hxxps://www[.]xeno[.]now/

Analysis

user interaction
yes
max time kernel
899s
max time network
899s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/08/2026, 02:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.xeno.now/
Sample260826-dfapsa1hmb

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
30	discord.com
31	discord.com
34	discord.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4704	msedge.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134321866207841787"	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1079202589-886135813-2527035092-1000\{5AB6A7EB-FD95-410C-8467-FF4F83481EA2}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4676	msedge.exe
4676	msedge.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
828	Process not Found
828	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 1236 wrote to memory of 1696	1236	msedge.exe	89
PID 1236 wrote to memory of 5912	1236	msedge.exe	91
PID 1236 wrote to memory of 4704	1236	msedge.exe	92
PID 1236 wrote to memory of 5912	1236	msedge.exe	91
PID 1236 wrote to memory of 5912	1236	msedge.exe	91
PID 1236 wrote to memory of 2760	1236	msedge.exe	93
PID 1236 wrote to memory of 2760	1236	msedge.exe	93
PID 1236 wrote to memory of 4284	1236	msedge.exe	94
PID 1236 wrote to memory of 4284	1236	msedge.exe	94
PID 1236 wrote to memory of 4284	1236	msedge.exe	94
PID 1236 wrote to memory of 3300	1236	msedge.exe	95
PID 1236 wrote to memory of 3300	1236	msedge.exe	95
PID 1236 wrote to memory of 3300	1236	msedge.exe	95
PID 1236 wrote to memory of 4228	1236	msedge.exe	96
PID 1236 wrote to memory of 3148	1236	msedge.exe	97
PID 1236 wrote to memory of 4228	1236	msedge.exe	96
PID 1236 wrote to memory of 4228	1236	msedge.exe	96
PID 1236 wrote to memory of 3148	1236	msedge.exe	97
PID 1236 wrote to memory of 3148	1236	msedge.exe	97
PID 1236 wrote to memory of 1076	1236	msedge.exe	99
PID 1236 wrote to memory of 1076	1236	msedge.exe	99
PID 1236 wrote to memory of 4808	1236	msedge.exe	100
PID 1236 wrote to memory of 4808	1236	msedge.exe	100
PID 1236 wrote to memory of 4528	1236	msedge.exe	103
PID 1236 wrote to memory of 5052	1236	msedge.exe	105
PID 1236 wrote to memory of 5052	1236	msedge.exe	105
PID 1236 wrote to memory of 5052	1236	msedge.exe	105
PID 1236 wrote to memory of 2144	1236	msedge.exe	106
PID 1236 wrote to memory of 2144	1236	msedge.exe	106
PID 1236 wrote to memory of 2144	1236	msedge.exe	106
PID 1236 wrote to memory of 5892	1236	msedge.exe	107
PID 1236 wrote to memory of 5892	1236	msedge.exe	107
PID 1236 wrote to memory of 5892	1236	msedge.exe	107
PID 1236 wrote to memory of 4572	1236	msedge.exe	108
PID 1236 wrote to memory of 4572	1236	msedge.exe	108
PID 1236 wrote to memory of 4572	1236	msedge.exe	108
PID 1236 wrote to memory of 1028	1236	msedge.exe	109
PID 1236 wrote to memory of 1028	1236	msedge.exe	109
PID 1236 wrote to memory of 1028	1236	msedge.exe	109
PID 1236 wrote to memory of 1384	1236	msedge.exe	110
PID 1236 wrote to memory of 1384	1236	msedge.exe	110
PID 1236 wrote to memory of 1384	1236	msedge.exe	110
PID 1236 wrote to memory of 1012	1236	msedge.exe	111
PID 1236 wrote to memory of 1012	1236	msedge.exe	111
PID 1236 wrote to memory of 1012	1236	msedge.exe	111
PID 1236 wrote to memory of 4140	1236	msedge.exe	113
PID 1236 wrote to memory of 5668	1236	msedge.exe	114
PID 1236 wrote to memory of 5816	1236	msedge.exe	115
PID 1236 wrote to memory of 4596	1236	msedge.exe	116
PID 1236 wrote to memory of 4596	1236	msedge.exe	116
PID 1236 wrote to memory of 4676	1236	msedge.exe	118
PID 1236 wrote to memory of 1128	1236	msedge.exe	119
PID 1236 wrote to memory of 1128	1236	msedge.exe	119
PID 1236 wrote to memory of 4360	1236	msedge.exe	120
PID 1236 wrote to memory of 4360	1236	msedge.exe	120
PID 1236 wrote to memory of 5864	1236	msedge.exe	121
PID 1236 wrote to memory of 5864	1236	msedge.exe	121
PID 1236 wrote to memory of 2604	1236	msedge.exe	122
PID 1236 wrote to memory of 2604	1236	msedge.exe	122
PID 1236 wrote to memory of 3560	1236	msedge.exe	123
PID 1236 wrote to memory of 3560	1236	msedge.exe	123
PID 1236 wrote to memory of 2992	1236	msedge.exe	125
PID 1236 wrote to memory of 2992	1236	msedge.exe	125

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.xeno.now/
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7fffdf9ec188,0x7fffdf9ec194,0x7fffdf9ec1a0
  2⤵
  PID:1696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1528,i,7840854137661230986,18464015937565659,262144 --field-trial-handle=2412,i,17231179630286456453,12663114359562534739,262144 --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:2
  2⤵
  PID:5912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1760,i,14066484763586698399,14025457058328326466,524288 --field-trial-handle=2412,i,17231179630286456453,12663114359562534739,262144 --variations-seed-version --mojo-platform-channel-handle=2528 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2296,i,10632060168749066852,13050884545490704801,524288 --field-trial-handle=2412,i,17231179630286456453,12663114359562534739,262144 --variations-seed-version --mojo-platform-channel-handle=3184 /prefetch:13
  2⤵
  PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3552,i,186618802419645964,9611210544668557271,2097152 --field-trial-handle=2412,i,17231179630286456453,12663114359562534739,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3572,i,3920812259998603454,5981904476413311956,2097152 --field-trial-handle=2412,i,17231179630286456453,12663114359562534739,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
  2⤵
  PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4200,i,18038877297119406709,446957417583051417,2097152 --field-trial-handle=2412,i,17231179630286456453,12663114359562534739,262144 --variations-seed-version --mojo-platform-channel-handle=4712 /prefetch:1
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4216,i,17445577162970234039,12796998380569706293,2097152 --field-trial-handle=2412,i,17231179630286456453,12663114359562534739,262144 --variations-seed-version --mojo-platform-channel-handle=4716 /prefetch:9
  2⤵
  PID:3148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3708,i,4875193062954582358,3161868300950715232,524288 --field-trial-handle=2412,i,17231179630286456453,12663114359562534739,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:14
  2⤵
  PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3540,i,13032323629265279961,5462045767654391007,524288 --field-trial-handle=2412,i,17231179630286456453,12663114359562534739,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:14
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,5277271242512671633,13451241666325293579,524288 --field-trial-handle=2412,i,17231179630286456453,12663114359562534739,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:14
  2⤵
  PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,5277271242512671633,13451241666325293579,524288 --field-trial-handle=2412,i,17231179630286456453,12663114359562534739,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:14
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5084,i,18118621150541102458,3774866977837328937,2097152 --field-trial-handle=2412,i,17231179630286456453,12663114359562534739,262144 --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:1
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4192,i,5547607510894765978,1761954338869697069,2097152 --field-trial-handle=2412,i,17231179630286456453,12663114359562534739,262144 --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:1
  2⤵
  PID:2144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4940,i,14173162045517586821,3638684108611395137,2097152 --field-trial-handle=2412,i,17231179630286456453,12663114359562534739,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:1
  2⤵
  PID:5892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6956,i,9733625415594975848,14475206527419157806,2097152 --field-trial-handle=2412,i,17231179630286456453,12663114359562534739,262144 --variations-seed-version --mojo-platform-channel-handle=6932 /prefetch:1
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6652,i,2333943033091350070,13618721086726648047,2097152 --field-trial-handle=2412,i,17231179630286456453,12663114359562534739,262144 --variations-seed-version --mojo-platform-channel-handle=6680 /prefetch:1
  2⤵
  PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6584,i,9433928496234583581,14799483653084912816,2097152 --field-trial-handle=2412,i,17231179630286456453,12663114359562534739,262144 --variations-seed-version --mojo-platform-channel-handle=7172 /prefetch:1
  2⤵
  PID:1384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=7304,i,137382700796726179,4464259144774703880,2097152 --field-trial-handle=2412,i,17231179630286456453,12663114359562534739,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:1
  2⤵
  PID:1012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,3907150504738518950,5956913892586445489,524288 --field-trial-handle=2412,i,17231179630286456453,12663114359562534739,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:14
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,7764444083850936338,8086592285637090891,524288 --field-trial-handle=2412,i,17231179630286456453,12663114359562534739,262144 --variations-seed-version --mojo-platform-channel-handle=6592 /prefetch:14
  2⤵
  PID:5668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,5666341640507705262,17315548230216127232,524288 --field-trial-handle=2412,i,17231179630286456453,12663114359562534739,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:14
  2⤵
  PID:5816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6636,i,6490573054620145635,8715343048224088253,524288 --field-trial-handle=2412,i,17231179630286456453,12663114359562534739,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:14
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6504,i,8778243335412279128,4377052618852427501,262144 --field-trial-handle=2412,i,17231179630286456453,12663114359562534739,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2912,i,1857067748418614413,4807963485727186088,524288 --field-trial-handle=2412,i,17231179630286456453,12663114359562534739,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:14
  2⤵
  PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5500,i,18053452485353609500,6853717568523845777,524288 --field-trial-handle=2412,i,17231179630286456453,12663114359562534739,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:14
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2160,i,1123827845961645636,2292537397318089139,524288 --field-trial-handle=2412,i,17231179630286456453,12663114359562534739,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:14
  2⤵
  PID:5864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5040,i,1748025604197162754,790551175984027552,524288 --field-trial-handle=2412,i,17231179630286456453,12663114359562534739,262144 --variations-seed-version --mojo-platform-channel-handle=7080 /prefetch:14
  2⤵
  PID:2604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3728,i,6184938611061538966,13001677351481318280,524288 --field-trial-handle=2412,i,17231179630286456453,12663114359562534739,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:14
  2⤵
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7104,i,3730603605605879260,11405794474084489154,524288 --field-trial-handle=2412,i,17231179630286456453,12663114359562534739,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:14
  2⤵
  PID:2992

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4936

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3088

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:200

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:3628

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2d6015222f1312f2737e561f5cb789cba16ddda90131d3af679ca4d112ce8de9
MD5 c1a7f665f2c508cc6aaf2ab720e9bbac
SHA1 f10047340073ccfd0dfa0a1ac50f19824703c6c6
SHA512 3b4b2c7997cc3a8e382662b8ab84779147222db6dcf3b614fe3750efba14aade687800978cd24780f580eacb766daa34fe0e560c30dde1f463983613dda767cb
TLSH
T188D092693B904E08C5C4207228E0A6A6A2604A31B82E024840A2B23CF8A5ED6073F4AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0c59160a51f6f3c09faaf3593a45b43a14b1da3961c2cccaed8346e6543c20e0
MD5 a2b289a93fce671046a365170f24567f
SHA1 d545bd953aab467815db42a92fd1d54047d5e6af
SHA512 ce7bb8aa1a40366ad652feb8233f60cd807014cb9e8ca999c2c1931eeb40a4afa1dc2c94c60d58639e2cece8c73d3a46da7a30c651ca6da0834f57b890bd2572
TLSH
T1CFD092653BA04E08C5C4207628E1A6A6A2504A31642E024841A2F23CF8A5ED6073F4AA
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 096955b22059633928974ef298d8d1d6153c303c02bdf051cd964a01a38d6494
MD5 a4deade9387314d7bc7dfe4dda3b2987
SHA1 d2ead02d4306ce03b159b97cadc5ac6bc390582e
SHA512 36ead97afad47c9f97237060e31cdf617847519a8594d6de805568979f944c5972a65b3f83328fff7c08afe6fd1a47907a7122a07a940a4ca7851518568d3e13
TLSH
T10BE0209605DCC3ADB50074C7A754434CC280370E93C4EE472700C4CE704218863C2764
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 2b781c9afa33643358350397ab7d514e404c4e8517e99e9342f0ae078041ef16
MD5 1eb3969a136739d4e06704d4852ed671
SHA1 48752db7b194b08009f5c14e6dd0ac6d27314b40
SHA512 bcc6cace1e9afc1062926a4aa121d48f51defc4b2f1a99b4151f8b7ad265ceb967ae0ef81e4c5ee93bbe55ef9280d5d9afcdf54fd4f31701be35b431bc47f180
TLSH
T10BE026F505DCC37EA750E8C7E269430CC2C0370BD2CCEA0A5B04848E7482040A2CAB90
MD5 SHA1 SHA512 TLSH

Submit Download

f_000051

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000051
Size 23KB
SHA256 4d374f815118157d4ec62c285937df74fec28c75d9eec110f48d3e04cb321ba8
MD5 ce7b262351203b245322fe75044fb61e
SHA1 46fc201fa3a9a56cb91f3a08f4a380f6d2283e0a
SHA512 0af2f8fa0171107ca26b73d1eeed9599c0b67953e163441bf65dc3a5bae5c9aa82bdcc54255996e8d1d472db1b09ba3286859d595619f1706a8e61c464081dff
SSDEEP 384:zApz2RXdsOYVa2CE00K/4dJfoLdmiJo0zADElg9jIKauH6CwJ6k5zRv2LbFq:oamOTZE0hAdJfoxmiJ9zdC9SpCwJoFq
TLSH
T130B2E1833404A6947BFF27130CF66A08E6B2B67BF63273054465483E42B52FA5B5977C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 dd6a1b9eb633abaaf6cdeb0c29d6794d7d18a73bd35a6e6b41ace1d987219ef7
MD5 bc90636fdff5843536d19f5712f0b03e
SHA1 1a7caadac096ab84d56eb0290f5d6c7be55ada3d
SHA512 2f138416806d15eba55bc65e04f0970f3f0f97cf78cb8458cd27d11c25bb6566af5bfc23ca48d7d2558931f4c4d10b4b34044eec6c3593dcc1bba8cc77d35e61
TLSH
T169517486C3EA89A8D725F9F663E1087A32F14492014F9F11B47D7EBC5656F4011DD83B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 26ff3a90a5a02fef1ca9b7bb4bfc33459d5b8965077ea206ec9a1b7c98065340
MD5 3ea84cefa1c402963296f974ff17ec8d
SHA1 f605242904b19dabad2cfcc34a4b02c1fb422447
SHA512 d231628dd62f07846ae295f8cdaf7e4eae199fdb882c6119c3e7a2bf91cf21775f0a527f93774cd34d934bf5f772874f3b09fb72d3c493d6b55afe9bb830b873
TLSH
T1A5515286C3EA89A8D765F9F563E0087A32F14492018F9F11B4BD7EBC5656F0011DD83B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59b57b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59b57b.TMP
Size 2KB
SHA256 455f81c169894ab8ea01af255af1284102f15f527e7459fb10856defd2ceef3e
MD5 d646575dd16e57753b3be52403f53f2f
SHA1 c008806a3dd4378985fb6c3af50e1274292e5a2d
SHA512 d6096d992d029531a6f4987ccaf8aaa97905696a6e0bf580caf6f351413d629cc94d72268984b4e529ce0a3395c6ef546f3a9bde31b2ca76864ec19d4b4e91b7
TLSH
T101513E97C3E689A9C764E5F263E1087932F55092014FEB21B07D7EBC5A86F0511DC43B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

70109c88-b17d-4952-a91e-9a40407035a1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\70109c88-b17d-4952-a91e-9a40407035a1.tmp
Size 11KB
SHA256 4324a26e8213da2ba856ce0074a2c429d5a708ddb32406f5aead1508934ee10f
MD5 f10bac3fc6c490164f9158307194df99
SHA1 96879de40149faf05b6ca809ef713aff840c9dd0
SHA512 885ee45d5ede719739a59783aa19c471fc7d2c4ac0c4d3939369978a8ab4fb6d5e3baafb65f17b61f82835a7a7aa17476bfa35ea27d360390db3d95da8a4e594
SSDEEP 192:DOjJ5PePhP4PUJP1PuPjPPeP/POPCPdPMAP2aaiZt1RIScxX6JkbPfIP/GPYyPjT:DOjJ5PePhP4PwP1PuPjPWP/POPCPdPjO
TLSH
T18C325BF7D7E4876D992156F89A142F1FCE2D1924431C3C3ACAD5AF0BA7E2870E20564E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 6ba9f973f4eb640670d8ee20ba6f7f2f1512581d8a23449a057616e1c64c2031
MD5 604a9244b72979597a166b9e6db2ef33
SHA1 04f3016fba292a16b179bfc0890c2bccc8c46ba0
SHA512 eeb1dfc2e3f0e641b6ed65c0fc97d34cc21aa6388eab4f1d7f28c268887e7e901d1e8b3626deb9989202c7b85026af651a737d9d78951501631c659d456210a9
SSDEEP 192:Dsa3sPMPgPuPJJPqP8PBPcePDPaPMPoPzAPx9PXaaiZt1RISMxu6J+bPfIP/GPYk:Dsa3sPMPgPuP3PqP8PBP9PDPaPMPoP0y
TLSH
T1BF126AF7D3F1876DAD2196F49A146F2FCE291924431C3C39CAD1AE079BE2871E20574A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 d2326c4a2c2216c34aa6d447e8830acb9481af3f75dae94156778da2b3f64d7f
MD5 10845aa9bdf50d10dbaa0b035323f714
SHA1 98a9db103a0a3f98b7264a85c3d961a3a0563941
SHA512 90edf5037b2339b164e86265cb5d94c4ddb000510f2b27ae9809f4973b6ae098e96cd149366f33dc11d8fc8cbe5fc98db0225248fd92a4d587913c8df451fd4c
SSDEEP 192:DOjJ5PePhP4PUJP1PuPjPCeP/POPCPdPMAPePJaaiZt1RIScxX6JkbPfIP/GPYyY:DOjJ5PePhP4PwP1PuPjPrP/POPCPdPjF
TLSH
T1F0325CF7D7E4876D992156F89A142F1FCE291D24431C3C3ACAD5AF0BA7E2870E20564E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 c2ef293e2ac7aa7ea1006a0f56c10d3d2d935de255d6fe76ca48e668fa256560
MD5 1d6582fb0659febb1acd9010293e5a4f
SHA1 8ddae435a526a7af14d04b59584da37f6f719c8c
SHA512 a11527f0155ec92266066f81369e811bf2b25d02a83f5f21d2cdd7c5896204805a64583332f78267b1e028f605f4d1ef97a80dc614c1ea2e11b45298d7009438
SSDEEP 192:sxR3R8br/fjsWIxHFSaxzoA8p+Y/g6+WN/F6/YbpyAXZ6BG6IgQJ:sxR30r/fjsWIxlSas3/54/06b0
TLSH
T11932A7166A28A97B8CC7D21DFB55BF53D6F91032A1D52E48B7FC861C04EB6DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 803618d4c820f7d33a31e0d19dfeb7a796dcbb2afd03329e6344e5fc279795e9
MD5 e13f21c604e9e0064eb6bd979d6f76ee
SHA1 4b9debf22e041d39bc52adf5eec8f917c3f904bc
SHA512 84db21c3ca204429c1d080e551f29d53ef11e93b3542e3dd8ad3ed566b82c97c7f45e4581b4c834ecdda243c11390681f364a8ff1ac4c0c667b6e6ed7b7de597
SSDEEP 192:sxRMR8br/fjs5IxHFSaxzoA8pgHY/g6+WN/zk34XYbB8yAXZ6BG6IgDwJ:sxRM0r/fjs5IxlSash/5zXB6bY
TLSH
T1BA42B716AA28E97B4CC7D21DFB55BF53D6F91032A1951E48B7FC861C04EB6DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 26KB
SHA256 2269c982b2a2490b3c34163c5c8a27d4c41befb0f83f767166aa722e2304fbea
MD5 d17dd3a6f74af97c8c3cf21a96ac1581
SHA1 51d9dc251862d5983960b4ced655b808f3f9bbe6
SHA512 a7ad9a8651539e36039c4add0441c4cad8028cc47a6bd4bd0c1ce724fbb64bdae67fb10c1fccbce3bff75f445120dd383f3e2c0302d8dfe91ecaf40c912424e0
SSDEEP 384:sxRM0r/fjs5Iw66s8qMpRiYnazAW8pZS15posJWeT++lSasv/5F/IXB6bS:s40r/fvw4Mnc7WeT++nI/5YB6+
TLSH
T11EC218059914C83B9FC35D18A97D7E33DAEC506221C5DEDA66ECCA0C01AE1FDAB07853
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 ff2b053eb3242a3340fe2474d180bae3b8ef137aefe3a17921f7857c8f209b1b
MD5 024cf652c84f0e572a6f857269307730
SHA1 8f71c9a99053ec32d8cb081562a989198b092570
SHA512 c2c27c28a18250e1b841093ddd42434a251360d042c7bee8aa1b5fde93e7231382ffe2ececf45e2263412b0b0681d95f81c5870ee074f8a62438653624c48fc7
SSDEEP 192:sxRMR8br/fjs5IJHFSaxzoA8pgHY/g6+WNFNoGszk34XYbCyAvZ6BG6IgDSJ:sxRM0r/fjs5IJlSash/5F/IXB6bS
TLSH
T1B342B556AA28AD7B4CC7E21DFB55BF53E2F9103260911E48B7FC860C00EB6DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 01a10c68070a84ea3a31c36edc5e1d2628f62cacdd71d9ec694874db7590df86
MD5 cfc4df0fc79163c235363d8927f0db6d
SHA1 2878803e622e08abfcbd0fc760ced94c5dd86bff
SHA512 04714a522fd92255366d0555c91bb426f5790479153a8fec6557577c49ce8539aba3fb435a48921d89b32c7bdc19237d94080035fb7660a90d76209b9ec297dd
SSDEEP 384:Flp1pABfCtgisFfq4KhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVnz98ERF4roAog:Fb1pAtWgikfq48F1+UoAYDCx9Tuqh0Vn
TLSH
T1ADB2DA3B200DCB7E5F801A9DEC19AFD76D9802C796988D4447FE994C02C77FA921A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\77a4afab-6748-42a0-94be-9e1dc7dc6818\index-dir\the-real-index
Size 144B
SHA256 a6c1d6c46ee5e8d06e1ce9432399bcdada4b39461beec77fe114edc04f7693e1
MD5 c6b730e633566e8ddea7042b3389c978
SHA1 062a946b47c47db81607ffa231b98485b91ae1cd
SHA512 0d5f6897e17052825831f2e6d3ef1e6868f2e49462593e4ca0071aeadd94e90431fd14b90825cea6ebb4e0e0054d9a7b05b8ab017c5c4a49e03e9edd96db93a8
TLSH
T1C5C09201CE6A4565C8066932216B206826720AAD09676E5A14EC5806A572859D0CBC19
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5d9cb0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\77a4afab-6748-42a0-94be-9e1dc7dc6818\index-dir\the-real-index~RFe5d9cb0.TMP
Size 144B
SHA256 8a7c91c697f362c3ed1e5491f5bb2689f9f4667d2dcc333aedb3b5dd52324e4e
MD5 573957d83af66f626621543a1dafc47d
SHA1 27dea10499b80f9e14eb089153d941f80da08019
SHA512 1b995106a1c8cfac6832cd63f7e45e44d048485476b1a0b27365f2aeccdb1b8d0c9c735a9e313154d3927be310c24e48aec7338e5043184e73eb79f031e4ee75
TLSH
T121C01212C96688B0C40B95701043835822AB5C340426F6AB60FD4C6F58B18C8D0CBD08
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 370B
SHA256 584a48bdae1930586242520d10a2afd20f03acfcaad52f12ea787ca77e79c4d2
MD5 87a826107e36b7d1f867f23789d40cf7
SHA1 f00979fc3d507366ee707d6bbfd64b34a1eb8035
SHA512 4fa570aeb7421d8a157e06cfa7ad0b6c6418e5219f9480e83027ecb74a69f81d4dfdf5dc3f6c73d47810885f3bb02a59e7b3fa97222b2e5463af35f2ec51e30d
TLSH
T15AE0D8B72EE62904FD6BD3C2143598F8040175598581ED6E192AE2E350B13963C8AD27
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

.usage

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\FileSystem\t\.usage
Size 24B
SHA256 fac0a85e4f5907c8036b0052214b777ddbacea9420e5903526272dc76bd4c7b6
MD5 e1edf83f1dbe0a1640e5800ef2f44b90
SHA1 58e8f31a1282e84a05c6960d6ab461d6ccef42cc
SHA512 151b19bcb34d72c304d02f2830f577036c5d2156499cb998643a87a3010544e5a4c236f8458786ea4b3416aaa4fd1ea96fc3bfe1ab0c5baebeac29e5427ca417
MD5 SHA1 SHA512

Submit Download

00000000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\FileSystem\t\00\00000000
Size 1B
SHA256 6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
MD5 93b885adfe0da089cdf634904fd59f71
SHA1 5ba93c9db0cff93f52b521d7420e43f6eda2784f
SHA512 b8244d028981d693af7b456af8efa4cad63d282e19ff14942c246e50d9351d22704a802a71c3580b6370de4ceb293c324a8423342557d4e5c38438f0e36910ee
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59f459.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59f459.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 110b2168daa17116688ce54fad91f80cd57690505528734794027b70113d9732
MD5 619340569af2a40310e18005ac1ac7a5
SHA1 f4db812722f1e7998d0998ca1397e252a1554d9e
SHA512 9d392a1a0f2f653b44b62b91df025e730e0b5901d0d075ca2b4058f61c437920f92d8016275b7faa3079697ed0d5c696100793b8eff96ddcb392d1638dfd495b
SSDEEP 768:N13YQNeBqobGaN0tZu4aWADIidy8Lu6Y0mGqqy:N13LtZzaNsuVLnY0muy
TLSH
T135F2AF79AC12CDB75CBAA284B7873A46AEF8D163D5C949D484DC1B0E10C75AE131BC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 c6b3bb401411c4fb9b4890becdb0c057947fb01d623c0d9a73a5ba72815295f2
MD5 9673d7f5c96b1ececb31bcadc31278b8
SHA1 198d3b68aec85a687462eca713c1204b62bd7526
SHA512 6f5d6a9412f1992b961018b54f17ae70a553e9a5c0a196e44a6479f137fa1b5040e23c844715fa3c01e4a261a407e9e90d69e353d5b45fe79fff5aec5ae66940
SSDEEP 768:0rv+4UNbdC3O+cBqobGaNQtZu4aWADIidy8Lu6YMMkt:0bsbw3PtZzaNsuVLnY2
TLSH
T15D03AE75FC19DEB39CB6A284B2873A077EF89163C5890AD488DD1B4E05CB4AE130BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 620fca2d91fa4a6b2d54c431a98732f0f1db5ec20ba430b3a10fd6561c0e4c86
MD5 a38da120a11f37c721dbe5803e05f31c
SHA1 86a1903deabd5d3659217a69751ad1db6430fb41
SHA512 b600490b381a1cc37dba738724796e49591e2418c064950f887dd2e4dfa0e8d47ab8038a2d0e9f7a6ce0639da0d4325a244f68368bc997bb3fda72be0f10a78b
SSDEEP 768:0FQ93NwgKQNeBqobGaNmtZu4aWADIidy8Lu6Y0mGqqy:X93DtZzaNsuVLnY0muy
TLSH
T11C03AF769D41CEBBACBA9784F7863606EEF481A3C5C999D495CC1A0E10D74ED130BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 988c3b345ab427a84455aa4b9a2e5093b66fbcb146189679fd1d4af0e997e47a
MD5 ce847186fee587a7a6b162259d7b05a7
SHA1 44c184fe183b9a6782d657ddee57da45d577791e
SHA512 aa205ff4923894817c0b829f3dd45d5f54afac94814a9c467d2b7f43f5ea42aba2d33c8451f89c92274b4a233bbd0ecb3dd8dc05abac527e8bd47c9f77a8d213
SSDEEP 768:drv+4UNbdC39AWBqobGaNOtZu4aWADIidy8Lb6YeVH1S1C:dbsbw3CtZzaNsuVLOYEH1d
TLSH
T1FF03CF36E859DA739CF7A284B1877A077EF89163C5890AD488CD1B4E45CB4ED130BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 e07f1d685fec065ac3fb046e9f406ba66758b791e27103e56ef53bf124881b2a
MD5 b36f2a03cacf856fe194b891d0185d71
SHA1 48909b25155bd0f7ba14d34ab9960761c5450eba
SHA512 ea366a8a6ad7b5d5c78425f213366e87524ea1c838d32b4850d2ea05c6f0996e7e7d57ed249e787664c859137d98a5e9ef98eb150b85207d65be817d5ddec406
SSDEEP 768:9rv+4UNbdC3JExBqobGaYpZu4aWADIidy8LqzeVH1S1C:9bsbw3HpZzaNsuVLEEH1d
TLSH
T15A03CF36A859CA739CF7A284B2877A077EF89163C6890AD4C8DC1B4E41DB4AD130BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 924e877bb3f1a7b398e466e81af82508d271464b1dca63d15612adb4beac607d
MD5 762f28d990a1d68f9d3bf992524bf34c
SHA1 41b689d1909c3e4004d8dc55618e3d80cbca8ddc
SHA512 26c4012e9efc0d3c1544b3b687f23a53956c250c8240840c0d6c3a02c4bcb0440bc796ff3d0530164c6e0d2e3fab7ef6a197e82c3e67cad08f304c71fd796f2b
TLSH
T17BE00451F100013FC03C077051C3D53015D0501011F10555D71041543C133041330FC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5a0428.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5a0428.TMP
Size 392B
SHA256 b343dfecceba071138182ad2d8c6a0f856a6da21f779e140edacb3e45da5ff60
MD5 396259897f04967556f06c666288b3fc
SHA1 623b7a5a0ff76578fc195052d70d4715b72da67c
SHA512 5ac4bbf555bc43714a5c23974882c94608fcd3d2b302d959d6c1cea210a0c64a1e574e9d4da6a324fe8529d936276131e994ff297b558aebd5a1dfece9d839dc
MD5 SHA1 SHA512

Submit Download

00f37b48-dc50-4056-91e7-e243c7c86ea1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\00f37b48-dc50-4056-91e7-e243c7c86ea1.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download