0e4-e48cc01a3936.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\5a56efca-9c5d-4eb8-a0e4-e48cc01a3936.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 17ee73fed8898d786d846a496a51e8bd7559b3366689eb943faa8cb3cc46f366
MD5 8a448d06c2e221bfcac5b5fa1f2d80d1
SHA1 9330be4941f951a88c54ced9b1baa8d42c802b24
SHA512 60240d6c6faa57ce4d2d4fcc167298d2308627f171245c2a84f69dc52cd336e5eca009db5379c00184c297d2b6d550ee8280affcff93a8fa7927849cf89abdfb
SSDEEP 384:nqZcIhsNmk8DCF4x+dQ4sw24ALLkJ+2FinBivB+a6Wo8:IhDCu+3ALL2lFinBi5l6W3
TLSH
T178829D705878AC3259F7F105F5873A17AFB8907796C8AF58D9D8CF1C00EA698270B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 cffede4c910e227e35a402f08454d143ba976240da0d2454221abdfb7ed51533
MD5 b76210ba4dc047735eed3578abe49bea
SHA1 750003bc3ad3b2e0b939bf360d4c0dee34682842
SHA512 7b56e53cfcc096274a6f8978f0f62e78e1720b7c05a0f78242c1eaf6f0b4779019656d41ce446da04c591eb60e8386a9352f5235e64fe9f37d239867e0c58a3e
SSDEEP 384:n+iFiZcItsNm8TUNTUlIlk8DCF4oc+mDfweQ4sw24ALLkJ+2FWzBivB+a6Wo8:VFQtTwgfCBcye3ALL2lFWzBi5l6W3
TLSH
T187D2C7F188E79936D8AE9783A73E6D069EBCC06375889994F7C45D0CCC961BFC30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 ae27c536024b517802ddb727f075bea5d3981ebb5fffa8da85130f6185950c7d
MD5 74f6bdce191b887693c89d38d67b3f90
SHA1 8aabbe09225c98b7475bb865d343c5154165edcc
SHA512 cdea91926babc465566baf552914302b271daa8a8bc11f99f09984f84da6af233ffab891883c1383452e2f00b76af3c0ef07fa0b4257933b63ad2ff6290c99c2
SSDEEP 192:uuPzLsN5UkKQkC8p4mZQmiU1gux4dQ4sw24ALLkRv+2FiseBEqttU8:nXsNmkKDCF4x+dQ4sw24ALLkJ+2FinBN
TLSH
T1AB3209306878AC364EF7B555F1473A23AFE411779AC4AF58DAE88A0C40DB29C270F916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d1dda173ebaab2e1dbaaa633ea14d48d6a806e5e33eddc56f05ba258c0b687af
MD5 cdd8a702bd422d54c14371b60ef15fb2
SHA1 c0d81f5b8fbf944c93b037264368461a73bceb08
SHA512 85469934073b411623c1ec200453c1151a62320b0e6c38d0c1be24a77391cf1efd02bb292168c9d0dfd867bd0d1ae331596e6dbad336103625f6b8ef61c766c5
SSDEEP 192:lONd6JpdQmiUy2UgcQ4sw24ALnsFHFhU6:lONd6jQgcQ4sw24ALnkLU6
TLSH
T1A102C735AD787C7A8EF3AD05F5873B276FA4113BE6906B54DAE81E0C40DB25C1307926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 42e7d64344dc5e2ed4fdc9c87d3ef1e03eba07938cbe5d75955cd4981b6121b3
MD5 a1f58d155ad0d8c8478774d77224d517
SHA1 bdca3871ebd3697312f1dc0e80d7dd4c26c98cbf
SHA512 b18b30d06da0df9a1865390c8194ceef8e16d6c1f35ee16502562e6087f82fa2ebccc50821e1c8fc1d545d5f80ecf0fc451ba902735864b1380421f8ba4fc6b1
SSDEEP 192:wJONFh6Jp4QmiUyvUjGcQ4sw24ALLkRv+2FTshsEqttU6:WONv6AZ6cQ4sw24ALLkJ+2FT7BU6
TLSH
T14912F974A8B8BC675EE3A515F4873A239FE42277DA84AF54DAD84E0C40DB24C270F916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

aac46757-530a-4288-80e9-3f6076820fe9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\aac46757-530a-4288-80e9-3f6076820fe9.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 7f1a450b4454ae31c919c23757962fd6b91e357f338b4beb45322ff43a75ec27
MD5 fdb4760076a03fd61eb8d6bb8e7e1bc7
SHA1 72244748613bbfb9d840366a9f88fbdddbb1c453
SHA512 3c0108f2b2b76274e9c6b694cc43dcc281ea7606df490b9e313bc831a90821ef934a972a3cab6f93885931508160b64265b26ab4c1daba2d083dbabed14a0ff0
TLSH
T109412998A7FD1158B3B77E5A6BB3A96D487F78372F06D09D10110E4E0562E00C871733
MD5 SHA1 SHA512 TLSH

Submit Download

55995fbb-24d5-467a-8b7f-447ec388e9d3.tmp

Path C:\Users\Admin\AppData\Local\Temp\55995fbb-24d5-467a-8b7f-447ec388e9d3.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1224_1042885124\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2308-526-0x00000257F2440000-0x00000257F259B000-memory.dmp

Download

memory/2308-525-0x00000257F2440000-0x00000257F259B000-memory.dmp

Download