e5b87323b6d6ebe0967a8f290f20cb0ce2c90b26ecbc0f0564b6f483b2974fff

Analysis

user interaction
yes
max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/05/2026, 23:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Xenes/Xenes.exe
Size 1.7MB
Sample260508-2453labs2p
SHA256 e5b87323b6d6ebe0967a8f290f20cb0ce2c90b26ecbc0f0564b6f483b2974fff
MD5 e29ace702dd1afd6745f991a8060506d
SHA1 862e6af13ea08a24fcd541d294337b22cb2627a9
SHA512 b614f91231f48125c48002dad30e4625d1ebfaf6d3c202fb1577351fd98a64f14fef087b83f993f1066b3749d1e5e02621a38404a921e45648fd16af809b52c1
SSDEEP 24576:0bA1+50SHgbuO0MjdM8yfAPnqOTmciow1Pm7rnlTxYcxMNWwA:0sglH20MjmfeqOTmcNwdm7zbBxM
TLSH
T17C85F1A117DC968BCC563F3076B09411066A3CBF14A2899B9855BD8E3D33E70EE5CB1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery trojan

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
4472	Xenes.exe
4472	Xenes.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Xenes.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 11 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping952_1732001546\passwords.txt	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping952_1732001546\ranked_dicts	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping952_1732001546\surnames.txt	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping952_1732001546\us_tv_and_film.txt	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping952_1732001546\male_names.txt	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping952_1732001546\model.markov	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping952_1732001546\test.txt	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping952_1732001546\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping952_1732001546\english_wikipedia.txt	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping952_1732001546\female_names.txt	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping952_1732001546\manifest.json	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Xenes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	Xenes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	Xenes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134227553887339446"	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4472	Xenes.exe
4472	Xenes.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
952	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4472	Xenes.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4472 wrote to memory of 952	4472	Xenes.exe	82
PID 952 wrote to memory of 1880	952	msedgewebview2.exe	83
PID 952 wrote to memory of 1776	952	msedgewebview2.exe	86
PID 952 wrote to memory of 1776	952	msedgewebview2.exe	86
PID 952 wrote to memory of 1776	952	msedgewebview2.exe	86
PID 952 wrote to memory of 3044	952	msedgewebview2.exe	87
PID 952 wrote to memory of 2832	952	msedgewebview2.exe	88
PID 952 wrote to memory of 2832	952	msedgewebview2.exe	88
PID 952 wrote to memory of 2788	952	msedgewebview2.exe	89
PID 952 wrote to memory of 2788	952	msedgewebview2.exe	89
PID 952 wrote to memory of 2788	952	msedgewebview2.exe	89
PID 952 wrote to memory of 2504	952	msedgewebview2.exe	102
PID 952 wrote to memory of 2504	952	msedgewebview2.exe	102

C:\Users\Admin\AppData\Local\Temp\Xenes\Xenes.exe
"C:\Users\Admin\AppData\Local\Temp\Xenes\Xenes.exe"
1⤵
- Loads dropped DLL
- Checks whether UAC is enabled
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4472
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Xenes.exe --webview-exe-version=1.0.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Xenes\Xenes.exe.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --mojo-named-platform-channel-pipe=4472.2004.9602808109969809167
  2⤵
  - Drops file in Program Files directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:952
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\Xenes\Xenes.exe.WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\Xenes\Xenes.exe.WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ffb48e5b078,0x7ffb48e5b084,0x7ffb48e5b090
    3⤵
    PID:1880
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Xenes\Xenes.exe.WebView2\EBWebView" --webview-exe-name=Xenes.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1732,i,13568534515326919194,8356043148284653014,262144 --variations-seed-version --mojo-platform-channel-handle=1728 /prefetch:2
    3⤵
    PID:1776
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Xenes\Xenes.exe.WebView2\EBWebView" --webview-exe-name=Xenes.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2044,i,13568534515326919194,8356043148284653014,262144 --variations-seed-version --mojo-platform-channel-handle=2052 /prefetch:3
    3⤵
    PID:3044
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Xenes\Xenes.exe.WebView2\EBWebView" --webview-exe-name=Xenes.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2376,i,13568534515326919194,8356043148284653014,262144 --variations-seed-version --mojo-platform-channel-handle=1700 /prefetch:8
    3⤵
    PID:2832
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Xenes\Xenes.exe.WebView2\EBWebView" --webview-exe-name=Xenes.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3660,i,13568534515326919194,8356043148284653014,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:1
    3⤵
    PID:2788
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Xenes\Xenes.exe.WebView2\EBWebView" --webview-exe-name=Xenes.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4080,i,13568534515326919194,8356043148284653014,262144 --variations-seed-version --mojo-platform-channel-handle=3868 /prefetch:8
    3⤵
    PID:2504

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping952_1732001546\manifest.json
Size 69B
SHA256 c0622dadf4ec10ce5f4a64e3f24956b750345dcc194d0bd3ff73cfce1bf6081e
MD5 fb0d9796a86299d3689982f7a949dc6e
SHA1 6179cd612ac0dcc44d0659c7c99d1e0aecbf206e
SHA512 e3e1a18be661da9d450a30a37d24dc08dc8de628a104ce0f4197214ce6f27a2bf9de3eca1c1697fcfa3c601787ca7a6b5e30a5fe3d6ae3b2c10f1ab34af22fd0
TLSH
T141A022200C2088FFF200E3CC0020E380CF28A300A2088C0A022220002280CB80200320
MD5 SHA1 SHA512 TLSH

Submit Download

682e2634-a13a-4614-b342-8fa145335d31.tmp

Path C:\Users\Admin\AppData\Local\Temp\Xenes\Xenes.exe.WebView2\EBWebView\682e2634-a13a-4614-b342-8fa145335d31.tmp
Size 19KB
SHA256 791cdf5761bea80f592d8a9622be9bf2e0b12baca92ab4d127e5b5c61619f9e0
MD5 7e0cd50dd819fdbdb72f9d5fa6e5da18
SHA1 eb1d8f06550e9e1ef52bd75c6a8cb8719d5d23d6
SHA512 5aeb99d62fb3eb360f8cc3e1d1061fabd3b8f12bf460c71f455f1483467fb5e6072025b58386ee7d72fb9dc756abd44c3e6909cd724b366896fb3867dd2ebf36
SSDEEP 384:zo7vsrvyOiyp4+IWA1eUVWGfvvLeENmeIvj16Ky/MOOMfThdDD:w0raxyp4sQe6WGfvKUIcWMfT3
TLSH
T14F929E319AB4DA739CEA4DC6BA4BB617BAE48156DAC81FC4D8D45F0D008B68D170BC1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\Xenes\Xenes.exe.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 7ba9d357511f404d8c5c3726ea5ef78e071b597b9124580d0a0610bca1697abb
MD5 41748ee83e851597858cf53d05c46136
SHA1 4d4ec8772fa7eb659a0fa81f5065f254fd34b484
SHA512 babeb0f48efa35ab2a0fc4eaab1d145c33e9c8c800038be1fb744b13fa97cc003b82bc824a603c1a1ae001e70d351b1b9626fcc3a3a7cd1e301b5c844913804b
TLSH
T102D02BA623214034C4B831712401720E3C07500DE054718060AD479E2E2A4D514E1857
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\Xenes\Xenes.exe.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 457589605e8153e066bdca3e5910419ebfac0abd63794a459529aed5ddc49fb1
MD5 25f45ee993557aed8381f99bcbc5cb6b
SHA1 b29118ad11bd2e98ace5d99a7574be9510eb46ec
SHA512 919daf9b9f08bd02a54e25c78eccde4724dc1922f80133765c968a91b393d152824697bd2e62914c6455dbf5b960cba7e47deefc6996787293cc0cba5721e99f
TLSH
T1C2D02BB333214034C0B831712401730E3C07900DE1543180606D479D2E296D515E1897
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\Xenes\Xenes.exe.WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 504B
SHA256 4fb52b2015d793f0943ddd40b86ed9669b5ac9faef58cb1d58b86829f83537b0
MD5 81665a63bff151e648edccab37dda573
SHA1 e38cb8ec8175d143281dbaf72ee33e5cfa450ab8
SHA512 d021d27bec8fd29c660e2bf9d8ebc07b9e4817a612ec27f967c9beae2d1061d22bd3562e1ea2289ac641fec7f158ddadaa6589178ff842ebf564a35fae6d5231
TLSH
T16DF0C015100246C7DB94CB701CC4298C32F1D4048DC75BFB02A5E839CCCA3CF2E5D501
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b32e.TMP

Path C:\Users\Admin\AppData\Local\Temp\Xenes\Xenes.exe.WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe58b32e.TMP
Size 408B
SHA256 34cff89790e9a19a0ff5fedb01527d370c7b6feba52069ebae9e10f1a3f7edb4
MD5 76eee159922ece16a3434a8f0fd68427
SHA1 b2d35f6f7316e271fb3cad47198d270885e93d7d
SHA512 230df829ec191054ca3a32182bce2ccf9f3eb4409a33e28fdd8b6cb44caf1c1cf22d83f653e795a5faad2a7db4ff4712668bd9fb693c36849f844adfaa5c5d34
TLSH
T192E0C219211241C7E748C6305CC5169472F6A84484875FF643A9EC76CDD87CF1E2C645
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Temp\Xenes\Xenes.exe.WebView2\EBWebView\Default\Network\Network Persistent State
Size 5KB
SHA256 1658170b85f30410bfe8067ec71a03a106b1b1f29d85532f07c507717fa22f98
MD5 35fc252b932f0f26cbc3a7b8f7ae0d53
SHA1 eef906922db022e244b42170fab107d2495abe4e
SHA512 0079d04643357683d21ed2e97f05657711124e9749d29ce29a9dabbea31197a553043890e2ed59403427d9dd6e0b0473badf575de193405db45761a3d203ae77
SSDEEP 96:F2k2fV2fN2fO6IJsI/IETYOTvvT8E1Tp6wiPSDhTpMTBoBkK1B0wZzBjBvz+:F2k2d2l2m6UsCJDjvYq4wTDhFM1oucG/
TLSH
T173C15EB2B3E45A6D4A1355FDE61C3B369E99081D43183C7D8CE5BF0E97D28B0A20498B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Temp\Xenes\Xenes.exe.WebView2\EBWebView\Default\Network\Network Persistent State
Size 1KB
SHA256 ab34f2e45a8ca5e95dc0508a96401fa2d1cb927999f981d47e1ba94e96ea4ebe
MD5 597f3428fdc3d9abf3b7d968a585f33f
SHA1 812cd84192fdfd2ec8be6c769a48edbeb8da1299
SHA512 212598a6f9967b0c687dd2c9b47a2aa2740f3b4378310932e3d5235351b72f5a86f169995b53b5769bed2da777fd60149bde43c72804d141432fcd4b0887e391
TLSH
T11D31C0B283F456AD8A4316F42B24AA27CF5D082447682D29CDDEBF4B53F0970E21074F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Temp\Xenes\Xenes.exe.WebView2\EBWebView\Default\Network\Network Persistent State
Size 1KB
SHA256 56d915c0ba78057d50a4f709622c6427e6571b2d2cde28ad7450465265d84bbd
MD5 a70c21fe606ec02cc4cc459362e42fe1
SHA1 38049b9607662d1a3441cbde9f75b42c38350ba2
SHA512 464d00568d23524a593a97e692f7b87e6b3f74a3b7bb2b09dc921e07542c744570fca5dcf2ed388b5147fbea8106e82622323a08fe3b5ce5f7c7e1bd2f8551a0
TLSH
T1443190B286F456AD8A4316F42B247A27CF5D082447682D29CDDEBF4B53F0970D21074F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\Xenes\Xenes.exe.WebView2\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Temp\Xenes\Xenes.exe.WebView2\EBWebView\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Temp\Xenes\Xenes.exe.WebView2\EBWebView\Default\Network\TransportSecurity
Size 1KB
SHA256 20cd80e5ba9962c3446265e5d47d19bb67633073806e2383ee6f4cdc1f497d55
MD5 90ddcf8b42ac6f1e8946c6d1de7eda54
SHA1 a1e0eb28247327cf5681e20522e8f3c3460ddb98
SHA512 c99374e572398ec3cb3ab4a5370c35dbf9e61d921c344214dca29874653017606f7e64e3275e11310568717b4717f676ce824bde4cca301e258f4d5e4f3d0e0e
TLSH
T123317AA7D6FEF86F613C5DA75E40BC452BBAB831429260F4CA63C57CB0815F32612466
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Temp\Xenes\Xenes.exe.WebView2\EBWebView\Default\Network\TransportSecurity
Size 1KB
SHA256 de8841e16af8f1ade4ad33a348c6bc4e2b6e5c4a9656c1a348cb7ac0318edc32
MD5 31acaa825df25ddd36f0fe126ecb62d8
SHA1 97ad72fec0be50892bed04d3b543ada41826a856
SHA512 8674aa3e2fc22717688023225bc1814c3a2afeda7e9532f3c68452c4a9ef38e707511379e6f55b46597297737dce86509ae268a8539fd3109a77021e48216f6c
TLSH
T133317AA796FEF86F213C5DA75E40BD452ABAB831029260F4CA63C57CB0C15F32A16467
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\Xenes\Xenes.exe.WebView2\EBWebView\Default\Preferences
Size 12KB
SHA256 11293776e24330356bc48a48722fe929911678d179c61c0dfb840c6ed2965948
MD5 d48fc31092948b468494186495009f0d
SHA1 a4a1fcc592d89daba3226f27bd05dce614912f9c
SHA512 ea09060f147262c2010549eb12eb3f4363cbf4909200c53b6f6283ced15fe5f8aa44377aaab4a52a7d46173fda96b2ae7ad7dc3db55ec25193a455baa1cbed59
SSDEEP 192:sxRYcl+uybPApiSi5jpWo33c6+WNLAWgUNGeiCdI5PLY/qxgsfbQeQK+0m8HMV:sxRYcl+zEq39dXJiJkqx/hmdV
TLSH
T1E042A617A9B8697B5DC7D118F922B76BE3F9103266D04E48AFFC8A1C14E67DD620340B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\Xenes\Xenes.exe.WebView2\EBWebView\Default\Preferences
Size 12KB
SHA256 29cb161c889b03da6cebf2e9dddddfb2c24c881bfd5326f3632eee290e7d17ee
MD5 f9911760f7b8266fc7523f9daa7e1df9
SHA1 fed67027258dc121d44f8f46e1d9d1794b63323d
SHA512 4b268172bf872c84660e6412302222bb92a2394117d41c2b3ce401e86b2b8abd83eda7a742da0ebb82f76dcbdc53224a052b897a9ae815d7d0218957669e7b1a
SSDEEP 192:sxRYcl+uyTPApiSi5jpWo33c6+WNLAWgUNGeiCdI5PLeVkxB0gsfbQemw+0m8KWk:sxRYcl+zMq39dXJiJUkx+ThmxdV
TLSH
T1EB52A717A978697B5DC7D128F522B76BE3F9102266C04E48AFFC4A1C15E77DD620340B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Temp\Xenes\Xenes.exe.WebView2\EBWebView\Default\Secure Preferences
Size 9KB
SHA256 fce920546509ac3f4d5ed99f0377d2e10f546d4ce563fb5a1cd0a0cdbc0ee1f4
MD5 507b0bfbc15f70243675e5e9177bce5b
SHA1 88f039a7c86801b70f791a414f4b1f2ec8d756d6
SHA512 956dcb69d108558b9da4fbc3af835cc6737f724dd6525945e0d9ed31f91fba1ea641e5b01018d017eb813b71db5a6f141bd2e6e75c9453c6f7ab1e6501482985
SSDEEP 192:HdWWG+L9ldSdugPoEu3jDMXlgcxfFkbJ8rRlTanQiSZhETgv9KO:9LL9rKnrvtj97ETE
TLSH
T18C1209F3486CCE3A9F895AE9EC39BECBCD65019FC9CD4C0195D6C54802C2FE931994A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\Xenes\Xenes.exe.WebView2\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 ad8d720ab2f212a8ba051071f8a6d4e8d39b6d2d4a6ed44f68cb2b5d5db7d164
MD5 a53ba7c2a9a290fe65aa1dd27c005d8c
SHA1 7b60e161c62b3bc71398b142ee1178b053010cf0
SHA512 b0a360f0e84150667479aff7703be83d3977fa7515654f78497864b8d1a4fbb2eace1fa1c5c8d50382c067bd0c2c35e0a62b34fb3bd9f66f593cebb6996d0378
SSDEEP 3:MsEllllkEthXllkl2zET/G/D:/M/xT02z+/
TLSH
T16F4404177FF40415C50010314031D3700F71D4300D11D74335D104135CC5D40DD0C040
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\Xenes\Xenes.exe.WebView2\EBWebView\Local State
Size 13KB
SHA256 a551ea3d026be20c5397ab66e67babe8dfee899c6fc9c7fceb84378bc4973aba
MD5 8822c0a56057a7805112d87f98af8635
SHA1 2d43e154dd3647edcbc01f655a0d6cffb366f520
SHA512 6782733175062226b6568cb24f7a7b9eb3476571869570d56ac4fcf2e7cd7622bd25a15e5670e38a7d4f8863c68d6c841a197201d507c02b93e0e6b2db8b9158
SSDEEP 192:zH3OsABNbcFU6cGESm09FWCnyN5R4GUvWOuu1nREmiUaek///kMPCkIDVKORhiG:zHlCcmyWCyN5eGEj1zQ/HkMPIDVKORoG
TLSH
T147521B36E4785EE388E6DAC5F545E606AED46177868C0E9CC8F92F1C308F1BC1747826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\Xenes\Xenes.exe.WebView2\EBWebView\Local State
Size 10KB
SHA256 e58dc0964a3c12c20d90f704fcf384f9d6a05bb0c47fae0e370e5b575cda77b8
MD5 cb8892b7d89b6949314b08e0ad9a62c6
SHA1 699298b2544030bfec1b52face56f2a37454e048
SHA512 c77ec8ab4b39262ff7035c9035ab71092eff25f2f39690117221c5ff5aeba6147034628ca3857341661811cadc4565f3f1242c54fab119fedee278ea6e8497b1
SSDEEP 192:zH3PsABNbcFU6cGESm09FWCnyN5R4GUvWOuu1nREmiUaN+///PMVz3Q:zHUCcmyWCyN5eGEj1zj/HPMFQ
TLSH
T120222A36E8B99A739CE79A89F6462617A9E45157868C0FE8C8ED0F0C11C72DC1747C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\Xenes\Xenes.exe.WebView2\EBWebView\Local State
Size 19KB
SHA256 282b29618fe28a3b20f5c98d5dab2da6b3e7d7a82b76fb7ef9b39d1f7744a0ef
MD5 1b91003f352534e9330a984439c74b47
SHA1 4404f8ef98821681d2632317e1e6c8030ee0c222
SHA512 2ae719f3e1e26c4b314738ea6710c98491b47c173d16c611d87b5bab138f9f4f5bb7b3e7719e7b55696469d13ff760712fd431d03e11172c480e44b5bf6b6c45
SSDEEP 384:zoQvsrvyOiyp4+IWA1eUVWGfvvL4N5eIvj16cy/MPMf7hdDD:N0raxyp4sQe6WGfvRIoDf73
TLSH
T171929F359AB4D5739CEA5EC6BA4AB607BAE88156CAC81FD4D8D45F0D008B28D170BC1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Version

Path C:\Users\Admin\AppData\Local\Temp\xenes_ext_12d4e06c\XenesExtUpd-xenes\Version
Size 6B
SHA256 59854984853104df5c353e2f681a15fc7924742f9a2e468c29af248dce45ce03
MD5 c9e47dbb0e1927076ed7b2e1ec157be7
SHA1 c538b66c7110ca3a028ccfe422d0f1fa200a9935
SHA512 c6e5081ce77f5971474ff994acc1b8887818f3007a4e3db32c91640203906f0bd2df3012441c9e1b6c1ae4e54dfea465ec23034092779cf6852aece45bf1df21
MD5 SHA1 SHA512

Submit Download

XenesEx.dll

Path C:\Users\Admin\AppData\Local\Temp\xenes_ext_12d4e06c\XenesExtUpd-xenes\XenesEx.dll
Size 1.0MB
SHA256 da2ff6179409ad53ee845a9756d934e67b99317bb6e93de549df2ae1c413be23
MD5 72305395254c125a37d6f9015f5e586f
SHA1 c087c0f5cb80f6e59014d8a643fd5a18a9596dfc
SHA512 4060e45ab9129d03098ba9ac1969e53c00705917dfd24bb1fd845f526a4b17f97ba2e99288c0b1a34932cf7d4eff039c657d88fa520eacbf3696c8449c31a1b3
SSDEEP 12288:WFCAVF2yRk26txSXBcRhyJC7tGSpQD5Ed4b7wDyeAEoQ+Kzzty:zS0326SxiKWfexwdAEZnA
TLSH
T192357C5AAB4911F8D156D1B8CE978913FBB6F442031193E732EC91683F17BE88B7A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zstd.dll

Path C:\Users\Admin\AppData\Local\Temp\xenes_ext_12d4e06c\XenesExtUpd-xenes\zstd.dll
Size 639KB
SHA256 6293ac5ece98da290d95aea3459d49066ba54736d73e77aa4923c8664405acc3
MD5 01bcb079eca861316159263cecf1ae4e
SHA1 4192d84a88fd1c7a7a5f32ce5e8a0ba5b156f4b7
SHA512 a530ac7bf3a1b382040c674121fa283a6e987b2e51257ca73008fd571ef679b53bc6c79ec070656247fe9f15c1dded92ee726f92692a9f5d1a757fb75215c211
SSDEEP 12288:iwQgldrZYak5VtEy7/ZKO2N5ZKXpwlAiHnlRXWk6qR:VVG7tEy7/ZKOUnKXpwltHnFn
TLSH
T150D48D83F29951ECD02BD179C6965323EBB67C4513006AEB83A0EF653F13AE55B34386
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/952-459-0x000001F294DA0000-0x000001F294DCC000-memory.dmp

Download

memory/952-149-0x000001F29EA00000-0x000001F29EA27000-memory.dmp

Download

memory/952-460-0x000001F294DD0000-0x000001F294DDC000-memory.dmp

Download

memory/952-150-0x000001F29FC50000-0x000001F29FC8B000-memory.dmp

Download

memory/952-147-0x000001F294DA0000-0x000001F294DCC000-memory.dmp

Download

memory/952-148-0x000001F294DD0000-0x000001F294DDC000-memory.dmp

Download

memory/952-462-0x000001F29FC50000-0x000001F29FC8B000-memory.dmp

Download

memory/952-461-0x000001F29EA00000-0x000001F29EA27000-memory.dmp

Download

memory/1776-31-0x00007FFB6A000000-0x00007FFB6A001000-memory.dmp

Download

memory/1776-179-0x000002240DA00000-0x000002240DACD000-memory.dmp

Download

memory/2788-82-0x00007FFB6A000000-0x00007FFB6A001000-memory.dmp

Download

memory/2788-185-0x000001F861910000-0x000001F8619DD000-memory.dmp

Download

memory/2832-42-0x00007FFB6A650000-0x00007FFB6A651000-memory.dmp

Download

memory/2832-43-0x00007FFB69D40000-0x00007FFB69D41000-memory.dmp

Download

memory/4472-269-0x0000025BFC920000-0x0000025BFC92A000-memory.dmp

Download

memory/4472-271-0x0000025BFDA10000-0x0000025BFDA22000-memory.dmp

Download

memory/4472-140-0x0000025BFC8F0000-0x0000025BFC912000-memory.dmp

Download

memory/4472-186-0x0000025BFC9E0000-0x0000025BFC9F0000-memory.dmp

Download

memory/4472-0-0x0000025BFA230000-0x0000025BFA3EC000-memory.dmp

Download

memory/4472-83-0x0000025BFD610000-0x0000025BFD6C4000-memory.dmp

Download

memory/4472-5-0x0000025BFC9E0000-0x0000025BFC9F0000-memory.dmp

Download

memory/4472-4-0x0000025BFCB90000-0x0000025BFCDAC000-memory.dmp

Download

memory/4472-3-0x0000025BFCAF0000-0x0000025BFCB92000-memory.dmp

Download

memory/4472-2-0x0000025BFBF90000-0x0000025BFBF9E000-memory.dmp

Download

memory/4472-1-0x0000025BFC9E0000-0x0000025BFC9F0000-memory.dmp

Download

memory/4472-116-0x0000025BFC9E0000-0x0000025BFC9F0000-memory.dmp

Download

memory/4472-139-0x0000025BFC9E0000-0x0000025BFC9F0000-memory.dmp

Download

memory/4472-146-0x0000025BFA7B0000-0x0000025BFA7BC000-memory.dmp

Download

memory/4472-145-0x0000025BFC9E0000-0x0000025BFC9F0000-memory.dmp

Download