hxxps://www[.]x-code[.]org/#install

Analysis

user interaction
yes
max time kernel
64s
max time network
69s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
01/10/2026, 09:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.x-code.org/#install
Sample261001-ll2dpatdnc

Score

8^/10

discovery execution

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
53	5976	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
816	xcode.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe
\??\F:\	powershell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
524	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	xcode.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	xcode.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4372	msedge.exe
5148	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3353145205-3618084634-580274525-1000\{329198C5-B93A-4B5F-BF74-F1010B348461}	msedge.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
5976	powershell.exe
5976	powershell.exe
5976	powershell.exe
5976	powershell.exe
5728	powershell.exe
5728	powershell.exe
5728	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5976	powershell.exe
Token: SeDebugPrivilege	5728	powershell.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 4932 wrote to memory of 4996	4932	msedge.exe	82
PID 4932 wrote to memory of 4372	4932	msedge.exe	83
PID 4932 wrote to memory of 5936	4932	msedge.exe	84
PID 4932 wrote to memory of 5936	4932	msedge.exe	84
PID 4932 wrote to memory of 5936	4932	msedge.exe	84
PID 4932 wrote to memory of 4296	4932	msedge.exe	86
PID 4932 wrote to memory of 4296	4932	msedge.exe	86
PID 4932 wrote to memory of 5188	4932	msedge.exe	87
PID 4932 wrote to memory of 5188	4932	msedge.exe	87
PID 4932 wrote to memory of 5188	4932	msedge.exe	87
PID 4932 wrote to memory of 964	4932	msedge.exe	88
PID 4932 wrote to memory of 964	4932	msedge.exe	88
PID 4932 wrote to memory of 964	4932	msedge.exe	88
PID 4932 wrote to memory of 5724	4932	msedge.exe	93
PID 4932 wrote to memory of 3892	4932	msedge.exe	94
PID 4932 wrote to memory of 5724	4932	msedge.exe	93
PID 4932 wrote to memory of 3892	4932	msedge.exe	94
PID 4932 wrote to memory of 992	4932	msedge.exe	98
PID 5976 wrote to memory of 4008	5976	powershell.exe	114
PID 4008 wrote to memory of 5080	4008	csc.exe	115
PID 4932 wrote to memory of 620	4932	msedge.exe	117
PID 4932 wrote to memory of 2104	4932	msedge.exe	118
PID 4932 wrote to memory of 5704	4932	msedge.exe	119
PID 5728 wrote to memory of 816	5728	powershell.exe	122
PID 816 wrote to memory of 524	816	xcode.exe	123
PID 816 wrote to memory of 6060	816	xcode.exe	125
PID 4932 wrote to memory of 2204	4932	msedge.exe	126
PID 4932 wrote to memory of 2204	4932	msedge.exe	126
PID 4932 wrote to memory of 2204	4932	msedge.exe	126
PID 4932 wrote to memory of 4172	4932	msedge.exe	127
PID 4932 wrote to memory of 4172	4932	msedge.exe	127
PID 4932 wrote to memory of 4360	4932	msedge.exe	128
PID 4360 wrote to memory of 568	4360	msedge.exe	129
PID 4360 wrote to memory of 1888	4360	msedge.exe	131
PID 4360 wrote to memory of 5148	4360	msedge.exe	130
PID 4360 wrote to memory of 1888	4360	msedge.exe	131
PID 4360 wrote to memory of 1888	4360	msedge.exe	131

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.x-code.org/#install
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x270,0x7ffe3ee1c188,0x7ffe3ee1c194,0x7ffe3ee1c1a0
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1956,i,14376523181566131460,15020025451709244987,524288 --field-trial-handle=2336,i,3924236235069575148,12143285730381001283,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1752,i,1022575029283352338,3565312136780613971,262144 --field-trial-handle=2336,i,3924236235069575148,12143285730381001283,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:2
  2⤵
  PID:5936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2504,i,12489997808910288275,7329997457071434780,524288 --field-trial-handle=2336,i,3924236235069575148,12143285730381001283,262144 --variations-seed-version --mojo-platform-channel-handle=2512 /prefetch:8
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,5558317231400899557,13708682362367635451,2097152 --field-trial-handle=2336,i,3924236235069575148,12143285730381001283,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:5188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,17989587788826286049,754299911138943945,2097152 --field-trial-handle=2336,i,3924236235069575148,12143285730381001283,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4984,i,4128621676577427535,15445334763124270353,524288 --field-trial-handle=2336,i,3924236235069575148,12143285730381001283,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:8
  2⤵
  PID:5724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5024,i,2089012348295730872,15930438400496463689,524288 --field-trial-handle=2336,i,3924236235069575148,12143285730381001283,262144 --variations-seed-version --mojo-platform-channel-handle=4872 /prefetch:8
  2⤵
  PID:3892
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5724,i,2318744876422522760,11469290126578554234,524288 --field-trial-handle=2336,i,3924236235069575148,12143285730381001283,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:8
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5724,i,2318744876422522760,11469290126578554234,524288 --field-trial-handle=2336,i,3924236235069575148,12143285730381001283,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:8
  2⤵
  PID:992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5940,i,5262355773323143099,8147265601840377470,524288 --field-trial-handle=2336,i,3924236235069575148,12143285730381001283,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  PID:620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6228,i,7754034944653338970,4950459912446727681,524288 --field-trial-handle=2336,i,3924236235069575148,12143285730381001283,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:8
  2⤵
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6232,i,7755029591228841424,15063458728204281811,524288 --field-trial-handle=2336,i,3924236235069575148,12143285730381001283,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:8
  2⤵
  PID:5704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6328,i,7794958264386455398,14605007826781337528,2097152 --field-trial-handle=2336,i,3924236235069575148,12143285730381001283,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:1
  2⤵
  PID:2204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,665895952481422926,363598241690064804,524288 --field-trial-handle=2336,i,3924236235069575148,12143285730381001283,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:8
  2⤵
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Enumerates system info in registry
  - Suspicious use of WriteProcessMemory
  PID:4360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x308,0x7ffe3ee1c188,0x7ffe3ee1c194,0x7ffe3ee1c1a0
    3⤵
    PID:568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1824,i,11232204871719458862,6176671945455530651,524288 --field-trial-handle=2260,i,12033781300695874799,7735460265717636227,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:3
    3⤵
    - System Time Discovery
    PID:5148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1664,i,12300429498934732417,14697416384299690808,262144 --field-trial-handle=2260,i,12033781300695874799,7735460265717636227,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:2
    3⤵
    PID:1888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2616,i,16005592277438608072,6614761812914866274,524288 --field-trial-handle=2260,i,12033781300695874799,7735460265717636227,262144 --variations-seed-version --mojo-platform-channel-handle=2824 /prefetch:8
    3⤵
    PID:5232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4360,i,14949132206570984669,284725167859109538,524288 --field-trial-handle=2260,i,12033781300695874799,7735460265717636227,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:8
    3⤵
    PID:5780
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4528,i,13155853220696174441,10438375132738678216,524288 --field-trial-handle=2260,i,12033781300695874799,7735460265717636227,262144 --variations-seed-version --mojo-platform-channel-handle=4544 /prefetch:8
    3⤵
    PID:5732
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4528,i,13155853220696174441,10438375132738678216,524288 --field-trial-handle=2260,i,12033781300695874799,7735460265717636227,262144 --variations-seed-version --mojo-platform-channel-handle=4544 /prefetch:8
    3⤵
    PID:6060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4468,i,5504265350814260572,15719520158285763939,524288 --field-trial-handle=2260,i,12033781300695874799,7735460265717636227,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:8
    3⤵
    PID:5184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4484,i,7808960936594653267,16812135338500645074,524288 --field-trial-handle=2260,i,12033781300695874799,7735460265717636227,262144 --variations-seed-version --mojo-platform-channel-handle=4760 /prefetch:8
    3⤵
    PID:5752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4800,i,13880331372341164732,9748383958320394702,524288 --field-trial-handle=2260,i,12033781300695874799,7735460265717636227,262144 --variations-seed-version --mojo-platform-channel-handle=4768 /prefetch:8
    3⤵
    PID:5872

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5576

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4004

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5976
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\s5e4evh0\s5e4evh0.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4008
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEF4D.tmp" "c:\Users\Admin\AppData\Local\Temp\s5e4evh0\CSC38A6A7539FD444A1913C171B13EA638C.TMP"
    3⤵
    PID:5080

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
1⤵
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5728
- C:\Users\Admin\AppData\Local\Programs\XCode\xcode.exe
  "C:\Users\Admin\AppData\Local\Programs\XCode\xcode.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of WriteProcessMemory
  PID:816
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /d /s /c "npx -y [email protected]"
    3⤵
    - Executes a command shell one-liner
    PID:524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.x-code.org/connect?port=50224&state=yrSVh305glD6ONEEOLwsZFZkzsbwG3g5&challenge=SPNA5rEMIlIVSRDELqOL1m-CkiP9t9K7pmmLKpTMA10&name=Dzcpmcci
    3⤵
    PID:6060

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:232

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 5c82db7a0c93d60606256c513ecc38d7443fb4fec0278e8e79ea7e603fa2b280
MD5 59337168721568103a6bd24837fea34d
SHA1 cb116f19c7a5a377e38867ccd3fb00a014ff3212
SHA512 e3d16b95209199ec2871afc60c39f9a45d98ddd75ab23011e40a77a7bc31c05b83da414b6ad9e663262f9b2e1ce172b39919a000347fc76b3f837be909fb3df5
TLSH
T17D71CB313275B0E4C9567F07192819C063BF8396FA98AF5CB66C521ED92740BDB222F3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3a90bea09e212134dc17388b25f224d71e49ca39dcc69bc19702622e77398e31
MD5 1b78c171c4c68630e5b7ebb32c84e785
SHA1 91cf5dd71c41350998b7d2281087fdcfdebe69c1
SHA512 ea0518551e5ebe409c443be54112086677308fdab24beab120e4553deb487efb00bf47a7a850d5952ae98f894136b4b665897af533998d21b0bdebe2ab6f9313
TLSH
T130D0244CF5FCD054D413103FC3304F4033C5C5545103F001C04433550C477030754050
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 77d8f9655e8605dacf9173174ed3d4e541b8abb9b2a53720558cdf09a3f90fe0
MD5 aebdd585defde2f356ce7acd7dee3778
SHA1 28457b1a7c107598e128a5b603a19b45c1aa9308
SHA512 4728ae6158fd005dfd4f86822aa41121fae41905b50764ca02d36b88b5073a3720c6d1831a5d0581a27c6273e0344e9733f61e8f7aab3f5c5b64728b3611e38d
TLSH
T127D0C008E9FCA5E0E035103F83300A4032C8069153036101910415050C5134309908D4
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 167066c68967c1c574330cab4ab09e3254a680626c412ca22b8e31fc099946b6
MD5 187f5ace274c2f9ec3062953b23f8f46
SHA1 ee844c97a6069ad6977c267241393a342befaac4
SHA512 dc040c965075a0de15a08acedf48a7819fa4fc3ebd97330d5e43de1723a55d7b2d358dbdab7cb7aa09db1ac471db58bad48ff9816f30161c063f6cab6449518d
TLSH
T160D0C0CCF0F84494E412003E8210570072C497547C03F040E10171143D4770102500D0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 e67d9cae6a57ecf43c94d02200d6298615ce38d6bd42a5c65f1ccbcabde6f52d
MD5 0e107b5153b3a2b36fcea4898dd9608f
SHA1 2a6790047d00bd98b75769823e67d19178ddd356
SHA512 499fce0dc506a0ed1464378f0b1939389c731e579ad4603bdcdbe828146730ee0aead217545144f0ecca5399648c88b94a41c95ec96439c92132e88f5f219a1a
TLSH
T190F0D1B9C825EC2B18F80B2974A45A46E79123572790885F3B3D810D8FB5A3B8696C1C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 e6b3cf98ab92e24853d7a1959fcaf489889a94d92a26c9c46960679daf12cf63
MD5 cb85ac4c9a7f3d6b4c57900cdaf2a033
SHA1 2fa6a5cdf80fb584722b48ab1846d9669f31839d
SHA512 56d430b3a5aa60f8b6def23a46f8fe7249cb7c53108e5456139aef65f130a73a466337a2c09849667ea3bc3e7788b8a3dbcce85f98e67e4a55c890b7dc5945ec
SSDEEP 192:igX7+g8kxYBSvSVOpah3vCrJy0K/iE5h7jEHEsPmX2NJ8tlYLgbVkPsBYmdFp2:i0jASvSZh34UrLJwHEsPFHPsBYS
TLSH
T1A313D67F72029D35CAF74C3D681B8B76277DD9A9C0CA4613063AF82923937EA195EC40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 5ffaf632bc1eca46d5af266445942993c1515cb7456d30e27d471335be6cfaad
MD5 68c2869928a5b0b1c12037732354e422
SHA1 23f44e160cb22bf87f84463de998fa4b2353e5a4
SHA512 a77b89e52239fb629040973b515c5bee383ce66aa5330fb816a59fc702ca36349e54477ca6d555fb4d58c4800954c4eed02cfe3baf8d8f2960f0502d88de0583
SSDEEP 1536:stn3L/CnL/rYjJxzi/HPEjCqjhjMe1t2L/+L/rL/3OBF:An3L/EL/iZlRMeH2L/+L/rL/e
TLSH
T185444FF70A51A01BCBA852F9E2033E3ED17B405D7CD2F8A9D1788C812925B71B6BDE44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 796b4806eba3e8bfa80d77eab86cf9bbb6105a4c1c0ab17e51ada5d85b49c80a
MD5 2e0ec42d32555ab387d065d520ee180c
SHA1 70c51fd81bfbd83506433b39be264e2e07496375
SHA512 6611c7d8064a9cff0a1fa0d6804bf3b89a4a78a42b83e6177d85b7841abf138971e30749ee38eac661971dd42611db3f37b2133b0197552cf5a00153a4f13f5f
SSDEEP 3072:lW3+QIHvH1SBxbWfou29lxKQr2QMVeWght7ZCI3B2mBbFVl8uVh7:SVBxbkkXr2QMVeBztfomBbZ8Ih7
TLSH
T15F2539EEC7682C82DF2B8774B0E0D9077E712082BA5DD0D39944C5D897D6B8576E82BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 d03066303a6c8f60ea18d40cd1e13e344cd1438fefa9d8b59c83ef36425be7b4
MD5 123f17a27e590cef4bb9af1563ba490d
SHA1 b427ca6e7bb12f91bb7dcf403b207889c0d3f91b
SHA512 e32fa915b0c7bcbb3c43ebd4887ab4b2854f1f4e64f6be8acc39670ac170efc8b75aeddeaf954952c31b23d58de2a3313b44ecbac6d1e00cc4a8dd007f098b9c
SSDEEP 24576:EFU4/vlSnYQQkyLDy7oQrzwVZG1mULzeA7mswK53oyhCYSSrKwVGUeWIjPr+XS:mUUlIYU7oQrMZChl1
TLSH
T1C2167CEDCA7858C3CD63AA30B4F0E9477C7413C3F955D1D68C98C18402A7BC5BBAA669
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 e2ba45ecee4145741847b08ba5e4f9791a98f06f873a177ee8a810390b7efa7b
MD5 d98227971296ef8fe177f53b9e663a3d
SHA1 4ba130c02e4b47d634c9e87fac4bb1356c44dac2
SHA512 92b4b158c9d1e2a4ca451444ec64170cfdd9ab195891d4c3e7b21489b7731bb443cf53932962de818e5499a3335ae9cc4d92c809056aa9fc89a39d21caa3a5b2
TLSH
T13D611D3B22B14D73DF9C813356E060823E38B588CBA70E8D1499D87A6F963F941958F0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 b279ae94c5460df03c53b139fe2585cc668114c2b6a968a41f05c18df678cc8e
MD5 c7c95dabaea409d3f0770d52afae15c6
SHA1 68d504dfd4daceb1d0ea4e5fc3a1137ea69fbd8f
SHA512 abd64f0dfbc805dcdf0cb780cc7e6533421549990d4c09d270a5945c893100e3d9a6cc46a14a01f87711e890dc2f04d589e9954447d492ab3eb63091d654fd68
TLSH
T1AB510B3725B24D73DFACC13395E060863E74B588CBA31E8D1099D9BA6F863F981949F4
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 86ca5f462620d493843eea28e5420067dd0fae5deea7b7ad36f47c27282c62a6
MD5 2ba1f773a2bf3eb54fbaf6120c38fd6a
SHA1 85904ec32f5072242f7a5e34dcce42ae94ac49db
SHA512 11417f516cae578c00d1a41057dbad64168a9a1dcc94f2d34ab05ea24c5190150ae10790988e7450d068f7bf73a0e92dffc600c33344fd6511f4db2250ad9598
SSDEEP 3:MsEllllkEthXllkl2zE/lTb/eK/l:/M/xT02zsVt
TLSH
T1E744040C7FC00C07C500317440F1C7505374D41007535F4375514C377CC57410C00000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 570B
SHA256 99def1b557f19f04c1affc6f247d0451f33fc10ec42e73792223c3215ac98be6
MD5 d4ba0ae0bb0b9faff3da6f35fdbc3c8a
SHA1 fb3e9dec7f35a9b1d94e54a5659dd0de484055e7
SHA512 86fd07c34b9abd4c52ba19eae291936f92bc6d38a75c021edc1dedbc15617669876180cd99f959c62476d82ec6bb9f5fe4c6cb4d82cb037efb76d99a4d3d9c51
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 a29d601f96ae03882f81505c7d49e1d15bb701c18cddb674977310991e33affc
MD5 5d0276bc24d4cb9a0d6472a2ca113e32
SHA1 939602b3f68e382034fee22731e5ad8d2ea72c60
SHA512 d900ed492e070983ca8709e757a7d1580df55f8d215e6dc7476e8ca3c05dbed57c0c528cbb8b437701a8a289e167b82e9ef33b50f8383dfc0c70f6be97f9ad59
TLSH
T121E07DAC09CFC16D901CA8D7036C6708CFD03813FA883D061748D8857201281B2C72D0
MD5 SHA1 SHA512 TLSH

Submit Download

ExtensionActivityEdge

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityEdge
Size 32KB
SHA256 d86b7b7f10bbecfa155b2aa53e2a61a8b726d075be1073b16322b4446e5f564a
MD5 959fd7a9dd064b5f7fead31a31b71b10
SHA1 fd0d829d81034864d3c8c3f212815cdadc8bed62
SHA512 84099eb90e068a3100530d376ebd68db1a68880d543e8c94c0cd92c292ec0655afe96d491ebb837604bb491b987bfbf18cdf13e6be24aac9ba0c205bd8744d00
SSDEEP 24:TL8JhK3iOvwxwwweePKmJIOAdQBVA/BNj2VTJZwJ9vpV3WOT/uReQQ:Tgm+BE9ZW9v/3WOT/
TLSH
T1A3E23A2A5E7C7521CD667136BC21A4665CB910DA977336F23EE0007D6F8228BC475CEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 4fec05e7643bfba5d00e79d777c12c060c55678e3e75b71e9c656732c7d9b6a0
MD5 345b145e8b197a0be74c83be2970ae65
SHA1 7aed95ff2fa48b0a72317901365a7b0fc15f5cae
SHA512 4fce00c0bb1441c45875405fb59ce8e74c458b45d0c3f5817f4fe0df8d362eae9cb26be78747c4b27cf364f542b12e006a30ccaf23d0e7e85c0b04bc336779c2
SSDEEP 96:fR0S0JIU+bGz83uy3+u4tgp4DLjGQLBze9z3/60h0GjBHMsDEuspU0wbtqrOQpP5:GrJf+G83uy3Ct7XBBKjDOSH7DXspU3if
TLSH
T16514331E0F352312CD7D417629EB44B75D7DF03F8B5266DA68A114B4CEE3B52A02C8AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 133B
SHA256 3c9b04c37907ce34d683996e5ef4106d0357c0130cbdd298188a160a6032e1c4
MD5 16fd67d91540483c7c1d029d3aa39ae6
SHA1 ec308c605b5b7accdc12201ee426dd1d00524924
SHA512 c56efdd14350241d20f1700930cca786c2db8e6195e03b32c6b17a178cf9f27e6d33dbadb38c68ec05ae26960dbf59311a5826d04ebea3fcf1e19d60bc660e36
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 75cc05294a8a34007771a9ab4e76ec7b2bbd125c8b809ffad7a2d9d21858e968
MD5 4e4130db058cf510caa13cd7988183c6
SHA1 66f99dd8e024e3192fefd1e4797d65ba0e9ffe5f
SHA512 06966eb7c45cb463e936ed26b7fa324fa8c5b06dcff7728b3ccf2f9c4d1a167a8deb6c1361247864fb17a4032d531023e6c96b02053ea266b99badbb498d80a8
TLSH
T1FBE020F445CFC21D71082097422DB70CCBB43897D6847E051B08E9C1B50D084AB931D1
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 20KB
SHA256 08a2869e0cd155c88799ec0a692939dd31b9489284cbb07b70603b7c077620cf
MD5 cabe969471800c7075d80e7658f4a36b
SHA1 c112096eca7368c09d48e9cc8e0043561ce040e6
SHA512 08c7791ecde1d9504297ba8471afd327aa28ce36cce6d571b6fb9b5ed75a48350ca5c9580605d0d9b2606019bae17aa755dccda4e4d65d183d64559e5761915e
SSDEEP 48:TNLopFMatSaw/auUOt8BMogwMMlookccIAwH:deMatUaAK6aloogIAA
TLSH
T18192214E5F346221C0F15B76EDD5C46B2FBC202CC3A33699AA6460F2CD925ABF5051B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 548d4b2a4cc9e4d25859ec287ea7ee0a10d206e06c4d8810709f88f339f0f1a2
MD5 349c5313fc75f78008121a4696412472
SHA1 5bc11db3fa1ccee69aac9a5878adfb7cd3c8301c
SHA512 6b947034a4c6a13e0ea9bc31dc72b32f63c5d5615d18bb27582bc69d7338fa98038ccf2c045a1faf095913c089230aa0ea0217b6c21dfdb5d4cf61eac2b214a2
TLSH
T1D841AEF383F4856D8A0196F4AA14AE2BCF6D0515431C3D5AC5E4AE2B93F34B1E18165F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 da812e4d636a4e5da28d3d11c42ba5a01e705178e81513b8e8742d9d4af04bfb
MD5 1d1d8c162c72ecd3d94dd4b4c8673af1
SHA1 62940b7da8958e2bdd795512d1430b35e3bdec58
SHA512 8000af38403268fd295666f4a44a1546f36d1ee3cb1a7bd244f60da4c69c68a1de76ba869761305dad7fd4a3012e25f3a72674f86b1a8bf9a4ef1fb63ee49776
TLSH
T1C4F05063DABEE47B206948771988B409A9FF94300161B4E0D996C3FF70D04F35F6202A
MD5 SHA1 SHA512 TLSH

Submit Download

e13a684a-c0b2-480e-aa70-dada5abe845d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\e13a684a-c0b2-480e-aa70-dada5abe845d.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 1e4cc902c351a3fb153dee1ff76da29fb931f860f97254809dfac14f4e83eded
MD5 08ec898933a085163f95d7f2e030297a
SHA1 4ec64373c81da3dd6af58c9c4820e8f54d7f4e31
SHA512 f4b14e5e7ba4178feaf78382dfc90e8581e70b164a788105c26a7f3d0f22dc886cc76549729d42568cac4604aa51c404d35044854a5a7ba93fc3e1077c4a1373
SSDEEP 192:sxZ46Rak7/f+RsSe1sBzodpXQHW6+WNJ7r/YM3rR08Ig51t6J:sxZd/7/fosSeXgHbF/nD3t2
TLSH
T11442D715AD28A97F8CC7D21AFB55BF53E7F9503290901E48A6FC8A1C15EB6DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 963f0b9359e05c4cfb4129313da2ce06cc36051bb8ee7071aaff8dc09d77caca
MD5 d829a6bf60e8557a73876a20d3f5f59e
SHA1 e7e54d10e61a982a83b02052fcbdd00e66724379
SHA512 0263e9597d7dea03db5b4b3dc86e399ea8ae737dc87ba1b5f424772b7654448202088601a82b5259dd6456ee43eeab3df95fd398463a1abe29911c8102fd73d6
SSDEEP 192:sxZ46Rak7/f+RsKWpVre1suzodpXEHW6+WNE4ixfYUrRdCIgb1t6J:sxZd37/fosKWvreeUHbOf7IRt2
TLSH
T11952C7156D38A97B8CD7D21EFB25BF53E7F9103250911E48AAFC8A1C15EB6DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 62fe98662710d8af5743406691b8f04dafb344b4d171689c4f8359c06b8b71a4
MD5 de778468a679670beb5a6060aad3effa
SHA1 9327fcb7c3524ca08bc1e97466c1797085e73ae4
SHA512 792f03f2b848a7ac5743abeaaf94539ab01282a46125a152263983fc41b07b865524c80452d6ac75f9a5df224461f89b93f9a5ab4b8931a5f0c34cfb4124a226
SSDEEP 192:sxZ46Rak7/f+Rsbe1sBzodpXQHW6+WNJ7r/YMGR08Ig51t6J:sxZd/7/fosbeXgHbF/WD3t2
TLSH
T1F842C715AD38A97B8CC7D21AFB55BF53E7F9503290901E48A6FC8A1C15EB6DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 7c1d552b2523701229f512cbb6c86c70e486634d6d135918d144aed29c96703e
MD5 d8158b1dae49cd147f84218cbeb36189
SHA1 db798bd4b5fc4a769fcedc3f89b7a1ec436a8ddb
SHA512 777d66845f88ce25a02146c0a575eb7f50081932537ce30a4e920160e457c3ff0eb4f96410c68151b0fcef26ff005c7b4c26fc802b3c67b6d09409106ec9fa38
SSDEEP 192:sxZ46Rak7/f+Rs6Ge1sBzodpXQHW6+WNJ7r/YM3sR08Igjt6J:sxZd/7/fosreXgHbF/QDjt2
TLSH
T1BE42D6156D28A97B8CC7D219FB25BF53E7F9503391901E48AAFC8A1C14EB6DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 7d1b5dcb49680e294d80daed458d514d3f94f855042fe386914af89cabeaef98
MD5 9217895182cee47cb799687b981fb073
SHA1 1693099e4ed9d69389b232984a5edda771f2f12e
SHA512 f4e103f707c874293f86c8f0d5d6710176997cda1bea8407e433889f62e329dd3f0768c69d9c1e95dfadeb9ae4edfbb4ac5038515ff5eeceee66704917464e99
SSDEEP 768:HaaazDVWvZTyo8F1+UoAYDCx9Tuqh0VfUC9xbog/OVdLLlCQcmMroWP8:HaaazDVWvZTyou1jasLLwVmXWP8
TLSH
T145C2E93B244CCA7E4FC01A9DDD5A6FDB2E9802C7A6588D4087FE984C02D77EE51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 352d38168dbd0ad92ede587b42163a89368f3969414c0da708ef185b6c02370d
MD5 ac8ab32f0b8007aab6dbb3f5d90e8615
SHA1 e3d5ac5f5679f58a3342e0d6ea08a5394bf2db55
SHA512 b00de6b22ecf6b705fcb278aad76aa88e0ba1736238f842e339d0fce9c0c6f4bc3e903ad30bb55914af876ee2597bbccc0903542f31d1b43b098254c04681f86
TLSH
T11FE07DB04ECBD37D611D33C302389308ABED7827DAC4BD462F80FE806E46984B197190
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 e0ea85a78496bab83ea8275d67a13be8adff8187dab9f9fd9286e6b534142c8b
MD5 aed511a474fd8b53bc54c1e7a0263337
SHA1 c70821b0812492641ca7fb44262e8def518897fe
SHA512 04097fe15f1b6c0f3a8f99cbe13ab6682516126b97d9c78ebc35bc10538db283f61d3638bdee3e8f83148cdba413ce9832599eedfaf7df9ccd75eb3e4a9fd6b7
TLSH
T10DB0124C3B40F487E0492E380BC4D74C7B14E05A055072439C0C4E2C8D2036CB9558E0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 bd2ce16111f963888e0f9bad513dd925221c2f335f3667c40e52551907e402b4
MD5 9d69abf6d6d1c5f352a433f6eeca549a
SHA1 2820444f80edeb5b378723af629b8fb1e6164fe6
SHA512 99e644ffeed6dd341085288a59e8454d806203273db00a508368b8f8274e56784aab5ea04228a3ee017f0701115cee1c90c178a8e7d65d081ee4e1193ae97214
TLSH
T1CAE0D8B41ACFC66E628920C70215E348C7B77813D7D479153F0CE9C1730A1807643150
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 2607a6bd8e30d4f2313af5a0f1f2747f428a7c312dcc08457c8e6027c58687b1
MD5 5a757cd76d28a85162317bb5b9bdc4b4
SHA1 278734be99354b3c294497da3d135b95f267f9ef
SHA512 6b602c3e05a5e70c463673fd4e41bf29ef979f3e642f08d8ed9dfc14be6f75c0a16d8e96be301bccd3c84beb07587c20baeff476237976d3e0b13baeb03478c5
TLSH
T1C0E086B046CBD63D514971C302B4AB0DDBF47C1797C57E8A5B08A4D0AA06984B6BB5D1
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 00514ab1bf00ffd02f1872478665d8d91b417fbe8ba58bc6a857366ff1482142
MD5 68f594adef59a285a747f03a225127e6
SHA1 444017740eef4e1e859b0e66641fba0032222e9a
SHA512 00a61f9cd072c90d9fecd6691e2b44d227ef967f380c92456e5bf7458a41016faae33bdb259cfd0e28f71754c52ea31d33323b41438361ccbf5fae4f1585ddd0
SSDEEP 384:q5/FO5XfrQnWaAqOrm1KSoGlUB4Q9WeDdERN/rviDuRlJ1lnKVl+HYHUFDT+F9:q5/FO5XfrQnWaAqOrm1KSoGlUB4Q9WeH
TLSH
T13BB2031171BF0240387E2D1C81B4976E9A4272A37178FA7B7FBC10A68E66E045DFD8D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 ee9a68df09cfb4550754fb26413c6c1b54aeca911ac87bd670e8303a6be1b163
MD5 2e1ec8a17126f1a93444ca20e778b983
SHA1 d364f13e8d18c3779623337ce897de54799a7cae
SHA512 0a2c75b8d66b1bb5751aa453e5246a92b3262a2fb12e1030d8d55cf3a368c87f0f2df4658736988dfa7e37fe4b711fe564afffcba41877017071c37d33f91bd8
SSDEEP 192:P+xWnCVUfT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:mxhifQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T1B324740A7B747001EDE6D9725CB080771E3CB16DCF22A6916DB254698DB2853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 13KB
SHA256 04f9d9af28454d32df9c9081a2a811f5424453220a383afa6da67a6074500b5d
MD5 f9e7dcf1eee84783fb3da9b32c2ecacd
SHA1 dd762f6586df6438dd10c660b1d50e6aace538a1
SHA512 b850b3203639ed8c73f79bbadb32290da0207d1c78c7e1d9fe1df999f7b7538641ea35191c8280f6592fc1640ad67f0057ab02e820bf0027dc07eabda289a727
SSDEEP 192:x95QkIIIbbLMIMNsYcYgEOaNLAszlrhKrshxA:x95QkIIIbbLMIM2Bla2sZYsY
TLSH
T14A52712B27051B73C09F5BB7035A87A117C9C981827A66BE3462180F8DF3B57C6D52F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 f3bacdca9b3689f3656c24bd8dfbfc1faaa957f8694441ee9e214c8e7442ab87
MD5 618f3636f2cbcfc170c630a1e06d7f5f
SHA1 b3555866bb272f22aa316ab7a145e226fa4914ab
SHA512 4342e86e139ffeaf6fb19b55fa976aa86f7083c7224c8da16b59986affafe6e28d6caefbac1a5c0eb3bfdce4c8e07f258e32e45428267ffdc4489ad4ba74f2b0
TLSH
T16FE07DF0AECBC16FB02E20CB01A85708CBC43C13FEC8390A1F40D984B685280BACB591
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 61d1d9f9bb8c7aaefd8cca75ada3a78523645f3a50b7c1193db2fb37d907b9b5
MD5 4ef89083c49f22ec787a63f6a75f571a
SHA1 f345f82d7258a2f1d22d02b65305dc790e8a8773
SHA512 45dfd268f2816f9431ad89fbb7abc7e546a6b1a0f87990815e173835c608a0fe0eb5962ef517c8a0d4753b1be8ff24357990b130a78cf38eed7db835903022ae
TLSH
T16721BF65F320C158E18A863E902F97350738E8169FFCDC0F84BA24752DB1B100E8B6E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 ef72aaa0746f650b71cac977af6de8db5fa59e06b1f8cca1b485645f26645d83
MD5 5b332d09ee2449edece282f5b09e776f
SHA1 5fc32aff3b0f8826b9f8cc4712af21771928468d
SHA512 4a36477908afdb647ceedb6a7d3b58c31fbd5f882ebd5290dc1145501f2eca5d8ad3dc198531c993aa68386de667ab5e2d973e28e2589cc9dcf16ddfbfb2ea3d
TLSH
T147E026F0A9CBC12F911920C301E4A74DCB95BC13EA803E0B1F00EDC4BA46289B68F1D1
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 b784bd80ab76afc507beb448285e8d4af8e0aae93657c2c021a133ee6a016e2b
MD5 b8d6fb4b8d275e4eb28cfb74185aa713
SHA1 7410e31e1f3f180b878ecaa06e46cef3baa260bb
SHA512 4d3f0aa8bdf3817dc772908f788f20a71bf9f0d88654c737c8342fb9d2f7870ee0fd83062fe8db74beba2fcf9a2bb11e481f9b849b56871ce83c14cc1079867f
SSDEEP 3:MsEllllkEthXllkl2zE63/:/M/xT02zB
TLSH
T1CA44040CFFD00545C50130F0C057C3504774D431051557C774550C337CC55710C14100
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 634f29f26b6e59b9e59907dbbdf52f5dcb3e29f9e4ed2133de771846d39b8582
MD5 98bd9dd8fc04d7d2d29a846feefedda5
SHA1 d4c508f8622a8ad0aa4dafe0b0e7af23c112f0c5
SHA512 5e6dafea41649b83b40d6ad0479f6261d65da099d7ebea633040821bbc022904bf7793b9aea8df36ce5b7c146ce01a1ebc744b52a1229f45c15358f027e246b1
SSDEEP 3:MsEllllkEthXllkl2zEAgSWu:/M/xT02zv/
TLSH
T1314404447FC00505C50030704453C3704374D4110511574734750C777CC57750C11000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 b412a4c1767cc84d1d386570c7edf4ef3c42b5bfcd69263d8ad8bc217c013b13
MD5 2d07f8fc14e1b338802785a92d05eba8
SHA1 55af69e9f2239fcd2241cefda5f0ca61a65ec5db
SHA512 dd81b8509752bbdf2c5cc6f4d4467ea31957e0fe22f840de8e22c8fff013d38eb08de7632d3951f226a92a3aabcd1fbdaa82b083356b662196b085c35464488f
SSDEEP 384:nKiFvZcIB3sNN8TUNTUlI4A1AE3aI3Kt4fdBCWp6xWchcrV7NAVZh6DKhHx/fgL5:BFnB38wg3dTB/pXoiVJAfYGH5y
TLSH
T1EAC25A32EC98D9B7ECEA4AC6F74A7A03DEF45163958C9AD4D5C85D1C009B19E130BC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 bf7f27ef1dc5d452525ad858a81d876e710ea8bec520ce4718d16a5e2169b30a
MD5 f70aa82066c4e7fa65abdf7aa7b41c09
SHA1 0766ef303808cbbae81ea984df208418261d44ad
SHA512 30a6d3be8ef595f17a1246f08407b93b9fb140a362a51940765e6b7ca6f0053ee74da7bcc871200c63e001c2c5c974c4f7431cc15227c2951094a20cffc41d44
SSDEEP 384:nPiFhZcI13sNN8TUNTUlI4A1AE3a43Kt4fdBCWp6xWchcrV7SAVZh6DKhHx/fgL5:aFp138wg3HTB/pXoiV+AfYGH5y
TLSH
T182C24A32ECA8D9B7ECEA4AC6F34A7A03DEF45163958C9AD4D5C95D1C009B19E130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 31KB
SHA256 301ea8d33485016d1511874bae0a2f64cb05fd524e3547b9ccbc3b8ce4d85dbb
MD5 e5975dcaa0f1f50a0fa6e5489ede9767
SHA1 c1e3b9b0fc1e68c80ba02a4abb63a7d9a731e2f4
SHA512 72faeebb80bf23746d619179ff30e4f486f4fa4033b9f8fb723c125c3461bae93967b231b73c00ef141da538885b4cef31b099d89de2ab678517cf13fe0c114e
SSDEEP 384:n3iFPZcIydsNN8TUNTUlI4A1AE3aOUL2t4fdBCWp6xWchcrV7Cx3BbLu9o3tVZhg:yFH48wg32LfB/pXoiVmjG9o9fYGH5y
TLSH
T1DCE2183DDC64D97FE8EE7B85A20E6A169EE41177D4B89998C7C40F1C80B609DF30781A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 9cbae4dadb0760f6f572389935a65b168779fb8db4a97496f6b4c21217358286
MD5 2b6b0d2fee1133df6c82d050ee53dd88
SHA1 a7b827c9a3c25535bb85639992fa6385ed7e8979
SHA512 823b0cce0e4f196ea98761390bdc567aa9633cc7cff641363cdbd3887bde7c8be35941de8894cef214e698e4c0f1ef44498fdd94db2ac43ba9209ee4d25b7c16
SSDEEP 384:nKiFiZcI03sNN8TUNTUlI4k1AE3ab3Kt4fdBCWp6xWchcrV7uAj3dSgL/7Izwo0:BFQ038wgrWTB/pXoiViAj3Vv
TLSH
T137C23932DC64DABBECEB4AD5B34A7A03DEE45163998C9AD4D5C95D1C009B19D030BC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 4851e7315b17f618d6085605a8b0972e24ac9a4ef28974d5227a350ba019dd89
MD5 dab4d5947775b8bd2e886f5defceb471
SHA1 6c02cc92e68422888f612a4f65959a97b4bdba89
SHA512 24b75f5faa635518b777d3f1b2f59350c1da2fd57c94f65c58253d2055d71914bd6ed74afbc89a9a0551716c9c0c406e8829a8cce11d153576dfae215adc7862
SSDEEP 384:nPiFPZcIB3sNN8TUNTUlI4A1AE3a43Kt4fdBCWp6xWchcrV7SAVZh6DKhHx/fgL5:aFHB38wg3HTB/pXoiV+AfYGH5y
TLSH
T11DC24A32ECA8D9B7ECEA4AC6F74A7A03DEF45163958C9AD4D5C85D1C009B19E130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 f768af1840be03181ce771e729eaed924936c3ae91a8a41131c50e87296296c9
MD5 33cfe8070fe8bfee53c087d71b4779a9
SHA1 320d07e3147bf96717fd0b664c5528889400694a
SHA512 61dbd9ff84e2b90c91caca3f8d98211c778709a08b37b47175046fa72fa70069670fdc665d1891babdb0a0d688532138711219580f261ee82ec2f385c3356727
SSDEEP 384:ngiFiZcI63sN48TUNTUlImkrE3a+w3t4fdBCWp6xr9sa+VYud7U4gL/7IzAot:7FQ63lwgOo2B/pQ9hgxsi
TLSH
T1B6C25A36EC94D9ABECFB4FD6A74A7A16EEF41163A48C5AD4CAC85D1C009719D0307C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 31KB
SHA256 cf42c819b5ba6680cecbcdf2bade1d3bb3d38f8bdc5b4ac4cf7f20850b337ccb
MD5 897b747bba7aea4543a0e3b10c184def
SHA1 7e14d51ba991dd457aaf0afd23f3784d9b39aa2c
SHA512 e46427c86b15d030fd84bf325be77f63eab3120b846a23cc67d4219d893a6748b4105dd5bf437cb6d8ef3e93c75f7232e5f1b4017cdd01eedbd1e6e1e95b975d
SSDEEP 384:n3iFPZcIydsNN8TUNTUlI4A1AE3aONL2t4fdBCWp6xWchcrV7Cx3BbLu9o3tVZhg:yFH48wg3LLfB/pXoiVmjG9o9fYGH5y
TLSH
T1ADE2173DDC64D97FE8EE7B85A20E6A129EE41177D4B89998C7C40F1C80B619DF30781A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

campaign_history

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history
Size 20KB
SHA256 72c9d84810f7df51b5ae3d69307d5e855a39122f647c688a199006944c71ec90
MD5 f1d91542aaa4f4cd06841957a792ac7b
SHA1 7cb431098bc0f46df21df222903fdf5f660242e1
SHA512 324497b341746bc8642c15d0250c304c9ba72254bc274661df29a84be5917369169b3de98a23e2c57b4077bf9cfb35f785bbe03cb8e868cf543f370087d2f1fd
SSDEEP 12:TLyeSjPFUxOUDaaWZXiDiIF8izX4fhhdWeci2oesJa/Si3isuQQtydQIpTzbdQIp:TLyT5UOl0afDdWec9sJSpdp7pejB5fc
TLSH
T13592AF236D352033E8DA877AF98349910EB8135EC9A7B8488DD049620DB1BC1A6996FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 4b891fe03df96ffa8d07d6e7640d98e6895f91c821fc6727aace19fa87052405
MD5 ff18b3554d97f6cfac91d784dd0e2885
SHA1 82aef14c7aebf9bd5efe0e6b4b46c843766ee1e4
SHA512 feedc61c0e35901fa74ce42a0aab293780525591a8b2452f2bd8473e02ca0a987f8e5a1db56f8233afd9b193730b024d3f363089bcc50ee74c0c0a410767da9e
SSDEEP 3:MsEllllkEthXllkl2zEdMal:/M/xT02z9al
TLSH
T12A4404447FC00515C50014304053C3D0C374DC110D3157473C510C137DCD5754C40040
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 8c592b6ff53c4a96fc4bd8c08d2b704449679ead588da285b59a983ba1a63e74
MD5 0695b50b81ae0fa9c00b18391054cd36
SHA1 b626febe810d1b769d93654aefc086ada2740a91
SHA512 e4f414b191ad50741be1c05e233c02ee598d66d2a630c846f7df4cf8212d91dcd67f60cc1479369776a34f2f4adae5c41baa45113028a243f6fff6e1ef012687
TLSH
T1C1415B59BAED1108B3B76F5A9BF6A86D887EBD732E06D55E00010E4F0627A40CC71737
MD5 SHA1 SHA512 TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 54KB
SHA256 d9ab76429234c047c73937eccaff11c0c79a1ccab93d16900e8675d36cb5e26d
MD5 19237629add2da25f0cbc043d212eeb9
SHA1 a77fd3ad143bf1535bf0e9c714a1b4064757533c
SHA512 1f58c813c87027b998201488cd78d890087dd004fdc6a5ffcb684efa1dc5a85577f6919645516387cbf7ee3007985a6b4aafc8ee38abe69a697a9a0e53074fe0
SSDEEP 1536:vUsENhfkR+jH0Mv35iFHzdyyhl3OihN9flJdFhETYojiUpRLa5Ei3j39MVvjprK/:vUsENhfkR+jH0Mv3gFHzdfhEihN9flJB
TLSH
T145433F93E9204D71E1A66F3EF15662227D34394690F8113212DC25EFA983D970B1FBBE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 3KB
SHA256 d7f7230d043128cd7fdc06d93cd91b70139723fbd5a61ddc7421131bc86f4e45
MD5 285850de56f8f59d18c7e583380c20a2
SHA1 b47a5e5ad634ff90a62d73d6ded51e8ca139808f
SHA512 f84047bacf45d62a78b545a0acc0924b4a7e6aad27f6dadd7661eb2a41e33bee20c456df36006448ef0681ff2888be0ab5d75ad2f11e274bb38b768095377bb0
TLSH
T10A611117B7CC4DD3DA8D5736C08C882220DA92878462BECEAF8FC5F0621F1B5B674164
MD5 SHA1 SHA512 TLSH

Submit Download

3373a1af-390e-4d7c-bbb3-c0d3cf8cc1b8.tmp

Path C:\Users\Admin\AppData\Local\Temp\3373a1af-390e-4d7c-bbb3-c0d3cf8cc1b8.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

RESEF4D.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESEF4D.tmp
Size 1KB
SHA256 656b09e3c5a01f29779d9db27e17b0ee7ea74a4da4d5ab7a80f69ac6b40e9bd8
MD5 d9479042676f95e78a436e69f160c66c
SHA1 4bd2ebeea102a599aed1ba12b62f0358de94a909
SHA512 249d5996983e4c5a9e64b55e37a68362d74c25fd69077beff102b47629b4831bc80423b11d81c92e947516b1f6b627fde0f26bf1803e69f7d32fdd5ec1dc4e79
TLSH
T16F21860193EE470EF0B7573169F6072BA268FDA0AF63A36F854042292C41614DEE1EB2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_x24omigf.dzt.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_x24omigf.dzt.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

s5e4evh0.dll

Path C:\Users\Admin\AppData\Local\Temp\s5e4evh0\s5e4evh0.dll
Size 3KB
SHA256 4545c61ba1f831a0c3a9edf7f6cbffe6ef43e63959dc12daa8582ef978661395
MD5 a96cdbf4a641eb6300dc6de53f50a7fa
SHA1 5f1d310e61d2451b2f575ef4c351f81ac813d2f2
SHA512 ff07e0a7896793632d5c842b843a936d5730e9cb2927e13304c22cadf0956da326303d17e0cc68a59c1e826081b1792e05b7455e90d1f4d80de386605bc72212
TLSH
T1AE51FF0A93F8063BE4770731AEF3471323B8F8509F73A75E69800329AC606649D72BB0
MD5 SHA1 SHA512 TLSH

Submit Download

xcode-1dd8d2c702cb409dbc77e9619f65ace4.exe

Path C:\Users\Admin\AppData\Local\Temp\xcode-1dd8d2c702cb409dbc77e9619f65ace4.exe
Size 1.6MB
SHA256 4a0d6244d56a39764a05904f2732bf21652c47cdc510e0bcaea9988691f3a19d
MD5 40fcc82c02e9614664e761d09b9b71ac
SHA1 d680f323e687d640354dd3872c8e29f2d2906f9a
SHA512 495f934035be16281fad1bed56d8dc3551e5508e44df425c5a8c580df1f694b7ae6f493423eeedc0ad80360de9ebed350a6e5e43075eace9f02c04a518199d53
SSDEEP 24576:UX0jL+5V7zuP9ktapjPh8D6vCsaT/7FAWcXEPbf90RH2zhy8a9DN6Yne6yY:UE/+5puP9CWjPh8D6qsaT/rgOr4p+Y
TLSH
T18D856D2A268402BCE0BAD1BDCE475E81E775740A03B16AFF16D049E25E6B5E44F3E713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConsoleHost_history.txt

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt
Size 46B
SHA256 6c0aab3531fbcb0e4dc2491485f865754f60a574e1d47bc2db0c07c64802b902
MD5 fe16e6324c1f3e06fcd5ec49cf8bc5b3
SHA1 538313d7a59b4803e47f9a9ce0d741e8b358060d
SHA512 a513cc14189091423393eed3423f57a4ef398da85a1a3b3c4d7c259dca3f4d1a86e407b85babff48c67c8ad0aa4ad13d3db66cb8859779e2ddcd7fa3f4650dd6
MD5 SHA1 SHA512

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 5KB
SHA256 f5a9b408b6bb1e1fbbbcbdb43d7c873777b8694a8461d8c6ab2afafc98270b7d
MD5 93979cc46f4de8ab84afb36683f690f3
SHA1 97a7aae6bd820e8db2671855160d13e361ac19bb
SHA512 0d2db15a8f88540556c9b82c4d2db4246d0956b60ea16faee681353bfe2311d065192f999c9e953c200abcc44f53b5e1a3c7f311970b21b4886403898533ebdd
SSDEEP 96:A/VhJyiJCd7/apHFukvM2nohQHfnohQHs:A/VhJyi67/8HNnohonohN
TLSH
T1A0B1F3001BF5061AF1F78F3969B6B3219236B980CF078FCF5240A12D9C31165E979B6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 5KB
SHA256 01155b222669f862d08e4cca6c0485ca879636a8ac5db2e5c2cc4d27d8c97c62
MD5 73f27e90a8b3e22dab84559d56083a5b
SHA1 74940c0a28365f9093ec67e915b48b9e0c28a874
SHA512 55514696252e6624f8162ea33c4eb5dd022969baa3605c29411a311fc3783b2137d582f82329b97f92ac40caaca6e5139f242c7e92d3ef0cba6108320e177b33
SSDEEP 96:rc/VhPyTJCTW/apHFukvM2nohQHfnohQHs:Y/VhPyTkW/8HNnohonohN
TLSH
T164B1F20017F6061AE1F78F3969B6B7219236B984CF078FCF5240A12D9C31165E979B6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XCode.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\XCode.lnk
Size 2KB
SHA256 c06f105f6d49f86176e00d5b915bec2577f0f718da6e059afc4c76133ed7b0d4
MD5 6da5757f8d7f5ede57457935fb199b34
SHA1 87f8a0ab93a616795c9e17178287fed7a56d0408
SHA512 d77db59b874155f8cc85608ad24a1f0b8d1d20c7b78a418564562bac880464cfda1234e4cef113348ee2d33e4a3ecbe7f4ef62331a07f4677f2fc677919256a0
TLSH
T19241AC039EE62B31E2BACD7142FA7756D5BAF8709F022B1D0044438A1D22BC09E59F5F
MD5 SHA1 SHA512 TLSH

Submit Download

CSC38A6A7539FD444A1913C171B13EA638C.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\s5e4evh0\CSC38A6A7539FD444A1913C171B13EA638C.TMP
Size 652B
SHA256 8d392265fca6693207d028dae9b55bba7f56d13c4af9519a81732c45b40edfdc
MD5 07561c86fba019577a6f605b98be0f48
SHA1 b47522c9e308d7a7c72f9cc181d5e28be5f400e9
SHA512 c9564fbe599fdf8905109ee8467715b52852d9bb387a610d85f6c53c6a9b5cb56ec84ccd1b227f97b9508843bec563cfcbfd0d585ee5e964b78aaed3c68a71af
TLSH
T17CF05E0963F8020EF4F74B30BDF6436391A9BCA4DE3393ED64500319286492089B2FB2
MD5 SHA1 SHA512 TLSH

Submit Download

s5e4evh0.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\s5e4evh0\s5e4evh0.0.cs
Size 313B
SHA256 dae42684d85aefb59a58a78a825b486036b682015d7a640debf816f888cb1e9c
MD5 9ced59ed3f5313ed4d6ff2dd3fbb95bd
SHA1 ba472f2f6fd619dbbee8372b249dc15d154b82cd
SHA512 0cc0faa870ca79530f3e4f0899cf17378b927712899149ad2c27919f72df15d93bdfece6de06a92d4748011fccb9becc268d95383e693d6d3f012ee377065502
TLSH
T1CEE0262462E3996A4042540E1D9E70BDFB23A12B227A2240F9BC2200CF964486932B12
MD5 SHA1 SHA512 TLSH

Submit Download

s5e4evh0.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\s5e4evh0\s5e4evh0.cmdline
Size 369B
SHA256 23388ef2755397558ced304261e2bf5b0c956a58073b7673c42b6d281e622512
MD5 e88bae70c8035f5f703e68134be5b539
SHA1 289336ed577eee2b7171a2afa6243cb2c19f71e5
SHA512 0b0b9d03364b9aa66ea13e4f45072b430ff536643d9578ed4070c8e4eb565541b91d6e5633b729746ba8566a1d7bf7f3e97d6cbfe5f7f5d0e5faf5206ce881eb
TLSH
T1E6E0C07AA287C27D82ED10173169D4ACC3B207473E497F845254447DD83700227D3741
MD5 SHA1 SHA512 TLSH

Submit Download

memory/992-230-0x000001E50ACE0000-0x000001E50BCE0000-memory.dmp

Download

memory/5976-267-0x00000205F5340000-0x00000205F5348000-memory.dmp

Download

memory/5976-228-0x00000205F57C0000-0x00000205F5804000-memory.dmp

Download

memory/5976-229-0x00000205F5890000-0x00000205F5906000-memory.dmp

Download

memory/5976-220-0x00000205F52A0000-0x00000205F52C2000-memory.dmp

Download

memory/5976-240-0x00000205F5AE0000-0x00000205F5CA2000-memory.dmp

Download

memory/5976-275-0x00000205F5810000-0x00000205F581A000-memory.dmp

Download