761f7855c41c948aa31d680411f82501dd9949a7d7e5be48969dc44bd6c6c684

Analysis

max time kernel
149s
max time network
158s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/05/2026, 00:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Xeno-v1.3.35/Xeno.exe
Size 160KB
Sample260503-agyapadt2m
SHA256 761f7855c41c948aa31d680411f82501dd9949a7d7e5be48969dc44bd6c6c684
MD5 f4a4f52c10877ab8defe95a969bd6077
SHA1 eb37e1d415d38d0ba512392028fca4bff26c5ec5
SHA512 bbd50fde73363055d10dd83c7da942f6fc83d21c080d54d5bf0af1f08f5f3a573c1035538dd0c224f240d4b077f333b014e22c40ec8139ab27a50e1dfc35159c
SSDEEP 3072:nqvmgiYSoIk8uIHzlqRwa/YB26mDIgHaNVza:n64k83TlEvG4IgwVza
TLSH
T102F35B07A6A851BDE1B6C639C9924D41FB727C198B71A6CF07507EB60E737D0AE39302
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery trojan

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
6084	msedge.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Xeno.exe

Contacts third-party web service commonly abused for C2 1 TTPs 8 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
38	discord.com
25	discord.com
26	discord.com
28	discord.com
29	raw.githubusercontent.com
30	raw.githubusercontent.com
31	raw.githubusercontent.com
35	discord.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6084_1455979252\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6084_1455979252\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6084_1455979252\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6084_1455979252\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6084_1455979252\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6084_1455979252\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6084_1455979252\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6084_1455979252\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6140_1364061207\hyph-la.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6140_1364061207\hyph-pa.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6140_1364061207\hyph-sv.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6140_1364061207\hyph-hu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6140_1364061207\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6084_1255957231\deny_etld1_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6140_850519337\Part-DE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6084_1835479043\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6140_1439212068\crl-set	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6084_1455979252\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6140_1364061207\hyph-de-1996.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6084_1455979252\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6084_1455979252\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6084_1455979252\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6084_1455979252\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6140_1364061207\hyph-et.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6140_1364061207\hyph-te.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6140_1364061207\hyph-uk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6084_1455979252\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6084_1455979252\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6084_1455979252\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6084_1455979252\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6140_1364061207\hyph-as.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6084_912785507\ct_config.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6084_1455979252\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6140_1364061207\hyph-ga.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6084_137389713\v1FieldTypes.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6140_850519337\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6084_555707436\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6140_1364061207\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6084_1455979252\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6084_1455979252\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6084_1455979252\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6140_1364061207\hyph-bg.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6140_1364061207\hyph-gl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6140_1364061207\hyph-mr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6140_1364061207\hyph-ta.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6084_1835479043\domain_actions.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6140_1364061207\hyph-cu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6084_1455979252\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6084_1455979252\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6140_1364061207\hyph-gu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6140_1364061207\hyph-it.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6140_1840608946\manifest.json	msedgewebview2.exe
File opened for modification	C:\Windows\SystemTemp	msedgewebview2.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_6084_1729756689\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6084_1455979252\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6084_1455979252\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6140_850519337\Part-IT	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6084_1455979252\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6084_1455979252\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6084_1455979252\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6140_1364061207\hyph-be.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6140_1364061207\hyph-pt.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6084_1255957231\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6140_850519337\adblock_snippet.js	msedgewebview2.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
600	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134222408125898424"	msedgewebview2.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-600123060-2148212387-2211176695-1000\{4247BD89-789C-422D-BC27-92ECBACEA408}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-600123060-2148212387-2211176695-1000\{F2AAC081-B0F8-42E4-B7E1-4FAD0526F0BE}	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5008	Xeno.exe
5008	Xeno.exe
3452	msedge.exe
3452	msedge.exe
5684	msedgewebview2.exe
5684	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
6084	msedge.exe
6084	msedge.exe
6140	msedgewebview2.exe
6084	msedge.exe
6084	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
6084	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5008 wrote to memory of 6084	5008	Xeno.exe	79
PID 5008 wrote to memory of 6140	5008	Xeno.exe	80
PID 6140 wrote to memory of 5776	6140	msedgewebview2.exe	81
PID 6084 wrote to memory of 5700	6084	msedge.exe	82
PID 6084 wrote to memory of 600	6084	msedge.exe	83
PID 6084 wrote to memory of 1168	6084	msedge.exe	84
PID 6084 wrote to memory of 1168	6084	msedge.exe	84
PID 6084 wrote to memory of 1436	6084	msedge.exe	85
PID 6084 wrote to memory of 1168	6084	msedge.exe	84
PID 6084 wrote to memory of 1436	6084	msedge.exe	85
PID 6140 wrote to memory of 4988	6140	msedgewebview2.exe	87
PID 6140 wrote to memory of 4988	6140	msedgewebview2.exe	87
PID 6140 wrote to memory of 4988	6140	msedgewebview2.exe	87
PID 6084 wrote to memory of 3656	6084	msedge.exe	88
PID 6084 wrote to memory of 4000	6084	msedge.exe	89
PID 6084 wrote to memory of 3656	6084	msedge.exe	88
PID 6084 wrote to memory of 3656	6084	msedge.exe	88
PID 6084 wrote to memory of 4000	6084	msedge.exe	89
PID 6084 wrote to memory of 4000	6084	msedge.exe	89
PID 6140 wrote to memory of 2744	6140	msedgewebview2.exe	91
PID 6140 wrote to memory of 6112	6140	msedgewebview2.exe	92
PID 6140 wrote to memory of 6112	6140	msedgewebview2.exe	92
PID 6140 wrote to memory of 3172	6140	msedgewebview2.exe	93
PID 6140 wrote to memory of 3172	6140	msedgewebview2.exe	93
PID 6140 wrote to memory of 3172	6140	msedgewebview2.exe	93
PID 6084 wrote to memory of 1236	6084	msedge.exe	94
PID 6084 wrote to memory of 1236	6084	msedge.exe	94
PID 6084 wrote to memory of 1236	6084	msedge.exe	94
PID 6084 wrote to memory of 2452	6084	msedge.exe	95
PID 6084 wrote to memory of 1516	6084	msedge.exe	96
PID 6084 wrote to memory of 1516	6084	msedge.exe	96
PID 6084 wrote to memory of 3896	6084	msedge.exe	98
PID 6084 wrote to memory of 3896	6084	msedge.exe	98
PID 6084 wrote to memory of 5732	6084	msedge.exe	97
PID 6084 wrote to memory of 5732	6084	msedge.exe	97
PID 6084 wrote to memory of 4424	6084	msedge.exe	99
PID 6084 wrote to memory of 2352	6084	msedge.exe	101
PID 4424 wrote to memory of 1180	4424	msedge.exe	102
PID 6084 wrote to memory of 3864	6084	msedge.exe	105
PID 6084 wrote to memory of 4644	6084	msedge.exe	106
PID 6084 wrote to memory of 2380	6084	msedge.exe	107
PID 6084 wrote to memory of 4396	6084	msedge.exe	108
PID 6084 wrote to memory of 4396	6084	msedge.exe	108
PID 6084 wrote to memory of 6136	6084	msedge.exe	109
PID 6084 wrote to memory of 6136	6084	msedge.exe	109
PID 6084 wrote to memory of 3244	6084	msedge.exe	110
PID 6084 wrote to memory of 3244	6084	msedge.exe	110
PID 6084 wrote to memory of 1852	6084	msedge.exe	112
PID 6084 wrote to memory of 1852	6084	msedge.exe	112
PID 6140 wrote to memory of 4512	6140	msedgewebview2.exe	113
PID 6140 wrote to memory of 4512	6140	msedgewebview2.exe	113
PID 6084 wrote to memory of 5728	6084	msedge.exe	114
PID 6084 wrote to memory of 5728	6084	msedge.exe	114
PID 6140 wrote to memory of 3972	6140	msedgewebview2.exe	115
PID 6140 wrote to memory of 3972	6140	msedgewebview2.exe	115
PID 6084 wrote to memory of 2016	6084	msedge.exe	116
PID 6084 wrote to memory of 2016	6084	msedge.exe	116
PID 6140 wrote to memory of 860	6140	msedgewebview2.exe	117
PID 6140 wrote to memory of 860	6140	msedgewebview2.exe	117
PID 6084 wrote to memory of 2372	6084	msedge.exe	118
PID 6084 wrote to memory of 2372	6084	msedge.exe	118
PID 6140 wrote to memory of 2112	6140	msedgewebview2.exe	119
PID 6140 wrote to memory of 2112	6140	msedgewebview2.exe	119
PID 6084 wrote to memory of 3452	6084	msedge.exe	120

C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.35\Xeno.exe
"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.35\Xeno.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/xe-no
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:6084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x2f4,0x7ff9a906c188,0x7ff9a906c194,0x7ff9a906c1a0
    3⤵
    PID:5700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1636,i,3499960598390918014,5771846874395046706,524288 --field-trial-handle=2384,i,9692758792171061278,2630799079867177208,262144 --variations-seed-version --mojo-platform-channel-handle=2792 /prefetch:11
    3⤵
    - System Time Discovery
    PID:600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1508,i,17743442168341630690,1081125193735321176,262144 --field-trial-handle=2384,i,9692758792171061278,2630799079867177208,262144 --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:2
    3⤵
    PID:1168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2148,i,1287775200903586482,5031259404314870786,524288 --field-trial-handle=2384,i,9692758792171061278,2630799079867177208,262144 --variations-seed-version --mojo-platform-channel-handle=2800 /prefetch:13
    3⤵
    PID:1436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3492,i,15591202961221662064,16516999849175057274,2097152 --field-trial-handle=2384,i,9692758792171061278,2630799079867177208,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
    3⤵
    PID:3656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3496,i,12451985239939734952,3376999462591204549,2097152 --field-trial-handle=2384,i,9692758792171061278,2630799079867177208,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
    3⤵
    PID:4000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4868,i,11287990774662129439,2276746138583697053,2097152 --field-trial-handle=2384,i,9692758792171061278,2630799079867177208,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:1
    3⤵
    PID:1236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4212,i,5856006328502818954,3763932191877323354,524288 --field-trial-handle=2384,i,9692758792171061278,2630799079867177208,262144 --variations-seed-version --mojo-platform-channel-handle=3788 /prefetch:14
    3⤵
    - Modifies registry class
    PID:2452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5068,i,10317626732248954767,16098405926307520869,524288 --field-trial-handle=2384,i,9692758792171061278,2630799079867177208,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:12
    3⤵
    PID:1516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5528,i,4789260706205581231,12233152196167860960,524288 --field-trial-handle=2384,i,9692758792171061278,2630799079867177208,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:14
    3⤵
    PID:5732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,5755306282451438599,12538926246646794444,524288 --field-trial-handle=2384,i,9692758792171061278,2630799079867177208,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:14
    3⤵
    PID:3896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6184,i,2348567636672026912,11481053438054555859,524288 --field-trial-handle=2384,i,9692758792171061278,2630799079867177208,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1128
      4⤵
      PID:1180
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6196,i,14294454638609772899,15854837403152662725,524288 --field-trial-handle=2384,i,9692758792171061278,2630799079867177208,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:14
    3⤵
    PID:3284
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6196,i,14294454638609772899,15854837403152662725,524288 --field-trial-handle=2384,i,9692758792171061278,2630799079867177208,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:14
    3⤵
    PID:2352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6308,i,6606813253894071927,17844892757304455006,524288 --field-trial-handle=2384,i,9692758792171061278,2630799079867177208,262144 --variations-seed-version --mojo-platform-channel-handle=6880 /prefetch:14
    3⤵
    PID:3864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6252,i,6171318254219823905,13388770987907032291,524288 --field-trial-handle=2384,i,9692758792171061278,2630799079867177208,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:14
    3⤵
    PID:4644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6312,i,4311271974283410640,15003103608273179212,524288 --field-trial-handle=2384,i,9692758792171061278,2630799079867177208,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:14
    3⤵
    PID:2380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6716,i,8335806428514002438,7029571083735850998,524288 --field-trial-handle=2384,i,9692758792171061278,2630799079867177208,262144 --variations-seed-version --mojo-platform-channel-handle=7016 /prefetch:14
    3⤵
    PID:4396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7036,i,11733489027299839838,16472185244371571062,524288 --field-trial-handle=2384,i,9692758792171061278,2630799079867177208,262144 --variations-seed-version --mojo-platform-channel-handle=7004 /prefetch:14
    3⤵
    PID:6136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5456,i,13159861872675709614,11887485240708194043,524288 --field-trial-handle=2384,i,9692758792171061278,2630799079867177208,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:14
    3⤵
    PID:3244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6980,i,3173071403945982449,16561560550835144977,524288 --field-trial-handle=2384,i,9692758792171061278,2630799079867177208,262144 --variations-seed-version --mojo-platform-channel-handle=6944 /prefetch:14
    3⤵
    PID:1852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6388,i,10684322045037103230,8161283915210282348,524288 --field-trial-handle=2384,i,9692758792171061278,2630799079867177208,262144 --variations-seed-version --mojo-platform-channel-handle=6956 /prefetch:14
    3⤵
    PID:5728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6708,i,10776364519020204454,16444133880215142797,524288 --field-trial-handle=2384,i,9692758792171061278,2630799079867177208,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:14
    3⤵
    PID:2016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5432,i,10259655485011658306,11956830756418540268,524288 --field-trial-handle=2384,i,9692758792171061278,2630799079867177208,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:14
    3⤵
    PID:2372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5728,i,11267731792336850364,16665596022962517812,262144 --field-trial-handle=2384,i,9692758792171061278,2630799079867177208,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6392,i,14688328130173151705,12213114175053962219,524288 --field-trial-handle=2384,i,9692758792171061278,2630799079867177208,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:14
    3⤵
    PID:5816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,8565634971022919308,11010695821784765123,524288 --field-trial-handle=2384,i,9692758792171061278,2630799079867177208,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:14
    3⤵
    PID:5612
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Xeno.exe --webview-exe-version=1.3.35+87ae4f96f8a0927052c1120167982fb069afd1b4 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.35\Xeno.exe.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --mojo-named-platform-channel-pipe=5008.5080.1304176856929720128
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:6140
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.35\Xeno.exe.WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.35\Xeno.exe.WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x160,0x164,0x168,0x13c,0x170,0x7ff9a8c7b078,0x7ff9a8c7b084,0x7ff9a8c7b090
    3⤵
    PID:5776
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.35\Xeno.exe.WebView2\EBWebView" --webview-exe-name=Xeno.exe --webview-exe-version=1.3.35+87ae4f96f8a0927052c1120167982fb069afd1b4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1660,i,14069670147509975267,1619099463192983544,262144 --variations-seed-version --mojo-platform-channel-handle=1656 /prefetch:2
    3⤵
    PID:4988
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.35\Xeno.exe.WebView2\EBWebView" --webview-exe-name=Xeno.exe --webview-exe-version=1.3.35+87ae4f96f8a0927052c1120167982fb069afd1b4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=1984,i,14069670147509975267,1619099463192983544,262144 --variations-seed-version --mojo-platform-channel-handle=1996 /prefetch:11
    3⤵
    PID:2744
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.35\Xeno.exe.WebView2\EBWebView" --webview-exe-name=Xeno.exe --webview-exe-version=1.3.35+87ae4f96f8a0927052c1120167982fb069afd1b4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2016,i,14069670147509975267,1619099463192983544,262144 --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:13
    3⤵
    PID:6112
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.35\Xeno.exe.WebView2\EBWebView" --webview-exe-name=Xeno.exe --webview-exe-version=1.3.35+87ae4f96f8a0927052c1120167982fb069afd1b4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3396,i,14069670147509975267,1619099463192983544,262144 --variations-seed-version --mojo-platform-channel-handle=3412 /prefetch:1
    3⤵
    PID:3172
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.35\Xeno.exe.WebView2\EBWebView" --webview-exe-name=Xeno.exe --webview-exe-version=1.3.35+87ae4f96f8a0927052c1120167982fb069afd1b4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=3624,i,14069670147509975267,1619099463192983544,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:14
    3⤵
    PID:4512
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.35\Xeno.exe.WebView2\EBWebView" --webview-exe-name=Xeno.exe --webview-exe-version=1.3.35+87ae4f96f8a0927052c1120167982fb069afd1b4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=4456,i,14069670147509975267,1619099463192983544,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:14
    3⤵
    PID:3972
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.35\Xeno.exe.WebView2\EBWebView" --webview-exe-name=Xeno.exe --webview-exe-version=1.3.35+87ae4f96f8a0927052c1120167982fb069afd1b4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=4624,i,14069670147509975267,1619099463192983544,262144 --variations-seed-version --mojo-platform-channel-handle=4640 /prefetch:14
    3⤵
    PID:860
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.35\Xeno.exe.WebView2\EBWebView" --webview-exe-name=Xeno.exe --webview-exe-version=1.3.35+87ae4f96f8a0927052c1120167982fb069afd1b4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=756,i,14069670147509975267,1619099463192983544,262144 --variations-seed-version --mojo-platform-channel-handle=4576 /prefetch:14
    3⤵
    PID:2112
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.35\Xeno.exe.WebView2\EBWebView" --webview-exe-name=Xeno.exe --webview-exe-version=1.3.35+87ae4f96f8a0927052c1120167982fb069afd1b4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4392,i,14069670147509975267,1619099463192983544,262144 --variations-seed-version --mojo-platform-channel-handle=4656 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5684
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.35\Xeno.exe.WebView2\EBWebView" --webview-exe-name=Xeno.exe --webview-exe-version=1.3.35+87ae4f96f8a0927052c1120167982fb069afd1b4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=4408,i,14069670147509975267,1619099463192983544,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:14
    3⤵
    PID:388

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3284

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5052

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

autofill_bypass_cache_forms.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\autofill_bypass_cache_forms.json
Size 161B
SHA256 f7510e38f81f8a84027304070205dd55127e3233fdf011411465ede67b5b5d92
MD5 4b1a79b1996f03fb926a97912835c881
SHA1 ca43e23f7bbb4ff3839751f722df3c38ef7bd8a7
SHA512 c2e07a1b311ab71d94c7b874d645fe1114fdccfe4468875d6b23318fbe327481a60b2782af105b7546b3c1e6c3a7ec67261b21a0587f914cc7bf77c55f1f568e
TLSH
T1E5C08C07ABB804230B414E0B590DEFC9990476F6D5C146FEAB75A5A98A3C6B0005B74A
MD5 SHA1 SHA512 TLSH

Submit Download

edge_autofill_global_block_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\edge_autofill_global_block_list.json
Size 6KB
SHA256 7d3c45c8207ba69066516e51e10a2137bc4f1fce070a692e0c65225f9856e04c
MD5 5d4464dabc1289c3a010e14c05b92c57
SHA1 d2d185faca1cd13a6d42dea68803a9941074707d
SHA512 f93f4b58efc0127946ffa1b2950a1cf71da6f77a6ab4cf98ad8ada6a751d6261be4818ff8c64fe1f1d45467aa070e0823d15be36c8259c1044fb2d1289df9994
SSDEEP 192:C73stL7O9FnLk25+tF4B8K5b+QiGoztWuDpR6lFuftdHAa4/i:nwJ2r
TLSH
T133D16A2BA91C54B32A044839128E5BE47DDD73B6DD6008D6D650C0B9AEDFCB8203FDA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v1FieldTypes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\v1FieldTypes.json
Size 509KB
SHA256 611e7995ab7599a0c89f98d6c6152a42aaedf7449748109a465bb5b0badd0af2
MD5 b1c140ef49f01eea089d3957da1a529f
SHA1 de64781f20aac98b4d2bbc497e3defa83b25aa8f
SHA512 02ddfcbaf9eaff793f251bd983394cf473b1340182ac1f3217cb7258ddfbd2de066ab08af16b47a378644bcc1871ad6ed8c641f6a053802c90e77f648e4f4be8
SSDEEP 1536:jlKS/dYt+dtxX9U2/W++dGcUooTHR6rF1azQmkEMUmxralqDAtyttVJAC5c8KrVx:B
TLSH
T148B48E2BF9F25C634D822A32053E18996A30615F5CEC6CD4BB3E211F4F2C1791E797A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5d8c0ebc33f7882ac8aaa0f941413384749c7672a7744de3485d53f3d7a832ce
MD5 fb7d9391eb1040937b5c31ff61febe79
SHA1 0be0bde544b492ac590e441f96bf8d0a378d3782
SHA512 d4a405f080afee18100d407e824cc3366114b1acd56307d247bc25ee87ffaba37406581a2dfcfe9320df4d014582f86fd300e9f67a54b4fcd2e471e1358c493d
TLSH
T1AED0804425F15CB6D046C57115457B053955D6A79E539B1A35F36C784C4300115511F7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 71f86f37b013034051fae2e3307728bc40653c617383d6aa85219dd8ea093ca3
MD5 2ee9c9062df63fee32f65bc087b93005
SHA1 2874f6b34fdb5f9ff64aed6e38005f7940050b27
SHA512 99729f971f840d780b0e5404260284b048d532cb0dbd20969536cacd61a2d2c52568d6b9d96f6f0168b93eaa3c7236b49d8aafb6138d1b1fcbe89990c6af5af3
TLSH
T1AFD08C4821F66CBAD09ACA7219057B0A2959EAA79E93AB2A39B36C784C4300115911F7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 7b72c0781faa13f849e011e303da5b67a4bcf62e84437c49261d5dab2e6b4fa4
MD5 817eab8e05cebdf777975e1935f3f337
SHA1 4067f7ad4254533b6e50c5574589ec9e1fc850ff
SHA512 607c060423fe015b6ae4185e08d91b7a70818e47ee20c321bb89478150ceb8e44113a84a6622ae86f082985cfc0193989b2d941eda6fcf75c2c468f1c1248b99
TLSH
T130E02BAADE259C3708FE076D21400786F66553271640951B3A3C920C8F7563A45DAC1C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 9KB
SHA256 6c5e232d6c96ce839b8998672d20f0b8b39028d10cb6c95ff9831579dca49dc1
MD5 d3bc49a8774fa3d534cf2f86d3a71cc9
SHA1 ee1dab6903ba9109d3e4c8cc604d366046ca65af
SHA512 97e97e1819d55849bb42e947f27a6a42675d9de6ece11450baf97ba2b5dcba25f97d4c19aa3b955019567e9476ce8ee739cb8ce682f46466ee172c2cd066aad7
SSDEEP 192:gkcWwi8gghvBFD6sCQoFzLjuFotCMpKAFG/GXZ6+5nXVLEe9ZBU9zMFqUYABFZaO:gkcWwi8gghvBFmsCQoFzLjuFotCMpKAr
TLSH
T1FB124AE15BF3AF6BF7F1A9B801E21B4C7A71C07088273F63A8A54B7D9A0C799015644D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe589025.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe589025.TMP
Size 3KB
SHA256 b1ae2e45b1c5b9867de263c2a7ced804437e5eecc1426b04506808ab9bdfbaa6
MD5 1e0b9397f907adff9f06375b949e584e
SHA1 7f62c06da580b11deac7bacc83c0698eca4ca1cf
SHA512 5d4c422b25477b115d8a217e179b051f48a35ae99057ef7e78b03bb3ceca2d9b2106a7ed0abb1997d8b5c6c951d6393adbada40718b5bcf7a088eaf446eac969
TLSH
T18F8108E0A9F38F99E7E8F0BC01E6184C7E35C1554D0B0E35ADE54B3EAB4CB61409140C
MD5 SHA1 SHA512 TLSH

Submit Download

61605057-294c-4877-b7fd-3afff8c5a3f2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\61605057-294c-4877-b7fd-3afff8c5a3f2.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

91e671a7-53bf-4eec-a563-63a8a4db6626.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\91e671a7-53bf-4eec-a563-63a8a4db6626.tmp
Size 2KB
SHA256 b70c435b3c2cbe39d466c790a3a6e84db4fb5ac519a56a468c038f2850bc31b6
MD5 f41bd5b8e4bbb7d747c881800e8fb73e
SHA1 51b6f612aefd49e288e352102e82a7b6fb9e4d1d
SHA512 850b99c9013ab4054c083daa8f0e7c7a075544d0f8d6ce747d75b8f3e6ad4c3f737d0ee6935afa572317a8fdb724312a04100d6214012e752ae47a1aecc15beb
TLSH
T12D51BDF783E4862DDE1156F4AB186E2FCE2D0954431C3C6AC8E49F1B93E2561F141A9F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 f6484a97da6502c4af805ea865b59aaaada730f84bff34377b90c6068415ea06
MD5 991c99d4bf5417f3d86f09c8ee0e2044
SHA1 c7fb7dae256914684699e36b5332177b42143ac9
SHA512 8b45f790272b7ef7a8eca12b91104819990dc7b45b20257a01e4460ad0b656c0aa907426bceb1e2d36fd680b84f7dcc756eb84bbfedea84b65dfd25ad42c5518
TLSH
T17E61ADF783E8862DDA1156F4AA187E2FCE2D0954431C3C6AC8E49F4B93E2571F141A8F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 f655b1f78a3dc0974f84ac5dc6e10ca2538eb30b4e55a060f0eac9801954ab52
MD5 6a471842daa3b745db968e4dd35949a7
SHA1 b98efd93c1cd4caaef97e06072ffd9c5d46a6813
SHA512 ce00fd81442042a641340d66bded181874b3d47640a95c90f0c765cb09c4c6901ccd13466b965987ddfca40045c812b278fdede4cde4266ca89b5ba75c552271
SSDEEP 384:sxZX6qu9/fJsGSaYobPTiu+/bQ/5UiE3xV:svFu9/fnSaYob+t/bS5Uiu3
TLSH
T15E72F7169A389D778CDBD219FA45BB53D6F8116392840E449AFC8B0C04E6BED321783F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 cee973dd2f4e9543f31cb5ace4a9e532ea1cc61e3f13cfa24385df5049adaec1
MD5 b076565624d256a63b1737f3f2b29515
SHA1 528f5876117bfc43b08221f987b9da49e65c4c1b
SHA512 f091696c35de1aa117b77854b40dc1ac737b53d6d1a3d9d68a6d7ace7d942d982b2e877209ee06689a30791d2936fa47dd4a564c5beedbdb5358adc3dee318ca
SSDEEP 192:sxZXRRyMqZ/K1Ml8MN9/fJsbSaYo4pdJTP6J0czodpxYl/W6+WNzdpw/Y0rYEgix:sxZX619/fJsbSaYokPTiu+/bQ/5kiEji
TLSH
T15162E7166A389D778CCBD218FA45BB53D6F9116392844E449AFCCB0C04E6BED321782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 37KB
SHA256 b30fc90dfb2007d704f6663996cfd70f71d1293ad9bce6e5bafcbfcb5ab37cd6
MD5 b9bd8970bf039c750430279921514865
SHA1 5582f866a3d3115326e7011a910968fa77a13136
SHA512 c9a21caa80c49c28481016250357443231c43ec8f4d8ccde7d12abd379f8828202f2ccba49ef75703206e0f97751c2aecd9a5f147ca232d88d45ed87e3c97a34
SSDEEP 768:kA4so86s2+q7pLuL/HzWRmH9QWR8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3zU3SLlP:kA4so86s2+CE/HzWRmH9QWRu1jaKzU3W
TLSH
T149031D3B684CCB7E4F844E9CEC2ABE8A6DE8018F96988D9447FA444C03C67DB55161DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\bead6402-6358-4fbe-929c-7ef81f8d7eb0\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 233B
SHA256 ee560e23d2c3e2a080da8aeb3cf745af322ad68dbc43054233461f1c8bf1786f
MD5 d6223f6f7bca3d835bbb691130df0ac0
SHA1 7432c443815dd2b801cabf427ca50367877883eb
SHA512 1ff3ba9989825cd8a43046b7f50a722d18069301986a23b6d428b0aab76d34cd5515cfdaa51c2e4530c94f69b6875b6d5e1c5d137ab9a329a538b57b66da0359
TLSH
T147D0236FE1621C90D73B0FE04332106A02312C8C4CC8604CD44230ACD475B43D706F7B
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 226B
SHA256 879d280498a162a4999cd94cb1daf5dbaa37f8b85f37c11c7fc73b06e8b8de1b
MD5 0ccc423ba1edc6489dd841124c5f3123
SHA1 8d46049e2924ec8a9a0a2dbbe29f6100575a9b26
SHA512 bc5cb49ef0a7c44bff517bc8273f090c81320ab79765258f32b142ae481bcb18d168035b1d5dfe45deaef93b07f2caf260114260503422460ac3dc8fb2a509f1
TLSH
T1F8D0236FD1551990DB7F4FE00332603A02213C8C48CD608CA0410028C845B43D603F7B
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe582527.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe582527.TMP
Size 138B
SHA256 916c84fef9e8a74d923fc62cb5a28f997220ba2fb26a9587dfcdac257d55f494
MD5 1559e4eb4a7af83c87ae288a474cd672
SHA1 9d80fd749e7d5d8c7ccf61cd541afef94e8a6a31
SHA512 c488e18449facc308fdd35f6eb1b9f9c2452eef71b51f96df4ad62f8f9d53c29e1dea95a3cbcc6d45ea69f27e42003ae08fca996fa9e54e32391d3a3b0a866bf
TLSH
T1B9C02B67A2420C46C7340BD04332A00E47072CCC4C8A908CF06330581035E23A20EEFB
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 b9db6a307e698dfdffe94b39dd015b55e658104d192ed4d0c22a8ede0f221f36
MD5 882c5ce02d8b90c7504dcb407f9752e5
SHA1 082ba05c7c7e5d715a95fe027f7c5fa997f8dc46
SHA512 7eecd3bda8605de909f19f8e2ddfb105d1b92749df38abd88fddd7c82fd1e139c87e074bb9172bd48135df1d4670be75a54958d627de49d5828f50cd1c22f98c
SSDEEP 96:KkGQKTyeupuKK8DF6KOkKeFGKWoJp+K6wKK6UKXqAugKHqC6S0KzSA+IK/qa2jSk:ubB91NPhfYXHkvl7X3S9r4dFVwlf
TLSH
T15BB27C91357A12D03A7E298A8595B87E52C231633118E96B3BF900B50F6BE31DDFDCC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

domain_actions.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Domain Actions\3.0.0.18\domain_actions.dll
Size 83KB
SHA256 d35c8efcb710239f009633bcc5ae904ac6dafa985d451bedf791cf6909f014d4
MD5 956f610121cd5827fd5549097b79cd9f
SHA1 dbd23f99895a3a92fbe04c3c35d475a6f6998fd0
SHA512 3cc4712f64474497495d229ddd743c6bf25c30c3fbfca2525f46227d99a59a0f9e80e2119ffb40bc8a707b539f65f907e2e1565ea937e0387db47cf7269944e6
SSDEEP 1536:sNGnmI1FOxAdgxBf8paY3JQzQik428fKagFVbydki8yyafuzWk:sNG91FPgrfrPza428fIenya2Sk
TLSH
T16D83F180DF58411BF86F4835E0B269857A78E6B50FE092DF2376C9590E12FD1AF39705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.4.6\data.txt
Size 145KB
SHA256 44dda6faa8220666a11a09301932b82c5d89ba5cf60227ae3b5c3a0a7518bbac
MD5 370210ebc9e63f6f39a4185846435533
SHA1 17b63f65390d236465b6952953a7df4cbc6fce1e
SHA512 e594ebf58d19f6d9e7024f98107c738142c6cc2504a0ba89e13f8f771c6a600427e75951ccbfe105983c21b735dcde6e6e173f4da37745c4de51bb9f5e86b989
SSDEEP 3072:7PAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEI/tLZjUd6mG:LX1aI5aZoKzMJ07NI/leBG
TLSH
T105E3F1108EC41FACDFA8291C70BE0B1D63E1C79D84676585E773FE0AAFAB90462275C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 d0ea0d5563e5518f8aee7c4f5cff7c650e068f667bce4fdd3f5da6b2f275f217
MD5 2169ea654369f28a61c08e37dd8f081f
SHA1 42ea70ec5a3017d383baae0c31b4ba81357007dd
SHA512 5c318be3293e8008cba44fc353237ffe057c549f24f0ec49445c902dcf7c2761c93a37273900bba862ae7316f2ffa65a7c6019f758a954d8ec9a14aebde485d5
SSDEEP 384:nzriFrcXqn338N1Z8TUNTUlIRBgPSY5m2EV0fKYbh8BQQOVcPd1oYqFvvmrN1k+Y:KFz336Zwgad0YbSKQOVcF1oYqVqa
TLSH
T12FE2D6F198DB8876D89E4B87A73E6E429AFCD153B5484984F7C41D0CCC861BFE70A825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 f18e888335214b69963cdc7be1065c0546c9db1d8421037c533533a235769a4f
MD5 f53e9cc3f629379249d74697ad23ece1
SHA1 eec4a7219849907edb8211f245c3320f80ea2a79
SHA512 efad777d9e186cd6930e1aa526eeecab0a8032379f65c6e5d17e402c5d3128bc864c77ee4e8d08c2579cec104b1bc97173626278cfb8b4f763a4b47bc58bbde2
SSDEEP 384:nzeiFrcXqnX38N1Z8TUNTUlIRBgPSY5mIEVFfKYbh8BQQOVcPdZYqFvvmrN1k+5y:ZFzX36ZwgaT7YbSKQOVcFZYqVqa
TLSH
T1EBC25C71E8A8CDA7ADDA8FC5B75A7643AEE011A3C98C5ED4D6C85D0C00C76DD270BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 f699d2cabd0a41ad5ece70cd09f3640db4fbdbd2ea9a257e0499ea126a05f8ab
MD5 89068b0f99f45975210dd1f6c16d5865
SHA1 f4616f768f0af1d5f6533134d81d835961571f7b
SHA512 803bd7070ba549027c5490836ca6589b9a3d9400a40b2d0618bbe414fe1850d77ef31fb4f3e383a63016b3d8ef683b4bf32705bcd8a574cb06f9cecc41802465
SSDEEP 384:nKeiFavqMg38No8TUNTUlIxBgPSY5oNFOVFfKYbh8BQQOVe2RYV/Vw1mRbdUVrNM:0Fayv3bwgGQFZYbSKQOVe2RYk1mT4K
TLSH
T1FFC23B35EC58DDB7EDEA8FD9E7097606EEE00167C59C4AD8E6D81D0D009719D230BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 6d6b120bb0b368a8c1199f696039bf7c433aecda40c6da510d9255b045faf3cf
MD5 a87990e81915afbb2724a2344cbffdd0
SHA1 b39686a4c63a2c85ddab9e93da5481f08f12412d
SHA512 249c27b2db66fecf9aa3e012a3bb1658141d7f8a7b0b3d4f0119450bb44950e3db040e75f9532e7d44b8ca3b83bdf45ca4dc8df458a65e641d3b2ef2c0eb49a0
SSDEEP 384:ngeiFavqMg38N5Z8TUNTUlIxBgPSY5MSxVFfKYbh8BQQOVcPdfYRYV/Vw1mRbdUY:uFayv3qZwgGXQYbSKQOVcFfYRYk1mT4K
TLSH
T1E9C24B71EC58DDA7EDEA8FD9E7097643EEE011A3C98C8AD8E6D41D0D009719D270BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 46774793aafa9a0c841d5b869204a5be735e92214e77f87f058c0b48b7655a87
MD5 a2e30a8f03366f9fb36850b21aea1aa4
SHA1 0e1c924907f77555506b5222bb1e6d0c52339cd7
SHA512 67dcbfdb80ccc1c92e2e13e1d83fed5eac4e3c854d308f78e62973b5b471bb58de8bb9e91fb0840e8249a7259991fe048d46860d4d58d2ff94b2a3e10a5ee2cf
SSDEEP 384:n/eiFrcXqnX38N1Z8TUNTUlIRBgPSY5mIEVFfKYbh8BQQOVcPdZYqFvvmrN1k+5y:9FzX36ZwgaT7YbSKQOVcFZYqVqa
TLSH
T159C25C71E8A8CDA7ADDA8FC5B75A7643AEE011A3C98C5ED4D6C85D0C00C76DD270BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crs.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\45.0.0.0\crs.pb
Size 233KB
SHA256 314199e7ac5f396e6596a1b249daab7a3d4e4fc5534654284a18df65aee1cdd6
MD5 8265ec43991e2a046a7c7de702678282
SHA1 84b3ab55cfe6ee24909c74000a875c3d4118b450
SHA512 21c4cd80df8abc08db43ce9c2663cebf2ecf9a9e3c6276cc5280b8a3cea5ef5ffbd25bcabb9fd53b8ca2dd8bc6eea760c4692c47ebc8a1df21097a130bcff422
SSDEEP 6144:KKiD4b7BVpsrYRVW+J2i/P66k88yST+uUM:KBo9VpsrK2GeQY
TLSH
T11634AE9A0F3C3A11BFD2DEA466C8D9377D79B3E06A6928172111C4F169927E07D8C12F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ct_config.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\45.0.0.0\ct_config.pb
Size 16KB
SHA256 3606e07b5ee09b43a622cd87cee80474679ea4f4c1aa59e5ff33d49da851f1aa
MD5 442440bc4c725cf395df7410e58d9653
SHA1 3d387b0a60fa20c9c4a22d5e8f6ed5f6ec8d1520
SHA512 28879ff61c3933068bc4212bfd9da3956971fe6e45f5a8379910328899acfb489353afa41b67e1c961d95534aee7f2c004ae04ea92286b43491595a7aad63252
SSDEEP 384:btomWvvtJvzm9myvg+FN2VOhikm5hV5+QiyA94pDmiDyDS1c8CazaUhszz:bl5Zhk5hV5+Qis2DS1cbe7Kzz
TLSH
T15672D9BFA1169F000383E558D6E157AAA12363DACCF3763DB1E1C005F5423E6B1A967B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kp_pinslist.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\45.0.0.0\kp_pinslist.pb
Size 10KB
SHA256 205bed72b527a07310d132616393bac84db775a9bc372559d5182672e376c0e2
MD5 d05686bdc79220049deee3d07b28c41b
SHA1 d59bd95593290a239f6d4538ed1674d1541c4017
SHA512 78163f8efa0bf534325087b08f31ce488bfdcf154b79ef6c53ea41c648b9f11bfef13de21a2233b89a4a6d89e45fdc9e261f780a568be9599b8e50571f1458bc
SSDEEP 96:rxk+yBjecaikDBwrBnnoxGwMAy5z5tBT6c5MacFwn2Xh6g/gw:21IDCrBnYQ5jlMacFwn2c9w
TLSH
T1302204B37904F99350E7E0BE1041F59AE93343A540ADF98A528C4A7635F1F0719BB4EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 87b38e493df3e90ca0b61193f10481938c242b892a7519a9b900d77519ac4246
MD5 b8ead6e0abc85d076e89a0897f4420c0
SHA1 a9e35689a31c007003b5110cef1ad9217f200763
SHA512 fcb9fefcb802fc99c6a0e6996da8bcedd338c49088808c5aa0742a22728a9e338b353f66a8c2d393fe9090d5b2b2d54f1e5007c17905ca2464ea8f4beeefc21d
TLSH
T1E14120E04C3D5AD1D1BD0ABEB48B38EC80ECC725F4A4347D6C68E9984A7A60D248583F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 84772c12c1970229b8b07a0ec48ae50826f046a602f06cbf7faecb15c761abe1
MD5 cf477f42e31bf5cef2aa48054e674c0a
SHA1 f9dd0125e04e6cc658febb99b98d8e27bc334d18
SHA512 7be79cab6932614365fa845fec1b92cb5384b9ee45f43eb780cb2be52c6b37302aed0f507df02fb9b2120407988caadbebdb47c0d67350e990031ec15b703ed5
TLSH
T1C94120E15C3D5AD1D0BD0ABEB49B74FC81DCC725F4A4347D2868E9984A7A60D248083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 e194dd9ed2c136a815eb39f2624fe83209168189f7289ae0270bc1ed4d8feb26
MD5 b1c764ccf11f4c7a67073d83469a70a6
SHA1 c2722e156384d6e0cbf792903810d2e0bcac27f0
SHA512 87eea317de6861d037dc78c12b34aafb0265df9d6375cd88b4cb69853c07af00a7f5cb1546f37ffab702e6697e9016c2746ece077f32d0034ae02d6612d84eb7
TLSH
T1754140E05C3D6AD1D0BD0A7FB09B78FC80DCC625F5A4347E2C68E9984A3A60D248083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 c0751231b6e3aa664e5892f8def654a7a23da336086b7543a50a856e90a78428
MD5 05faef5a8f8f305e8e50f960f12ef6d5
SHA1 9c601ab2d49429bc44e757a035f2d3753fbcbebf
SHA512 0468672fcdb374cf4c3ea80aa14fa2dbf5e3e393c5af2715558191776e193c4682ca71ade4e07ec90ddba333d103dcc42aaedab4d02f7d178b9cffd5b6b9cc90
TLSH
T1404140E15C7D5AD1D0BD0A7EB09B78FD81DCC729F4A4347D6868EA984A3E60D244083F
MD5 SHA1 SHA512 TLSH

Submit Download

3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 54f761e00d363bd15db7bae3cc55144c80148a5fa1db7c3c2049e0e406a9142c
MD5 b1ac780361002049b0a10a7fd30fd809
SHA1 0ee0a7dc27fd175ab7abd6e5649890be3e2795b5
SHA512 1bd8b1d2dc30bc62728d3d08085a446e8c037b02499687affa9a0bb18c6bdfee19104eabdcd8a52c2d0b542046abf26b7fdf81815037d4923e31231b0dfb7d60
TLSH
T156C02B5538F9488C2FA5257ED238092E12E4C912310022B0002ED804103465C13A0C2F
MD5 SHA1 SHA512 TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.35\Xeno.exe.WebView2\EBWebView\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
Size 3KB
SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
MD5 1de85fec2dfcc28011a7c2aaab95eb5f
SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
TLSH
T1D1611DB79A3048090E3412B86B19B35DF63E029F1AD598EB76BE568F1F710F7245C54C
MD5 SHA1 SHA512 TLSH

Submit Download

crl-set

Path C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.35\Xeno.exe.WebView2\EBWebView\CertificateRevocation\6498.2025.9.4\crl-set
Size 22KB
SHA256 6ddcaf50aaff98b960d067054ce2ce17872ac0719d02abbb7fe56b9eabc818f2
MD5 d01869348d5a783f61f90cbb27b82a78
SHA1 d4eccc91435adaf01f8589cf7f3589cf65425de2
SHA512 7ad7f27d1f559d1f50f1f009518ccca5d6d01696cd70657ad94c9fe37db7bbe06e4afc13170bc5c065cf72d69a92c3df78f637b7faa2f968bb89aa154fe371da
SSDEEP 384:2t71+UygzeWhU6yVS2Ddc0fp/9yYoIJgWUeJuDzeG0LOsr2h9ltQYX9hVPz/HG1y:m4OBwVPDdFhVyYoPWUiuXeG0K5dQYXFr
TLSH
T1B8A2BE9FAF48F112E211523D94245F40DD24D54A23996AB74F943F30ADAE42AAF3CC7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.35\Xeno.exe.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 09937c741b0350ee4f2eff20250aa72cb0d526c9aa6d5152233e2e58db7bf82a
MD5 74e29a177ee56945251af6a0cf535f36
SHA1 8a795ed69b0bdeccc4e87b9b38e8aae0d01901e0
SHA512 cc33c96af7f81cd105758bf60a0ac40c03cda58bf28f2361942408cdbdfcc509250820cdd74260c2df5749f3d62f4aeb4b97629770f0f540211004a942d0efa0
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.35\Xeno.exe.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 7515cc4214e8ac184cb678955ec00c336afdc138ebac451509f61d6142b9ecad
MD5 e712796fce7cb03fa1d4c09116d548b4
SHA1 880983daf483e2321a6bc27f147afca94e7ae746
SHA512 624582808e4d2b030461e3fe0f21d9fb56afce496a5b4b0a2ea4de923cece614868885434ee6b4ad3ca293ec3083f5d2618bb65e3d33dfab5e863cad231049df
TLSH
T149D0222333020338C0203033F083F30C2802E20F800B8002B8BCCABE3F088A80E0B883
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.35\Xeno.exe.WebView2\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.35\Xeno.exe.WebView2\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.35\Xeno.exe.WebView2\EBWebView\Default\Network\Network Persistent State
Size 229B
SHA256 153938ecc186cd98a2f1ebd1f53ae88cfe9d9884bd470e9166a53348a071fb2b
MD5 5c9f79435fd36dd2a8914a542651f839
SHA1 81f4f5faf2f14d448626b3f49618d11fd4295cad
SHA512 0e7cf3372f919b11b0c6341bc4df2bb8ba5106463b06c74f0736b14755fa23a78db7e9b3111938570225435169bd01f7198b6124007defa77e90bbe21fd14588
TLSH
T17AD0A7B655601AFE075583E01A24685BCE7D4003422C9DBAC6347B2D43A11B9901095B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe59330c.TMP

Path C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.35\Xeno.exe.WebView2\EBWebView\Default\Network\Network Persistent State~RFe59330c.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.35\Xeno.exe.WebView2\EBWebView\Default\Preferences
Size 6KB
SHA256 cadb14a3d0bf2e4ef6d46ece866d9e6d076775001208a40e2ee6db217865ef34
MD5 f200de79dcee8c32594facd18e0c82b6
SHA1 13b590f04ed7ef932678b4df1c1cd206d7108cae
SHA512 f9e881f78cac5c1c008e7cc07477de1231c15b01ef37a1fdbe4465cc2184aa4ac7dccca98215c5a3af993fdcf7d0a3f671ee48d89219d6b5fd7bb89e87eb8e48
SSDEEP 96:stV85sAcVcIb9q+fffZ8i0vhE1kmGm/7qx+WVHMSm+uecadQjo+gyjHMEB:stV8bBqfnZ8pa9z/S+Wi8d1sHM8
TLSH
T16DD186035F6C6D774CCBE619BB35BB42D5F9502262D51E98EAFC861C08D65DC230B90B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.35\Xeno.exe.WebView2\EBWebView\Default\Preferences
Size 6KB
SHA256 088497aa8a1510a2848c8f920ebe08060cd22791f292734f05f5693069a95d76
MD5 0756adbd033f6d3e91290c40a44f2bdc
SHA1 e53c7e19cad35f9a3df041d943babc0623025fb6
SHA512 ea87bfe5cab5ba5bba53094b92cb7e29431d5851c0cb9f628bcc10a24c4f45284d900e0cd7f2ab363235d100c682235b33891489594ef18096fa24acf7aaa464
SSDEEP 96:stV85sAcVcIb9Y+fffZ8i0vhE1kmGm/7qx+WVHMSm+uecadQjo+ggjHMOB:stV8bB8fnZ8pa9z/S+Wi8d1mHMC
TLSH
T1BAD196036E6C6DB74CCBF6197B35BB02E2F5502262D51E58EBFC861C08E65DC220B90B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.35\Xeno.exe.WebView2\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.35\Xeno.exe.WebView2\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.35\Xeno.exe.WebView2\EBWebView\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.35\Xeno.exe.WebView2\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.35\Xeno.exe.WebView2\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.35\Xeno.exe.WebView2\EBWebView\Local State
Size 15KB
SHA256 ca5947168d81822e2b175667d0ff1e0851b0fdae20ace8db794b03ff627ea9a4
MD5 4519ad152aebebf0a3ceff53f8015dc2
SHA1 198f3e39c609b61ec0a1ed3adc16d2aab5187428
SHA512 ad15f9ed5170df83be1c3c1c9a51e75710cd851478410ffa9cd9fec772019904e20c498fa7cc98b556e1a58139546f74dd38941996c3e1d9063a251d3d0f37bf
SSDEEP 384:zHfTPLdSWCUkEaV8DNYi0qnSXaqZvsNb6AqktDc5uPE:TTRMUVai1SKqvsiB
TLSH
T1C672AFB3AC7C9A5B19AF9915F617320B99B8D154C2D53F0DDCED1F0E06C62981716C23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.35\Xeno.exe.WebView2\EBWebView\Local State
Size 2KB
SHA256 8461813301a71c634cecae93ada4ed78a13233c27b725be63b3074b5e1340a33
MD5 542e55e72584c72196bc9cc1aa5764c7
SHA1 b52400fd09a5f7437def7e80e206bdb22de3e1bb
SHA512 dbc26e1856d770c898f9ab39e7a813a98258d078305c805c86912b52ed09e39d7fcd8e7d1153086c34558750d235117ccbb7701556c791ac1530cf6fc60178a4
TLSH
T1E851E733F858AE3789E39640B94B7F27AA355166C6523F6085DD0B0801DB5AC378AC37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.35\Xeno.exe.WebView2\EBWebView\Local State
Size 3KB
SHA256 befd80c09eb180227ebd784f6d61ebe1317bf3f3624785086b616790c70f20e2
MD5 fa766d04396d4f14cdea4ee5d0d8a4df
SHA1 37567822c7feef98b8366c8815886bd32f197ef2
SHA512 8a953bbe44d71a82aec61872edce8947d0305582ee0c70ccf7bd9f05d8b7678c77cb5812eba59addab5514a1dd5cf4ca0d1ea999af601cc23ca9543c8a85078f
TLSH
T19071B637A5A8AD374DE3D940B8862B17B7655137D1853FA8C5EC0F0C01DB2A83396C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.35\Xeno.exe.WebView2\EBWebView\Local State
Size 1KB
SHA256 346dc504f5b710228638d713a0936315328994eb1d169fb0b8f0ab11cb9dbc47
MD5 a347325ba5a1a29883295d43c6d9a2cb
SHA1 d9e5b80f55f7a4b23af6396378ba5401cf819ba4
SHA512 53df8899efb280d2e4808f46d75c158c56ce687f847d281a225ea345cd724e510f6fdb88aa46d01f3095f5c027e9de95573350c5f5fea4f1a139021b0dd267c8
TLSH
T144316773E0A82F725CD7A5817187BA5B6E21107BC1155E4851DD070412E75ACB6BEC37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe581b15.TMP

Path C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.35\Xeno.exe.WebView2\EBWebView\Local State~RFe581b15.TMP
Size 1KB
SHA256 930d800e217c471914235445c1c057e61c5c3547fa1562622a84780ba5d9060f
MD5 35911b108f0082409172a8d1fd5a9c49
SHA1 a425de71f6cb1f6c1ceb7fbe6cf3c702b7ce94d8
SHA512 4f6f5111c915a9a73a03eddc56c30240a4d9052e3f122883d878f7db90abd95fe4fec88dcc0ba111e19dfe7f5cf9310369c07f3a40d915cd29ed7f836d947570
TLSH
T1EC216573E0E86E72A9D79591B143BB4B2E60417B81151E0891DD070413DB5BCB6BEC37
MD5 SHA1 SHA512 TLSH

Submit Download

Filtering Rules

Path C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.35\Xeno.exe.WebView2\EBWebView\Subresource Filter\Unindexed Rules\10.34.0.84\Filtering Rules
Size 2.1MB
SHA256 5e301c48e6d7290990971e9f0bcb2263c8adba06ed0a2c6db5086949825d999b
MD5 43f62d9f35fa6597cec4e2ad5643e282
SHA1 8dba6404724ffd6a2e89901e8dc6e5e55fed3374
SHA512 91891d23464f89e6769d9ec7a28867e28f77925e6e3b3b75fb628d8672157ba239676c07699c931ac307a21ccc4dae95dd707d410f988ff82be4015103d4d6a3
SSDEEP 49152:ua2qP9SKIrivd04TxN/7Uw+zJEhs6dl61n4Kmq9SL6bbBT0HjTsQc8cxjw:u8d
TLSH
T1BAA55D237518BDF45BB31F3EA44B6D48823962A483E3EDC5EA2BD10ED5E014F79601B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.35\Xeno.exe.WebView2\EBWebView\Subresource Filter\Unindexed Rules\10.34.0.84\LICENSE
Size 24KB
SHA256 ed0f972d56566a96fb2f128a7b58091dfbf32dc365b975bc9318c9701677f44d
MD5 aad9405766b20014ab3beb08b99536de
SHA1 486a379bdfeecdc99ed3f4617f35ae65babe9d47
SHA512 bd9bf257306fdaff3f1e3e1fccb1f0d6a3181d436035124bd4953679d1af2cd5b4cc053b0e2ef17745ae44ae919cd8fd9663fbc0cd9ed36607e9b2472c206852
SSDEEP 384:mva5sf5dXrCN7tnBxpxkepTqzazijFgZk231Py9zD6WApYbm9:mvagXreRnTqzazWgj0v6XqK
TLSH
T140B2526EB64903731AF30116AA4B64DBF31ED03F362A4564346CC1481FB6E7443FA6EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XENO_CACHE.bin

Path C:\Users\Admin\AppData\Local\Xeno\XENO_CACHE.bin
Size 36B
SHA256 3bab55816f9c1c63b26bee8027a74983736938cfa748d9c91230391d4bacfb88
MD5 03b4e88d732421deccbdd05cb90b0513
SHA1 1ba9d3bd3af60ecc041e93251633b5a0fbac4d9b
SHA512 40e01403608fc8d8c0bc7bc6e1367a472778dea5d4dde4d242b37b0860d098075ac71cf24abd85c6b9ee67bf6adf80adaaf279a969f4477555807003276a2c75
MD5 SHA1 SHA512

Submit Download

settings.json

Path C:\Users\Admin\AppData\Local\Xeno\settings.json
Size 101B
SHA256 88e5c8567b1cad0fa2a42a21ac273a1ffb8a6992be41e5de548d11f281f4c373
MD5 7109faf92716c37ae9d65f89a2477be0
SHA1 de2903bb44600fd8a69649c395335d4fc226c5e0
SHA512 f41ca49622d3458c1365fd9f610e1c27fd3dd816ce5c910e785532dcc39d94ceb1a00991909cc247ab4b9e9da0ac583245168853d8bdcc235116f0a7a4538b2f
TLSH
T11CB09232984108FC01608299C841D80203118E0120662E02B4BE025928308346000FD8
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6084_1255957231\manifest.json
Size 177B
SHA256 096e772e0f2e8c15e6dec9087ee0a1fb8b0c56b25061626aedc9e7e705adfc2e
MD5 2714a51ed8c2a891ad73b7488ab655b9
SHA1 9a8cc479aec8de1b4eb678e5d68b23b16a39dc99
SHA512 4811522c06ad6946626a9f4d12eb62a1d623825d18a1cd0ad7b628f4c059f37d299b5857abffd959e4ea53239412490539f5705b4aa6c6951d13c68e6d5b72ad
TLSH
T1E6C012EFDC509DB215EB4323156D43C4E733CF4B1546490935FB66082A25981C193500
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6084_137389713\manifest.json
Size 119B
SHA256 7169d86e87f904218238cd293e043e20b7828afad9acd1ff2e5d64188530b9d7
MD5 7382260298fc06c135b7c7399e9acff9
SHA1 6a829f795a3b8be25200675e00abfa1908fdefdf
SHA512 f0ce77f9f72fb6721bcfa9b03f77b0771e8217988183787c00dba4f9d9f19cdba252ddd656422336035f81939cb97c8b5dcb4f036a39280198c17cd04faaaed4
TLSH
T191B09273A800E83830E9EB91093A8243F320AB4BA585640A3625485C0B2B9F990606C4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6084_1835479043\manifest.json
Size 165B
SHA256 daf50c160ae8f5935baa4a7207e9d04afbbc81a6dd9ed02d99de12056743eeb6
MD5 8ff4c35081337b1ba6731cc36163c2a8
SHA1 31c80c4a98e5492fbf1b6b3e050446e7240c24a6
SHA512 1a616b9b797441fb438c89864beae36c1a151b1c85e1288481dc61d9f82df2c1fd5e002dbacc05d3070323f56325ed960df3e353d314eb2ee218f8e93aea3fac
TLSH
T1D6C0805294011D7419CE47150D5CE3889723D7152980B0155BD7C218DC3DC8B68F3B4D
MD5 SHA1 SHA512 TLSH

Submit Download

keys.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6084_2092187094\keys.json
Size 8KB
SHA256 ae6e69a145f84c0a261b4e82888779fbf137f193881d687588e1af71609ae947
MD5 d3ebc1cb4b692c6e2d29a4625420fe73
SHA1 4ce74c1e9af6fd34d6379ec0fec6afb24082a7c1
SHA512 e34b855615e6a3bf770f27d85aa29ca57a324c08bd8f8d9c0130e2a142c0e4a5f17bffd0861b725acc8a2316f73b7fe50406b0af26264a5c2d8f37599b260860
SSDEEP 192:uNtGbR+mFGfvPNyR9Pm4lOvMwkoR9PuGMXcy:ORmqwKjA
TLSH
T18402A57F14A41181CE7FC1698F0B78B78FA038065BCA3A83539BFA49494296D173B5B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6084_2092187094\manifest.json
Size 79B
SHA256 7ea98f2308a9c51d17a1ac71b64afbe2a41ff0a083a166a0e4cc428bf44f0715
MD5 817fea104100763cd1bf4f15a51bfe94
SHA1 589717cf98cf7e2d55fc0d6025a4b8e215ed13d6
SHA512 da7b959d93113c5a6be360f90d9c721989c5e7acad7fa592081b582c4c3a0c4a9066a71473fd8492ce7fe7b0fbfd6870d939428a67fbd508fcf6b2c6dc1a41ea
TLSH
T15EA0122058019233108407600360478243551C022015244809461041258813A12A3128
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6084_555707436\manifest.json
Size 52B
SHA256 38bee4120e8eb37975dd2f6a2a3b23f9cea6e6c4f0335ad80270dc22b9990fc9
MD5 50ba36034cb8b97ce52eb941d76e9103
SHA1 a8757a3700f2af777ce5efc382010d2619f51491
SHA512 001110c3e45514a09cf6f60ca14855524e83ac15cf56776cf3005e016464dc6584b107c63842328a7c1738cc7f2154d8689f84d913b9b8199367699c3f9085aa
TLSH
T1FC900260082491171AC10E506570F8859391661A95851D1D0445154802A646CE050298
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6084_912785507\manifest.json
Size 102B
SHA256 e741cdf9904ddfa667e409e6c84d20225efc506588802ca959e1c6b0926ddfd8
MD5 ee1ed8500e24dfe42b5be26a96d5fdfe
SHA1 f4b08becd340a875a34eb0dc3fff2024625643f6
SHA512 0b782a4871d0fde1c775237f9392f9ecf7355b886f50584a101a0764631ddf22a25d0d19a0041bd22d943d68529a86168e202c6276d0cc9c5751b580f4d2783e
TLSH
T1EDB01221EC10B4B31004036C086CC3D0632B2F072C4079280DE19F84E90D9EBE872529
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.fingerprint

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6140_1320548580\manifest.fingerprint
Size 66B
SHA256 22b55f5d9b1bafb80e00c1304cf5e0d6057a304a2e8757b4f021b416f4397297
MD5 5bbd09242392aacbb5fac763f9e3bd4e
SHA1 14bb7b23b459ce30193742ed1901a17b4dcf9645
SHA512 541e4c7998e91a5113f627c2c44e32b54878fe225b3b9476572f025f51f2b4ec4a44b102498adcc22b8fe388970645bacfafb6e7fc8a216df4d7bbfc8b0ff670
TLSH
T1CEA0026342648D9FBC1C042BD478A69DCD9115B088492445A925C75BB14203389F49A1
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6140_1320548580\manifest.json
Size 76B
SHA256 0d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11
MD5 ba25fcf816a017558d3434583e9746b8
SHA1 be05c87f7adf6b21273a4e94b3592618b6a4a624
SHA512 3763bd77675221e323faa5502023dc677c08911a673db038e4108a2d4d71b1a6c0727a65128898bb5dfab275e399f4b7ed19ca2194a8a286e8f9171b3536546f
TLSH
T170A022833A0EC03B008283B0202383C08BBCAA28380E080E082338C0CAC2BB80000B28
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6140_1439212068\manifest.json
Size 113B
SHA256 98821f71a1973ac61b45967ce0c121eb598ac6e95abaa23c912d2f33e4237d8c
MD5 7ef3c71464d0fef472bc1d81fd363c62
SHA1 230e8ec0f849bf34d444c55ef548ba0c9c94d39b
SHA512 f74b96ec3b9569e360a02bfdd4fe237efad8ee2a5deaf46db891bcadd39dba22fd6d59a4e9aafe5511152625ce9f468519dadd53fc0c9b6c8826dc58cbe6cd7c
TLSH
T1C8B09262DC80D872693A93AC0E2246C4F228234B2558AA493630048C0A3A3F082A2321
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6140_1840608946\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
TLSH
T158C04C668D51DEAB00A747A56B295315E23B4B4B5044800A7AF5429C1A288964171944
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6140_850519337\manifest.json
Size 116B
SHA256 181a1631374b5ac1fff89559f7e23498ad9ee4796885d7b956d5e7d5f9c3f8c7
MD5 daf93729356a67ea1f849554827fdab1
SHA1 17dad0cbc82d5e04fb068896a5832f983e124c01
SHA512 473d9d608f2f3324d5db6eddeb4554a7271df4a6b62377820d935c001a8a2376479aa4d3e3b80ffbfdd3ba80f56fe72f1bc9dd020bcb396182b753353b883a30
TLSH
T1FBB09262A8084633249523F4A2639363CBA86D4A91346606091B9480659E73B22A5219
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1180-654-0x00000257862A0000-0x00000257862A9000-memory.dmp

Download

memory/2744-1027-0x000002BE84370000-0x000002BE84379000-memory.dmp

Download

memory/3172-184-0x00007FF9CC790000-0x00007FF9CC791000-memory.dmp

Download

memory/4988-73-0x00007FF9CC790000-0x00007FF9CC791000-memory.dmp

Download

memory/5008-646-0x000001D6F1FA0000-0x000001D6F1FA9000-memory.dmp

Download

memory/5684-1836-0x000002A3CE460000-0x000002A3CE461000-memory.dmp

Download

memory/5684-1828-0x000002A3CE460000-0x000002A3CE461000-memory.dmp

Download

memory/5684-1827-0x000002A3CE460000-0x000002A3CE461000-memory.dmp

Download

memory/5684-1833-0x000002A3CE460000-0x000002A3CE461000-memory.dmp

Download

memory/5684-1834-0x000002A3CE460000-0x000002A3CE461000-memory.dmp

Download

memory/5684-1835-0x000002A3CE460000-0x000002A3CE461000-memory.dmp

Download

memory/5684-1826-0x000002A3CE460000-0x000002A3CE461000-memory.dmp

Download

memory/5684-1838-0x000002A3CE460000-0x000002A3CE461000-memory.dmp

Download

memory/5684-1837-0x000002A3CE460000-0x000002A3CE461000-memory.dmp

Download

memory/5684-1832-0x000002A3CE460000-0x000002A3CE461000-memory.dmp

Download

memory/6140-782-0x00000146D4630000-0x00000146D4639000-memory.dmp

Download