ae6fc5ba07dc314423a518f93b8ad69a5730df780669fd3b40283c32b24a56fc

Analysis

user interaction
yes
max time kernel
49s
max time network
49s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
30/09/2026, 19:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Xeno-v1.3.60/Xeno.exe
Size 164KB
Sample260930-yeacvashnd
SHA256 ae6fc5ba07dc314423a518f93b8ad69a5730df780669fd3b40283c32b24a56fc
MD5 6156707c90644ea4edb71f3044d1c8d9
SHA1 237a4262696840719021a53e9322ca1fd0d6fb0d
SHA512 8fc14005a4ec1cc372e7be1d64c12899a9f304f6002ef1c87bf510697c3ee9fb8753a042e6d2ef5dde6805f349b96847f09a19ab0fa5385ea7e7ee915054d13d
SSDEEP 3072:520jWfVKLer59aSpfO9D/87jXEkeFZA4nsSyU3i4w:MIhSpfO9jC/44Uhw
TLSH
T189F34B07A6A840BEE1B7D679C9924941FB723C558B71A6CF03507AB60F777D0AE39302
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
82	3928	msedge.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\windowsdesktop-runtime-9.0.20-win-x64.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3928	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1805035633-626948184-3225555471-1000\{B70C660C-2A2D-4527-A993-3B08AC91924F}	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\windowsdesktop-runtime-9.0.20-win-x64.exe:Zone.Identifier	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe

Suspicious use of FindShellTrayWindow 11 IoCs

pid	Process
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe

Suspicious use of WriteProcessMemory 59 IoCs

description	pid	Process	procid_target
PID 1412 wrote to memory of 3980	1412	Xeno.exe	79
PID 3980 wrote to memory of 4504	3980	msedge.exe	80
PID 3980 wrote to memory of 3928	3980	msedge.exe	81
PID 3980 wrote to memory of 3628	3980	msedge.exe	83
PID 3980 wrote to memory of 3628	3980	msedge.exe	83
PID 3980 wrote to memory of 2272	3980	msedge.exe	82
PID 3980 wrote to memory of 2272	3980	msedge.exe	82
PID 3980 wrote to memory of 2272	3980	msedge.exe	82
PID 3980 wrote to memory of 1904	3980	msedge.exe	85
PID 3980 wrote to memory of 1904	3980	msedge.exe	85
PID 3980 wrote to memory of 1904	3980	msedge.exe	85
PID 3980 wrote to memory of 3336	3980	msedge.exe	86
PID 3980 wrote to memory of 3336	3980	msedge.exe	86
PID 3980 wrote to memory of 3336	3980	msedge.exe	86
PID 3980 wrote to memory of 1804	3980	msedge.exe	88
PID 3980 wrote to memory of 2148	3980	msedge.exe	89
PID 3980 wrote to memory of 1804	3980	msedge.exe	88
PID 3980 wrote to memory of 1804	3980	msedge.exe	88
PID 3980 wrote to memory of 2148	3980	msedge.exe	89
PID 3980 wrote to memory of 2148	3980	msedge.exe	89
PID 3980 wrote to memory of 3040	3980	msedge.exe	90
PID 3980 wrote to memory of 1032	3980	msedge.exe	91
PID 3980 wrote to memory of 3040	3980	msedge.exe	90
PID 3980 wrote to memory of 3040	3980	msedge.exe	90
PID 3980 wrote to memory of 1032	3980	msedge.exe	91
PID 3980 wrote to memory of 1032	3980	msedge.exe	91
PID 3980 wrote to memory of 4860	3980	msedge.exe	92
PID 3980 wrote to memory of 4860	3980	msedge.exe	92
PID 3980 wrote to memory of 4436	3980	msedge.exe	93
PID 3980 wrote to memory of 4436	3980	msedge.exe	93
PID 3980 wrote to memory of 4868	3980	msedge.exe	95
PID 3980 wrote to memory of 4868	3980	msedge.exe	95
PID 3980 wrote to memory of 4868	3980	msedge.exe	95
PID 3980 wrote to memory of 4824	3980	msedge.exe	96
PID 3980 wrote to memory of 4824	3980	msedge.exe	96
PID 3980 wrote to memory of 2476	3980	msedge.exe	97
PID 3980 wrote to memory of 2476	3980	msedge.exe	97
PID 3980 wrote to memory of 2448	3980	msedge.exe	98
PID 3980 wrote to memory of 3644	3980	msedge.exe	100
PID 2448 wrote to memory of 5064	2448	msedge.exe	101
PID 3980 wrote to memory of 1048	3980	msedge.exe	102
PID 3980 wrote to memory of 1048	3980	msedge.exe	102
PID 3980 wrote to memory of 2484	3980	msedge.exe	103
PID 3980 wrote to memory of 2484	3980	msedge.exe	103
PID 3980 wrote to memory of 1808	3980	msedge.exe	104
PID 3980 wrote to memory of 1808	3980	msedge.exe	104
PID 3980 wrote to memory of 1764	3980	msedge.exe	105
PID 3980 wrote to memory of 1764	3980	msedge.exe	105
PID 3980 wrote to memory of 2312	3980	msedge.exe	106
PID 3980 wrote to memory of 2312	3980	msedge.exe	106
PID 3980 wrote to memory of 2248	3980	msedge.exe	107
PID 3980 wrote to memory of 2600	3980	msedge.exe	108
PID 3980 wrote to memory of 2248	3980	msedge.exe	107
PID 3980 wrote to memory of 2600	3980	msedge.exe	108
PID 3980 wrote to memory of 2600	3980	msedge.exe	108
PID 3980 wrote to memory of 1460	3980	msedge.exe	109
PID 3980 wrote to memory of 2584	3980	msedge.exe	110
PID 3980 wrote to memory of 832	3980	msedge.exe	111
PID 3980 wrote to memory of 5088	3980	msedge.exe	112

C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.60\Xeno.exe
"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.60\Xeno.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.NETCore.App&framework_version=9.0.0&arch=x64&rid=win-x64&os=win10&gui=true
  2⤵
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x374,0x7fff4c78c188,0x7fff4c78c194,0x7fff4c78c1a0
    3⤵
    PID:4504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1780,i,18108010663613540778,3932228490385653779,524288 --field-trial-handle=2536,i,16006036803196234794,13528235944921786290,262144 --variations-seed-version --mojo-platform-channel-handle=2584 /prefetch:11
    3⤵
    - Downloads MZ/PE file
    - System Time Discovery
    PID:3928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,15715550823397122335,11214801986873833155,262144 --field-trial-handle=2536,i,16006036803196234794,13528235944921786290,262144 --variations-seed-version --mojo-platform-channel-handle=2532 /prefetch:2
    3⤵
    PID:2272
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2120,i,3779462263222451547,12385179338012819957,524288 --field-trial-handle=2536,i,16006036803196234794,13528235944921786290,262144 --variations-seed-version --mojo-platform-channel-handle=2964 /prefetch:13
    3⤵
    PID:3628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3536,i,7849309981542241204,8081113796205743871,2097152 --field-trial-handle=2536,i,16006036803196234794,13528235944921786290,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
    3⤵
    PID:1904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3540,i,11968485556583018296,17667998623321594121,2097152 --field-trial-handle=2536,i,16006036803196234794,13528235944921786290,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
    3⤵
    PID:3336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,5011059467680533847,16808455744721327537,2097152 --field-trial-handle=2536,i,16006036803196234794,13528235944921786290,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:1
    3⤵
    PID:1804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4164,i,9023373535369771097,5080734922388729624,2097152 --field-trial-handle=2536,i,16006036803196234794,13528235944921786290,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:9
    3⤵
    PID:2148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4304,i,11447486068590140504,12825218773851597928,2097152 --field-trial-handle=2536,i,16006036803196234794,13528235944921786290,262144 --variations-seed-version --mojo-platform-channel-handle=4904 /prefetch:9
    3⤵
    PID:3040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4252,i,4794111659548952173,7828733957279919158,2097152 --field-trial-handle=2536,i,16006036803196234794,13528235944921786290,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:1
    3⤵
    PID:1032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5488,i,13732400057818508374,6466315161415496519,524288 --field-trial-handle=2536,i,16006036803196234794,13528235944921786290,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:14
    3⤵
    PID:4860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5648,i,991302789902219266,586614918370624839,524288 --field-trial-handle=2536,i,16006036803196234794,13528235944921786290,262144 --variations-seed-version --mojo-platform-channel-handle=4872 /prefetch:14
    3⤵
    PID:4436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5512,i,18334668121728057010,2242572288011212888,2097152 --field-trial-handle=2536,i,16006036803196234794,13528235944921786290,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:1
    3⤵
    PID:4868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5412,i,11518101192103012168,521397826605934726,524288 --field-trial-handle=2536,i,16006036803196234794,13528235944921786290,262144 --variations-seed-version --mojo-platform-channel-handle=3952 /prefetch:14
    3⤵
    PID:4824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4512,i,10207511620934443281,11595799361751805024,524288 --field-trial-handle=2536,i,16006036803196234794,13528235944921786290,262144 --variations-seed-version --mojo-platform-channel-handle=3988 /prefetch:14
    3⤵
    PID:2476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3520,i,16215651599191648702,15128855132517987198,524288 --field-trial-handle=2536,i,16006036803196234794,13528235944921786290,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1128
      4⤵
      PID:5064
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5276,i,6240655478203098450,15197317128233646293,524288 --field-trial-handle=2536,i,16006036803196234794,13528235944921786290,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:14
    3⤵
    PID:1268
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5276,i,6240655478203098450,15197317128233646293,524288 --field-trial-handle=2536,i,16006036803196234794,13528235944921786290,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:14
    3⤵
    PID:3644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6160,i,1376364976447356593,7598613226887306451,524288 --field-trial-handle=2536,i,16006036803196234794,13528235944921786290,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:14
    3⤵
    PID:1048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6516,i,7420804960761700685,5405336292225637857,524288 --field-trial-handle=2536,i,16006036803196234794,13528235944921786290,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:14
    3⤵
    PID:2484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6536,i,9973581551729496706,17362790065009975141,524288 --field-trial-handle=2536,i,16006036803196234794,13528235944921786290,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:14
    3⤵
    PID:1808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6916,i,6809144410481701726,6959965262729560687,524288 --field-trial-handle=2536,i,16006036803196234794,13528235944921786290,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:14
    3⤵
    PID:1764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6472,i,9625668623130312658,8937406692946140408,524288 --field-trial-handle=2536,i,16006036803196234794,13528235944921786290,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:14
    3⤵
    PID:2312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6916,i,682007803402251305,14134815952570796451,524288 --field-trial-handle=2536,i,16006036803196234794,13528235944921786290,262144 --variations-seed-version --mojo-platform-channel-handle=6924 /prefetch:14
    3⤵
    PID:2248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=6620,i,17175742740325181663,3551564365788734598,2097152 --field-trial-handle=2536,i,16006036803196234794,13528235944921786290,262144 --variations-seed-version --mojo-platform-channel-handle=6644 /prefetch:1
    3⤵
    PID:2600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7344,i,13591269100043485293,14040112810944730039,524288 --field-trial-handle=2536,i,16006036803196234794,13528235944921786290,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:14
    3⤵
    - Subvert Trust Controls: Mark-of-the-Web Bypass
    - NTFS ADS
    PID:1460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7336,i,652533258228567926,7992625138814181968,524288 --field-trial-handle=2536,i,16006036803196234794,13528235944921786290,262144 --variations-seed-version --mojo-platform-channel-handle=7328 /prefetch:14
    3⤵
    PID:2584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7344,i,8580516745757721373,4864889776855976571,524288 --field-trial-handle=2536,i,16006036803196234794,13528235944921786290,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:14
    3⤵
    PID:832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4280,i,2392195053066376161,5048320162114648697,524288 --field-trial-handle=2536,i,16006036803196234794,13528235944921786290,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:14
    3⤵
    PID:5088

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4848

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 0526a2a51e51d4fabd0b1d17ef03f5340c42a3dfcb2119ece19ca3fb7900a64d
MD5 844a3eca2c89c5806ce623a8aaa667a4
SHA1 92425b0bd5ebe6baf101dd06c4c2d65b1cabbe97
SHA512 19fb4fa602526e6121d2bbb2984c8130d972906c815cef03a10d6c046e88bc013fabfd2daed35ac6fc10b90eb453c529c4fb4c4b465fb957c45a55ec67aa247f
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7u:fwUQC5VwBIiElEd2K57P7u
TLSH
T1D2B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4eebdc04ff118e9cd3cbb614d205d2b777bd24419c5ba2ae742de33b0ae98212
MD5 40ad9518d5c77a0ba122e8109cc3c934
SHA1 3770983945ea6e6a8d5f74005f43d42a473cda6f
SHA512 c5dd104df7f9dfc246af8034f366c71afff1236b796e9a095503e2d67aa832edd20512ecc75a53cbdb4618c87af263d88078adcaaf2e02b99f0651281f9fa7e9
TLSH
T1D5D002D5FB40B684D271197B2E6D871DCB0CC7795253F204B25C099A1D8415EA593895
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 495cbc944027e77a92a9ec89f9f3d49fef1a3c8d6a49799d028c6b0ddd2d141f
MD5 042a221b60b748c6310e6d0d9626df94
SHA1 2876a7f41c1f36216b42f732121be6ec3876fab0
SHA512 2903ed725a107d712af334a0b0dcc8d21fd9fda84ff7d91bb8785bec500bd52e3f1695b8399f2dbade924fe5bf796aee0029c03098f145a5013d86ece00c1e3b
TLSH
T157D08094DD64BFD4E131143D17354115B54C966657437105B14C0D564D5418755D2CE5
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 c5106cbbb22c540baca4d6f70a8989eb3921eef8c0887df6934e48010ccd0671
MD5 0b10db246295e3a14371440060ec1c48
SHA1 176a4ab2bd8ba69ab2f5d2b316b6b7c80ddbc469
SHA512 76309014732b415f3fbe07bed2598aad1ac895f8a0a8e732ad7f5e0c4678c48c9031f462474fd8177c640d52b8f344e0129362dd41b9cf7c3f1e36e8c7b70e2f
TLSH
T15E612E52B8D040D2F7B8923C8699E0867237BE87DBC62ED30F9BC5B8AC0630C5157C50
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5988ae.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5988ae.TMP
Size 3KB
SHA256 ce77c8e70f20be02d56b535deb0e89e2abcbb5b0c5fbd483bd90e4ee0a4a94c1
MD5 3eb675a25931e3c0188c809422cc189d
SHA1 0999a0f8f5ace2e9a91acb82a77e108d13c1d158
SHA512 529805a6d512f8a098f994d9e2a5cf2675d7e0fb4ad73071cad299fb399980f9e4df2a8a2e39f968274535658b88d52a0cb04754fce129f23c70ff2274b79446
TLSH
T17D512A55B9D080D2F7B8927C86D5E086763BBE93EBC22ED30F6AC4B88C0670D1053C90
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 b2b6ca0a0fe7e4080f2a2db0e40f7091fcf35094945226caaaa25677032a255b
MD5 88c6fb05ecf4e60a69dff83b58fc7557
SHA1 41a6914baa227f3874a47b65ed968a641bacad33
SHA512 d8a7ecc64efae637bcf068e6c725b8b929d7b66d4a0b4edcde61bcec110a61ef1bae8b8a50077cd0f2a1cac175f1a6c50eb65c1d16d5058b703f143946fcbd64
SSDEEP 3:MsEllllkEthXllkl2zEkl8a5l:/M/xT02zn8m
TLSH
T1F544041D7FC10405CD0054304411D3504370F5100D1357433C7105337DC75410C00000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 a9c94abc8f364e7725adb0731d5245ace999ebe9b0107a969a1fa25bd49da977
MD5 ea33c2b54b0b7c198e98d62486ac22b4
SHA1 8bbb82d4a17c2caef1c44d1ef72fad9051d70ff3
SHA512 97e9362c2e7c265a0830b74b2b8a0164c1e73accece5253c21048f11df3386973ac127ccd6ffcac68b5cd998a2cf79482c6d2ac731bb220e8fce952afc0c2683
TLSH
T1DF619EF787F4856E8A0496F09A14EE2FDF2D0615431C7C6989D4EE27D3E34B2E00265B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 70fed6c310e68f6c73dcd8c0d6bf7f48e4f0f8c45488b4c5354674e86eccd512
MD5 f0b47b52d63ee5a63caa38a53f960b46
SHA1 dca77cb9e28ec4ae9db0949810feda5aebf7bd05
SHA512 0f39c3ca9aa46f34e510c95d46f101492ad1eac7817a9cac0f03087b689c194ff8a7b988c4b02d73b47dce65704826ab4a1fba04c1dcde2dc598baec3b6eb6aa
SSDEEP 192:sxZpR9eU/fhsQvPT6LIdpfY/W6+WNrBe/A+0nFyTbIg4J:sxZpaU/fhsGPTzQ/bk/Gw3c
TLSH
T10732E812AE74A97B8CCBD219BA55BF53E2F9143291C11E4CAAFC861C05E76DD2207C0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 60fdacd58ebc32727fdccbc27a03b2362db03f8d39b308d31ea3bcd16ee4c431
MD5 33779045ff91ef3bb9b7c85205ece87d
SHA1 97f81d871939b3060f4f512921a3a4c99e418ad4
SHA512 2664656633805bf68bac28073f70862e2a836fd79dc495be67e54a087f07d819c9857c1946253af5a961f621b99571f7b4b82c88a50414e3977b2d21ec1ea739
SSDEEP 192:sxZpR8TU/fhsxvbWpVPT6oIIdpfY/W6+WNH9Be/A+0Hayu1IgbLdJ:sxZpQU/fhsNbWvPTF5Q/bW/Grm/
TLSH
T14B42D912B974A97B8CCBD219BA55BF63E6F9143291D11E4CA6FC8A1C01E77DD2207C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 64d35cc5cdd7ee96a2273b14f9491cbedab5e0d6fc8f710dad73c7abe097e15b
MD5 5b957012c2542b085a8d220138c111eb
SHA1 b45ca86caf077c826bca4ca81e0eab412dc04f4d
SHA512 d73c214ef097a73777de4b02465d3d35d4c205fd3f9bc40dd789a0716d3c9f0864a1f82ab6efb2de449f7cf1f1e7f821108c6761ecf7f534a9f83e72369d56ce
SSDEEP 192:sxZpR9TU/fhsxvPT6LIdpfY/W6+WNrBe/A+0nPyTbIg5LDJ:sxZpHU/fhsNPTzQ/bk/G63/
TLSH
T16332E712AE74A97B8CCBD219BA55BF53E2F9143291D11E4CAAFC861C05E76DD2207C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 33KB
SHA256 3781f2b6a65efc39e5d18383f473dac16f122489dac905216f05b89fada7d993
MD5 92bd9b26a0e4c91899e47ce94970a6f5
SHA1 13223f0c304166c9690a2f7018b834713ef78f05
SHA512 7792c7fd1dad8ce42e67b89beddb2ed434db2716d122688ae21644302f7b35882e2268929af387ffcb6997928382bde634460ab8c73f5e63885a9b12cf46a98a
SSDEEP 768:xVnwK8sN2UO7pLuLMosWRmkUQ3z8F1+UoAYDCx9Tuqh0VfUC9xbog/OV33KoYLlz:xVnwK8sN2UOEMosWRmkUQ3zu1jaK3KoE
TLSH
T1DCF2FA3B780CCA7E4FD04A9DDD166F9F6DE8028B9698C94047FA885C02C77EE51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 e20092edc954a88b4b0e4ce951dc949b02286cd013a157d98b3ee07ac7f35d36
MD5 a4d3146e8192a8638605fb5bf3d1c131
SHA1 e518bf2f681f35658436642e53fb7c826f15e6a0
SHA512 8f45c50547401171e304381dcca17a7b2ff58b74e5c990ce56f7e4eb4a36c77e1ae5b0b13b5ea2f05f44f62cd094b874715d5fc3927064192d9e319e06cec623
SSDEEP 24:KVmfZE7koVeikyeowPI7wkK8HhkCk12o0Soaur+o5yXrsrsQqIZKYhs1yS9KhyXT:KYXIBKwAE/ytVIZKOs0byRmIXK/60W
TLSH
T17491ED0734BA06443DBE291992F59B1F069531737028E6BA7FBD40B69A27E180DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 1f6c691669809dd06bd105ffeda59396f367330d469ad6b74ca53d9d70fba5d7
MD5 c77d04f8cda8878960cc895d73ccfdea
SHA1 622e6d43cd0f87b707fb7d874919283e18f43386
SHA512 74b3185bf197be7a000e34c792434a29c222578d1584a0051692115fab8e61bff89dc8198de2d1ee2068489502acdaf4acca276262c70e31a94b410f2f35dc79
SSDEEP 384:n9ZcIh8NnnDGaMh+CedvdUptgOIwZOy7LsoC:lhbJeEpXs0w1
TLSH
T1C2827C319CB9ACAB19FBE106F08B36439FB45477A9C4AF48E5E99B1D009169C270BC02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 bfb66d48f2716c8cdea5b664fa2b8b8dfe103929492db2a2085f079521f793db
MD5 50003a430c374947552580d873683e1c
SHA1 1aa5b731bb4ba3ff3f35f40bfe54f869d11f43b8
SHA512 7097c8b58cca7df1476936c8628a3cefb6788a6b2a75f014c392c0dfb9e47f36cbabb2098ad60a7c403209bc73d172f68e7332ec5486941d12a937959f643f54
SSDEEP 384:nSZcI38NyODGaop+Cedvd1p/OtMo+Kwx3tgOIwZOy7LsoC:g35JelAth+Kwx3Xs0w1
TLSH
T1B8B25B3D8CA99C7F44BEF304A18E2A235EA80137E5B45A98E3E88B0CC07159CFB07D15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 ce5890980db6a5ade10df61d49aef3e9d4f8418f2aa72c33a5ed900349df5458
MD5 8500947664a6e191d44fe2aba7b0c118
SHA1 d1ccd134dd1dc61967d59e83a10ca63ab158cc48
SHA512 bed383745d4388ad9c36d76eb6f59d208065bd3b074a25ece78888e0be5abae623fd033876f3cbedca972a0cb813ae08a9a6e1c8f236bb3c1601b950480bde28
SSDEEP 384:nHZcI38NnLDGaMh+CedvdUptgOIwZOy7LsoC:v3PJeEpXs0w1
TLSH
T180826B319CB9ACAB19FBE106F08A76439FB45477A9C4AF49E5ED8B1D009169C270BC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6a6c0c3a7f2b1238e766d41a8865f8e6effa92ed1be5a98d4410d3c73adec81d
MD5 3b41c970fc9f6b9d4e8e08752d421bf2
SHA1 00155a5ad64fc7a75004e8c362e7bd80d7f71096
SHA512 5f20678fc0a39bcb69caa30a8d46b6ff240e948ec045ba833deed966f592c79be7899574664c348bd27d780285f858befc04f6e57111372225ae25794cb7d6c3
SSDEEP 192:ZGNd6f15sQmiUypEIzuLzFEjW+FdvdyG8YHU6:ZGNd6tGOhu/edvd4CU6
TLSH
T16502C835AC786C6B9EE3EE45F4876613AFE5113BA9D56F84D6E81E2C00D765C2302823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9a8b698310473c2e228cd52aa9c648fde9eb1b93a9a130bba60f3a35ffb9563d
MD5 5cc5a2591236a22d9397180325114ec4
SHA1 c42c6027f6e36323e990e26afe86825483c0fb3e
SHA512 e9824f566955f90c9f3fb9b06597511fe8d800149db46b276dca91d3ec51523017e2ca5eb9eddc0e68033d45377a79dc55463b247d4720a38a4028b28baa9b1c
SSDEEP 192:ZGN66f15SQmiUyIz6LzFEjW+FdvdSDuKXbqPZ8U6:ZGN66tAl6/edvd0pU6
TLSH
T19A12E831A8B9AC6B1EE7F545F0873693AED41077AD857F89E6D84A1C00D665C3B0B813
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9b47832a-b509-4aae-819f-ef8641c9dd28.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\9b47832a-b509-4aae-819f-ef8641c9dd28.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

60933e1e-905d-4d62-9784-7afe206e4a94.tmp

Path C:\Users\Admin\AppData\Local\Temp\60933e1e-905d-4d62-9784-7afe206e4a94.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bb21029d-b409-464c-95ba-722438062bca.tmp

Path C:\Users\Admin\AppData\Local\Temp\bb21029d-b409-464c-95ba-722438062bca.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

853bb3de-eff0-4923-bfff-fe3d839b2e3e.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3980_2063135843\853bb3de-eff0-4923-bfff-fe3d839b2e3e.tmp
Size 157KB
SHA256 e03138d37406c2bedec93e5a7c44a457a6b19cf4fee5dfe5a46450fcea1bf85e
MD5 088d09e1a5cd1db2f55a4f5131b75b3b
SHA1 4e017079555c92f2f9419a53ab89aae7c5425550
SHA512 f8e7a1652d20778af9e0aefef0f24bb477260eefd5c6cecd3b4e17276b7d6c8d79554e850b9a9fdd9c65095ae16dad8868df304ee7a057ec7cea5a35b9e526ad
SSDEEP 3072:sA30KAb7L7nAnBPxnb8b4HpQgHY15vClaH4d6r1tx:sAkKAb7L0Qb4HpQgoq8tx
TLSH
T182F3E1AD2FEE891ACD0B50BD3B04B38BC90A8F07820A655F735F8015997475D17A2DFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3980_537361711\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windowsdesktop-runtime-9.0.20-win-x64.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\windowsdesktop-runtime-9.0.20-win-x64.exe:Zone.Identifier
Size 185B
SHA256 649c0f8951261b6426a7c008f5e8c02ab05816504326b8f87b44fbb0df0d4b06
MD5 17c827f97b35b1dc7b4a120b7069e6c3
SHA1 54432424c88c849c079bcdb596e51dbf51e12f93
SHA512 1c3d3405dc8016b0556c61d017f896786ec3c5d095418117535318f43f419d7e0bfc0ba9bd3d6a74a324c2c96aaa8c8631201ae5fcb8b9bd08c2febb1116f31e
TLSH
T1D0C0125BC40045420E3022864B6ED668EA0F1D524D81D3DC8CC5C092EA53DDAC191891
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads