xworm | hxxp://link-center[.]net/1250429/xeno-best-cheat-in-2024

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
03-11-2024 16:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://link-center.net/1250429/xeno-best-cheat-in-2024

Score

10^/10

xworm discovery rat trojan

Malware Config

Extracted

Family

xworm

127.0.0.1:42499

23.ip.gl.ply.gg:42499

Attributes

Install_directory
%AppData%
install_file
svchost.exe
telegram
https://api.telegram.org/bot7553043476:AAG79f7X-HeCpXvdZcY4-35HYNB1sbXfJkU/sendMessage?chat_id=5684222606

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0007000000023d69-643.dat	family_xworm
behavioral1/memory/3964-645-0x0000000000410000-0x000000000043E000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm
Downloads MZ/PE file

Executes dropped EXE 4 IoCs

pid	Process
2888	winrar-x64-701.exe
2512	winrar-x64-701.exe
4780	winrar-x64-701.exe
3964	Xeno.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
76	api.ipify.org
78	api.ipify.org
426	ip-api.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4050598569-1597076380-177084960-1000\{F9D9A280-30D3-4D83-99E6-EE7EE928BAFE}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	OpenWith.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 678889.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
4240	msedge.exe
4240	msedge.exe
4732	msedge.exe
4732	msedge.exe
4376	msedge.exe
4376	msedge.exe
1812	identity_helper.exe
1812	identity_helper.exe
5260	msedge.exe
5260	msedge.exe
5836	msedge.exe
5836	msedge.exe
6004	msedge.exe
6004	msedge.exe
6004	msedge.exe
6004	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
6000	7zFM.exe
3812	7zFM.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 28 IoCs

pid	Process
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeRestorePrivilege	6000	7zFM.exe
Token: 35	6000	7zFM.exe
Token: SeSecurityPrivilege	6000	7zFM.exe
Token: SeDebugPrivilege	3964	Xeno.exe
Token: SeRestorePrivilege	3812	7zFM.exe
Token: 35	3812	7zFM.exe

Suspicious use of FindShellTrayWindow 62 IoCs

pid	Process
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
6000	7zFM.exe
6000	7zFM.exe
6000	7zFM.exe
3812	7zFM.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
6096	OpenWith.exe
6096	OpenWith.exe
6096	OpenWith.exe
6096	OpenWith.exe
6096	OpenWith.exe
2888	winrar-x64-701.exe
2888	winrar-x64-701.exe
2888	winrar-x64-701.exe
2512	winrar-x64-701.exe
2512	winrar-x64-701.exe
2512	winrar-x64-701.exe
4780	winrar-x64-701.exe
4780	winrar-x64-701.exe
4780	winrar-x64-701.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4732 wrote to memory of 1012	4732	msedge.exe	84
PID 4732 wrote to memory of 1012	4732	msedge.exe	84
PID 4732 wrote to memory of 3652	4732	msedge.exe	86
PID 4732 wrote to memory of 3652	4732	msedge.exe	86
PID 4732 wrote to memory of 3652	4732	msedge.exe	86
PID 4732 wrote to memory of 3652	4732	msedge.exe	86
PID 4732 wrote to memory of 3652	4732	msedge.exe	86
PID 4732 wrote to memory of 3652	4732	msedge.exe	86
PID 4732 wrote to memory of 3652	4732	msedge.exe	86
PID 4732 wrote to memory of 3652	4732	msedge.exe	86
PID 4732 wrote to memory of 3652	4732	msedge.exe	86
PID 4732 wrote to memory of 3652	4732	msedge.exe	86
PID 4732 wrote to memory of 3652	4732	msedge.exe	86
PID 4732 wrote to memory of 3652	4732	msedge.exe	86
PID 4732 wrote to memory of 3652	4732	msedge.exe	86
PID 4732 wrote to memory of 3652	4732	msedge.exe	86
PID 4732 wrote to memory of 3652	4732	msedge.exe	86
PID 4732 wrote to memory of 3652	4732	msedge.exe	86
PID 4732 wrote to memory of 3652	4732	msedge.exe	86
PID 4732 wrote to memory of 3652	4732	msedge.exe	86
PID 4732 wrote to memory of 3652	4732	msedge.exe	86
PID 4732 wrote to memory of 3652	4732	msedge.exe	86
PID 4732 wrote to memory of 3652	4732	msedge.exe	86
PID 4732 wrote to memory of 3652	4732	msedge.exe	86
PID 4732 wrote to memory of 3652	4732	msedge.exe	86
PID 4732 wrote to memory of 3652	4732	msedge.exe	86
PID 4732 wrote to memory of 3652	4732	msedge.exe	86
PID 4732 wrote to memory of 3652	4732	msedge.exe	86
PID 4732 wrote to memory of 3652	4732	msedge.exe	86
PID 4732 wrote to memory of 3652	4732	msedge.exe	86
PID 4732 wrote to memory of 3652	4732	msedge.exe	86
PID 4732 wrote to memory of 3652	4732	msedge.exe	86
PID 4732 wrote to memory of 3652	4732	msedge.exe	86
PID 4732 wrote to memory of 3652	4732	msedge.exe	86
PID 4732 wrote to memory of 3652	4732	msedge.exe	86
PID 4732 wrote to memory of 3652	4732	msedge.exe	86
PID 4732 wrote to memory of 3652	4732	msedge.exe	86
PID 4732 wrote to memory of 3652	4732	msedge.exe	86
PID 4732 wrote to memory of 3652	4732	msedge.exe	86
PID 4732 wrote to memory of 3652	4732	msedge.exe	86
PID 4732 wrote to memory of 3652	4732	msedge.exe	86
PID 4732 wrote to memory of 3652	4732	msedge.exe	86
PID 4732 wrote to memory of 4240	4732	msedge.exe	87
PID 4732 wrote to memory of 4240	4732	msedge.exe	87
PID 4732 wrote to memory of 1792	4732	msedge.exe	88
PID 4732 wrote to memory of 1792	4732	msedge.exe	88
PID 4732 wrote to memory of 1792	4732	msedge.exe	88
PID 4732 wrote to memory of 1792	4732	msedge.exe	88
PID 4732 wrote to memory of 1792	4732	msedge.exe	88
PID 4732 wrote to memory of 1792	4732	msedge.exe	88
PID 4732 wrote to memory of 1792	4732	msedge.exe	88
PID 4732 wrote to memory of 1792	4732	msedge.exe	88
PID 4732 wrote to memory of 1792	4732	msedge.exe	88
PID 4732 wrote to memory of 1792	4732	msedge.exe	88
PID 4732 wrote to memory of 1792	4732	msedge.exe	88
PID 4732 wrote to memory of 1792	4732	msedge.exe	88
PID 4732 wrote to memory of 1792	4732	msedge.exe	88
PID 4732 wrote to memory of 1792	4732	msedge.exe	88
PID 4732 wrote to memory of 1792	4732	msedge.exe	88
PID 4732 wrote to memory of 1792	4732	msedge.exe	88
PID 4732 wrote to memory of 1792	4732	msedge.exe	88
PID 4732 wrote to memory of 1792	4732	msedge.exe	88
PID 4732 wrote to memory of 1792	4732	msedge.exe	88
PID 4732 wrote to memory of 1792	4732	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://link-center.net/1250429/xeno-best-cheat-in-2024
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb91b646f8,0x7ffb91b64708,0x7ffb91b64718
  2⤵
  PID:1012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,893852926462847613,9947163895764211598,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
  2⤵
  PID:3652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,893852926462847613,9947163895764211598,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,893852926462847613,9947163895764211598,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:8
  2⤵
  PID:1792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,893852926462847613,9947163895764211598,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,893852926462847613,9947163895764211598,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,893852926462847613,9947163895764211598,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4652 /prefetch:1
  2⤵
  PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,893852926462847613,9947163895764211598,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4068 /prefetch:1
  2⤵
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2136,893852926462847613,9947163895764211598,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3200 /prefetch:8
  2⤵
  PID:980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2136,893852926462847613,9947163895764211598,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5588 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,893852926462847613,9947163895764211598,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3624 /prefetch:1
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,893852926462847613,9947163895764211598,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5992 /prefetch:8
  2⤵
  PID:2712
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,893852926462847613,9947163895764211598,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5992 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,893852926462847613,9947163895764211598,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:5476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,893852926462847613,9947163895764211598,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5668 /prefetch:1
  2⤵
  PID:5984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,893852926462847613,9947163895764211598,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6472 /prefetch:1
  2⤵
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2136,893852926462847613,9947163895764211598,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6484 /prefetch:8
  2⤵
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,893852926462847613,9947163895764211598,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6540 /prefetch:1
  2⤵
  PID:5248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2136,893852926462847613,9947163895764211598,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6312 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,893852926462847613,9947163895764211598,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1172 /prefetch:1
  2⤵
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,893852926462847613,9947163895764211598,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7024 /prefetch:1
  2⤵
  PID:5436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,893852926462847613,9947163895764211598,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:1
  2⤵
  PID:5428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,893852926462847613,9947163895764211598,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7544 /prefetch:1
  2⤵
  PID:5872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,893852926462847613,9947163895764211598,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6348 /prefetch:1
  2⤵
  PID:5864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,893852926462847613,9947163895764211598,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5948 /prefetch:1
  2⤵
  PID:5880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,893852926462847613,9947163895764211598,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5976 /prefetch:1
  2⤵
  PID:5828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,893852926462847613,9947163895764211598,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:1
  2⤵
  PID:5420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,893852926462847613,9947163895764211598,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7772 /prefetch:1
  2⤵
  PID:5712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,893852926462847613,9947163895764211598,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2716 /prefetch:1
  2⤵
  PID:876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,893852926462847613,9947163895764211598,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6892 /prefetch:1
  2⤵
  PID:6124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,893852926462847613,9947163895764211598,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6020 /prefetch:1
  2⤵
  PID:5804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,893852926462847613,9947163895764211598,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6532 /prefetch:1
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,893852926462847613,9947163895764211598,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6900 /prefetch:1
  2⤵
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,893852926462847613,9947163895764211598,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7408 /prefetch:1
  2⤵
  PID:5204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2136,893852926462847613,9947163895764211598,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7984 /prefetch:8
  2⤵
  PID:5808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2136,893852926462847613,9947163895764211598,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6632 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5836
- C:\Users\Admin\Downloads\winrar-x64-701.exe
  "C:\Users\Admin\Downloads\winrar-x64-701.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2888
- C:\Users\Admin\Downloads\winrar-x64-701.exe
  "C:\Users\Admin\Downloads\winrar-x64-701.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2512
- C:\Users\Admin\Downloads\winrar-x64-701.exe
  "C:\Users\Admin\Downloads\winrar-x64-701.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,893852926462847613,9947163895764211598,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5672 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,893852926462847613,9947163895764211598,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3088 /prefetch:1
  2⤵
  PID:5352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,893852926462847613,9947163895764211598,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:5528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,893852926462847613,9947163895764211598,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3920 /prefetch:1
  2⤵
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,893852926462847613,9947163895764211598,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8020 /prefetch:1
  2⤵
  PID:2860

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3100

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1300

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:6096

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\3cd31841466f47c7944fa1e72ef54215 /t 468 /p 2512
1⤵
PID:5368

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3188

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\Xeno.rar"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:6000

C:\Users\Admin\Downloads\Xeno\Xeno.exe
"C:\Users\Admin\Downloads\Xeno\Xeno.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3964

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\Xeno\Xeno.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56a4f78e21616a6e19da57228569489b

SHA1
21bfabbfc294d5f2aa1da825c5590d760483bc76

SHA256
d036661e765ee8fd18978a2b5501e8df6b220e4bca531d9860407555294c96fb

SHA512
c2c3cd1152bb486028fe75ab3ce0d0bc9d64c4ca7eb8860ddd934b2f6e0140d2c913af4fa082b88e92a6a6d20fd483a1cb9813209f371a0f56374bc97d7f863b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e443ee4336fcf13c698b8ab5f3c173d0

SHA1
9bf70b16f03820cbe3158e1f1396b07b8ac9d75a

SHA256
79e277da2074f9467e0518f0f26ca2ba74914bee82553f935a0ccf64a0119e8b

SHA512
cbf6f6aa0ea69b47f51592296da2b7be1180e7b483c61b4d17ba9ee1a2d3345cbe0987b96f4e25de1438b553db358f330aad8a26e8522601f055c3d5a8313cdd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6bc7feda-e2d4-489b-ba64-f54ab4b90577.tmp

Filesize
12KB

MD5
bda4a1b3190e89dc49981874ab99d3aa

SHA1
4eb98a7e4eb07900c22d69d64a46b14298b3bad0

SHA256
320f143c12fdc50507ad1fba710a15290f24a2e89f22ef48572ad16617887b47

SHA512
b3c2bed78f1169a0c46c4e4077761262ad3e61c656d4e629d5b1ada32372d18b7b5db276ec5ead1d96c45ee97d50bcfe8dad04fcc1f1ead0635666dd60a3396b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
480B

MD5
21e663160f5dff8ea881f1ef2246b8ee

SHA1
d5fef4f0a66744d40506434cf41eeab7ca1235f5

SHA256
c669c615bad4b6998189fd6e96f37345e721cd5e5642d060496b6d257fdde95f

SHA512
a6ef3c6aa2fdd53a34fa16e5028c374255917c4f983c8de8f73ab87a8d84d91a9b26c3abb43f34a4ba83c1f4d4a448ea08f0b24e583726be0a6d8c5827d0050e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
ec02047533545ca5a883348cf5a3fdd1

SHA1
c63aa77181193cc6356ebd49757162e46ba702b4

SHA256
9ba8f82806babea8aa8712868b17347efe7bddfcf9d095d08472c92ad8ff68e2

SHA512
0fac3401912ebee52c7ec7da9cc5580f42664bf8bd6f5038235f693e63c096b51b680886531d9c16c59491147bd9832d3342ad0af9cfcb3840b2e10ae4f351a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
10KB

MD5
42c67743de3ba3e1ad29557e3507a827

SHA1
d8e56fde73c333fdba308035f4c5f0cb054b4107

SHA256
7ca70c427867c49c8f02a7bf4960ef1db5b5667cc4c795796ad74bf51c9a35d3

SHA512
0c2ecec46a0e82bd265eadc1cd225e8510ac6708a191fc0a056d8ce0f7081dd029cdeb7373b38849595f78d9cbce426162613209dc628ec04df2ec9454ca081f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
10KB

MD5
273e34773cd5e2b90f43595d5d68e30c

SHA1
f1e62ea64b4a9277348d629427a4dde4f90abd7c

SHA256
745d509164b8a8a81e751eae80e64b428a1eab148e05e1d735f6206c526f92d0

SHA512
ec53be1ecc9dacb6e828257181e1dfc4b84548e8edbf7d8d3f6f1e48420f3f8f1870cd9ac69ecb2a96d25d15caf1e5c4d65343f208875365a08d0299b064c2cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
77a14f0ca779ec9699fc4470cb0f50e0

SHA1
a527edbc1cbbe9b312819c07c44962bd0c0bedd1

SHA256
0d523f18ba533119ab0d2a8916431d8ba23006b5e31cce8a64704a945ae0bb72

SHA512
57551ed4171cf29dd95e257a86a87e5ba3e22be541da37bcda5be24ecdf0fb524ba7a82e651dde12c659191586580816dc3e78a344bacda81768d7ec148f1657

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
033ada59993bdfcb9f614ee3290d6028

SHA1
0f73384c9c18c3655794cef25103748eb9d28974

SHA256
e38fe0f5f2c522457a66a2fe61da8af863da9d3de9372e0bc78320ed3356bb4a

SHA512
3e8a24c89dc354d3a4d66340f53a65b4defd1a540bac74fc7877736ac1972f99f66e7bf875fb3c819e5d04e75d2f7153e4a698ef48ca92481bc2683ad753d883

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
12KB

MD5
31165c29918e1df0a02a6adf655069c1

SHA1
0181ba7c0031d0ee70fff6f753acf37b6023bbf5

SHA256
121e62a023cb6834e8268da493e9433e30a84a624b6e5c76563e98547fe0426d

SHA512
5478e95414d2f230e0f1a02ff4bd4e746911384fd4ed51a0615b6be17a71e16e30930c0f38a36dc226c6f9ade0c390cebe107ad68e0c7ab5effdaacc4998cfa1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
12KB

MD5
5bcf4f790a39855594d7689b1fe43c65

SHA1
c58f8cd1e6a73e17afb8befbd97b08d2b0aecff5

SHA256
bb39e00661222096a83c0d7b2f97d9610fc441bd4ad1db27d9f2a958ebe0b411

SHA512
b982202bd80bf6d2ce88aaaff1b2cb849ec250425a1b8b07d76c5b1bf5f2664eb226110c6fae2a4c2688addc3bba41fccefd9c4285796754c37c94a42ec92cef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
a7c86ba5e193e71a6baf5b86a8c6a76f

SHA1
0c30b0c83394030a3384f35848feb50548b5b174

SHA256
f24f8fc59e3d80096e92d7bb10cd46c1ed5f42e6061bb044a4ba76099a2c1009

SHA512
01fa25a118b835282f92ea52cb071ff4a9ada272bec0775891c82824cd142949702f79700129bdad5d2dcc4eb6b919389e3fe3888cb6a3e02c810e530288f144

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
fee256de8fe5d9ee1c0add19ca225f07

SHA1
0c119751ba71cfb3657ec2fe96bbc42a698fdc96

SHA256
7d86fd14b984152b54da02e465967361242e93d32683072524e19c0ddfd532f4

SHA512
0cafbeced3430bb608a2ae8b777674c57917c3cd54279131a16e3063139a72e4411e49f22c69d8159f67753c11f650d735f60eb2592e000b88955bdfa61b4511

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
cafdd21e1b7a9a381bba5386ee2f6298

SHA1
290180dc4d8e3e2fe43161c2be4d19def9e88606

SHA256
5a30f022327f414c821eabccd9a73d22e769e0d2ae7db687af8b0c0e4994503e

SHA512
7cd5ec108337c48b155ebd846a5bbe75f402cd1e802e05718475c00aa648d44315900033f142e019ed839099dd364cbd5837f721babe804cb4f0b38f601e1b25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe580cdc.TMP

Filesize
1KB

MD5
11b71b0de6b53bc45e252b40070133e1

SHA1
cf4e6fb9beb8ae0e981a062db712e42d9c6a5630

SHA256
a96b8c42351575234626c3e806e4c24fb3535bdb1197dba07dff50cb4bdc5772

SHA512
fe1ed22716ecb33432460cddeebb929cec8894b8d176df562429020407877d34fecc95e7d0e50780f3e194b0d04a03fc3e96568ddb65e4be882c46d6d97a597a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3e1f2c3661125d5e691f878d459475c4

SHA1
74842d011c12fd412675616bf70918aa3dc7dd92

SHA256
34c6c25876ca15b00df60a3fa09dc5e312e22ff1ced347e974e43330efd6c301

SHA512
3000446271cdc6f33b6dee25602c770345d0a9e30abf18133d7e820e48c09cc760ae5f4a2bb9a62a55ccb3954cada237f664009b58bb617bb81ef33251e4c796

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
c9613715978995077281a680934b3f6f

SHA1
99c460e7793d68c2c2123e77af530133ddfe04a4

SHA256
aff144b92d05e01336f88f001a54eec57accdf1e77ca725036768bfe25995c3f

SHA512
d7b2c443e64748d22e05ff78218b028ab56fd27f371e18c9c6d32b79372c487e8175acedba06a28e5d7050b002f7777ec4dcf6d3b577a0ef3ea9b5ef80839f22

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 678889.crdownload

Filesize
3.8MB

MD5
46c17c999744470b689331f41eab7df1

SHA1
b8a63127df6a87d333061c622220d6d70ed80f7c

SHA256
c5b5def1c8882b702b6b25cbd94461c737bc151366d2d9eba5006c04886bfc9a

SHA512
4b02a3e85b699f62df1b4fe752c4dee08cfabc9b8bb316bc39b854bd5187fc602943a95788ec680c7d3dc2c26ad882e69c0740294bd6cb3b32cdcd165a9441b6

Download Submit
C:\Users\Admin\Downloads\Xeno.rar

Filesize
52KB

MD5
669feb720ce03719e7e75f574e6dec85

SHA1
344633505989079e36f38a6d8e3771e0bd3f4f28

SHA256
ca11684b8b9c0f8385085e0d5b7111a43ec8bd6c620b465df43150907e94b441

SHA512
796932069340805399a5eff50719832c17336ecf59916b4e1044087aaea0a01a0ebc7cd73a800876d652210d7d69e9a76d415b9806f95f8b14b0729b95ed8be1

Download Submit
C:\Users\Admin\Downloads\Xeno\Xeno.exe

Filesize
159KB

MD5
cb64302a0bff8d5234d4ac0b0db8ca83

SHA1
f542215fb8ae03f9f5f7197bd0c9c2c139043cef

SHA256
2a3342c8f57d71a625615563b95186587e564fd195f686bf6c0f81a8695ccd9d

SHA512
0bdeae24ef21b8d31179c52c92742efc914882a0f068fc2e19c52c143c977bb939a2da7c91eebacca3e8a3541db76fca4babc6f796590e179bd83e0e14415c22

Download Submit
memory/3964-645-0x0000000000410000-0x000000000043E000-memory.dmp

Filesize
184KB

Download