hxxps://www[.]xeno[.]now/method

Analysis

user interaction
yes
max time kernel
210s
max time network
215s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/06/2026, 00:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.xeno.now/method
Sample260620-a4ef4acw4n

Score

8^/10

discovery persistence ransomware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
224	916	msedge.exe

Executes dropped EXE 6 IoCs

pid	Process
5764	windowsdesktop-runtime-9.0.17-win-x64.exe
6028	windowsdesktop-runtime-9.0.17-win-x64.exe
5264	windowsdesktop-runtime-9.0.17-win-x64.exe
6276	windowsdesktop-runtime-9.0.17-win-x64.exe
6288	windowsdesktop-runtime-9.0.17-win-x64.exe
2752	windowsdesktop-runtime-9.0.17-win-x64.exe

Loads dropped DLL 64 IoCs

pid	Process
6028	windowsdesktop-runtime-9.0.17-win-x64.exe
5000	MsiExec.exe
5000	MsiExec.exe
2248	MsiExec.exe
2248	MsiExec.exe
5640	MsiExec.exe
5640	MsiExec.exe
3116	MsiExec.exe
2752	windowsdesktop-runtime-9.0.17-win-x64.exe
3116	MsiExec.exe
7068	Xeno.exe
7068	Xeno.exe
7068	Xeno.exe
7068	Xeno.exe
7068	Xeno.exe
7068	Xeno.exe
7068	Xeno.exe
7068	Xeno.exe
7068	Xeno.exe
7068	Xeno.exe
7068	Xeno.exe
7068	Xeno.exe
7068	Xeno.exe
7068	Xeno.exe
7068	Xeno.exe
7068	Xeno.exe
7068	Xeno.exe
7068	Xeno.exe
7068	Xeno.exe
7068	Xeno.exe
7068	Xeno.exe
7068	Xeno.exe
7068	Xeno.exe
7068	Xeno.exe
7068	Xeno.exe
7068	Xeno.exe
7068	Xeno.exe
7068	Xeno.exe
7068	Xeno.exe
7068	Xeno.exe
7068	Xeno.exe
7068	Xeno.exe
7068	Xeno.exe
7068	Xeno.exe
7068	Xeno.exe
7068	Xeno.exe
7068	Xeno.exe
7068	Xeno.exe
7068	Xeno.exe
7068	Xeno.exe
7068	Xeno.exe
7068	Xeno.exe
7068	Xeno.exe
7068	Xeno.exe
7068	Xeno.exe
7068	Xeno.exe
7068	Xeno.exe
7068	Xeno.exe
7068	Xeno.exe
7068	Xeno.exe
7068	Xeno.exe
7068	Xeno.exe
7068	Xeno.exe
7068	Xeno.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{df745324-5cb5-434e-80ec-1238a7c258a3} = "\"C:\\ProgramData\\Package Cache\\{df745324-5cb5-434e-80ec-1238a7c258a3}\\windowsdesktop-runtime-9.0.17-win-x64.exe\" /burn.runonce"	windowsdesktop-runtime-9.0.17-win-x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Contacts third-party web service commonly abused for C2 1 TTPs 9 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	discord.com
109	discord.com
261	discord.com
262	discord.com
263	discord.com
269	raw.githubusercontent.com
270	raw.githubusercontent.com
108	discord.com
268	raw.githubusercontent.com

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.17\System.Runtime.Loader.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.17\System.Diagnostics.Tools.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.17\netstandard.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.17\tr\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.17\es\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.17\pl\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.17\System.Runtime.Handles.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.17\System.Runtime.InteropServices.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.17\pl\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.17\zh-Hant\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.17\zh-Hant\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.17\System.Threading.Tasks.Dataflow.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.17\zh-Hans\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.17\fr\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.17\pl\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.17\fr\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.17\System.Core.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.17\System.Xml.XDocument.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.17\zh-Hans\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.17\pt-BR\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.17\System.Resources.ResourceManager.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.17\cs\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.17\System.Collections.NonGeneric.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.17\System.Threading.ThreadPool.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.17\de\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.17\zh-Hant\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.17\tr\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.17\fr\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.17\System.IO.FileSystem.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.17\System.Runtime.Serialization.Primitives.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.17\System.ServiceProcess.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.17\System.Runtime.CompilerServices.Unsafe.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.17\Microsoft.CSharp.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.17\System.ObjectModel.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.17\System.Reflection.Primitives.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.17\es\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.17\ja\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.17\pt-BR\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.17\System.Windows.Presentation.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.17\System.Net.Ping.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.17\tr\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.17\System.Transactions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.17\ja\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.17\Microsoft.Win32.SystemEvents.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.17\de\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.17\System.Threading.Overlapped.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.17\System.Security.Cryptography.X509Certificates.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.17\UIAutomationTypes.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.17\PresentationFramework.Fluent.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.17\zh-Hant\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.17\System.Design.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.17\it\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.17\ja\WindowsBase.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.17\System.Reflection.TypeExtensions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.17\System.Windows.Forms.Design.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.17\zh-Hant\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.17\System.Resources.Extensions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.17\es\System.Xaml.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\LICENSE.txt	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.17\System.Runtime.CompilerServices.VisualC.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.17\System.ComponentModel.Primitives.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.17\de\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.17\PresentationFramework.Royale.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.17\it\WindowsBase.resources.dll	msiexec.exe

Drops file in Windows directory 55 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5342.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5527.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI574C.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF2B7BA10003B42762.TMP	msiexec.exe
File created	C:\Windows\Installer\e5b41ce.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFD27D21068952E2A2.TMP	msiexec.exe
File opened for modification	C:\Windows\SystemTemp	msedgewebview2.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\~DFCA42C841FA8C01DA.TMP	msiexec.exe
File created	C:\Windows\Installer\e5b41c3.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF72EACEB903693284.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFADC2CA59D464A2B7.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5A6A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6866.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF0206CA0C0E001AFA.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFB01C4DB454CBEE64.TMP	msiexec.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\Installer\e5b41b9.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF129B46B1306B94DF.TMP	msiexec.exe
File created	C:\Windows\Installer\e5b41bd.msi	msiexec.exe
File created	C:\Windows\Installer\e5b41be.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5b41be.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF7FA71C35C8799659.TMP	msiexec.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\~DFFE2C2865499DE0FA.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e5b41c3.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF7010DD5F327F1F05.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI55C5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149	msiexec.exe
File created	C:\Windows\Installer\e5b41c9.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{F2C84F3F-E093-4D2B-A895-DDA05BB06222}	msiexec.exe
File created	C:\Windows\SystemTemp\~DFDB27041CCCAE86DE.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{02387076-6763-4FC4-A33C-41F4B807DE44}	msiexec.exe
File created	C:\Windows\Installer\e5b41b9.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4478.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI46BB.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF1814C4E01E886BEB.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI515C.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{8880D1FE-29A8-491A-9F71-F38EAD502A3F}	msiexec.exe
File created	C:\Windows\Installer\e5b41ca.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF4937AA78179831EA.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5247.tmp	msiexec.exe
File created	C:\Windows\Installer\e5b41c2.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF7A516F88D32A8EBC.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149\fileCoreHostExe	msiexec.exe
File opened for modification	C:\Windows\Installer\e5b41ca.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5C8E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF53CBB942F25B161C.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4ECA.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{38BEBAEF-02B0-4915-973F-1EFFE4239967}	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149\fileCoreHostExe	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-9.0.17-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-9.0.17-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-9.0.17-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-9.0.17-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-9.0.17-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-9.0.17-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

System Time Discovery 1 TTPs 4 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5880	msedge.exe
6636	chrome.exe
916	msedge.exe
880	msedge.exe

Enumerates system info in registry 2 TTPs 15 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 20 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134263899553123986"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_72.68.53536_x64\Dependents	windowsdesktop-runtime-9.0.17-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EF1D08888A92A194F9173FE8DA05A2F3\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EF1D08888A92A194F9173FE8DA05A2F3\SourceList\PackageName = "dotnet-host-9.0.17-win-x64.msi"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6707832036764CF43AC3144F8B70ED44\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6707832036764CF43AC3144F8B70ED44\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F3F48C2F390EB2D48A59DD0AB50B2622\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\FDB0DE8CF6D50A643790B7A2E48BFC05\6707832036764CF43AC3144F8B70ED44	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6707832036764CF43AC3144F8B70ED44\SourceList\PackageName = "windowsdesktop-runtime-9.0.17-win-x64.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{df745324-5cb5-434e-80ec-1238a7c258a3}\DisplayName = "Microsoft Windows Desktop Runtime - 9.0.17 (x64)"	windowsdesktop-runtime-9.0.17-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_72.68.53536_x64\Version = "72.68.53536"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_9.0_x64\ = "{8880D1FE-29A8-491A-9F71-F38EAD502A3F}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\EF1D08888A92A194F9173FE8DA05A2F3	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EF1D08888A92A194F9173FE8DA05A2F3\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EF1D08888A92A194F9173FE8DA05A2F3\SourceList\Media\1 = ";"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6707832036764CF43AC3144F8B70ED44\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\windowsdesktop_runtime_72.68.53601_x64	windowsdesktop-runtime-9.0.17-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{df745324-5cb5-434e-80ec-1238a7c258a3}\Dependents\{df745324-5cb5-434e-80ec-1238a7c258a3}	windowsdesktop-runtime-9.0.17-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\FEABEB830B20519479F3E1FF4E329976\Provider	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EF1D08888A92A194F9173FE8DA05A2F3\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3730367222-316663987-825798519-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_72.68.53536_x64\DisplayName = "Microsoft .NET Runtime - 9.0.17 (x64)"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6707832036764CF43AC3144F8B70ED44\Version = "1212469601"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6707832036764CF43AC3144F8B70ED44\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F3F48C2F390EB2D48A59DD0AB50B2622	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FEABEB830B20519479F3E1FF4E329976\ProductName = "Microsoft .NET Host FX Resolver - 9.0.17 (x64)"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FEABEB830B20519479F3E1FF4E329976\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6707832036764CF43AC3144F8B70ED44\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{02387076-6763-4FC4-A33C-41F4B807DE44}v72.68.53601\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{df745324-5cb5-434e-80ec-1238a7c258a3}\ = "{df745324-5cb5-434e-80ec-1238a7c258a3}"	windowsdesktop-runtime-9.0.17-win-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-3730367222-316663987-825798519-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F3F48C2F390EB2D48A59DD0AB50B2622\Provider	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FEABEB830B20519479F3E1FF4E329976\Version = "1212469536"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_72.68.53601_x64\Dependents\{df745324-5cb5-434e-80ec-1238a7c258a3}	windowsdesktop-runtime-9.0.17-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F3F48C2F390EB2D48A59DD0AB50B2622\ProductName = "Microsoft .NET Runtime - 9.0.17 (x64)"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F3F48C2F390EB2D48A59DD0AB50B2622\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\79895C2910357244A8ABC2BB24DBA164	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_9.0_x64	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\6707832036764CF43AC3144F8B70ED44\Provider	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F3F48C2F390EB2D48A59DD0AB50B2622\Version = "1212469536"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F3F48C2F390EB2D48A59DD0AB50B2622\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_72.68.53536_x64\Dependents\{df745324-5cb5-434e-80ec-1238a7c258a3}	windowsdesktop-runtime-9.0.17-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EF1D08888A92A194F9173FE8DA05A2F3\SourceList\Media	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FEABEB830B20519479F3E1FF4E329976\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FEABEB830B20519479F3E1FF4E329976\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{38BEBAEF-02B0-4915-973F-1EFFE4239967}v72.68.53536\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FEABEB830B20519479F3E1FF4E329976\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{38BEBAEF-02B0-4915-973F-1EFFE4239967}v72.68.53536\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EF1D08888A92A194F9173FE8DA05A2F3\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_72.68.53601_x64\DisplayName = "Microsoft Windows Desktop Runtime - 9.0.17 (x64)"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_72.68.53536_x64\Dependents	windowsdesktop-runtime-9.0.17-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F3F48C2F390EB2D48A59DD0AB50B2622\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EF1D08888A92A194F9173FE8DA05A2F3\PackageCode = "01C87E9BF982FEB4B8C8624A07DFD876"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_9.0_x64\Dependents\{df745324-5cb5-434e-80ec-1238a7c258a3}	windowsdesktop-runtime-9.0.17-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EF1D08888A92A194F9173FE8DA05A2F3\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\6707832036764CF43AC3144F8B70ED44\MainFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6707832036764CF43AC3144F8B70ED44\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F3F48C2F390EB2D48A59DD0AB50B2622\DeploymentFlags = "3"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FEABEB830B20519479F3E1FF4E329976\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6707832036764CF43AC3144F8B70ED44\PackageCode = "4EB6BE82AA9795A4DA68191647551ECA"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{df745324-5cb5-434e-80ec-1238a7c258a3}	windowsdesktop-runtime-9.0.17-win-x64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3730367222-316663987-825798519-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3730367222-316663987-825798519-1000\{A2446E4B-3A01-45CF-BEF7-2E57AA637BE5}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_72.68.53536_x64	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FEABEB830B20519479F3E1FF4E329976	msiexec.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
4464	chrome.exe
4464	chrome.exe
3044	msiexec.exe
3044	msiexec.exe
3044	msiexec.exe
3044	msiexec.exe
3044	msiexec.exe
3044	msiexec.exe
3044	msiexec.exe
3044	msiexec.exe
7068	Xeno.exe
7068	Xeno.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 38 IoCs

pid	Process
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
5556	chrome.exe
5556	chrome.exe
4724	msedge.exe
4724	msedge.exe
5556	chrome.exe
5556	chrome.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
5680	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5556	chrome.exe
Token: SeCreatePagefilePrivilege	5556	chrome.exe
Token: SeShutdownPrivilege	5556	chrome.exe
Token: SeCreatePagefilePrivilege	5556	chrome.exe
Token: SeShutdownPrivilege	5556	chrome.exe
Token: SeCreatePagefilePrivilege	5556	chrome.exe
Token: SeShutdownPrivilege	5556	chrome.exe
Token: SeCreatePagefilePrivilege	5556	chrome.exe
Token: SeShutdownPrivilege	5556	chrome.exe
Token: SeCreatePagefilePrivilege	5556	chrome.exe
Token: SeShutdownPrivilege	5556	chrome.exe
Token: SeCreatePagefilePrivilege	5556	chrome.exe
Token: SeShutdownPrivilege	5556	chrome.exe
Token: SeCreatePagefilePrivilege	5556	chrome.exe
Token: SeShutdownPrivilege	5556	chrome.exe
Token: SeCreatePagefilePrivilege	5556	chrome.exe
Token: SeShutdownPrivilege	5556	chrome.exe
Token: SeCreatePagefilePrivilege	5556	chrome.exe
Token: SeShutdownPrivilege	5556	chrome.exe
Token: SeCreatePagefilePrivilege	5556	chrome.exe
Token: SeShutdownPrivilege	5556	chrome.exe
Token: SeCreatePagefilePrivilege	5556	chrome.exe
Token: SeShutdownPrivilege	5556	chrome.exe
Token: SeCreatePagefilePrivilege	5556	chrome.exe
Token: SeShutdownPrivilege	5556	chrome.exe
Token: SeCreatePagefilePrivilege	5556	chrome.exe
Token: SeShutdownPrivilege	5556	chrome.exe
Token: SeCreatePagefilePrivilege	5556	chrome.exe
Token: SeShutdownPrivilege	5556	chrome.exe
Token: SeCreatePagefilePrivilege	5556	chrome.exe
Token: SeShutdownPrivilege	5556	chrome.exe
Token: SeCreatePagefilePrivilege	5556	chrome.exe
Token: SeShutdownPrivilege	5556	chrome.exe
Token: SeCreatePagefilePrivilege	5556	chrome.exe
Token: SeShutdownPrivilege	5556	chrome.exe
Token: SeCreatePagefilePrivilege	5556	chrome.exe
Token: SeShutdownPrivilege	5556	chrome.exe
Token: SeCreatePagefilePrivilege	5556	chrome.exe
Token: SeShutdownPrivilege	5556	chrome.exe
Token: SeCreatePagefilePrivilege	5556	chrome.exe
Token: SeShutdownPrivilege	5556	chrome.exe
Token: SeCreatePagefilePrivilege	5556	chrome.exe
Token: SeShutdownPrivilege	5556	chrome.exe
Token: SeCreatePagefilePrivilege	5556	chrome.exe
Token: SeShutdownPrivilege	5556	chrome.exe
Token: SeCreatePagefilePrivilege	5556	chrome.exe
Token: SeShutdownPrivilege	5556	chrome.exe
Token: SeCreatePagefilePrivilege	5556	chrome.exe
Token: SeShutdownPrivilege	5556	chrome.exe
Token: SeCreatePagefilePrivilege	5556	chrome.exe
Token: SeShutdownPrivilege	5556	chrome.exe
Token: SeCreatePagefilePrivilege	5556	chrome.exe
Token: SeShutdownPrivilege	5556	chrome.exe
Token: SeCreatePagefilePrivilege	5556	chrome.exe
Token: SeShutdownPrivilege	5556	chrome.exe
Token: SeCreatePagefilePrivilege	5556	chrome.exe
Token: SeShutdownPrivilege	5556	chrome.exe
Token: SeCreatePagefilePrivilege	5556	chrome.exe
Token: SeShutdownPrivilege	5556	chrome.exe
Token: SeCreatePagefilePrivilege	5556	chrome.exe
Token: SeShutdownPrivilege	5556	chrome.exe
Token: SeCreatePagefilePrivilege	5556	chrome.exe
Token: SeShutdownPrivilege	5556	chrome.exe
Token: SeCreatePagefilePrivilege	5556	chrome.exe

Suspicious use of FindShellTrayWindow 56 IoCs

pid	Process
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
6028	windowsdesktop-runtime-9.0.17-win-x64.exe
4724	msedge.exe
5556	chrome.exe
2352	msedge.exe
2352	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
3044	msiexec.exe
5000	MsiExec.exe
2248	MsiExec.exe
5640	MsiExec.exe
3116	MsiExec.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5556 wrote to memory of 5544	5556	chrome.exe	89
PID 5556 wrote to memory of 5044	5556	chrome.exe	90
PID 5556 wrote to memory of 6636	5556	chrome.exe	91
PID 5556 wrote to memory of 5044	5556	chrome.exe	90
PID 5556 wrote to memory of 3676	5556	chrome.exe	93
PID 5556 wrote to memory of 3676	5556	chrome.exe	93
PID 5556 wrote to memory of 3716	5556	chrome.exe	94
PID 5556 wrote to memory of 3716	5556	chrome.exe	94
PID 5556 wrote to memory of 2984	5556	chrome.exe	95
PID 5556 wrote to memory of 2984	5556	chrome.exe	95
PID 5556 wrote to memory of 5956	5556	chrome.exe	96
PID 5556 wrote to memory of 5956	5556	chrome.exe	96
PID 5556 wrote to memory of 6728	5556	chrome.exe	97
PID 5556 wrote to memory of 6728	5556	chrome.exe	97
PID 5556 wrote to memory of 2352	5556	chrome.exe	98
PID 5556 wrote to memory of 2352	5556	chrome.exe	98
PID 5556 wrote to memory of 524	5556	chrome.exe	99
PID 5556 wrote to memory of 524	5556	chrome.exe	99
PID 5556 wrote to memory of 2812	5556	chrome.exe	100
PID 5556 wrote to memory of 4480	5556	chrome.exe	101
PID 5556 wrote to memory of 4480	5556	chrome.exe	101
PID 5556 wrote to memory of 4256	5556	chrome.exe	102
PID 5556 wrote to memory of 4256	5556	chrome.exe	102
PID 5556 wrote to memory of 5760	5556	chrome.exe	106
PID 5556 wrote to memory of 5760	5556	chrome.exe	106
PID 5556 wrote to memory of 1524	5556	chrome.exe	107
PID 5556 wrote to memory of 1524	5556	chrome.exe	107
PID 5556 wrote to memory of 1104	5556	chrome.exe	108
PID 5556 wrote to memory of 1104	5556	chrome.exe	108
PID 5556 wrote to memory of 4880	5556	chrome.exe	109
PID 5556 wrote to memory of 4880	5556	chrome.exe	109
PID 5556 wrote to memory of 4700	5556	chrome.exe	110
PID 5556 wrote to memory of 4700	5556	chrome.exe	110
PID 5556 wrote to memory of 3376	5556	chrome.exe	111
PID 5556 wrote to memory of 3376	5556	chrome.exe	111
PID 5556 wrote to memory of 2404	5556	chrome.exe	112
PID 5556 wrote to memory of 2404	5556	chrome.exe	112
PID 5556 wrote to memory of 6264	5556	chrome.exe	113
PID 5556 wrote to memory of 6264	5556	chrome.exe	113
PID 5556 wrote to memory of 4820	5556	chrome.exe	114
PID 5556 wrote to memory of 4820	5556	chrome.exe	114
PID 5556 wrote to memory of 1208	5556	chrome.exe	115
PID 5556 wrote to memory of 1208	5556	chrome.exe	115
PID 5556 wrote to memory of 4392	5556	chrome.exe	116
PID 5556 wrote to memory of 3136	5556	chrome.exe	117
PID 5556 wrote to memory of 3136	5556	chrome.exe	117
PID 5556 wrote to memory of 6548	5556	chrome.exe	118
PID 5556 wrote to memory of 6548	5556	chrome.exe	118
PID 5556 wrote to memory of 4492	5556	chrome.exe	119
PID 5556 wrote to memory of 4492	5556	chrome.exe	119
PID 5556 wrote to memory of 4200	5556	chrome.exe	120
PID 5556 wrote to memory of 4200	5556	chrome.exe	120
PID 5556 wrote to memory of 956	5556	chrome.exe	121
PID 5556 wrote to memory of 956	5556	chrome.exe	121
PID 5556 wrote to memory of 3600	5556	chrome.exe	122
PID 5556 wrote to memory of 3600	5556	chrome.exe	122
PID 5556 wrote to memory of 5336	5556	chrome.exe	124
PID 5556 wrote to memory of 7060	5556	chrome.exe	125
PID 5556 wrote to memory of 6276	5556	chrome.exe	126
PID 5556 wrote to memory of 2828	5556	chrome.exe	127
PID 5556 wrote to memory of 2828	5556	chrome.exe	127
PID 5556 wrote to memory of 3948	5556	chrome.exe	128
PID 5556 wrote to memory of 4464	5556	chrome.exe	132
PID 6384 wrote to memory of 4724	6384	Xeno.exe	134

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.xeno.now/method
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff9bc94c728,0x7ff9bc94c734,0x7ff9bc94c740
  2⤵
  PID:5544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1664,i,18171118244206365571,12274262266886979961,262144 --field-trial-handle=1908,i,1740766933853095642,2015595337383386677,262144 --variations-seed-version --mojo-platform-channel-handle=1904 /prefetch:2
  2⤵
  PID:5044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1988,i,5529349656397628450,3495643894841776687,524288 --field-trial-handle=1908,i,1740766933853095642,2015595337383386677,262144 --variations-seed-version --mojo-platform-channel-handle=2052 /prefetch:11
  2⤵
  - System Time Discovery
  PID:6636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2312,i,13282323469003927805,8304724261779955343,524288 --field-trial-handle=1908,i,1740766933853095642,2015595337383386677,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:13
  2⤵
  PID:3676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3124,i,12045757082413774067,16579799843277188743,2097152 --field-trial-handle=1908,i,1740766933853095642,2015595337383386677,262144 --variations-seed-version --mojo-platform-channel-handle=3168 /prefetch:1
  2⤵
  PID:3716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3128,i,6231966555839818929,16123992375999279443,2097152 --field-trial-handle=1908,i,1740766933853095642,2015595337383386677,262144 --variations-seed-version --mojo-platform-channel-handle=3188 /prefetch:1
  2⤵
  PID:2984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4688,i,11251460096142449066,11528595305231095125,2097152 --field-trial-handle=1908,i,1740766933853095642,2015595337383386677,262144 --variations-seed-version --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:5956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4824,i,3271676323117777621,14312341837966645376,2097152 --field-trial-handle=1908,i,1740766933853095642,2015595337383386677,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:1
  2⤵
  PID:6728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4988,i,18297157336138478112,11121404330278411437,524288 --field-trial-handle=1908,i,1740766933853095642,2015595337383386677,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:14
  2⤵
  PID:2352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5176,i,596388566620354230,15927855221456111700,524288 --field-trial-handle=1908,i,1740766933853095642,2015595337383386677,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:14
  2⤵
  PID:524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5532,i,987039810465396533,12560324610113222158,524288 --field-trial-handle=1908,i,1740766933853095642,2015595337383386677,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:14
  2⤵
  PID:2812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5600,i,6400519021519818021,2035619377490875607,2097152 --field-trial-handle=1908,i,1740766933853095642,2015595337383386677,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:4480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5632,i,4890308958478494369,114520694569158009,2097152 --field-trial-handle=1908,i,1740766933853095642,2015595337383386677,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:4256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5800,i,5359734118491621715,3845895280510213083,2097152 --field-trial-handle=1908,i,1740766933853095642,2015595337383386677,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:1
  2⤵
  PID:5760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5624,i,2127733405403659038,6639708255281268858,2097152 --field-trial-handle=1908,i,1740766933853095642,2015595337383386677,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:1
  2⤵
  PID:1524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6460,i,13741717906744226454,1713211152006374729,2097152 --field-trial-handle=1908,i,1740766933853095642,2015595337383386677,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:1
  2⤵
  PID:1104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6252,i,9266218394542272212,17357249115852677091,2097152 --field-trial-handle=1908,i,1740766933853095642,2015595337383386677,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:1
  2⤵
  PID:4880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5676,i,13617898632899729447,7304672877872592872,2097152 --field-trial-handle=1908,i,1740766933853095642,2015595337383386677,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:1
  2⤵
  PID:4700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5492,i,16947959820338492035,10943006198317733198,2097152 --field-trial-handle=1908,i,1740766933853095642,2015595337383386677,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:1
  2⤵
  PID:3376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5704,i,1936955555638323354,11614839023712156062,2097152 --field-trial-handle=1908,i,1740766933853095642,2015595337383386677,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:1
  2⤵
  PID:2404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6220,i,11147960777224745412,5379480209505375545,2097152 --field-trial-handle=1908,i,1740766933853095642,2015595337383386677,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:1
  2⤵
  PID:6264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=3316,i,17536318388683252276,2739361122103960822,2097152 --field-trial-handle=1908,i,1740766933853095642,2015595337383386677,262144 --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:1
  2⤵
  PID:4820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=3168,i,18063445640696957221,10235722634254761455,2097152 --field-trial-handle=1908,i,1740766933853095642,2015595337383386677,262144 --variations-seed-version --mojo-platform-channel-handle=4740 /prefetch:1
  2⤵
  PID:1208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5636,i,9642205285679955497,8873061138569498831,524288 --field-trial-handle=1908,i,1740766933853095642,2015595337383386677,262144 --variations-seed-version --mojo-platform-channel-handle=4724 /prefetch:14
  2⤵
  PID:4392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=5880,i,3820610047557390886,7969265413832855112,524288 --field-trial-handle=1908,i,1740766933853095642,2015595337383386677,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:12
  2⤵
  PID:3136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=5836,i,508607716696642328,17073538798273292018,2097152 --field-trial-handle=1908,i,1740766933853095642,2015595337383386677,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:1
  2⤵
  PID:6548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=6312,i,8272354012540076778,17806122042191791991,2097152 --field-trial-handle=1908,i,1740766933853095642,2015595337383386677,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:1
  2⤵
  PID:4492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=6716,i,4331509682108451671,3397194959734262976,2097152 --field-trial-handle=1908,i,1740766933853095642,2015595337383386677,262144 --variations-seed-version --mojo-platform-channel-handle=6860 /prefetch:1
  2⤵
  PID:4200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=6292,i,6076292022568851912,1095021415770557855,2097152 --field-trial-handle=1908,i,1740766933853095642,2015595337383386677,262144 --variations-seed-version --mojo-platform-channel-handle=4776 /prefetch:1
  2⤵
  PID:956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=6156,i,4465440413624848802,7333412827328002389,2097152 --field-trial-handle=1908,i,1740766933853095642,2015595337383386677,262144 --variations-seed-version --mojo-platform-channel-handle=6764 /prefetch:1
  2⤵
  PID:3600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6172,i,14284875391861769622,18139113729494221647,524288 --field-trial-handle=1908,i,1740766933853095642,2015595337383386677,262144 --variations-seed-version --mojo-platform-channel-handle=4740 /prefetch:14
  2⤵
  PID:5336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4744,i,16711864375458513049,2085188015144601510,524288 --field-trial-handle=1908,i,1740766933853095642,2015595337383386677,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:14
  2⤵
  PID:7060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6320,i,12297097914153466629,18176377892198114717,524288 --field-trial-handle=1908,i,1740766933853095642,2015595337383386677,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:14
  2⤵
  PID:6276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=4840,i,8078344718191454462,16731503755920976139,2097152 --field-trial-handle=1908,i,1740766933853095642,2015595337383386677,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:1
  2⤵
  PID:2828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4744,i,983810758657859737,1004985350819972626,524288 --field-trial-handle=1908,i,1740766933853095642,2015595337383386677,262144 --variations-seed-version --mojo-platform-channel-handle=6832 /prefetch:14
  2⤵
  PID:3948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3224,i,10104267253295856875,13673410438411687640,262144 --field-trial-handle=1908,i,1740766933853095642,2015595337383386677,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=3436,i,3824357337776665933,275188389682901802,2097152 --field-trial-handle=1908,i,1740766933853095642,2015595337383386677,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:1
  2⤵
  PID:7096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6408,i,18417372701499288627,696004094804730787,524288 --field-trial-handle=1908,i,1740766933853095642,2015595337383386677,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:14
  2⤵
  PID:5832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --metrics-shmem-handle=4820,i,12782847579266362510,1302019283469348350,2097152 --field-trial-handle=1908,i,1740766933853095642,2015595337383386677,262144 --variations-seed-version --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:4420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3404,i,18223067881694283311,11736104361568319743,524288 --field-trial-handle=1908,i,1740766933853095642,2015595337383386677,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:14
  2⤵
  PID:2508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --metrics-shmem-handle=3280,i,4116180539886036415,9320274979328821887,2097152 --field-trial-handle=1908,i,1740766933853095642,2015595337383386677,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:1
  2⤵
  PID:2916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --metrics-shmem-handle=3360,i,17406558443005343644,17222498413647650412,2097152 --field-trial-handle=1908,i,1740766933853095642,2015595337383386677,262144 --variations-seed-version --mojo-platform-channel-handle=6704 /prefetch:1
  2⤵
  PID:5868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4608,i,15806673779019095593,10497148926195815185,524288 --field-trial-handle=1908,i,1740766933853095642,2015595337383386677,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:14
  2⤵
  PID:6932

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5676

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2172

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:6068

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:392

C:\Users\Admin\Downloads\Xeno-v1.3.55\Xeno-v1.3.55\Xeno.exe
"C:\Users\Admin\Downloads\Xeno-v1.3.55\Xeno-v1.3.55\Xeno.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:6384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.NETCore.App&framework_version=9.0.0&arch=x64&rid=win-x64&os=win10&gui=true
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  PID:4724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e8,0x2ec,0x2f0,0x2e4,0x34c,0x7ff98c26c188,0x7ff98c26c194,0x7ff98c26c1a0
    3⤵
    PID:1028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1996,i,2955544914624714362,11040536973378219008,524288 --field-trial-handle=2116,i,5322226325359625596,8206167643183438638,262144 --variations-seed-version --mojo-platform-channel-handle=2156 /prefetch:11
    3⤵
    - Downloads MZ/PE file
    - System Time Discovery
    PID:916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,5953652115440174806,16640854566165732666,262144 --field-trial-handle=2116,i,5322226325359625596,8206167643183438638,262144 --variations-seed-version --mojo-platform-channel-handle=2112 /prefetch:2
    3⤵
    PID:5680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2444,i,4723715800015215092,15339777693863765673,524288 --field-trial-handle=2116,i,5322226325359625596,8206167643183438638,262144 --variations-seed-version --mojo-platform-channel-handle=3120 /prefetch:13
    3⤵
    PID:980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3556,i,12523212443230661938,653152903389620587,2097152 --field-trial-handle=2116,i,5322226325359625596,8206167643183438638,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
    3⤵
    PID:4272
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3640,i,13521549226575197025,12322651651110601833,2097152 --field-trial-handle=2116,i,5322226325359625596,8206167643183438638,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:1
    3⤵
    PID:6096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4380,i,1719365465164731349,16420302987438902198,2097152 --field-trial-handle=2116,i,5322226325359625596,8206167643183438638,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:1
    3⤵
    PID:6644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5224,i,13447888401276849363,5309363719721040094,2097152 --field-trial-handle=2116,i,5322226325359625596,8206167643183438638,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:1
    3⤵
    PID:5796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5400,i,8881264579449421899,17883588863493362397,2097152 --field-trial-handle=2116,i,5322226325359625596,8206167643183438638,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:1
    3⤵
    PID:5748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5540,i,3700626893302715765,18315238615551569800,2097152 --field-trial-handle=2116,i,5322226325359625596,8206167643183438638,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:1
    3⤵
    PID:2652
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3556,i,9331237599248867473,18116148090520154334,2097152 --field-trial-handle=2116,i,5322226325359625596,8206167643183438638,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:1
    3⤵
    PID:6288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5356,i,6210434229379831263,14888194829134392674,524288 --field-trial-handle=2116,i,5322226325359625596,8206167643183438638,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:14
    3⤵
    PID:5800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5908,i,8103490111874031078,5268195988503679587,2097152 --field-trial-handle=2116,i,5322226325359625596,8206167643183438638,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:1
    3⤵
    PID:1588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6508,i,16728835951628420533,12993858568042701166,524288 --field-trial-handle=2116,i,5322226325359625596,8206167643183438638,262144 --variations-seed-version --mojo-platform-channel-handle=6552 /prefetch:14
    3⤵
    PID:2508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6504,i,13125067599467636716,6055099667598354053,524288 --field-trial-handle=2116,i,5322226325359625596,8206167643183438638,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:14
    3⤵
    PID:2868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7264,i,1737574862602679851,14745772474086024777,524288 --field-trial-handle=2116,i,5322226325359625596,8206167643183438638,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:14
    3⤵
    PID:1196
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7328,i,4174416247473018011,1609264123568847380,524288 --field-trial-handle=2116,i,5322226325359625596,8206167643183438638,262144 --variations-seed-version --mojo-platform-channel-handle=7364 /prefetch:14
    3⤵
    PID:3720
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7328,i,4174416247473018011,1609264123568847380,524288 --field-trial-handle=2116,i,5322226325359625596,8206167643183438638,262144 --variations-seed-version --mojo-platform-channel-handle=7364 /prefetch:14
    3⤵
    PID:2352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5776,i,5564814511367136533,11264792989258377092,524288 --field-trial-handle=2116,i,5322226325359625596,8206167643183438638,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:14
    3⤵
    PID:672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5748,i,2856270064570346859,7227852012504052703,524288 --field-trial-handle=2116,i,5322226325359625596,8206167643183438638,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:14
    3⤵
    PID:2400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6228,i,8531365410830915885,15305261010283830242,524288 --field-trial-handle=2116,i,5322226325359625596,8206167643183438638,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:14
    3⤵
    PID:4660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    PID:2352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2dc,0x7ff98c26c188,0x7ff98c26c194,0x7ff98c26c1a0
      4⤵
      PID:4844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1524,i,4133543941636746748,16268216859696187650,262144 --field-trial-handle=2164,i,4770382536329265806,17732442665932331094,262144 --variations-seed-version --mojo-platform-channel-handle=2152 /prefetch:2
      4⤵
      PID:4412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1668,i,15022292991537997245,14927089895482404622,524288 --field-trial-handle=2164,i,4770382536329265806,17732442665932331094,262144 --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:11
      4⤵
      System Time Discovery
      PID:880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2480,i,3809787651598110820,13904410784138367139,524288 --field-trial-handle=2164,i,4770382536329265806,17732442665932331094,262144 --variations-seed-version --mojo-platform-channel-handle=2944 /prefetch:13
      4⤵
      PID:1708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4468,i,5457374800018489501,16394321735870102153,524288 --field-trial-handle=2164,i,4770382536329265806,17732442665932331094,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:14
      4⤵
      PID:4780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4468,i,5457374800018489501,16394321735870102153,524288 --field-trial-handle=2164,i,4770382536329265806,17732442665932331094,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:14
      4⤵
      PID:2400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5096,i,6924024817816013202,11511939704488030960,2097152 --field-trial-handle=2164,i,4770382536329265806,17732442665932331094,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:1
      4⤵
      PID:6972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=5100,i,7334547959378524626,4398504598687076124,2097152 --field-trial-handle=2164,i,4770382536329265806,17732442665932331094,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:1
      4⤵
      PID:4184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5644,i,14414383273040139999,4113761019327305043,524288 --field-trial-handle=2164,i,4770382536329265806,17732442665932331094,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:14
      4⤵
      PID:6108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5652,i,14480753833935443487,13305553932587702677,524288 --field-trial-handle=2164,i,4770382536329265806,17732442665932331094,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:14
      4⤵
      PID:4964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=6136,i,715466689696802469,9715850688557413132,2097152 --field-trial-handle=2164,i,4770382536329265806,17732442665932331094,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:1
      4⤵
      PID:1168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6328,i,5690101419334950933,4898845086243139988,524288 --field-trial-handle=2164,i,4770382536329265806,17732442665932331094,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:14
      4⤵
      PID:3056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6324,i,3242693238133818186,1582328337982493893,524288 --field-trial-handle=2164,i,4770382536329265806,17732442665932331094,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:12
      4⤵
      PID:1316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
      4⤵
      Enumerates system info in registry
      PID:1556
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x328,0x7ff98c26c188,0x7ff98c26c194,0x7ff98c26c1a0
        5⤵
        
        PID:2440
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1672,i,7662033823167557429,11878976744264747089,262144 --field-trial-handle=2264,i,4211396465848508911,15146303621874605389,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:2
        5⤵
        
        PID:4480
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1872,i,6615368534545608301,5847875568260862931,524288 --field-trial-handle=2264,i,4211396465848508911,15146303621874605389,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:5880
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2552,i,1891170325874050072,17485863208586937277,524288 --field-trial-handle=2264,i,4211396465848508911,15146303621874605389,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:13
        5⤵
        
        PID:3908
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4464,i,6298085506156907586,17567226948671973243,524288 --field-trial-handle=2264,i,4211396465848508911,15146303621874605389,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:14
        5⤵
        
        PID:2588
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4464,i,6298085506156907586,17567226948671973243,524288 --field-trial-handle=2264,i,4211396465848508911,15146303621874605389,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:14
        5⤵
        
        PID:3284

C:\Users\Admin\Downloads\Xeno-v1.3.55\Xeno-v1.3.55\Xeno.exe
"C:\Users\Admin\Downloads\Xeno-v1.3.55\Xeno-v1.3.55\Xeno.exe"
1⤵
PID:5500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.NETCore.App&framework_version=9.0.0&arch=x64&rid=win-x64&os=win10&gui=true
  2⤵
  PID:3376

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4168

C:\Users\Admin\Downloads\Xeno-v1.3.55\Xeno-v1.3.55\Xeno.exe
"C:\Users\Admin\Downloads\Xeno-v1.3.55\Xeno-v1.3.55\Xeno.exe"
1⤵
PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.NETCore.App&framework_version=9.0.0&arch=x64&rid=win-x64&os=win10&gui=true
  2⤵
  PID:4376

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6428

C:\Users\Admin\Downloads\windowsdesktop-runtime-9.0.17-win-x64.exe
"C:\Users\Admin\Downloads\windowsdesktop-runtime-9.0.17-win-x64.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5764
- C:\Windows\Temp\{C3592207-E322-4934-AF4C-43995211AE32}\.cr\windowsdesktop-runtime-9.0.17-win-x64.exe
  "C:\Windows\Temp\{C3592207-E322-4934-AF4C-43995211AE32}\.cr\windowsdesktop-runtime-9.0.17-win-x64.exe" -burn.clean.room="C:\Users\Admin\Downloads\windowsdesktop-runtime-9.0.17-win-x64.exe" -burn.filehandle.attached=748 -burn.filehandle.self=752
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  PID:6028
- - C:\Windows\Temp\{12491003-2023-4803-AF93-678DA2CE9A14}\.be\windowsdesktop-runtime-9.0.17-win-x64.exe
    "C:\Windows\Temp\{12491003-2023-4803-AF93-678DA2CE9A14}\.be\windowsdesktop-runtime-9.0.17-win-x64.exe" -q -burn.elevated BurnPipe.{A35FB346-555D-44F5-9E84-FCA299CFE64B} {CC73C6E9-BAF2-499C-98FB-F7803BFCC571} 6028
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:5264

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3044
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding AC91E7D1550053240CBBAD5843878AEC
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5000
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding E4B5B179416B4B5B2B73751DE562E4B6
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2248
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding CB14D794698706A860DED2B34B753B57
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5640
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding E851F3EF7C295555C187F496C55A5178
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3116

C:\ProgramData\Package Cache\{df745324-5cb5-434e-80ec-1238a7c258a3}\windowsdesktop-runtime-9.0.17-win-x64.exe
"C:\ProgramData\Package Cache\{df745324-5cb5-434e-80ec-1238a7c258a3}\windowsdesktop-runtime-9.0.17-win-x64.exe" /burn.runonce
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6276
- C:\ProgramData\Package Cache\{df745324-5cb5-434e-80ec-1238a7c258a3}\windowsdesktop-runtime-9.0.17-win-x64.exe
  "C:\ProgramData\Package Cache\{df745324-5cb5-434e-80ec-1238a7c258a3}\windowsdesktop-runtime-9.0.17-win-x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_9.0.17_(x64)_20260620014845.log"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6288
- - C:\ProgramData\Package Cache\{df745324-5cb5-434e-80ec-1238a7c258a3}\windowsdesktop-runtime-9.0.17-win-x64.exe
    "C:\ProgramData\Package Cache\{df745324-5cb5-434e-80ec-1238a7c258a3}\windowsdesktop-runtime-9.0.17-win-x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{df745324-5cb5-434e-80ec-1238a7c258a3}\windowsdesktop-runtime-9.0.17-win-x64.exe" -burn.filehandle.attached=560 -burn.filehandle.self=580 /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_9.0.17_(x64)_20260620014845.log"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2752

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6228

C:\Users\Admin\Downloads\Xeno-v1.3.55\Xeno-v1.3.55\Xeno.exe
"C:\Users\Admin\Downloads\Xeno-v1.3.55\Xeno-v1.3.55\Xeno.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:7068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/xe-no
  2⤵
  PID:2840
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Xeno.exe --webview-exe-version=1.3.55+87ae4f96f8a0927052c1120167982fb069afd1b4 --user-data-dir="C:\Users\Admin\Downloads\Xeno-v1.3.55\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=7068.2028.6057032423624976294 /pfhostedapp:bafa41f67970133927630457e720340d3db81a40
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  PID:5680
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\Downloads\Xeno-v1.3.55\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView /prefetch:4 /pfhostedapp:bafa41f67970133927630457e720340d3db81a40 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\Downloads\Xeno-v1.3.55\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x160,0x188,0x18c,0x164,0x194,0x7ff99ee25fd8,0x7ff99ee25fe4,0x7ff99ee25ff0
    3⤵
    PID:4824
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\Xeno-v1.3.55\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView" --webview-exe-name=Xeno.exe --webview-exe-version=1.3.55+87ae4f96f8a0927052c1120167982fb069afd1b4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1764 --field-trial-handle=1768,i,2462712575577122846,2796001603757674027,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:bafa41f67970133927630457e720340d3db81a40
    3⤵
    PID:5416
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\Xeno-v1.3.55\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView" --webview-exe-name=Xeno.exe --webview-exe-version=1.3.55+87ae4f96f8a0927052c1120167982fb069afd1b4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=1992 --field-trial-handle=1768,i,2462712575577122846,2796001603757674027,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:bafa41f67970133927630457e720340d3db81a40
    3⤵
    PID:1356
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\Xeno-v1.3.55\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView" --webview-exe-name=Xeno.exe --webview-exe-version=1.3.55+87ae4f96f8a0927052c1120167982fb069afd1b4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=1960 --field-trial-handle=1768,i,2462712575577122846,2796001603757674027,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:bafa41f67970133927630457e720340d3db81a40
    3⤵
    PID:1464
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\Xeno-v1.3.55\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView" --webview-exe-name=Xeno.exe --webview-exe-version=1.3.55+87ae4f96f8a0927052c1120167982fb069afd1b4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3516 --field-trial-handle=1768,i,2462712575577122846,2796001603757674027,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:bafa41f67970133927630457e720340d3db81a40 /prefetch:1
    3⤵
    PID:1996

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1052

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5b41bc.rbs

Path C:\Config.Msi\e5b41bc.rbs
Size 48KB
SHA256 dd52df0ad1a14bdd42e9bcae10f4b774effed480ed762da42398ed0e3282340c
MD5 422ea1102ff896b3ab3a50e4fc70d079
SHA1 5ab3d195bb7b2e4d291f38449e28537ff076df59
SHA512 4e07187d6aa57367a70093c8c271fbb5e8eec3c862bf62bf5568c5cf5eef08d11f149fbd6f9ac38390c2369b0a075e51b0c7f801722de61b8ccf9fd1197e2ab3
SSDEEP 1536:WIeIsbuluVQiLKnJSF5pP3TkrgM2CH/Vppj2hzliBYjA0BYimR/34cVNV9W86uL0:w
TLSH
T116231F709B10C1E3F2327F628369BF4023518E9A5741CE9E96CD1129EED1FFA5AAD0D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5b41c1.rbs

Path C:\Config.Msi\e5b41c1.rbs
Size 9KB
SHA256 2b6cbda0fcad8c8c91e5aab48edd988f60cd9162c77bc600ca6602adb6b7bbde
MD5 5575b27d03e9f42b49bc069ebe070126
SHA1 45bfe85362e179880972f1ec80cfa80ab0c2179e
SHA512 1f4c95de25d3792f1ac76c3ab5772883ffdecb3a4fe389bd10775c9fc57ac69687867c30928d0509d7b6b3c9fe8fffcc7282b13b405e8f59e56f1b8fea191c6b
SSDEEP 96:7mfD5lDeELbrfjDt8CL3d3rQ4UDpeD2iLPqcCsTlZ4UDpeD2iLPqcC6jKW3iYDLK:yNo0PiCJgcr+Ivcr+sTEd4meu0pK
TLSH
T14812F016630487D3FEA72B34CB532B2037B6D2D5A714578B088D52201F57BC95EA46DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5b41c6.rbs

Path C:\Config.Msi\e5b41c6.rbs
Size 10KB
SHA256 349b9ad9170e8e50151d07b24e35c5f4827e7498fddc82c02c2ec6edb7c0d785
MD5 b17f46b33f9afbf622c263e78f145297
SHA1 52b955d2bd1e3698d68456f66eadcbecb1d5fd85
SHA512 1e71a829df27093bbacb902c86bade1f1c2dcb1f6e109d29009a2f4775039e2ef809774c1b121c066cbc02a6f577ce33f288c125f4d6d2d8c03ed16931692d98
SSDEEP 192:/rBUMPMrS4MkMz5Hrb09CIgYZr+IvWYZr+i7ETk9TBX0p/:/rBUMPMrS4MkMz5HPvYZrUYZrc0Bm
TLSH
T1C1223206B6408BD2F9A21B75DB07272537A3C6DAA30453CF09CE9128AF477D46EAC197
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5b41cd.rbs

Path C:\Config.Msi\e5b41cd.rbs
Size 88KB
SHA256 2b073d10850c1d52288274c38b3dba905d5196d7cb4bbd2f31588e9cc5339ab8
MD5 348722bd1e5298e32b44200d5ef446d1
SHA1 bdddbc87f78cb98dc7790c2d8b023bd0fbdea2c7
SHA512 6d64c95a92af16820c3d56d4c3c0ff5470bbed5a7ee38a32248871fc7d777ec71805819cc38aea24025cab132f0a0e29853c3cce4f537f370798b958c8ceda7a
SSDEEP 1536:29xAb8l/L17v20/hJq0pmrUtT8KhmcJRN70ftfqZEjiBq/C6TwhxhDD/zUbY5DMS:oElslv+FVOSSsNHA2Id
TLSH
T19693BD9DA711C185B8333A49CB3FEE096F194D7E93455AA50BC40136DAE2EA71BFC4D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ThirdPartyNotices.txt

Path C:\Program Files\dotnet\ThirdPartyNotices.txt
Size 77KB
SHA256 e8ddd95ac905467e4e519b446ca023fa00c31732bebd9b66e65101c712092ee7
MD5 406d07d20e58568365df0557629fadc6
SHA1 9ab5ba1ef3866afa75b8cf3c392b7dd3d7f52026
SHA512 c6025a947faa5dc2b41a14d75e228ca2bd0df094e8cef914c58a6d2f5854424972a647b2c8ca8173345e40ba7557843d03efa85c5098c6e0e6726377efc8a38f
SSDEEP 1536:HA9jHwsGfgg39/zwgAVkguQxrDjugtSEGepkWvrpX7anuqdLSVnfiStPq+3Lefrb:HA97w/ogz1AVxuMjHtSFULryLOgrGWwa
TLSH
T1F573A45F7E45077319E2C3916569A8C5F22FA02E3B6B2A44346EF248133B42DD6FF858
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000009

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000009
Size 23KB
SHA256 4d374f815118157d4ec62c285937df74fec28c75d9eec110f48d3e04cb321ba8
MD5 ce7b262351203b245322fe75044fb61e
SHA1 46fc201fa3a9a56cb91f3a08f4a380f6d2283e0a
SHA512 0af2f8fa0171107ca26b73d1eeed9599c0b67953e163441bf65dc3a5bae5c9aa82bdcc54255996e8d1d472db1b09ba3286859d595619f1706a8e61c464081dff
SSDEEP 384:zApz2RXdsOYVa2CE00K/4dJfoLdmiJo0zADElg9jIKauH6CwJ6k5zRv2LbFq:oamOTZE0hAdJfoxmiJ9zdC9SpCwJoFq
TLSH
T130B2E1833404A6947BFF27130CF66A08E6B2B67BF63273054465483E42B52FA5B5977C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 a2a1ddc724d9dce9668086477da2acfa469b38362fb2526c430aa2f08eaa34b7
MD5 98fcdffae394f72c45e5b439ba40b2e7
SHA1 60072bcf4d1dcf202088ca1a6515de1dda721872
SHA512 54454b5bbc8d48770b5f6596e3ee577633efeb9c0b3369853bba6945e2212da447d5a97087af5f5b7687de6ad3f94d0b8bb8e386827946ee432949ded3f5afcd
TLSH
T11E31A04D64993B74CFA86B7867C04C0C2B21E80A414B6E1A46B358B77DBFBA4459046B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 720B
SHA256 bb414c4afdd05ae295546f314dab7fc9f93b4e9373b592bdc8611308bbf274c1
MD5 e88c96bd19888b0f54735b2c8f030509
SHA1 33e56f562112db02a30c6c73f471e931ed33ab9d
SHA512 f4a6a807130e0e60264ed1b3cd2cd648f819b5eab51559ad3054a2803d6d0c2b17b6418c49ea5493a64a9192e42a838a765d3bc3258d35ce5e6e28ef0a431693
TLSH
T1FB018B8F6CE820C4CB99BBB0DBE0DC1C3760D89A405B5F0602A868B7D697BF9814459E
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 13KB
SHA256 4608b347f9322ab4b46be68c1a6939a5a43c91c5636a51edae0777f2b6bbeb9e
MD5 bfd12e2ae515b422fb20462f3ee2b3c8
SHA1 752d252e0644f9e5b9a4713a2f12e283fb5ef62b
SHA512 64e862f1f74dff66ba17cd6b58871fa875ecfedf55332074b9366f8bd1e9db1cbb2a8b2f81e2aee5962f072f0bb52458c33d7328e4610efdbc04c15bc6e4c81e
SSDEEP 384:D+2ytHmTkqJhJPUPIPrPnPKPEP4PiJ1nBIseMOR6SpulDU90JqSrmPfIP/GPjPwY:HHh6WbPgqGJsTUfW/0Te3cRmON/vnK4B
TLSH
T195528CF3C3D48A6DD82155F5AB142F2ECD2A1925432C3C26CED5AF0B97E2871E21164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 21KB
SHA256 3e71899daf40a64e97acb84734039791f81c96fe83fd36cef9235752c4cfcb8d
MD5 a54073495179c482ce8b9f6e1ab66d17
SHA1 4f8317ca4ea9353c00c30f39a01f5db45f5dca56
SHA512 83fc2105fd4be77ea7dca87b0f083f446052f7b4b444eaf4e61133b4f59f8101bbd54a03cffcf6bfeeb1edfa61b815f7f6d60fa7034b111539ad9c4955dd46d2
SSDEEP 384:D+2ytHmTkqJhJPUPIPrPnPKPEP4PiJ15QMrkw1CBXMOR6SpulDU90JqSrmPfIP/k:HHh6WbPgqGRsTUfW/0Te3cRmON/vnK4R
TLSH
T1B6A28CF3C3D8CA6DDC1156F5AB152F1ECE290925432C3C26C9D9AF0B97E2871E251A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 15KB
SHA256 73ae0e6518b2154c7194c5c36b9c3f0718c2fd3af068e28241b761cd3a2f4a4b
MD5 9fa872e78fdd3210ce5997f0f09ee4e9
SHA1 a67a7c25a4f051356777b38fec4ab3c96c3b7aa7
SHA512 88f3465c8d7877c302ed0ee48893055e0a29f583c036efc83fe238645f2910451cd35eb1abe41a1d199169fe2130851db0a1998d968d3984f766a6188907a600
SSDEEP 384:D+2ytHmTkqJhJPUPIPrPnPKPEP4PiJ15yBjeMOR6SpulDU90JqSrmPfIP/GPjPwp:HHh6WbPgqG8sTUfW/0Te3cRmON/vnK4s
TLSH
T163627CF3C3D48A6DDC2255F5AB142F1ACD2E1925432C3D26CDD5AF0B97E2871E21164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 3KB
SHA256 8e20fad9dcf343732d30c57d16af32f1d6041ed35672879236ad0126a09587dc
MD5 6d3547568d963865aa50d6dd893cdd3a
SHA1 bb575ccd1fb7e9b5b2e69fcf2935aa7992193e89
SHA512 3b991879be569564be241559aab7cbb97fa2acc0a6efcaa7aaad3ecafe907fb26a5282b8d037176f905c127c45f1c539f4b8eb4d4768fb5f030bbac5c83bb590
TLSH
T144819FABC6BEF41F507E0DAB1E54BC0519BAB4311152B8F9EF96922CA055CF72B02473
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 f813ef2ddebc93ce587ce7d1a36521de78238d6c39b37e5b9b0684cbb7b8e4af
MD5 add83afa8545acc045c48c5407fb2eff
SHA1 64543ae622d527040d0381c109d44013dfafb4a2
SHA512 555b5ea0daefba77afe59e90e70eca6d33babc1959b360d276d14e9bd389f6d15f6a18d3a7845843a829604eac5298c9a269a4686acaebb4935335e00d9e7417
SSDEEP 192:XRhgVUdv76JiAPRp2eui9AHsb+WNnmsXAOs/F23lemnVyIsnAUge:XRhgqdUXJ2wZV22lBe
TLSH
T15C32932AA914697F5CDBD219FE65BB67E2F5102272C02E84EAFCCB2C10D79CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 5315963c8be0f906eead273476da43525bfd65a86b801d9d35a6f9e4cca419e4
MD5 4629b1f1eeca73e8253b0f8315c5c700
SHA1 4a86f0cd953d62aeb18f0644a253d3d6c61af8ba
SHA512 4916d54956e4a39bab3a817b079a392a4fac6752ae29131e78819122f9129125d593c56905de0b33d3fa788ee3f90afdb4b7fcbfc97ee81edb46c4b4b3330ad4
SSDEEP 192:XRhgVUyv7/zJBXPRprewlv9AHsb+WNn1CmsX0CE/F2qlenn8yIsnAUgE:XRhgqeTX12wn65u2zME
TLSH
T13342A61AA924697F5CDBD219FD65BB66E2F5103272D02E84E6FCCB2C11E7ACC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 6e03abaab2f37d3b1f44db03f4116a2650adec6178c4e29c030e26653b9f32e6
MD5 a02d1bac75f1ab997007b7cbab0d9c8f
SHA1 2b2225f8098fcd7c68d5ed22a67930a327dbe8be
SHA512 014cfc5195fd53c1eb0584433bc77ac77804855c78108ff0ac544661406d83cb19773e115419dc5ed29309a819091b777afd74f2838d902e774b951f7d078468
SSDEEP 192:XRhgVUyv7/zJBAPRp2ewlv9AHsb+WNn1CmsX0CE/F2ilehn8yIsnAUgE:XRhgqemXY2wn65u2lME
TLSH
T11B42962AA914697F5CDBD219FE65BB67E2F5102271C02E84E6FCCB2C11E79CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 92d67417e51ef1c151be350359e5d60814859343fd5c4a436dd0fb819db5e987
MD5 03ef2bbe8d506f3db1ff308b0237e93b
SHA1 f1ddd5a40b8eb9f4834c9805e15a03e58979405c
SHA512 819dc4e99a88c863375d6736193d2eb1e5bfb3c799588942d3cfde7c794e991c5669febd0606f65a665303ef3863ab472ed0c093c7e0e9e83a86219988acaaf7
SSDEEP 192:NRdcBzcVPWv7/zJkXPRprNUQXLwlk9AHsb+WNTY51JSLF1c0CWTvsUKeBlenn8yN:NRdmzcBiSXGw2wM5WzCWWeUME
TLSH
T14A52B62BA924597B8DDBD619F951FB6AE2F5102272C01E84EAFCCB2C11D7ACC3203417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 69292eb3c6f29a859d9765d6b852ce73fcb41e244384cb16981adea8a1e14a3f
MD5 1e0b71014533a6760f986cc8ae17a386
SHA1 1798d6ce57ed9fd263edb1fc043c609a63994073
SHA512 2a2ee5e52e2697269ae9de3d131cbcb85cca6f32b943fd53860d0d6271d3c58fe08c2a2d5c770e676f074df3f8ea1e33dab3972502240af747949482c9d7290f
SSDEEP 192:XRhgVUdv7/zJBAPRp2ewlv9AHsb+WNn1CmsX0CE/F2ilehn8yIsnAUgE:XRhgqdmXY2wn65u2lME
TLSH
T12942952AA924697F5CDBD219FE65BB67E2F5102271C02E84E6FCCB2C11E79CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 8a546851a0e19b37831c8bfbfd96e16729516988ec05907a700d580164b12577
MD5 e6011a16530d3956963a171f7cb7c1aa
SHA1 ac8916cc6c4c54c3843dc5be17e936981aaec52d
SHA512 5b9d1c59f9a9f0e054f585b468575a9075cc4672ecf68bc3c5ab350e6509ac6c7e3a350008866fcb6bdf32daab1bfebd86247f5b32e40495c88cdce6411a87b1
SSDEEP 192:XRhcVUWv7/zJBXPRprNUvwlk9AHsb+WNn1CmsX0CEUKeWlenn8yIsnAUgE:XRhcqiTXGD2wn65eeHME
TLSH
T1EC42B62BA924697B9CDBD219FE55BB67E2F5102271C01E84E6FCCB2C01E7ACC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 8af1fab72d8b5fbc0c48398952849d858583a5cdc5e658185867e6ddcf9c18bf
MD5 2d59320fa3921e1536ad58574156aa1b
SHA1 aa4078a91869caed7785e83c18f7037e0910c814
SHA512 b519a2c37ee75a9908be2d1f03bab6fbe7d5b0726af1e512152e71cfc9827e84159907b6ce0e7766b459496cff565cfe87178b9d8e9136238990283d86d6bf2e
SSDEEP 192:XRhgVUdv7/zJiAPRp2ewli9AHsb+WNnmsXAOs/F29lemn8yIsnAUge:XRhgqdZXB2wZV227Me
TLSH
T19D42932AA924697F5CDBD219FE65BB67E2F5002272C02E84E6FCCB2C10D79CC6217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 af94bca764dee537322cd2bf703bcf5816b34662c41620af4ffba4c5d66fc418
MD5 b14560aebba11a8e708e2a5b1f7f0885
SHA1 54da37a860f74f689bc01848a950b67497acfbf1
SHA512 9f1aee3ac961da0b754989fc79f4730e175ba8547e6f19033fef02584508a63f5cc0b8a82197b96c53ec65ba4e8f5f4f3c48d76c1b83484baa9e542d3af6231e
SSDEEP 192:XRhgVUWv7/zJBXPRprNUvwlv9AHsb+WNn1CmsX0CEUKeWlenn8yIsnAUgE:XRhgqiTXGs2wn65eeHME
TLSH
T1BE42A61BA924697B9CDBD219FE55BB67E2F5102271C01E84E6FCCB2C01E7ACC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 d1e277aae102aa5d0c705693418ccaf096bbf71954fd55e413952b96a9345eb6
MD5 79d97801c2572187d66d6d77e240cd54
SHA1 98d5329de32efdd32c33b9f0edf35f4478abe26f
SHA512 51fc33ba522952a32719772b310a61068c7ad9a346213b5cf7ae6ebf6439c1201fe27ef76612debbb1e7a11883766720a0dce5a67b4095f23198e569996cf369
SSDEEP 192:eov4K6CE7KxkXqK4I40pUZNCgVLHrKHfFKslHgWXzKD/Vs+ErUkKNwMWLp/B4ZM:Jvj9E7KxkXqKf/pUZNCgVLH2HfgslAWZ
TLSH
T1AB32D927988D9D7F4FDCD50DDC166F8B6CF5029372680D2492FB9D0803E978A524A2BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Session_13426389998190505

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sessions\Session_13426389998190505
Size 20KB
SHA256 aef26aa28a59b733a28174df4ab6c1bf71136ee3a0ed33df8e40560c5c1742ef
MD5 6769483cee2d8c149157dc591ec9b2a5
SHA1 07049d7b705ecdc6f5caef270b25d5e85846625e
SHA512 a05b57722e9142b39a7800cf61da6a0c045287df552f059dfd5d00f43510cfb923bb6990c0dbe03c33fe81e952d0a6084820053c9c33c53604fdb208db076271
SSDEEP 192:3EYagi/YLnALnFOFalY/zUpkxqZp1csyJgVLjqrenayDSz4gS:lfi/YLnALnFOYlYckIjJ8z6
TLSH
T13FA28D6E3AE5013DF37ECA79C1B521B2A53AB6162D51CD0F40D0C30D6816B52FA72E6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 03aed2b95167bd0a524063feceb5c6b4dbacefc54fdd7613b88fd8464c6040b1
MD5 a489bf14e75a53b2b7e707b766b13302
SHA1 4565bfe3d224426892b6238d54de751a4f2ce0b4
SHA512 28437a3813152e9cf5d93b964321abdcf2b50f221d1554eac765b56b3fc30b757589fd54f9105753c4d8f8b0915e53ae3e8d99c2f3c7ace3dcfcaddc964c8eb5
TLSH
T1C6A002AD01D23F65DD00027152E251D57321F92113869A5B91A4024D8CBA187C2013C0
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\2\CacheStorage\80703b26-9535-49f3-95b3-e603c2a09111\index-dir\temp-index
Size 72B
SHA256 5852070d8222bc615c9b8c4edc3ea31b49bbf5b1401a621d7b9654bff2036858
MD5 31699e2ec328a71db576e7dde11a0337
SHA1 d9f33fd09be13f5b7447e1a82573872fa3c6389e
SHA512 d50a9c63df2c5f915131ec9a8eb7b0f197951bb3d8fbdddf79ad8a3d10d810e07a8ad682eb7d188c05448c593b75cdbe1e371c0dec3a3aa76313d82b4770dcf6
TLSH
T13FA0029447C55045D05135B4F1060BA97741CC5005004B1384D00BCD8C611D4A915015
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 93B
SHA256 b993cbcf1c8fa11b7d2ea67ad80d2a47c161ec41523ba8fed530e190bd57b5a5
MD5 8244edf1488ed28c058eb74713a881c3
SHA1 245d0670c365eec1c332673e9f0a1dd763a19f5b
SHA512 765e37264547923b091ea62c1120b7868fcda6cd06976045e104c3b6950b20bdc0a91880ba4ecf29b85c133dfdc1485f8256f54b58ea158177f26e7d55fb3aa3
TLSH
T122B002FF0042ADC51E6134EF514671DDC52332CD5C94EA9C9475615873508FD3001D28
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe58b9d5.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\2\CacheStorage\index.txt~RFe58b9d5.TMP
Size 180B
SHA256 60c8574b92e6f6de848d53f799f987de9469c38206b92ee39229ce8aa4ae01af
MD5 2e50c7c0cefbb39fae625375097ac987
SHA1 73e4145a525ad2f7b542dbed2e95364e2b9b9259
SHA512 c3ab962706b955cd01e8168be44ee03e2bfef4f9a0ae817bf41d1698b80d7dc2ab271d2b0674b8972f49ca41876935fa0000055d4cb1149a879916be0594473d
TLSH
T1B7C012BB10C1D9D12A6624EB525672D8C9233ECF1C84964C442531442230C556500918
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 67438dd72676ffa42f6377dee8e2f5fdfeab2f3e7e28ec2c2a9a3687299e30be
MD5 58ea9f7ebee5eb72577a4678932505c0
SHA1 27fef7e8cb0a52eb07c9573e368febecb4aec72a
SHA512 a51a5d299048f54e81c7f0d0ff972e1c9fb1bb0ca0becc11977bc917045a307484bc27d9916e4b98e4c6540e076889087dcbf0ace5ff91bfc86e1b3ac7a7da1e
SSDEEP 96:UMbJ6bod+klsgvZRFKs+X71f/glDSl8h4otop5KpJDhB6PGovE1BLcV3HHyiC/sa:htbfls4fFKs6lciU2oZX7TBLcViiC/jn
TLSH
T188C11A7178785CB649FBD84AB4037E03CDB0A1AFA651AE94DAE98F0D01D79EC2346127
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 5eaf6bfbcaeb3fba2cea098055bcc35481d721ab53340977f32baac85c2a8f31
MD5 dac1ea83e7491ff5691ab39d18573c6b
SHA1 14c0f231b9f3869e34a28c20c3498d51a5b3bd7b
SHA512 a97dca3209fc6b967e5b34942babc253ddf95f0be2bb6abc75a91844f242211ac1725053b70f9429c0c716feff9ba6ad823f0e37f053f2b63bdbf09c89c658d7
SSDEEP 96:UMC6bod+klsgvZRFKs+X71f/glDSl8h4otop5KpeDhB6XGGfvE1BLcV3HHyiC/sa:hCbfls4fFKs6lciU2o4XCvIBLcViiC/b
TLSH
T152C12C7174785CB649FBD84AB4037E03CDB4A1ABA6519E54DEE98F0D01D75EC2342127
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 6KB
SHA256 f502c8da197033a9ee98a23185778c65c8b2e41eeaf2ab5cd32ba2be84f9a031
MD5 1b7c41aa25d8e714f0988400c354bad0
SHA1 91b1fd27e558996b904614fdcd3aefe859f0e868
SHA512 3a377afa8c27cb7867eb6cdbb02ddc90ce4483f09e5d9da48cb87ad7d0ebd3b009c321ba68d0175f8fc3804f69765129ff676c9c18c5974151676e5e5130b3a6
SSDEEP 192:htjfls4fFKs6lciUDogX7TBLcWzC/4u8xzjV:htjlbws6lc0Qi5/4u8BB
TLSH
T138D11871A82D4C7B4DFBA84AB1437E038DA8516BBA507E58E9ED5F4C01D78EC1382237
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 551845afd37047a7c986afdf5c9b353a3ab01c8d6bd40cbb81db2a0868fe5af5
MD5 4a1e0b05d02b3dcb19afb26d82b894bb
SHA1 36bea932d80fab9bff515220525c9eaa9376ddb2
SHA512 b11cc4f8ce9f7fd05def256cd59977af94069f8c0769044e7ea0cc864173b9cad948ec826b7b91a218a92878c90f7c7b8ed880e824b474228ec856744d54cad4
SSDEEP 96:UuC6bod+klsgvZRFKs+X71f/3Rl1RDotok5KpqDhB6eGyvE1BL+z/sdbEs3v4a:BCbfls4fFKs6l3DDUDoMX6tBL+z/AbF
TLSH
T13DA1F772B4388DB789BAD989B5967E03CEB8615BF5915E80D9ED5F0C00A74EC1341137
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 a15c001fa25c93ec50fd2d2315d3684494779b36be3fa11f31c93b7c4c88c5c1
MD5 bf46b803650d2f76ddc6687898521181
SHA1 e1b26075c256c05a93e9e6561cb07d6d0a73bd7e
SHA512 0fb1315a68d135dd97c463fa9cb5ae25e81f77fa415dbf5b86a630c5bde4710f4f4aaf9205346f0aca6c2b7fc66ba582a25f5b55280d0289f52384cdbb5bdb97
SSDEEP 96:UMbJ6bod+klsgvZRFKs+X71f/glDSl8h4otop5KpLDhB6PGovE1BLcV3HHyiC/sa:htbfls4fFKs6lciU2o/X7TBLcViiC/jn
TLSH
T1B9C11A7178785CB649FBD84AB4037E03CDB0A1AFA651AE94DAE98F0D01D79EC2346127
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 6KB
SHA256 07c2ba2778c97ee15cdf5e39d4ed5e40e671a6c520b80d0590a49365e72cf1e1
MD5 e8ab6e3d1c19bd8b5c92b301c286d3f3
SHA1 ce527a1ec53992c73a3d175dd97457acee94a3b1
SHA512 3a6f66fde0669cd2d31c94dccec8a793df17d0fda53652728830049235c8db4679c59632ad57979bf9833692915f23217e6e79fc3c2d8138573faf82d076e574
SSDEEP 192:htbfls4fFKs6lciU2o/X7TBLcWIC/4uCui:htblbws6lcVvi4/4uCR
TLSH
T15EC1F871A86D8C7B4EFBA94971432E038DB8616BBA507E94E9ED5F0C01D78DC1382137
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 6KB
SHA256 f292f5bfd376370c1a4bf152f8d1a67f5ad9f923c1d6f5e7bf978d7b13203533
MD5 38c8d76348b62b0c2dd507521f1443ea
SHA1 30f40b2ca217454775a0820024733a839328e87b
SHA512 300b514f94f0db2445c937764eccb3ed6f40854ee9f936d44e32c1079460e21de61dd66f3a92765a48035bcec8f49a9310f1e0abaf9345b24e319831680ea7f5
SSDEEP 192:htbfls4fFKs6lciU2oiX7TBLcWIC/4uCui:htblbws6lcVai4/4uCR
TLSH
T135C1F871A86D8C7B4EFBA84971432E038DB8516BBA507E94E9ED5F0C01D78DC1382137
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 35266fa3d70023fb7bd146f2423b8d723df305fd8dd053bc808d19a4feeb2bf7
MD5 d399b74630dba676eda617f3d571b0b9
SHA1 8c11dc3d3fbbba1b841a4e4704f1447ed1bd9d9a
SHA512 d85162c523b242814c1d99bb43ffc9893117982eb34d9389d94e6606ec4854e935d2057e0b89827bc05ec4670b76deb5c1ceaa77d0b30f1781c6fcdd1ea91de1
TLSH
T1CBD0A7113A3D78D2D13823758522426069595A53A362820A7999984DDCB90D4A6C1D97
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6d8a146085e02934b2f41c86e0c4610611efc000fc9ea222cee0d083b24d24f9
MD5 880f040b719bf1891e72feb07bb41cbd
SHA1 8b4341a450c0fc5e8e6fe21200666b96d32f5030
SHA512 0a634898eb6332c43975715385c90f96fed9427e98a6ec02d61b1b7ca43b4083e6a13960ba4e1712b6ff190b3a10dc8cb85590c05d6f6cce4f394052ff470fa9
TLSH
T101D023123B2D7C01C61473B0591247706A55C907E372C15E7EE9D84DDC5F0D4F6D5443
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4e5942c942b0528f38ead6ffe746ee3e9e4d086142ac1ef7960cc0296763f8c1
MD5 080b866cc9d858f5ed52a2af47d3bf01
SHA1 09e472c93152938dfb2f25e94f7917998fde0a3a
SHA512 4fe435c7194749c398ab2284c94a08d5136e21216fce12bf5e65347f77799c9b36228b4b740fef8fd60c6877ca2f4aa094fe94064d4b683c07469f5b867782f9
TLSH
T1ADD023513B2D7C01C6147370991247706A55C907E371C15E7AE9D84DDC5F0D4E6D5443
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7250e4ddb51fa53ec8c4b9199831864f7ff3c5cca1fbf2e4e5086ae0576d31e1
MD5 d67d9caab78f31b2ab2ae61fc88b12e8
SHA1 c439af9d2a4c79b1936d0b654cdf2b2a6da22a5c
SHA512 f8e3ffb5bbcb1740ce2b25ded24b3be72c6285c98433cf97d12acea2ff455dd8da18d81f9348060457962fde88e3e33b5654dc94e329100848cdec215f571788
TLSH
T1C3D0C0513B2DB402C1241330882343706D09C503E332C10635BD140CDCDA4C4A3C1547
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 fbfdc6639449912c7c98b931d8190c5dc58f3c2a0bf5687e437a1f10d8fb4d03
MD5 0648a8cda5509f4d21f145a8d2e85107
SHA1 0098998314a76ff86c61b0ea846ab42ba2d245f1
SHA512 d12c9f38e4b1be9f515149cbec2d53104d76f99eb87ea993bf787c888cea28fbc81e79244b64386a0c5a5111415c57c4251ad0e5528252f3302570bd3971bd56
TLSH
T1C1D0C0513B2DB402C1241370841343706D09C503E333C10639BDA40CDC9A4C4F3C1543
MD5 SHA1 SHA512 TLSH

Submit Download

6772ab1a-cd99-4394-94b2-271ccb0c538b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6772ab1a-cd99-4394-94b2-271ccb0c538b.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 0b04dc0efda178e85536f42d9e04678377ee292127795943dc08180e884b2ef8
MD5 6ab02b29a8601d7be147d2f7c6fbbe70
SHA1 ab27bfd9b43fc2f35ef2d6312e5ca197bab80629
SHA512 1b44110040778e79f3e54bb3dc8b5b77fa1484cb5999058e44dc445e317de99df394247d6d37c65aa5b3a7f4cc26228d97cc9229639e6155a2480b58aad57e7f
TLSH
T1C4E02BEAD831DD3B1CFC171C9494074AEB51130B3B50945F363E8A098FF5776458582C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 d97825eaf7e3ad6d59e8c717dca88cc43233a49450f2c785f7dea1a84e28ea51
MD5 7b5ddc01ea37ee3e137f64039b749e68
SHA1 f9a2bd381ac241de364f820625ae0ae9cd52c4c5
SHA512 accba48722cf8950584e36e64e13fc083bad4d007a6b3d6baf92ef51609ad9f9713ef678da49aeb5ae53b2865771a958a382e1bc4d2acea6228c979f1abbd02c
SSDEEP 96:ribO0VvQiPqP1sOBjPd0FGj1MWGtmi+hDHFjTlBM9PD6ezMojpZnIOry5Idx/KtX:ribO0VvQMqP1sOBjPd0FGjSWGtmi+hDL
TLSH
T1B9B1936D07AA0B27DBD65E7DB0E538663B7100888B476E2B4C8C57BB7D43BF1698110E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 4c44a0427ba60142573b0c421f9e9e67d23dcd9100ca84073f8c8c25f47b3430
MD5 d650e92ad8cc081665fe0d3bc5aa3451
SHA1 af37480bf275aa6372f302dae78d30066f42635a
SHA512 6347a9e866bc93857a1b7131c1b2916d977f82e7fe521baa70fb4e18a71af40d70ec218dd9f5fa5d8dce57adc3114f5b2127265bb7bd758ee7aede1f02794fe4
TLSH
T189712F6947CF4B36DB258E3DB4E524B93B7154484B0B6F238C9C577E5C427E17A8104E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5b4552.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5b4552.TMP
Size 3KB
SHA256 daeb23b3b9919f6d9c9a746a60e6b160ccae0781b56aafaef399e203b6c9b750
MD5 e35c5fd1477c39705ce54d29db9059f6
SHA1 b6b8a24e6248713aa781c69089c5b26940492901
SHA512 02bb8cbe89f8c5d226002209af3c3f71e7bbff49e3ac2c9a63a318cf07fb5acb713ca762e08ae4af556f3ddca12a6f21c39c694683f94a2005e4f8e9c75484a0
TLSH
T143712D9143DF4B36EB258E3CB0E120A93B3054584B0BAF130CDC57B9AC027F0B98105E
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 1006f2890bb9bfe8e20871aad5f6a54d612cc893fe2f181052e6af3651160f32
MD5 a74e80dd8aa840a7864114836621285d
SHA1 e62b144884bd7b5269a3cfaf5495a46e87476ea0
SHA512 a7d479102c6ebbb9546a237f26db8392b4814e85e648f9dae60d8eb0914914e0d89c7f015b5dbd23368066970f8f9aed5dce304294973ed6b551c4e471cf9d88
SSDEEP 3:MsEllllkEthXllkl2zEklLyNKlt:/M/xT02znGN+t
TLSH
T11D44040C7FD40C05C74010704013C7D40370D51017715F5334D1441F5CC55C00D40000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 bf87a2152612af9bdde1e233c814beb22dbebd2d1453928cb7cb0fda717da19e
MD5 dd026dc0935923581d57d7db2c263adf
SHA1 a14261d95ba45a5d9f9c4657d73620a7df5783f7
SHA512 fe60eb3de7bb12a4f859671de3fe6a3736c14249e68b1b061a528ab9917323b6c095966570eac163c5a53717b1b0bf0160855342eb2983a18f5cba0ef1829ab6
TLSH
T10B61B1F787B4856ECA1196F0A614AE2FDF2D0515432C3C6989E4EE27D3E3471E04265F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 f1a7cbc13f50cfbcb8df07d9d5dfce78b5e79ff17a7d6e107b4907d10deb7aa2
MD5 bee842a8da265b7cb54abd62e34e8160
SHA1 9ae14b668ae0eba77280a4dac36ebacec5004677
SHA512 474fdda4a45cd090176adcc868e6b96a93e9d5b5fc13712837f96ed2a689a300f50f057c75498669d4007c12a5c5e6e4d93c902a820ed7b84279a3b9071feca5
TLSH
T1C671C0F787B4856EDA1196F0AA18AE2FDF2D0515432C3C69C9D0AE27D3E3472E04265F
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 5d18c222a06849f112bb878e2628568d1487716072a6790deed28bb65cc9a24b
MD5 ac1886722314bc369830dc8a09cd0e55
SHA1 f87fbc2cc1ba260f93e46ab985d12f4632c1c3f3
SHA512 f35f1cab3cd56181bc76997a016e571479bda96dc4d80c4368a172a5b248e735add11cceb96690f04e5d2626498a5904b868733ec4d36155838af1837cd79b49
TLSH
T17821615BC57EF92F207A4D6F1D947C052ABAB831211168F9DA96832CF0519F30B19017
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 1015B
SHA256 7ec07212d1ceac9a68d7fd0d44854828103487ceac57e63eb5be2380a3fffb26
MD5 cfdd726f77273df63b7183549e4a29bf
SHA1 98818e8c833f3e0760b704ddf72d2b31f28b12a5
SHA512 697f555c8358f56acb9fc0aec34e611d332484ebf9cabf0d0ca8536e6cbf785c3147b1d5c0a7a30525365c2ab034c2af3e9fae1ed3995af84273421815e1e1b7
TLSH
T152117B1BC57EF82F207A4D6F2D9878052A76B8322521A8FDDE9A932CF0419F30B19016
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 3f8e712363f29e034b5e39a98cd7ac11c6a597b6fb6c8c42bd37f43b156737cd
MD5 6ab982e48cc36881605f20e9e7dd8340
SHA1 7a9e3984206a975ef0238180370ea875bc43f46a
SHA512 02c46fe2f8c4b8f69421efe639fb2566c841b8d136c12fadfc916c02021d18f3e3b1c2505d1f528f721236d9305414a0e68980d7c87c73acddc598bf76b6cb3c
SSDEEP 384:sxR7cFL/fysTWvydWz7QHZocinK/5HQ5OZyRTDfp/Ujt8H+:sPcL/fxYmWBcoK/5w5ayRHfR0v
TLSH
T13B82DA1AA538597B8DDBD619FA41BB63D2F91533A6905E449AFC8F0C00E7BDC210382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 7231ed9407790b65311f66cbfb03aaf35e8a8994b30ae1e6cf2dbc8a0942c70b
MD5 d1a0b04cf65250da763085f14768d42b
SHA1 c3c733f4662d9832377f788e0ddb5ee8de77022c
SHA512 945d81e89bc768b898634ee84349f652c164ca88939ff112446a8cac7c36c928ff2b9972e79d5e8e576501a732fac6cacd8aac84dc54bab9a483e9b6b246b227
SSDEEP 384:sxR7jTL/fys3qz7QHfciPK/515OZyG/TDfp/At8H+:sPvL/fpqQcKK/515ayG/HfRav
TLSH
T1CA72EA16A934997B8DDBD609FA81BF53D6F91573E2405E44AAFC8B0C10E7ADC211382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 66e046d93e1412dbda8d546681bafb0c95d0aef20e4514871988d5b748a329f4
MD5 d6205ee0a90f6e008e051f1e2df238a7
SHA1 36367ab2fef3bf1ecdc75a5c1023691a6c69e9aa
SHA512 31fba35741b701b016458997fed92de8a2a30490ecc7b8abfa3026453ea3b640db1900b85fc689736770520eb99c0b0ec7cf1a88469fea85ced1981335e5bbd1
SSDEEP 384:sxR7j1L/fys0Wvxqz7QHZHciPK/5v5OZy2/TDfp/Vt8H+:sPZL/fyYxqOcKK/5v5ay2/HfRPv
TLSH
T13982DA16A934997B8DDBD609FA45BF63D6F91533A2505E449AFC8B0C10E7BDC220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 fab3c4992ca179bee1015b1651c766ccf6fb6d008d365a7bf0b8f24afbbb1108
MD5 9be015cddb61d585056ed9174a820bc0
SHA1 2a4937731273cbd76a8c9c602d3c808868909e54
SHA512 c7ffe2a55ef77a12aad1089b3ef2f1548f9b95a36f2f9eaf2b80b314e51790d5d768c837adda94881d59cf30500fcd564aac4c134956403f5add927b0b4e0971
SSDEEP 384:sxRnjCL/fysETz7QHccip/5EfWTDfp/AjHk:sruL/feTrcY/5yWHfRF
TLSH
T1E372E916A934997B8DDBD609FA45BF53D2F91573E2805E44AAFC8B0C00E7ADC211382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 1dfe19147364dcb3cc1fe3ca356aac48023c2865b9071c0737e0c3068d4a26e5
MD5 3abe96a662baee661605338f2a7c3740
SHA1 4f62db2f7738f3b3469f445cd99b803b00e9161f
SHA512 ee452875ffe567c7030897279bff0de9333e60c17cb11948d72ad2f7a935794f6b19a0034b95f841d028b6fcd367fae8436fd1f8f2a45816f0dda9cebe2daa21
SSDEEP 768:hDiNNidNi/Jt7pLuL70DiEWg5Niuf+Xi08F1+UoAYDCx9Tuqh0VfUC9xbog/OV5/:hDiNNidNi/JbE70DiEWg5Niuf+Xi0u1b
TLSH
T1CCE2FC3B680CC77E4F844E9CED29BE9A6DE801CB96DCCD9447EA440C03C6AEB51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\e0d857a8-85f0-4aaf-b0fa-b30c2fd6e2c5\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 226B
SHA256 eb43622f5af8906b06f19884bfa94c98909e4ee9e1a5aa07848d4babc128262a
MD5 eb8b6d82ff7279b29847b83ddf9d814b
SHA1 e244a767a29948ed246a5cfcf59d282e5be0f7ce
SHA512 3a41f980ea1583752a40252145060ed721a358646c1e9b2f4a94d2e1e93454d697084a26622c412f855df45a9fbe3805539a0c1da326a70ee9419ea2b3e4f3f1
TLSH
T1D9D0A777E4D945A0D6FE4FA11B116A3F8AE07C88255668486011162E9D84F53A242EA2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 233B
SHA256 99b7e834e6a4980afe0ed5231bd2d1db8fb21174bc31103dadae2b5c73ea3ca3
MD5 3254469c5f864310a1c85ab745d5b537
SHA1 49e927f3fe34c17926aa0cbc64f20e72072dfbbb
SHA512 18cb9a8292ac538b381692e148087fcdef71a11f3c92c29de8a86c4458e3008bc62c1c6db485f0087568cb499f8df1775d87256079c0ac1bde072330024eea8b
TLSH
T1D9D0A777E4E945A0D7BA4BA11B21667F8AF07C88295168489012362E69B4B43A311FA2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5bb2d2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe5bb2d2.TMP
Size 138B
SHA256 921e5c462644644755eb5007161c0fd5795535f8e9c9d29079321027ae2497a6
MD5 c32410c7ad0b976c928a989b34d5779f
SHA1 2d8de31c5d30e98101f0b354e68918ebd9775488
SHA512 5688555748b4078eb5586048616869f10929b889ced63a45e9cf514ffdf95a60ce39974bd9f6ec8beef2d4426814f90c036598784a77796f586854d65940bef1
TLSH
T1D0C02BF3E08C0520C7384B500332563E47412CCC0D82848D6003313C1034F237102FF2
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 814d3df78b6d45d16660c5517023ff5d174efb2901a7f6536cecabb5baef4fb6
MD5 5cc318857409b579319b9e311032e11a
SHA1 82f53f8fd35360a80581685c47ad03b4a8b21380
SHA512 b4ca1ce0e9b4b2142451535e4d42d0e2d00cabd6ece450881e134505ebb51870594f9ebd2b432cd698538ce4a544d08c579a7f12a917d044659160d450c54b16
SSDEEP 384:TFUxVXrvC7WZd5J5PClV2Hlftp113RFJlbDNOzdXk:TFUxVXrvC7WZd5J5PClV2Hlftp113RFL
TLSH
T14CB22710797E224138FE6908E595955F234230B3306AA63B7BBD60E60E67E005FFDDE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 7bdc18f94b7511345fd56a13e184a0b5f9f5983f988be9727f6dac6309d249aa
MD5 2e0c1acd2af9728bc16eaa6186122ed1
SHA1 4b1ea1dd1dea1929865b67a39a3064707d54b150
SHA512 a7fe4f4033b4d5aefc691b06eabd0152ff782dfaad98266deeb6c5cf3c46f24f00fcd29221ce50cb594618482e5d5feb1bfb1e57a2bbc4765a8a158a041baa94
SSDEEP 768:CFXj+9N0wgv9zB1qGAwfbKpgKxx3JVi+044vW:39NEfwgKH3viVvW
TLSH
T167F20779CC61CA7F98EE7F88A70D66266DE40277C4B89888DBD90F0D80B359DF706815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 0686a1968de8e71cfe9dd78ec4d5fb71a5fdac2eee687a19c72897e5a560eda6
MD5 696d05149463e26db908fcb67b12f61d
SHA1 e5bc8201ac8828c2f1d4e14743ab7b0a94fad292
SHA512 d87eb656bb42f6b2d856b68f7b4dd894c3664b2494a0a3da812073f938bb88782b0ade4d5e4e39d1618488d9c6fb5ba53810b32a41bff5dc2fc10801ea990262
SSDEEP 384:neiF1tNn/s3n9Sd8ND8TUNTUlIRSu64QjRXfLO1qKioORwp590vITGT0IYuG8LkD:1F1j+9Yawg7eU1qGAwf90vi+0QNvE
TLSH
T1AFC23976DC64CAB7EDF64F95B70A764AAEE002A3C5D85AC8DAD85D4D00C72DD030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 4b5f8006f0f6a14861e11b2838aa14908729b5ec26856f155a7d9b000cbe27a9
MD5 22125113a585391d53301f93a74d14ac
SHA1 cf89a08ad7b4a4e94e491c8f1071885dadd61cba
SHA512 b6ce1ee12ed2d2a656e6490c5df12a6e610759c1054fe6138d62922e102218fb4c5efd6b3c92b067a6b09ed1291d4e08cfbcc74f5021c31c5d34d72be35591b0
SSDEEP 768:3F/j+9zDwgv94B1qGAwfbFH/v6t4KzXi+0n4vv:k9zLQF/CicXikvv
TLSH
T1E0F2177ADC61CE7F88EE7B88634D6626A9E00177C4B89988E7C80F0C907369CF746D15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 18a06ad95a39dbbcbbf2d825c6dd2c594ef26bda5af206bd0be2900cc96dc9bd
MD5 c21c1128f989de2d25b04588086d84d7
SHA1 06abd29e4dd22a0a8d513d08d904438c2b32246d
SHA512 69a4adeed9f35f729229020fec238748865168f314fbb7089d70e81c09474d7b367fff9212e3026c8b63e1b4e836a44f79e8dd4cdadce9dc8373b23592ffb783
SSDEEP 384:nHiF1tNn/s3n9Sd8N98TUNTUlIRSu6LPwRXfLO1qKioORwp5zXSOKoRITGT0IYuG:CF1j+9Y0wg7ad1qGAwfbrRi+0QNvE
TLSH
T1B0C24A72D864CE77ACE65BD5B74A7686AEF001A3C4C85EC8DAD85E4D00C72DD170BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 0199b0301746cc819cb9b3d256c01c620c44e67927ac30461dfa2e59157aa17c
MD5 0711b1138cf1e45828a17b57ab6187b8
SHA1 71aae9bba82e259e64f03cd7c593cdc2e8fc02bc
SHA512 50a4a92590646df75ca59ac229ea140a9ef759a02d0a00f2c573b5ec056f979271299348bde9eac0b0af30de17368fa593885415a9b6a3b5ea0a9a5bcabf3a9f
SSDEEP 384:nHiFBtNn/s3n9Ss8N98TUNTUlIRByu6xYcRXfLO1qKioORwp5zXSOKtRITGT0IrP:CFBj+9N0wgv9XB1qGAwfbkRi+044vW
TLSH
T156C24A32D864CE77ACE68BD5B71A7656AEF001A3C4C85EC8DAD85E4D00C72ED170BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XENO_CACHE.bin

Path C:\Users\Admin\AppData\Local\Xeno\XENO_CACHE.bin
Size 36B
SHA256 3bab55816f9c1c63b26bee8027a74983736938cfa748d9c91230391d4bacfb88
MD5 03b4e88d732421deccbdd05cb90b0513
SHA1 1ba9d3bd3af60ecc041e93251633b5a0fbac4d9b
SHA512 40e01403608fc8d8c0bc7bc6e1367a472778dea5d4dde4d242b37b0860d098075ac71cf24abd85c6b9ee67bf6adf80adaaf279a969f4477555807003276a2c75
MD5 SHA1 SHA512

Submit Download

settings.json

Path C:\Users\Admin\AppData\Local\Xeno\settings.json
Size 101B
SHA256 88e5c8567b1cad0fa2a42a21ac273a1ffb8a6992be41e5de548d11f281f4c373
MD5 7109faf92716c37ae9d65f89a2477be0
SHA1 de2903bb44600fd8a69649c395335d4fc226c5e0
SHA512 f41ca49622d3458c1365fd9f610e1c27fd3dd816ce5c910e785532dcc39d94ceb1a00991909cc247ab4b9e9da0ac583245168853d8bdcc235116f0a7a4538b2f
TLSH
T11CB09232984108FC01608299C841D80203118E0120662E02B4BE025928308346000FD8
MD5 SHA1 SHA512 TLSH

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

5d696d521de238c3.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms
Size 12KB
SHA256 a21aeaebbce37a2da83a826edcc33a7a38b8d554dc6b69608ea0980852396bac
MD5 d7910140cf313d5181ebf8fb59406a8e
SHA1 9af754848db8cf440e5a5b455654cff88efdf9f4
SHA512 69664ce712bfa4fe6987189fa0955533802e1793a522f7d82f270b6a24f651605a4bcb52a853d730268706978777d1dcf0ac5d3aee8c828972f8ed766b9dfcfa
SSDEEP 96:ZO9P8FCSTlRO9PU9O93y2FmKysTlRO9yNF6qX2jO9J4LhO96B3O9guf:Zg4gP4gtgz62jgJCg6hgz
TLSH
T1954214017BFA2945F2F78671B97737184FB6FC029929DE0E42D582080C62A505EA8F7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5d696d521de238c3.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms
Size 8KB
SHA256 34e070625edc322cdb59746384da2bd3bcf06f6970ce30923b446cb2e6dac2a3
MD5 f17acb15e38d93a4e2fadec982af8711
SHA1 b42eca5d774e1336948ece61c0627446a76c392b
SHA512 0950351a06ef04e7406c0b657c3168e1d6cc70a9e2eb5d43f9c78f51ad083a353776810f4548e96aff620d1768d341f036e10ce49ba8c7ea056ce8050b400cf4
SSDEEP 48:5CCdooXIWReRYJTeQ9ZUkUiKqeQSTltatLkCCdooXIGReRYJtrtDUfDLCCdooXIO:Ou9P8FCSTlWO9PU4O9J4LmO96BQO9guf
TLSH
T1200203017BFA1A45F2F38672B97337190FB7FC059A699A0E12D543080C616105AEDF7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Xeno-v1.3.55.zip

Path C:\Users\Admin\Downloads\Xeno-v1.3.55.zip
Size 6.8MB
SHA256 8339f51fffcb258a0f64e3369b5b334c035854715aa46640bec8b4773c0a1a8f
MD5 e0ebd1a8b712d0030cfad5c78f0d3255
SHA1 a1360a85cf8abaadd9e146c3ad52cdd193fce06e
SHA512 06c149b4c018fd228c8d7036dd0cd77efcd0a6fc29bdd456fd677abc62a4b0751b5db7f73940ea8432d9fa8e6581fa595e956b4be3ef26bb0a785082aaf6cf93
SSDEEP 196608:jNF9oPjPGBvG7bM0M2XaCzq/s+t284gQjJLiyBDE2:jNF6PjP/nMQhN84gu1DE2
TLSH
T1D366339CA6FC2C93F52922792D201BF87653F7812612941BA60C15F772DBE905783B2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\Downloads\Xeno-v1.3.55\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 0a171c74eda5d3d2d52b3a4eb29100b7601564d7c0e6b9095d06f45fd2defe8d
MD5 6343267272cacc03c9cb38790e29683f
SHA1 6768c42f51602ffff48acd20893cdc7b1c147d51
SHA512 128bb9746212a9b0d97beeddeeb412f841bf6247f4628ea765cd8e3cfab4d8f7ce4359ac02013feea3460dce05a9491f95776f8b484b0a149e8e9f08d422e813
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\Downloads\Xeno-v1.3.55\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 5ee07d725e6cc553da6894198308e628a3e977ba9a0bfe23e3703061b87d5fb6
MD5 5f89770dfdd5b2dfb90f72e3f2873037
SHA1 ae5491fb177e9c2099ccb129086f334d36dfaed8
SHA512 3cb988a19f749062d586ea5d9f006c0c0dc4cda25634bec601aa97d26d85ea2d13143a06e43af814a411cba31210e8023b26e356657ac810f7efc7ba1b22ca44
TLSH
T1EED0121637114238C0602673140265081800C54B400A4004A478853D1E441983E22441
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\Downloads\Xeno-v1.3.55\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\Downloads\Xeno-v1.3.55\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\Downloads\Xeno-v1.3.55\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\Downloads\Xeno-v1.3.55\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\Downloads\Xeno-v1.3.55\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView\Local State
Size 3KB
SHA256 e335cd8e7a75dd1b0a4259b08fe8187d753aeceb2970b8930529514a2ab9427c
MD5 c634717652756971bf2efe1c53955d43
SHA1 b3c67290e8f0aa149b62a0183640f6a72807d6ce
SHA512 6467639d59350646b8e7979d7cf3aa2c7de505f810c8f3663b232e4c8a2099151e9e68505a8b86b4893c2357a276b310159f751f1aeddd51cea061d4dcb48a66
TLSH
T18A71857AA964EA3B4DA28A057C8A3B07A7A1403BE9D13F54D6EC0F0C01C77DC1312C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\Downloads\Xeno-v1.3.55\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView\Local State
Size 2KB
SHA256 43f7c6b1ad1153801024e98bb454e8c46c6c9842e67de231d01c33d35dea277a
MD5 e5ca41527dbcd6ef538c713e5de79796
SHA1 7da3dd96c36afdc713e977c364de7aba7f3e8f33
SHA512 464a8172e3c1559c25fbb41c8701f28ebf03306d695324a11f42cb2ba1cf1266015c9d8a48b7775099a18513f4dc5429040e14f9b0e60a36e61563a3dc3e522c
TLSH
T17E519973AD14FB3789A286457D4E7A13DE7541AAAEA12F50D6DC0B0C00D769C2317C7B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe5bad63.TMP

Path C:\Users\Admin\Downloads\Xeno-v1.3.55\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView\Local State~RFe5bad63.TMP
Size 1KB
SHA256 8b7fe5d3133cabd5c4f9c7425d9733fbbd46de6530bb3ff4f977ded92df3ca5a
MD5 3b0f1455c5fbcd3446216751d49d249f
SHA1 ed10e36fa075891d9f3145a13a70119df4af21e1
SHA512 57c2096a4357d126b0dcb177fe20810fe04695a355becbc08b6940f2e72137dc02e9ffcdfa77f676e6ba76c024d49d32815b18cb1720f4e158aee1ce0aaa6754
TLSH
T1E63196B2D9A4AF325D529606358ABA9BAF20007FA6511E04A6CC4B1C01976DC763BC37
MD5 SHA1 SHA512 TLSH

Submit Download

MSI515C.tmp

Path C:\Windows\Installer\MSI515C.tmp
Size 219KB
SHA256 2bf33a9b9980e44d21d48f04cc6ac4eed4c68f207bd5990b7d3254a310b944ae
MD5 928f4b0fc68501395f93ad524a36148c
SHA1 084590b18957ca45b4a0d4576d1cc72966c3ea10
SHA512 7f2163f651693f9b73a67e90b5c820af060a23502667a5c32c3beb2d6b043f5459f22d61072a744089d622c05502d80f7485e0f86eb6d565ff711d5680512372
SSDEEP 3072:FVzl3qiEZybztEwiUx6D02cWVsV1v2vZR3X6j7zo6k2FkngTLrOrORT9flQnS6lg:FVIMEgXmEAR3oHon2VaFuG0eEp
TLSH
T1AF248D217494947EEAFA0832A57EDA71BF3DF2241760C8AEC3409D1E6D604C167B7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5b41bd.msi

Path C:\Windows\Installer\e5b41bd.msi
Size 27.5MB
SHA256 d87c6a255667b9e92018c80cb3952ae9350a0374560fd49b4f02079e91266383
MD5 6e0a8003d3436ef936fb713faae7676f
SHA1 d0f47dd0c513939377b021d30cb9ec7fe2173de9
SHA512 209f405aaa0ee74aff11b981b0a2dc9f7f337b5e8607e324cf2419d4fe1f378bf2be5103ee656b1b1f4e543039d4c1c5806a85ba879a51a76411ef36c2dbd645
SSDEEP 393216:u3JLHuBk7rIa9vYq6AvO9lBrMvy7nQuE53LH/ja9mPasIdjWMprgjZD84GXU6/:u3Jn7H6AW9lBwtxa9GasAjGjZLIt
TLSH
T10C5733337D42C635E5290E72417FA3616B3EAE144E12C8476384792DEDF39C84A7BAD2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5b41be.msi

Path C:\Windows\Installer\e5b41be.msi
Size 776KB
SHA256 fbb88be7b6a0d460c90624fda80eb12a68c7c042a727f0118e3aec3aa52283d9
MD5 7320e8bfd5fd34afa69fa9ebd2c7b64c
SHA1 65ed7291bf3553ef6e08f398cfc3320d5e163044
SHA512 41420d59f7f490bd853ca3c2ecbc24921f0cd42edbab63b520aa586bef853dbea066f341b71281bf404de8504bdd616aa8df0c9a24ba8ed96199d6bb1aba6794
SSDEEP 12288:btVFhKMky3Ar/gMCV1EgXmEI3os2Qx7E4D4Rxbp4K+1uiq:vFgjuAreXdc3/7Rin+s
TLSH
T133F4AD237D80803AD8BA1D71953AD7B16F3DBD204A64889B5380B91DDDF11C0AF76BE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5b41ce.msi

Path C:\Windows\Installer\e5b41ce.msi
Size 29.9MB
SHA256 06421abd85426b1b9f068608ed89565559dd2734ae638a35ce9a541f8e12902a
MD5 583defa9eee808ce45302b279e26939a
SHA1 5d1341296a50030548a030137b13a884ec47ee83
SHA512 0fbfa5b07a7c83983edbf8d3bab01f3262e24a073cae37fa75ad99d2abe15fe33e2cc5515d52fd1e201a2381902eca8099d550ae697778a06ac1794cfd3bf2d7
SSDEEP 393216:za/60FemY/qyvZPiQOHRfqiTUPvT9zl0h6Y1mbGFkgcBkq6fod3HPnxE2/4QXwLu:I60FejvLqRfqTvT9prbgcsKxuSduP8
TLSH
T1766733133C82E035E93D0EBA543CD769573E7E214A0484276785F98EEDF12C05E76AEA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bg.png

Path C:\Windows\Temp\{12491003-2023-4803-AF93-678DA2CE9A14}\.ba\bg.png
Size 4KB
SHA256 9095bf7b6baa0107b40a4a6d727215be077133a190f4ca9bd89a176842141e79
MD5 9eb0320dfbf2bd541e6a55c01ddc9f20
SHA1 eb282a66d29594346531b1ff886d455e1dcd6d99
SHA512 9ada3a1757a493fbb004bd767fab8f77430af69d71479f340b8b8ede904cc94cd733700db593a4a2d2e1184c0081fd0648318d867128e1cb461021314990931d
SSDEEP 48:u+Xg+NXWbdlIr33lx9W5OstaDIy3r5XpPyvZKmXYTDeiByNxcaaaaaaaaaaaaaaE:AaXWPIrHT932JsdpPyjqDeioatEn
TLSH
T19891B4D8FCF95322C6002BF255F4C0735A0215B713ABFEC82F496BD90E6878E25058B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windowsdesktop-runtime-9.0.17-win-x64.exe

Path C:\Windows\Temp\{C3592207-E322-4934-AF4C-43995211AE32}\.cr\windowsdesktop-runtime-9.0.17-win-x64.exe
Size 607KB
SHA256 b0130d17ffd269d510eddb7026d2d8198f5b6e2c92b5c5f314daee1cd4882d9c
MD5 b4734aa809543fea36bb77ecb2f7c1f2
SHA1 7175d089ff780f2bea588960621ca82dd7a7bdfe
SHA512 e1b6cbb90daedfe5a6d6b6f015249b191f5e0a330217b8bf8d0d16adb1efbf914dd1c8c7e92cff5d776433f59ab9a288a06f53bb20bcd5f98f9e66bfadeb52e8
SSDEEP 12288:xmEsd9PZfePv3xl7ft7V+6uC+zd5qLl8s3wkCiy7nlEM0Dnm4:xm39PZfePv3r7fm6t+jqp73lWzCM0V
TLSH
T175D48D32A5614032F7F10673B92896303E3CE328175488AAE7D4AD1D7EB88D667F7257
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{C36668D4-E387-4431-B388-5E3200F8A4F0}\.ba\1033\thm.wxl
Size 5KB
SHA256 81a68046b06e09385be8449373e7ceb9e79f7724c3cf11f0b18a4489a8d4926a
MD5 d5070cb3387a0a22b7046ae5ab53f371
SHA1 bc9da146a42bbf9496de059ac576869004702a97
SHA512 8fcf621fb9ce74725c3712e06e5b37b619145078491e828c6069e153359de3bd5486663b1fa6f3bcf1c994d5c556b9964ea1a1355100a634a6c700ef37d381e3
SSDEEP 96:MT0abTxmup/vrCKATQdYQHdYCwgoVOBq9LjP5dbSE7:OQNkdYQHdYCYXt7
TLSH
T1F1C1DBA778CF53C128731255EA925AAA5911C19C537F2DF4FC8B454B838A827A373F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixstdba.dll

Path C:\Windows\Temp\{C36668D4-E387-4431-B388-5E3200F8A4F0}\.ba\wixstdba.dll
Size 190KB
SHA256 dcea15f3710822ffc262e62ec04cc7bbbf0f33f5d1a853609fbfb65cb6a45640
MD5 f1919c6bd85d7a78a70c228a5b227fbe
SHA1 71647ebf4e7bed3bc1663d520419ac550fe630ff
SHA512 c7ff9b19c9bf320454a240c6abbc382950176a6befce05ea73150eeb0085d0b6ed5b65b2dcb4b04621ef9cca1d5c4e59c6682b9c85d1d5845e5ce3e5eedfd2eb
SSDEEP 3072:sjEoXsLW9OLG8Qp51ySdjDXY33b+Av7O5IkI+/AYkPAEc527uu3k/gLtxavf0ir2:sjEo8LW9553hXWy15I2YrAW7FUVEihs3
TLSH
T1FF14AF1176D0A07AEBFB16307A39A5216E7DBA200FA0C9DF63449D2B1D715C19B36B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1996-2123-0x00007FF9C69F0000-0x00007FF9C69F1000-memory.dmp

Download

memory/5416-2048-0x00007FF9C69F0000-0x00007FF9C69F1000-memory.dmp

Download