Overview

overview

8

Static

static

1

URLScan

urlscan

1

https://cdn.discorda...

windows10-2004-x64

8

Resubmissions

11/07/2026, 04:52

260711-fhlk6sbz5k

11/07/2026, 04:34

260711-e7ey9abx3m8

Analysis

  • user interaction
    yes
  • max time kernel
    273s
  • max time network
    271s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    11/07/2026, 04:34

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    https://cdn.discordapp.com/attachments/1495721562727383166/1524327608529981450/Xeno-v1.3.55.zip?ex=6a52a3f6&is=6a515276&hm=1dec7e15e06a83e768372c13a2605cc77b13e9981c5776df88da24ec00d1f614&
  • Sample260711-e7ey9abx3m
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Downloads MZ/PE file 1 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 23 IoCs
  • Loads dropped DLL 64 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 41 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 4 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks processor information in registry 2 TTPs 24 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 15 IoCs
  • Modifies data under HKEY_USERS 19 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1495721562727383166/1524327608529981450/Xeno-v1.3.55.zip?ex=6a52a3f6&is=6a515276&hm=1dec7e15e06a83e768372c13a2605cc77b13e9981c5776df88da24ec00d1f614&
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2656
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffb32f3c188,0x7ffb32f3c194,0x7ffb32f3c1a0
      2⤵
        PID:1760
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1976,i,9076428661011482828,11715830572217541749,524288 --field-trial-handle=2260,i,5903040787339608234,11300365952909884717,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:3
        2⤵
        • System Time Discovery
        PID:3436
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1676,i,1453322877964988258,3950022116686004288,262144 --field-trial-handle=2260,i,5903040787339608234,11300365952909884717,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:2
        2⤵
          PID:3744
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2560,i,12739004457369777821,8997452298318585179,524288 --field-trial-handle=2260,i,5903040787339608234,11300365952909884717,262144 --variations-seed-version --mojo-platform-channel-handle=2728 /prefetch:8
          2⤵
            PID:4480
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,5618729722650671884,14452993970740444679,2097152 --field-trial-handle=2260,i,5903040787339608234,11300365952909884717,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
            2⤵
              PID:6100
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,12047389262812322573,1280817651672162284,2097152 --field-trial-handle=2260,i,5903040787339608234,11300365952909884717,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
              2⤵
                PID:2740
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4148,i,6992787117672287200,17571442475180393149,2097152 --field-trial-handle=2260,i,5903040787339608234,11300365952909884717,262144 --variations-seed-version --mojo-platform-channel-handle=4160 /prefetch:1
                2⤵
                  PID:3240
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4176,i,7670141522453309244,13911409378852393045,2097152 --field-trial-handle=2260,i,5903040787339608234,11300365952909884717,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:2
                  2⤵
                    PID:5328
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3560,i,7815748675521115303,3385221927194524792,524288 --field-trial-handle=2260,i,5903040787339608234,11300365952909884717,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:8
                    2⤵
                      PID:2492
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4788,i,8697945210968711937,5873835802261164359,524288 --field-trial-handle=2260,i,5903040787339608234,11300365952909884717,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:8
                      2⤵
                        PID:772
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5648,i,7036033657022578566,649779445225026116,524288 --field-trial-handle=2260,i,5903040787339608234,11300365952909884717,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:8
                        2⤵
                          PID:3372
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5680,i,867357923552560122,4373851136573455994,2097152 --field-trial-handle=2260,i,5903040787339608234,11300365952909884717,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:1
                          2⤵
                            PID:3168
                          • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,1596817669176890711,10277966851395547551,524288 --field-trial-handle=2260,i,5903040787339608234,11300365952909884717,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:8
                            2⤵
                              PID:1720
                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,1596817669176890711,10277966851395547551,524288 --field-trial-handle=2260,i,5903040787339608234,11300365952909884717,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:8
                              2⤵
                                PID:800
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6448,i,12971236769449658604,9557136731705190114,524288 --field-trial-handle=2260,i,5903040787339608234,11300365952909884717,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:8
                                2⤵
                                  PID:400
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2664,i,16970453460850761341,15936760940626903841,524288 --field-trial-handle=2260,i,5903040787339608234,11300365952909884717,262144 --variations-seed-version --mojo-platform-channel-handle=4776 /prefetch:8
                                  2⤵
                                    PID:4252
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4176,i,2360804644665757823,15239912903591764790,524288 --field-trial-handle=2260,i,5903040787339608234,11300365952909884717,262144 --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:8
                                    2⤵
                                      PID:972
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4112,i,12407774475595495038,2733337172348688493,524288 --field-trial-handle=2260,i,5903040787339608234,11300365952909884717,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:8
                                      2⤵
                                        PID:6012
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2788,i,344530479369676398,14018662910588777364,524288 --field-trial-handle=2260,i,5903040787339608234,11300365952909884717,262144 --variations-seed-version --mojo-platform-channel-handle=2912 /prefetch:8
                                        2⤵
                                          PID:64
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                        1⤵
                                          PID:4160
                                        • C:\Windows\System32\rundll32.exe
                                          C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                          1⤵
                                            PID:1636
                                          • C:\Users\Admin\Downloads\Xeno-v1.3.55\Xeno-v1.3.55\XenoLauncher.exe
                                            "C:\Users\Admin\Downloads\Xeno-v1.3.55\Xeno-v1.3.55\XenoLauncher.exe"
                                            1⤵
                                            • Suspicious use of WriteProcessMemory
                                            PID:2248
                                            • C:\Users\Admin\AppData\Local\Temp\43930E7B\Launcher.exe
                                              "C:\Users\Admin\AppData\Local\Temp\43930E7B\Launcher.exe"
                                              2⤵
                                              • Executes dropped EXE
                                              • Checks processor information in registry
                                              PID:5296
                                            • C:\Users\Admin\AppData\Local\Temp\43930E7B\Xeno.exe
                                              "C:\Users\Admin\AppData\Local\Temp\43930E7B\Xeno.exe"
                                              2⤵
                                              • Executes dropped EXE
                                              PID:5968
                                          • C:\Users\Admin\Downloads\Xeno-v1.3.55\Xeno-v1.3.55\XenoLauncher.exe
                                            "C:\Users\Admin\Downloads\Xeno-v1.3.55\Xeno-v1.3.55\XenoLauncher.exe"
                                            1⤵
                                            • Suspicious use of WriteProcessMemory
                                            PID:1628
                                            • C:\Users\Admin\AppData\Local\Temp\A7A40E7B\Launcher.exe
                                              "C:\Users\Admin\AppData\Local\Temp\A7A40E7B\Launcher.exe"
                                              2⤵
                                              • Executes dropped EXE
                                              • Checks processor information in registry
                                              PID:2872
                                            • C:\Users\Admin\AppData\Local\Temp\A7A40E7B\Xeno.exe
                                              "C:\Users\Admin\AppData\Local\Temp\A7A40E7B\Xeno.exe"
                                              2⤵
                                              • Executes dropped EXE
                                              PID:4344
                                          • C:\Users\Admin\Downloads\Xeno-v1.3.55\Xeno-v1.3.55\XenoLauncher.exe
                                            "C:\Users\Admin\Downloads\Xeno-v1.3.55\Xeno-v1.3.55\XenoLauncher.exe"
                                            1⤵
                                            • Suspicious use of WriteProcessMemory
                                            PID:5084
                                            • C:\Users\Admin\AppData\Local\Temp\C1170E7B\Launcher.exe
                                              "C:\Users\Admin\AppData\Local\Temp\C1170E7B\Launcher.exe"
                                              2⤵
                                              • Executes dropped EXE
                                              • Checks processor information in registry
                                              PID:412
                                            • C:\Users\Admin\AppData\Local\Temp\C1170E7B\Xeno.exe
                                              "C:\Users\Admin\AppData\Local\Temp\C1170E7B\Xeno.exe"
                                              2⤵
                                              • Executes dropped EXE
                                              PID:4872
                                          • C:\Users\Admin\Downloads\Xeno-v1.3.55\Xeno-v1.3.55\XenoLauncher.exe
                                            "C:\Users\Admin\Downloads\Xeno-v1.3.55\Xeno-v1.3.55\XenoLauncher.exe"
                                            1⤵
                                            • Suspicious use of WriteProcessMemory
                                            PID:5252
                                            • C:\Users\Admin\AppData\Local\Temp\8F2B0E7B\Launcher.exe
                                              "C:\Users\Admin\AppData\Local\Temp\8F2B0E7B\Launcher.exe"
                                              2⤵
                                              • Executes dropped EXE
                                              • Checks processor information in registry
                                              PID:6072
                                            • C:\Users\Admin\AppData\Local\Temp\8F2B0E7B\Xeno.exe
                                              "C:\Users\Admin\AppData\Local\Temp\8F2B0E7B\Xeno.exe"
                                              2⤵
                                              • Executes dropped EXE
                                              PID:3232
                                          • C:\Users\Admin\Downloads\Xeno-v1.3.55\Xeno-v1.3.55\Xeno.exe
                                            "C:\Users\Admin\Downloads\Xeno-v1.3.55\Xeno-v1.3.55\Xeno.exe"
                                            1⤵
                                            • Suspicious use of WriteProcessMemory
                                            PID:3776
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.NETCore.App&framework_version=9.0.0&arch=x64&rid=win-x64&os=win10&gui=true
                                              2⤵
                                              • Suspicious use of WriteProcessMemory
                                              PID:5872
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.NETCore.App&framework_version=9.0.0&arch=x64&rid=win-x64&os=win10&gui=true
                                                3⤵
                                                • Checks processor information in registry
                                                • Enumerates system info in registry
                                                • Modifies data under HKEY_USERS
                                                • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                • Suspicious use of FindShellTrayWindow
                                                • Suspicious use of SendNotifyMessage
                                                • Suspicious use of WriteProcessMemory
                                                PID:3512
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x25c,0x7ffb32f3c188,0x7ffb32f3c194,0x7ffb32f3c1a0
                                                  4⤵
                                                    PID:1452
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1928,i,6349335952171943699,2520457502914680376,524288 --field-trial-handle=2344,i,6995891301412413446,16928554272144537631,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:3
                                                    4⤵
                                                    • Downloads MZ/PE file
                                                    • System Time Discovery
                                                    PID:2868
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,8080460780590536452,801921620259679442,262144 --field-trial-handle=2344,i,6995891301412413446,16928554272144537631,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:2
                                                    4⤵
                                                      PID:3136
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2316,i,12610678113886028840,12298469369451145334,524288 --field-trial-handle=2344,i,6995891301412413446,16928554272144537631,262144 --variations-seed-version --mojo-platform-channel-handle=2600 /prefetch:8
                                                      4⤵
                                                        PID:2140
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3484,i,5125274217347128187,4605833506219956187,2097152 --field-trial-handle=2344,i,6995891301412413446,16928554272144537631,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
                                                        4⤵
                                                          PID:5348
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3488,i,17242495618780136836,4351062865825528153,2097152 --field-trial-handle=2344,i,6995891301412413446,16928554272144537631,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
                                                          4⤵
                                                            PID:5636
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4988,i,3931924456901816561,6172719112428091170,524288 --field-trial-handle=2344,i,6995891301412413446,16928554272144537631,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:8
                                                            4⤵
                                                              PID:1840
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4556,i,6085272716007023839,12934682526324896374,524288 --field-trial-handle=2344,i,6995891301412413446,16928554272144537631,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:8
                                                              4⤵
                                                                PID:2816
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5104,i,4455283580320945050,1841942293603947672,2097152 --field-trial-handle=2344,i,6995891301412413446,16928554272144537631,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:1
                                                                4⤵
                                                                  PID:2988
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,8512874707164826777,17787118233584936060,524288 --field-trial-handle=2344,i,6995891301412413446,16928554272144537631,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:8
                                                                  4⤵
                                                                    PID:2392
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5164,i,335130337098333645,10528575607638722013,2097152 --field-trial-handle=2344,i,6995891301412413446,16928554272144537631,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:1
                                                                    4⤵
                                                                      PID:640
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5792,i,15397528069685166070,9654415529420490336,524288 --field-trial-handle=2344,i,6995891301412413446,16928554272144537631,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:8
                                                                      4⤵
                                                                        PID:4908
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5796,i,17088296557784190946,4789925632292484041,524288 --field-trial-handle=2344,i,6995891301412413446,16928554272144537631,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:8
                                                                        4⤵
                                                                          PID:3276
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6580,i,13052329445503980103,3746146082396832708,524288 --field-trial-handle=2344,i,6995891301412413446,16928554272144537631,262144 --variations-seed-version --mojo-platform-channel-handle=6596 /prefetch:8
                                                                          4⤵
                                                                            PID:1096
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6580,i,13052329445503980103,3746146082396832708,524288 --field-trial-handle=2344,i,6995891301412413446,16928554272144537631,262144 --variations-seed-version --mojo-platform-channel-handle=6596 /prefetch:8
                                                                            4⤵
                                                                              PID:5332
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6524,i,13476127530785686217,17224871206257288256,524288 --field-trial-handle=2344,i,6995891301412413446,16928554272144537631,262144 --variations-seed-version --mojo-platform-channel-handle=6644 /prefetch:8
                                                                              4⤵
                                                                                PID:3248
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6860,i,1740495880341060363,10407252213702988774,524288 --field-trial-handle=2344,i,6995891301412413446,16928554272144537631,262144 --variations-seed-version --mojo-platform-channel-handle=6864 /prefetch:8
                                                                                4⤵
                                                                                  PID:4560
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6848,i,1297455912754497262,9960788247537867222,524288 --field-trial-handle=2344,i,6995891301412413446,16928554272144537631,262144 --variations-seed-version --mojo-platform-channel-handle=3760 /prefetch:8
                                                                                  4⤵
                                                                                    PID:1084
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6660,i,10294109285142986528,18261223150884967939,524288 --field-trial-handle=2344,i,6995891301412413446,16928554272144537631,262144 --variations-seed-version --mojo-platform-channel-handle=3772 /prefetch:8
                                                                                    4⤵
                                                                                      PID:5180
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5212,i,13522933573903467652,897950004889363547,524288 --field-trial-handle=2344,i,6995891301412413446,16928554272144537631,262144 --variations-seed-version --mojo-platform-channel-handle=4656 /prefetch:8
                                                                                      4⤵
                                                                                        PID:2624
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7296,i,12035699685656822295,4569740834507829761,524288 --field-trial-handle=2344,i,6995891301412413446,16928554272144537631,262144 --variations-seed-version --mojo-platform-channel-handle=7308 /prefetch:8
                                                                                        4⤵
                                                                                          PID:1136
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7296,i,285692553722687023,2174488254111074769,2097152 --field-trial-handle=2344,i,6995891301412413446,16928554272144537631,262144 --variations-seed-version --mojo-platform-channel-handle=7152 /prefetch:1
                                                                                          4⤵
                                                                                            PID:628
                                                                                          • C:\Users\Admin\Downloads\windowsdesktop-runtime-9.0.17-win-x64.exe
                                                                                            "C:\Users\Admin\Downloads\windowsdesktop-runtime-9.0.17-win-x64.exe"
                                                                                            4⤵
                                                                                            • Executes dropped EXE
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:3600
                                                                                            • C:\Windows\Temp\{683DA108-0A2A-42CD-A186-E44D59669F38}\.cr\windowsdesktop-runtime-9.0.17-win-x64.exe
                                                                                              "C:\Windows\Temp\{683DA108-0A2A-42CD-A186-E44D59669F38}\.cr\windowsdesktop-runtime-9.0.17-win-x64.exe" -burn.clean.room="C:\Users\Admin\Downloads\windowsdesktop-runtime-9.0.17-win-x64.exe" -burn.filehandle.attached=556 -burn.filehandle.self=692
                                                                                              5⤵
                                                                                              • Checks computer location settings
                                                                                              • Executes dropped EXE
                                                                                              • Loads dropped DLL
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              PID:5444
                                                                                              • C:\Windows\Temp\{39D559E0-57C5-4D51-BE83-1F94EC03B670}\.be\windowsdesktop-runtime-9.0.17-win-x64.exe
                                                                                                "C:\Windows\Temp\{39D559E0-57C5-4D51-BE83-1F94EC03B670}\.be\windowsdesktop-runtime-9.0.17-win-x64.exe" -q -burn.elevated BurnPipe.{17BBA6F4-C245-461A-8328-755F4D068333} {DD7FB46D-94A9-47B6-BCED-A91A5BD5CA8C} 5444
                                                                                                6⤵
                                                                                                • Executes dropped EXE
                                                                                                • Adds Run key to start application
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                • Modifies registry class
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                PID:2556
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7048,i,7680673061842533771,13211640113808455232,524288 --field-trial-handle=2344,i,6995891301412413446,16928554272144537631,262144 --variations-seed-version --mojo-platform-channel-handle=6976 /prefetch:8
                                                                                            4⤵
                                                                                              PID:6076
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3612,i,11384787843263883093,17224071339169690810,524288 --field-trial-handle=2344,i,6995891301412413446,16928554272144537631,262144 --variations-seed-version --mojo-platform-channel-handle=7288 /prefetch:8
                                                                                              4⤵
                                                                                                PID:3000
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7260,i,16328157150934310700,1696103751801080459,524288 --field-trial-handle=2344,i,6995891301412413446,16928554272144537631,262144 --variations-seed-version --mojo-platform-channel-handle=7268 /prefetch:8
                                                                                                4⤵
                                                                                                  PID:1176
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
                                                                                                  4⤵
                                                                                                  • Checks processor information in registry
                                                                                                  • Enumerates system info in registry
                                                                                                  • Modifies data under HKEY_USERS
                                                                                                  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                                                  PID:2268
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x240,0x244,0x248,0x23c,0x260,0x7ffb32f3c188,0x7ffb32f3c194,0x7ffb32f3c1a0
                                                                                                    5⤵
                                                                                                      PID:1176
                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1824,i,6050648984876788275,3940215354928747507,524288 --field-trial-handle=2636,i,17084015451868931110,17449075976497140478,262144 --variations-seed-version --mojo-platform-channel-handle=2672 /prefetch:3
                                                                                                      5⤵
                                                                                                      • System Time Discovery
                                                                                                      PID:3508
                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1644,i,15279884028558066913,11422875283606868208,262144 --field-trial-handle=2636,i,17084015451868931110,17449075976497140478,262144 --variations-seed-version --mojo-platform-channel-handle=2632 /prefetch:2
                                                                                                      5⤵
                                                                                                        PID:3304
                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2336,i,12293368647050597225,16712852433084406811,524288 --field-trial-handle=2636,i,17084015451868931110,17449075976497140478,262144 --variations-seed-version --mojo-platform-channel-handle=2680 /prefetch:8
                                                                                                        5⤵
                                                                                                          PID:2100
                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4508,i,11935169907995487482,14949785129016635412,524288 --field-trial-handle=2636,i,17084015451868931110,17449075976497140478,262144 --variations-seed-version --mojo-platform-channel-handle=4544 /prefetch:8
                                                                                                          5⤵
                                                                                                            PID:5572
                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4508,i,11935169907995487482,14949785129016635412,524288 --field-trial-handle=2636,i,17084015451868931110,17449075976497140478,262144 --variations-seed-version --mojo-platform-channel-handle=4544 /prefetch:8
                                                                                                            5⤵
                                                                                                              PID:5676
                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4696,i,16255970336127361512,10233856246761186067,2097152 --field-trial-handle=2636,i,17084015451868931110,17449075976497140478,262144 --variations-seed-version --mojo-platform-channel-handle=4948 /prefetch:1
                                                                                                              5⤵
                                                                                                                PID:4672
                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=4700,i,6152155122200084676,2313036485186446686,2097152 --field-trial-handle=2636,i,17084015451868931110,17449075976497140478,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:1
                                                                                                                5⤵
                                                                                                                  PID:5316
                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5412,i,1306380522112984427,6572083605394866293,524288 --field-trial-handle=2636,i,17084015451868931110,17449075976497140478,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:8
                                                                                                                  5⤵
                                                                                                                    PID:4636
                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5432,i,3550739056194529764,300090903076993198,524288 --field-trial-handle=2636,i,17084015451868931110,17449075976497140478,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:8
                                                                                                                    5⤵
                                                                                                                      PID:5732
                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5852,i,4791165198274368963,16150310286620836851,2097152 --field-trial-handle=2636,i,17084015451868931110,17449075976497140478,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:1
                                                                                                                      5⤵
                                                                                                                        PID:2740
                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5004,i,7606377750259135971,11660192375279701662,524288 --field-trial-handle=2636,i,17084015451868931110,17449075976497140478,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
                                                                                                                        5⤵
                                                                                                                          PID:2852
                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5028,i,17420154588223305646,4338500333347736542,524288 --field-trial-handle=2636,i,17084015451868931110,17449075976497140478,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
                                                                                                                          5⤵
                                                                                                                            PID:5604
                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
                                                                                                                            5⤵
                                                                                                                            • Checks processor information in registry
                                                                                                                            • Enumerates system info in registry
                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                            • Modifies registry class
                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                            PID:3836
                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffb32f3c188,0x7ffb32f3c194,0x7ffb32f3c1a0
                                                                                                                              6⤵
                                                                                                                                PID:532
                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1956,i,8289304899290654324,16119280991562625177,524288 --field-trial-handle=2328,i,3205617440394031437,14787601489878368114,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:3
                                                                                                                                6⤵
                                                                                                                                • System Time Discovery
                                                                                                                                PID:5432
                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1740,i,2716426383677109458,13682563370073847951,262144 --field-trial-handle=2328,i,3205617440394031437,14787601489878368114,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:2
                                                                                                                                6⤵
                                                                                                                                  PID:4176
                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2292,i,16332209370570945212,828253821826792933,524288 --field-trial-handle=2328,i,3205617440394031437,14787601489878368114,262144 --variations-seed-version --mojo-platform-channel-handle=2752 /prefetch:8
                                                                                                                                  6⤵
                                                                                                                                    PID:4316
                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4220,i,2850033724250340203,17403947467432306537,524288 --field-trial-handle=2328,i,3205617440394031437,14787601489878368114,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:8
                                                                                                                                    6⤵
                                                                                                                                      PID:4344
                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4220,i,2850033724250340203,17403947467432306537,524288 --field-trial-handle=2328,i,3205617440394031437,14787601489878368114,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:8
                                                                                                                                      6⤵
                                                                                                                                        PID:5316
                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4772,i,15849327407647219969,16593716379924716201,524288 --field-trial-handle=2328,i,3205617440394031437,14787601489878368114,262144 --variations-seed-version --mojo-platform-channel-handle=4756 /prefetch:8
                                                                                                                                        6⤵
                                                                                                                                          PID:1296
                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4780,i,6024576677842162778,5094311198222911722,524288 --field-trial-handle=2328,i,3205617440394031437,14787601489878368114,262144 --variations-seed-version --mojo-platform-channel-handle=4800 /prefetch:8
                                                                                                                                          6⤵
                                                                                                                                            PID:1096
                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4784,i,2381142707655364675,12394363729961604857,524288 --field-trial-handle=2328,i,3205617440394031437,14787601489878368114,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:8
                                                                                                                                            6⤵
                                                                                                                                              PID:2552
                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4868,i,15833705333749770116,3278198138706928747,524288 --field-trial-handle=2328,i,3205617440394031437,14787601489878368114,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:8
                                                                                                                                              6⤵
                                                                                                                                                PID:4060
                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4244,i,11758125334866948336,3017815878174745225,524288 --field-trial-handle=2328,i,3205617440394031437,14787601489878368114,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:8
                                                                                                                                                6⤵
                                                                                                                                                  PID:1448
                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                                                        1⤵
                                                                                                                                          PID:3456
                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                                                                                                                          1⤵
                                                                                                                                            PID:4308
                                                                                                                                          • C:\Windows\system32\msiexec.exe
                                                                                                                                            C:\Windows\system32\msiexec.exe /V
                                                                                                                                            1⤵
                                                                                                                                            • Enumerates connected drives
                                                                                                                                            • Drops file in Program Files directory
                                                                                                                                            • Drops file in Windows directory
                                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                                            • Modifies registry class
                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                            PID:5816
                                                                                                                                            • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                              C:\Windows\syswow64\MsiExec.exe -Embedding 4D08655ED8DEDD7B0D66C109D7CDB09A
                                                                                                                                              2⤵
                                                                                                                                              • Loads dropped DLL
                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                              PID:4000
                                                                                                                                            • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                              C:\Windows\syswow64\MsiExec.exe -Embedding 9E404B724300D68B78F6145469A26D2D
                                                                                                                                              2⤵
                                                                                                                                              • Loads dropped DLL
                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                              PID:1120
                                                                                                                                            • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                              C:\Windows\syswow64\MsiExec.exe -Embedding C401320ABF204EBEE7A95CC001DEEC4E
                                                                                                                                              2⤵
                                                                                                                                              • Loads dropped DLL
                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                              PID:2804
                                                                                                                                            • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                              C:\Windows\syswow64\MsiExec.exe -Embedding F6F9D00819EA9BB6732F0C73134080F8
                                                                                                                                              2⤵
                                                                                                                                              • Loads dropped DLL
                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                              PID:2852
                                                                                                                                            • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                              C:\Windows\syswow64\MsiExec.exe -Embedding 70280906E4C188CF69D21F2A24B17A56
                                                                                                                                              2⤵
                                                                                                                                              • Loads dropped DLL
                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                              PID:3336
                                                                                                                                            • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                              C:\Windows\syswow64\MsiExec.exe -Embedding 247990E51DD9CF7CF3BA6E7FE05B4103
                                                                                                                                              2⤵
                                                                                                                                              • Loads dropped DLL
                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                              PID:4988
                                                                                                                                          • C:\ProgramData\Package Cache\{df745324-5cb5-434e-80ec-1238a7c258a3}\windowsdesktop-runtime-9.0.17-win-x64.exe
                                                                                                                                            "C:\ProgramData\Package Cache\{df745324-5cb5-434e-80ec-1238a7c258a3}\windowsdesktop-runtime-9.0.17-win-x64.exe" /burn.runonce
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                            PID:5232
                                                                                                                                            • C:\ProgramData\Package Cache\{df745324-5cb5-434e-80ec-1238a7c258a3}\windowsdesktop-runtime-9.0.17-win-x64.exe
                                                                                                                                              "C:\ProgramData\Package Cache\{df745324-5cb5-434e-80ec-1238a7c258a3}\windowsdesktop-runtime-9.0.17-win-x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_9.0.17_(x64)_20260711053658.log"
                                                                                                                                              2⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                              PID:2612
                                                                                                                                              • C:\ProgramData\Package Cache\{df745324-5cb5-434e-80ec-1238a7c258a3}\windowsdesktop-runtime-9.0.17-win-x64.exe
                                                                                                                                                "C:\ProgramData\Package Cache\{df745324-5cb5-434e-80ec-1238a7c258a3}\windowsdesktop-runtime-9.0.17-win-x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{df745324-5cb5-434e-80ec-1238a7c258a3}\windowsdesktop-runtime-9.0.17-win-x64.exe" -burn.filehandle.attached=520 -burn.filehandle.self=540 /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_9.0.17_(x64)_20260711053658.log"
                                                                                                                                                3⤵
                                                                                                                                                • Checks computer location settings
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Loads dropped DLL
                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                PID:2404
                                                                                                                                                • C:\ProgramData\Package Cache\{df745324-5cb5-434e-80ec-1238a7c258a3}\windowsdesktop-runtime-9.0.17-win-x64.exe
                                                                                                                                                  "C:\ProgramData\Package Cache\{df745324-5cb5-434e-80ec-1238a7c258a3}\windowsdesktop-runtime-9.0.17-win-x64.exe" -q -burn.elevated BurnPipe.{0787FC71-C305-4DE0-8310-6961321E8BC5} {352648AA-5A8F-4009-ADAB-1FEF83F56970} 2404
                                                                                                                                                  4⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                  • Modifies registry class
                                                                                                                                                  PID:224
                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                                                            1⤵
                                                                                                                                              PID:6056
                                                                                                                                            • C:\Users\Admin\Downloads\Xeno-v1.3.55\Xeno-v1.3.55\XenoLauncher.exe
                                                                                                                                              "C:\Users\Admin\Downloads\Xeno-v1.3.55\Xeno-v1.3.55\XenoLauncher.exe"
                                                                                                                                              1⤵
                                                                                                                                                PID:2832
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\948F1E7B\Launcher.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\948F1E7B\Launcher.exe"
                                                                                                                                                  2⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • Checks processor information in registry
                                                                                                                                                  PID:532
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\948F1E7B\Xeno.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\948F1E7B\Xeno.exe"
                                                                                                                                                  2⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  PID:2884
                                                                                                                                              • C:\Users\Admin\Downloads\Xeno-v1.3.55\Xeno-v1.3.55\Xeno.exe
                                                                                                                                                "C:\Users\Admin\Downloads\Xeno-v1.3.55\Xeno-v1.3.55\Xeno.exe"
                                                                                                                                                1⤵
                                                                                                                                                • Loads dropped DLL
                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                PID:4036
                                                                                                                                                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                                                                  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Xeno.exe --webview-exe-version=1.3.55+87ae4f96f8a0927052c1120167982fb069afd1b4 --user-data-dir="C:\Users\Admin\Downloads\Xeno-v1.3.55\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --mojo-named-platform-channel-pipe=4036.2136.14232536447162267615
                                                                                                                                                  2⤵
                                                                                                                                                  • Enumerates system info in registry
                                                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                                                  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                                                                                                  PID:2528
                                                                                                                                                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                                                                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\Downloads\Xeno-v1.3.55\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\Downloads\Xeno-v1.3.55\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ffb2538b078,0x7ffb2538b084,0x7ffb2538b090
                                                                                                                                                    3⤵
                                                                                                                                                      PID:1836
                                                                                                                                                    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                                                                      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\Xeno-v1.3.55\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView" --webview-exe-name=Xeno.exe --webview-exe-version=1.3.55+87ae4f96f8a0927052c1120167982fb069afd1b4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1672,i,14326649113146620905,12424750990628740641,262144 --variations-seed-version --mojo-platform-channel-handle=1692 /prefetch:2
                                                                                                                                                      3⤵
                                                                                                                                                        PID:3844
                                                                                                                                                      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                                                                        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\Xeno-v1.3.55\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView" --webview-exe-name=Xeno.exe --webview-exe-version=1.3.55+87ae4f96f8a0927052c1120167982fb069afd1b4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2024,i,14326649113146620905,12424750990628740641,262144 --variations-seed-version --mojo-platform-channel-handle=1924 /prefetch:3
                                                                                                                                                        3⤵
                                                                                                                                                          PID:3272
                                                                                                                                                        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                                                                          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\Xeno-v1.3.55\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView" --webview-exe-name=Xeno.exe --webview-exe-version=1.3.55+87ae4f96f8a0927052c1120167982fb069afd1b4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2368,i,14326649113146620905,12424750990628740641,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:8
                                                                                                                                                          3⤵
                                                                                                                                                            PID:676
                                                                                                                                                          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                                                                            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\Xeno-v1.3.55\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView" --webview-exe-name=Xeno.exe --webview-exe-version=1.3.55+87ae4f96f8a0927052c1120167982fb069afd1b4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3612,i,14326649113146620905,12424750990628740641,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
                                                                                                                                                            3⤵
                                                                                                                                                              PID:3448
                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/xe-no
                                                                                                                                                            2⤵
                                                                                                                                                              PID:1636
                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                                                                            1⤵
                                                                                                                                                              PID:1724
                                                                                                                                                            • C:\Users\Admin\Downloads\Xeno-v1.3.55\Xeno-v1.3.55\XenoLauncher.exe
                                                                                                                                                              "C:\Users\Admin\Downloads\Xeno-v1.3.55\Xeno-v1.3.55\XenoLauncher.exe"
                                                                                                                                                              1⤵
                                                                                                                                                                PID:5988
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\B9BA2E7B\Launcher.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\B9BA2E7B\Launcher.exe"
                                                                                                                                                                  2⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  • Checks processor information in registry
                                                                                                                                                                  PID:1168
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\B9BA2E7B\Xeno.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\B9BA2E7B\Xeno.exe"
                                                                                                                                                                  2⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  PID:396
                                                                                                                                                              • C:\Users\Admin\Downloads\Xeno-v1.3.55\Xeno-v1.3.55\XenoLauncher.exe
                                                                                                                                                                "C:\Users\Admin\Downloads\Xeno-v1.3.55\Xeno-v1.3.55\XenoLauncher.exe"
                                                                                                                                                                1⤵
                                                                                                                                                                  PID:4704
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\DB2C2E7B\Launcher.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\DB2C2E7B\Launcher.exe"
                                                                                                                                                                    2⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    • Checks processor information in registry
                                                                                                                                                                    PID:3232
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\DB2C2E7B\Xeno.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\DB2C2E7B\Xeno.exe"
                                                                                                                                                                    2⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    PID:1720
                                                                                                                                                                • C:\Users\Admin\Downloads\Xeno-v1.3.55\Xeno-v1.3.55\XenoLauncher.exe
                                                                                                                                                                  "C:\Users\Admin\Downloads\Xeno-v1.3.55\Xeno-v1.3.55\XenoLauncher.exe"
                                                                                                                                                                  1⤵
                                                                                                                                                                    PID:216
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\9E173E7B\Launcher.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\9E173E7B\Launcher.exe"
                                                                                                                                                                      2⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      • Checks processor information in registry
                                                                                                                                                                      PID:4444
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\9E173E7B\Xeno.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\9E173E7B\Xeno.exe"
                                                                                                                                                                      2⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      PID:2872

                                                                                                                                                                  Network

                                                                                                                                                                        MITRE ATT&CK Enterprise v16

                                                                                                                                                                        Replay Monitor

                                                                                                                                                                        Loading Replay Monitor...

                                                                                                                                                                        Downloads

                                                                                                                                                                        e5a189d.rbs
                                                                                                                                                                        • Path C:\Config.Msi\e5a189d.rbs
                                                                                                                                                                        • Size 48KB
                                                                                                                                                                        • SHA256 d43a9401602e27c61093aeae7bff1eec60c498ae357e23aaac6cfa7097a73176
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        e5a18a2.rbs
                                                                                                                                                                        • Path C:\Config.Msi\e5a18a2.rbs
                                                                                                                                                                        • Size 9KB
                                                                                                                                                                        • SHA256 f7d8855f9b7bfa4d2a3b5d175fe799d2537f25953ba81d3b8bc909ddd85cd1c6
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        e5a18a7.rbs
                                                                                                                                                                        • Path C:\Config.Msi\e5a18a7.rbs
                                                                                                                                                                        • Size 10KB
                                                                                                                                                                        • SHA256 c7e66ca3e4af0295801625e49f66a2997ab95911074a8f4c316a6c10ea69eed0
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        e5a18ae.rbs
                                                                                                                                                                        • Path C:\Config.Msi\e5a18ae.rbs
                                                                                                                                                                        • Size 88KB
                                                                                                                                                                        • SHA256 f648d4bd571d0a05a353399784718bffaebb98ae89da9d3afface7715c07cadb
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        e5a18b2.rbs
                                                                                                                                                                        • Path C:\Config.Msi\e5a18b2.rbs
                                                                                                                                                                        • Size 3KB
                                                                                                                                                                        • SHA256 09309843a38577d5ac0e32aa123c85477ddd6d1ead35570d497a44cd7d6125c0
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        e5a18b5.rbs
                                                                                                                                                                        • Path C:\Config.Msi\e5a18b5.rbs
                                                                                                                                                                        • Size 3KB
                                                                                                                                                                        • SHA256 4cf320e30450271379223be662fc7e8faec60f0d633e5180e72b4aa1a6c36d62
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        manifest.json
                                                                                                                                                                        • Path C:\Program Files\chrome_Unpacker_BeginUnzipping3836_1116546214\manifest.json
                                                                                                                                                                        • Size 135B
                                                                                                                                                                        • SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        ThirdPartyNotices.txt
                                                                                                                                                                        • Path C:\Program Files\dotnet\ThirdPartyNotices.txt
                                                                                                                                                                        • Size 77KB
                                                                                                                                                                        • SHA256 e8ddd95ac905467e4e519b446ca023fa00c31732bebd9b66e65101c712092ee7
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        blocklist
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
                                                                                                                                                                        • Size 105KB
                                                                                                                                                                        • SHA256 bf637ca0b28ebd6e948876848ccfe71d201158d460d4ad944f124f9d17ee5472
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        protocols.json
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
                                                                                                                                                                        • Size 3KB
                                                                                                                                                                        • SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        settings.dat
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                        • Size 280B
                                                                                                                                                                        • SHA256 b1244de948ee50580bd6ad190ff4a7bc96daf1a372b5eaf9a3edaf798b2123f4
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        settings.dat
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                        • Size 280B
                                                                                                                                                                        • SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        settings.dat
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                        • Size 280B
                                                                                                                                                                        • SHA256 09feb6a8021b01251b5f6507b6843fccdfcdd4464b96e9d3ed20c244a8b69237
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        settings.dat
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                        • Size 280B
                                                                                                                                                                        • SHA256 9d9b938e7dfc76e833a40d1878cd6fa2891a7000747eeba85d0566f8336f21aa
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        settings.dat
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                        • Size 280B
                                                                                                                                                                        • SHA256 663b973c0839de7b5d72965a55ff05bf3265e6fc831aca22aad2d20d09b08e79
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        settings.dat
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                        • Size 280B
                                                                                                                                                                        • SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        BookmarkMergedSurfaceOrdering
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                                                                                                                        • Size 6B
                                                                                                                                                                        • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                        Submit Download

                                                                                                                                                                        the-real-index
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                        • Size 3KB
                                                                                                                                                                        • SHA256 98a6ac49ad1241837a3b1cdb46bafcaa0554bcbd0c2282ccaa9c18d8f1151177
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        the-real-index
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                        • Size 7KB
                                                                                                                                                                        • SHA256 c061c9961de4d730dfc1d2a199b72e2bf487014fcf81ab586c197204002b81c9
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        the-real-index
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                        • Size 3KB
                                                                                                                                                                        • SHA256 3707f1d2b370d3214142b26fe2505a3f93751cfbdde4cb300cdae90cc0e95121
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        the-real-index~RFe5852de.TMP
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5852de.TMP
                                                                                                                                                                        • Size 3KB
                                                                                                                                                                        • SHA256 aa3035b1f1b2f15aac32019db449caa33c8805bbad0d848cf3e33204d346133c
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        data_1
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
                                                                                                                                                                        • Size 264KB
                                                                                                                                                                        • SHA256 4e2067b0437030272efff9ad51030c83370df714c645c99767b976a0a5599467
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        SiteList-Enterprise.json
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                                                                                                                        • Size 2B
                                                                                                                                                                        • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                        Submit Download

                                                                                                                                                                        History
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
                                                                                                                                                                        • Size 204KB
                                                                                                                                                                        • SHA256 1a58cacc2a6482a81287567f8c4599765b5f98db8c5a87feaf5be2fce5400c4c
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        000003.log
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
                                                                                                                                                                        • Size 19B
                                                                                                                                                                        • SHA256 ab5c71347d95f319781df230012713c7819ac0d69373e8c9a7302cae3f9a04b7
                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                        Submit Download

                                                                                                                                                                        LOG
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
                                                                                                                                                                        • Size 331B
                                                                                                                                                                        • SHA256 4d4a53a7377e4966a79f036019f1fd6b3e5eebf1adaffb241b8712b8b1f936f4
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        Network Persistent State
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                                                                        • Size 111B
                                                                                                                                                                        • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        Network Persistent State
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                                                                        • Size 4KB
                                                                                                                                                                        • SHA256 992ee35ce834298d351ec89a56da7376d58fc8228d40229c1d6a427bb153ad4c
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        Network Persistent State
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                                                                        • Size 1KB
                                                                                                                                                                        • SHA256 6f3ca12b34aa302dafef06342605449f0529a7f5c3b8d04f29decbabf7df4eba
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        Network Persistent State
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                                                                        • Size 3KB
                                                                                                                                                                        • SHA256 a4679805a0f3e0d1408d036f8959c01da4760274be8c9d9b1b457345ede12cd8
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        TransportSecurity
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
                                                                                                                                                                        • Size 1KB
                                                                                                                                                                        • SHA256 df7628b5a9a4b66221d5da3b9e8cc76af3ccbbdb3ac896e2f19d32c7d92c7750
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        TransportSecurity
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
                                                                                                                                                                        • Size 1KB
                                                                                                                                                                        • SHA256 e8a91685cc03801d81a5a9909ae6457a1a2495b3caa3499242be4d5aa57933bc
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        b25f9c2f-a519-4478-86b7-fcb6968ef568.tmp
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\b25f9c2f-a519-4478-86b7-fcb6968ef568.tmp
                                                                                                                                                                        • Size 40B
                                                                                                                                                                        • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                        Submit Download

                                                                                                                                                                        e4366248-5969-4137-91b2-970a843fb1ed.tmp
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\e4366248-5969-4137-91b2-970a843fb1ed.tmp
                                                                                                                                                                        • Size 2B
                                                                                                                                                                        • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                        Submit Download

                                                                                                                                                                        Preferences
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                        • Size 12KB
                                                                                                                                                                        • SHA256 feaf658bdbbad2369ce1e339a32d4b475d789057269fdac9911beccdf4b1a9f6
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        Preferences
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                        • Size 15KB
                                                                                                                                                                        • SHA256 042344459a1d1c7038631af952269c43370337ec7c3dab0e1b8b0e678fc5bc9d
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        Preferences
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                        • Size 14KB
                                                                                                                                                                        • SHA256 40cdd088832956e099cc3f417153848d6785615689cc137722f15cabbf71714a
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        Preferences
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                        • Size 14KB
                                                                                                                                                                        • SHA256 2379c884c9bfc13c6a9f0582e49b563c920e34801a02d73ce5b9e10c442f85af
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        Preferences
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                        • Size 16KB
                                                                                                                                                                        • SHA256 7691c79438a2aeab789b1c257efcaa5ca364af8f2db30259a98ed0300797a48f
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        Preferences
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                        • Size 17KB
                                                                                                                                                                        • SHA256 99b098ea3ba3d3c36511ce261ad64d34d07d11feb4b7f93bdccedb60e7f06964
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        Secure Preferences
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                                                                                                        • Size 30KB
                                                                                                                                                                        • SHA256 9c434893f6d717dfd10ee7b77308b53958b60a33a67f7a82c5d446bdec9ed98e
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        index
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\b80e5386-03b5-48dc-812a-db2212589a69\index
                                                                                                                                                                        • Size 24B
                                                                                                                                                                        • SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                        Submit Download

                                                                                                                                                                        index.txt
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
                                                                                                                                                                        • Size 233B
                                                                                                                                                                        • SHA256 a9a0795d82336c5ee656349c8def00111178cdc243d23a7f19e939be01fb0d92
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        index.txt
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
                                                                                                                                                                        • Size 226B
                                                                                                                                                                        • SHA256 31988060f7b680552ee5ab97ab40011fca3c6495ee4d3ec5b4f5349f3fc18ffd
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        index.txt~RFe5aca08.TMP
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe5aca08.TMP
                                                                                                                                                                        • Size 138B
                                                                                                                                                                        • SHA256 b3d84cfaf65475493536f31e75c7fe25a7adb66df767f0df1c657c44fe005bb7
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        LOG
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
                                                                                                                                                                        • Size 335B
                                                                                                                                                                        • SHA256 2db27f39dfe6f98d0437b38b306a7e7ed3345c569b9ccd076ccb2bdf93e713e8
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        LOG
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
                                                                                                                                                                        • Size 350B
                                                                                                                                                                        • SHA256 10f9b7fcb61c437f57643f1a0680629b53015e49e61e36858494c6229abe2c48
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        000003.log
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
                                                                                                                                                                        • Size 175B
                                                                                                                                                                        • SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        LOG
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
                                                                                                                                                                        • Size 323B
                                                                                                                                                                        • SHA256 07cad9ae58ccea7a731201cf3476da893591d09ea78af08f9f9d2e148e8e7d71
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        sync_diagnostic.log
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                                                                                                                        • Size 6KB
                                                                                                                                                                        • SHA256 167d3ecc670c76703ff8e9ea64f2bb20395b738db319fb6e87f195fe02b40829
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        abcee6a1-ebaf-4ea7-98c8-c233d7bb927f.tmp
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\abcee6a1-ebaf-4ea7-98c8-c233d7bb927f.tmp
                                                                                                                                                                        • Size 106KB
                                                                                                                                                                        • SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        ca1badf4-35be-4962-9d1d-68b9881e4d70.tmp
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ca1badf4-35be-4962-9d1d-68b9881e4d70.tmp
                                                                                                                                                                        • Size 70KB
                                                                                                                                                                        • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        db25c319-de6e-498f-b099-2532d8526b79.tmp
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\db25c319-de6e-498f-b099-2532d8526b79.tmp
                                                                                                                                                                        • Size 414B
                                                                                                                                                                        • SHA256 5081ac43af1f6b1d1cb153b4481e3d27f771c46b53df14152a55e6d0605a2a6a
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        default_cloud_config.json
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
                                                                                                                                                                        • Size 13KB
                                                                                                                                                                        • SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        load_statistics.db
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db
                                                                                                                                                                        • Size 112KB
                                                                                                                                                                        • SHA256 e230b2854af58996f3a93834ce3e7e4fcabe8311f89173541f92cd281e04404c
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        000003.log
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
                                                                                                                                                                        • Size 1KB
                                                                                                                                                                        • SHA256 585123eaea876f6e82ca433a2abcc0e54c5ceed0b3166841c04e55e39b52a432
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        LOG
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
                                                                                                                                                                        • Size 337B
                                                                                                                                                                        • SHA256 512953eaa1adc5edaa5fc874d68239a60a4c1782f1131366f8ff6e4b7615999f
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        OperationConfig
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
                                                                                                                                                                        • Size 22KB
                                                                                                                                                                        • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        OperationConfig~RFe58f509.TMP
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe58f509.TMP
                                                                                                                                                                        • Size 3KB
                                                                                                                                                                        • SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        Last Version
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
                                                                                                                                                                        • Size 14B
                                                                                                                                                                        • SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                        Submit Download

                                                                                                                                                                        Local State
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                        • Size 19KB
                                                                                                                                                                        • SHA256 d125492492841d80cc76200f71bb72fa32d2fb114ac4398d131368abd1beeb9a
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        Local State
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                        • Size 23KB
                                                                                                                                                                        • SHA256 aec61aa222332ce6c8a3b88996efc5d6c2eb9a2860dd257fbbee2001b10df4b4
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        Local State
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                        • Size 23KB
                                                                                                                                                                        • SHA256 cef48c27afeccd2025078cfd0ba84ad913f9cfd31cf67928243d2b09fb7f06f2
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        Local State
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                        • Size 28KB
                                                                                                                                                                        • SHA256 5a16cd3dc3a213b471b49d62d0f8b8e5bc458c4172468eaedc9bb111a519d747
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        Local State
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                        • Size 28KB
                                                                                                                                                                        • SHA256 bc7bc5c1af2bf9d75c2e5a079281fdeeff3042a6bbdb835c5041c14e9a4c5d67
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        Local State
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                        • Size 8KB
                                                                                                                                                                        • SHA256 eaf65abe173c8191b47b1c6877eac557446a285b707337994e3d2972fa8bc999
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        Local State
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                        • Size 8KB
                                                                                                                                                                        • SHA256 cf060e0a7b1e717abdeff58302641496d9a29ce88ce702ba14c10081de2d81e6
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        Local State
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                        • Size 19KB
                                                                                                                                                                        • SHA256 f996df97000a8b6dc882155b11f56826dcc2387239b5b108d37cfa2e5f699beb
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        Local State
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                        • Size 29KB
                                                                                                                                                                        • SHA256 77a9aa8a7e9f89e011f9634554ea4c4dc91c7012bd6ad96133f30449ec4db876
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        Local State
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                        • Size 19KB
                                                                                                                                                                        • SHA256 6b60cb658f579ec59c96dd0221f043f56bf882f3026d07a57da063b4b57ab000
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        Local State
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                        • Size 22KB
                                                                                                                                                                        • SHA256 37576458cdc2f7cad1db86e7df74d5920b02f7877e7a852029067eb4bb02d8c4
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        Local State
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                        • Size 29KB
                                                                                                                                                                        • SHA256 1c96aa53de7137ee3d65746bb5454828e1ca6458d1af91c35ed0d52caaaa5871
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        Local State
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                        • Size 25KB
                                                                                                                                                                        • SHA256 04d8c168373a410df93971a7ff0fc421e67bfa69a7ff458892bd88aa2d6f1b2e
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        manifest.json
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\OriginTrials\0.0.1.7\manifest.json
                                                                                                                                                                        • Size 43B
                                                                                                                                                                        • SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                        Submit Download

                                                                                                                                                                        data_1
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
                                                                                                                                                                        • Size 264KB
                                                                                                                                                                        • SHA256 d579e1a30cecda63fb355242af9df9fe38e6c76db0bb1daac0576c1891a58acf
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        Variations
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
                                                                                                                                                                        • Size 86B
                                                                                                                                                                        • SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        metadata.json
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                        • Size 132B
                                                                                                                                                                        • SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        eddaaccb-42d0-4213-b5a8-42fc3707e93f.tmp
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\eddaaccb-42d0-4213-b5a8-42fc3707e93f.tmp
                                                                                                                                                                        • Size 13B
                                                                                                                                                                        • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                        Submit Download

                                                                                                                                                                        5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                                                                                                                                        • Size 2KB
                                                                                                                                                                        • SHA256 0c0e62770e3f0c10ea20957d6039147f448880e66879d4e6c52be17855a25cca
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        0d3fa701-f716-42c9-9cc2-93bd232bb10d.tmp
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\0d3fa701-f716-42c9-9cc2-93bd232bb10d.tmp
                                                                                                                                                                        • Size 1B
                                                                                                                                                                        • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                        Submit Download

                                                                                                                                                                        Launcher.exe
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\43930E7B\Launcher.exe
                                                                                                                                                                        • Size 1.1MB
                                                                                                                                                                        • SHA256 987b2ffc81123940cab2b77b1b9771079faa005e9a4931ce583a893d8c0f20f4
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        Xeno.exe
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\43930E7B\Xeno.exe
                                                                                                                                                                        • Size 164KB
                                                                                                                                                                        • SHA256 a1bb4867aa671672757bd123ae737c7f2af4bd5bb51b86cf357ae44db4ea0096
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        929695c6-c09b-44e7-b1ff-4b39e90dd87a.tmp
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\929695c6-c09b-44e7-b1ff-4b39e90dd87a.tmp
                                                                                                                                                                        • Size 10KB
                                                                                                                                                                        • SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        9c8cc8ff-7529-4384-ab71-bc60f2988ee4.tmp
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3512_49565528\9c8cc8ff-7529-4384-ab71-bc60f2988ee4.tmp
                                                                                                                                                                        • Size 152KB
                                                                                                                                                                        • SHA256 f83832c37a0969ce89f77b16eaa07457b03f43029abaec00eaedce2674adbaf5
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        content_new.js
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3512_696453676\CRX_INSTALL\content_new.js
                                                                                                                                                                        • Size 10KB
                                                                                                                                                                        • SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        XENO_CACHE.bin
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Xeno\XENO_CACHE.bin
                                                                                                                                                                        • Size 36B
                                                                                                                                                                        • SHA256 3bab55816f9c1c63b26bee8027a74983736938cfa748d9c91230391d4bacfb88
                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                        Submit Download

                                                                                                                                                                        settings.json
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Xeno\settings.json
                                                                                                                                                                        • Size 101B
                                                                                                                                                                        • SHA256 88e5c8567b1cad0fa2a42a21ac273a1ffb8a6992be41e5de548d11f281f4c373
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        settings.dat
                                                                                                                                                                        • Path C:\Users\Admin\Downloads\Xeno-v1.3.55\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView\Crashpad\settings.dat
                                                                                                                                                                        • Size 280B
                                                                                                                                                                        • SHA256 d6d614e3bf0aec862a6b11030319847263cc1f37e81399a4795c3c0d72da9f87
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        data_0
                                                                                                                                                                        • Path C:\Users\Admin\Downloads\Xeno-v1.3.55\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_0
                                                                                                                                                                        • Size 8KB
                                                                                                                                                                        • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                        Submit Download

                                                                                                                                                                        data_2
                                                                                                                                                                        • Path C:\Users\Admin\Downloads\Xeno-v1.3.55\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_2
                                                                                                                                                                        • Size 8KB
                                                                                                                                                                        • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                        Submit Download

                                                                                                                                                                        data_3
                                                                                                                                                                        • Path C:\Users\Admin\Downloads\Xeno-v1.3.55\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_3
                                                                                                                                                                        • Size 8KB
                                                                                                                                                                        • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                        Submit Download

                                                                                                                                                                        Network Persistent State
                                                                                                                                                                        • Path C:\Users\Admin\Downloads\Xeno-v1.3.55\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView\Default\Network\Network Persistent State
                                                                                                                                                                        • Size 229B
                                                                                                                                                                        • SHA256 153938ecc186cd98a2f1ebd1f53ae88cfe9d9884bd470e9166a53348a071fb2b
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        Network Persistent State~RFe5b28e1.TMP
                                                                                                                                                                        • Path C:\Users\Admin\Downloads\Xeno-v1.3.55\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView\Default\Network\Network Persistent State~RFe5b28e1.TMP
                                                                                                                                                                        • Size 59B
                                                                                                                                                                        • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        Preferences
                                                                                                                                                                        • Path C:\Users\Admin\Downloads\Xeno-v1.3.55\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView\Default\Preferences
                                                                                                                                                                        • Size 6KB
                                                                                                                                                                        • SHA256 24776e707a88cfe4730bb33e031af52e3f35030c87a2eec08c29c08eb87c9cf9
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        Preferences~RFe5b2874.TMP
                                                                                                                                                                        • Path C:\Users\Admin\Downloads\Xeno-v1.3.55\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView\Default\Preferences~RFe5b2874.TMP
                                                                                                                                                                        • Size 6KB
                                                                                                                                                                        • SHA256 5d17e134c9e2cf45ddd48666503dd514baba16dc2e97ca1f17e5db0b573b0117
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        CURRENT
                                                                                                                                                                        • Path C:\Users\Admin\Downloads\Xeno-v1.3.55\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView\Default\Sync Data\LevelDB\CURRENT
                                                                                                                                                                        • Size 16B
                                                                                                                                                                        • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                        Submit Download

                                                                                                                                                                        MANIFEST-000001
                                                                                                                                                                        • Path C:\Users\Admin\Downloads\Xeno-v1.3.55\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
                                                                                                                                                                        • Size 41B
                                                                                                                                                                        • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                        Submit Download

                                                                                                                                                                        Local State
                                                                                                                                                                        • Path C:\Users\Admin\Downloads\Xeno-v1.3.55\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView\Local State
                                                                                                                                                                        • Size 2KB
                                                                                                                                                                        • SHA256 cc18c051693db8a5287815d0a352d99824028d62a5fd329e8ad68a9ce03ccc90
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        Local State
                                                                                                                                                                        • Path C:\Users\Admin\Downloads\Xeno-v1.3.55\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView\Local State
                                                                                                                                                                        • Size 3KB
                                                                                                                                                                        • SHA256 6dea5f2f62eb69e6544203d37ea5f1d0e114e95599000a0cc6246b21c0291650
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        Local State
                                                                                                                                                                        • Path C:\Users\Admin\Downloads\Xeno-v1.3.55\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView\Local State
                                                                                                                                                                        • Size 1KB
                                                                                                                                                                        • SHA256 cc1806a8f70d2ec6392ed15f329b14c7d32c2888177d18243e48861128dc1ad4
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        Local State
                                                                                                                                                                        • Path C:\Users\Admin\Downloads\Xeno-v1.3.55\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView\Local State
                                                                                                                                                                        • Size 15KB
                                                                                                                                                                        • SHA256 0dca23652fc74f1db6c8921017017722b9935a204ee074d42303b96f3deaef86
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        Local State~RFe5ac0f0.TMP
                                                                                                                                                                        • Path C:\Users\Admin\Downloads\Xeno-v1.3.55\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView\Local State~RFe5ac0f0.TMP
                                                                                                                                                                        • Size 1KB
                                                                                                                                                                        • SHA256 4ebe8d2edca5f14ded75c7c1e651d55d554a5601c05af33200097638069c5427
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        MSI2EC5.tmp
                                                                                                                                                                        • Path C:\Windows\Installer\MSI2EC5.tmp
                                                                                                                                                                        • Size 219KB
                                                                                                                                                                        • SHA256 2bf33a9b9980e44d21d48f04cc6ac4eed4c68f207bd5990b7d3254a310b944ae
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        e5a189e.msi
                                                                                                                                                                        • Path C:\Windows\Installer\e5a189e.msi
                                                                                                                                                                        • Size 27.5MB
                                                                                                                                                                        • SHA256 d87c6a255667b9e92018c80cb3952ae9350a0374560fd49b4f02079e91266383
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        e5a189f.msi
                                                                                                                                                                        • Path C:\Windows\Installer\e5a189f.msi
                                                                                                                                                                        • Size 776KB
                                                                                                                                                                        • SHA256 fbb88be7b6a0d460c90624fda80eb12a68c7c042a727f0118e3aec3aa52283d9
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        e5a18af.msi
                                                                                                                                                                        • Path C:\Windows\Installer\e5a18af.msi
                                                                                                                                                                        • Size 29.9MB
                                                                                                                                                                        • SHA256 06421abd85426b1b9f068608ed89565559dd2734ae638a35ce9a541f8e12902a
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        bg.png
                                                                                                                                                                        • Path C:\Windows\Temp\{39D559E0-57C5-4D51-BE83-1F94EC03B670}\.ba\bg.png
                                                                                                                                                                        • Size 4KB
                                                                                                                                                                        • SHA256 9095bf7b6baa0107b40a4a6d727215be077133a190f4ca9bd89a176842141e79
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        windowsdesktop-runtime-9.0.17-win-x64.exe
                                                                                                                                                                        • Path C:\Windows\Temp\{39D559E0-57C5-4D51-BE83-1F94EC03B670}\.be\windowsdesktop-runtime-9.0.17-win-x64.exe
                                                                                                                                                                        • Size 607KB
                                                                                                                                                                        • SHA256 b0130d17ffd269d510eddb7026d2d8198f5b6e2c92b5c5f314daee1cd4882d9c
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        thm.wxl
                                                                                                                                                                        • Path C:\Windows\Temp\{5C7FF634-CA88-474C-9684-96E3035CCA7F}\.ba\1033\thm.wxl
                                                                                                                                                                        • Size 5KB
                                                                                                                                                                        • SHA256 81a68046b06e09385be8449373e7ceb9e79f7724c3cf11f0b18a4489a8d4926a
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        wixstdba.dll
                                                                                                                                                                        • Path C:\Windows\Temp\{5C7FF634-CA88-474C-9684-96E3035CCA7F}\.ba\wixstdba.dll
                                                                                                                                                                        • Size 190KB
                                                                                                                                                                        • SHA256 dcea15f3710822ffc262e62ec04cc7bbbf0f33f5d1a853609fbfb65cb6a45640
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        memory/676-2733-0x000002350F820000-0x000002350F850000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/676-2045-0x00007FFB4F140000-0x00007FFB4F141000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/676-2044-0x00007FFB4E4E0000-0x00007FFB4E4E1000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/3448-2074-0x00007FFB4DAD0000-0x00007FFB4DAD1000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/3844-1967-0x00007FFB4DAD0000-0x00007FFB4DAD1000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4036-2705-0x000001AC00C10000-0x000001AC00DDE000-memory.dmp
                                                                                                                                                                        Download