hxxps://cdn[.]discordapp[.]com/attachments/1503499765390770290/1503520940653281280/RAK90DH[.]zip?ex=6a03a67e&is=6a0254fe&hm=f7fc3596e4039165ff1b148660502ee3f32858ccc2f29d58d079c0493ebe883f&

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/05/2026, 22:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cdn.discordapp.com/attachments/1503499765390770290/1503520940653281280/RAK90DH.zip?ex=6a03a67e&is=6a0254fe&hm=f7fc3596e4039165ff1b148660502ee3f32858ccc2f29d58d079c0493ebe883f&
Sample260511-19yp2abs3t

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
90	discord.com
93	discord.com
100	raw.githubusercontent.com
101	raw.githubusercontent.com
102	raw.githubusercontent.com
89	discord.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2408_163456051\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2408_324686214\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2408_324686214\protocols.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2408_2108181268\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2408_2108181268\nav_config.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1944	msedge.exe
4312	msedge.exe
5584	msedge.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134230117363198087"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2023547815-1162023398-1465618254-1000\{0D9CB328-723B-4181-B92A-4C18482C6399}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2023547815-1162023398-1465618254-1000\{0677C3C9-1720-4948-81CC-FE5C53A4A04D}	msedge.exe

Suspicious behavior: EnumeratesProcesses 27 IoCs

pid	Process
3424	Xeno.exe
3424	Xeno.exe
2408	msedge.exe
2408	msedge.exe
5580	taskmgr.exe
5580	taskmgr.exe
5580	taskmgr.exe
5580	taskmgr.exe
5580	taskmgr.exe
5580	taskmgr.exe
5580	taskmgr.exe
5580	taskmgr.exe
5580	taskmgr.exe
5580	taskmgr.exe
5580	taskmgr.exe
5580	taskmgr.exe
5580	taskmgr.exe
5580	taskmgr.exe
5580	taskmgr.exe
5580	taskmgr.exe
5580	taskmgr.exe
5580	taskmgr.exe
5580	taskmgr.exe
5580	taskmgr.exe
5580	taskmgr.exe
5580	taskmgr.exe
5580	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
4412	msedge.exe
4412	msedge.exe
416	msedgewebview2.exe
4412	msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	3424	Xeno.exe
Token: SeDebugPrivilege	5580	taskmgr.exe
Token: SeSystemProfilePrivilege	5580	taskmgr.exe
Token: SeCreateGlobalPrivilege	5580	taskmgr.exe
Token: 33	5580	taskmgr.exe
Token: SeIncBasePriorityPrivilege	5580	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 3856	1632	msedge.exe	86
PID 1632 wrote to memory of 1944	1632	msedge.exe	87
PID 1632 wrote to memory of 4552	1632	msedge.exe	88
PID 1632 wrote to memory of 4552	1632	msedge.exe	88
PID 1632 wrote to memory of 4552	1632	msedge.exe	88
PID 1632 wrote to memory of 1504	1632	msedge.exe	90
PID 1632 wrote to memory of 1504	1632	msedge.exe	90
PID 1632 wrote to memory of 2192	1632	msedge.exe	91
PID 1632 wrote to memory of 2192	1632	msedge.exe	91
PID 1632 wrote to memory of 2192	1632	msedge.exe	91
PID 1632 wrote to memory of 2216	1632	msedge.exe	92
PID 1632 wrote to memory of 2216	1632	msedge.exe	92
PID 1632 wrote to memory of 2216	1632	msedge.exe	92
PID 1632 wrote to memory of 3536	1632	msedge.exe	93
PID 1632 wrote to memory of 4460	1632	msedge.exe	94
PID 1632 wrote to memory of 3536	1632	msedge.exe	93
PID 1632 wrote to memory of 3536	1632	msedge.exe	93
PID 1632 wrote to memory of 4460	1632	msedge.exe	94
PID 1632 wrote to memory of 4460	1632	msedge.exe	94
PID 1632 wrote to memory of 1840	1632	msedge.exe	97
PID 1632 wrote to memory of 1840	1632	msedge.exe	97
PID 1632 wrote to memory of 1772	1632	msedge.exe	98
PID 1632 wrote to memory of 4908	1632	msedge.exe	99
PID 1632 wrote to memory of 1772	1632	msedge.exe	98
PID 1632 wrote to memory of 4908	1632	msedge.exe	99
PID 1632 wrote to memory of 1288	1632	msedge.exe	100
PID 1632 wrote to memory of 1288	1632	msedge.exe	100
PID 1632 wrote to memory of 1032	1632	msedge.exe	101
PID 1632 wrote to memory of 1032	1632	msedge.exe	101
PID 1632 wrote to memory of 1032	1632	msedge.exe	101
PID 1632 wrote to memory of 3052	1632	msedge.exe	102
PID 1632 wrote to memory of 3052	1632	msedge.exe	102
PID 1632 wrote to memory of 1044	1632	msedge.exe	103
PID 1632 wrote to memory of 4952	1632	msedge.exe	107
PID 3424 wrote to memory of 3536	3424	Xeno.exe	129
PID 3536 wrote to memory of 4412	3536	msedge.exe	130
PID 3424 wrote to memory of 416	3424	Xeno.exe	131
PID 416 wrote to memory of 1296	416	msedgewebview2.exe	132
PID 4412 wrote to memory of 4588	4412	msedge.exe	134
PID 4412 wrote to memory of 4312	4412	msedge.exe	135
PID 4412 wrote to memory of 3304	4412	msedge.exe	136
PID 4412 wrote to memory of 3304	4412	msedge.exe	136
PID 4412 wrote to memory of 396	4412	msedge.exe	137
PID 4412 wrote to memory of 396	4412	msedge.exe	137
PID 4412 wrote to memory of 396	4412	msedge.exe	137
PID 4412 wrote to memory of 4380	4412	msedge.exe	138
PID 4412 wrote to memory of 1252	4412	msedge.exe	139
PID 4412 wrote to memory of 4380	4412	msedge.exe	138
PID 4412 wrote to memory of 4380	4412	msedge.exe	138
PID 4412 wrote to memory of 1252	4412	msedge.exe	139
PID 4412 wrote to memory of 1252	4412	msedge.exe	139
PID 416 wrote to memory of 3548	416	msedgewebview2.exe	142
PID 416 wrote to memory of 3548	416	msedgewebview2.exe	142
PID 416 wrote to memory of 3548	416	msedgewebview2.exe	142
PID 416 wrote to memory of 456	416	msedgewebview2.exe	143
PID 416 wrote to memory of 5160	416	msedgewebview2.exe	144
PID 416 wrote to memory of 5160	416	msedgewebview2.exe	144
PID 4412 wrote to memory of 5456	4412	msedge.exe	145
PID 4412 wrote to memory of 5456	4412	msedge.exe	145
PID 416 wrote to memory of 5700	416	msedgewebview2.exe	146
PID 416 wrote to memory of 5700	416	msedgewebview2.exe	146
PID 416 wrote to memory of 5700	416	msedgewebview2.exe	146
PID 4412 wrote to memory of 6140	4412	msedge.exe	147
PID 4412 wrote to memory of 6140	4412	msedge.exe	147

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1503499765390770290/1503520940653281280/RAK90DH.zip?ex=6a03a67e&is=6a0254fe&hm=f7fc3596e4039165ff1b148660502ee3f32858ccc2f29d58d079c0493ebe883f&
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f0,0x7ffe948cc188,0x7ffe948cc194,0x7ffe948cc1a0
  2⤵
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1872,i,17419223944278820134,107052066931680996,524288 --field-trial-handle=2256,i,14497619187969142108,10855124881338907619,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1660,i,7043843383714749403,2997871452106479777,262144 --field-trial-handle=2256,i,14497619187969142108,10855124881338907619,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:2
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2396,i,4085015807244767807,11832645038014912641,524288 --field-trial-handle=2256,i,14497619187969142108,10855124881338907619,262144 --variations-seed-version --mojo-platform-channel-handle=2548 /prefetch:8
  2⤵
  PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,17616501496723914728,5568798871540283780,2097152 --field-trial-handle=2256,i,14497619187969142108,10855124881338907619,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:2192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,671151451318310743,10912582757029859159,2097152 --field-trial-handle=2256,i,14497619187969142108,10855124881338907619,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4144,i,17292114591209802853,3970674877637225639,2097152 --field-trial-handle=2256,i,14497619187969142108,10855124881338907619,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:1
  2⤵
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4272,i,3284650812562637643,5772836639094058095,2097152 --field-trial-handle=2256,i,14497619187969142108,10855124881338907619,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:2
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5076,i,14272225098792988445,15749066095590531894,524288 --field-trial-handle=2256,i,14497619187969142108,10855124881338907619,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:8
  2⤵
  PID:1840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5296,i,3244594273767590244,1096647606320545626,524288 --field-trial-handle=2256,i,14497619187969142108,10855124881338907619,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:8
  2⤵
  PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5304,i,3813739185036190825,5711593796533807539,524288 --field-trial-handle=2256,i,14497619187969142108,10855124881338907619,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:8
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5956,i,862570371371413786,15282667845802924815,524288 --field-trial-handle=2256,i,14497619187969142108,10855124881338907619,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:8
  2⤵
  PID:1288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6004,i,11148473047396926203,12535360218543596887,2097152 --field-trial-handle=2256,i,14497619187969142108,10855124881338907619,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:1
  2⤵
  PID:1032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5812,i,3577086886162551928,16975245919044409927,524288 --field-trial-handle=2256,i,14497619187969142108,10855124881338907619,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:8
  2⤵
  PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6628,i,896704239265658568,4370781066104807669,524288 --field-trial-handle=2256,i,14497619187969142108,10855124881338907619,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:8
  2⤵
  PID:1044
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5232,i,9189528832197716573,3260469543766136913,524288 --field-trial-handle=2256,i,14497619187969142108,10855124881338907619,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:8
  2⤵
  PID:3860
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5232,i,9189528832197716573,3260469543766136913,524288 --field-trial-handle=2256,i,14497619187969142108,10855124881338907619,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:8
  2⤵
  PID:4952

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4216

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4292

C:\Users\Admin\Downloads\$RAK90DH\Xeno-v1.3.30\Xeno.exe
"C:\Users\Admin\Downloads\$RAK90DH\Xeno-v1.3.30\Xeno.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/xe-no
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://discord.gg/xe-no
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:4412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x25c,0x7ffe948cc188,0x7ffe948cc194,0x7ffe948cc1a0
      4⤵
      PID:4588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1796,i,17888838197218128914,16439594679941260009,524288 --field-trial-handle=2244,i,10180195214269538004,9455714387663333548,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:3
      4⤵
      System Time Discovery
      PID:4312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2288,i,4460217260381847301,7218457354131818788,524288 --field-trial-handle=2244,i,10180195214269538004,9455714387663333548,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:8
      4⤵
      PID:3304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,2758268416330591557,6125341816960908853,262144 --field-trial-handle=2244,i,10180195214269538004,9455714387663333548,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:2
      4⤵
      PID:396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3352,i,4849104173865651189,9158171461088168225,2097152 --field-trial-handle=2244,i,10180195214269538004,9455714387663333548,262144 --variations-seed-version --mojo-platform-channel-handle=3428 /prefetch:1
      4⤵
      PID:4380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3356,i,17508238767645883101,2001525944092516161,2097152 --field-trial-handle=2244,i,10180195214269538004,9455714387663333548,262144 --variations-seed-version --mojo-platform-channel-handle=3432 /prefetch:1
      4⤵
      PID:1252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4800,i,9268017397735105887,5397054212100579607,524288 --field-trial-handle=2244,i,10180195214269538004,9455714387663333548,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:8
      4⤵
      PID:5456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5080,i,12475628987889876695,13459898230521908188,2097152 --field-trial-handle=2244,i,10180195214269538004,9455714387663333548,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:1
      4⤵
      PID:6140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
      4⤵
      Drops file in Program Files directory
      Checks processor information in registry
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      PID:2408
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2e4,0x7ffe948cc188,0x7ffe948cc194,0x7ffe948cc1a0
        5⤵
        
        PID:1564
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1980,i,6942470337514195000,1861656503964275364,524288 --field-trial-handle=2280,i,15411008350825920903,249481545361978588,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:3
        5⤵
        System Time Discovery
        
        PID:5584
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1888,i,6873630787021760658,16826661515369741515,262144 --field-trial-handle=2280,i,15411008350825920903,249481545361978588,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:2
        5⤵
        
        PID:5380
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2348,i,8236545648633180970,18138553478643319892,524288 --field-trial-handle=2280,i,15411008350825920903,249481545361978588,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:8
        5⤵
        
        PID:552
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4444,i,5992568868045279261,12055863626720880214,524288 --field-trial-handle=2280,i,15411008350825920903,249481545361978588,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:8
        5⤵
        
        PID:5988
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4444,i,5992568868045279261,12055863626720880214,524288 --field-trial-handle=2280,i,15411008350825920903,249481545361978588,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:8
        5⤵
        
        PID:6000
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4508,i,12965402215669778160,9504082178148459519,524288 --field-trial-handle=2280,i,15411008350825920903,249481545361978588,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:8
        5⤵
        
        PID:6012
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4512,i,2235992409004946590,4463651404827130602,524288 --field-trial-handle=2280,i,15411008350825920903,249481545361978588,262144 --variations-seed-version --mojo-platform-channel-handle=4720 /prefetch:8
        5⤵
        
        PID:4724
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4588,i,14755696038755222374,15154948822039256522,524288 --field-trial-handle=2280,i,15411008350825920903,249481545361978588,262144 --variations-seed-version --mojo-platform-channel-handle=4580 /prefetch:8
        5⤵
        
        PID:576
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4652,i,4676337465736616893,17596725439627229137,524288 --field-trial-handle=2280,i,15411008350825920903,249481545361978588,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:8
        5⤵
        
        PID:5948
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4936,i,15353354970803176258,5812740347183133220,524288 --field-trial-handle=2280,i,15411008350825920903,249481545361978588,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:8
        5⤵
        
        PID:3572
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5064,i,4371009793058172677,9377307424290426020,524288 --field-trial-handle=2280,i,15411008350825920903,249481545361978588,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:8
        5⤵
        
        PID:1848
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4572,i,15626624870172065887,9555108416688672195,524288 --field-trial-handle=2280,i,15411008350825920903,249481545361978588,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:8
        5⤵
        
        PID:3132
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4576,i,6640841047369428950,17532627054797786537,524288 --field-trial-handle=2280,i,15411008350825920903,249481545361978588,262144 --variations-seed-version --mojo-platform-channel-handle=4564 /prefetch:8
        5⤵
        
        PID:5484
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4568,i,11662125655412888929,4667200897753340712,524288 --field-trial-handle=2280,i,15411008350825920903,249481545361978588,262144 --variations-seed-version --mojo-platform-channel-handle=4620 /prefetch:8
        5⤵
        
        PID:6000
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4892,i,14539293022682951799,7959905786120066369,524288 --field-trial-handle=2280,i,15411008350825920903,249481545361978588,262144 --variations-seed-version --mojo-platform-channel-handle=4852 /prefetch:8
        5⤵
        
        PID:1488
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4956,i,16954193057216221658,17670291587195689897,524288 --field-trial-handle=2280,i,15411008350825920903,249481545361978588,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:8
        5⤵
        
        PID:5908
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=752,i,13524727654269216476,17589961197572665193,524288 --field-trial-handle=2280,i,15411008350825920903,249481545361978588,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:8
        5⤵
        
        PID:576
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Xeno.exe --webview-exe-version=1.3.30+87ae4f96f8a0927052c1120167982fb069afd1b4 --user-data-dir="C:\Users\Admin\Downloads\$RAK90DH\Xeno-v1.3.30\Xeno.exe.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --mojo-named-platform-channel-pipe=3424.3412.1364466578898444518
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:416
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\Downloads\$RAK90DH\Xeno-v1.3.30\Xeno.exe.WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\Downloads\$RAK90DH\Xeno-v1.3.30\Xeno.exe.WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x178,0x17c,0x180,0x154,0x188,0x7ffe88abb078,0x7ffe88abb084,0x7ffe88abb090
    3⤵
    PID:1296
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\$RAK90DH\Xeno-v1.3.30\Xeno.exe.WebView2\EBWebView" --webview-exe-name=Xeno.exe --webview-exe-version=1.3.30+87ae4f96f8a0927052c1120167982fb069afd1b4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1720,i,18036897284522528795,224939193421640379,262144 --variations-seed-version --mojo-platform-channel-handle=1716 /prefetch:2
    3⤵
    PID:3548
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\$RAK90DH\Xeno-v1.3.30\Xeno.exe.WebView2\EBWebView" --webview-exe-name=Xeno.exe --webview-exe-version=1.3.30+87ae4f96f8a0927052c1120167982fb069afd1b4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2024,i,18036897284522528795,224939193421640379,262144 --variations-seed-version --mojo-platform-channel-handle=2036 /prefetch:3
    3⤵
    PID:456
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\$RAK90DH\Xeno-v1.3.30\Xeno.exe.WebView2\EBWebView" --webview-exe-name=Xeno.exe --webview-exe-version=1.3.30+87ae4f96f8a0927052c1120167982fb069afd1b4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2208,i,18036897284522528795,224939193421640379,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:8
    3⤵
    PID:5160
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\$RAK90DH\Xeno-v1.3.30\Xeno.exe.WebView2\EBWebView" --webview-exe-name=Xeno.exe --webview-exe-version=1.3.30+87ae4f96f8a0927052c1120167982fb069afd1b4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3516,i,18036897284522528795,224939193421640379,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
    3⤵
    PID:5700

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3912

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5248

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5596

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5580

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2408_163456051\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2408_2108181268\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2408_324686214\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
TLSH
T158C04C668D51DEAB00A747A56B295315E23B4B4B5044800A7AF5429C1A288964171944
MD5 SHA1 SHA512 TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
Size 3KB
SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
MD5 1de85fec2dfcc28011a7c2aaab95eb5f
SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
TLSH
T1D1611DB79A3048090E3412B86B19B35DF63E029F1AD598EB76BE568F1F710F7245C54C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2750848cdf8b155b772b2859a370c76029a75331f88a1bf4640cd86dd6641dbb
MD5 c5adc2c06b75dd899d8626726afbf36e
SHA1 195876d7989e157e40ff30bb80c1ac9cb47086fa
SHA512 d74a0df4bf764d0a066eff2c6a21464c730574036ce5f5b4a5d3247ea38ac01af3559f27854fbcabe9fd34e1753e7cd903c7d49c411c09772c6097933f7c3f2b
TLSH
T1D9D0A73039AAA871D01A10728D1172963A1986827C835572A026509D8C6A46467D4687
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2118f3debea8e2640977d8aaf949f09ebd1208d30ba20757560f958087279634
MD5 8d9c606cac641db39043b73620b9af30
SHA1 5641a30c54a84af71f1a3aab03ca11b81a4d3457
SHA512 e3db3c84d1a85989aeb2ab3f1c4235705e72fc3ef797e27988b927948b985b91f9a11ed453d521868095f672866c1590fad569dfc486201d39a6df77306d4a6d
TLSH
T13ED0C04810711C30D09D90734C4977873408C9538C4357321073386C0C030601685187
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cfc4c99d69f9c52f58f7b726679719d676ddcd16278ca035077150db6634776d
MD5 65ff856c4917f9b96c253c03e99f6d76
SHA1 33749e2ead8c955507fabd4fb311329c1134d9e7
SHA512 ef547f806295f75c6c7d6f49f2137cb9762980edeb83507dc0bd2b0cce6bae384033066b27891fcc52eec7c4840944e4e10bf9896a83850e2457249af7d58fc0
TLSH
T11ED0A73039AAA871D01A1072CD1172963A1986C67C835572A02A509D8C6A46467D4687
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5cc77a69e2933d0235ac8a539206200c479816f5bda04a32fda5a396eed16f10
MD5 1c0c83b8e90dc2addc52496554af3ff3
SHA1 d51d2e4f19bae4673952b8a9a969fbf594f3b774
SHA512 8953275d791ff6c9f0be1af08ed082a774a4afed8467fd458e4c175381ed8191baebfe40ebe8844eaf7a7054a60441da2d5759499d2bd067a8d0315d8593071f
TLSH
T1F3D0C04810B11C30D49D90734C4877873408C9538C4397331073386C0C030A01685187
MD5 SHA1 SHA512 TLSH

Submit Download

6166b5a9-6ef4-4a35-85fd-fe4256ac2c62.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6166b5a9-6ef4-4a35-85fd-fe4256ac2c62.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

6485f58b-d28f-4ec2-8f38-aea851353023.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6485f58b-d28f-4ec2-8f38-aea851353023.tmp
Size 30KB
SHA256 1ca0c5a190a703a9472f3d17ee38a52e7f429cdde424d1870b567e8eb25300e2
MD5 93224b6d0549e5f9126077a951aae9dd
SHA1 0b17f93d6501be0d6c295dcd0b815f0bb41e1342
SHA512 07e376e0af06a9cfadbcf322ea5ff34809f9400d4168d3ee04121efb89fab7ae2f56ced6c30c330c11cca5c35561bc1cfdab0a56c6cac3d5505db4adc2814b90
SSDEEP 768:2gU2JunWvB3u/8F1+UoAYDCx9Tuqh0VfUC9xbog/OVHsLl4CpRVronf:2gU2JunWvB3u/u1jaAsLiaRunf
TLSH
T163E21A3B284CCB7E4F804E9CEC2AAF966DD801CBA6944D5447FA884C03C67EF55265DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 f9193b2101c8943427fc90a802549d8979dc6492b80916b3a42fb8e1c9b99dfa
MD5 b48c2d13f607f0cdd0792b6a6a584cfc
SHA1 8c059bcfec8103a4d4f4bbe5f1852af86ea8c5cb
SHA512 30c7b63f979c7dda0f00545dc623c74b0f17b8fdd678c29eeae4e7c248caf587a81a63fa7537e1776f9585103abc5aace790a0f458c56e451206287d394762cb
SSDEEP 384:CddhlvWuhUoQaZkAwzYBAopLl770fZrMqtiBmBAJhk0xUJTt:MlvWu2oQaZkARBVuBr/iBmBAJ1WJ
TLSH
T1701371BE721C1C56D6C70EBC4C9B2E316338DB28E9D266E37331B01196197D67D1EA82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 2e082ab8d4d71ab744ed2ace60f9689d63822f0554c0b7be8876dafa6ac0e1f3
MD5 83c4b4d8e20cafc4fa59fd191a38a403
SHA1 846f7cf05d58aa45a84d83a9151ca5925cac0a1e
SHA512 253d6a7671a626b9c4fce117668709420235ae8bf8c5c7efde7e411ea9a8acf82c9a9cbc3f2f62fd199d3c37254e2b6ef73c452769058e5842db2c1fe989f0f0
SSDEEP 1536:dkUgiQXtWujhkyIl9QObMf9GMcjEdbDkHALt3TzLw6O:GhCjMzRFTzLp
TLSH
T169445EF74955A01BCFA802F5E2033E2DD17B415D6CE1F8E9E63C0C952825B22B6BDB94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 eb318e1415aad1b7f55807408a981b59308187627f5f4bdb9b723297373ccf23
MD5 4fe74a129f76f8b724ef277af9adad01
SHA1 ea03872e911b1df3c04d7675436ec8c61fa44044
SHA512 4ce98a00cb5a99c786f9765fb2c3ad4d7c4d1b699edbe573ab44782a88532b33a57837b4a887ac787e1867a3f6a93c4c1fc4a43de45ecf91617ac2724cfd8d53
SSDEEP 3072:Fr5mnqmiHVGONdlRsFP2HC0eWrY1j/LLurMz+:Z57muGOBRsIC0eoQj/KMz
TLSH
T156255BEE8F382C87DD6B4D70B4E0EC22BCB412937516E1D34818C990979A3C6679B6DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 8.0MB
SHA256 893daca0572b37eea27003faa5abe0ff54bf0713219eee80ac242c5446053efe
MD5 ff4e7ae3e78cdab9f51480f587343070
SHA1 69fd2fdcd7e352c4c4bf5babd3ac4d650fa5ec74
SHA512 3647bb4777ce1f6005a3107c38411db5d7e906cac0cbaf1ce56a0957b8768818c1df35cc1fb4b63e0a11774c9e5a20e3358a4aea1597bbad1c0e522be4bcb76c
SSDEEP 49152:UOYPRrWFgHPBsylDRQe9miXFNUmFBasMN:fYCFgv6yQu3aB
TLSH
T1AB867EEEC6785C83CE678A70B4E0EC477C7412C3F595C1D38958C59402A77C5BAEA2AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 57193d21dc027a31be8f8c910eb8a76ecd1ca30561effb6abde917f9119e4b0a
MD5 e81dec96d4fe4d247e1e4a4c32933f89
SHA1 b1c34794fa6b662c5b251b039bdf4bbfb109c804
SHA512 e84a3714bfb98139c8a488762ee70aba0b9b74ab877ce2e3fdea8a22e1fa714aedf1b026ad04d99ad56909a7571547444720972981ca9fb63e69ce3f1dd0dfcb
TLSH
T1E9717F4061409E34FBE903BFE6D518C6B270D75A0A0B1E173DF299BC5E52F2120E4BB8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 b759e5101ce4034e008366a2769e57070c6898abad3249ed3641001c29515970
MD5 6fa5eb27fc7b7e177fe65a04fe6781fa
SHA1 1b073654b95f45c3b291126a53f90279f55799db
SHA512 89c6846b1b92d8d84b556a977fed1555ab73daf0fe7ae6ec986e8d55c80ecf74694be62dfdfef6b47899c05d3d44ab40b54ff28c7d072bea8c94ca303aa71c59
TLSH
T1606129406190AE38FBEA03BFE6D920C2B674D75A420B1E573EF1597C9E22F2101D4B70
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58361e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58361e.TMP
Size 3KB
SHA256 19de96d8ceb46cddd9ad6d380250ec0d99c0716a2358a672998c725e2d884051
MD5 eb39a9826bff0e385d89bcf5093f1ae7
SHA1 1b4231c95fac9066211a9d53fefb356a31ca843f
SHA512 c05584f599e168f38cde1a1188e03dea2cbd46462f53183308215bbe58fc0b3024d00cc03aa1cc8026258b1d6b8680bdeaba9cafe08dfa636d4763c9803e1b17
TLSH
T17F61294461909E38FBEA07BFE6D910C6B674D75A020B1E573EF1597C9E22F2111D4B70
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 741B
SHA256 9b997acc7c88838d57b0c2471326a74947d58166568e3b4aa7946a4f24bf7ff5
MD5 0b0a9c73fc7c9b071290f7f9ef3a2c56
SHA1 d9bd125eec41252658f662a2f320f37576b1f093
SHA512 d334bd714a0dc22be924e9d777f7a2b31fec6f98e009c4ef22049944c5ff16fde3428ea13a759f597d43736755732dbb10684bba533b7f69cd6587905db023c0
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 ec5fe095669add2e6013ed5cf9e38f5df4836f6642eac396234685100d337faa
MD5 b08d1e992a7a2bd3c74d4344cf4f8747
SHA1 79687598c263b57fba79c030d8e6c570d7433d9b
SHA512 d21141c561c76a54b5a3a8e4ca3d5ba03d144b20de7304e869acbdafbe0175affdc7e5d3594a16abfa65b5ada22f3295f5f0fee657d62c38f46ffc402c904f42
TLSH
T14DE0260405CAC229B154ADD3837C7748C7D8348EA2AC3DC6178CCC406181A42B3AF7D4
MD5 SHA1 SHA512 TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 0896a0d40e2ed607d80f66cb902807604e87868b7933b983b48c945e9e9889c4
MD5 be7d0f79a096b45ff64e8c78c9252eec
SHA1 9bf7e572f7243bf67907804bb085d02db5241fbd
SHA512 d7369c6fde7a2eb051652e1e51e0b3b909a99782d7d12c486fa0a1105bf362ce4bdeb0c50d7b199abe9cb138a0a84cf231598ec62ca2bc9c542186194d403f25
SSDEEP 192:nUpndMNpnd9f+G83uy3Ct7XBBKjH7DXspU3i:nUpnmNpnD/83uICtTBBc7DXspU3i
TLSH
T1CA14201E4F243721CDBD917629EB44A35D6CF03F8B5366CA686114B4CEE3652A06C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 5e0683b056be38b638ed9337f570e6cd2f823b8c25d77d2a0d885b433012ba13
MD5 4d2e61e0160c42a2e260fdc096192d49
SHA1 fc0d3190ed5c6fb321c152f44619267fba1f1330
SHA512 139f59b0a65102f5a3100e6e808ed1f1b858287004eca40a3f7c6145b79526edb9310813c801e2b33224396b55f93fee2649c970bb10abc1782bb1d3fe8bc7ff
TLSH
T152E0D86145DEC259616464CB43386B08CBE5384ED69C3F862B05DD86B041444B79E6D5
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 20KB
SHA256 5bba7db27721e455aef59dd6e63992ff97b9bf29d027a967ff2975d70b251c04
MD5 a519444b0d24727ff8f5ff615586e9b3
SHA1 8bf7cf5523baebca5d2167595c97a07869373e6e
SHA512 bca4b1f74b32855b4326831c4b79852febf42ef9c645e4b26fcfc873eb7e3dbdaa392af02757ddad7793c7ecd29e6d29c2fcc27ff2fae7bd41c1c9e7b6e5290d
SSDEEP 48:TtLopFMatSaw/auUOt8BM+oB1FfNtd1Hht+omwrKqJh5HczPwH:9eMatUaAKadJh0UDJ7HYA
TLSH
T146925F4E0F242112E1B5AF36DED484AB2E7C102DC373A99D9D5460B3CDE369BF5024A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 e8fbd79522a79a4d59b25be65e8cab5abd3a51ae27894ccd8496d77600124347
MD5 9c14d76cf37cd07380dbadf521db642f
SHA1 e43c1ea60abf560c928aa7e7a0bb017e95b6fc8f
SHA512 aeb026480b406e35300778f710b376cd0aea3c6ed92b69d85581f67ad4b5f6e1a5d5739f3b3d704b1ad98fe219506a3041293dd7093c38209277b6e0383b406f
TLSH
T10851AAF7C3E8866D8A1146F4AA186E2FCE2D0954432C3C5AC8E4AF1F97E2461E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 cd74c9783461b586abd111c349d89fb89f72c054d1cab29ee466a77750671dd5
MD5 e258beb2653cd6d670f55dab2c7b1896
SHA1 4af7163c5b90043ed62529a12640b8d9fe2aac16
SHA512 e63f84b5b68c997d6222f779416372af74cc59eac045b47f6df70a8dc3e5babf7c0d1a2ca39cd5a291ba728a2d819f108424d7a0826c3bd2cee2ec99520bc18c
TLSH
T18B3199F7C3E4896D8A1146F4BA186F1FCE2D0515432C3C5B89E4AE1BA3E3471E14095F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 1067901de13e01360e779e79cee7ec4320bc73282e2d69088bc1cacbfa2eb5db
MD5 5a891dd878b8741017e2f2795cbb4613
SHA1 e14304be57ed1a058bad0af88f91faa797223b33
SHA512 b3de83c6e7534fc3455e17f93008c1261c2dc5377c39b1da1bb99a245e59024223bad4b9bcc3fad6f73cd0bf7a7b2a75d0c6079e9bdf66cf528bd491231e24fc
TLSH
T1F74199F783E4896D8A1146F4AA192E1F8E2D0914432C3C6B89E4AE1FA7E2461E14098F
MD5 SHA1 SHA512 TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL
Size 36KB
SHA256 72cff78542b23a6aa9ca42902bc20a81f2ccaaa1b8219df1edc6b91b69f04aa1
MD5 4318a725a4c09bc7901fa1e84d43b75f
SHA1 0f80e526018acf5d7b077178865697d8d964b1e2
SHA512 dc9dfc864dba5e04b35a8c2d9b2ceae99adc6910410d50b32db04d51ea06e911f302d3bb18ec463dd6aa92cbe77c640d3820f7fa097776ee89fb469d0139d159
SSDEEP 96:eIEumQv8m1ccnvS6EJdfsrSBkf9yuSB0+nF58w7J4g:eIEumQv8m1ccnvS6E7fj0gn
TLSH
T179F2E1FB07236106D95844B0A500AB8EAF16014B47B6B6ED76C447E3F3A31E2B1B5B86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 355B
SHA256 e4bc0eabcc7c4d54956ba5fda3143a1b19bda01d1dfe13bfa9ed8fc806ba40af
MD5 1978cdf9f2f4154c436ec063c409c6e2
SHA1 399cd4e72ffbaf4dca6606da0d4cc2f50236d130
SHA512 cb38703fbe8b23c70d4bec947f851a80709c6382ae6cc3bd7234f3235388e4d1a6bdedcc58ba394560e4910728d978ab9cb4ba9e087ff7877b93c4e89655e8a7
TLSH
T1CDE0C0A3C1B9F03730390D3E8C44B40EA576E5340156A0F1C978823CB1C04F35F0642B
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 9e7bd7a5cb69d077ac91a6a8f5440249c181670dc5c3de23381db79614ab0a44
MD5 3a637614f6c51a36cadd9c23e983cf2b
SHA1 4414f5a1f020a1d963a47d21f4843d7b3bd3c1b7
SHA512 3c75c91ea11aa09115e9d49323b75d1b22f6a687f4a08c6ff33476a50677cf5139aadf987ab7fccfc215b1eceb1ae4d972ba057e8f45df5365a7a28bc18bcec5
SSDEEP 192:sxZHR9yM//K1Ml8c9e/fNsKDWpVZjn71X6ZEdpJHW6+WNGYBkmMW7LIgEJ:sxZHJHe/fNsWWvZj71X6SJHbGovI
TLSH
T15D52E8126A34597BCCDBD20DFA557F53D7F90473A2900E44AAFC8A1C05E6AEC621782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 d102d5601b840a197881669cef3ea247f59c8c221832788fe703232545536385
MD5 f4467179000c53627b38f636a45ddc15
SHA1 036e04156bf6691c8b4104e025cb5af71720a9ea
SHA512 33f3516564bb9158824044e70c508cd896f72a13857c84622afabf45a58827556f38a6be024fd21c4255247e65d2d2eb83227cffa012329c21e82cbb3f383fef
SSDEEP 192:sxZHR9yM//K1hl8u9e/fNs6WpVzjqOX6ZzkdpESHW6+WNeSfJO/YBsVZW2LIgEJ:sxZHeZe/fNs6WvzjqOX6yHHbno/ioI
TLSH
T14852D9076A34597BCCDFD609FA517F63D7F9056392900E449AFC8A1C04E6AEC621382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 48884d16f6292e05acdd74e50df14a44288828cbf0689b60ebd22b2e30cb23f2
MD5 e4cb48826599588243510c4491abdf6e
SHA1 2d6659bf4e5e7fde7b1ad70d2411225d6a4713f7
SHA512 142ece703431500030d15ea8bd3f425da23b251209efb843e42263ccca1125a8c97e99e9a3b8a5ef78a0698feac3ec668586a0d2794073c96a8666eef6fa147e
TLSH
T197E0261006EAC37D705562C3C334C70CC3EC744BD2FC3E826F88CE80A542509B2AEAA0
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log
Size 716B
SHA256 57f856cc55aad562ee6c5455ef78daa186308b8dc2e380683d195872d6cc0fed
MD5 07dcc027affd218e72bd2aab097f7ff8
SHA1 003b0f599d6146430b2d66e8f80a9058ed588e36
SHA512 31e4641a04a51f75bb390723d2b1e1a92ab341d70659776d9b14b0236b2347e7fd2ef355b7980889250a9a9be12112dfcbc322cd559cced71e1a59fba561a9d7
TLSH
T10501D1E70E1894A8DE9D82B0289973F4D327558C4AC98ACA97CD124729426327926D17
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG
Size 319B
SHA256 15bfebe18aa74caf435f92331494fe15c2ed8f11c841fbbd4ae8098fcc2a3e8f
MD5 943242ae6d49545faafd9abb456db236
SHA1 686ccdb7de3d2b33f7a35acf7eb765780398e96d
SHA512 b01c9e321dccb9417f769e8ddaf9f99715a3195ef2918fc3cb1b846f1b756e8d159da1595756c393ebe45259e1e4e103fb83363166350b9b457fa612fa216b94
TLSH
T171E0806405E5C6797164A8D70375770CC7E53446E7AC2E812705C8816141545B79E9A5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 e4538121419507395469944a5e7cd6b057b75cae23cc7e0d3e16e229ab59a3ed
MD5 1cb1670a76f6fa37e7293cf42638c60b
SHA1 a9b6c5396795b4ebcde78a41711950d240c9e006
SHA512 7286e4ef1f2f84ae141ec59aab8d289e2725ba745c3fd76749585128ab69917437696762976b9f75394d93e4341c4db5b8f4b344ad14ca9ae81b64bd82b5db6c
TLSH
T1FEE0686811CEC72A318460CB1338D70CC3E63006D7EC6E813B0AD940A30A280735F644
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 3f619de2f60aef8175a8ac73df183c82a204af9449b590536814ac4f4af0e9c2
MD5 a14d402efbec022c3ac5638acb845d14
SHA1 4f4611f13ecce716e326ec25a5b47c13af85195c
SHA512 bf8e47618925b44c62f67ad7087dd01a69d2ab8e6d4a2dbdb2e2ff53136d885447296c246f9da3fad55843f2c0e348721695da0b4693e2501ad3021ff123f08f
TLSH
T1C1E0267495EAC7396450E0C74374DB0CC2F8784BB3ED3EC2578AC880A501101B3BEAD0
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 3a89818c71ea695091633ea46bf102b2f1043faa421951f97529669797a2d02e
MD5 ef6c1aa690c1dc67c10baa14469e0d90
SHA1 07121dfb54c40689468e5ed1b1737ab51b221162
SHA512 16ef7d6e83cbf9938dc9ca30ced960880e36401195742b06328f3e19e51ea72b55bc93cf0f98a74a45bf04a3c24fb6cb3d45dbc18c89ac7d19a3a2b6a0b299d3
SSDEEP 96:K88gKFGNePSKgUBuv6KsAXYQKha+GFaKWQ2:KMhu1fD1r
TLSH
T1DAE10620727A43803A7E358985E5BB5F5AC2B1B33058A43B77BC50655F66E20DCFE4C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 2507c2a8993a8f0d2defc33984e457fc3191a1d477aa930da01cd836bf063395
MD5 582e9cb91d1ca4d2428e40162263dc09
SHA1 04902b0c0e73a4b48f22adf239533c84e3e13898
SHA512 424809ca36432f70b76978c33e115065b7d346d3f52b48f28249dc4f64fff7c515a819c73faf10432396bfe935aa6660e35401d73fe1e46843f6587ff0520cb1
SSDEEP 192:/+5WI/hfT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:W5tfQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T11824740A7B747001EDE6D9721CB080771E3CB16DCF22A6915DB654698DB2853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

afb393c2-1c5a-4db4-83d5-3a6409ad86ef.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\afb393c2-1c5a-4db4-83d5-3a6409ad86ef.tmp
Size 414B
SHA256 de9a65b2a23942e99815647891e60e02a249cea11862c0bb4ef641ad447ac593
MD5 de9736661972c436adf5d3720f22e089
SHA1 77c73efe5af91634627a813b500df10155254708
SHA512 9aac4471b056bf7e6d4a6d5a2f16ce76ae64efbd2c3fe1689d8306d7db3acba0915d5fee42a350d5fab60bca6283fa819d884b4968bbb399d017df26898f7f6b
TLSH
T1E6E02B66C925E9370DFD5B9C60605342E7C423572BC0554F363DC2098FB153A91D681C
MD5 SHA1 SHA512 TLSH

Submit Download

load_statistics.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db
Size 108KB
SHA256 260c0dee51ff7aead8178cc903b257b4c5ff6a5f91c37c718c43555d8f606da3
MD5 4181777b7ec07f6510365f16a370a327
SHA1 c600ab27b4f26c7c0dcb34f2850261b71b91b579
SHA512 f4e190e6c7692eb0c28994443b1c679bd702d84a6ed6cdfc5f2959c51149486290ccc9bc2dcea0eca023713e12dbf30bdc3326b305b959a3a1307610e61722ec
SSDEEP 768:JakmofUngROcdtRJMONvOA9pZrqEqXVftYfbSdMG959LtlToDR3P1zhfJ3pwhwBi:A0ZoMa59ColNmc+94KEY5R89+vYfNL
TLSH
T1DAB32FF76C09A1A7CDCD96B8C50BEE4480730626CA28D8E5A97C48C77779B033E759C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 15KB
SHA256 6f103b92d512560be17a0f4a4272e6433405e16f528a18c0be73e0187f7b583b
MD5 c02a7218a42ee3f353d7a8930e08e308
SHA1 edae678f64c47fa5bc99cf7212c51e11bc5bb8ff
SHA512 54e6f3683f11a784bbf35ce11e5ef78313ed731f5b3c7580dd5a55ab34301a3ed9c849655e4fb5bce9fd586d7ab8a2e50ab29d7c82e8a39ba672ec5ef39176f2
SSDEEP 384:HQvIIIebOMIMeBoSVskKs0pnKpn19pnKpn1XpnKpn1TpnKpn1z:HQy2kT0pKpnpKpJpKpZpKp9
TLSH
T1197272AE12152B77C28FAB7A139AC78206C98C854D61120D7114AD4F9DF2B2B87C63F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 f34cc02c518e06c611b6e6fb6a4ef09348066ddee6f40ffe4562f5d6bf4ef241
MD5 8f529878840c1e8eeaea923eaed0c6a6
SHA1 da7bc6dce3f5da6a9977d8da336fcc5b9f22d5e5
SHA512 7517d2bc86e596f17e1bd24c157463a60cc7f60195bf7d35f88237ba326223af61d5307242f739809bcebf10f613e8cb8280dddd8d5272f1fa8dd8d22b09fe2a
TLSH
T151E02690AECBCA6EB15465C712384F08C3C83C4BEAFC2DC63F40CC44A041501B3AEAD1
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 e067408561a4085306562a20c7a2bc2d3b833850779a9ea4749a2669fe0183e2
MD5 629fc47a128d15a2900efbb69ba1249e
SHA1 60bbb6302fc7bbf86eab79750bada66e7c05818c
SHA512 8c5aeb942c93454d8e8af0e4dedc37cedb89d9e33192886f0960f6b9c6094f9ef93c40dc48f086bde4361ce43c004395bb33504a854d1fa269f650fe94791f5d
TLSH
T142214526F330C249D149863A503E9B152338E856CFB8DC0F05B620352E77A051D4B2E2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 22a51d13fdd8b0fc6c132f9ae219cc0fe1ea83e48adb163386677c47abf573f8
MD5 567f34e02c9e43ec8c4529d6894cc0b3
SHA1 25e5bfc3dff2c7bac16616d9535808bb80e91825
SHA512 6c55add94080db669c97f93deae48a1a209c782ef1946a6b46bffa8f3b5d7a8ff7c383fc30efa9b36f2d41aa71132ce2b2df80b42c8cd2d2277102c821d0060f
TLSH
T129E020506DC7C65F615065C302788F48C3D93C47EAFC2EC13F40CD445141542735EAD1
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 214426bd6020a14537e8675e7649866f8b2a88970c6c85f3104d8a33ed859c5f
MD5 d3ea51fafc92011327bb61993d3af0de
SHA1 8dd9d4aaa17b15fa5b28bd4871e2da9406b02de8
SHA512 55f9a95a53662a7abfd80f2802716e706bd09950d7bc41d7c9aad4c1e588cc6dc7a07ae1660321ac4c69ef23f3c12cfbbe793f2fccba81527a03d4b452bc9ff6
SSDEEP 384:n8iFCCcmyWCi3sNd8TUNTUlIlMB50WNC7BDfct/j2s3usLQaqv8Au5ge/ipF7IgL:nF5cpi3CwgOBMOt/91LQaU5u5ge/ix
TLSH
T192B23932D855DDB7A8E797C1F706B6539EE000B789889D98D6ECAE1C10CB4FC070AC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 17KB
SHA256 ca5bb7792ef9307452585f30dec491ab5913e894ea3838b450f921da80edbd5e
MD5 242b395a2a4c77d641456fdb75440c86
SHA1 341ec76fb133c32ee6a7f8209aa16a8257edf30e
SHA512 693d294a86ffa69b0235bac41c837004e7b51e071bc7141fd0d988cffb311412f8bdf2b112db89819ba8bd155b7bdc74452969ce20475186d3265a9b71142249
SSDEEP 384:nTCcmyWCi3sNyMB50WNC7h/j2s3usLQQu/Kxx5pF7IgL:mcpi3KBMV/91LQQYax5x
TLSH
T100827D316C292C73D9ABAE0AF55B26135FF4607B86C41E14DADD8F1E00CA5AC271A933
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b2b39bd274bde99e50d8f5c655b001b9e69141955fa694fb73588110c0637d86
MD5 508d06103eeeeb2a951414a90cea80d4
SHA1 e532920c2b97975e6c93192006d81be15b5d1a05
SHA512 2df04a2eaed64735c414ac9edbcc61a227603a18dab15c5a9bd7da88427aad2bcf417373d0467505c26c8838ae3a613476f6323e47185f0f8ec2ac13979f4ed4
SSDEEP 192:tONS6xIQmiUymqM8R/j2wzMSus6slQCWH3MU6:tONS6a0MW/j2s3usLQl8U6
TLSH
T1E602F735A82DBCABDEB3AE45F68737275FD4103BA9552F48D6D85E1D00D756C2302C22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 3fd50ed28b3f5d43b9e381eb6ddaa57425f86e408e6f04acda0c07e4800da54c
MD5 4f9d7d1d8e7f8ffed1ae50e91fc0afaa
SHA1 07b7f196b3cc9764d213ac9662bcfec7ea684154
SHA512 bd48b39414ff46fb55bbd9f0700b91171319b10c409ff2bc5be8adb622e27ef791eed5bb162b74921971c24922e0e09d77205bcd407b6b168c9e58a91c902227
SSDEEP 384:nr3sNzpFP0WN07h/j2s3usLQQu/Kj+nVA8yNiD+Ku84e0DH5pF7Ig5O:r3qFgV/91LQQYW+K8XSKu84e0DH5rO
TLSH
T14C821AB5D8A56CF75896E4C5A642F5133EB4513BCA8C5E0CD2FCBA3E309F8B85315822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 12d0a684a284bd113fa6b2790ff8db2b77c6824c2c669f8bcd17ec587e58b0ea
MD5 6aa4b8c6e0314a73b039ad092dd46019
SHA1 54142c0198743886e58bce233297e2522b60215f
SHA512 a478cd2fb00a27883aacc266f8b57509ecc478715890dac32316e45812e4b12226cba65f6ce6bd3eec3fa52c80e61f0825182bdcb30545b2a0c0efe00e74abb4
SSDEEP 192:7ONAh6xBQmiUySqZ8R/j2wzMSus6slQFSud5Shew6sjq/9U6:7ONAh6xGZW/j2s3usLQQu/KJK9U6
TLSH
T1BC121935682D7C67EEB3AE46F58732235FA5213BA9952F44DAD81E1D00CB66C2316C33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 b2ff2e04019baea51ac12fd6d10aa6c4b28bfc323edaefeb493690323606a311
MD5 a72c00ce50205af98a1060344a38c328
SHA1 ef9165bdacb2cc1e49ae17ddd4b9b2c45ea969ec
SHA512 95a77506817ec0fa6c7a5fe4065d8b145cf7b7d40bf71357a23eeecb87b17e36207824ec0adc7f8bec18a77a77df76bb071dffbd0cdd0341bb286519727668a1
SSDEEP 384:nnsN0UpMa0WFf7h/j2s3usLQQu/Ky9hvFA8Bv21o8+Ku84e0056:nFKMCV/91LQQY3X683TKu84e0056
TLSH
T1E6821AB1D8A56CF795A6E8C5E642F5232EB4103B899D5E0CD6F9BA3D308F4F81315822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 13KB
SHA256 1e97cbfd959c15f7f689d8f1e0750df34cdfacc0eb6158a65bafc3010f485370
MD5 1cd6b49d4a4499aa354df47049903954
SHA1 f8b4c6d0c3a16480430553c5080a6b1ce9e191d0
SHA512 7a9cc7583683bfea78d91f4523fccb1ad0e6ee0bb59a90181c8f52d9297417d984644e7999efcdb579f5510bc4e871d109a93867ab6ee02719af5ce3fb5a44ac
SSDEEP 384:nnsNzpMa0WFp7h/j2s3usLQQu/K2J5pF7IgR:nqMAV/91LQQYDJ5H
TLSH
T165523B762C39AC639AB7AD45F65A36136FF0106B99841E44D6DC9F1D00CB5A8231A823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 de3d2bfab96b979dd150f84fcd38cb3f72159e47b13f340e07c326ccdad6d4fa
MD5 2175a9fb0884a178061d9dacf13afd08
SHA1 49ce2fef9d9946cae36c225033e0f1be95464cdf
SHA512 5196730962a8f2aef48102ad26827d1c39d21e7b70efd499e74d6d1b5ff6cf364d7fc4834d88f5fe33437c4d03193ceb553ee07988a4b8a715b9c41bad3ae56a
SSDEEP 384:nnsN0UpMa0WF67h/j2s3usLQQu/Ky9hvFA8Bv21o8+Ku84e0056:nFKMnV/91LQQY3X683TKu84e0056
TLSH
T124821AB1D8A56CF795A6E8C5A642F5232EB4103B899D5E0CD6FDBA3D308F4F81315822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 17KB
SHA256 fafa8af32064baa31da1f1e8609cdf7969bb9be3a158693d46d12f2254ac66df
MD5 47aa650fa7ea2be4218ea78cdaf6feed
SHA1 afa5b6883a25e89a68e22b0771c789b7a2637bfb
SHA512 b14a7d091b27f6441a42c98641ead6f1b13166bc707dc1f76da9a1955e98add0ad9cf50bcaf29ae953a31e8dac5c0b72041799a7cd3d6f1e2e0f1b6e6a5e4fd1
SSDEEP 384:nKCcmyWCi3sNypB50WNC7h/j2s3usLQQu/Kxx5pF7IgL:hcpi3zBMV/91LQQYax5x
TLSH
T123827C316C293C73DAABAE0AF55B26135FF4607B96C41E14DADD8F1D00CA1AC271A933
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 13KB
SHA256 6b1c03b28fd41cfb33421ec6753c0fbf86a2fec3414092ac876ef9d8b4a96b59
MD5 f9626cf70f952565b655e93aa36b170b
SHA1 3cd7b7839985071f925029894eee804d0597fb55
SHA512 b453c34edb123e1d7a3242eeb9c1f5d81ad058e5e152db5413706b5cc75c2baeaedd5e6867b768a3cfb889cec3fce97ab665a689d9dabe66bfcee6755c4af2d4
SSDEEP 384:nr3sNypFP0WNQ7h/j2s3usLQQu/Kbx5pF7Ig5O:r3zFMV/91LQQYax5rO
TLSH
T193523B366C297C63AAA7AD46F25A76135FF4106B99C41F44D6DC9F1D00CB6AC131AC33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

nav_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
Size 2KB
SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
MD5 499d9e568b96e759959dc69635470211
SHA1 2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6
SHA512 3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905
TLSH
T16B51DB73D5988C4B9BF4A29CE919A309F11107CF75D48C0B76BE010C1F7757AB5C6588
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

489743e0-bae1-46f0-8cab-63c48ea25998.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\489743e0-bae1-46f0-8cab-63c48ea25998.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 1e37a446ec7fed696ec2b621025a7fe336c880b0be10f719cc29b4e01310e90f
MD5 0f57c775982c1083d7ebbda5511988e2
SHA1 2fcbfcfa8fdc9e4662c4db40fae63ef651c3ebae
SHA512 d2154318b8ecc6b6bd1aa4166c529857645f52d30a173aef5e9db9b5977cb9fe981779b16e14e7884f01a251c6f30757eea0a99e1d1bfe9270bf0ee14e3f8bb7
TLSH
T11C413A59A6F91248B3B76F1AA7F6786D487BBD772F06D19E00010D4F0A62A40C871737
MD5 SHA1 SHA512 TLSH

Submit Download

8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres
Size 2KB
SHA256 715e07b1c1fc1577432e8671b00c42772f6e526a35c89faeb6481b8eb3bfad2f
MD5 e4a46577db4d9499a4c4d4da38cfd3cc
SHA1 58e42695810193e487e9a41e8c158c97b81ce6ed
SHA512 8709a4cc7faf87899b201bdbd635ea640d7de756dc33b8c4f62a838f20197efc430ad367dcd227f4a6f1d9d2d17bfa9928ab9e375b39aa6ed9d2677057d2de75
TLSH
T10051305DA6FD1018B3B36F169BF678AE887F7D372B06D49E00010E4F4A62A40C9A1777
MD5 SHA1 SHA512 TLSH

Submit Download

75ac3702-0a3b-4ff4-8870-3b1ffcae10e9.tmp

Path C:\Users\Admin\AppData\Local\Temp\75ac3702-0a3b-4ff4-8870-3b1ffcae10e9.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9d5ad263-d406-4ba8-89c4-f7b6497eceb4.tmp

Path C:\Users\Admin\AppData\Local\Temp\9d5ad263-d406-4ba8-89c4-f7b6497eceb4.tmp
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2408_1263047784\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XENO_CACHE.bin

Path C:\Users\Admin\AppData\Local\Xeno\XENO_CACHE.bin
Size 36B
SHA256 3bab55816f9c1c63b26bee8027a74983736938cfa748d9c91230391d4bacfb88
MD5 03b4e88d732421deccbdd05cb90b0513
SHA1 1ba9d3bd3af60ecc041e93251633b5a0fbac4d9b
SHA512 40e01403608fc8d8c0bc7bc6e1367a472778dea5d4dde4d242b37b0860d098075ac71cf24abd85c6b9ee67bf6adf80adaaf279a969f4477555807003276a2c75
MD5 SHA1 SHA512

Submit Download

settings.json

Path C:\Users\Admin\AppData\Local\Xeno\settings.json
Size 101B
SHA256 88e5c8567b1cad0fa2a42a21ac273a1ffb8a6992be41e5de548d11f281f4c373
MD5 7109faf92716c37ae9d65f89a2477be0
SHA1 de2903bb44600fd8a69649c395335d4fc226c5e0
SHA512 f41ca49622d3458c1365fd9f610e1c27fd3dd816ce5c910e785532dcc39d94ceb1a00991909cc247ab4b9e9da0ac583245168853d8bdcc235116f0a7a4538b2f
TLSH
T11CB09232984108FC01608299C841D80203118E0120662E02B4BE025928308346000FD8
MD5 SHA1 SHA512 TLSH

Submit Download

$RAK90DH.zip

Path C:\Users\Admin\Downloads\$RAK90DH.zip
Size 6.7MB
SHA256 49bae1d0612ed1391834d64949b11260b9533226ac4f7f85e2ae5c0017a86f23
MD5 85e2b8fea502bede31f11d07b77cfc12
SHA1 7e797b5008820aad652f70acf0d93f7b3415442d
SHA512 4605d6e1b7b9739688c27ceb39baa0af07c74979ec61b981af0cacc542866fd9c2f6a9adae2d734dabfb99bedf55c5904ace28c5a128cd7c57d5367452530b7b
SSDEEP 196608:S3FcHWKfGBvG7bM0V2XaCzd/so/28dgqjJx5y9cCjH:S3FaWKf/nM3h28dgQAbH
TLSH
T1B866339C9AFC04D3F5644279A9354BB93143F78267116C2BEA4C19A273DEED04683B2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\Downloads\$RAK90DH\Xeno-v1.3.30\Xeno.exe.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 14db42c7849b3490e98a2d9b907a8bd48d37524101862d72388341ba926079d9
MD5 c64221c00add329e454b38994b59bd8f
SHA1 eb65807d9a04d74feac2b4571a09adbff7219ce0
SHA512 9879ef548923a3ef737c3cc3e9656da1d85b572e0356a0dd1c4e325c16111922c171deb222aea90441840eec5228b296a55c62e4a276437acfb6013590c62e17
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\Downloads\$RAK90DH\Xeno-v1.3.30\Xeno.exe.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 f6c13d582c2083f19ccd7963fd3309f5b6afcf1fe967c93e702c1bbe04d2bbc2
MD5 6d3832946f069321af4063eb69f7a222
SHA1 48f7b6322c20ae7477a8d94802574554a1120d67
SHA512 3bfbfd1f9322a79d73280365cc8692c6863915f5f53d7eb384d362f506663678cf1b30412048125866008ca258c06b714bfc1eb1154c33e6ac1ed607db9e9331
TLSH
T153D0241373510534C41030334517710C0545C11F400DC1447C3CC73D5FCC0740D03451
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\Downloads\$RAK90DH\Xeno-v1.3.30\Xeno.exe.WebView2\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\Downloads\$RAK90DH\Xeno-v1.3.30\Xeno.exe.WebView2\EBWebView\Default\Network\Network Persistent State
Size 229B
SHA256 153938ecc186cd98a2f1ebd1f53ae88cfe9d9884bd470e9166a53348a071fb2b
MD5 5c9f79435fd36dd2a8914a542651f839
SHA1 81f4f5faf2f14d448626b3f49618d11fd4295cad
SHA512 0e7cf3372f919b11b0c6341bc4df2bb8ba5106463b06c74f0736b14755fa23a78db7e9b3111938570225435169bd01f7198b6124007defa77e90bbe21fd14588
TLSH
T17AD0A7B655601AFE075583E01A24685BCE7D4003422C9DBAC6347B2D43A11B9901095B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe58d8e6.TMP

Path C:\Users\Admin\Downloads\$RAK90DH\Xeno-v1.3.30\Xeno.exe.WebView2\EBWebView\Default\Network\Network Persistent State~RFe58d8e6.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\Downloads\$RAK90DH\Xeno-v1.3.30\Xeno.exe.WebView2\EBWebView\Default\Preferences
Size 6KB
SHA256 f1e4882dc032dfdb0bfbdcfb1fb9c455df7f2340c28b61401982f519b5be0f54
MD5 a4d35b29b615c6418613114f2062501d
SHA1 7533e4dbe7d0edd264ade3c9a097501dbfa1dff6
SHA512 d18211926ec6f86880facdd32df546b831ffa54711abc1b5d8d659a068e99ebb757520962cc05bb4991c3b253b6eb875ea1af44edea9b71eb0990aa7ffadfe6a
SSDEEP 96:st885sAHDpHdb9JLffq4Z8i0vhEEkmqm/7qx+WVHMSm+uecadQj6+gpRovWKEB:st88bBpfjZ8pasn/S+Wi8dnzRovWK8
TLSH
T1CFD1A8035F28A9774CCBE619BA35BB52E3FA102272D50E58EBFC461C08D66DD530790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe58d869.TMP

Path C:\Users\Admin\Downloads\$RAK90DH\Xeno-v1.3.30\Xeno.exe.WebView2\EBWebView\Default\Preferences~RFe58d869.TMP
Size 6KB
SHA256 5d44b18f5f6892fa89b2f76bd86a80cb4adc78ae94c26d4367db6bf21e9a1bc2
MD5 55b01c1e7f1c2dcc9d589bf4740fd42f
SHA1 b0a73e9ead1b3753d2ef6aadf3c7c4738f217880
SHA512 b49e99b1b7ef9a9977608e637d351b1baaa73f0df1fb28c66c5ac35e201a5d271e9023c3ffcf67b69c4183082f1fdb6165b2604beed93070fa92253a7aa4128d
SSDEEP 96:st885sAHDpHdb9JLffnZ8i0vhEEkmqm/7qx+WVHMSm+uecadQj6+gp3oeMEB:st88bBpf/Z8pasn/S+Wi8dnz3oeM8
TLSH
T122D1B8035F2869774CCBE6197A35BB12E3FA502222D50E98EBFD861C08D66DD531B90B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\Downloads\$RAK90DH\Xeno-v1.3.30\Xeno.exe.WebView2\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\Downloads\$RAK90DH\Xeno-v1.3.30\Xeno.exe.WebView2\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\Downloads\$RAK90DH\Xeno-v1.3.30\Xeno.exe.WebView2\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\Downloads\$RAK90DH\Xeno-v1.3.30\Xeno.exe.WebView2\EBWebView\Local State
Size 1KB
SHA256 80466b3291a46d4e0980e5e9a39af3114be8f47bbf4e4cd989211e4fda1cf503
MD5 216f093ecdaab7cfa1645fef689dca07
SHA1 af0871a03fcbe813bea81755efb462faf3013137
SHA512 89d5abeb76bf5e539b301880aa03271163f0596e8f0c612cd2f3f7390177c1d2b695901e467ff34e7f6396ecfd27e81f770d76cfb64846006ecbcbb1a805a354
TLSH
T117318573E5A01F7218876A85B1452BAB3F714075C2224E0491EF470D02EF59C8637C33
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\Downloads\$RAK90DH\Xeno-v1.3.30\Xeno.exe.WebView2\EBWebView\Local State
Size 2KB
SHA256 96cc59cf338a83bfbafca3c46b4331e3536ed4c179af0c565436f7a16e953e18
MD5 2b10b6d7973052e5b05efe5d82bda321
SHA1 5e9db436f71320a0148f0b871c39e81a02f09e83
SHA512 97ae1ff753d54f59fd99dc618eb1f0ed90c7e63e81f455765fab26fe6aaaa84798129b54873bd3f0794091a18804a51399bfb4fa548f2b238f2c6eedee7be87f
TLSH
T11651D533A9549B3749E79A84B8893F276F364061DA622F5086EE0B0C01DF69C1313C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\Downloads\$RAK90DH\Xeno-v1.3.30\Xeno.exe.WebView2\EBWebView\Local State
Size 3KB
SHA256 b7568cef017b71d3e883033e6520afda7b5510f7630de4ce93e2a0cf967fcba1
MD5 6afd236c9dad538a62943a6ebd628727
SHA1 ca6987451875a89285405572114b7943dfc8b69c
SHA512 7a88a4fc784511917146cb5b426e79d8904ed293495dcf38e11af52192427e045ae83a4feb435e7a979dc9552ff462ca7e5e2e8bc781cffa00ae9219a1c90459
TLSH
T14D71A737A564AA274DF79E44B8C52B1677A54137D5A13F94C6ED0F0D01DB3D81312C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\Downloads\$RAK90DH\Xeno-v1.3.30\Xeno.exe.WebView2\EBWebView\Local State
Size 15KB
SHA256 6955447b551fed4ef3c4d9fd3c9c6380126a409af4d5702552634eea0a23964c
MD5 e26b4bf9e15d63bfed8ded807f434e88
SHA1 97ce4032686152dd1d9a57d29250a362aba6db34
SHA512 060af3fcb59905f6652055e72eec44522fc9cb17302d8d0fa1abe69ce638be6ea16f8e13d9e0faeca81881e66d6c93e9dc075e83a7e5a6946cb112a9895881e2
SSDEEP 384:z/vsrvyOiyp4+IWA1eUVWGfvvLhNbLH0nXlfnu0SEB:r0raxyp4sQe6WGfvLH0XND
TLSH
T10C72BF720A749A379DEAAD46BC4E3A1B7F994066DDD12F84A4DA6B1F014F1CC0707C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe589e10.TMP

Path C:\Users\Admin\Downloads\$RAK90DH\Xeno-v1.3.30\Xeno.exe.WebView2\EBWebView\Local State~RFe589e10.TMP
Size 1KB
SHA256 b9844cf03a23a263610d3a32ab2392742af949455797a35c71e5cd6d04f22059
MD5 178054aaa8b6385cfdf8703583361de0
SHA1 0fadc995bfa9184c0ddcfa07d53310203a5e5bb2
SHA512 9a1038f93b1c27ccff0d5139ff4859c2379ba6f6642ba32f616e23611578a7651b1f54a3ad47c7243acc83fef678cdca792093842af42941750ddf6cc1bd788d
TLSH
T1F5214033D4945BB268865A85B1416B9B2F61407986218E0891DF430902EF99C8737C33
MD5 SHA1 SHA512 TLSH

Submit Download

memory/416-1115-0x0000028CC2C20000-0x0000028CC2C2C000-memory.dmp

Download

memory/416-1114-0x0000028CC2BE0000-0x0000028CC2C0C000-memory.dmp

Download

memory/416-1116-0x0000028CC36C0000-0x0000028CC36E7000-memory.dmp

Download

memory/416-1303-0x0000028CC2BE0000-0x0000028CC2C0C000-memory.dmp

Download

memory/416-1304-0x0000028CC2C20000-0x0000028CC2C2C000-memory.dmp

Download

memory/416-1306-0x0000028CC36F0000-0x0000028CC372B000-memory.dmp

Download

memory/416-1305-0x0000028CC36C0000-0x0000028CC36E7000-memory.dmp

Download

memory/416-1117-0x0000028CC36F0000-0x0000028CC372B000-memory.dmp

Download

memory/3424-1111-0x0000025799550000-0x00000257998A5000-memory.dmp

Download

memory/3548-389-0x00007FFEAFB10000-0x00007FFEAFB11000-memory.dmp

Download

memory/3912-500-0x000001D757620000-0x000001D7577C1000-memory.dmp

Download

memory/4216-39-0x00000203F0AF0000-0x00000203F0C91000-memory.dmp

Download

memory/4952-288-0x00000164CD400000-0x00000164CD755000-memory.dmp

Download

memory/5160-454-0x00007FFEB06E0000-0x00007FFEB06E1000-memory.dmp

Download

memory/5160-453-0x00007FFEB06A0000-0x00007FFEB06A1000-memory.dmp

Download

memory/5580-1354-0x000002D1694D0000-0x000002D1694D1000-memory.dmp

Download

memory/5580-1350-0x000002D1694D0000-0x000002D1694D1000-memory.dmp

Download

memory/5580-1349-0x000002D1694D0000-0x000002D1694D1000-memory.dmp

Download

memory/5580-1348-0x000002D1694D0000-0x000002D1694D1000-memory.dmp

Download

memory/5580-1351-0x000002D1694D0000-0x000002D1694D1000-memory.dmp

Download

memory/5580-1352-0x000002D1694D0000-0x000002D1694D1000-memory.dmp

Download

memory/5580-1353-0x000002D1694D0000-0x000002D1694D1000-memory.dmp

Download

memory/5580-1344-0x000002D1694D0000-0x000002D1694D1000-memory.dmp

Download

memory/5580-1343-0x000002D1694D0000-0x000002D1694D1000-memory.dmp

Download

memory/5580-1342-0x000002D1694D0000-0x000002D1694D1000-memory.dmp

Download

memory/5596-735-0x000001551FD10000-0x000001551FEB1000-memory.dmp

Download

memory/5700-489-0x00007FFEAFB10000-0x00007FFEAFB11000-memory.dmp

Download

memory/6000-1162-0x000001C479200000-0x000001C479555000-memory.dmp

Download