lumma | hxxps://www[.]mediafire[.]com/folder/jukm222qfm289/Xeno+++Script

Analysis

max time kernel
90s
max time network
91s
platform
windows11-21h2_x64
resource
win11-20250313-en
resource tags

arch:x64arch:x86image:win11-20250313-enlocale:en-usos:windows11-21h2-x64system
submitted
14/03/2025, 01:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.mediafire.com/folder/jukm222qfm289/Xeno+++Script

Score

10^/10

lumma cryptone discovery packer spyware stealer

Malware Config

Extracted

Family

lumma

https://citydisco.bet/api

https://.crosshairc.life/api

https://mrodularmall.top/api

https://jowinjoinery.icu/api

https://legenassedk.top/api

https://htardwarehu.icu/api

https://cjlaspcorne.icu/api

https://bugildbett.top/api

https://weaponrywo.digital/api

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma

CryptOne packer 1 IoCs

Detects CryptOne packer defined in NCC blogpost.

cryptone packer

resource	yara_rule
behavioral1/files/0x001900000002b103-806.dat	cryptone

Executes dropped EXE 2 IoCs

pid	Process
3600	Xeno Executor + Script.exe
4056	Xeno Executor + Script.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3600 set thread context of 4300	3600	Xeno Executor + Script.exe	131
PID 4056 set thread context of 1804	4056	Xeno Executor + Script.exe	135

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4388_1514404032\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4388_1514404032\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4388_1514404032\manifest.fingerprint	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4388_160144821\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4388_160144821\manifest.fingerprint	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-994669834-3080981395-1291080877-1000\{C93068F7-AFC9-4EA5-8C40-7AFAE7ACEA08}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-994669834-3080981395-1291080877-1000_Classes\Local Settings	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\X E N O 4 3 5.rar:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
4300	MSBuild.exe
4300	MSBuild.exe
4300	MSBuild.exe
4300	MSBuild.exe
4300	MSBuild.exe
4300	MSBuild.exe
4300	MSBuild.exe
4300	MSBuild.exe
1804	MSBuild.exe
1804	MSBuild.exe
1804	MSBuild.exe
1804	MSBuild.exe
1804	MSBuild.exe
1804	MSBuild.exe
1804	MSBuild.exe
1804	MSBuild.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 21 IoCs

pid	Process
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeRestorePrivilege	2988	7zG.exe
Token: 35	2988	7zG.exe
Token: SeSecurityPrivilege	2988	7zG.exe
Token: SeSecurityPrivilege	2988	7zG.exe
Token: SeImpersonatePrivilege	4300	MSBuild.exe
Token: SeImpersonatePrivilege	4300	MSBuild.exe
Token: SeImpersonatePrivilege	1804	MSBuild.exe
Token: SeImpersonatePrivilege	1804	MSBuild.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4388 wrote to memory of 2576	4388	msedge.exe	78
PID 4388 wrote to memory of 2576	4388	msedge.exe	78
PID 4388 wrote to memory of 4996	4388	msedge.exe	79
PID 4388 wrote to memory of 4996	4388	msedge.exe	79
PID 4388 wrote to memory of 1256	4388	msedge.exe	80
PID 4388 wrote to memory of 1256	4388	msedge.exe	80
PID 4388 wrote to memory of 1256	4388	msedge.exe	80
PID 4388 wrote to memory of 1256	4388	msedge.exe	80
PID 4388 wrote to memory of 1256	4388	msedge.exe	80
PID 4388 wrote to memory of 1256	4388	msedge.exe	80
PID 4388 wrote to memory of 1256	4388	msedge.exe	80
PID 4388 wrote to memory of 1256	4388	msedge.exe	80
PID 4388 wrote to memory of 1256	4388	msedge.exe	80
PID 4388 wrote to memory of 1256	4388	msedge.exe	80
PID 4388 wrote to memory of 1256	4388	msedge.exe	80
PID 4388 wrote to memory of 1256	4388	msedge.exe	80
PID 4388 wrote to memory of 1256	4388	msedge.exe	80
PID 4388 wrote to memory of 1256	4388	msedge.exe	80
PID 4388 wrote to memory of 1256	4388	msedge.exe	80
PID 4388 wrote to memory of 1256	4388	msedge.exe	80
PID 4388 wrote to memory of 1256	4388	msedge.exe	80
PID 4388 wrote to memory of 1256	4388	msedge.exe	80
PID 4388 wrote to memory of 1256	4388	msedge.exe	80
PID 4388 wrote to memory of 1256	4388	msedge.exe	80
PID 4388 wrote to memory of 1256	4388	msedge.exe	80
PID 4388 wrote to memory of 1256	4388	msedge.exe	80
PID 4388 wrote to memory of 1256	4388	msedge.exe	80
PID 4388 wrote to memory of 1256	4388	msedge.exe	80
PID 4388 wrote to memory of 1256	4388	msedge.exe	80
PID 4388 wrote to memory of 1256	4388	msedge.exe	80
PID 4388 wrote to memory of 1256	4388	msedge.exe	80
PID 4388 wrote to memory of 1256	4388	msedge.exe	80
PID 4388 wrote to memory of 1256	4388	msedge.exe	80
PID 4388 wrote to memory of 1256	4388	msedge.exe	80
PID 4388 wrote to memory of 1256	4388	msedge.exe	80
PID 4388 wrote to memory of 1256	4388	msedge.exe	80
PID 4388 wrote to memory of 1256	4388	msedge.exe	80
PID 4388 wrote to memory of 1256	4388	msedge.exe	80
PID 4388 wrote to memory of 1256	4388	msedge.exe	80
PID 4388 wrote to memory of 1256	4388	msedge.exe	80
PID 4388 wrote to memory of 1256	4388	msedge.exe	80
PID 4388 wrote to memory of 1256	4388	msedge.exe	80
PID 4388 wrote to memory of 1256	4388	msedge.exe	80
PID 4388 wrote to memory of 1256	4388	msedge.exe	80
PID 4388 wrote to memory of 1256	4388	msedge.exe	80
PID 4388 wrote to memory of 1256	4388	msedge.exe	80
PID 4388 wrote to memory of 1256	4388	msedge.exe	80
PID 4388 wrote to memory of 1256	4388	msedge.exe	80
PID 4388 wrote to memory of 1256	4388	msedge.exe	80
PID 4388 wrote to memory of 1256	4388	msedge.exe	80
PID 4388 wrote to memory of 1256	4388	msedge.exe	80
PID 4388 wrote to memory of 1256	4388	msedge.exe	80
PID 4388 wrote to memory of 1256	4388	msedge.exe	80
PID 4388 wrote to memory of 1256	4388	msedge.exe	80
PID 4388 wrote to memory of 1256	4388	msedge.exe	80
PID 4388 wrote to memory of 1108	4388	msedge.exe	81
PID 4388 wrote to memory of 1108	4388	msedge.exe	81
PID 4388 wrote to memory of 1108	4388	msedge.exe	81
PID 4388 wrote to memory of 1108	4388	msedge.exe	81
PID 4388 wrote to memory of 1108	4388	msedge.exe	81
PID 4388 wrote to memory of 1108	4388	msedge.exe	81
PID 4388 wrote to memory of 1108	4388	msedge.exe	81
PID 4388 wrote to memory of 1108	4388	msedge.exe	81
PID 4388 wrote to memory of 1108	4388	msedge.exe	81

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://www.mediafire.com/folder/jukm222qfm289/Xeno+++Script
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x240,0x244,0x248,0x23c,0x28c,0x7ff8c501f208,0x7ff8c501f214,0x7ff8c501f220
  2⤵
  PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1828,i,13366009525335248872,14111519113558504619,262144 --variations-seed-version --mojo-platform-channel-handle=2204 /prefetch:11
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2176,i,13366009525335248872,14111519113558504619,262144 --variations-seed-version --mojo-platform-channel-handle=2172 /prefetch:2
  2⤵
  PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2380,i,13366009525335248872,14111519113558504619,262144 --variations-seed-version --mojo-platform-channel-handle=2416 /prefetch:13
  2⤵
  PID:1108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3432,i,13366009525335248872,14111519113558504619,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2388,i,13366009525335248872,14111519113558504619,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4164,i,13366009525335248872,14111519113558504619,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:1
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=4180,i,13366009525335248872,14111519113558504619,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:9
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=3440,i,13366009525335248872,14111519113558504619,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:1
  2⤵
  PID:3676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=4264,i,13366009525335248872,14111519113558504619,262144 --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:9
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3760,i,13366009525335248872,14111519113558504619,262144 --variations-seed-version --mojo-platform-channel-handle=4160 /prefetch:14
  2⤵
  PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5416,i,13366009525335248872,14111519113558504619,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:14
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=5340,i,13366009525335248872,14111519113558504619,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5656,i,13366009525335248872,14111519113558504619,262144 --variations-seed-version --mojo-platform-channel-handle=5740 /prefetch:14
  2⤵
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5660,i,13366009525335248872,14111519113558504619,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:14
  2⤵
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=6140,i,13366009525335248872,14111519113558504619,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:1
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6476,i,13366009525335248872,14111519113558504619,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:14
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6476,i,13366009525335248872,14111519113558504619,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:14
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6612,i,13366009525335248872,14111519113558504619,262144 --variations-seed-version --mojo-platform-channel-handle=6576 /prefetch:14
  2⤵
  PID:4696
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1124
    3⤵
    PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6712,i,13366009525335248872,14111519113558504619,262144 --variations-seed-version --mojo-platform-channel-handle=6728 /prefetch:14
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6752,i,13366009525335248872,14111519113558504619,262144 --variations-seed-version --mojo-platform-channel-handle=6748 /prefetch:14
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6804,i,13366009525335248872,14111519113558504619,262144 --variations-seed-version --mojo-platform-channel-handle=6820 /prefetch:14
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7104,i,13366009525335248872,14111519113558504619,262144 --variations-seed-version --mojo-platform-channel-handle=7100 /prefetch:14
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7164,i,13366009525335248872,14111519113558504619,262144 --variations-seed-version --mojo-platform-channel-handle=7172 /prefetch:14
  2⤵
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7336,i,13366009525335248872,14111519113558504619,262144 --variations-seed-version --mojo-platform-channel-handle=7204 /prefetch:14
  2⤵
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7508,i,13366009525335248872,14111519113558504619,262144 --variations-seed-version --mojo-platform-channel-handle=7524 /prefetch:14
  2⤵
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7504,i,13366009525335248872,14111519113558504619,262144 --variations-seed-version --mojo-platform-channel-handle=7652 /prefetch:14
  2⤵
  PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --field-trial-handle=5548,i,13366009525335248872,14111519113558504619,262144 --variations-seed-version --mojo-platform-channel-handle=7768 /prefetch:1
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --field-trial-handle=7556,i,13366009525335248872,14111519113558504619,262144 --variations-seed-version --mojo-platform-channel-handle=6984 /prefetch:1
  2⤵
  PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --field-trial-handle=7600,i,13366009525335248872,14111519113558504619,262144 --variations-seed-version --mojo-platform-channel-handle=7592 /prefetch:1
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --field-trial-handle=6156,i,13366009525335248872,14111519113558504619,262144 --variations-seed-version --mojo-platform-channel-handle=7548 /prefetch:1
  2⤵
  PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --field-trial-handle=7036,i,13366009525335248872,14111519113558504619,262144 --variations-seed-version --mojo-platform-channel-handle=6636 /prefetch:1
  2⤵
  PID:1316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --field-trial-handle=7596,i,13366009525335248872,14111519113558504619,262144 --variations-seed-version --mojo-platform-channel-handle=7440 /prefetch:1
  2⤵
  PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --field-trial-handle=7452,i,13366009525335248872,14111519113558504619,262144 --variations-seed-version --mojo-platform-channel-handle=7424 /prefetch:1
  2⤵
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --field-trial-handle=7176,i,13366009525335248872,14111519113558504619,262144 --variations-seed-version --mojo-platform-channel-handle=7920 /prefetch:1
  2⤵
  PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --field-trial-handle=8156,i,13366009525335248872,14111519113558504619,262144 --variations-seed-version --mojo-platform-channel-handle=7628 /prefetch:1
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7764,i,13366009525335248872,14111519113558504619,262144 --variations-seed-version --mojo-platform-channel-handle=7616 /prefetch:14
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --field-trial-handle=7788,i,13366009525335248872,14111519113558504619,262144 --variations-seed-version --mojo-platform-channel-handle=7780 /prefetch:1
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --field-trial-handle=8568,i,13366009525335248872,14111519113558504619,262144 --variations-seed-version --mojo-platform-channel-handle=8044 /prefetch:1
  2⤵
  PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --field-trial-handle=4188,i,13366009525335248872,14111519113558504619,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:1
  2⤵
  PID:1168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=568,i,13366009525335248872,14111519113558504619,262144 --variations-seed-version --mojo-platform-channel-handle=8052 /prefetch:14
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4292,i,13366009525335248872,14111519113558504619,262144 --variations-seed-version --mojo-platform-channel-handle=7372 /prefetch:14
  2⤵
  PID:4144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=8116,i,13366009525335248872,14111519113558504619,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:14
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=8088,i,13366009525335248872,14111519113558504619,262144 --variations-seed-version --mojo-platform-channel-handle=7172 /prefetch:14
  2⤵
  - NTFS ADS
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=8344,i,13366009525335248872,14111519113558504619,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:14
  2⤵
  PID:2600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6560,i,13366009525335248872,14111519113558504619,262144 --variations-seed-version --mojo-platform-channel-handle=7976 /prefetch:14
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6048,i,13366009525335248872,14111519113558504619,262144 --variations-seed-version --mojo-platform-channel-handle=8180 /prefetch:14
  2⤵
  PID:564

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:3504

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4300

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\X E N O 4 3 5\" -spe -an -ai#7zMap12541:88:7zEvent13331
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2988

C:\Users\Admin\Downloads\X E N O 4 3 5\Xeno Executor + Script.exe
"C:\Users\Admin\Downloads\X E N O 4 3 5\Xeno Executor + Script.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3600
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4300

C:\Users\Admin\Downloads\X E N O 4 3 5\Xeno Executor + Script.exe
"C:\Users\Admin\Downloads\X E N O 4 3 5\Xeno Executor + Script.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4056
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
02cf1313b32a8ab2f031cee39bee8fc3

SHA1
861cc0ab9ff881460dd6433e37075b822aac9355

SHA256
7e7fd13903a8d57f314d9e7dab6fa28975050b63f045eb315e96cccaa17d1e61

SHA512
f5464c94391bfb590f6755c2ae6896dd459a2a93d778601caebf272438c2ff127ec5de81dcf8efeec65a56609558477afc7be1c4993977a18fde7b915f7a8700

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
768843f41e5b144f0feff379c1b75b8d

SHA1
807fe067351e027d6278224fce44abee0b7041a7

SHA256
b218bb754af9aefda7e0fc3425622bd4eac6bde6b50d65991879e51893a931de

SHA512
309b58451468ef9c4cb6063ca6721354280897c3fb6c4dbdb19d0b6f0ac6185523222b4b566ef7982bb0f35485f96cb533ce62a242e48858d78bed0c47f4d0b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
cd452d75ef92750fc3571b5e846972a0

SHA1
78e4232fcf622daa17a506e2de57bb1a70f9a53d

SHA256
aff8fa726752b6c70ab88f43d4c24e7826c87dd7296f20e3e9a555a385317b9b

SHA512
520435109f78fae49d4671d49ead77e81b5860c85f6fdc1fff3c1cc80e493ed5a859c8de866def958e431ad0cd7737a0a9abf3a72fc9d2b476ff8826db1a1cc4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe582f68.TMP

Filesize
2KB

MD5
b63546abae91c2010f3595672bc26b18

SHA1
9ba9422031287d88baa4e2bda776ec96ffce8df8

SHA256
3494046b7a45b991b9b477fabb9b053a0c6767b9f8c76c00816d704df9c1a17d

SHA512
05aa58c3b4198d4a7bc2c8f9187df48b22bd352f528da0c5f1488824721e126062c45ac7e58518a53fdf5a25cd01713439b397e7ea3a96aadca6d8f15612805c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
69KB

MD5
164a788f50529fc93a6077e50675c617

SHA1
c53f6cd0531fd98d6abbd2a9e5fbb4319b221f48

SHA256
b305e470fb9f8b69a8cd53b5a8ffb88538c9f6a9c7c2c194a226e8f6c9b53c17

SHA512
ec7d173b55283f3e59a468a0037921dc4e1bf3fab1c693330b9d8e5826273c917b374c4b802f3234bbb5e5e210d55e52351426867e0eb8c9f6fba1a053cb05d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\content.js

Filesize
9KB

MD5
3d20584f7f6c8eac79e17cca4207fb79

SHA1
3c16dcc27ae52431c8cdd92fbaab0341524d3092

SHA256
0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643

SHA512
315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
192KB

MD5
ac93c185375b4e1bc96de93f87e4edc3

SHA1
50a55b7ddf637934f1ce03b2631c09f3fc989553

SHA256
2e2f3844261045a37272aebaf750229410160c789c652b1926b5456747aa7e5e

SHA512
76f0c891df01ee8409b52a8732f770e04ab8ba21974011cebee4fe00e2d3a44d8b489a9253453a59ccd477bdfb91f5ed5be5f624ebc139c05d34f7951d3209ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Filesize
32KB

MD5
27bbf75fde8695a069abf1617efc422e

SHA1
3aa415a0de66fc062063779ef4fc7f0cb571803c

SHA256
4d9310e69e9b03af62e4958347599306db28e864ab4907057863bd5c31f6b3ef

SHA512
c4ebaccc1cd5bafd3054e5f0f5bf6b4f1868753f6bbf3646abc7f220e71da19fbe548f70398689a20324819df4757a0b6936cf78c96e6346aca2cc2de28efd5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
16KB

MD5
8ad6bc9f7a6c1470bd742e7c2a4ad2cc

SHA1
acf1ab35910714d581722fb17f6860e916b0a78e

SHA256
c3a386a73293801e470f7927144c7b30448a8cce53e96c620f8c3e0e1eabcff8

SHA512
b3faec959f805630aab399bbc8f9948cbf91c4d50e09397633ae178940935830699483d4829e7a425a419780e102b9a758ddc00349f712b2ad069d55591cbe3d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
7e070304deb3a26d11daa543352851de

SHA1
f2976c9c44524bd0f0c4cb6ba2a2d0de79ab3260

SHA256
54ddd5b453d84eb70295069cb444ded38102bad5b58c48f82477d8243614ab88

SHA512
ab08daccb7622266e1d2e26423c4db3c5765f3e13304117af555c19a5231bb857107cbf6e1fdbc1cbc38ee7b5fcd539c3342eddb79758fe0d6c5804c5be499eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
18KB

MD5
caaada8ecced0e18cde9905938e6fbbd

SHA1
b32685773d4254d3226162c3c1c677f9b2c6fcdf

SHA256
0bd2e2dc3980fbafd6df09105bbc020c9f5976492238ea7fd044514f22a5cab3

SHA512
26995db45efdd5a47bb97a0d71cbf1e22d6bb67386124c0de360e1e727f022fd88a7866a47d185f52a7688a331218df5cbb6bf86cbdbbe694e38d6fbe5b9dd52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
37KB

MD5
17f927bd3a91603614fa94662281d198

SHA1
13930413a7909ba5cfd1fdb20eecd9ae3be9ef13

SHA256
83829757457a46c16693fbbe296d2e302761c5b8c6a1e7f391dc658056e7bb51

SHA512
2d242b630faeaedb73583eb270eb3fc57c83b338431cc8dd83f8ff834dc417fa685d0d92c7c5a97d78b7271e018d14ef010361794a2b37593592a9af002c9307

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Filesize
228KB

MD5
91a1a5fdccfc8fd8b1b498a2d9e6e264

SHA1
406c1af2e7fbd9b6141ad50387039851f73b48c8

SHA256
286bcb891fe9788878034a3a61f0ac98709c424e9dbf4e5516d37b7f1e68df80

SHA512
8de00d41bdc28dbdeea59ab10dc7e4988c8f97419cdd1aa9736507c4305928c79a3866ff54eb903246082fd4dd29f019b01feb08def96e93ac4ae2c0671161bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
20KB

MD5
ad5e4318555fdd305450975ecf797717

SHA1
5874d4edc34ddaeb4104cd2791517a38db4ba190

SHA256
097d96d05cd5a3b236a5ce20c6a3943147fe91c91354a031bace98cc10489019

SHA512
9fbdb1afed328eace0ab9c7f85704eeabd4279fe5bc67f9f8110276497fe30a37c8d16f69d6172e556007e77552f50a27eb8fde229363c63c4aef3db7801c5e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
872B

MD5
76a5623bf6a00725fdad086aca77ac8d

SHA1
6aef2fe71b6560d9b7879120eecf56882fee3e52

SHA256
05c536f81a502b3c887e34ef2cbfb410fcb5d45e297c9d91e8b7b3ec1e0fa462

SHA512
09fac68e60db3feebfe9a48cbbe5fdeff430b4c39141620417945400e1129ede16d79528c0bcd94039a9e8b7f8015d2dbbded11bdfc40d5dc81c072fa81d4609

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog~RFe588da5.TMP

Filesize
465B

MD5
c35b88778bc465ef68aa6269d2b101a9

SHA1
07d225f9e28f252c5cf5e3c4dbde6a1d50c7bfd7

SHA256
67285a88008dac488fa4f1b304bd55052a9aef65ddae10f93d1e8725a84a2a98

SHA512
16adc91f23bad76ef1c95945b2670ec3012d8d9933587e71acc1cc303f7a7779339690fd2e85597d491a98bf3f4ee715feebae949a9edf4a2199669bd525ea5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
19KB

MD5
41c1930548d8b99ff1dbb64ba7fecb3d

SHA1
d8acfeaf7c74e2b289be37687f886f50c01d4f2f

SHA256
16cee17a989167242dd7ee2755721e357dd23bcfcb61f5789cc19deafe7ca502

SHA512
a684d61324c71ac15f3a907788ab2150f61e7e2b2bf13ca08c14e9822b22336d0d45d9ff2a2a145aa7321d28d6b71408f9515131f8a1bd9f4927b105e6471b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe588f79.TMP

Filesize
2KB

MD5
ee334aba4dd4fb9caec2da190449504a

SHA1
83d86913e3555e9a83208a777607a621965e9d77

SHA256
762156ec3519d73a52878b137bd506781d5ce93e10336f2010ec52ea9ab78536

SHA512
5863b59c91b1045cb69c5a8feefc32d579f615c3d1480d13369aff2cdf521e7d991424c4edb61f58b1da763e0bbb98f02cc56b0d9fc01236db2f4acc799b58f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
13B

MD5
3e45022839c8def44fd96e24f29a9f4b

SHA1
c798352b5a0860f8edfd5c1589cf6e5842c5c226

SHA256
01a3e5d854762d8fdd01b235ce536fde31bf9a6be0596c295e3cea9aaf40f3dd

SHA512
2888982860091421f89f3d7444cacccb1938ef70fc084d3028d8a29021e6e1d83eaef62108eace2f0d590ed41ece0e443d8b564e9c9a860fc48d766edb1dc3d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
30KB

MD5
7c53e2af2ac9959ce0f09c81c93d260f

SHA1
f9a7453b237f25963e98eac0308a29ac404ac155

SHA256
755bf2b7f9a41fc445a7efd9b11d29e6a2291e9954ead0d24e5c9f4e71044e1a

SHA512
12fe0e47bb8e36b653bc546ce8820ee4954c97bd27deff33e92975bf2562ad2b921e6a9f4c994c4c3bc0d741748d13b7ef690b51c3d6c6da83803a61ed43543a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
7KB

MD5
efdb5f20c30738eb6ba46c7b9c5618f3

SHA1
f391e27120bdb1624e2bf0c6182d55ce830056db

SHA256
260e3054c4960cf9aebd7e07ee6a658faaaec38042b8ce9edf4e036497cdf013

SHA512
11bd5dbcc967e6502f8814ac6061d8da9800686f17f7c963f65a8c2f610b637983c36ef67911be9997b954630e805052a7c072cec35120730a0daedb59cdbd9e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
6KB

MD5
e55267c346db3c5ddefe583d26d5c948

SHA1
533bf103c482e645b9503c747052b3812849b298

SHA256
012a3c1924cb87e4716115be63c41d362b47a68d34ad0e29db4b16650ec6521c

SHA512
da39bf1e588cd56907cb56d482174b96c52f4f3e9f75ef192378be590019a641a5af075eea7cad5718ab890f33da3790924f44e36c61f30cd545f82b9779e0eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
39KB

MD5
0d011a8c35abb180715609fcaf668011

SHA1
68d60e673d853d4bfd0ca055b632fb51fad34c45

SHA256
6dc0f3b72197a18fed38ad82cd574010c186e05081d84cb4343e780a07d96cf9

SHA512
d8cc1727ff6bc1741c815cef39624f5246b714d47b480b3f79598d340c6d6321ed171103b2d2596c80cad3a27e4769b398bfed82ef001e290e51bc3d13c412e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
30KB

MD5
41284a5b1ac5ed58f3c7fc70a6b4fb2a

SHA1
d5998d4763e68033ce0f1851c4aaa1eae7944975

SHA256
4f352b34aafe16600e83dbef47887644a8527ee055d09d265381b444d0a640db

SHA512
4d63796f4daa1ad1bae07aeec435e56e5f37ac69d034698be2c108dd614bd3ad066984167efab76c98dbae97f892a949844c702c1654b7165c76ee7ed13b635b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\OriginTrials\0.0.1.7\manifest.fingerprint

Filesize
66B

MD5
3fb5233616491df0ec229ba9f42efdb8

SHA1
18a8116e2df9805accd7901d2321c3fa92da1af4

SHA256
946f3a9e019b0d80f5671de782f295132341f663f74aebad7628f22e528d6d52

SHA512
e9b17ac626bf6508db9a686825411e90d316a0f1dacbf63dbec5baaaf6b96af4dbc9a7332975b6d5c16c43757d79fddca6b888ea97bc07a8dffb1b3a06366b4d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
b9332797230eb8e0a0c0de986cc58bc5

SHA1
404a883eb3c561049ab33d6081f06e9ffefa2237

SHA256
633329a4a0f8e90771c580c4b646054ac1fa33dc99ed94a02436cf69d715f25d

SHA512
c7c08ddd084478233f53cf1bfb6c79d0eefa9275a813494a67a0017a11836824504b22c69e082ea35e68f2e9cd4e73d0453e1e49378cfdd332ac8f8e83771686

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe57e30d.TMP

Filesize
392B

MD5
81e89d8b7ce6721c27e2f03958ec7e10

SHA1
12b302411bc07188d14b9cfa69348f6fd65c21e0

SHA256
80c1f629036600a34972793967169cc62ac088512515fdc9666b4432aee88e0c

SHA512
7c3d54c42008b74bce028cffb370ffabc0c6fa9716f2429b017d7705b71dc5fb53dd63d8ef4b845aa7487a2d39255faf38b0cf3e879e067a5a3c3adb672106c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\073495bb-5fa5-4205-9587-ef144d7d0f89.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Temp\43447508-429f-40db-96c2-fd17ddae7ba2.tmp

Filesize
10KB

MD5
78e47dda17341bed7be45dccfd89ac87

SHA1
1afde30e46997452d11e4a2adbbf35cce7a1404f

SHA256
67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550

SHA512
9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir4388_2000416331\00caa8df-826c-4974-b08a-2c598b2dbcd6.tmp

Filesize
150KB

MD5
eae462c55eba847a1a8b58e58976b253

SHA1
4d7c9d59d6ae64eb852bd60b48c161125c820673

SHA256
ebcda644bcfbd0c9300227bafde696e8923ddb004b4ee619d7873e8a12eae2ad

SHA512
494481a98ab6c83b16b4e8d287d85ba66499501545da45458acc395da89955971cf2a14e83c2da041c79c580714b92b9409aa14017a16d0b80a7ff3d91bad2a3

Download Submit
C:\Users\Admin\Downloads\X E N O 4 3 5.rar

Filesize
35.1MB

MD5
f13350ea6de2b9d5ef484ad253761c00

SHA1
9587edc6b23777e141d3624dc593abfb7628563b

SHA256
e98b2fa63215a6b8eb800ff6a98886d67fa022c1ce5ae80af628ecb6dfdccf21

SHA512
bd470869f4ad143103ddbe57604219ff9c0dfc105cf0915627ac521e2ea49e3e5f15bc8fe8af86baa7263cc11ed3352b3a6ae0ed8d5acf043f7229153e7e4932

Download Submit
C:\Users\Admin\Downloads\X E N O 4 3 5.rar:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\X E N O 4 3 5\Xeno Executor + Script.exe

Filesize
477KB

MD5
658d458dc1c4cf3d99aa2a418ac36a54

SHA1
5c1675ed075eb1e0b5fe97c3b4668f7cd2f3b33a

SHA256
343348d09cf7c6a7b2c23f65ba51ef5ef5b5a483e94eb2685c533e09d79ce868

SHA512
8c800f9966d1035079431f91eb79550ec931b65c5de02a4a22a4ce84ec8f339ec57ff3d1df47de0f094fcbabc58f5a3c5cf464f5f5f0eab08ba4db0f6b574535

Download Submit
C:\Users\Admin\Downloads\X E N O 4 3 5\autoexec\scripts

Filesize
18.7MB

MD5
88fd7dbf04bcf75123d02009aea3f7f7

SHA1
cecf16bdad71e54afc941179ea2b7438a04efa1d

SHA256
01481b9a862936fbc090bda4033f22d7ffa5a7bfe5dc32f47c7794332b34eec4

SHA512
2c6298b5adf91b51f0042d48e0846f5b196d52a588fd4fc577bf19ec26ad8e547382279a15f8bf131b08b0d7c140534aff25f82d5e8998818b812e72c9493917

Download Submit
C:\Users\Admin\Downloads\X E N O 4 3 5\workspace\.tests\isfile.txt

Filesize
7B

MD5
260ca9dd8a4577fc00b7bd5810298076

SHA1
53a5687cb26dc41f2ab4033e97e13adefd3740d6

SHA256
aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27

SHA512
51e85deb51c2b909a21ec5b8e83b1cb28da258b1be227620105a345a2bd4c6aea549cd5429670f2df33324667b9f623a420b3a0bdbbd03ad48602211e75478a7

Download Submit
C:\Users\Admin\Downloads\X E N O 4 3 5\workspace\Xeno.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\Downloads\X E N O 4 3 5\workspace\Xeno.exe.WebView2\EBWebView\Default\Extension Rules\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\Downloads\X E N O 4 3 5\workspace\Xeno.exe.WebView2\EBWebView\Default\GPUCache\data_0

Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\Downloads\X E N O 4 3 5\workspace\Xeno.exe.WebView2\EBWebView\Default\GPUCache\data_1

Filesize
264KB

MD5
a833653a021f29ee2ec1a845e0c2308f

SHA1
05071159d3c2516d67b765cef012a0a2d3337759

SHA256
8e9f3538e43a68caa472fd47adaf43906e097cfb53ef55d1361caf1cc97efca7

SHA512
0902a886c95cee1b34f9419ab0a10ce0fe96eae57c59ab4cefba99ba3fc2a0237741f31076ce065db14fe3dfecd325458209f0d1e9fcc8b9ac7bff8328e1744f

Download Submit
C:\Users\Admin\Downloads\X E N O 4 3 5\workspace\Xeno.exe.WebView2\EBWebView\Default\GPUCache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\Downloads\X E N O 4 3 5\workspace\Xeno.exe.WebView2\EBWebView\Default\Shared Dictionary\cache\index

Filesize
24B

MD5
54cb446f628b2ea4a5bce5769910512e

SHA1
c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

SHA256
fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

SHA512
8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4388_160144821\manifest.json

Filesize
43B

MD5
af3a9104ca46f35bb5f6123d89c25966

SHA1
1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8

SHA256
81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea

SHA512
6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1

Download Submit
memory/4300-1371-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/4300-1370-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download