098e0ddda1fa6cec7def5be97f6cd85df891324b5ccd52e001cf415e09ee557b

Analysis

user interaction
yes
max time kernel
44s
max time network
36s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/06/2026, 16:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Xeno-v1.3.55/Xeno.exe
Size 160KB
Sample260620-t27veahs51
SHA256 098e0ddda1fa6cec7def5be97f6cd85df891324b5ccd52e001cf415e09ee557b
MD5 06c6c8928a5f9f32ad4778ece45176f3
SHA1 69941334c19ff637e65acf791b74600a76455842
SHA512 e22018318c674426a2550fdad3ea2c80252b81eb9aedd58c0ff597fe7c82344c0274bda2b8b2814d6a3098a859756ab1747cc150ecc2bfff5fdf42b7ada9e558
SSDEEP 3072:IqeXA/4yIg9vkNPNu6H6xCYOihUE265AJw41V0:IvgvkNFNaxmpEgJ1V0
TLSH
T1D4F34C07A6A851BDE1B6C678CD924D41FB727C598B71A6CF03507AB60E737D0AE39302
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Xeno.exe

Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
25	discord.com
26	discord.com
28	discord.com
41	raw.githubusercontent.com
42	raw.githubusercontent.com
44	raw.githubusercontent.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedgewebview2.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1256	msedge.exe
6820	msedge.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134264469142463026"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4118910392-3846778420-3545080915-1000\{1B9337E5-9E98-441E-8271-309A68A383F0}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4118910392-3846778420-3545080915-1000\{43BDAE52-B58E-468D-9BFA-9C3F94A0FE05}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4118910392-3846778420-3545080915-1000\{046C4D3D-7091-4756-8BCD-4F3F1BE607BD}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1552	Xeno.exe
1552	Xeno.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
4680	msedgewebview2.exe
700	msedge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
700	msedge.exe
700	msedge.exe

Suspicious use of WriteProcessMemory 61 IoCs

description	pid	Process	procid_target
PID 1552 wrote to memory of 700	1552	Xeno.exe	88
PID 700 wrote to memory of 916	700	msedge.exe	89
PID 1552 wrote to memory of 4680	1552	Xeno.exe	90
PID 4680 wrote to memory of 1384	4680	msedgewebview2.exe	91
PID 700 wrote to memory of 5432	700	msedge.exe	93
PID 700 wrote to memory of 1256	700	msedge.exe	94
PID 700 wrote to memory of 5432	700	msedge.exe	93
PID 700 wrote to memory of 5432	700	msedge.exe	93
PID 700 wrote to memory of 2788	700	msedge.exe	95
PID 700 wrote to memory of 2788	700	msedge.exe	95
PID 700 wrote to memory of 2816	700	msedge.exe	96
PID 700 wrote to memory of 2816	700	msedge.exe	96
PID 700 wrote to memory of 2816	700	msedge.exe	96
PID 700 wrote to memory of 3128	700	msedge.exe	97
PID 700 wrote to memory of 3128	700	msedge.exe	97
PID 700 wrote to memory of 3128	700	msedge.exe	97
PID 700 wrote to memory of 5708	700	msedge.exe	98
PID 700 wrote to memory of 1660	700	msedge.exe	99
PID 700 wrote to memory of 5708	700	msedge.exe	98
PID 700 wrote to memory of 5708	700	msedge.exe	98
PID 700 wrote to memory of 1660	700	msedge.exe	99
PID 700 wrote to memory of 1660	700	msedge.exe	99
PID 4680 wrote to memory of 3304	4680	msedgewebview2.exe	100
PID 4680 wrote to memory of 3304	4680	msedgewebview2.exe	100
PID 4680 wrote to memory of 3304	4680	msedgewebview2.exe	100
PID 4680 wrote to memory of 3304	4680	msedgewebview2.exe	100
PID 4680 wrote to memory of 2864	4680	msedgewebview2.exe	101
PID 4680 wrote to memory of 2444	4680	msedgewebview2.exe	102
PID 4680 wrote to memory of 2444	4680	msedgewebview2.exe	102
PID 4680 wrote to memory of 2444	4680	msedgewebview2.exe	102
PID 4680 wrote to memory of 1300	4680	msedgewebview2.exe	103
PID 4680 wrote to memory of 1300	4680	msedgewebview2.exe	103
PID 4680 wrote to memory of 1300	4680	msedgewebview2.exe	103
PID 4680 wrote to memory of 1300	4680	msedgewebview2.exe	103
PID 4680 wrote to memory of 1300	4680	msedgewebview2.exe	103
PID 700 wrote to memory of 2920	700	msedge.exe	104
PID 700 wrote to memory of 2920	700	msedge.exe	104
PID 700 wrote to memory of 1796	700	msedge.exe	105
PID 700 wrote to memory of 1796	700	msedge.exe	105
PID 700 wrote to memory of 1796	700	msedge.exe	105
PID 700 wrote to memory of 5524	700	msedge.exe	107
PID 700 wrote to memory of 5524	700	msedge.exe	107
PID 700 wrote to memory of 3520	700	msedge.exe	108
PID 700 wrote to memory of 3520	700	msedge.exe	108
PID 700 wrote to memory of 3296	700	msedge.exe	109
PID 700 wrote to memory of 4388	700	msedge.exe	110
PID 700 wrote to memory of 4388	700	msedge.exe	110
PID 700 wrote to memory of 7008	700	msedge.exe	112
PID 700 wrote to memory of 3284	700	msedge.exe	113
PID 700 wrote to memory of 3284	700	msedge.exe	113
PID 700 wrote to memory of 3536	700	msedge.exe	114
PID 700 wrote to memory of 3536	700	msedge.exe	114
PID 700 wrote to memory of 6544	700	msedge.exe	117
PID 6544 wrote to memory of 6592	6544	msedge.exe	118
PID 6544 wrote to memory of 6976	6544	msedge.exe	119
PID 6544 wrote to memory of 6820	6544	msedge.exe	121
PID 6544 wrote to memory of 6976	6544	msedge.exe	119
PID 6544 wrote to memory of 6976	6544	msedge.exe	119
PID 6544 wrote to memory of 6684	6544	msedge.exe	122
PID 6544 wrote to memory of 6684	6544	msedge.exe	122
PID 6544 wrote to memory of 4936	6544	msedge.exe	124

C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55\Xeno.exe
"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55\Xeno.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/xe-no
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ff897ffc188,0x7ff897ffc194,0x7ff897ffc1a0
    3⤵
    PID:916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1588,i,14128647512056841127,3812119352134608934,262144 --field-trial-handle=2196,i,7142508488784672342,7570088622475247988,262144 --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:2
    3⤵
    PID:5432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1724,i,8001775302615986937,488163470170914681,524288 --field-trial-handle=2196,i,7142508488784672342,7570088622475247988,262144 --variations-seed-version --mojo-platform-channel-handle=2656 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2088,i,5383809365995554125,2819735110271575597,524288 --field-trial-handle=2196,i,7142508488784672342,7570088622475247988,262144 --variations-seed-version --mojo-platform-channel-handle=3352 /prefetch:13
    3⤵
    PID:2788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3212,i,18127502527718735873,7531270260908370266,2097152 --field-trial-handle=2196,i,7142508488784672342,7570088622475247988,262144 --variations-seed-version --mojo-platform-channel-handle=3340 /prefetch:1
    3⤵
    PID:2816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3240,i,583296350316319813,1407731498195202231,2097152 --field-trial-handle=2196,i,7142508488784672342,7570088622475247988,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
    3⤵
    PID:3128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4180,i,12803842704591701321,16253042176928122022,2097152 --field-trial-handle=2196,i,7142508488784672342,7570088622475247988,262144 --variations-seed-version --mojo-platform-channel-handle=4720 /prefetch:1
    3⤵
    PID:5708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4192,i,277017685808712492,9593917977113593785,2097152 --field-trial-handle=2196,i,7142508488784672342,7570088622475247988,262144 --variations-seed-version --mojo-platform-channel-handle=4724 /prefetch:9
    3⤵
    PID:1660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5252,i,14890099979562752471,1656658867907997802,524288 --field-trial-handle=2196,i,7142508488784672342,7570088622475247988,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:14
    3⤵
    PID:2920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5412,i,11950170309014829133,16411906385175951574,2097152 --field-trial-handle=2196,i,7142508488784672342,7570088622475247988,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:1
    3⤵
    PID:1796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5616,i,12102087619847498980,16066244125249238603,524288 --field-trial-handle=2196,i,7142508488784672342,7570088622475247988,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:14
    3⤵
    PID:5524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5620,i,3406928018409510874,6892008810707424890,524288 --field-trial-handle=2196,i,7142508488784672342,7570088622475247988,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:14
    3⤵
    PID:3520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6048,i,1708362811165050360,5044114445817239588,524288 --field-trial-handle=2196,i,7142508488784672342,7570088622475247988,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:14
    3⤵
    - Modifies registry class
    PID:3296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6044,i,15739857565675274846,1959043045442566498,524288 --field-trial-handle=2196,i,7142508488784672342,7570088622475247988,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:12
    3⤵
    PID:4388
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6548,i,10754729866513096000,18295272183659248390,524288 --field-trial-handle=2196,i,7142508488784672342,7570088622475247988,262144 --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:14
    3⤵
    PID:6992
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6548,i,10754729866513096000,18295272183659248390,524288 --field-trial-handle=2196,i,7142508488784672342,7570088622475247988,262144 --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:14
    3⤵
    PID:7008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6920,i,925979686355995119,17515899979956349246,524288 --field-trial-handle=2196,i,7142508488784672342,7570088622475247988,262144 --variations-seed-version --mojo-platform-channel-handle=6928 /prefetch:14
    3⤵
    PID:3284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5364,i,4877527103794122251,14202915082950596763,524288 --field-trial-handle=2196,i,7142508488784672342,7570088622475247988,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:14
    3⤵
    PID:3536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:6544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2c0,0x7ff897ffc188,0x7ff897ffc194,0x7ff897ffc1a0
      4⤵
      PID:6592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1644,i,2947090995268672165,1547475065197178945,262144 --field-trial-handle=2288,i,16137748473214569357,12574810585564235266,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:2
      4⤵
      PID:6976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1872,i,8365992094022137301,2935468767118474456,524288 --field-trial-handle=2288,i,16137748473214569357,12574810585564235266,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:11
      4⤵
      System Time Discovery
      PID:6820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2424,i,14661872981113708374,17422706190262306425,524288 --field-trial-handle=2288,i,16137748473214569357,12574810585564235266,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:13
      4⤵
      PID:6684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4408,i,15145461868721662491,15357533789742476393,524288 --field-trial-handle=2288,i,16137748473214569357,12574810585564235266,262144 --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:14
      4⤵
      PID:3408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4408,i,15145461868721662491,15357533789742476393,524288 --field-trial-handle=2288,i,16137748473214569357,12574810585564235266,262144 --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:14
      4⤵
      PID:4936
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Xeno.exe --webview-exe-version=1.3.55+87ae4f96f8a0927052c1120167982fb069afd1b4 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=1552.4460.17850981525935259433 /pfhostedapp:c08d8e0ec6927dabfdced4a9bb201679c5503c74
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4680
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView /prefetch:4 /pfhostedapp:c08d8e0ec6927dabfdced4a9bb201679c5503c74 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x184,0x144,0x7ff897b85fd8,0x7ff897b85fe4,0x7ff897b85ff0
    3⤵
    PID:1384
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView" --webview-exe-name=Xeno.exe --webview-exe-version=1.3.55+87ae4f96f8a0927052c1120167982fb069afd1b4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1744 --field-trial-handle=1748,i,14745164558528736806,1941926050872730344,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:c08d8e0ec6927dabfdced4a9bb201679c5503c74
    3⤵
    PID:3304
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView" --webview-exe-name=Xeno.exe --webview-exe-version=1.3.55+87ae4f96f8a0927052c1120167982fb069afd1b4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2184 --field-trial-handle=1748,i,14745164558528736806,1941926050872730344,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:c08d8e0ec6927dabfdced4a9bb201679c5503c74
    3⤵
    PID:2864
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView" --webview-exe-name=Xeno.exe --webview-exe-version=1.3.55+87ae4f96f8a0927052c1120167982fb069afd1b4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2208 --field-trial-handle=1748,i,14745164558528736806,1941926050872730344,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:c08d8e0ec6927dabfdced4a9bb201679c5503c74
    3⤵
    PID:2444
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView" --webview-exe-name=Xeno.exe --webview-exe-version=1.3.55+87ae4f96f8a0927052c1120167982fb069afd1b4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3432 --field-trial-handle=1748,i,14745164558528736806,1941926050872730344,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:c08d8e0ec6927dabfdced4a9bb201679c5503c74 /prefetch:1
    3⤵
    PID:1300

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2964

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3028

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6636

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9ad6bde8f9df16bf1a3f2b131c3f574a65d0163628e7e30079063c8fc175cd9f
MD5 52d97c8511ccf0d37f6babfe47fb7dcc
SHA1 5d49aa8ba1fadaf9c89205d7d2398152d8473179
SHA512 cd807435ee156a310025ad5c57a471c59bf17881d67e67304022786f8b4257cbb690c90132693fac38ed6482c85fe0ed15eac349ddaeaf92e3be7cbaa3119bd5
TLSH
T145D0A7B03F55BA95D04A107681105510513E85832986D209B261890DDDB49C1ABD69D6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 00fbb63799d26e9a7e30ff53840386023c5150d62b9ea487041ad388db361544
MD5 447de69b347844c29cf7a3b3f5e89252
SHA1 67ad860b72f4cf3188b263680869e8d3e2f79164
SHA512 b8977c20ec2389237c40a065ee9041a0ba55bc2336c4da14ff107c76ebafa289f5512cf0cafa740524f3299ee4cacddcee021abb68d7450550e6d21aa04cbdae
TLSH
T17ED080F13F45B905D4471476C5105620513FC44124C6D609B271C50DDDA4DC0FBD5593
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cffda89706c34029bbadb3a079f8166927ce29a27926faf81be0941753fa411c
MD5 7cdea7179a599d50436be1171f9511c2
SHA1 6d8054f3ef2c68bd8edc0e0a0c209a8d0ec96169
SHA512 9254b7cacbb6da2f3991af0c9a702b61e8ea1514e5a421096b8814aba7d20757eb9270096433d7132ac27e348f1f0dafca2c9bdfe53b1301eac088ad262db76a
TLSH
T14BD080F53F45BA05D4471472C5105620513FC44138C6D609B171C50DDDA4DC0FBD6597
MD5 SHA1 SHA512 TLSH

Submit Download

0c2df007-1c13-453f-90a5-7993cb02a3db.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0c2df007-1c13-453f-90a5-7993cb02a3db.tmp
Size 32KB
SHA256 8ed8389300d97a17b0416f30cb324b3a8ae6489338c2192e21eb2b1adaa70070
MD5 765cc5b48d4d1c2df69faf8189681684
SHA1 f60ebac0df716a9c9ab99fd00e8bcef0d7d52833
SHA512 ad6381dbeafbe65df6b70729068fd83da7cf2c1cf15dbd7fcd861236f47ccaa59d41672ab44217fa5d893871bcbbe398c0443206be85f27ecfe1a26590a37d54
SSDEEP 768:BcfLZX7pLuL72DWg5tfnq8F1+UoAYDCx9Tuqh0VfUC9xbog/OVb+XLO/1roQqu5t:BcfLZRE72DWg5tfnqu1jaY+XK/OJAQY
TLSH
T10EE2FC3B680CCB7F4F844E9CE829BD9A6DA801CF56D8CD5447EA881C03C6BEB51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

496326f0-3420-4443-b19e-976f217da3c6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\496326f0-3420-4443-b19e-976f217da3c6.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 3d90b495e5c86eff1335fc58fc905e3fecf8d555b16ce7a6beefb0a4a7505a47
MD5 04adb2ea8a8f4fa1012d7e4082d24b34
SHA1 b04f8087b734b2592ec4eda4b3d3efd36ec8799a
SHA512 fada3282a6c9ff5559776f35db7a9eab5620fd9d56791f90e00308954d618ded3dc7665d37b0ed3f80defe6525d084030b56299c161caf546b13ce325c2e877b
TLSH
T19CE0E5F9C821DC3729FC471CA9554A8AE70523176F51894B363C51098FB467A4586C1C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 80KB
SHA256 408cede5c28a27d9a90e904594bc30be39703286c9adbe0f04b0cc6ee48916c3
MD5 81ddbb57e498980ba18b6d585ae1d4a4
SHA1 b5bfef1f7f28f944f3eeaab69a73e9471d48bb49
SHA512 c331b3a734e0f092dda484134304767cffc6b325aa7408dc73d6d80af9e437bcc23c54c22bfab002ba4c8d3ce940b0ec009a7137c2753ad7ad9c1458f9ce76ea
SSDEEP 1536:ZyFIeYHDwI8VCveMMwdzE19WWetlSVuB0FJ8d:wM/ciuwdzEWt0kB0n
TLSH
T1FB83303CBAB52C0DD9E76C7CA4FB1BF593E48A9CDAD3D9579568B078220239F541E008
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 776KB
SHA256 243d70cd02fe61852cbfb61abc51aa7723210398224261e043fbaf49eaac8649
MD5 8a10c0a593ef41e01f60a00ec16ce85d
SHA1 5a3108c3738e852c9e416249b5ff9e9a5ecdeffb
SHA512 b5ff72e8b4a08009ba7bc077e00baa0636988fdb90befe23e27bafb69c66493bf38e6681a1e9db37716126d5ce89b37f87124b0ed53516b620771e75c988ce77
SSDEEP 12288:+L/oL/27PL/IL/XL/Kt7bDYZiLj39N18ntza:wpMiH9r4za
TLSH
T185F4C5F384505829CB7912F95393367C9337428D3CDAE8DAF5361CA96819B33B2A4DD2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 5.0MB
SHA256 c552a5fe16cf4b8e87c449603d827edd3990bcb252145c91355ebd7f120ed51f
MD5 224785be30180832b0a3e0afb586cc2b
SHA1 b120d25bd468153e6d964a71f3c21f4d6bd171f7
SHA512 59214a2842055e9aad960a4ae75593ca25a1f222a3fa894b83acf11152f86681e8e6f62e4bb7dd6a761be1b9a82255c3939824f12779f0b01d5807d992cf14e7
SSDEEP 12288:GQNtoAm5zGFNKVGCqBz+FV7HYw22mRYTz30TUI3zYoNyNbQMTKKeg3MbbGefe5Ss:7mxTjtOOEQWluGgis8kqm5
TLSH
T15D361BDB4B749A91D7ABDEB0BDD4DC5D7DB810C6AADBE0836402C67900C37C12B9528E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 e34e0d3a2dff70ca7886c253996069d81fb8df370ce0c8cef9a11f570f2c5b44
MD5 8340daeb3f1df2bbb7409f3898883137
SHA1 33b69b739dd2327fb0bd7e2f18983603ae0bddd5
SHA512 70a8f83424bcd5f03b3b95bc27526118d6ea340da3e3520ad9c86d14f326ed87bd46d390a12c1f4e821dc7479af4e8d6c5c1fa8d8c5959b42616f1a9b2c61c35
SSDEEP 24576:rnT0o8mC6NBEnnShIHZcaLTvHgqJjmawnxdc8QmTHWZUPAYdQKKh:rgofC6jEnaMnIq1mawx0mrMUPZRK
TLSH
T168167DEDCA6858C3CD63AA30B5F0E8577C7413C3F994C1D7C898C584026B7C5BBAA669
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 9KB
SHA256 f803a519309a7cba9623845e476da3a4858f5dd997d63601a2191b99bc5b9555
MD5 e303e9e810665d31addafb4d8d5c41fc
SHA1 05bacb9fdd8148e8e58cddccca7bdbc2d4bde9ab
SHA512 6751dc80d1ed0f3417b914f3c1ede4125d7cd4a40a082d270cfd32dfeffa2f6a6ef5a447f119f3049dbffab04f53184673349f41a7b64f3585f49def4a19a80a
SSDEEP 192:FuYSMH3DV9Mrskj1sq23lBob2aLlOI551rSwa6KLv4IVt60J7TsI/hI90Z+ied23:FuYSMH3DV9Mrskj1sq23Tob2aLII5brY
TLSH
T148128539A031CEDDD75B59F554F61C587BFB0DAD42CBDEC5AA77BA382A293040826007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58ec4f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58ec4f.TMP
Size 3KB
SHA256 58efaf2f827161d6da93e5b4f9bcda3b3231a592f44986c939085025da68a0b0
MD5 e4c4e53496a02e9ecbfab62df2022ad7
SHA1 40dbf4bbbaf4e59489bc829e4027c0d8e2424d9c
SHA512 aa6d457d741af5ae6c2655611d3b3a91506b582b5220c9264a3219bd2edbd4059001fc77f3200fc485dd0efda87675d2d61b77074a7578b76849f071ca875e7b
TLSH
T15071C45D0061076DD72B0939A1D318AABBFC1BE2468FDFA8BFB8D6786F02708640104B
MD5 SHA1 SHA512 TLSH

Submit Download

adb91bba-e11b-44df-a75a-ddb7f8f8318a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\adb91bba-e11b-44df-a75a-ddb7f8f8318a.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 342B
SHA256 39dfdec86949f152a1471442545245ac5f3372b56428a6f61dffac0a3ec159e7
MD5 829a3c6987490c82e6ba954662c1d61b
SHA1 3799630075c4e24b21e810bb5896dd5ecb96c9b5
SHA512 0fe38650c2f79854b11bb4f6564fa45639e74cf8e644f7913c55cc92ee0ebe58c20307360aa83432e6521c046c39ccf2d2e1098695cae563817d0f4af593e30a
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 63d61cbc1c23339169a91ac6f5b010f6021cff32757353c986f6c7ac6d5cfe41
MD5 942f1b67c9b410014ea6dcf7fd25eb4c
SHA1 682be59a8ad55511d5371f09fe701d54094fc0ca
SHA512 cee9762ae28daf0b4639bef8c32adac1493181eb30823147cd458b772e05ed04c936ed222a8162d4f2eeb664d3c9638252a0830e3bae94db56a59fb5a6f97dda
TLSH
T1B8E026A454C8C369E01C68E786BE630CC3E2351AF78ABA063B08CC546203BC1A2C6AC0
MD5 SHA1 SHA512 TLSH

Submit Download

computed_hashes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json
Size 429B
SHA256 b829b0df7e3f2391bfba70090eb4ce2ba6a978ccd665eebf1073849bdd4b8fb9
MD5 5d1d9020ccefd76ca661902e0c229087
SHA1 dcf2aa4a1c626ec7ffd9abd284d29b269d78fcb6
SHA512 5f6e72720e64a7ac19f191f0179992745d5136d41dcdc13c5c3c2e35a71eb227570bd47c7b376658ef670b75929abeebd8ef470d1e24b595a11d320ec1479e3c
TLSH
T10AE055170A1A50B79BB8DB90EE525CA2E8A0A6B1C50438D63E608234B68A11F738347D
MD5 SHA1 SHA512 TLSH

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\verified_contents.json
Size 1KB
SHA256 d23b2ba94ba22bbb681e6362ae5870acd8a3280fa9e7241b86a9e12982968947
MD5 738e757b92939b24cdbbd0efc2601315
SHA1 77058cbafa625aafbea867052136c11ad3332143
SHA512 dca3e12dd5a9f1802db6d11b009fce2b787e79b9f730094367c9f26d1d87af1ea072ff5b10888648fb1231dd83475cf45594bb0c9915b655ee363a3127a5ffc2
TLSH
T12B317466C8683D56267A63348E2D0602EB57C2BB0050640EB5AC558D4F7115FE242FAF
MD5 SHA1 SHA512 TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 20KB
SHA256 5781e06cc504854c8f7fb560d876dbfca8d10d83b571222e762db5ab9801a3c4
MD5 a946a48817817a8bd8e3e08f65d622f2
SHA1 1630595d6dbb37468706523eb96c74b20c7dc8f4
SHA512 67bdf6a571b7168dd3d11932592b288bef8bcddddc6c6beaf53d21e6c3950061663799f61b00b60509a378cdd7ff7bc8c43e0a8dc9e3652ceec3126916eda45c
SSDEEP 48:uzBmw6QU1Pz3wwJOrZjrte3FJu4yeRvXYGg12AxyUl:6BCx3wwAr5M3FJu4yYvXYz1XxZ
TLSH
T1B392B6470D797853E7092B7A2A2B4839C93BE19CFFE5CC89312550781DF8656A0358FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 224KB
SHA256 be66e0632a59f8ecd6b3d0dd5e7af7632d3b62908bebf92add65b19d80046eca
MD5 76657f5c2d00fc7715af3ec16de34da5
SHA1 9a072e0c8aff2c7c72d4bc0eb96306ae92f4fcad
SHA512 f5a11343be38cb64b1446cbe882f32e3206cd7af5e809e8aeb5586713a5856af4131cd699eff11d2d22b88893534cbcd39197798aa1e61f939d5ab3e8514e73e
SSDEEP 96:8fHtejzH+bF+UIYysX0fxQp97oEHt/DfLjLqL/xHhrJbbEOVpZf24JkMfXSFR+Cw:8oH+bF+UI3iWGVoWN3qL/xbVVV63
TLSH
T1CF241E1F5F702722CDBD813668E744A35C7DF03F8B5366CA686114B4CEE2652A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 8KB
SHA256 f871582dcab1f752660b14b11efd2c0aa4bece967df0d5a34adc2081ad0b9b09
MD5 b79113a31b9599a66d5aeaf913850d36
SHA1 4a19104ade3429fc79e281a8e3d6b5ba9575f154
SHA512 2710824cdc0c15fae8995480368c880c94d3433fcfac38441ccc53665a436ce8ca411c42cb2cddf401fde4518aca849ccdbdc547ab660b2c125a13952c5c808c
SSDEEP 96:WXX2nwejyLNtj3ADZXYAyKU3Q2mIAMuUZv3t/KPSKXl+CJF9o1uqNXTZzgTGL2Ol:CGjy3fuU3Rjhd/uMChWjv2Ol
TLSH
T1D702117FE408847E47778727918B351ECBBB397E185CF559D0C21D0C066E2AE2605A9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 334B
SHA256 2bc52278c4fbc732569a1bde3d4a1ed17b684b1561ac67191b9868f04768573f
MD5 d710350cb261d69c8d668f81b083fba9
SHA1 7b2ccc54a6a76a9ac5ce75a14511a7bf286ea981
SHA512 00175bb8107167d9f7a23b8cd241cfeb5c590bda9ab0f874658c983e954290a52f1379e98a4d6ec8236989252165d6a4722e67bcda0264e6224f222265e117e4
TLSH
T1F4E0D8A295CEC26E910C20AB4329770CC3A1390AE78A6E076B04A850B146104A6816D1
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 24KB
SHA256 add601c01d45b699bde2c4c2978392ce570543a9536ff473b25b191eb895a219
MD5 9963071f9d752894ae543d392375aa39
SHA1 173efd4058eb97d0c8b54e6dfdf7254ee9384217
SHA512 355c7c6fbc155dfea54d3c30fc4fa29104d24a0283b5e117e7f3e6e52c738011a7bdaa1502c428e646928e7c17b816f80d42a620513eccf89fee6c4ab6449077
SSDEEP 96:qDeMatha98Z7kGEdJAX57z95pgNK9g9SDU2EA8A:qDLaTaaBEdq7zfewNDU8z
TLSH
T101B2B60E2F206916C2F5463AEDF144561F6D10AC87E36A46E90820BD8C67A57F5164A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 061901184c6ddb072d8d58eebb0c0b366daaaf9c143213239a4a861c484ddd7f
MD5 6e1db4c13eb86603c191e2edb2d1bb7c
SHA1 2e9ad492afe039a4032c073a4ceec910dcf17fee
SHA512 a9750e3fe05e4a85733057e63cca405f8d0e7db83329c27992fe505b57b2b5a2fe79bbd3f341e74366f9da6618819a36e6971f862bb814de1dd13e815475a5fb
TLSH
T1825189F3C6E8866D891156F4BB146E1BCE2D0958432C3D6AC8E4EF4B97E2471E241A4F
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 522B
SHA256 9f4d75026b4493a37f8e04a3f78f7ae9728291f4e86339900aca0bbcdcb37ec8
MD5 134187759ff05af6c8e62c548d046cfd
SHA1 502adbc60adeb8ce651bb1e5b70972c5dfe08ff1
SHA512 aceae3f340f32c90c2fb5343ff40d35b76fd4f9f48894f2e4a0b690d5299174ed079fd6c103b49ce51d1261688479dc3817b0ceca7a681599c02e11cf06d7da9
TLSH
T19EF059A780BEF4771035093B0CD47C0567BAD835015A98E9CA96C26EF0440B36F12827
MD5 SHA1 SHA512 TLSH

Submit Download

c9fbc605-1dd8-4c2a-8826-da4c26a789ea.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\c9fbc605-1dd8-4c2a-8826-da4c26a789ea.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

fa023ce7-65fa-46ec-ba3b-d3e079276f3c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\fa023ce7-65fa-46ec-ba3b-d3e079276f3c.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 9ab972a7f2660f17fc7da8b8a554a0a60a5b30f9b6ef6616e392b1baf522ffdb
MD5 83a44505b139282691cbc241d81350ee
SHA1 6355b46660ae7af48dda7876ac65784233f38383
SHA512 066b3fd1da6d854f96595561c43726ddaa1e140afafbfcb8666516d295d158a34e47f2e42a6cb072e3c772159b87ac3bed6d8f726a63d2e1e791f604b3f693fe
SSDEEP 192:sxRbRpyM/jK1Ml8/cl/fHsvWpVCcKZU2V5zoA8plP/g6+WNOrkK/eBV75j4ghIg3:sxRbf/l/fHsvWvCccUqEd/5y/eZr3
TLSH
T11662D816A534597BCCDBD20DFA567F63D6F81523A2911E44AAFC8A1C00E6EED2213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 bc1987736e80ec1a28628e071c9fe3064f58719329957d7edb8fe30de30b17e4
MD5 d6e19f4c61a65f2635feb77d3427c29d
SHA1 1ed63aa8d11e9a94c7f1d88f2a59740436114aaf
SHA512 09535dd739601e2564773f5de3cf387ad3a24acc06adc47974a6581ef660afe7d47797cab68edba6b95f51bb3ff1aa3f718ea2693ae3a1d11ae56cffefe2e84b
SSDEEP 192:sxRQRpyM/jK1Ml8wcl/fHs4cKZU2V5zoA8plP/g6+WNpkK/eBVbRjiGhIgtJ:sxRQfCl/fHs4ccUqEd/5p/exL3
TLSH
T1AD62D916A5385977CCDBD208FA557B63D6F81573A2901E44A9FC8B0C04E6EED2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\a3f58554-ae11-4840-bcd8-a40cf0be2a10\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 226B
SHA256 0e41b945fc76b46fc0b0ec52591e350f43411721ffa696bd8620161509d702e6
MD5 dd912f26f0fcf1ab5ccaa83e91c9cf3b
SHA1 608a4ba4ea041a8771e682cae415056c8d7c5235
SHA512 7790367e89e64cc12351389e79fbc5247ddeca3dfd13e0a790c736a649c93e77cdaae5347ff210088f081debbc0115053492b15d708b2e2b16085d0ca4864f25
TLSH
T16FD0A7ABA0694682DEBF4F911A221939462D3C8414EAD45CD413053C8894B97B166EA3
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 233B
SHA256 81378b57d3c4f1a3d5447fbb5188b935869a8ccafec674a13c5cec6e68df5338
MD5 d4ba26145d6b3ab91820b939b8dae085
SHA1 1263152438d8b312386bde44877720ebd9af23b7
SHA512 d552ff1b4794dce48e134b202fba9a9ec20b81c848389d842167f6f1f28263c8c02b6df3a47337c3c8d9b9ff39f4d96d01d729b281bde12579a1e83fe51ee24c
TLSH
T1D3D097ABE0250982DBBB0B810A32053943383C8818D6C45CC013203C48B0B87B226EA3
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe58bfb1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe58bfb1.TMP
Size 138B
SHA256 4c8c801b8fe59d7ee9ed9cf41de4bfdfeba6c005c3f6167217ff34d5e2640545
MD5 7ef4cfd3f7da80d60185ab6145988c9c
SHA1 7cdeba88d1552cf411db764b03a627dc19bae25f
SHA512 61a7d3164de5e1e15612304c677e5ba88ac58bed9c48322396bbf2de802af5461c6c2d9a606a04d2e5f9be8f5e403fed9569e8c08156cfdcc6de58e86fd9a54c
TLSH
T1C9C02BB7E1090B43CB6803410232062C870E3CCC1CC7C48CA42334686030F673212FE1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 d9819590cb72a0d37870042554c9a720b3a440851401f96d8365b90b45629e83
MD5 85463f2fc84b7542b65f816208e02722
SHA1 4bf388409968b587c53c53a3b760436221221395
SHA512 4f2bbe8c3ccc72a808f36e8d576d60e6d1300cf1635ec56cf0adb391bc83b1c4db1a10f380460628c5915d58d79dbdfc568294c2382daeb8dad541aefd57ae5c
TLSH
T19CE0269095C8D3BDA0692457863A970CF3F4750BE3CA3D473F00CCC07186604B1D7591
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 3f918c7e79faf619deb6bbaef0c10dc2e41fe56595eb265739b7addcabdc1d8a
MD5 c87369d3b27704b0f18cb32f0e8d0a49
SHA1 ccba4149d7da96fcf346f424aaefa2b0048b104a
SHA512 22c6a901d750f7ae82c353d0c345fd4ab0a1555d4fe29f49bd577f8132a98b775e3d949dfb7a7327e4becf5697efba55fabd5be3baa5a6d51846de54a49f9511
TLSH
T1B9B012947721C662D484087207E187C05748E05224819D03CC08CF934F096983F878C4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 cafccd00072609517e1aec6b3131716a2e204574fa4ca11ef5ad2d7bcdf37acb
MD5 c81150ec7e6d9197494c2c9da2c8c01e
SHA1 729392c467eb77cac4422287e0219b9e3724e83e
SHA512 f95749069330922ce1f52c83a741dd82238dc43a6e841d9cc1b4a7afd80dda09af766daaf8cf9650c712c64b2f8c801db2e6f16c43d7215580d81897b03bf76f
TLSH
T15CE0D8E055C9C36AA159259B822AE30CE3B2754BE7CA69663B089CC0728A2407297550
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 ae4be52aba53376325ff13e69a828c1d52636db05d9c39ab1de318f48c4a9494
MD5 6b48111d8d99b4597ca154dee8fb515e
SHA1 c021cb7d0a665faee3b6873313384a8f52000158
SHA512 c60e1076f231fd75a317173bf1c818a8db22ea4326f371c150c154ed24e328c41536ef9eaa3014f54ed642d7a652a0e6cedc87a92dfc63e8a83631492980b2b4
TLSH
T1D4E026F085C8C3F9901CA0DB83BCA70CD3F1790AABCABB0A770C5444A1412C0B6A6D90
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 03ea3a80815d66394816ca77d0c5a04e1388277f73fff21fc78ecd779d51d108
MD5 5f999b4cc3f57975084ba5cdf54892c8
SHA1 b32b518ff730decc9e45f3e0d3618d3ffc649533
SHA512 d9b91cec4855ddfc2b4b3f292bc34e16f525338ac60c6f4ca0b036383abafef9577b04303579ffe36f674b8d191d001c881488e030cc95799ab25622778b211e
SSDEEP 48:KQ/I5Kkg0zyhWI3KPawq5a5h5O5K505w5s5k85w575PI75i5kK25Bu5M5kS5q50j:KQ/SKkgCyWkKPakZuK6o6Ir0vLVNB
TLSH
T1AF917005767E2365787E38489192896E574235B3364AE53B3BBD20F21E2BE040EFDCD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 841f07ac423a77ad7c223a028dc2651a6298b270161654616e360b12f0374ac2
MD5 a121aa8e672283d122efac0288def2da
SHA1 9c2cfe72c336297ec45926c6092c1ebcf94a6d13
SHA512 b398270009464d08601e43755adccd2da246c54e8ca23b93d88346a05e35b8b62bf977c82457f06452136e69c33cc92981184af316262ff6385e93eec958de5f
SSDEEP 384:DNrRZyCSDnxTIC6HgMEhIKyll7svbFKfk7:xFZJSDniByI1l7svbF9
TLSH
T10044840A7B747001EDE6D9721CB080771E3CB16E8F62E6916DA254694DB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 12KB
SHA256 9083971ee4de8614a8f8546901e3abcb3e92e74747aa34593814841b92bd7470
MD5 931388a0508e2d7a8029727588f94ab1
SHA1 37a46f735c8b00b5b9026d9bfd03c14e8b279c63
SHA512 a52b5c30ce5d8c0b1c25ba42041fa571b25535edfb35d81624c1db15989d83421cfd9c926e6e957f5b13f3569b02a62244a7b94e37a37e7e12c5d32c896681ba
SSDEEP 192:iQXIIIWbmMIMgBYcYWrIOT1Asolu0BusmEM:iQXIIIWbmMIMyBVTmsKks
TLSH
T1BD42A55E17112B77D04E9BBE536A92415BD9888100B2312D32A72C4F8EF3F9B83C52F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 2776ed4fb786b920713cf222203f7b35d78b00436c9b522109fa43d1173fa248
MD5 775f58a7e213e27aeab2d1880d06727a
SHA1 ad6e101499550b505993bdc1592fb5da3c385b94
SHA512 9d448c2f747beede2740314ba7d49ede1f6c9a083d8a8075b8d7bea7792b67b30c8402e6ed16e3e6a04825c301625968d0282a5c110ad043618678050a664a73
TLSH
T1FAE08661E9C9D26EE01D20AF4669574CD3917A2BFF8A695A2F04C854A10A244B2D65C1
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 0649faefb3ac69ca93b28274f4bbaff0c55f57136656dab442dc433464f9b33f
MD5 36f762ed65816867268fc8642d55ac1a
SHA1 b50533b611e6dae812e63f890eda52e66b54b091
SHA512 2fa371a4274331e8f0c9fe772fe939a3dc67de3ee3975257ebfb879a96cc1ceb8eab4a11b6f264f2e3a40759862ff22cec0e7f1403075f5479ce8cdd1570845f
TLSH
T16E214955F330D109E28A827E643E9B290338E846CFB8EC0F44BA31742E71B441E4B7E9
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 09334ba0cfaa6d5cad211ddd1fe035264d5a6ec8d7ca5352409a0e84a2efd1d3
MD5 a655c8c0c13c9e994311eb74c3aff8b8
SHA1 d90175cfa2dd873664cfbbab2e8b121c3535b44d
SHA512 1d40a2c9513f9868cb36f6e97c744f5fa86bb991cd4528005b7d62a8249e73420e662499d3bc17cd6e3db03746a30f409be059a3f6f219c19a4395a9cda12473
TLSH
T1F1E02670E8C8D2AFD01D20AB0169A74CC391391BFF9A2E0A2F00CC54A10A241B2EA6C1
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 44ddf9e6f2097c4a482910a297f8888513f1fa4135fc59f6c83bd4af084c4dd5
MD5 2ebf98ea4571df8157ef86a81ecb6fcb
SHA1 d2f37b34a05701f45653388c7cd2925c26c44ef5
SHA512 41094ed020d60e5f2165b1637a049e0fd8405c75835989daf42cb6405e30568b9debee446031ebc994cd048c34dec8b9ecb6fa9d778f6ba620cfc7ddf524fa7b
SSDEEP 3:MsEllllkEthXllkl2zEflVX9pal:/M/xT02z7
TLSH
T1704404C47FC00405F70C1130C055C3D01370FF50055157433CD50433DCC75401C00000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 4569490ed2ec574829f75d7715711a8fbfd2489f359ffc5145f9c27d159617da
MD5 86a8ad39932709f78ec0a80b1dc233b7
SHA1 b8fcb5eefc8be8b5f2f70f52a43878c27383c4ca
SHA512 c51f1ccf953b261063e0b00ded7a999d7c36ff197ced30709e0c6c42dc48884e5b4ce2e7c7a18cc4d8e850c5c07221f598ea0862443afbc8078f107011e550cc
SSDEEP 3:MsEllllkEthXllkl2zEfls+3ll:/M/xT02z1+3l
TLSH
T18D44044C7FC00405C71410704051C3505370FF100D11574334D505335CC75C40C10004
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 cbf41f0cd9aa887234e535475a284c1de24b514a8b7599682413f1581b89bdf8
MD5 41d046137c477eacee5af2975f749702
SHA1 1345d8b060fa19fb1ee77c6a4f1240b30cd2eceb
SHA512 adb76a8a7df9bc2444862f970feab65605b16bff0b9290222af90b5e98f56a08b17cd8685f2d8354f85faef1c6a7529d9a5406e32f780c30185202fac54628f7
SSDEEP 768:Gj+9O3bySfFrfgMfgDm72tbnuGfI+Yi3ve:V9O3/fxfVfl72tbnxRYMve
TLSH
T167E2AD31A82A8D379CF29684B20B3B93AEF4057395C41F88E8D95F0D09D33DD224B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 1ca9dcc12d3d50c8ba4e3d7b7065752167a9eaab3432884d53cb67890359ab14
MD5 f4ced3c3527f86f9591ffc470bfd4861
SHA1 7ae792efd1901b4195fc073310b12a339c31e729
SHA512 0e2e27f57a71a9bc6d8a01e4d51debcda6a97ef38901b0b9e977df570a1dae3f1b944950d985163391529a14692d55f5e665e52ac1e2d823aa189a9f448cd164
SSDEEP 768:bjaeqD4MlshiLdMms35rSfFrfgMfgDm62tbnuGfDMuKxx8xi1TT:bqcjhIdMD3EfxfVfl62tbnxwuKH8xU
TLSH
T147238D7D9C64097F88BE7B48A70E2A636DB40237C1B55958DBD90B0EC17368DF34682A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 c8af2117589cb90ab44bd97daa05461df7c567971d8c883592ca9676da1d7790
MD5 e3ba7d1deaae6950805c3c8b3416bc3e
SHA1 f8b8c62e983993d9ac42655c01a6629399665242
SHA512 de57a83a55d40ef1b7ea0ec9029b373ea1c50d3482d1555ce01d79e1c42d29f2f0624ee9238e17b1a8d22066f6a16e353960d2798d9a73036f6b6e37b1e34c64
SSDEEP 768:NjaeqD4MlshiLdMms35+SfFrfgMfgDm62tbnuGfD1i1TT:NqcjhIdMD3pfxfVfl62tbnxhU
TLSH
T15603BF35E8684C779CB2A545B24737D3AEF405B386856F98ECD95B0E05933CE224B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 a9cb424abbeb05e159f1d26e5564927475505d474b4309fbf5b4a569c33b37dd
MD5 125ca405f99b679d40fedb71fdcd7df9
SHA1 cc609d29850ab7896b7a1a89523f3fec314d18c4
SHA512 68aa921d1e99c284e68ef5056e48776dcfdeb4c03717d8f36dc31e688cb886a39effb8e9ca92bebfb26cdae66ce02732c8c8b217d0ac71a711c1fbac29d993a7
SSDEEP 768:ajaeqD4MlshiLdMms3w9AfFrfgF62tbnuGfTQ+ApXpfTS:aqcjhIdMD3wqfxf862tbnxU+KXs
TLSH
T1D703BF3AD86848779CB3A585B24677936FB442A3C7C53B98ECDD1B0D02A72CD634742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 59e0ffaa1939bbfd2c166acfce450b097b082bdf0ec2946d1d7927b0ef8aecf6
MD5 3758c7df4457dc9b89054b9f0d40577a
SHA1 2c4ed17180842a03b6f4c51b33d789b557be08d9
SHA512 8d49eee9e8dfb4165a741fd098154a3a03714578f92eac3a50725747c79a3449863a92dce10aecc17b0dcefe0412a0d8e49765a7c233d689c81ee4a83743e462
SSDEEP 3:MsEllllkEthXllkl2zEflRlKl/:/M/xT02z
TLSH
T1944404447FC00405D74413304051C3545370F5100713574334F704335CC75400C00000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

25819eba-f34c-436d-8994-8dd15fab0679.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\25819eba-f34c-436d-8994-8dd15fab0679.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 40ad2c139d4393721e66c69c9c17c6c494f6b401a05da596bdff4f009e3cfcbc
MD5 dd42b9d93d5c86f97f15a86c23ddf9ef
SHA1 c279fee1d5e2531ffe31d2715fa0d72cfe65bede
SHA512 86e0fef3d69ab7ff0f86f994e4b65691e635129403517494da278a52335b0586e8344484cc862a17a9cc281c9aa45ccb942ddb954c49ce0929cdda9c63318ae3
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 216418374a18bf020a12aadfb9a580e63bd2af01b597a1a063dadf6cfbb49fde
MD5 21489755d35343faebdc49bee654be58
SHA1 7bc3b2c062542f8b37caaefe10a91298f824feff
SHA512 11227b8e2eedb5b1068d6ed76cabadaf100a599dc950ec1a98333c576a63ec0f33188120e6658ce00257af4ff38816cbc34c78efa9f3848d2136ef45a7fe3cc3
TLSH
T102D0129F32010174C01021730002A5080400D21BD14642056829DA6D1A0C2540D03441
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView\Default\Extension Scripts\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView\Local State
Size 3KB
SHA256 e5e49f6e31d11eccd1ce5ce86b1e809717e66832ecf2b978f0a7461f8d6025e6
MD5 ad88d2a62045662cf9f91adc8f3a494d
SHA1 1fff5eba42f1bca3648002de4e7673ff70ddd741
SHA512 8f077243c9ab6bdea7b68a022e4dd7016c863b6a53c9fe522a2904643c917d4c7b03366216711fc1e358b0313c11b288d74a2a391314af18a0fb7785ff2e5994
TLSH
T19581843654A0997B89E3960579873B57ABA54037FAD23FA4DAEC0F0C01CB6D92353C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView\Local State
Size 2KB
SHA256 a18ac91ae09525534564e17b638246432dd35df14bbb334c9feb4e8247db9d63
MD5 6a4092358411fe764f2d6891ff7ba0e3
SHA1 9476eacdea2ec81ecc4928656c98ec818f7f7537
SHA512 9e7263423f6a9244193bb131d45babbd37e86fd3ceef3c09e330213a1fa1efae7e5559831875ca156b5f2c75e4fe096699bb4dc4ab10fedcca089c7cc50e20e0
TLSH
T1D151857368505A76C6E34705794B3B639E754065BBA32F90AADD0B0C00DBDAC2353C3B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView\Local State
Size 3KB
SHA256 872d2bb0d22206de5f5c398bdac3240f832f6456e164835f475ab9a9c5bf784c
MD5 6298f7230a824b7bfa60053a51e7a1af
SHA1 445a234b138cd20532d00099bb1bd80754303936
SHA512 715c0bd05b92b9e29a94ebe7e9c790630f38c86c2c92dbd66f905d2adc4a6ab10368f5d528cd13750580f6072aafad45ce42dd7d7e60956ef6a65446dfef3f3e
TLSH
T1E371867768A0997789E3870579872B16AB914027FAD27F94D5EC0F0C01D7AD81352C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView\Local State
Size 14KB
SHA256 d5faf895f4373fb5380e4d5721d96f5108a7635032197a6b2aacfd7fb3a41abd
MD5 02fd095ed0e7954ed6ad989814dcb7a0
SHA1 8e6bf9b62b5cda11898f47319b7fe4974213b688
SHA512 8b809d1abce9c0d03e1853f00481fae1dd50834913079bc8734089dc67dc5b15d7c232e1dbfa2cfebea6329e133fedbc1cd7d5fbdb9c2eb65dc3a6ec318e3061
SSDEEP 384:3Ojae3af7pOMe4tyUOh8iqLyWpMmGrNBSydIyHSLo:ejaeqD4MlshiLdMm5HU
TLSH
T1ED62AEAF59B429B78D7394067A462A975B3040A9D6D27F9DECDC1B0D01D71CE1242C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe58b764.TMP

Path C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView\Local State~RFe58b764.TMP
Size 1KB
SHA256 19d11bca5b28365905ee8a5ece1477fef0fa560dd285bb46919bbed17a3a00ca
MD5 33d21d792012477255409eb841b80dcd
SHA1 0079fe4e287080eb2f6de72fc1548e4f401f162a
SHA512 6cf954de766717ba51d9de4d671358a48f72e0db4573d3f04dee8df47aa6d30e64d40774cf7d6c03e96c1d6184e521d3bab9212de02ba579cebea0fb092684e6
TLSH
T1773154B3A4E00B72A992530736077AE79E21007AA6924F8471DE4B0C19DB9CD667B837
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir700_817116737\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XENO_CACHE.bin

Path C:\Users\Admin\AppData\Local\Xeno\XENO_CACHE.bin
Size 36B
SHA256 3bab55816f9c1c63b26bee8027a74983736938cfa748d9c91230391d4bacfb88
MD5 03b4e88d732421deccbdd05cb90b0513
SHA1 1ba9d3bd3af60ecc041e93251633b5a0fbac4d9b
SHA512 40e01403608fc8d8c0bc7bc6e1367a472778dea5d4dde4d242b37b0860d098075ac71cf24abd85c6b9ee67bf6adf80adaaf279a969f4477555807003276a2c75
MD5 SHA1 SHA512

Submit Download

settings.json

Path C:\Users\Admin\AppData\Local\Xeno\settings.json
Size 101B
SHA256 88e5c8567b1cad0fa2a42a21ac273a1ffb8a6992be41e5de548d11f281f4c373
MD5 7109faf92716c37ae9d65f89a2477be0
SHA1 de2903bb44600fd8a69649c395335d4fc226c5e0
SHA512 f41ca49622d3458c1365fd9f610e1c27fd3dd816ce5c910e785532dcc39d94ceb1a00991909cc247ab4b9e9da0ac583245168853d8bdcc235116f0a7a4538b2f
TLSH
T11CB09232984108FC01608299C841D80203118E0120662E02B4BE025928308346000FD8
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1300-149-0x00007FF8BE910000-0x00007FF8BE911000-memory.dmp

Download

memory/3304-135-0x00007FF8BE910000-0x00007FF8BE911000-memory.dmp

Download