hxxps://github[.]com/xenoexecutorv2/xeno/releases

Analysis

user interaction
yes
max time kernel
109s
max time network
110s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/07/2026, 03:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/xenoexecutorv2/xeno/releases
Sample260716-eft9vsfz5z

Score

8^/10

collection credential_access defense_evasion discovery execution spyware stealer upx

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3808	powershell.exe
5100	powershell.exe
5928	powershell.exe
5952	powershell.exe

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
5100	powershell.exe

Clipboard Data 1 TTPs 2 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
2008	cmd.exe
5168	powershell.exe

Loads dropped DLL 37 IoCs

pid	Process
1840	XenoExecutor.exe
1840	XenoExecutor.exe
1840	XenoExecutor.exe
1840	XenoExecutor.exe
1840	XenoExecutor.exe
1840	XenoExecutor.exe
1840	XenoExecutor.exe
1840	XenoExecutor.exe
1840	XenoExecutor.exe
1840	XenoExecutor.exe
1840	XenoExecutor.exe
1840	XenoExecutor.exe
1840	XenoExecutor.exe
1840	XenoExecutor.exe
1840	XenoExecutor.exe
1840	XenoExecutor.exe
1840	XenoExecutor.exe
1840	XenoExecutor.exe
1840	XenoExecutor.exe
2648	XenoExecutor.exe
2648	XenoExecutor.exe
2648	XenoExecutor.exe
2648	XenoExecutor.exe
2648	XenoExecutor.exe
2648	XenoExecutor.exe
2648	XenoExecutor.exe
2648	XenoExecutor.exe
2648	XenoExecutor.exe
2648	XenoExecutor.exe
2648	XenoExecutor.exe
2648	XenoExecutor.exe
2648	XenoExecutor.exe
2648	XenoExecutor.exe
2648	XenoExecutor.exe
2648	XenoExecutor.exe
2648	XenoExecutor.exe
2648	XenoExecutor.exe

Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
147	ip-api.com

Enumerates processes with tasklist 1 TTPs 3 IoCs

discovery

Process Discovery

T1057

pid	Process
4704	tasklist.exe
3476	tasklist.exe
5176	tasklist.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00070000000244d7-467.dat	upx
behavioral1/memory/1840-471-0x00007FFFDC7F0000-0x00007FFFDCEFB000-memory.dmp	upx
behavioral1/files/0x00070000000244c5-473.dat	upx
behavioral1/memory/1840-478-0x00007FFFF0430000-0x00007FFFF043F000-memory.dmp	upx
behavioral1/files/0x00070000000244d4-477.dat	upx
behavioral1/memory/1840-475-0x00007FFFEF1A0000-0x00007FFFEF1C9000-memory.dmp	upx
behavioral1/files/0x00070000000244c4-479.dat	upx
behavioral1/memory/1840-482-0x00007FFFEF180000-0x00007FFFEF19A000-memory.dmp	upx
behavioral1/files/0x00070000000244c8-481.dat	upx
behavioral1/files/0x00070000000244d0-484.dat	upx
behavioral1/memory/1840-487-0x00007FFFDFCD0000-0x00007FFFDFD50000-memory.dmp	upx
behavioral1/memory/1840-486-0x00007FFFE1E80000-0x00007FFFE1EAC000-memory.dmp	upx
behavioral1/files/0x00070000000244d5-490.dat	upx
behavioral1/files/0x00070000000244cf-507.dat	upx
behavioral1/files/0x00070000000244ce-506.dat	upx
behavioral1/files/0x00070000000244cd-505.dat	upx
behavioral1/files/0x00070000000244cc-504.dat	upx
behavioral1/files/0x00070000000244ca-502.dat	upx
behavioral1/files/0x00070000000244c9-501.dat	upx
behavioral1/files/0x00070000000244c7-500.dat	upx
behavioral1/files/0x00070000000244c6-499.dat	upx
behavioral1/files/0x00070000000244c3-498.dat	upx
behavioral1/files/0x00070000000244e9-496.dat	upx
behavioral1/files/0x00070000000244e8-495.dat	upx
behavioral1/files/0x00070000000244da-494.dat	upx
behavioral1/files/0x00070000000244cb-503.dat	upx
behavioral1/files/0x00070000000244d6-491.dat	upx
behavioral1/files/0x00070000000244d3-489.dat	upx
behavioral1/memory/1840-512-0x00007FFFEFB00000-0x00007FFFEFB0F000-memory.dmp	upx
behavioral1/memory/1840-511-0x00007FFFEFD10000-0x00007FFFEFD1D000-memory.dmp	upx
behavioral1/memory/1840-516-0x00007FFFEF160000-0x00007FFFEF174000-memory.dmp	upx
behavioral1/memory/1840-517-0x00007FFFDC2B0000-0x00007FFFDC7E1000-memory.dmp	upx
behavioral1/memory/1840-515-0x00007FFFDC7F0000-0x00007FFFDCEFB000-memory.dmp	upx
behavioral1/memory/1840-524-0x00007FFFDFA90000-0x00007FFFDFAC4000-memory.dmp	upx
behavioral1/memory/1840-523-0x00007FFFEF1A0000-0x00007FFFEF1C9000-memory.dmp	upx
behavioral1/memory/1840-522-0x00007FFFDF9C0000-0x00007FFFDFA8E000-memory.dmp	upx
behavioral1/memory/1840-521-0x00007FFFEF090000-0x00007FFFEF0AA000-memory.dmp	upx
behavioral1/memory/1840-526-0x00007FFFF0430000-0x00007FFFF043F000-memory.dmp	upx
behavioral1/memory/1840-532-0x00007FFFDFCA0000-0x00007FFFDFCC6000-memory.dmp	upx
behavioral1/memory/1840-534-0x00007FFFDED80000-0x00007FFFDEF0A000-memory.dmp	upx
behavioral1/memory/1840-535-0x00007FFFEEE80000-0x00007FFFEEE8D000-memory.dmp	upx
behavioral1/memory/1840-536-0x00007FFFDF900000-0x00007FFFDF9BE000-memory.dmp	upx
behavioral1/memory/1840-598-0x00007FFFEF160000-0x00007FFFEF174000-memory.dmp	upx
behavioral1/memory/2648-599-0x00007FFFDB7F0000-0x00007FFFDBEFB000-memory.dmp	upx
behavioral1/memory/2648-602-0x00007FFFEED40000-0x00007FFFEED4F000-memory.dmp	upx
behavioral1/memory/2648-605-0x00007FFFE1CC0000-0x00007FFFE1CDA000-memory.dmp	upx
behavioral1/memory/1840-604-0x00007FFFDFA90000-0x00007FFFDFAC4000-memory.dmp	upx
behavioral1/memory/1840-603-0x00007FFFDF9C0000-0x00007FFFDFA8E000-memory.dmp	upx
behavioral1/memory/2648-601-0x00007FFFDF8D0000-0x00007FFFDF8F9000-memory.dmp	upx
behavioral1/memory/1840-600-0x00007FFFDC2B0000-0x00007FFFDC7E1000-memory.dmp	upx
behavioral1/memory/2648-607-0x00007FFFDF8A0000-0x00007FFFDF8CC000-memory.dmp	upx
behavioral1/memory/2648-606-0x00007FFFDED00000-0x00007FFFDED80000-memory.dmp	upx
behavioral1/memory/1840-608-0x00007FFFDFCA0000-0x00007FFFDFCC6000-memory.dmp	upx
behavioral1/memory/2648-611-0x00007FFFDF890000-0x00007FFFDF89F000-memory.dmp	upx
behavioral1/memory/2648-610-0x00007FFFE2220000-0x00007FFFE222D000-memory.dmp	upx
behavioral1/memory/1840-609-0x00007FFFDED80000-0x00007FFFDEF0A000-memory.dmp	upx
behavioral1/memory/1840-614-0x00007FFFDF900000-0x00007FFFDF9BE000-memory.dmp	upx
behavioral1/memory/2648-613-0x00007FFFDB050000-0x00007FFFDB581000-memory.dmp	upx
behavioral1/memory/2648-612-0x00007FFFDF860000-0x00007FFFDF874000-memory.dmp	upx
behavioral1/memory/2648-615-0x00007FFFDF3C0000-0x00007FFFDF3DA000-memory.dmp	upx
behavioral1/memory/2648-619-0x00007FFFDF8D0000-0x00007FFFDF8F9000-memory.dmp	upx
behavioral1/memory/2648-618-0x00007FFFDEC30000-0x00007FFFDECFE000-memory.dmp	upx
behavioral1/memory/2648-617-0x00007FFFDF380000-0x00007FFFDF3B4000-memory.dmp	upx
behavioral1/memory/2648-616-0x00007FFFDB7F0000-0x00007FFFDBEFB000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
996	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
4180	WMIC.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
5248	systeminfo.exe

Kills process with taskkill 10 IoCs

defense_evasion

pid	Process
3468	taskkill.exe
3620	taskkill.exe
5412	taskkill.exe
5660	taskkill.exe
5840	taskkill.exe
6064	taskkill.exe
3980	taskkill.exe
5172	taskkill.exe
5624	taskkill.exe
5780	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134286476147122573"	msedge.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{288D808F-3B8C-46C7-8AE7-D664C96D565C}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
3808	powershell.exe
3808	powershell.exe
5100	powershell.exe
5100	powershell.exe
3808	powershell.exe
5100	powershell.exe
5168	powershell.exe
5168	powershell.exe
5168	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe

Suspicious use of AdjustPrivilegeToken 57 IoCs

description	pid	Process
Token: SeDebugPrivilege	3808	powershell.exe
Token: SeDebugPrivilege	5100	powershell.exe
Token: SeDebugPrivilege	4704	tasklist.exe
Token: SeDebugPrivilege	3476	tasklist.exe
Token: SeIncreaseQuotaPrivilege	5184	WMIC.exe
Token: SeSecurityPrivilege	5184	WMIC.exe
Token: SeTakeOwnershipPrivilege	5184	WMIC.exe
Token: SeLoadDriverPrivilege	5184	WMIC.exe
Token: SeSystemProfilePrivilege	5184	WMIC.exe
Token: SeSystemtimePrivilege	5184	WMIC.exe
Token: SeProfSingleProcessPrivilege	5184	WMIC.exe
Token: SeIncBasePriorityPrivilege	5184	WMIC.exe
Token: SeCreatePagefilePrivilege	5184	WMIC.exe
Token: SeBackupPrivilege	5184	WMIC.exe
Token: SeRestorePrivilege	5184	WMIC.exe
Token: SeShutdownPrivilege	5184	WMIC.exe
Token: SeDebugPrivilege	5184	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5184	WMIC.exe
Token: SeRemoteShutdownPrivilege	5184	WMIC.exe
Token: SeUndockPrivilege	5184	WMIC.exe
Token: SeManageVolumePrivilege	5184	WMIC.exe
Token: 33	5184	WMIC.exe
Token: 34	5184	WMIC.exe
Token: 35	5184	WMIC.exe
Token: 36	5184	WMIC.exe
Token: SeDebugPrivilege	5176	tasklist.exe
Token: SeDebugPrivilege	5168	powershell.exe
Token: SeIncreaseQuotaPrivilege	5184	WMIC.exe
Token: SeSecurityPrivilege	5184	WMIC.exe
Token: SeTakeOwnershipPrivilege	5184	WMIC.exe
Token: SeLoadDriverPrivilege	5184	WMIC.exe
Token: SeSystemProfilePrivilege	5184	WMIC.exe
Token: SeSystemtimePrivilege	5184	WMIC.exe
Token: SeProfSingleProcessPrivilege	5184	WMIC.exe
Token: SeIncBasePriorityPrivilege	5184	WMIC.exe
Token: SeCreatePagefilePrivilege	5184	WMIC.exe
Token: SeBackupPrivilege	5184	WMIC.exe
Token: SeRestorePrivilege	5184	WMIC.exe
Token: SeShutdownPrivilege	5184	WMIC.exe
Token: SeDebugPrivilege	5184	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5184	WMIC.exe
Token: SeRemoteShutdownPrivilege	5184	WMIC.exe
Token: SeUndockPrivilege	5184	WMIC.exe
Token: SeManageVolumePrivilege	5184	WMIC.exe
Token: 33	5184	WMIC.exe
Token: 34	5184	WMIC.exe
Token: 35	5184	WMIC.exe
Token: 36	5184	WMIC.exe
Token: SeDebugPrivilege	5840	taskkill.exe
Token: SeDebugPrivilege	6064	taskkill.exe
Token: SeDebugPrivilege	3620	taskkill.exe
Token: SeDebugPrivilege	5412	taskkill.exe
Token: SeDebugPrivilege	3980	taskkill.exe
Token: SeDebugPrivilege	5172	taskkill.exe
Token: SeDebugPrivilege	5624	taskkill.exe
Token: SeDebugPrivilege	5660	taskkill.exe
Token: SeDebugPrivilege	5780	taskkill.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
660	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3696 wrote to memory of 5020	3696	msedge.exe	87
PID 3696 wrote to memory of 996	3696	msedge.exe	88
PID 3696 wrote to memory of 4560	3696	msedge.exe	89
PID 3696 wrote to memory of 4376	3696	msedge.exe	90
PID 3696 wrote to memory of 4560	3696	msedge.exe	89
PID 3696 wrote to memory of 4560	3696	msedge.exe	89
PID 3696 wrote to memory of 4376	3696	msedge.exe	90
PID 3696 wrote to memory of 3432	3696	msedge.exe	91
PID 3696 wrote to memory of 1428	3696	msedge.exe	92
PID 3696 wrote to memory of 3432	3696	msedge.exe	91
PID 3696 wrote to memory of 3432	3696	msedge.exe	91
PID 3696 wrote to memory of 1428	3696	msedge.exe	92
PID 3696 wrote to memory of 1428	3696	msedge.exe	92
PID 3696 wrote to memory of 832	3696	msedge.exe	94
PID 3696 wrote to memory of 832	3696	msedge.exe	94
PID 3696 wrote to memory of 832	3696	msedge.exe	94
PID 3696 wrote to memory of 960	3696	msedge.exe	95
PID 3696 wrote to memory of 960	3696	msedge.exe	95
PID 3696 wrote to memory of 960	3696	msedge.exe	95
PID 3696 wrote to memory of 5080	3696	msedge.exe	99
PID 3696 wrote to memory of 2020	3696	msedge.exe	100
PID 3696 wrote to memory of 5080	3696	msedge.exe	99
PID 3696 wrote to memory of 2020	3696	msedge.exe	100
PID 3696 wrote to memory of 3468	3696	msedge.exe	102
PID 3696 wrote to memory of 2224	3696	msedge.exe	112
PID 3696 wrote to memory of 2224	3696	msedge.exe	112
PID 3696 wrote to memory of 2224	3696	msedge.exe	112
PID 3696 wrote to memory of 4800	3696	msedge.exe	113
PID 3696 wrote to memory of 4800	3696	msedge.exe	113
PID 3696 wrote to memory of 4800	3696	msedge.exe	113
PID 3696 wrote to memory of 384	3696	msedge.exe	116
PID 3696 wrote to memory of 3908	3696	msedge.exe	117
PID 3696 wrote to memory of 4480	3696	msedge.exe	118
PID 3696 wrote to memory of 4968	3696	msedge.exe	122
PID 3696 wrote to memory of 4968	3696	msedge.exe	122
PID 3696 wrote to memory of 4180	3696	msedge.exe	123
PID 3696 wrote to memory of 4180	3696	msedge.exe	123
PID 3696 wrote to memory of 4180	3696	msedge.exe	123
PID 3696 wrote to memory of 3488	3696	msedge.exe	124
PID 3696 wrote to memory of 4808	3696	msedge.exe	126
PID 3696 wrote to memory of 4808	3696	msedge.exe	126
PID 540 wrote to memory of 1840	540	XenoExecutor.exe	130
PID 1840 wrote to memory of 3940	1840	XenoExecutor.exe	131
PID 1840 wrote to memory of 2848	1840	XenoExecutor.exe	132
PID 2848 wrote to memory of 5100	2848	cmd.exe	137
PID 3940 wrote to memory of 3808	3940	cmd.exe	136
PID 1860 wrote to memory of 2648	1860	XenoExecutor.exe	139
PID 1840 wrote to memory of 4776	1840	XenoExecutor.exe	143
PID 1840 wrote to memory of 1896	1840	XenoExecutor.exe	144
PID 1896 wrote to memory of 4704	1896	cmd.exe	147
PID 4776 wrote to memory of 3476	4776	cmd.exe	148
PID 1840 wrote to memory of 2160	1840	XenoExecutor.exe	149
PID 1840 wrote to memory of 2008	1840	XenoExecutor.exe	150
PID 1840 wrote to memory of 2200	1840	XenoExecutor.exe	152
PID 1840 wrote to memory of 1792	1840	XenoExecutor.exe	155
PID 1840 wrote to memory of 4460	1840	XenoExecutor.exe	158
PID 2008 wrote to memory of 5168	2008	cmd.exe	160
PID 2200 wrote to memory of 5176	2200	cmd.exe	161
PID 2160 wrote to memory of 5184	2160	cmd.exe	162
PID 1792 wrote to memory of 5240	1792	cmd.exe	163
PID 4460 wrote to memory of 5248	4460	cmd.exe	164
PID 1840 wrote to memory of 5388	1840	XenoExecutor.exe	165
PID 5388 wrote to memory of 5468	5388	cmd.exe	167
PID 1840 wrote to memory of 5484	1840	XenoExecutor.exe	168

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/xenoexecutorv2/xeno/releases
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7fffe1c8c188,0x7fffe1c8c194,0x7fffe1c8c1a0
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1960,i,9508625294385632550,5412239641427688639,524288 --field-trial-handle=3080,i,15664747516828464570,6011814243678357380,262144 --variations-seed-version --mojo-platform-channel-handle=3112 /prefetch:3
  2⤵
  - System Time Discovery
  PID:996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,15923786169604762336,828876286619708145,262144 --field-trial-handle=3080,i,15664747516828464570,6011814243678357380,262144 --variations-seed-version --mojo-platform-channel-handle=3056 /prefetch:2
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2220,i,10396036323428379456,12787746354226917945,524288 --field-trial-handle=3080,i,15664747516828464570,6011814243678357380,262144 --variations-seed-version --mojo-platform-channel-handle=3120 /prefetch:8
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,16312795059618809610,8160614573510407199,2097152 --field-trial-handle=3080,i,15664747516828464570,6011814243678357380,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,737237710132400665,17015633924173046700,2097152 --field-trial-handle=3080,i,15664747516828464570,6011814243678357380,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:1428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4164,i,668687427066932279,11445912446288275475,2097152 --field-trial-handle=3080,i,15664747516828464570,6011814243678357380,262144 --variations-seed-version --mojo-platform-channel-handle=4160 /prefetch:1
  2⤵
  PID:832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4184,i,9320281503720374467,1134363023786179620,2097152 --field-trial-handle=3080,i,15664747516828464570,6011814243678357380,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:2
  2⤵
  PID:960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,6491816024233386401,4811556951792172129,524288 --field-trial-handle=3080,i,15664747516828464570,6011814243678357380,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,3973076373942969478,15401307036588773207,524288 --field-trial-handle=3080,i,15664747516828464570,6011814243678357380,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,4628973642777369332,1371908199700533591,524288 --field-trial-handle=3080,i,15664747516828464570,6011814243678357380,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,4628973642777369332,1371908199700533591,524288 --field-trial-handle=3080,i,15664747516828464570,6011814243678357380,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4288,i,1546529506085603551,1249400551880640319,2097152 --field-trial-handle=3080,i,15664747516828464570,6011814243678357380,262144 --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:1
  2⤵
  PID:2224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6284,i,13203995379706342543,17727618646244004642,2097152 --field-trial-handle=3080,i,15664747516828464570,6011814243678357380,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:1
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,13542346686571717833,7233433551783156171,524288 --field-trial-handle=3080,i,15664747516828464570,6011814243678357380,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:8
  2⤵
  PID:384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4256,i,11785733340901983821,18110524973525331117,524288 --field-trial-handle=3080,i,15664747516828464570,6011814243678357380,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:8
  2⤵
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4348,i,1459595032473390445,16127108814161075873,524288 --field-trial-handle=3080,i,15664747516828464570,6011814243678357380,262144 --variations-seed-version --mojo-platform-channel-handle=4160 /prefetch:8
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6240,i,2962335900351856925,8955869951819568904,524288 --field-trial-handle=3080,i,15664747516828464570,6011814243678357380,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:8
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6252,i,13506218090374186028,670132548147009680,2097152 --field-trial-handle=3080,i,15664747516828464570,6011814243678357380,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:1
  2⤵
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,7398715196398197711,6315737675231324847,524288 --field-trial-handle=3080,i,15664747516828464570,6011814243678357380,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:8
  2⤵
  PID:3488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5412,i,2407049527839043387,13690673303256284233,524288 --field-trial-handle=3080,i,15664747516828464570,6011814243678357380,262144 --variations-seed-version --mojo-platform-channel-handle=6852 /prefetch:8
  2⤵
  PID:4808

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1512

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1600

C:\Users\Admin\Downloads\Xeno-v1.3.0a\Xeno-v1.3.0a\XenoExecutor.exe
"C:\Users\Admin\Downloads\Xeno-v1.3.0a\Xeno-v1.3.0a\XenoExecutor.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:540
- C:\Users\Admin\Downloads\Xeno-v1.3.0a\Xeno-v1.3.0a\XenoExecutor.exe
  "C:\Users\Admin\Downloads\Xeno-v1.3.0a\Xeno-v1.3.0a\XenoExecutor.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1840
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Downloads\Xeno-v1.3.0a\Xeno-v1.3.0a\XenoExecutor.exe'"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3940
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Downloads\Xeno-v1.3.0a\Xeno-v1.3.0a\XenoExecutor.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3808
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2848
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      4⤵
      Command and Scripting Interpreter: PowerShell
      Disables one or more Microsoft Defender components
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5100
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4776
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3476
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1896
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4704
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2160
  - - C:\Windows\System32\Wbem\WMIC.exe
      WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5184
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
    3⤵
    - Clipboard Data
    - Suspicious use of WriteProcessMemory
    PID:2008
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Clipboard Data
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5168
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2200
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:5176
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1792
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:5240
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "systeminfo"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4460
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:5248
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5388
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:5468
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:5484
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:5544
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:5560
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:5616
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:5628
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:5680
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:5692
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:5748
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3696"
    3⤵
    PID:5788
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 3696
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5840
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 5020"
    3⤵
    PID:5948
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 5020
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:6064
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 996"
    3⤵
    PID:6100
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 996
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3620
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4560"
    3⤵
    PID:5136
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 4560
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5412
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4376"
    3⤵
    PID:2060
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 4376
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3980
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 5080"
    3⤵
    PID:5536
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 5080
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5172
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 2224"
    3⤵
    PID:5520
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 2224
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5624
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4800"
    3⤵
    PID:5168
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 4800
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5660
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4180"
    3⤵
    PID:5744
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 4180
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5780
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4808"
    3⤵
    PID:4100
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 4808
      4⤵
      Kills process with taskkill
      PID:3468
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    PID:5892
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:5928
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    PID:2128
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      PID:5992
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "getmac"
    3⤵
    PID:512
  - - C:\Windows\system32\getmac.exe
      getmac
      4⤵
      PID:4660
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI5402\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\9uICK.zip" *"
    3⤵
    PID:3588
  - - C:\Users\Admin\AppData\Local\Temp\_MEI5402\rar.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI5402\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\9uICK.zip" *
      4⤵
      PID:400
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic os get Caption"
    3⤵
    PID:2164
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get Caption
      4⤵
      PID:2452
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
    3⤵
    PID:1272
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get totalphysicalmemory
      4⤵
      PID:736
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:3844
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:204
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
    3⤵
    PID:3392
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:5952
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    PID:2284
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:4180
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
    3⤵
    PID:5360
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
      4⤵
      PID:5464

C:\Users\Admin\Downloads\Xeno-v1.3.0a\Xeno-v1.3.0a\XenoExecutor.exe
"C:\Users\Admin\Downloads\Xeno-v1.3.0a\Xeno-v1.3.0a\XenoExecutor.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1860
- C:\Users\Admin\Downloads\Xeno-v1.3.0a\Xeno-v1.3.0a\XenoExecutor.exe
  "C:\Users\Admin\Downloads\Xeno-v1.3.0a\Xeno-v1.3.0a\XenoExecutor.exe"
  2⤵
  - Loads dropped DLL
  PID:2648

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:660

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\Xeno-v1.3.0a\Xeno-v1.3.0a\editor\vs\loader.js"
1⤵
PID:1764

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\Xeno-v1.3.0a\Xeno-v1.3.0a\editor\vs\base\worker\workerMain.js"
1⤵
PID:3096

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ab98da7535c8de464335204ae97fd672936e639269325c3a388b3039d8396b83
MD5 1656a3560c7aeae221756f3891b89fd3
SHA1 e48441fe2b843ba3bd0bb7799c07b22a27db8eb7
SHA512 c06d7152d11e33601716d4c5c33c7373ac4e0c16571e80ac4a8ffb9cabb52fae51d4fe8d808fc75be943287b55a320e90a186d71a5f06e9db006f6ab89266400
TLSH
T1CFD09B307B597042D3074031E8074790169E84B5249B86066554410D7D5A485E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a37a5dbcc9eff7a637797dae50c8d99d88ff5331f8b19475e92ac5d7904d31cd
MD5 dc295d82c13fa6020341ece446d1bb6d
SHA1 10e7be2047a5d2b3156d78d77d97ebac3e6d8608
SHA512 01025176e5120f6c625f1c4ef3dd7fb844c8d9bced85acb975fc29c17194d2e933f32d955354d3c008deb4f4467fe4f52528214b4d49e246b75d023b42792c0b
TLSH
T1966191380F8601A4FBA2037257D1C252B47D82E7FC93DE56D3B009F44BF57228A1974A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 1b8d9dfaec28f3cc363811da40c69bbf5dcaeda7afe586954444c35091d43fa6
MD5 925082c7220ea87115e789177ce2906b
SHA1 b1f421b81021ab13e3c9e5584aee7b6fcb01a715
SHA512 e6a29b3bc1cbd2e5d33fa93f2afbdd8c4fa37e6acc31339344babed0ae46cca7bde515f180c3d4ee8969cb62df3466a2372db03b013ba83efd0927a1893c7743
SSDEEP 48:rlFSW5eWEyEhySrUqCrDCk+Lqi0NujGRnPmMqhkneDyHX1YqkhtEN3e7Y4y:LzeWEVye2DHOqiMuSRPRReuX2Ec7Xy
TLSH
T11EB109340B4E0290EB510271C6D19E51777F81F6FC83DEED92A239B80BF57D68A4974A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe589267.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe589267.TMP
Size 3KB
SHA256 51d60f5b101f9f0169cab93671043f78043cbba485db722ab820414dac2ba365
MD5 7a59a5a1dbddb7c93e4c51163f6c7419
SHA1 1e9f5c95f095a02a2060efe493f77427ac564269
SHA512 2ff07f8f946ffb60b089f5de6dd0eacfe169242a535a6fc5908a7c3aa0cc60cc10e7bc2b371ef7577bf2374c79367f0879b5a76f32877250d7146ce21ca9e6d6
TLSH
T175617F380F8605A4FB62037197D1C252B47D86E7FC93DE56E3B009F44BF57228A5974A
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 503bca9fed829d81608dd5e8364212790eb10285de99648340e9a22578229472
MD5 1e845ef4de40eec7002f0ae8fc2118c4
SHA1 9e241b857c9bdf814f39a86f336d6aeb58132236
SHA512 7ffc4f9d762fef58de25b77963e4ec46b40b90902cb0dd28035f4ef0526f296eeb665bedc417e49fa9e76c1f2c2a779c2b770d8753e9e83e432c684c0b5cb452
TLSH
T1BF419BF787F1956D9B125AF0AA18EE2BCE2C0510831C786985E0BE17D3E3871E00275F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 9e5488d13f157373859943f4eb48137bf795077b5fd3a58eafaa5ed528cf65fa
MD5 ace959291cf662001f129bcd8a2f14c8
SHA1 f6ef16236c5286841598b35c69ca5ed4ce7f3459
SHA512 19698e02a138d1a0d1a3716cbe3a36260ae3e96326a581668b63b15b9aa353a453f73d3b4bf3af0ed136573bcc09f11f37522852bc2a4229a49023a2646b63e6
SSDEEP 192:sxZd/yM/jK1Ml8MkO/fQsxpdrIdpJHW6+WNGYzcSbuSbIgrJ:sxZd5MO/fQsxpuJHbGE9
TLSH
T12042E9126A345977CCDBD209FA55BF93D6F9547392900E44AAFCCA0C04E6AED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 ec20ff55e8c918b96dffe32368b45982af75e96459fead6eae09833b6222f893
MD5 af2b35b54578b0d2e8b92c7c759e67d1
SHA1 79e69ad9601560dafab7f74b4558ec32b26daef7
SHA512 1c6936d0412cb10c99ee654501f34cf674141d172e36d1105f71a0f929126e6c9c8301c8f6191462ce0d88e17eb679465070efea267c0202a8e17c5f85ddf5e3
SSDEEP 192:sxZz/yM/jK1Ml8M9O/fQsnAVrIdp9naHW6+WNYRWXYzNGbuSbIg5wJ:sxZz71O/fQsnAGsHbDXju
TLSH
T13352D9526A345D7BCCDBD209FA55BF93D6F9142292900E44AAFC8B1C01E6BED620781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 37acc7dec9a0e998bc988b0be99bcef41efcfdada94d160a54a3dcef918739fe
MD5 609dd0859b4ac143f6a8e8e954b55c34
SHA1 f37591d95548b41f1413831458d858c4467dd9ce
SHA512 91454d4b6b14c46392d02e13c52d591673f94d7cb8a1fe8c0eef7ba5fcde90f5e03924862928a2c5aae8c9b94b0bd3859df25ced34f7d55d2a30d9f5a8e50dc5
SSDEEP 192:sxZz/yM/jK1Ml8MkO/fQsnAVrIdp9naHW6+WNYjz/Yzr2buSbIg5UJ:sxZz7MO/fQsnAGsHbo/Ny
TLSH
T11552C8526A345D77CCDBD209FA55BB93D6F5446292A00E44AAFC8B0C05E6BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 a9896c1a7bdb567c46d185410a3db46d8ac03cf585cd1282c71a04103412ffb5
MD5 005ee4a41b57c2658d94a8c0ee9ef4d1
SHA1 9790d43bcb7ab8f6b3c86d5db09e21089b203e7d
SHA512 db0f4547702fe22171cfeb1929870d9550422d274b4e8af5b8cd3f7041d50cce868e70e7b8c45644177fd457f535c3e2cd3e1d19c2411ee4dc2d806182e85642
SSDEEP 768:viW7kf0Wvqida8F1+UoAYDCx9Tuqh0VfUC9xbog/OVX5LlWYSjMroIsieYB:viW7kf0Wvqidau1jaa5LA3jX0B
TLSH
T1D9D2FA3B684CCB7E4F840E5CEC266F966ED801CB66988D5487FA884C03CB6EA51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 f8cfc9103dbd9badf827a5ebfce45147c620a85285380239388bc2205aebf52a
MD5 6d0276575e015c82c214699de0b71ff0
SHA1 c5b5120053630173183a104f41aebf5d267f7679
SHA512 15eb9c873b366c3627d030642ee770fabee17bb7c2ea71c2aba8246d62fb6ebfc6ce2c77364be473990ce8cd70a74d3cb511d65ef9fc380956c1bb2f512d7fb5
SSDEEP 192:s2t/kh4fjRTnMv2zLJ2W1yZBOfX8L6xWqkIsPITOSuhWMfKqzkU:s2F6Jx
TLSH
T184D1330A703A4601387D3899B29B8A365F4675A3751CB4EF7FB900A60E67E210DFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4197a5ab-0f00-47dd-a497-2ad82237866d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\4197a5ab-0f00-47dd-a497-2ad82237866d.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 f0d6b25a5dfc2e9e4a92d5241a531a09aaa299e3f51921154c61fda038dc8023
MD5 5cb3d751da9783a7f17b85e8ced23f99
SHA1 fb2ad726901bba101f2385a51fa8666c738a37ee
SHA512 b6d8c2de7d4958f591a0250846e7eb6c5650a8fee337f2a0c831f66c23c2333cd68034f64150390c4fd37b6f794f22c9cd08c2772e0140ae2b82638087f8727a
SSDEEP 192:uzLsNpBQQ/oBbiehQmiU1AaA1JxB4aGBPKlt+FdG8PohrGFC1SJrlMdNmqdU8:MsNpBCbj/2X1Jxu7dEh+CEJrlepU8
TLSH
T143322A356C749C275DA3A181F48B3643AFF8417BD7896F84E6ED970C01EB7AC231A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 7cec7f7288b8d7a8a5f8633ac90ea787f38b11f502d04a10c8978ff190876c0b
MD5 cc87ccafc46084c48fea9b068ac5bfc7
SHA1 0f47ee8b3caa9cbeced93e3b4fe10d5f1a09badb
SHA512 2de15d4964e0dc743d51ecf31c59e1f054e386cadf44db1b441c1dfc791a165447f75eba4f9867884bb9c72f4ee096e0a9fccce350255cf3ccb5e160bf6fcf85
SSDEEP 384:LiFYtNn/s3n9SZksNL8TUNTUlIlKCbjK281Jxu7dEh+CEJrl7pOObjI9G6w7Pj:mFYj+9Riwg/fKJ2Wuhl7p29Mb
TLSH
T1CEC229F258D78D36D96E5B43B77E2D168EBCC167B6845A40B3D89A0CCD962BFC302811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 7cdb2d1b07f145b4352063512e3d7330682e5f090ff9d8301e63911a132195d3
MD5 8424a68b4291c6c0ba29838bd3ab46f3
SHA1 e7d097de46e2126a7a5bfb005395fd744246e690
SHA512 164be3af3137a74f997febb863ea327356947ae49340592fdbea835c394b381b1b5a34bdf7af112f83c05e36d25fa3645e51824c68125d6ca122d8dc1bf399c7
SSDEEP 192:uWLsNpMQQ/oBbiehQmiU1AaA1JxB4aGBPKlt+FdG8PohrGFC1SJrlMdNmqdUt:jsNpMCbj/2X1Jxu7dEh+CEJrlepUt
TLSH
T1934229356C749C275DA3A181F48B3653AFF8413BD7896F84E6ED970C01EB7AC231A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 96d287a58e439259184a7906dff3ad764b68da0af03369b0ed64f81b8f8b5917
MD5 090a810bdde2b8a0efd8541fb8662b6d
SHA1 5cdca06f42f3045aa9c60473b2c582c8227fe4e4
SHA512 91681e3f1b4a4f6503e101494c83446c10984517c0724c1c2e1c4e97917406a571106017c00e0b05b07ae3bfbf5650dd524b9e39b7bb7d1c616a596a1d866156
SSDEEP 384:itNn/s3n9SAsNpKCbjK2X1Jxu7dEh+CEJrlepOObjI9G6w7Pj:ij+9f0fxJ2Wuhlep29Mb
TLSH
T169929D326C355D275DA3A491F48B3A5B9FF8417B93C52F84E6ECAB0C06DB7AC5302816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0d403c09bdd7c70bd5ad2ad42da64ddfb68d5b4cba27229ff930899bd8273842
MD5 9bb127e7fcf37c34369131284211d3bd
SHA1 b85bddd5195ddaefe760add5d6401e5efe9cfc24
SHA512 b4415496cb913b8439e2327814d2e60ee7d7d67c4edd017a0c7e129c806bd65209853526b4f2d501675d66f1540f897cbd60488ae4893e13366e08b65b84837e
SSDEEP 192:MON/64BAQmiUyAL1AGW5GBPKlt+FdG8PohIaD2qU6:MON/6eAHLOGWAdEhxpU6
TLSH
T1D402F9346C796C6B9EB2AE45F58737175FE8107BE6846F44EAE85B0C00A775C230342B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6fe6ded8ce183d17f055b1f58da57ef8ea5edc3cfbf1d72446398e1c89c0fc09
MD5 5f568b9008cab7aa8edb082023dd291b
SHA1 7f987ae5679e655764f6ca941a39313e255c272a
SHA512 1c0c55996e7057bdb9b78dc199f4abfcf0efcba884a2142f130b7986296d1c359ab2bb7673bc38bab17a384113ea4f2fc6ce0265492696ffa50b057f1272d272
SSDEEP 192:cONM64BAYQmiUyAfAGJc5GBPKlt+FdG8PohrGFC1SJrllWwmqdU6:cONM6eA4H4GJcAdEh+CEJrlppU6
TLSH
T1A61219356C756C2B5DA2B541F4C736439EF9416BEA856F80F6EC6B0C01EF7AC2306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c44ca10b-cee1-4feb-bdd9-26e9d3c86709.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\c44ca10b-cee1-4feb-bdd9-26e9d3c86709.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 5692bdb5b97ec82627e2d5c89060cb76288ab9f3e1691606a9dfabe2a91f9465
MD5 732f70458c6b495104bf844f16b670ea
SHA1 9d3c8e5934a6db9c506bd6f4812d817b055de48e
SHA512 f1dc479e03ccf6a9162e379cf06a29bc82cbb7f99b59da88551b00cb37a176ff302a457124d33e7c2d5121d62bbbc2f1cfee741bece6f3df4764aae555c6a747
TLSH
T1AE412F58A6FA1149B3B37F46ABF6A86D447FBD772F0A909D10110D4E0A63B40CCA2737
MD5 SHA1 SHA512 TLSH

Submit Download

5W8Sw01kk2.tmp

Path C:\Users\Admin\AppData\Local\Temp\5W8Sw01kk2.tmp
Size 20KB
SHA256 bea70e34f273a5c8529571eb001dde5f890fb9a0bf12364539e632e49846a76f
MD5 407885dc56d6aa918e035a475b69d222
SHA1 8f6323de7de8b1ad3db6430b06ee18c09fff64c6
SHA512 e8832092825c9844ca6146c79de4a3e07733ec39a7421a7f9b18bed21ee0f7fe342dd017a57c072cb9101a48913e7afc6c28d303486feff7c01fdbc88cf6df21
SSDEEP 48:TtLopFMatSaw/auUOt8ByTml97GZHNO9NeqNTkNGt08sV16HqzjkiU:9eMatUaAKyTm1Desh08sV16Hcol
TLSH
T17E92D9CD1B202291C0A54E3BD9E5486B2FBC5018D33FBE95DC1910B28DB159BB28736F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blank.aes

Path C:\Users\Admin\AppData\Local\Temp\_MEI18602\blank.aes
Size 94KB
SHA256 927dc65e35a1126575b154646283f440c3cf4d9f4402fbf01986ecfd578d0a01
MD5 034f2cf110788d920f947dc5a56e58bd
SHA1 94b4a87ab76817c96052e56703903172aad4bb19
SHA512 b04076ed9291ec11ce2f912fa5cacbc4af1b8a1b8bbb57a6dcccbdfd21f0b7233feab81afdac2ac3a54f29d6218a50c7ce3e3e9f582e7eb76bb7c1833d52c879
SSDEEP 1536:DNj9H8HLO+juWU64pHC62eYq5ZhvNUY/zvdN3NDdNhAEOn1ejhiz:MrUWOdCsB5ZheGPHTMn1e0
TLSH
T1E193D0D93390665BF09DFABD38DB9166A321E8D2F784CF03D12A184F1E65103991C7AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI5402\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI5402\VCRUNTIME140_1.dll
Size 48KB
SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
MD5 c0c0b4c611561f94798b62eb43097722
SHA1 523f515eed3af6d50e57a3eaeb906f4ccc1865fe
SHA512 35db454dbcc7ed89842c0440b92ce0b0b0db41dbd5432a36a0b7e1eddf51704b1f0d6cff5e3a3b0c3ff5db3d8632fed000471180ad72e39d8dbe68a757ccdfb0
SSDEEP 768:vzzO6ujT3MbR3v0Cz6Sz5q83ywug1HDV9zxfYbK9z:mq/oMx3hXHDnzxfYiz
TLSH
T1AE236BA453784486D4AB99B0C0DAEE577D7CFA964B10928F0BA0D15C1F637D0EB3D21B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_asyncio.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI5402\_asyncio.pyd
Size 41KB
SHA256 a6fb1d26c06f5f18163b46698f96cef8f1b951b4671b3dd6d7acb284675d038c
MD5 68066a9967a93449444b7828684f1f0f
SHA1 9a0dd795f43b5ec97f583b3ed68289adb965f255
SHA512 6928ff8630b869c167aa2370f3559de17ac1bcf0f9e4ebed7ee82bec3a08e616f798c75fd913465fcfdf6bffcc8ea6b2db7537b167802b566bd9d042a3f97aec
SSDEEP 768:uwbx/SjBSY8JbG1XXDBr6hMXWeBuECt0pnQIMDnuuo8y++RYT2Ip4ig6MTxf1mlw:uwbFSjwYC4DUhMXWe4OQIMDnuL8y+kR7
TLSH
T16313BFC64278D193EA93ED7056E4DDC3FA347BA72444835B30AA91AA0F673D0971A63C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI5402\_bz2.pyd
Size 51KB
SHA256 e4ac61b411b73ca1896635df8b81f6b0d53d242399a927b2a1665bbdb79fa5d7
MD5 ea2eb9361815438a45ef9272d8b5213b
SHA1 b947f175a79b4ff3b13a37dbe0785292da361734
SHA512 c9bc0bb7903482bec5421ef798168ce3fdbdc15016543b24f3ae5a18522409b5446571be3e228bed32fd25a0a93265c858e24ce91c8a07c74236ca7b77632a2e
SSDEEP 1536:QLlVDVFIDWluYQnq88e2mpiV7IM3Vej8y+kR9LfIgHL1:8l5IikY00z5IM3VeAYB
TLSH
T19033D0CA44B890B3F9636D3206E1D986F93DB7E32455C7AB30EDA1951F223C17B17229
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI5402\_ctypes.pyd
Size 66KB
SHA256 1debf97e877b2c16ff4dad8801fefa9f0f1ec9093ff47f088168952ae1b8d473
MD5 52b03a112125443dccd71474934c30d3
SHA1 caad857440d2a1835074a36befdde875e07aa7fc
SHA512 4f0b542968e5ae5a3a447222a9cedbb63e4d7230907d3f7972fc26a883262e620c271c45d0595c87dd9ecb9d17caeb765c7087515c2a5cb9065c914049b980c2
SSDEEP 1536:WKuxB1sbrQJx+U5Au+Rm8eF7MRX1a+IMGPx88y+kR9sCfIW44DNr61w:LQBzBGnzIMGPxDW4Ihn
TLSH
T19F63F1C687BC9017C9976CB0B295CE97F635FBE34044825B30EE61E74E673D0AB21169
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI5402\_decimal.pyd
Size 120KB
SHA256 fa5313dde97a83d69fb95918c2222da5a6f365d3343a806103ca519e9ac46a54
MD5 8511a056dac4f21b3c07b7d08ecbfca1
SHA1 4762e62d434278ea1a646fbc0d3047b874af8800
SHA512 77ea963453f84861281a2531707553805ccc31840a16925075bddbf2299407fd9ab67f30958291bb7c13a8f040f2515a90e535793bfa752cc96275b114671f26
SSDEEP 3072:iQ6IFtUjNqiAGYNRQBOcxzlPSUQuIV6IMDqXRdE/Yt:iOUjNqnGYN6BOm5Kn3Rft
TLSH
T1EDC302E552984496F967A9324342DA41F53C7FA31BA3EB1A2096528F4FD13C6F31323E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI5402\_hashlib.pyd
Size 38KB
SHA256 a6a6eb65cd6b6d1b7fba0de4335ae472588d3884cc5b2a0d932070bdbbe601b9
MD5 20db31871b418087e8768f36d5807dfa
SHA1 3d49e844531f4ee76bc0234eee331efafb4b1ecd
SHA512 3d0f3389dda669a2fb6f0cb681d92384231c9f511055e87f060cdf0f3fa57333b533c28a51e89cb28e3d688f2cb1e99331c770d5b01b1407adb28fa2da2f25b0
SSDEEP 768:RWmaIhID5GaLYpKNIMDITqo8y++RYT2Ip4WTxf1mlDeI66SUA:RaIs5Ga1NIMDITP8y+kR9WfIU6H
TLSH
T1AF03C0C655B98023DB63BD7153E4DD42FA34BFD36415871B306EA2EA0D633C1A72923A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI5402\_lzma.pyd
Size 88KB
SHA256 4a47161760aeb055169c2d04197c7d395b38baa1b2a09b76966a84d99eadf1c6
MD5 909aac9717bc2b32fdec8aaad8a26f94
SHA1 22a088b4a8bdae95b2e139946ca36c5335f07bf4
SHA512 411471dea6e3bf2d27f5633af0b7803ce73391265dc1f298fd859b69c5989e5f224075870610aebd4d1b84518fe9b678dffaf7766c8c432a6e4e4237eff2780b
SSDEEP 1536:Vd954VcaVWeuTQdjq4Qbj5fGDlSrY0W+NyuAMdOmbISLS431iuzvBIMI1xL8y+k6:VDelVWewGq4Q5NW+4uwmZLX/zZIMI1xi
TLSH
T15E93F18F5F7844EDC667997173A0DEC67A38B7D3114A835E28CF22611B5B3D22327218
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_multiprocessing.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI5402\_multiprocessing.pyd
Size 29KB
SHA256 cc9ac8a5ae05afa23cacbcbed718dd9b9159f5ffb23ff778a6f3eb84a1f881b3
MD5 5a3526180a5a67f894c041a0a912626b
SHA1 e0f47c68e1c757ab78632ad526a6d866203aa2e8
SHA512 c1127c3bd80a5b282089309a1bdd48f61c0e01b0b4da199c6b7aaf5f233dafbd71b37595982d6154680a44daf07ec9be51c1974ea5df926ce616b2253f207ddc
SSDEEP 768:NU8vsdbt2pFk1IM7tDmo8y++RYT2Ip4ATxf1ml/6dHQSVvO:NU8Udbtsk1IM7tDj8y+kR9MfIgH91O
TLSH
T1FDD2AFCA42789122E963BE7163D5D9C2FE3CBBD31845866B30DA829A1E773C0A315375
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_overlapped.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI5402\_overlapped.pyd
Size 36KB
SHA256 cfba5cc86f9cfe91aa98d70ef07184e5b2876d76037becc8cb6640452bd895ba
MD5 2821c215fbe41bffb223772ffa05a711
SHA1 7885901c4f0da918b9e5e13cbb982d91d0740a92
SHA512 86974f5c718acd3e1d16af0593fa1bf266e214fb3dba12e5a24525c0cdc14746131facf8a2fd3c7c8448815a24d09518eb5c903d5ca1d0f6290bda86921f4fa6
SSDEEP 768:/bDc7aAdvIQ4qZuPQ67pNe9IMCtDIo8y++RYT2Ip4YnaTxf1mlWZG8vDNjr/Cqw3:/nAdvIMEhze9IMCtDp8y+kR9BfIW44DW
TLSH
T14FF29ECA427D4066DE73AD7062D4DE82FB38BFA35066467B30EE51E50E673C0D71622A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI5402\_queue.pyd
Size 28KB
SHA256 e5f274a72e65e3b5bca5e2629596be50cc2bebfb6cba14dc7693fe1175de4e70
MD5 759afe5305a14c807e8c28b9876ad121
SHA1 33bbfa3d55764440da0de51572f562eff2b0325d
SHA512 113da692b19c8b6247402cea0dd9cf0ad2882c4864b22ac941e2381bfe295976a80b70f141c43d2834ccf1a346106cbf338bc28cf69ca6d0f433379a6e745db4
SSDEEP 768:I3zncv/8CrGP6d+hppwIMRUT0o8y++RYT2Ip4oTxf1mlDeI6WSU:IrG3d+FwIMRUTN8y+kR9UfIUWH
TLSH
T15ED29FD646789153EE539E7052D4DD83FE38BBE35511876B709D92AA0E633C0E31322A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI5402\_socket.pyd
Size 46KB
SHA256 d879c77e516f21d40fa5e7e101bac947c65047a40105f572db6b751059d83c0b
MD5 feeccebf01e267257fb0ff971ae9bbe0
SHA1 ff2280cecc2ba5e1cfa54e5bdd8809634ead8cf5
SHA512 ca87d153cabc3c0798ccffaa175309b5b822de117dcb47a4171f2658487ec84ef2ae297a826964079fb6dba3dc9fa3a09d140048128d2d84d4d2e93216432f6f
SSDEEP 768:Cahd/XlBiuYQM1MdLB2DTLJc2pNDiIMGweYtDo8y++RYT2Ip44nTxf1mlWZG8vDW:CahdtJM10oFDiIMGweAs8y+kR94NfIWQ
TLSH
T1F323C0C745348066EA239B3222E4DE86FB7877D34416872A309EA0590E673D1F71622D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_sqlite3.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI5402\_sqlite3.pyd
Size 61KB
SHA256 265f7394851fe00adf1536d83877501741ac31a81c709f8cb9d4d67b523f77fa
MD5 300b6874243b79ac59142683a002d0a0
SHA1 fbecc2bdffc8632046b57e43df6bc4bee3c86b45
SHA512 e9601254d1b8aedf1fd14934bc3f32727d020c98cf8c4426c674ab3721251d91a4358ed41b802c5a056a1094f30193b3f679c8b58a1397da2d99282b05e343a1
SSDEEP 1536:JM/4IF7YU7LwP29gflMAgw2tD1orc/sIMDQu/8y+kR9bfIW44DTr6V:KNDglMAgHBor3IMDQusW4IPw
TLSH
T18453D0D656A89012DB63DC7092E4DED2FA39ABA3A520D75F30CE60E54F633D0D321235
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI5402\_ssl.pyd
Size 68KB
SHA256 ff49094b6eadab672042389edff414025059b418c915824ebed6fb257f1ca851
MD5 563b632b5697995caeb4e41781a37f3f
SHA1 1d6ba5bdc53912a80f082a490f764ea9d8ab0c38
SHA512 daae1034739871742a9e293a060ff21c43cbc00a9cf5b528ad97ace2df9482d082c93b4b2b9f33f43828799e4d7f20bca550aae77a79c90dd168524c12d170b1
SSDEEP 1536:SxFMMGIzdqmRLHXy/QOkfyUmGjb+OobJMVadFb7ryNOGT1IM37hEF8y+kR9YfIgo:SxSQpqqC/pkX+OoyVuN7rWxRIM37hGYI
TLSH
T18563E1CA44785496EF679D3093D5EBC3EB3D2BD3A821873E34DA918A0E32791B70116D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI5402\_wmi.pyd
Size 30KB
SHA256 87739a83c91f979b17c3fca8b22fe684624c450277dc2c6d6c68a25ed115b4f4
MD5 0fd50629505450336ba7b340e3c830e1
SHA1 8932d1dd0bb362b320b7b43118b11b29db49801b
SHA512 7e4021eff4655bfb69f9e87abdd136ce282f92ec1e4b2d45e50debf69daa847a3c8b48e68f2bb8a7d80e89c4537fc9106af5bdef17e377c849050b23e2b89614
SSDEEP 768:t+So74TudMdaHYukBip7bRIM3iz5Vo8y++RYT2Ip48Txf1mlDeI6JSU:wSoUfcYuqSbRIM3izE8y+kR9wfIUJH
TLSH
T164E2A0C646798126EE93AE71A3E4DD87F7387BA31451876B30AE41E50D273D1E312239
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_zstd.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI5402\_zstd.pyd
Size 176KB
SHA256 d792937d5c8d477d6684e4df957d6169f0f68a801f06f32bb51247fab9355811
MD5 754a9828368ab5136d19101437df5589
SHA1 c01816af9c9eba9aa5198998dc347c3f7b865d4f
SHA512 3934195c9683c695af1f78d3e299f3298d19afbea9503e1a27ada7684b639c93e114162950aae303ef816d262eec8c7053087554dc26ec3e26a734afe2cf172a
SSDEEP 3072:DkmxGd5+EY488HES2DO4iVcYa/zXBbV6h6E3amFerUIKIMIMgKd:7GdYEY48UmDO44ra/zxbVGFeQok
TLSH
T1EA0412DB943D837FE1639AB05064FB927FB77ED30A60CF6F3095A1029E9A380575214A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI5402\base_library.zip
Size 1.3MB
SHA256 7dcfe4602cdcf14eb82d65da0340dd0d5679a4515643df8958279f235374cf63
MD5 5dfb565c157b6911206d35a600eb16ac
SHA1 5ab8c77db3a18ebbeb410d1272517bb25a8300e1
SHA512 6a463540bdbececb9ec5b814d1d1d7e45896a1cd01cd2462cb08dfe0c6a1c20890fd533a97eceee6c0f1d80db039caefab2212b3cc1a64caa8010f5e841dbcf7
SSDEEP 24576:JlbyjLPrhfQeOdP2m2dfERaguOuUFsgdvsk:i9/MRnuOuUFBdZ
TLSH
T1F5552AA1B9917967FEC9F37A35775A0CA715C0109B20D303B4A88DAC6FDF260AE158DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blank.aes

Path C:\Users\Admin\AppData\Local\Temp\_MEI5402\blank.aes
Size 94KB
SHA256 32798867a64d24f72cd22870a19bf1a5a61d56cc6e4428a1a0ba948e55e61b41
MD5 753b60e62b0c431ba2537b23386a13ee
SHA1 a9d446a75de63c450745d8519b7db5caedf93468
SHA512 53dadcf7014cbab2e4d7f8adb415e09ac6ce28f2dd0d5cc120c5fef331c18c398a6e63d8251a004c7b31a6dd3cb4381a6d6db8c46dc92b04f792386939a989d1
SSDEEP 1536:4mlwdaA1YB/7MoiCZzC8qsgPGJoxOgZ/qSnz5FGXNoIRVn2Xe154zsRz6Yx1Mgan:4DaeYB/QoiCZztooc55FMbn2aDRGsa+q
TLSH
T18B930247A354212F93613AB6A0DDEAD44D738A58A13BCDBF3E2280F6CC7EA015B07591
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI5402\libcrypto-3.dll
Size 1.6MB
SHA256 e0935d6280048026ebd70fcf80bf4a54d05864711fc5e8c52c8ca814d88e504d
MD5 55e7ef95ab43b9cbc5a44f99974260a0
SHA1 ec8bae77dda25ec8da67f4a0ab40b385c5edf493
SHA512 76ea39654d0cd195d60aa7f436df220cbe9ba42ede38bde0406cf3afa8daa2fe479fd1d47a5fa7cf4e590607cd8b027dbe4401b78acd4849fee1d3fe27d152b1
SSDEEP 49152:hoZYFx+MO6+G42RXZYOMgi42hwjA5Y1CPwDvt3uFlDC:hjx+MOAXZYWZAm1CPwDvt3uFlDC
TLSH
T1C175136414BFB80BF6959078CF748D2B896D1732A30CEFA32E7EC9444C15E0E4AA59DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI5402\libffi-8.dll
Size 29KB
SHA256 135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece
MD5 08b000c3d990bc018fcb91a1e175e06e
SHA1 bd0ce09bb3414d11c91316113c2becfff0862d0d
SHA512 8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf
SSDEEP 768:3p/6aepjG56w24Up3p45YiSyvkIPxWEqG:tA154spK7SytPxF
TLSH
T164D2CFF34521FC35DD53EC7238D88434FB31BA8655A142E3521AD1BA4FA47822BA52FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI5402\libssl-3.dll
Size 224KB
SHA256 0478060bed0a69b47aa3ee282fe1f295dcd5e3b8a473844715f6fadecab06752
MD5 811245c9356e6001fba1d7c81f7184a1
SHA1 09e447ac902284182a686d049c5d2fecfc6e8e5b
SHA512 7e38736227f077f5701e9e4d6927ec89581d6d93217d7b1a46bf039b4359b2fbf70abeb0b9153ca56cd054e8c9cf99c25e04260bf7047c58d88f2bd73a3fab54
SSDEEP 3072:jUyDWDv8R8O3ydPEY3MfS8W1ANBco5hZX341fL80rZLAkH+Vm6ufDPkf7YL4X/tD:jUbR9dPEYnTYZH41h1L+0Xfjkz1PJ9
TLSH
T13524F18A750F6427DC66BD72DF74D0C6F27DB303AB01C9267A1AD6407AA8B8CA33D105
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pyexpat.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI5402\pyexpat.pyd
Size 93KB
SHA256 f185ba34b4e74cb99ea29ece0fb14cef90a47314b255944a70c91dffe1a5ff2f
MD5 b231335a1d3ef8d862c9f5591b08a75b
SHA1 6b384062e8b7edc1a4a27b0e2458cb32e684ead5
SHA512 b7a6d868efbdd91d3da4cbc7144dcfe6be6b1f19bc52cb2f2130ae2251fc8026185eeeb5ff82af8654cc2785451ad7a63c383b2ef26eb5841493e1931437e349
SSDEEP 1536:yFTvXJvGlF8giDGkBW1CYsAUMXsru6lLd8EEIGVHsBsRr3Ze9L/IMGh8N8y+kR96:ydv+pBGWoYpUMXquMd8XfRrJOIMGh8At
TLSH
T11893F1CA82BCD5AAFA235F3222E4FEC2BA3867F31450C72B609E5050493B3D19773159
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python314.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI5402\python314.dll
Size 1.9MB
SHA256 395430faaa3cd20b3ee99313be2e6aafcab109605f0f1830c847078caa9987c8
MD5 332ee3fe1ed488af10192b80b282b8ca
SHA1 9ebe5c302778d8813fc10748e10a1bcdfb1b7616
SHA512 6cedf94d2cfe459a8e229f94f9e13774b1f1a4acf387043ddf1a5a821ab72e0c509e28fc198b6401e6f17b2cdc0ee78d054780f980c696c44aa6ab727f947334
SSDEEP 49152:Zdh1m7ufHoYsnQUsWkyaqsYgXE2GgEZrLqjTQC8IFSWv:ybYDpyTsYgDGggXqjHIWv
TLSH
T177953333EA8AD826E1C1A5F15DD1DB0B7C2D1B52C83A55E174A5C38108DFEA85B3B70E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rar.exe

Path C:\Users\Admin\AppData\Local\Temp\_MEI5402\rar.exe
Size 615KB
SHA256 90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213
MD5 9c223575ae5b9544bc3d69ac6364f75e
SHA1 8a1cb5ee02c742e937febc57609ac312247ba386
SHA512 57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09
SSDEEP 12288:3lPCcFDlj+gV4zOifKlOWVNcjfQww0S5JPgdbBC9qxbYG9Y:3lPCcvj+YYrfSOWVNcj1JS5JPgdbBCZd
TLSH
T12CD48E59A7E400B4E1B3D674CAA24517FBB378416B718B4F13A9865B1F237A0CF39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rarreg.key

Path C:\Users\Admin\AppData\Local\Temp\_MEI5402\rarreg.key
Size 456B
SHA256 58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211
MD5 4531984cad7dacf24c086830068c4abe
SHA1 fa7c8c46677af01a83cf652ef30ba39b2aae14c3
SHA512 00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122
TLSH
T175F0232C312E70417BC5DE8A1ED04A63C0E28014C99B50D09DF456DF01980A67B72596
MD5 SHA1 SHA512 TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI5402\select.pyd
Size 28KB
SHA256 da09eb72df1e207eaa37130c5633daa87457b1a198fd6f1f5b8a40944cf90a99
MD5 775c837d46016f51472855aa910e040a
SHA1 d181b784fea1ff80fac850cb2699ebc049502f7e
SHA512 55369b63e6f1227627153e73e87d23310b55ef5d15a97ec4e5741132391ce4e7c1df6e665bcbf40bab2d9c46f6696f374fdcfa0ca63407158f517ad4b92761b9
SSDEEP 768:hgmk8qShYOoQp9TnIMRGTTo8y++RYT2Ip46htTxf1mltPRVgg9:hWeYiTnIMRGTc8y+kR96ZfIZR+c
TLSH
T1D0D2AFC746B8D163EB939E3112E4DEC2F934BBD36419821B70AE52D60F673C1A312269
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lorem ipsum.txt

Path C:\Users\Admin\AppData\Local\Temp\_MEI5402\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
Size 1KB
SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
MD5 4ce7501f6608f6ce4011d627979e1ae4
SHA1 78363672264d9cd3f72d5c1d3665e1657b1a5071
SHA512 a4cdf92725e1d740758da4dd28df5d1131f70cef46946b173fe6956cc0341f019d7c4fecc3c9605f354e1308858721dada825b4c19f59c5ad1ce01ab84c46b24
TLSH
T1972163328E9C03006FD1303A636E89EFD948F0281A04BB25ECF9D68FA44115CD6E2375
MD5 SHA1 SHA512 TLSH

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI5402\sqlite3.dll
Size 663KB
SHA256 573fedfd5976e01f024132bd49074efac724f739128b71ecde485d86c6a0f23c
MD5 330bd133be7bd698f50b6b9a69e13e38
SHA1 f8321dab1edcb97c7862f3fd61de8b9fe8972ca0
SHA512 521633315bfed9ca4a28dc95574fea1627ba7b943ea1bd1e47cbca93d8436e891124a5749f269fe433437c819d06b617d3b7fc3f2380ab8cb12d03b33dfe5318
SSDEEP 12288:8ZDJl+ZvDcMJ+Y3q0gVvlgiLpevIDjrbfVktPijbwAFKgwIJim+q+rjOdskNvvV8:IDTUQmf3+vlRpevIDjnfVktPjgVIrdrT
TLSH
T10BE423D7481B3C57F7823631E663C6D592284FD6FCF9478AF238A2145CDA6C1428E86A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI5402\unicodedata.pyd
Size 277KB
SHA256 8f67245cc28961ab3e9126274bb2611dd8abed46eccd75be446b17e3f74472b6
MD5 b21b6ef69e952c130946116dd4020c8c
SHA1 717299b5b42ecc64db611ab44a20a85ad74702d0
SHA512 a514b21b66027ef8b77e03b546b5fcc3caeb08c68175156f2f3593bdce7364dbe5922b5022c586f7ed72e9575355c384763ae83fda21867c9b3c254a7a1b65ec
SSDEEP 6144:wBaNO5xjGDYBfTVa9WL3H5r4s2obtolFTX1UbK+1Ee0cIv:t0A0baMQobtoLluKHedO
TLSH
T1545423819D85840FF6A2C23471A5EEEB377AB7F714B4A710F48D50471E337539B8A226
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_0zylfuyn.bay.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0zylfuyn.bay.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

Xeno-v1.3.0a.zip.crdownload

Path C:\Users\Admin\Downloads\Xeno-v1.3.0a.zip.crdownload
Size 16.9MB
SHA256 bd9c42ed72178ddf940abc4458776d079bf2b3eb5f5c94b037670d9a31185d58
MD5 b3f84ae9f294db3a2c75b6a89944d0c4
SHA1 44f689967fe88bd762fa4f67a606a8fcecdc5d26
SHA512 1138d548c9d9865099846a70f8e264a6d76cd865451ced6557917e748be5bb2917a428d28d4d32f724eec693ba8197d684a8b79540e9b9e91990b83e13ceeb70
SSDEEP 393216:pMowXIOeTL1wQ2JzELwr0QBoWg4Vt6/trgLsvQsmWV:NMgTL1L2dELwr003t6/trggYsmWV
TLSH
T1BD073360E6432C09D340F2FBB4D50B4F3A76887E59D37E616E6E922068CB8E5263754F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1840-515-0x00007FFFDC7F0000-0x00007FFFDCEFB000-memory.dmp

Download

memory/1840-840-0x00007FFFDFCA0000-0x00007FFFDFCC6000-memory.dmp

Download

memory/1840-512-0x00007FFFEFB00000-0x00007FFFEFB0F000-memory.dmp

Download

memory/1840-511-0x00007FFFEFD10000-0x00007FFFEFD1D000-memory.dmp

Download

memory/1840-516-0x00007FFFEF160000-0x00007FFFEF174000-memory.dmp

Download

memory/1840-517-0x00007FFFDC2B0000-0x00007FFFDC7E1000-memory.dmp

Download

memory/1840-487-0x00007FFFDFCD0000-0x00007FFFDFD50000-memory.dmp

Download

memory/1840-524-0x00007FFFDFA90000-0x00007FFFDFAC4000-memory.dmp

Download

memory/1840-523-0x00007FFFEF1A0000-0x00007FFFEF1C9000-memory.dmp

Download

memory/1840-522-0x00007FFFDF9C0000-0x00007FFFDFA8E000-memory.dmp

Download

memory/1840-521-0x00007FFFEF090000-0x00007FFFEF0AA000-memory.dmp

Download

memory/1840-482-0x00007FFFEF180000-0x00007FFFEF19A000-memory.dmp

Download

memory/1840-526-0x00007FFFF0430000-0x00007FFFF043F000-memory.dmp

Download

memory/1840-532-0x00007FFFDFCA0000-0x00007FFFDFCC6000-memory.dmp

Download

memory/1840-534-0x00007FFFDED80000-0x00007FFFDEF0A000-memory.dmp

Download

memory/1840-535-0x00007FFFEEE80000-0x00007FFFEEE8D000-memory.dmp

Download

memory/1840-536-0x00007FFFDF900000-0x00007FFFDF9BE000-memory.dmp

Download

memory/1840-478-0x00007FFFF0430000-0x00007FFFF043F000-memory.dmp

Download

memory/1840-475-0x00007FFFEF1A0000-0x00007FFFEF1C9000-memory.dmp

Download

memory/1840-598-0x00007FFFEF160000-0x00007FFFEF174000-memory.dmp

Download

memory/1840-841-0x00007FFFDF900000-0x00007FFFDF9BE000-memory.dmp

Download

memory/1840-813-0x00007FFFDC7F0000-0x00007FFFDCEFB000-memory.dmp

Download

memory/1840-802-0x00007FFFDED80000-0x00007FFFDEF0A000-memory.dmp

Download

memory/1840-604-0x00007FFFDFA90000-0x00007FFFDFAC4000-memory.dmp

Download

memory/1840-603-0x00007FFFDF9C0000-0x00007FFFDFA8E000-memory.dmp

Download

memory/1840-788-0x00007FFFDC7F0000-0x00007FFFDCEFB000-memory.dmp

Download

memory/1840-600-0x00007FFFDC2B0000-0x00007FFFDC7E1000-memory.dmp

Download

memory/1840-799-0x00007FFFDFA90000-0x00007FFFDFAC4000-memory.dmp

Download

memory/1840-800-0x00007FFFDF9C0000-0x00007FFFDFA8E000-memory.dmp

Download

memory/1840-608-0x00007FFFDFCA0000-0x00007FFFDFCC6000-memory.dmp

Download

memory/1840-797-0x00007FFFDC2B0000-0x00007FFFDC7E1000-memory.dmp

Download

memory/1840-471-0x00007FFFDC7F0000-0x00007FFFDCEFB000-memory.dmp

Download

memory/1840-609-0x00007FFFDED80000-0x00007FFFDEF0A000-memory.dmp

Download

memory/1840-614-0x00007FFFDF900000-0x00007FFFDF9BE000-memory.dmp

Download

memory/1840-655-0x00007FFFDC7F0000-0x00007FFFDCEFB000-memory.dmp

Download

memory/1840-486-0x00007FFFE1E80000-0x00007FFFE1EAC000-memory.dmp

Download

memory/2648-612-0x00007FFFDF860000-0x00007FFFDF874000-memory.dmp

Download

memory/2648-619-0x00007FFFDF8D0000-0x00007FFFDF8F9000-memory.dmp

Download

memory/2648-618-0x00007FFFDEC30000-0x00007FFFDECFE000-memory.dmp

Download

memory/2648-617-0x00007FFFDF380000-0x00007FFFDF3B4000-memory.dmp

Download

memory/2648-616-0x00007FFFDB7F0000-0x00007FFFDBEFB000-memory.dmp

Download

memory/2648-615-0x00007FFFDF3C0000-0x00007FFFDF3DA000-memory.dmp

Download

memory/2648-625-0x00007FFFDC120000-0x00007FFFDC2AA000-memory.dmp

Download

memory/2648-624-0x00007FFFF7270000-0x00007FFFF7296000-memory.dmp

Download

memory/2648-626-0x00007FFFF7260000-0x00007FFFF726D000-memory.dmp

Download

memory/2648-627-0x00007FFFDB7F0000-0x00007FFFDBEFB000-memory.dmp

Download

memory/2648-643-0x00007FFFEED40000-0x00007FFFEED4F000-memory.dmp

Download

memory/2648-654-0x00007FFFDF380000-0x00007FFFDF3B4000-memory.dmp

Download

memory/2648-653-0x00007FFFDF3C0000-0x00007FFFDF3DA000-memory.dmp

Download

memory/2648-652-0x00007FFFDF860000-0x00007FFFDF874000-memory.dmp

Download

memory/2648-651-0x00007FFFE2220000-0x00007FFFE222D000-memory.dmp

Download

memory/2648-650-0x00007FFFDF890000-0x00007FFFDF89F000-memory.dmp

Download

memory/2648-649-0x00007FFFDED00000-0x00007FFFDED80000-memory.dmp

Download

memory/2648-648-0x00007FFFDF8D0000-0x00007FFFDF8F9000-memory.dmp

Download

memory/2648-647-0x00007FFFDC120000-0x00007FFFDC2AA000-memory.dmp

Download

memory/2648-646-0x00007FFFDB050000-0x00007FFFDB581000-memory.dmp

Download

memory/2648-645-0x00007FFFDF8A0000-0x00007FFFDF8CC000-memory.dmp

Download

memory/2648-644-0x00007FFFE1CC0000-0x00007FFFE1CDA000-memory.dmp

Download

memory/2648-642-0x00007FFFF7260000-0x00007FFFF726D000-memory.dmp

Download

memory/2648-640-0x00007FFFF7270000-0x00007FFFF7296000-memory.dmp

Download

memory/2648-639-0x00007FFFDEC30000-0x00007FFFDECFE000-memory.dmp

Download

memory/2648-613-0x00007FFFDB050000-0x00007FFFDB581000-memory.dmp

Download

memory/2648-610-0x00007FFFE2220000-0x00007FFFE222D000-memory.dmp

Download

memory/2648-611-0x00007FFFDF890000-0x00007FFFDF89F000-memory.dmp

Download

memory/2648-606-0x00007FFFDED00000-0x00007FFFDED80000-memory.dmp

Download

memory/2648-607-0x00007FFFDF8A0000-0x00007FFFDF8CC000-memory.dmp

Download

memory/2648-601-0x00007FFFDF8D0000-0x00007FFFDF8F9000-memory.dmp

Download

memory/2648-605-0x00007FFFE1CC0000-0x00007FFFE1CDA000-memory.dmp

Download

memory/2648-602-0x00007FFFEED40000-0x00007FFFEED4F000-memory.dmp

Download

memory/2648-599-0x00007FFFDB7F0000-0x00007FFFDBEFB000-memory.dmp

Download

memory/3808-542-0x000001BF28D30000-0x000001BF28D52000-memory.dmp

Download