hxxps://gofile[.]io/d/t9UfIZ

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
26/01/2025, 13:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://gofile.io/d/t9UfIZ

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Xeno-v1.1.35-x64.zip:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
536	msedge.exe
536	msedge.exe
4744	msedge.exe
4744	msedge.exe
3560	identity_helper.exe
3560	identity_helper.exe
1328	msedge.exe
1328	msedge.exe
4708	msedge.exe
4708	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4744 wrote to memory of 680	4744	msedge.exe	77
PID 4744 wrote to memory of 680	4744	msedge.exe	77
PID 4744 wrote to memory of 4888	4744	msedge.exe	78
PID 4744 wrote to memory of 4888	4744	msedge.exe	78
PID 4744 wrote to memory of 4888	4744	msedge.exe	78
PID 4744 wrote to memory of 4888	4744	msedge.exe	78
PID 4744 wrote to memory of 4888	4744	msedge.exe	78
PID 4744 wrote to memory of 4888	4744	msedge.exe	78
PID 4744 wrote to memory of 4888	4744	msedge.exe	78
PID 4744 wrote to memory of 4888	4744	msedge.exe	78
PID 4744 wrote to memory of 4888	4744	msedge.exe	78
PID 4744 wrote to memory of 4888	4744	msedge.exe	78
PID 4744 wrote to memory of 4888	4744	msedge.exe	78
PID 4744 wrote to memory of 4888	4744	msedge.exe	78
PID 4744 wrote to memory of 4888	4744	msedge.exe	78
PID 4744 wrote to memory of 4888	4744	msedge.exe	78
PID 4744 wrote to memory of 4888	4744	msedge.exe	78
PID 4744 wrote to memory of 4888	4744	msedge.exe	78
PID 4744 wrote to memory of 4888	4744	msedge.exe	78
PID 4744 wrote to memory of 4888	4744	msedge.exe	78
PID 4744 wrote to memory of 4888	4744	msedge.exe	78
PID 4744 wrote to memory of 4888	4744	msedge.exe	78
PID 4744 wrote to memory of 4888	4744	msedge.exe	78
PID 4744 wrote to memory of 4888	4744	msedge.exe	78
PID 4744 wrote to memory of 4888	4744	msedge.exe	78
PID 4744 wrote to memory of 4888	4744	msedge.exe	78
PID 4744 wrote to memory of 4888	4744	msedge.exe	78
PID 4744 wrote to memory of 4888	4744	msedge.exe	78
PID 4744 wrote to memory of 4888	4744	msedge.exe	78
PID 4744 wrote to memory of 4888	4744	msedge.exe	78
PID 4744 wrote to memory of 4888	4744	msedge.exe	78
PID 4744 wrote to memory of 4888	4744	msedge.exe	78
PID 4744 wrote to memory of 4888	4744	msedge.exe	78
PID 4744 wrote to memory of 4888	4744	msedge.exe	78
PID 4744 wrote to memory of 4888	4744	msedge.exe	78
PID 4744 wrote to memory of 4888	4744	msedge.exe	78
PID 4744 wrote to memory of 4888	4744	msedge.exe	78
PID 4744 wrote to memory of 4888	4744	msedge.exe	78
PID 4744 wrote to memory of 4888	4744	msedge.exe	78
PID 4744 wrote to memory of 4888	4744	msedge.exe	78
PID 4744 wrote to memory of 4888	4744	msedge.exe	78
PID 4744 wrote to memory of 4888	4744	msedge.exe	78
PID 4744 wrote to memory of 536	4744	msedge.exe	79
PID 4744 wrote to memory of 536	4744	msedge.exe	79
PID 4744 wrote to memory of 1936	4744	msedge.exe	80
PID 4744 wrote to memory of 1936	4744	msedge.exe	80
PID 4744 wrote to memory of 1936	4744	msedge.exe	80
PID 4744 wrote to memory of 1936	4744	msedge.exe	80
PID 4744 wrote to memory of 1936	4744	msedge.exe	80
PID 4744 wrote to memory of 1936	4744	msedge.exe	80
PID 4744 wrote to memory of 1936	4744	msedge.exe	80
PID 4744 wrote to memory of 1936	4744	msedge.exe	80
PID 4744 wrote to memory of 1936	4744	msedge.exe	80
PID 4744 wrote to memory of 1936	4744	msedge.exe	80
PID 4744 wrote to memory of 1936	4744	msedge.exe	80
PID 4744 wrote to memory of 1936	4744	msedge.exe	80
PID 4744 wrote to memory of 1936	4744	msedge.exe	80
PID 4744 wrote to memory of 1936	4744	msedge.exe	80
PID 4744 wrote to memory of 1936	4744	msedge.exe	80
PID 4744 wrote to memory of 1936	4744	msedge.exe	80
PID 4744 wrote to memory of 1936	4744	msedge.exe	80
PID 4744 wrote to memory of 1936	4744	msedge.exe	80
PID 4744 wrote to memory of 1936	4744	msedge.exe	80
PID 4744 wrote to memory of 1936	4744	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://gofile.io/d/t9UfIZ
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe98123cb8,0x7ffe98123cc8,0x7ffe98123cd8
  2⤵
  PID:680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1920,5379775273831673692,9004085556032044774,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1932 /prefetch:2
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1920,5379775273831673692,9004085556032044774,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1920,5379775273831673692,9004085556032044774,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:8
  2⤵
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,5379775273831673692,9004085556032044774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:2072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,5379775273831673692,9004085556032044774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,5379775273831673692,9004085556032044774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4576 /prefetch:1
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,5379775273831673692,9004085556032044774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3924 /prefetch:1
  2⤵
  PID:1016
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1920,5379775273831673692,9004085556032044774,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4704 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,5379775273831673692,9004085556032044774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:1
  2⤵
  PID:3864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1920,5379775273831673692,9004085556032044774,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5816 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:1328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1920,5379775273831673692,9004085556032044774,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5848 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,5379775273831673692,9004085556032044774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5848 /prefetch:1
  2⤵
  PID:748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,5379775273831673692,9004085556032044774,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5952 /prefetch:1
  2⤵
  PID:3992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,5379775273831673692,9004085556032044774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  PID:1000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,5379775273831673692,9004085556032044774,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1920,5379775273831673692,9004085556032044774,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=880 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4440

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2100

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fdee96b970080ef7f5bfa5964075575e

SHA1
2c821998dc2674d291bfa83a4df46814f0c29ab4

SHA256
a241023f360b300e56b2b0e1205b651e1244b222e1f55245ca2d06d3162a62f0

SHA512
20875c3002323f5a9b1b71917d6bd4e4c718c9ca325c90335bd475ddcb25eac94cb3f29795fa6476d6d6e757622b8b0577f008eec2c739c2eec71d2e8b372cff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
46e6ad711a84b5dc7b30b75297d64875

SHA1
8ca343bfab1e2c04e67b9b16b8e06ba463b4f485

SHA256
77b51492a40a511e57e7a7ecf76715a2fd46533c0f0d0d5a758f0224e201c77f

SHA512
8472710b638b0aeee4678f41ed2dff72b39b929b2802716c0c9f96db24c63096b94c9969575e4698f16e412f82668b5c9b5cb747e8a2219429dbb476a31d297e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
5386306c3f4742e016d8e94b6ffa875f

SHA1
1ce96230d9d101e1979da12b454fab27db82a337

SHA256
b1b5b7220b793ce48f5b81eeee1f7f6f1b6642d5f9070a61268e3e61a9d3bff0

SHA512
24b61d267e02224a8bd4d7498ec766129aaeb858229933c8964233fb9b5855f722abc706de6d66b13bec9b0542e6fb742c017f6f7a369db31901b93702125d53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
391B

MD5
5443244819526c00cac01d095e2bf58f

SHA1
c8cbae51c0d5ccaf8cefd43834893204bf6081dd

SHA256
51b41792d3e73abdcb83e89e005cf3e188c9caac9cfdc2dcf7c5367c6fd65ceb

SHA512
395c5a9a2c2b636ecebcf436128215d582c6a30e89a58fb7ae27b8eddd7b5be1f8b72e43880233cfd2fcf761aa5a1b50f6fde026462bc72db2bacee37caf50cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1cca363254f37718a5dc209362c4a738

SHA1
f7ae72c0b4ae0b48d1f61dccf950670bd8406d9b

SHA256
e03b9efa8bb0b3f3c963bd4aa529f9bb72da2e583f104ce24a8258b9e4149769

SHA512
cdeaef7cfb26c37b144b0252f9856eee9ff7d89a682d5b4d698f97cb980a7b00d5ab819d41579e63ceaa01fbcf8dd0cdec390579ae521ba4de9603fd8c2f8fb1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c1c41c5fccc6bed19948795d875cac8e

SHA1
73bb0d19d54a73858be10986965a15ab459fa43f

SHA256
7e4846681358456943c778d443031740625643ef13639b49c9191fd1f5904eef

SHA512
b787db0afe1dfd1665fbd0ec476b13de911c2d5a9d46cc099f77e325cee4c43525f52cb36bc22bb525e7a9386427842041b4803bac5b7539de4ef955518e85a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
a5a4d6c962b1502934d9e1ec6d1b1617

SHA1
3b5834dbadc609d2e154b58f15f03852b0efd4b6

SHA256
0db617ce801646ea37c3323d657ea0384597547f245f0b74c0e57d84260d8df9

SHA512
de5eee2b5ef816b0cc25a6eb1e3d110b0322a2a91aa4cdae58101cbd9b13ccb9cb79997dfeee0221254e2417a790428d3dd41d0e9e8ce0b06c263a65bb5e5af9

Download Submit
C:\Users\Admin\Downloads\Xeno-v1.1.35-x64.zip

Filesize
5.1MB

MD5
3d3771b2b441ceb420e3d673c5b95097

SHA1
b782da1cada16382c4c47a7f822765967cbbb794

SHA256
f32fc3a2a760ea47fe18e746f6ccea53bc9adc4436916357df13926646f1cdeb

SHA512
efe63d90bd010b1498a23be95cdd6d1334bf7fc4c138dfea8cc1476447c4ebd29ee70cd7591beec95e0a18e32c6c13f16c30f6d964a2e7b7e524b69d16d7d355

Download Submit
C:\Users\Admin\Downloads\Xeno-v1.1.35-x64.zip:Zone.Identifier

Filesize
58B

MD5
f328e184c322cba91dc3c014fe2ef3e9

SHA1
2aab1f0a70009051dcc87350e0f3b079da02fbb2

SHA256
fe25e31061b432c3a3fdd8f797c6dadad253e83dfb305ee997a7302cd70b618d

SHA512
e59501b550ea64155d134ae832812004ec298a44519eb03183542599174b7691be3225f6fa5064d45ed7ec81f0a93721eb8f401d7e2a49c4b91a70ded006c97e

Download Submit