hxxps://wearedevs[.]net/d/Xeno

Analysis

user interaction
yes
max time kernel
85s
max time network
84s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/07/2026, 03:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://wearedevs.net/d/Xeno
Sample260718-ehhzlsay2z

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
163	raw.githubusercontent.com
164	raw.githubusercontent.com
165	raw.githubusercontent.com
155	discord.com
156	discord.com
158	discord.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
332	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134288205919890993"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{D55EAACF-D96C-4830-86A2-269FFE80A8A1}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{1DE52ABC-F514-4919-8380-4D6272AECD51}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1932	Xeno.exe
1932	Xeno.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
5204	msedgewebview2.exe
3600	msedge.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe

Suspicious use of WriteProcessMemory 61 IoCs

description	pid	Process	procid_target
PID 3600 wrote to memory of 536	3600	msedge.exe	83
PID 3600 wrote to memory of 332	3600	msedge.exe	84
PID 3600 wrote to memory of 2480	3600	msedge.exe	85
PID 3600 wrote to memory of 2480	3600	msedge.exe	85
PID 3600 wrote to memory of 2480	3600	msedge.exe	85
PID 3600 wrote to memory of 4392	3600	msedge.exe	87
PID 3600 wrote to memory of 4392	3600	msedge.exe	87
PID 3600 wrote to memory of 4524	3600	msedge.exe	88
PID 3600 wrote to memory of 4524	3600	msedge.exe	88
PID 3600 wrote to memory of 4524	3600	msedge.exe	88
PID 3600 wrote to memory of 4592	3600	msedge.exe	89
PID 3600 wrote to memory of 4592	3600	msedge.exe	89
PID 3600 wrote to memory of 4592	3600	msedge.exe	89
PID 3600 wrote to memory of 5056	3600	msedge.exe	90
PID 3600 wrote to memory of 5056	3600	msedge.exe	90
PID 3600 wrote to memory of 5056	3600	msedge.exe	90
PID 3600 wrote to memory of 2984	3600	msedge.exe	91
PID 3600 wrote to memory of 2984	3600	msedge.exe	91
PID 3600 wrote to memory of 2984	3600	msedge.exe	91
PID 3600 wrote to memory of 312	3600	msedge.exe	95
PID 3600 wrote to memory of 1400	3600	msedge.exe	96
PID 3600 wrote to memory of 312	3600	msedge.exe	95
PID 3600 wrote to memory of 1400	3600	msedge.exe	96
PID 3600 wrote to memory of 3900	3600	msedge.exe	98
PID 3600 wrote to memory of 552	3600	msedge.exe	104
PID 3600 wrote to memory of 552	3600	msedge.exe	104
PID 3600 wrote to memory of 552	3600	msedge.exe	104
PID 3600 wrote to memory of 4284	3600	msedge.exe	105
PID 3600 wrote to memory of 4284	3600	msedge.exe	105
PID 3600 wrote to memory of 4904	3600	msedge.exe	106
PID 3600 wrote to memory of 4904	3600	msedge.exe	106
PID 3600 wrote to memory of 4904	3600	msedge.exe	106
PID 3600 wrote to memory of 2868	3600	msedge.exe	107
PID 3600 wrote to memory of 4364	3600	msedge.exe	110
PID 3600 wrote to memory of 4200	3600	msedge.exe	113
PID 3600 wrote to memory of 4776	3600	msedge.exe	114
PID 3600 wrote to memory of 3768	3600	msedge.exe	115
PID 1932 wrote to memory of 5164	1932	Xeno.exe	125
PID 5164 wrote to memory of 5192	5164	msedge.exe	126
PID 1932 wrote to memory of 5204	1932	Xeno.exe	127
PID 5204 wrote to memory of 5228	5204	msedgewebview2.exe	128
PID 3600 wrote to memory of 5324	3600	msedge.exe	129
PID 3600 wrote to memory of 5324	3600	msedge.exe	129
PID 3600 wrote to memory of 5324	3600	msedge.exe	129
PID 3600 wrote to memory of 5452	3600	msedge.exe	130
PID 3600 wrote to memory of 5452	3600	msedge.exe	130
PID 3600 wrote to memory of 5452	3600	msedge.exe	130
PID 5204 wrote to memory of 5572	5204	msedgewebview2.exe	131
PID 5204 wrote to memory of 5572	5204	msedgewebview2.exe	131
PID 5204 wrote to memory of 5572	5204	msedgewebview2.exe	131
PID 5204 wrote to memory of 5600	5204	msedgewebview2.exe	132
PID 5204 wrote to memory of 5676	5204	msedgewebview2.exe	133
PID 5204 wrote to memory of 5676	5204	msedgewebview2.exe	133
PID 5204 wrote to memory of 6128	5204	msedgewebview2.exe	134
PID 5204 wrote to memory of 6128	5204	msedgewebview2.exe	134
PID 5204 wrote to memory of 6128	5204	msedgewebview2.exe	134
PID 3600 wrote to memory of 6100	3600	msedge.exe	135
PID 3600 wrote to memory of 6084	3600	msedge.exe	136
PID 3600 wrote to memory of 6100	3600	msedge.exe	135
PID 3600 wrote to memory of 6776	3600	msedge.exe	137
PID 3600 wrote to memory of 6776	3600	msedge.exe	137

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://wearedevs.net/d/Xeno
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ff90f1fc188,0x7ff90f1fc194,0x7ff90f1fc1a0
  2⤵
  PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1756,i,16242363180943577032,14633225010790438451,524288 --field-trial-handle=2300,i,17768445565474208546,8377372684934689528,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:3
  2⤵
  - System Time Discovery
  PID:332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,4285239385515742831,17799001124252822691,262144 --field-trial-handle=2300,i,17768445565474208546,8377372684934689528,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:2
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2464,i,2709669304952352603,13640805403547995786,524288 --field-trial-handle=2300,i,17768445565474208546,8377372684934689528,262144 --variations-seed-version --mojo-platform-channel-handle=2780 /prefetch:8
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3412,i,17045627784844549709,6496215986533513142,2097152 --field-trial-handle=2300,i,17768445565474208546,8377372684934689528,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3416,i,11812230676271293335,14209537212457923891,2097152 --field-trial-handle=2300,i,17768445565474208546,8377372684934689528,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4156,i,8793164140110265432,6660745811712728975,2097152 --field-trial-handle=2300,i,17768445565474208546,8377372684934689528,262144 --variations-seed-version --mojo-platform-channel-handle=4160 /prefetch:1
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4188,i,14302093852615882937,1828437458673371737,2097152 --field-trial-handle=2300,i,17768445565474208546,8377372684934689528,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:2
  2⤵
  PID:2984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,15018508700109721109,6009562482295944737,524288 --field-trial-handle=2300,i,17768445565474208546,8377372684934689528,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,11008010984417938780,985639139831743623,524288 --field-trial-handle=2300,i,17768445565474208546,8377372684934689528,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  PID:1400
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,18098232433029605009,2363392591008549529,524288 --field-trial-handle=2300,i,17768445565474208546,8377372684934689528,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:8
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,18098232433029605009,2363392591008549529,524288 --field-trial-handle=2300,i,17768445565474208546,8377372684934689528,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:8
  2⤵
  PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6208,i,9241602547094627424,3044338684720558467,2097152 --field-trial-handle=2300,i,17768445565474208546,8377372684934689528,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:1
  2⤵
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4184,i,3775088179422659615,4930016492258531306,524288 --field-trial-handle=2300,i,17768445565474208546,8377372684934689528,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:8
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4272,i,16410516125980751407,13315773960495402881,2097152 --field-trial-handle=2300,i,17768445565474208546,8377372684934689528,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:1
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4156,i,10440164748849916650,2701793568760318203,524288 --field-trial-handle=2300,i,17768445565474208546,8377372684934689528,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:2868
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4464,i,9958720957395631277,5013976075777117254,524288 --field-trial-handle=2300,i,17768445565474208546,8377372684934689528,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:8
  2⤵
  PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4464,i,9958720957395631277,5013976075777117254,524288 --field-trial-handle=2300,i,17768445565474208546,8377372684934689528,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:8
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,10227325105490685877,6394558397135556782,524288 --field-trial-handle=2300,i,17768445565474208546,8377372684934689528,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:8
  2⤵
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4440,i,15524777746782746130,5421855767517538224,524288 --field-trial-handle=2300,i,17768445565474208546,8377372684934689528,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:8
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3556,i,11659453682859086801,8227123650977581252,524288 --field-trial-handle=2300,i,17768445565474208546,8377372684934689528,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:8
  2⤵
  PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=4168,i,4860715596371051830,10561037006759170635,2097152 --field-trial-handle=2300,i,17768445565474208546,8377372684934689528,262144 --variations-seed-version --mojo-platform-channel-handle=6552 /prefetch:1
  2⤵
  PID:5324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6196,i,3694332350072556235,15534493118947462621,2097152 --field-trial-handle=2300,i,17768445565474208546,8377372684934689528,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:1
  2⤵
  PID:5452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5184,i,5383059345355782869,3149855575742008079,524288 --field-trial-handle=2300,i,17768445565474208546,8377372684934689528,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:6100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,15045009412924919820,3532797824702148128,524288 --field-trial-handle=2300,i,17768445565474208546,8377372684934689528,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:8
  2⤵
  - Modifies registry class
  PID:6084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6440,i,10382815359008431919,9797395451511423976,524288 --field-trial-handle=2300,i,17768445565474208546,8377372684934689528,262144 --variations-seed-version --mojo-platform-channel-handle=7228 /prefetch:8
  2⤵
  PID:6776

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4760

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4568

C:\Users\Admin\Downloads\Xeno-v1.3.55\Xeno-v1.3.55\Xeno.exe
"C:\Users\Admin\Downloads\Xeno-v1.3.55\Xeno-v1.3.55\Xeno.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/xe-no
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://discord.gg/xe-no
    3⤵
    PID:5192
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Xeno.exe --webview-exe-version=1.3.55+87ae4f96f8a0927052c1120167982fb069afd1b4 --user-data-dir="C:\Users\Admin\Downloads\Xeno-v1.3.55\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --mojo-named-platform-channel-pipe=1932.2304.17412955959618864447
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:5204
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\Downloads\Xeno-v1.3.55\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\Downloads\Xeno-v1.3.55\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x178,0x17c,0x180,0x154,0x188,0x7ff8ff54b078,0x7ff8ff54b084,0x7ff8ff54b090
    3⤵
    PID:5228
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\Xeno-v1.3.55\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView" --webview-exe-name=Xeno.exe --webview-exe-version=1.3.55+87ae4f96f8a0927052c1120167982fb069afd1b4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1732,i,8307813975032246155,859954569668345095,262144 --variations-seed-version --mojo-platform-channel-handle=1768 /prefetch:2
    3⤵
    PID:5572
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\Xeno-v1.3.55\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView" --webview-exe-name=Xeno.exe --webview-exe-version=1.3.55+87ae4f96f8a0927052c1120167982fb069afd1b4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2064,i,8307813975032246155,859954569668345095,262144 --variations-seed-version --mojo-platform-channel-handle=2080 /prefetch:3
    3⤵
    PID:5600
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\Xeno-v1.3.55\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView" --webview-exe-name=Xeno.exe --webview-exe-version=1.3.55+87ae4f96f8a0927052c1120167982fb069afd1b4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2240,i,8307813975032246155,859954569668345095,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:8
    3⤵
    PID:5676
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\Xeno-v1.3.55\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView" --webview-exe-name=Xeno.exe --webview-exe-version=1.3.55+87ae4f96f8a0927052c1120167982fb069afd1b4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3544,i,8307813975032246155,859954569668345095,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
    3⤵
    PID:6128

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cc11c2ba3ec4cb292b61dd36af338e083bb0ce5868e654b17f3c58ecf3c8fdfb
MD5 22bfe5ff5070c92c37e54f6f278efd25
SHA1 2fc94025f3a738879f1fcececb95937cbaa0cdd1
SHA512 b57abd220e674cf733b39ea299fc66d6fe964ab448ae0758482efe80597e3678909cd989b9635acc0317001af0fe6dbbbccfd3cf110ec5ad1b9e4c084de22188
TLSH
T16FD09220B719A2C3E24704BA94A6AB52A916C57AA0B7F7017232640CAE65089F28F192
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 201729318e073e437978c4f830a6df095e397d14193bbab8cb94016e3e0e1540
MD5 038903102cb76ddedd18207430e00005
SHA1 e694b970e01eb43fddfb00d36857e2b64f8c931b
SHA512 bacb50167c8d736bccc259f2ffbffff915c7c6dc188c6c2c1476ded8cbd822ff968f690173d1b8e35c352ec62f9ace3913a556b80bc1a59211be000ee9ea7447
TLSH
T17DD092207759A6C3E24704BA94A5AB52A916C57AA0B7F7027232640CAE66089F28F192
MD5 SHA1 SHA512 TLSH

Submit Download

f_00009c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009c
Size 156KB
SHA256 313818d6b177a70fbe715a5142d6221ac1a1851eff5a9f6df505670ddcd73074
MD5 3b0d96ed8113994f3d139088726cfecd
SHA1 1311abcea5f1922c31ea021c4b681b94aee18b23
SHA512 3d78c250029069e1850b1e302a6d8a5154f6e7bc5cd58f449b8824ccf418e80dba2d5569a9cff72f51ccc9de140dc91148f93ec4717f4a880e2ba94898fbdb24
SSDEEP 3072:B+pcBZNL29qTsnrCIO1lC6d6z9sZPbUGz3fOHN:BfWqg+IBU6oPbUGDfOt
TLSH
T19BF302B2751DD6D2E502DABAF20F840CBF9F5125879143A7DF68B21CCFD502A50A742A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 067223fb64b72ed5174c275afbbe6261dfdd3f491da06f54dd5f59fa62a72ef8
MD5 f00ddd03e98c0205fce35dff381d6469
SHA1 5ca15dc08fc7f522087931f1b827d097e418ac52
SHA512 53b8bb27c750d0db2ef3562a42ef374f0b4c60e28746fcd9467fc319e53a6c6c61e826b848245ccd33e2ae4f82353d9252bb76d35de0387fa977991c4fbf572c
TLSH
T1B781613D19260962D3A1897278DD22807DB1C5EEFE335DAE017AFD70E51D35B902B4B8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 8KB
SHA256 17e43eeeab0959619c72fa8b1a8d9520d2347dd2bff580d0a78779628cc9720f
MD5 ddf76076ed7a5ed90e3b7d1573a9348f
SHA1 6655b3df4f9c86da5679a2fcb7874afbc3043bf5
SHA512 bc4ddbb4bdca55dc0253210bab0d46819b958794282da7c8fd9686f4f64656de145475dd68e2a586d6f709a19b609dd0550c5f18580677627640a80bd72a2cb2
SSDEEP 96:C8OqF4IccXZhNhN57l1HLoFaw88P6Kgr/wr41zsI/Mz7B5pqmFshlXFPRooZ2Kn:FD7XbrVVHr/I4yI0/BzZsh1FPRoin
TLSH
T1570294393A610B52C7A14931E4CF10983D73C4FAFB635F5B442BEF31A2493961B2ACA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58f603.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58f603.TMP
Size 3KB
SHA256 81b720e0758a803369901f8ea3417400a9ad379109671e9fa49baa7d537f6308
MD5 1199828cf5dae0c397b4bc9f4a4218f4
SHA1 31736d3f32b9756f87761ec04f0f5c4c9aa2ca8c
SHA512 38762e4f2c10565fed26743ad12ecabaf8e43dc9333e75036554c9091c8f08829f39c0ef87239743e7bc0d97c4d474890a9f5ac5afe7041740eb21a1a3d99930
TLSH
T11071523D192609A1D3A1883278CD12847DB1C9EEFE336DAE0179FA74E51D71B812F0B8
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 bce9649f5d513830b4cf12847ddefb0b843e53a8c932bfdc2eff14a63a41b06f
MD5 fd55180127cc1d975cdfdfd546cec2a6
SHA1 fb4f65a18d5a655fe15affeb1bc0932fbd4e2e06
SHA512 74e9ede9f785cf9a90353f6b1ba465c27999456d4488f924daf6c9ed3dc4c90ad5f72fcc594f03dd5a58aeac9d484b700a4df36d5d9e1eabfde9d11afe1ec5c6
SSDEEP 96:DtOzgH+IJdVuqWzYGVmt+zubPgVzaKwB9y7ueuu6+uM:DAzgeIJdVfWzYGVg+CPgVzaKk9Yruox
TLSH
T1DAB17BF3C2E4862D991162F49B246D2ADF1D191943183D6ACCE5EF5FA3E2472E20164F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 5bac5eb30e9a2340b0efce95ae80c8b876d412304c306495420172e3ed486fd7
MD5 9ead7944c5fe905f2aee1a9b4e07bab2
SHA1 f2768dafdbd3ba9e49c22f88860ef52795a8fd46
SHA512 963e4975cdeef123ea696f0d2ae97cd179ad2f1783af9dbb0a17b77ad7bf8e91396297ac7c7da1da77cc389bf84fcc21087db33756a45b95d4e82c31e3ef963e
SSDEEP 192:sxZjlkk/f9sl15IdpMvHW6+WNrUb/YIIe5OOuIgrJ:sxZjuk/f9sl1SqHbU/w9
TLSH
T1D822A8526E28997B4CC7D21DBB19BF53E6F95032A1D45E48ABFC8A0C09E76DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 55d3a3ee4d5240adeb32ac8f906398fd65d65dfdbbb5e5207ba28c9c54b6a99e
MD5 2b4ce6728fb68f9f101f615138f246fd
SHA1 1aa34fc6eb9e308b09be53355fa7e5eb5ab4d536
SHA512 ac372766719587247c6f2684b4999073e10aa1fd35895b2396c53ade68979f674719a3dd05aabb6f1efefd1364502cbefbe8af5a5cb53b32d5aecea75390e378
SSDEEP 192:sxZjl9k/f9skR5IdpMvHW6+WNryyXYISN5OOuIg5XJ:sxZjvk/f9skRSqHbHXVT
TLSH
T16D32A7526A28997B9CC7D20DBB157F53E6F9503291911E48ABFC8B0C09E7ADD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 04e12ae02a110cc2f489a45a538067a364224905951d6060b089c7bc49627135
MD5 a506ff79463c4c0bf661d1797e49bc89
SHA1 3f86927be25985018bd5d364fd839ff1acca6de8
SHA512 579bdad2b586970d65b77c41d9c464b398f7aa28ee6c104f5a457e2d2b08fc3eafd706c543039512565e18c63f8469720e57dfa29fee9297d02639118762fee0
SSDEEP 192:sxZjl9k/f9sk15IdpMvHW6+WNryyXYIqr5OOuIg59J:sxZjvk/f9sk1SqHbHXld
TLSH
T1B92297526E28997B8CC7D21DBB157F53E6F9503291D51E48ABFC8A0C09E76DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 e1b03a0fd481e7d45701f2fe78cf878d0beb8ea8a47e7b02d53ea3d531dd6417
MD5 fa6c2e0ecccf845ec2e52b1d4f1791f9
SHA1 fbe10f16f9d1759ed54d7551c8c63db5b15fa825
SHA512 2acfd62b5186770bc937f2b4ba7e9b078548c8191de7d65db044e37b7a62b55106b8ede9a5dac822b7d0f02ebcf65ab4096c1f19e2ff3fb39a680ce96ae08740
SSDEEP 768:IHyqbblWvJDjT8F1+UoAYDCx9Tuqh0VfUC9xbog/OVE4Ll6AR7froIm/cU:IHyqbblWvJDjTu1jah4LAs7MBF
TLSH
T16CC2F93B654CCB7E4F800AADDD5A6FD73ED802C7A6588D4047FA994C02C73EA51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\f0827bb5-ed12-415d-bbae-8e7743f3a0e8\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 226B
SHA256 261fa4e2fe68832ffde6df45b7f0451d337d43010a94bfb48b1d7ba26c9b59e9
MD5 010688939afeab9bb6efdc47c397a2f6
SHA1 9b7d6a9d6907b35600d985bb03926b52d9fec6f1
SHA512 4882eabcfabf261d746694024a394e46f68126f78c7faf5a0f58b2e1de94b16a059b591f34a60bf64225af4f657da92e5970c62b1646b0ace32273465b35d79b
TLSH
T161D0A79BF0769641A7FB8EC25632A95687967CC82499A18C9011181A8894F5A5301E97
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 233B
SHA256 ee7680a6b97457b3d5b1bea05f6dc5edde3b8b4c18a5e513785858f2db0362cc
MD5 27330343c991eacba6ad6d4b18c26207
SHA1 4b449450d2aca707f29b7414d1b292ce0e4914de
SHA512 4940cc1c314ea11566986d4dab0112e9b0e613d6839c163924cb011a7bc2bff837152110e8c95c8060a6158f3eeb709f6eb3ff756d979562cd6287778b442f62
TLSH
T14BD0979BF0B35141E7BB4EC35232A94643A12CCA2884E08CC002381E44B0F4A9300E83
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe591fa4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe591fa4.TMP
Size 138B
SHA256 f12e12c409a423c68a218adefd4207a76e96995ef0bc620ad0de484fe5fe2edd
MD5 0418b22ec3cfeee69ef33a4fdba725f6
SHA1 e5aa57c06d20684c8f7a02f33fd5c2d79649155f
SHA512 f86401ce36784db5ffc2e5360c631744762032f483118bfecfb51a14ad11ae427799ae7e933ff326e0c155e1a43642ce2eacaae4a7d75f73ca56c8e6c7271869
TLSH
T1ECC02BF7F0B60011872906810332910C43412CCC5C82C54CF00338551074F276305F93
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 cdf89f79c8abfbda55dd670b9d9de9ec88b54a20af98953bfa4ede066c457b45
MD5 dbfa071519cad1032dc8f24dd9353ea5
SHA1 d47e007471a18a74bacfcc533003bc9ea6a5c011
SHA512 4ffbbba9a5804b6b023b1a0d39173f9a9f712309854739f35556f16978f94c4fdcd131d15e305fb67051fde0b30b1d1df731433236e79e5e5906a1ac540925b6
TLSH
T1CBA002119A5A6165C00003B6D25232C9732049101A5A321654B54459CEB99445793044
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589c0c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe589c0c.TMP
Size 48B
SHA256 2907b499ff27b0f510c6197886a0a7b0e6d6e6c4649683f5c9e683ca676dde29
MD5 d316862c342d496ffaaaa3f823bef574
SHA1 09f5c3fa98faeadf915252384f99648598ff8486
SHA512 e5341b62f3fa3f2406fb0b49970399de08e890444d3a96ee40d42ccfaf071e5b75807887424b6bf32f2da5f534854afedf2341d732da9b006c3da0f9cbc95839
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 3cf1acf2c5aead54448ce9010356ad24db1aabf54d2fd02180eef1f1186cfc08
MD5 a6f6b4fb08b223c3d9ab3b0d5b90e4f5
SHA1 dba73acdb318899ebeff2211f2655d61fa8566ab
SHA512 c86e5faba3aae1023b06ecdbb0f78aeeb597ef912a9e86773fbafeee9ebda1a1bd535b08fe6b55d75e8caf459ce9c2af93ed32d29fc66bac6f621decaf13f57b
SSDEEP 48:KPYNs4iCiac6vpI9IaKGveOaS4K7H2oTyuEVQUK+agembzIfcgKU1cCgAswpLik9:KYbaKYIKOfuKQY+S2gKnKI
TLSH
T131916716757E0242783D2958F3A69A374F8532A33008A4EF7FB850664E66E120DFDDED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2ace3af2-2d1d-427c-aacb-47c133038ab7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\2ace3af2-2d1d-427c-aacb-47c133038ab7.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 7ff68e09f42cde8e9b08ee376d9c9c3aec2029887830a2b1ffffd1257c055e4c
MD5 e840b9733aeb4b4e61132bdd31ce5947
SHA1 a7aa871a8b209d05bf562f32a2eb8f05cc87c65e
SHA512 fae18067dc59de37bf4fd493cb046eb297b7bb99d0202ef463273facafb0f43d9d1bc80eeacb4fdf4c92c9a45868eb001b30e42fd0b0e87447cc6277605d4961
SSDEEP 384:WtNn/s3n9S8sNxnhBkLbbQN2VRNT6bziyOObjI9G6w7Z:Wj+9jR8NUHTWiy29MZ
TLSH
T1BC929D3268385E3B8DE29514F58B36175FF482BB93C92F40D5EC6F0D05DB5AC1306A2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 9c8314c3cfb619f100b7f7e3989e137342c98cc843533b99acd06b04344e5bdd
MD5 d4919e33f9bf914c9952a2468ecffa91
SHA1 48510777c519e88e28a463c2c1def701b80d05cb
SHA512 70f718ebe655616f5504038f30baf87df3f2bbea1e34f2e1f6b3d44407d3cc8e9f277b0cebf06da002cf7069140d5e7bdd9783987abda311a7a8b66f68f12068
SSDEEP 192:QLsNxPQ8Acl+0XkRb6TQmiU1Yhz4VRNKFCk5dZc0vISRifqRXU8:msNxPhBkLbY+8VRNT6bziyU8
TLSH
T1FF323A3268385C3B9DE2A504B58B36135FB4516BABC92F40D6ED1F1C05DF6DC230BA2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 4594a3f99776c3a69ab317a696c43127e0c308eb54b85d9951007f7118bd44cd
MD5 f9e4bf09b7031f6056b7d2bf4d337516
SHA1 c093cc9dc55a36cb6ab6eec684c1c03bcc399c81
SHA512 916c12d70ce64e3f49b8324b34c91674546e7484067df03dafe35bd6f1dcc0f59af3e82c18658ed617c82103c96d61495e0960b371ae9fce3a33f262bb687acc
SSDEEP 192:tONb6JkRtQmiUyVjW+RNKFCk5dZDh3iMREU6:tONb6Ur2W+RNT6bVirU6
TLSH
T11C020A36AC386C7B9EF26D05B58737231FA4116BAA952F40DAE81B0C00D769C1307936
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f922ff9c87b2ebcdc9d8fdc49d25711f20236343f7a0a2a00e2493a41ed83465
MD5 ca095506a6317e4d762723235500a68d
SHA1 90c3f0f55d9a27a72b7a4d6493e18ad18717b4cc
SHA512 cb01d289b4ff3ad5c6282b01dccdc5f7076c7aaa941c6532908785eb9394a4ec1b394cda183ee2b3f68c00ef90bfbb6f106126db8e18b517886937b15c704953
SSDEEP 192:UONc6JkR1QmiUySjs+RNKFCk5dZc0v3VcifqRXU6:UONc6UT/s+RNT6baiyU6
TLSH
T114120A3668385C7F9DE2A805B48732135FA4926BEB896F40D5DD1F1C01EF99C230B93A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 9e7f3a71a658f3939d9ebb2054edc71e36461a265190e57af966dca3d0d6c412
MD5 e9cc1457215188a55f82224cb3734693
SHA1 7b062c1e0a9ef655d20fac1422e222c70e05cef4
SHA512 8a54ca5b89ac6996f67504f9620e3193b30767127237691d6358ee517cd12a51008324d3837993df53646b745bd9c79699835ec6137b735c7d5ff0c03de21a6e
SSDEEP 384:XiFKtNn/s3n9SvIsND8TUNTUlIlnhBkLbkLHN2VRNT6bciyOObjI9G6w7Z:SFKj+9jqwgqsNUHTdiy29MZ
TLSH
T1ACA27C3358288E7F9DE28A54FA8B36178FF441AB86C56E80E6DC5F0D01DB5EC1306A25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 2addfa6fc08101ab1ecac347459a68eb089a0a677e04b8e9da36d53e5bc54eb7
MD5 d25a4b7d1d7ac217eb539a79ca2f7e50
SHA1 1d35256e333b2583069b2feb78fb3ab54114364f
SHA512 69f6a147304f4031f581ae019f3fe7d9ad7ea9cdcd03dbe8bf1e2b0208600455d2d5b2c62b9e991d5e984158d37156ee5ce3080922107a4a5e00e1f56c39355c
SSDEEP 192:QBsNxYvQ8Acl+0XkRb6OQmiU1ehN8BVRNKFCk5dZc0vISRifqRXK1vKV/:esNxchBkLbbQN2VRNT6bziyAY/
TLSH
T171523B3668389C3B9DE2A505F54B32135FB49267EBC92F4096ED1F0D01DB6DD230B92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5cbeba23-5e4c-40ba-a964-d3dc5cc5ee68.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\5cbeba23-5e4c-40ba-a964-d3dc5cc5ee68.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 b145c4ecd9f413277bab006dc7aa01160a824893020803a430e9856b1002aca3
MD5 0bb5a3b75a7c0b2ea6b003ed8da59174
SHA1 0dcad9f55eff6ae418c1c89f2eab9a6f5e3beb62
SHA512 9e542bccd5c121502b41a56dc184a1bf32be0992381eed204f8101416ac8d08b3b9c5085b46d71c6046b7a2df98a87a1b7db18fdae0cc147933ef73951b8fe55
TLSH
T13941045CB6E91108B3B36F1A9BF6A86E48BAB9672F47C45E10110E4E4A63A40D871737
MD5 SHA1 SHA512 TLSH

Submit Download

XENO_CACHE.bin

Path C:\Users\Admin\AppData\Local\Xeno\XENO_CACHE.bin
Size 36B
SHA256 3bab55816f9c1c63b26bee8027a74983736938cfa748d9c91230391d4bacfb88
MD5 03b4e88d732421deccbdd05cb90b0513
SHA1 1ba9d3bd3af60ecc041e93251633b5a0fbac4d9b
SHA512 40e01403608fc8d8c0bc7bc6e1367a472778dea5d4dde4d242b37b0860d098075ac71cf24abd85c6b9ee67bf6adf80adaaf279a969f4477555807003276a2c75
MD5 SHA1 SHA512

Submit Download

settings.json

Path C:\Users\Admin\AppData\Local\Xeno\settings.json
Size 101B
SHA256 88e5c8567b1cad0fa2a42a21ac273a1ffb8a6992be41e5de548d11f281f4c373
MD5 7109faf92716c37ae9d65f89a2477be0
SHA1 de2903bb44600fd8a69649c395335d4fc226c5e0
SHA512 f41ca49622d3458c1365fd9f610e1c27fd3dd816ce5c910e785532dcc39d94ceb1a00991909cc247ab4b9e9da0ac583245168853d8bdcc235116f0a7a4538b2f
TLSH
T11CB09232984108FC01608299C841D80203118E0120662E02B4BE025928308346000FD8
MD5 SHA1 SHA512 TLSH

Submit Download

Xeno-v1.3.55.zip

Path C:\Users\Admin\Downloads\Xeno-v1.3.55.zip
Size 6.8MB
SHA256 7d89aca3584916e86707d8c9c6af606491bc9a3cadff9aea85a95f97a7a02a0b
MD5 4cb6bc7c49c919065dab1c32d70df887
SHA1 31924dd424c5259988e1cda49a5bd730fbb2b284
SHA512 8d738a6b78f773d41332f401e31ccf6d5e8054a768120906e1d0501d11dc887d111f8c1a5f7f96119b67cb3bf5fc97dfe218e78007aa61819636708003c5099e
SSDEEP 196608:inFGt4gLGBvG7bM032XaCzn/sUH28DgajJ2qaJggT3OsR:inFi4gL/nMhhc8DgsaJgNsR
TLSH
T1D06633CCABE818D2FA3891796A3017F96653E3416716650BE50C04E772DAED04B87B3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\Downloads\Xeno-v1.3.55\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 fc8a5f1fdcd567f4f956ab3648eb5b681a044f7e5fc61a65f6715404370051cb
MD5 e7f9ff57ca26ea7616237a0aa2557020
SHA1 ba1c249a184bb8c5bf0d32610768889426cb66ed
SHA512 86a1af8183165307e06b04420e8be5bb38760066658d70b29006948bd62b1a85cad6492bf2041ddc3bfe3d903e27f4e6a9237b9ab1fd5c15c8cd4664a86c2b01
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\Downloads\Xeno-v1.3.55\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 879a6ecc10aeada26211ecaa34010011137bc2e8a14bd377c2cb88e955ba1071
MD5 b072b1374aaa7dfcb41b9122dc447d2b
SHA1 dc92873f0bb95140a14d77bbffc5f5ba792a2652
SHA512 1273c7d6b8000e54f96cdcd76c285512893fac4e4254e92df46f325b14d0996df62c1ed7cb0c80a6e37b97e22ba2040d0394800ec455ad845de2866c5b98301f
TLSH
T1E1D012723341013CC42029730202A2090541C20B850540019429892E2B480900902C43
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\Downloads\Xeno-v1.3.55\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\Downloads\Xeno-v1.3.55\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\Downloads\Xeno-v1.3.55\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\Downloads\Xeno-v1.3.55\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\Downloads\Xeno-v1.3.55\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\Downloads\Xeno-v1.3.55\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\Downloads\Xeno-v1.3.55\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\Downloads\Xeno-v1.3.55\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView\Local State
Size 1KB
SHA256 4d78e12125257a42f7f17c50950f45a17e107f3fc65feab32acdc89247e63d95
MD5 03d09f1fd67d0b51285e33ba78182a86
SHA1 73c98f9cf2b1cd837a961e4b8ad1b87aa86cd578
SHA512 266ddd3550a6105eb20c24a6d4c3deec8774dfcd26523cb05543ebf2035efd770fc7875626d0b79196f7d8ad0c98360852a6a1c73162add1f8500f2facf9e201
TLSH
T12931A7B3F080AE32ACC2B6C472167F836D602279C1604E4896DD8B4C0BD75CC9636C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\Downloads\Xeno-v1.3.55\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView\Local State
Size 2KB
SHA256 588022471b1bd6ce48e5ed4bf70c5a6049fcab5c0ec128f4427c2ee7911a17f2
MD5 2f33591094bc9db95405258b5dda9c03
SHA1 9887095e593d3f13486e4cd4f938231275675e86
SHA512 cd3f75eb490867672bd6a6fd8110e6f8333ea5c328ecfe366c0e19c6bc21f6126c47d179fb72b58735f35a347b1bc8c571498e4bc8eefb8c5ecd0f7507b57577
TLSH
T17951D773B804EA37C9E39684BA1A3F53AD356265C6A12F509ADD0B4C06DB59C2302C3B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\Downloads\Xeno-v1.3.55\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView\Local State
Size 3KB
SHA256 116d962a27e4bcfee554bb421b74f7d06fa633a792609c089df89dc8b21c27e8
MD5 cd27079bc449d070b29b781ad9cfb377
SHA1 c655198cecaf1002c706d587de3d4242f8361ca1
SHA512 b959b8a345e0b32c90a5eb224df625cdb2a057f9834678c4b781f989da82870c0e16548dbc2ffefcf0a450b81fe5b60b301f7193cdd6164bd44431dacc0f707f
TLSH
T19A719663A964E9378DF3DA44B9863F06BAA55237D5D03FA4CAED0F0C06DB2981351C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\Downloads\Xeno-v1.3.55\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView\Local State
Size 15KB
SHA256 64b84ab5863ca882f2bc69e9954383d5b0715faeacf845bd59d08a4cbce7e1b2
MD5 ab46b7829505c3a24666b2768b4afd8f
SHA1 6cfccb313e5cfba9a56573773520841533b6e46d
SHA512 767495453ce3e00746f35f3647b8442ce8f75ea98f27507d1ee40ce6146ec454a3dc2ca913caa06b919aedfeae2dd717ac419f0d02137638c7f020f7ed7628d9
SSDEEP 384:z9srv+89zHqlDNP9oid6Nb/FiPCCjA6N1:Wrv+4UNbdaDCjA6N1
TLSH
T1A6729E33A178A737ACF2E944F54A6A077F7861A691C10BA4DAD94BCE46CF0C92316D13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe59165d.TMP

Path C:\Users\Admin\Downloads\Xeno-v1.3.55\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView\Local State~RFe59165d.TMP
Size 1KB
SHA256 c481bc592c2b8aecf11f484c0cd86e7d632116eb1a094e348b745d5a647116d0
MD5 d9545a3f8de1227428f1df8048389f61
SHA1 e959e2b6098dc31f9efb36329ea19c97102785e2
SHA512 6070490202faa297f1cd918aadbdbc9343071c67df290eebd1ddc05ee97ff955c7b1715cda7e8e6099e68852e999afd498a5400639d62485ab896233dafb5f7b
TLSH
T160219573E081A972AC8266C4B2227B862C502275C1604E0896CD874C07DB49C8732C33
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5572-1081-0x000001C0F3430000-0x000001C0F34FD000-memory.dmp

Download

memory/5572-329-0x00007FF92AA30000-0x00007FF92AA31000-memory.dmp

Download

memory/5676-334-0x00007FF92A8E0000-0x00007FF92A8E1000-memory.dmp

Download

memory/5676-1082-0x0000021ABCA60000-0x0000021ABCA90000-memory.dmp

Download

memory/5676-335-0x00007FF9290C0000-0x00007FF9290C1000-memory.dmp

Download

memory/6128-414-0x00007FF92AA30000-0x00007FF92AA31000-memory.dmp

Download

memory/6128-1094-0x000002351BA00000-0x000002351BACD000-memory.dmp

Download