69e43fe7ea3817134874b2da967ff6d590b0513e125580179c0410df9cfef39f

Resubmissions

25-01-2025 09:46

250125-lr4q1aypaj 5

25-01-2025 09:42

250125-lpc59symgj 7

25-01-2025 09:39

250125-lm539sxkg1 7

25-01-2025 09:37

250125-llqbesyleq 7

Analysis

max time kernel
103s
max time network
244s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
25-01-2025 09:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Xeno-v1.1.35-x64.zip
Size

4.5MB
MD5

5f7548663f208cb2fdd2350b916719a4
SHA1

689f5e7275b316892c88438d3bcb1ed2bf643697
SHA256

69e43fe7ea3817134874b2da967ff6d590b0513e125580179c0410df9cfef39f
SHA512

4ea59a095cdb5ddc1aba1a4a46b717799012cafdeca795e84bee6c5f5892300c82e7199d1e3f70503d87f6fa4e8382137d0ffb738776785fc2e71d2037a4b961
SSDEEP

98304:OmD6OMyjrm+twdjTmDh/BRFQNM74slPUDtgoCrEhxGMZLvrylQQOJgq:JDUyP9tWjTml/3bZUpn7GMZbOe7Jgq

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1976	Xeno.exe

Loads dropped DLL 19 IoCs

pid	Process
1388	Process not Found
1388	Process not Found
1388	Process not Found
1388	Process not Found
1388	Process not Found
1388	Process not Found
1388	Process not Found
1388	Process not Found
1388	Process not Found
1388	Process not Found
1388	Process not Found
1976	Xeno.exe
1976	Xeno.exe
1976	Xeno.exe
1976	Xeno.exe
1976	Xeno.exe
1976	Xeno.exe
1976	Xeno.exe
1388	Process not Found

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2484	iexplore.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DE0744E1-DB00-11EF-98B1-E20EBDDD16B9} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1060	chrome.exe
1060	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2188	7zFM.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeRestorePrivilege	2188	7zFM.exe
Token: 35	2188	7zFM.exe
Token: SeSecurityPrivilege	2188	7zFM.exe
Token: SeSecurityPrivilege	2188	7zFM.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe
Token: SeShutdownPrivilege	1060	chrome.exe

Suspicious use of FindShellTrayWindow 39 IoCs

pid	Process
2188	7zFM.exe
2188	7zFM.exe
2188	7zFM.exe
2188	7zFM.exe
2484	iexplore.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe
1060	chrome.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2484	iexplore.exe
2484	iexplore.exe
2184	IEXPLORE.EXE
2184	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 2484	1976	Xeno.exe	35
PID 1976 wrote to memory of 2484	1976	Xeno.exe	35
PID 1976 wrote to memory of 2484	1976	Xeno.exe	35
PID 2484 wrote to memory of 2184	2484	iexplore.exe	36
PID 2484 wrote to memory of 2184	2484	iexplore.exe	36
PID 2484 wrote to memory of 2184	2484	iexplore.exe	36
PID 2484 wrote to memory of 2184	2484	iexplore.exe	36
PID 1060 wrote to memory of 1512	1060	chrome.exe	40
PID 1060 wrote to memory of 1512	1060	chrome.exe	40
PID 1060 wrote to memory of 1512	1060	chrome.exe	40
PID 1060 wrote to memory of 432	1060	chrome.exe	42
PID 1060 wrote to memory of 432	1060	chrome.exe	42
PID 1060 wrote to memory of 432	1060	chrome.exe	42
PID 1060 wrote to memory of 432	1060	chrome.exe	42
PID 1060 wrote to memory of 432	1060	chrome.exe	42
PID 1060 wrote to memory of 432	1060	chrome.exe	42
PID 1060 wrote to memory of 432	1060	chrome.exe	42
PID 1060 wrote to memory of 432	1060	chrome.exe	42
PID 1060 wrote to memory of 432	1060	chrome.exe	42
PID 1060 wrote to memory of 432	1060	chrome.exe	42
PID 1060 wrote to memory of 432	1060	chrome.exe	42
PID 1060 wrote to memory of 432	1060	chrome.exe	42
PID 1060 wrote to memory of 432	1060	chrome.exe	42
PID 1060 wrote to memory of 432	1060	chrome.exe	42
PID 1060 wrote to memory of 432	1060	chrome.exe	42
PID 1060 wrote to memory of 432	1060	chrome.exe	42
PID 1060 wrote to memory of 432	1060	chrome.exe	42
PID 1060 wrote to memory of 432	1060	chrome.exe	42
PID 1060 wrote to memory of 432	1060	chrome.exe	42
PID 1060 wrote to memory of 432	1060	chrome.exe	42
PID 1060 wrote to memory of 432	1060	chrome.exe	42
PID 1060 wrote to memory of 432	1060	chrome.exe	42
PID 1060 wrote to memory of 432	1060	chrome.exe	42
PID 1060 wrote to memory of 432	1060	chrome.exe	42
PID 1060 wrote to memory of 432	1060	chrome.exe	42
PID 1060 wrote to memory of 432	1060	chrome.exe	42
PID 1060 wrote to memory of 432	1060	chrome.exe	42
PID 1060 wrote to memory of 432	1060	chrome.exe	42
PID 1060 wrote to memory of 432	1060	chrome.exe	42
PID 1060 wrote to memory of 432	1060	chrome.exe	42
PID 1060 wrote to memory of 432	1060	chrome.exe	42
PID 1060 wrote to memory of 432	1060	chrome.exe	42
PID 1060 wrote to memory of 432	1060	chrome.exe	42
PID 1060 wrote to memory of 432	1060	chrome.exe	42
PID 1060 wrote to memory of 432	1060	chrome.exe	42
PID 1060 wrote to memory of 432	1060	chrome.exe	42
PID 1060 wrote to memory of 432	1060	chrome.exe	42
PID 1060 wrote to memory of 432	1060	chrome.exe	42
PID 1060 wrote to memory of 432	1060	chrome.exe	42
PID 1060 wrote to memory of 3060	1060	chrome.exe	43
PID 1060 wrote to memory of 3060	1060	chrome.exe	43
PID 1060 wrote to memory of 3060	1060	chrome.exe	43
PID 1060 wrote to memory of 1964	1060	chrome.exe	44
PID 1060 wrote to memory of 1964	1060	chrome.exe	44
PID 1060 wrote to memory of 1964	1060	chrome.exe	44
PID 1060 wrote to memory of 1964	1060	chrome.exe	44
PID 1060 wrote to memory of 1964	1060	chrome.exe	44
PID 1060 wrote to memory of 1964	1060	chrome.exe	44
PID 1060 wrote to memory of 1964	1060	chrome.exe	44
PID 1060 wrote to memory of 1964	1060	chrome.exe	44
PID 1060 wrote to memory of 1964	1060	chrome.exe	44
PID 1060 wrote to memory of 1964	1060	chrome.exe	44
PID 1060 wrote to memory of 1964	1060	chrome.exe	44
PID 1060 wrote to memory of 1964	1060	chrome.exe	44

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Xeno-v1.1.35-x64.zip"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2188

C:\Users\Admin\Desktop\xeno\Xeno.exe
"C:\Users\Admin\Desktop\xeno\Xeno.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=x64&rid=win-x64&os=win7&apphost_version=8.0.11&gui=true
  2⤵
  - System Time Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2484
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2484 CREDAT:275457 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2184
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2484 CREDAT:734213 /prefetch:2
    3⤵
    PID:2204

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef66c9758,0x7fef66c9768,0x7fef66c9778
  2⤵
  PID:1512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1172 --field-trial-handle=1504,i,4840666677593898309,716651963222313531,131072 /prefetch:2
  2⤵
  PID:432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1428 --field-trial-handle=1504,i,4840666677593898309,716651963222313531,131072 /prefetch:8
  2⤵
  PID:3060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1640 --field-trial-handle=1504,i,4840666677593898309,716651963222313531,131072 /prefetch:8
  2⤵
  PID:1964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2312 --field-trial-handle=1504,i,4840666677593898309,716651963222313531,131072 /prefetch:1
  2⤵
  PID:788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2320 --field-trial-handle=1504,i,4840666677593898309,716651963222313531,131072 /prefetch:1
  2⤵
  PID:672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1624 --field-trial-handle=1504,i,4840666677593898309,716651963222313531,131072 /prefetch:2
  2⤵
  PID:1912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3244 --field-trial-handle=1504,i,4840666677593898309,716651963222313531,131072 /prefetch:1
  2⤵
  PID:1064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=3404 --field-trial-handle=1504,i,4840666677593898309,716651963222313531,131072 /prefetch:1
  2⤵
  PID:2560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3668 --field-trial-handle=1504,i,4840666677593898309,716651963222313531,131072 /prefetch:1
  2⤵
  PID:3052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2416 --field-trial-handle=1504,i,4840666677593898309,716651963222313531,131072 /prefetch:8
  2⤵
  PID:1984
- C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe
  "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe" --reenable-autoupdates --system-level
  2⤵
  PID:1560
- - C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe
    "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x154,0x158,0x15c,0x128,0x160,0x140077688,0x140077698,0x1400776a8
    3⤵
    PID:1708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3368 --field-trial-handle=1504,i,4840666677593898309,716651963222313531,131072 /prefetch:1
  2⤵
  PID:2476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=1924 --field-trial-handle=1504,i,4840666677593898309,716651963222313531,131072 /prefetch:1
  2⤵
  PID:2168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=108 --field-trial-handle=1504,i,4840666677593898309,716651963222313531,131072 /prefetch:1
  2⤵
  PID:1104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=3792 --field-trial-handle=1504,i,4840666677593898309,716651963222313531,131072 /prefetch:1
  2⤵
  PID:1804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=3708 --field-trial-handle=1504,i,4840666677593898309,716651963222313531,131072 /prefetch:1
  2⤵
  PID:824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=3672 --field-trial-handle=1504,i,4840666677593898309,716651963222313531,131072 /prefetch:1
  2⤵
  PID:1940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=1868 --field-trial-handle=1504,i,4840666677593898309,716651963222313531,131072 /prefetch:1
  2⤵
  PID:1548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=2336 --field-trial-handle=1504,i,4840666677593898309,716651963222313531,131072 /prefetch:1
  2⤵
  PID:2572

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ee122649504352de5efd97abf0765e77

SHA1
b8d01e44237303164129c9240c8550b5df45ed00

SHA256
7ec0a14da59d0ec954fb85b53c9ce1d57618624500ec91689061227e95e013c2

SHA512
2a8984b044b218a09588f564acb0f682e9f85c5b55e7bed05e4c0f531dd7f154c9ead3c221fb7094c92998c30bdd956c15948ca1015698e32de6c09beed948c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f4a92d92f2880652034911c5bf1aa2cb

SHA1
a485fc8273113aba8c3aaefbf4557963034d9bae

SHA256
057c8a04cca37a917b1963a63dd70868061582d050b7637a825c54cb2ea24582

SHA512
9eb8ee0208c8ce4f77a4f79b8ade8257bb862b812d494c51407b0c28520f0f88654ff05d4edb29248645f7b77e2cc8528ab3ec8d24d60bbe8ace31061f2f2d0d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
894ac0a71e6e2623aa7b95715e2f6ae4

SHA1
e26401094fa2eb500f48bb53ef6b3da845943d3e

SHA256
497ac01785556ddf760c4e9b21521c9f9a7216919c71bead0c703ea25a6bebf3

SHA512
7f5e8f918e910c4098444e6da93e16c8c2f3ef8a5a97dbfaedf1a75f9adfb454ff8ea95c497ae75006c3f1c13f0a11a571c9546565c65b63e4ee4058a3ba4e72

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b77146b645dd1e43142549ef4ec47f21

SHA1
5ff64ef0b75c05bf60b62efce1ce6c1578386b00

SHA256
096aa303498d90358bc42a64fe020637de4857c9f928f1cdb3cfc0f35b022913

SHA512
aa8d06a530a03878fb577a1d6c05badffd2cb176ba18ab1561ed599ee4ac3f482f0ea7c36cd8b7877a6f676768bf8a9d4173d71b2ec7c4be7477eaeb1968a507

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
47f145946b599c6e28cc1ecb65867880

SHA1
30b556e30ea32cfa517cce811f05cc336ac4f61c

SHA256
f9501313e60933428a77bb88adaad535127ae418adb0a0dea5cb70db62e166b4

SHA512
e524aa84aefcf71e5faa3f66e6235e39826ad6db8b3f95ef640c6e8dce9cfe9d9a0f3ecb9d4858b2595b644e524b9b60cfd0d0f41f69c8a04d928cdfcedcaf08

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f900b3af998703504601b5d72bd617f3

SHA1
63ee88f4a644339874b211e4f125c75c58666aae

SHA256
c05554244c8079f9202b48b2526e16ef7113087d397aa60d06c075e8f20e563c

SHA512
61b83e9aa9b69792cf5038c1321ec957a28c1f9da0cc92252f545e2ff877ade0e960966792606816f843a83ef23770bc663cb7d1825ae67d8a76bf82e51be944

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4e6cd36cd39b458bfac71d26e203aed7

SHA1
2e9b007c0ba966416c551259d85c1926b92dcf41

SHA256
c0fd54338db1c02608fe18980c0914c86fad1d4a81ede809463febc42704b7a9

SHA512
8b4319a301c3118247b02dc4c0e83f959681d859870a321b711d9f83c2138c938000f6682b30b32dae9e2d41f2f761028d72f40090bf410e157a2c2e572b86c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
214a282988e852facdaa28bd637e2927

SHA1
cab23ef0c78c34df1fa7bc99c0463d0537db8616

SHA256
74a0d5723d31b6e8571a88700b7bedf3c958a2884a91e5f8030cf78ac0f9fd26

SHA512
c6d3aafb8e7f3a28e3905dae3a0fd52a773adc885d6b2c4d122d28b2ab2d373c7c0fde0f95ea16a11dd6e01a9f629e2d280cee43202d98eee079ffa8bcb0bbd6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3e4f6792285131b18a0950d5c274c5c1

SHA1
cbe0e31371f928344ab664276af499e145cc6b72

SHA256
c2b58ee35da5212461873a1040f32c67566d116b0ed44611116ee5ec1f47706f

SHA512
518c6d21604ddc88f6bfdeb21d40ddbb979f2eb743ad497dd507f935a2b9cae5896e5cebecd4672805481016f307cbcaa6e85cc40d1593b4aa9eff0a14920c44

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
54675244e7003f70e76f16597cdd5d95

SHA1
b4c234dff378583163ca5600b32473224997d0a2

SHA256
a41038469cded6835bcf048a8cd1e181c0c986dcebbcbd39637de1e854b2cc15

SHA512
7d475947c95adecbb832dce3df220eed17d9f233b084437d2cbaf4941cb5ee55103a71190c2265d6301f4d0039070f5a7cc7a9631274f1d29dc04c8588031ab6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fd9097e2d90b1e6c2b54a221f968e2a1

SHA1
f1d9e559ad53d375b3886ad8117cf9a95b226d0e

SHA256
92daabc9418de2b3ff22b5b9adfdbb5f8bcbf424a4e64f0ae619bcd6e352471e

SHA512
162884871e8914c71d0cadb0593073e8ec18ad338a26e460ff407d580bbccff671c2b29006611b614b962d168d9ad04f4be1a096d2dbfc7022428c7843080d09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
10551f815810232df18eb29d8c2c8fd3

SHA1
bdec7f3ed056f8b30f667b59e65fef83863d6788

SHA256
985bc323fbe268f5c403541762f935cfe813796df4a00d1d7f5593b56cd51918

SHA512
225d2540263ac7f818e87cfcc8048b6e10469be05366c06a830b515e2271b5dfa5f01f25bb832ec629941efe5f2894b78024b4644bb5ffa97dbac7283296761c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
01fac5d51c0f80363898950c6074d3a9

SHA1
591d9f9c4b94a32ac1d339740aff5d4751314a53

SHA256
15303a5a2c8b5f0fefab4672d0232a629566f6c575b91b32335de4bb644cf8b6

SHA512
1cfcf4cadf638979ad9d7dda8e6bc0a5ad76f0c20eab8289496b6c3f14ad02e3d9234f98cfe04c69aed1922dfba1cae02d77db075bb2897b1dc262d8bcd1080f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
febc4c05813fb58520fc47876947790a

SHA1
57ec0d8caf88814012243f7c20f490603f7918e6

SHA256
d86aa435d2e5d437eddccdf3226537693f0ff78e879565019c5217704eab7f1f

SHA512
246a07dd6d4aab2f6b33a217d7c6adc7f46b7d933458c5cccfbcf0f15244127dbaf93293b4e703724a2dd1a02369e61a7d8e1299b59cd13229639d5eb845e661

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b1ee84c71c137a6c2a62915c0d805941

SHA1
926142a89bb1816da7679cfdbd98a93a16d7df8f

SHA256
ed7e01e46bec462f06a015cbd02fac4a0164499d248c9e1023930d39c7c1eb8e

SHA512
d2d4061cd0328406e38d7fa79c6344a7552c065137131bd095d3cc0976ce59cb94edd264dfae4819cf9155a2a6dba73e9faf5fca82f59b459ceef52f9596d9d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aaeba640f16a4a1a5e84e7d755971edb

SHA1
0482acb0463c45110583405764535077fc19503e

SHA256
65d96aaf7ee152919a8debb6c0b29241214cbe3560f25598ee857707bf1bedd0

SHA512
fc83b791af18e4b3e7dcd8f7787d6b134110acb7e245f2f2b9a0139c77247c158e858e225bb5484a914be76ada24e61fe995faa10f56e9db92c2131d8f1ab94d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0d98589996f6131baf5ccc00e017ad92

SHA1
8d2a9289004145ff7f8d29be55712fd59cd3b48d

SHA256
3f7d1c11560bbecc39bc9a9d3bb5a89ffa91d8fa7e3487c48dd62b15a8fad0b5

SHA512
0039638ce07b634ba2faef006352ae46a9f784fa0d9498d18db156c82b3c750c6155fe3e29cdbd793dba33cff3060cd5a98651d70c8bf85822e7528dc1444d23

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8cd0fbe42f840c5bd851aec3207111bb

SHA1
a54e1da309d395e26984d5f94fb0130338ee347f

SHA256
66ee767a9e9d056f1a3158cdc49369c41f869279f17f6f50ac0f74ffebb9a9e8

SHA512
53ecd853eafc755cddcddc06fe3160a4450b7e815d8c1ede4ca950d1ffdf5fa27965f65ca9a9dc55ccd6a6b7b1e53cc17bf0697d7c18d73d6f6b7dbc3d9b66a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
12b37ca331c6f1e81a8ceed84ff0b146

SHA1
b75c07e8ab5dd3a57a2bd9f64da5f54584d2472d

SHA256
9dadef7266a1c0a1c67d6e941edcb10fb2ff37851731bbe818e0dd442dc6fcd1

SHA512
76033f3cf3f6d46766f21c60aeb3737a6bc409f7cfd295fb80cfd15a6665dc09235b299a63dc639dc6408acb7709aac33053c9c7a62b489c5ac6dc61b46fabc9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3d9e791e653b8cb5788812d62a7d8258

SHA1
58483a9e0f13fb999174b77a16f32424f6d3f153

SHA256
e8f2d5aa7e655ca853f9e64b27a6c539195aee717055df05ede0f12bbc69bb67

SHA512
12c059471584c8be425aaeb20f0af6f17ffcc5d0afd11464da75fcb5b6272ad6d3e622830a00fc4faca69330b6fc3d790786a686b1e070a2cb418450e60fe6df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6732ab853345c0624d3b5aef5913dc38

SHA1
d833ff860d1b716e314e70e726eb1f2818d2897e

SHA256
a506fecb210b2255b131db7373b57c09af1dbd378b5159b02e260153bb77f474

SHA512
23c829c2afbaaaafba1f4388136ed58dd3e75059f9a9ce46b6c61d6b4d1103834279643e2a7865b544005128bec7ff1ce3dab40a5cdf0d4550106aa69bd30ccc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0c4d7813d8efff002091c20aad80e267

SHA1
fd30fb3a7df748d0ebf864218485080a7e32e343

SHA256
3a2bee0a1574ef971a6db54cb16bc11fcebd6e2b28c371786881306a34c35b06

SHA512
8f012fdf60c16307f518acf2c2d8d1d41e55b9904169c702409636ae35b6c8ae655cf082c573336b4dc811d89ab3cc706409db6957dba7aa01c9cf3c1b8a6805

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000005

Filesize
215KB

MD5
7b49e7ed72d5c3ab75ea4aa12182314a

SHA1
1338fc8f099438e5465615ace45c245450f98c84

SHA256
747c584047f6a46912d5c5354b6186e04ea24cf61246a89c57077faf96679db6

SHA512
6edf4594e2b850f3ede5a68738e6482dd6e9a5312bffa61b053312aa383df787641f6747ac91fa71bb80c51ed52a0c23cc911f063cd6e322d9a1210aea64e985

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
af5f79ee1b02f86b7dc934ff1f672219

SHA1
99a5c50681a4ca354461558e88bc8f4a2972c524

SHA256
c2eb39a22381d14ea95dd5eca75740bb0731aa287492b96480536d03fe07a576

SHA512
06a2a33db78008f70cf186d34fdcd4ac89216ad15c73ac6254077c5ea430eee6083e759b53126020c3cb299218dc2619ce100ee21ca7845dab583a85c25b18e8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
a4ebdcd2a851109518441dd62ea5764d

SHA1
8b52a31008f7368026d41ff79db721ed7bf5e978

SHA256
fd2e0260370dddc44d935c323df986ba63a8ae0aa160f08a9ed57af731a9a057

SHA512
1433ecee4d26c6815b771591417d4db32eec8df007ee50de9ec1fc25501dd59bdd1c19500bdcee1233b1e024a2b3dcda169f8970cafbe7f8f55a982ff43f3693

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
361B

MD5
2314c712063138dd904e27992d88441f

SHA1
c62cba67d1ac1d2b496ea9f538c79590505bd2ed

SHA256
5e4c7bc35a173eb8b66e5a7ec24d66d83d7362877334cd84344d048d79fcabc2

SHA512
f4e9548c85d0a656da4661edc186449c180fcd5dfae325f42713064af444f81f4dec8b2ce681ac80e47bb9da19eaabb815996de6d11e1a49f85b43a3ee9d7b40

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
363B

MD5
5c191e94c611e288375cc2f97de56478

SHA1
57536b9d49a2435c9b1203f3ba9dea8dbdec2ca8

SHA256
0bbc1f43fba380105cd6a09f0c0a89a9fe830ebd80ce80b20f85739b7b8879bf

SHA512
18c17c18c82abfe38ca21cc0fb6bc8d96f76f988f48b2bd85c30cc885c0683c580219316d493d41ee192cff6d79d803fcfe6c84760fc44ec203153d2df388eec

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
363B

MD5
3ae27db7499d1b901570cad7131a9545

SHA1
1bbdc75e2c3a453edeade9d715818dfebeb7c13c

SHA256
f85a8cb7474d779a2bcdde0fc6acfca88243024bebc44882d20d815ab36dc89e

SHA512
9a84213489f12b0320c5cf3057c316372a63e7aeb1be6eb97461fe5ffce03c42e8dbc8f92a37e8e4d2b61512bca29fedfd9c42159e0c5466267569ed53affa27

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
361B

MD5
917d86adf3a76c4dce74b710044365fa

SHA1
501d2d65e706e34345071d30addad59b2ac6fe1b

SHA256
73391af7a3af78ed82398c142be083828631ebbd357b42844a838dcbdba684cd

SHA512
182980361deb9dc3dab7f20245558dfc3a70bd35c15870acafc8b49d88a7b82b39962421cfe16b3a07e9fa57039e643993a99cfcd634260d68360bd461a4e4eb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
0a32ee93e4524316f9ba2fc74ed49a47

SHA1
35d70f1da7783efa5fa68947ec00dbcb793a87b4

SHA256
49e76de8beed7e28ef3168e05f65e949901c86aad2a5c8f2c6fc5e312257ba17

SHA512
365d748cce064480c27ca5d100e7f33ab36d54e7d6e5e45803d583ac2e3fb0b85bc6331839d2a27851875f9cac11956337395b0a66e2a14c8bc0f4301e4fd242

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
01a2003e9226944278754e43f0aacb77

SHA1
fb434d8162510cd9e0c7b12cc88a69a39ff4365f

SHA256
160c6ca9e2b6ff60841e1cf41d55a91fb4530b2d3acca78defe235ffe707c11e

SHA512
067cd4ff4c387034380837e9d90a1ce6e9c3ce0425cf76d74837389f711c7cc228d46f0101244589fe0c43b7881639f76731f4a546f8ac30b560370ed11ff126

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
3d376823992ea4e8213160a8d1050d83

SHA1
2b2f1bb90efd38c09f3d5830e2b9e23615f5752e

SHA256
f624b28c21e6a8991562048facfe9cf7d7b96d9e857d6d7a73e471b42e041fda

SHA512
07214f1e91de905709f6680b561b310d21f6496f5446729edcecae6b508132e32b60be2d9b569119b798e3a6db4bc7306fecf8e3d0012b1b59034d5e2acc6fc8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
7f2485bed9d9325e3382c6f223ddea35

SHA1
2e47265c34fe17cb8fd98f053ff0fdf4a5101c67

SHA256
d987d9da819b15a293d4e20b03d11cf79f329ddba7e3724b68d8cb2b15f89bfd

SHA512
b1581434344ee9f07cf86a40a1317b28d6352ff23107ae09e349ed65855189463f80b02e44af5b80eafbc4f7913158d0e8121e4505bb710378457a4a5daca1e1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
7d61d57a522c154896cbb4abe7861429

SHA1
c4ff1d526caf6589557a7fb51ad4ae878c6139fd

SHA256
db3b8130c26bb2cecbbc7a46978ebd7ae351c268a94ae016b74257291e735d52

SHA512
525152507adbc14c0ca6a7d4c907950b3a161943dcd7adc4860bfd1895a4aa083383c0c34448d8b6ea1e8dad9f9e5697918a13866c0170be49bf53b0c4cfeb2c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
1e5d66a1fde038b2878be7fb52af7348

SHA1
2ff58a3c74ac2935cbc97116520f8e30a29c900f

SHA256
538724c73148fc3b143f88a446f2b40356211c955dc4c569a0f015a653ee99d0

SHA512
9abffc7932acb2644b000e3565b689f64d9ab39d9428b88ce1e1d257d111e2b8dd9eb83bb09b9c6b24c81f84efa71981a950f2d8ed61f1a9af5c5eecb8b33941

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\d2ae85f7-abf7-419d-8ca2-c93f4baaf180.tmp

Filesize
6KB

MD5
b35b4e08e250ade69787b3590ed652f7

SHA1
a979d9495bad3c56021e3ef9f264a9766a763a8b

SHA256
f1eabe39d6ca9d2d49678ac9df2cc9c1c0033b2f5e1f5bf8243eef718b3f6987

SHA512
e436ff0d3e1be330f4131dd71c95a2021b41f139bc9ebb56f6fbd438ab5241bc4d22d550cbd505940791ad66b830346ce13be555b0103d42fa04bd5f9d354c0d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
354KB

MD5
b08ce3627f9bec9656d5eaacab2174ac

SHA1
4eefb3c284720fbf34066fa121584663bc9e8ba7

SHA256
9e154e2d00e583046b1086a8faa757b59eb7f6dbbb69dfbe3483961d8ea9c206

SHA512
81c3887be734aa7e1baf9b64712710cd5f30fb3b75176da34d7521203efd5a937adb1f956d8cdb8b42f5715b4980be4379454375a0a36262d02520701535567e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF865.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF961.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
\Users\Admin\Desktop\Xeno.exe

Filesize
140KB

MD5
f0d6a8ef8299c5f15732a011d90b0be1

SHA1
5d2e6cc0bd4f1e810808f2a284f6c2a30b21edcf

SHA256
326bae0bd1398234dcef4c3d71f00e30cc9b447fa963e21d6f29605f42bb7e5b

SHA512
5b9f1517949a7fa9fdb7413146632d21a4208dc92823b673af85963ae5cc7f827b3ba27f3e9c5554c45e726ad159aac77d30306acc3559bd8712534e41ff0f27

Download Submit
\Users\Admin\Desktop\xeno\api-ms-win-crt-convert-l1-1-0.dll

Filesize
15KB

MD5
c8dbf0ca88facfe87899168a7f7db52c

SHA1
e2cf163ad067b5d3b19908a71ed393711f66cd09

SHA256
94b6e91b93c2202dabd659bff294bee87c22897a30a6b4930b49051c2fb502dc

SHA512
e85c738f5d5a0ae6c3ef75a082712cb3cf2feae4560d316cb110e4eaf3a97d6058d5374da2a5edde39c3114f9aff8a027cbdff8cf49be2425943bac09c39e70b

Download Submit
\Users\Admin\Desktop\xeno\api-ms-win-crt-heap-l1-1-0.dll

Filesize
12KB

MD5
98da186fd7d7873c164a51c5d7b77f1a

SHA1
725a8b8fdfbe6a1e85674f4b2a7c0dd08411e00b

SHA256
80139e4caa379d87b1d1dafc23ace71d2b330368115f6314140d4ae59c2a78e8

SHA512
587b49a24cc59d4dcb62b59f379d1c9010196a6551cfc99ffdd931eeb0172618f020863191e530d65ad198e57063c57ba6f70bcf80591304243268ea5513f806

Download Submit
\Users\Admin\Desktop\xeno\api-ms-win-crt-locale-l1-1-0.dll

Filesize
11KB

MD5
ff48b107b2449a647c64baabd49408a1

SHA1
efb868ba125d9ff08474f02b9483d74c36a13cee

SHA256
7bb8644e565ad4bcfd890f9044bccb4d99953a740e9a500b1f820b2fdc3fc240

SHA512
4da2e4b727e7f31f8bffd680453c451b444bdf217c15cb36e353f8bb5ecb6c6481caa7d848558c7d94cfc2d1bc3551ace11e85ffc8ec7a7b570a59c294ea0216

Download Submit
\Users\Admin\Desktop\xeno\api-ms-win-crt-math-l1-1-0.dll

Filesize
20KB

MD5
e10e077bb06209aedd0d0d378c758f73

SHA1
97a9053a311280678f8ef65dc4e25975c41bd4ee

SHA256
8a7bff1c918539a75c25568db25933d653c003e016fd7791a37186b42bbb7c20

SHA512
571c1fc4192320bd967b603e6cda917a62f4720eb4dcd557ec2913d2558c0cfe68f936198f5809934aaa3a1d6049e8e918eb0e638a7244df5c71ef0c78843191

Download Submit
\Users\Admin\Desktop\xeno\api-ms-win-crt-runtime-l1-1-0.dll

Filesize
16KB

MD5
f91e1ff896b5616919ac97c7095c513e

SHA1
4ec6eed0bac5a8801db10238c7b3a5d35a87be67

SHA256
07382c0d91dad2bb6ba8bd06ea02f12c57abf7c4e5a70672e9f2954d09a4ffd4

SHA512
6448d6cdfde11e1805b6d381111ea062f681807c9dc54ae890305f287b13b6fb57ef3f4d3b909e56b81c99830c086b5702b46ba0f93e695fce2b87b32fa4b26a

Download Submit
\Users\Admin\Desktop\xeno\api-ms-win-crt-stdio-l1-1-0.dll

Filesize
17KB

MD5
429c26ed27a026442f89c95ff16ce8c2

SHA1
69ed09faae00a980c296546c9b5e6a8d5f978439

SHA256
2a466648affd3d51b944f563bb65046a3da91006a0d90fb2c0b123487a1fc1b3

SHA512
04641164d9e1eb3183db0c406583626011dfe2b2574551c0ac466ebf44165afcd7d8faf356b8268b4fc9a54db20de010a4e4293594ad2e605950aea65636f4e5

Download Submit
\Users\Admin\Desktop\xeno\api-ms-win-crt-string-l1-1-0.dll

Filesize
18KB

MD5
0f593e50be4715aa8e1f6eb39434edd5

SHA1
1117709f577278717c34365ce879bcd7c956069b

SHA256
bf4ea10be1b64c442ac0ccf4bdf69f6703467176a27e9e14a488d26448a6e179

SHA512
487dcbf7b7f18d62606cb2f05c8feff07e6ecda42e643f5919c6edda66cdb3b8cc393b0d260374f06c10cf54082410fc9f02bd87cc50866bc0c28b0bcec3e658

Download Submit