11e88b2ca921e5c88f64567f11bd83cbc396c10365d40972f3359fcc7965d197

Analysis

user interaction
yes
max time kernel
625s
max time network
627s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/07/2026, 17:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Xeno-v1.3.55/Microsoft.Web.WebView2.Core.dll
Size 557KB
Sample260724-wh7fmsverd
SHA256 11e88b2ca921e5c88f64567f11bd83cbc396c10365d40972f3359fcc7965d197
MD5 b037ca44fd19b8eedb6d5b9de3e48469
SHA1 1f328389c62cf673b3de97e1869c139d2543494e
SHA512 fa89ab3347fd57486cf3064ad164574f70e2c2b77c382785479bfd5ab50caa0881de3c2763a0932feac2faaf09479ef699a04ba202866dc7e92640246ba9598b
SSDEEP 12288:6CxswUBor35JrpQ322zy+uFKcDoRFNCMmeA+imQ269pRFZNIEJdIEY0lxEIPrEIE:6Cbmv
TLSH
T15BC4402123FD8A1AE6F63BB5A57407709BFAFC967979D39D0598251C0D72B408AE0333
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{b21e7fe8-9175-483b-a67f-0fd948722740} = "\"C:\\ProgramData\\Package Cache\\{b21e7fe8-9175-483b-a67f-0fd948722740}\\windowsdesktop-runtime-9.0.18-win-x64.exe\" /burn.runonce"	windowsdesktop-runtime-9.0.18-win-x64.exe

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
141	discord.com
144	raw.githubusercontent.com
145	raw.githubusercontent.com
140	discord.com

Downloads MZ/PE file 1 IoCs

flow	pid	Process
119	936	msedge.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	windowsdesktop-runtime-9.0.18-win-x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.18\System.Reflection.Emit.ILGeneration.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\tr\UIAutomationTypes.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\cs\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\cs\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\PresentationFramework.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\System.Windows.Forms.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\es\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\System.Threading.AccessControl.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\ja\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\pl\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\fr\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\PresentationNative_cor3.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\ru\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\pl\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\es\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.18\System.Linq.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.18\System.Resources.ResourceManager.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\ru\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.18\System.Diagnostics.Contracts.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.18\System.Transactions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\System.Formats.Nrbf.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\System.Windows.Controls.Ribbon.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\PresentationFramework.Classic.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.18\System.Net.Ping.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\cs\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\ko\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.18\System.Reflection.Emit.Lightweight.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.18\System.Diagnostics.TraceSource.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\System.Printing.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\System.Security.Permissions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\it\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\zh-Hans\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.18\System.Memory.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.18\System.Text.Encoding.CodePages.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\ko\UIAutomationTypes.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\es\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.18\System.Security.Cryptography.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.18\System.Net.WebSockets.dll	msiexec.exe
File created	C:\Program Files\dotnet\dotnet.exe	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.18\System.ServiceProcess.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\PresentationFramework.Aero2.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\zh-Hans\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\it\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.18\Microsoft.VisualBasic.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\System.DirectoryServices.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.18\System.Private.Uri.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.18\System.Threading.Timer.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.18\System.Threading.ThreadPool.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\ja\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\cs\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\pt-BR\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.18\mscordbi.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\UIAutomationTypes.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\ru\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.18\System.Threading.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.18\System.Xml.XPath.XDocument.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.18\System.Net.Http.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\fr\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.18\System.Data.DataSetExtensions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.18\System.Collections.Immutable.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\ko\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\fr\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\zh-Hans\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\fr\UIAutomationClientSideProviders.resources.dll	msiexec.exe

Drops file in Windows directory 35 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI6C2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149\fileCoreHostExe	msiexec.exe
File created	C:\Windows\Installer\e5fe4ac.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE836.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{EDFAA9B4-1B98-43B0-95C5-6010790950B5}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF6A0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5D6.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5fe4ad.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\e5fe4a0.msi	msiexec.exe
File created	C:\Windows\Installer\e5fe4a1.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5fe4a1.msi	msiexec.exe
File created	C:\Windows\Installer\e5fe4a6.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{B9CB3C69-65ED-445D-A35F-38FCC2058C35}	msiexec.exe
File opened for modification	C:\Windows\Installer\e5fe49c.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEB54.tmp	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149\fileCoreHostExe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA4D.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{35EC5E45-F900-4AE8-B6FC-E96FB9249F74}	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149	msiexec.exe
File created	C:\Windows\Installer\e5fe4ad.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1F9D.tmp	msiexec.exe
File created	C:\Windows\Installer\e5fe49c.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB4.tmp	msiexec.exe
File created	C:\Windows\Installer\e5fe4a5.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDF7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI11C1.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{0CADB010-02E6-4833-B505-BD81F85D0915}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI21C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5fe4a6.msi	msiexec.exe
File created	C:\Windows\Installer\e5fe4b1.msi	msiexec.exe

Executes dropped EXE 8 IoCs

pid	Process
2004	windowsdesktop-runtime-9.0.18-win-x64.exe
3728	windowsdesktop-runtime-9.0.18-win-x64.exe
568	windowsdesktop-runtime-9.0.18-win-x64.exe
1748	windowsdesktop-runtime-9.0.18-win-x64.exe
3936	windowsdesktop-runtime-9.0.18-win-x64.exe
2240	windowsdesktop-runtime-9.0.18-win-x64.exe
536	windowsdesktop-runtime-9.0.18-win-x64.exe
4536	windowsdesktop-runtime-9.0.18-win-x64.exe

Loads dropped DLL 64 IoCs

pid	Process
1748	windowsdesktop-runtime-9.0.18-win-x64.exe
568	windowsdesktop-runtime-9.0.18-win-x64.exe
4004	MsiExec.exe
4004	MsiExec.exe
4536	windowsdesktop-runtime-9.0.18-win-x64.exe
2692	MsiExec.exe
2692	MsiExec.exe
2604	MsiExec.exe
2604	MsiExec.exe
1820	MsiExec.exe
1820	MsiExec.exe
3924	Xeno.exe
3924	Xeno.exe
3924	Xeno.exe
3924	Xeno.exe
3924	Xeno.exe
3924	Xeno.exe
3924	Xeno.exe
3924	Xeno.exe
3924	Xeno.exe
3924	Xeno.exe
3924	Xeno.exe
3924	Xeno.exe
3924	Xeno.exe
3924	Xeno.exe
3924	Xeno.exe
3924	Xeno.exe
3924	Xeno.exe
3924	Xeno.exe
3924	Xeno.exe
3924	Xeno.exe
3924	Xeno.exe
3924	Xeno.exe
3924	Xeno.exe
3924	Xeno.exe
3924	Xeno.exe
3924	Xeno.exe
3924	Xeno.exe
3924	Xeno.exe
3924	Xeno.exe
3924	Xeno.exe
3924	Xeno.exe
3924	Xeno.exe
3924	Xeno.exe
3924	Xeno.exe
3924	Xeno.exe
3924	Xeno.exe
3924	Xeno.exe
3924	Xeno.exe
3924	Xeno.exe
3924	Xeno.exe
3924	Xeno.exe
3924	Xeno.exe
3924	Xeno.exe
3924	Xeno.exe
3924	Xeno.exe
3924	Xeno.exe
3924	Xeno.exe
3924	Xeno.exe
3924	Xeno.exe
3924	Xeno.exe
3924	Xeno.exe
3924	Xeno.exe
3924	Xeno.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-9.0.18-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-9.0.18-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-9.0.18-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-9.0.18-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-9.0.18-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-9.0.18-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-9.0.18-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-9.0.18-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
936	msedge.exe
4160	msedge.exe
2324	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 15 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 14 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134293899103933283"	msedge.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3693C0A713552476F4E3AD22D8059B9B\010BDAC06E2033845B50DB188FD59051	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_9.0_x64\Version = "72.72.55158"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\54E5CE53009F8EA46BCF9EF69B42F947\Version = "1212733302"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\54E5CE53009F8EA46BCF9EF69B42F947\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\54E5CE53009F8EA46BCF9EF69B42F947\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{35EC5E45-F900-4AE8-B6FC-E96FB9249F74}v72.72.55158\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{b21e7fe8-9175-483b-a67f-0fd948722740}\DisplayName = "Microsoft Windows Desktop Runtime - 9.0.18 (x64)"	windowsdesktop-runtime-9.0.18-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{b21e7fe8-9175-483b-a67f-0fd948722740}\Dependents\{b21e7fe8-9175-483b-a67f-0fd948722740}	windowsdesktop-runtime-9.0.18-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_72.72.55185_x64\DisplayName = "Microsoft Windows Desktop Runtime - 9.0.18 (x64)"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\8ADC86493D955D5516528FD99E43D025	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96C3BC9BDE56D5443AF583CF2C50C853\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{B9CB3C69-65ED-445D-A35F-38FCC2058C35}v72.72.55185\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\010BDAC06E2033845B50DB188FD59051\SourceList\PackageName = "dotnet-hostfxr-9.0.18-win-x64.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\96C3BC9BDE56D5443AF583CF2C50C853	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96C3BC9BDE56D5443AF583CF2C50C853\Version = "1212733329"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_72.72.55158_x64\Version = "72.72.55158"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\54E5CE53009F8EA46BCF9EF69B42F947\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\54E5CE53009F8EA46BCF9EF69B42F947\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_9.0_x64\Dependents\{b21e7fe8-9175-483b-a67f-0fd948722740}	windowsdesktop-runtime-9.0.18-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4B9AAFDE89B10B34595C06019790055B\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_72.72.55158_x64\ = "{0CADB010-02E6-4833-B505-BD81F85D0915}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_9.0_x64\DisplayName = "Microsoft .NET Host - 9.0.18 (x64)"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_9.0_x64	windowsdesktop-runtime-9.0.18-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4B9AAFDE89B10B34595C06019790055B\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4B9AAFDE89B10B34595C06019790055B\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4B9AAFDE89B10B34595C06019790055B\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{EDFAA9B4-1B98-43B0-95C5-6010790950B5}v72.72.55158\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_72.72.55158_x64\Dependents	windowsdesktop-runtime-9.0.18-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\010BDAC06E2033845B50DB188FD59051\PackageCode = "E65350071DC5D4947B27B36EF90204B9"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\010BDAC06E2033845B50DB188FD59051\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_72.72.55158_x64\Dependents\{b21e7fe8-9175-483b-a67f-0fd948722740}	windowsdesktop-runtime-9.0.18-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4B9AAFDE89B10B34595C06019790055B\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_9.0_x64	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_9.0_x64\ = "{35EC5E45-F900-4AE8-B6FC-E96FB9249F74}"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96C3BC9BDE56D5443AF583CF2C50C853\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4B9AAFDE89B10B34595C06019790055B\Provider	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4B9AAFDE89B10B34595C06019790055B\MainFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\010BDAC06E2033845B50DB188FD59051\Provider	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\010BDAC06E2033845B50DB188FD59051\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\8ADC86493D955D5516528FD99E43D025\96C3BC9BDE56D5443AF583CF2C50C853	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4B9AAFDE89B10B34595C06019790055B\PackageCode = "5DB59C3C77BB8894AAD967E03E92BCB4"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\010BDAC06E2033845B50DB188FD59051	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\54E5CE53009F8EA46BCF9EF69B42F947\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{35EC5E45-F900-4AE8-B6FC-E96FB9249F74}v72.72.55158\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\14A921B74F157796319B9A1F31F508AB\4B9AAFDE89B10B34595C06019790055B	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\010BDAC06E2033845B50DB188FD59051\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\54E5CE53009F8EA46BCF9EF69B42F947	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96C3BC9BDE56D5443AF583CF2C50C853	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_9.0_x64\Dependents	windowsdesktop-runtime-9.0.18-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_72.72.55185_x64\ = "{B9CB3C69-65ED-445D-A35F-38FCC2058C35}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4B9AAFDE89B10B34595C06019790055B\ProductName = "Microsoft .NET Runtime - 9.0.18 (x64)"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4B9AAFDE89B10B34595C06019790055B\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\dotnet_runtime_72.72.55158_x64	windowsdesktop-runtime-9.0.18-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3693C0A713552476F4E3AD22D8059B9B	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96C3BC9BDE56D5443AF583CF2C50C853\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{b21e7fe8-9175-483b-a67f-0fd948722740}	windowsdesktop-runtime-9.0.18-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\010BDAC06E2033845B50DB188FD59051	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\54E5CE53009F8EA46BCF9EF69B42F947\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\54E5CE53009F8EA46BCF9EF69B42F947\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96C3BC9BDE56D5443AF583CF2C50C853\ProductName = "Microsoft Windows Desktop Runtime - 9.0.18 (x64)"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\010BDAC06E2033845B50DB188FD59051\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\F71950C1A6A51F479A1ED20855BD5918\54E5CE53009F8EA46BCF9EF69B42F947	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96C3BC9BDE56D5443AF583CF2C50C853\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4B9AAFDE89B10B34595C06019790055B\SourceList\Media\1 = ";"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4B9AAFDE89B10B34595C06019790055B\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\010BDAC06E2033845B50DB188FD59051\InstanceType = "0"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
2464	msiexec.exe
2464	msiexec.exe
2464	msiexec.exe
2464	msiexec.exe
2464	msiexec.exe
2464	msiexec.exe
2464	msiexec.exe
2464	msiexec.exe
3924	Xeno.exe
3924	Xeno.exe
3924	Xeno.exe
3924	Xeno.exe
3924	Xeno.exe
3924	Xeno.exe
3064	Xeno.exe
3064	Xeno.exe
3064	Xeno.exe
3064	Xeno.exe
3064	Xeno.exe
3064	Xeno.exe
3064	Xeno.exe
3064	Xeno.exe
4248	msedge.exe
4248	msedge.exe
3064	Xeno.exe
3064	Xeno.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
324	msedge.exe
324	msedge.exe
4956	msedgewebview2.exe
324	msedge.exe
2452	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3936	windowsdesktop-runtime-9.0.18-win-x64.exe
Token: SeIncreaseQuotaPrivilege	3936	windowsdesktop-runtime-9.0.18-win-x64.exe
Token: SeSecurityPrivilege	2464	msiexec.exe
Token: SeCreateTokenPrivilege	3936	windowsdesktop-runtime-9.0.18-win-x64.exe
Token: SeAssignPrimaryTokenPrivilege	3936	windowsdesktop-runtime-9.0.18-win-x64.exe
Token: SeLockMemoryPrivilege	3936	windowsdesktop-runtime-9.0.18-win-x64.exe
Token: SeIncreaseQuotaPrivilege	3936	windowsdesktop-runtime-9.0.18-win-x64.exe
Token: SeMachineAccountPrivilege	3936	windowsdesktop-runtime-9.0.18-win-x64.exe
Token: SeTcbPrivilege	3936	windowsdesktop-runtime-9.0.18-win-x64.exe
Token: SeSecurityPrivilege	3936	windowsdesktop-runtime-9.0.18-win-x64.exe
Token: SeTakeOwnershipPrivilege	3936	windowsdesktop-runtime-9.0.18-win-x64.exe
Token: SeLoadDriverPrivilege	3936	windowsdesktop-runtime-9.0.18-win-x64.exe
Token: SeSystemProfilePrivilege	3936	windowsdesktop-runtime-9.0.18-win-x64.exe
Token: SeSystemtimePrivilege	3936	windowsdesktop-runtime-9.0.18-win-x64.exe
Token: SeProfSingleProcessPrivilege	3936	windowsdesktop-runtime-9.0.18-win-x64.exe
Token: SeIncBasePriorityPrivilege	3936	windowsdesktop-runtime-9.0.18-win-x64.exe
Token: SeCreatePagefilePrivilege	3936	windowsdesktop-runtime-9.0.18-win-x64.exe
Token: SeCreatePermanentPrivilege	3936	windowsdesktop-runtime-9.0.18-win-x64.exe
Token: SeBackupPrivilege	3936	windowsdesktop-runtime-9.0.18-win-x64.exe
Token: SeRestorePrivilege	3936	windowsdesktop-runtime-9.0.18-win-x64.exe
Token: SeShutdownPrivilege	3936	windowsdesktop-runtime-9.0.18-win-x64.exe
Token: SeDebugPrivilege	3936	windowsdesktop-runtime-9.0.18-win-x64.exe
Token: SeAuditPrivilege	3936	windowsdesktop-runtime-9.0.18-win-x64.exe
Token: SeSystemEnvironmentPrivilege	3936	windowsdesktop-runtime-9.0.18-win-x64.exe
Token: SeChangeNotifyPrivilege	3936	windowsdesktop-runtime-9.0.18-win-x64.exe
Token: SeRemoteShutdownPrivilege	3936	windowsdesktop-runtime-9.0.18-win-x64.exe
Token: SeUndockPrivilege	3936	windowsdesktop-runtime-9.0.18-win-x64.exe
Token: SeSyncAgentPrivilege	3936	windowsdesktop-runtime-9.0.18-win-x64.exe
Token: SeEnableDelegationPrivilege	3936	windowsdesktop-runtime-9.0.18-win-x64.exe
Token: SeManageVolumePrivilege	3936	windowsdesktop-runtime-9.0.18-win-x64.exe
Token: SeImpersonatePrivilege	3936	windowsdesktop-runtime-9.0.18-win-x64.exe
Token: SeCreateGlobalPrivilege	3936	windowsdesktop-runtime-9.0.18-win-x64.exe
Token: SeRestorePrivilege	2464	msiexec.exe
Token: SeTakeOwnershipPrivilege	2464	msiexec.exe
Token: SeRestorePrivilege	2464	msiexec.exe
Token: SeTakeOwnershipPrivilege	2464	msiexec.exe
Token: SeRestorePrivilege	2464	msiexec.exe
Token: SeTakeOwnershipPrivilege	2464	msiexec.exe
Token: SeRestorePrivilege	2464	msiexec.exe
Token: SeTakeOwnershipPrivilege	2464	msiexec.exe
Token: SeRestorePrivilege	2464	msiexec.exe
Token: SeTakeOwnershipPrivilege	2464	msiexec.exe
Token: SeRestorePrivilege	2464	msiexec.exe
Token: SeTakeOwnershipPrivilege	2464	msiexec.exe
Token: SeRestorePrivilege	2464	msiexec.exe
Token: SeTakeOwnershipPrivilege	2464	msiexec.exe
Token: SeRestorePrivilege	2464	msiexec.exe
Token: SeTakeOwnershipPrivilege	2464	msiexec.exe
Token: SeRestorePrivilege	2464	msiexec.exe
Token: SeTakeOwnershipPrivilege	2464	msiexec.exe
Token: SeRestorePrivilege	2464	msiexec.exe
Token: SeTakeOwnershipPrivilege	2464	msiexec.exe
Token: SeRestorePrivilege	2464	msiexec.exe
Token: SeTakeOwnershipPrivilege	2464	msiexec.exe
Token: SeRestorePrivilege	2464	msiexec.exe
Token: SeTakeOwnershipPrivilege	2464	msiexec.exe
Token: SeRestorePrivilege	2464	msiexec.exe
Token: SeTakeOwnershipPrivilege	2464	msiexec.exe
Token: SeRestorePrivilege	2464	msiexec.exe
Token: SeTakeOwnershipPrivilege	2464	msiexec.exe
Token: SeRestorePrivilege	2464	msiexec.exe
Token: SeTakeOwnershipPrivilege	2464	msiexec.exe
Token: SeRestorePrivilege	2464	msiexec.exe
Token: SeTakeOwnershipPrivilege	2464	msiexec.exe

Suspicious use of FindShellTrayWindow 18 IoCs

pid	Process
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
1748	windowsdesktop-runtime-9.0.18-win-x64.exe
3844	msedge.exe
324	msedge.exe
324	msedge.exe
3924	Xeno.exe
3064	Xeno.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2068 wrote to memory of 1932	2068	Xeno.exe	112
PID 1932 wrote to memory of 3844	1932	msedge.exe	113
PID 3844 wrote to memory of 1464	3844	msedge.exe	114
PID 3844 wrote to memory of 936	3844	msedge.exe	115
PID 3844 wrote to memory of 2160	3844	msedge.exe	116
PID 3844 wrote to memory of 2160	3844	msedge.exe	116
PID 3844 wrote to memory of 2160	3844	msedge.exe	116
PID 3844 wrote to memory of 1176	3844	msedge.exe	117
PID 3844 wrote to memory of 1176	3844	msedge.exe	117
PID 3844 wrote to memory of 2536	3844	msedge.exe	119
PID 3844 wrote to memory of 2536	3844	msedge.exe	119
PID 3844 wrote to memory of 2536	3844	msedge.exe	119
PID 3844 wrote to memory of 4316	3844	msedge.exe	120
PID 3844 wrote to memory of 4316	3844	msedge.exe	120
PID 3844 wrote to memory of 4316	3844	msedge.exe	120
PID 3844 wrote to memory of 2424	3844	msedge.exe	121
PID 3844 wrote to memory of 2608	3844	msedge.exe	122
PID 3844 wrote to memory of 2424	3844	msedge.exe	121
PID 3844 wrote to memory of 2424	3844	msedge.exe	121
PID 3844 wrote to memory of 2608	3844	msedge.exe	122
PID 3844 wrote to memory of 2608	3844	msedge.exe	122
PID 3844 wrote to memory of 4824	3844	msedge.exe	126
PID 3844 wrote to memory of 4824	3844	msedge.exe	126
PID 3844 wrote to memory of 816	3844	msedge.exe	128
PID 3844 wrote to memory of 816	3844	msedge.exe	128
PID 3844 wrote to memory of 4160	3844	msedge.exe	129
PID 3844 wrote to memory of 4160	3844	msedge.exe	129
PID 3844 wrote to memory of 4160	3844	msedge.exe	129
PID 3844 wrote to memory of 1012	3844	msedge.exe	130
PID 3844 wrote to memory of 4480	3844	msedge.exe	131
PID 3844 wrote to memory of 1012	3844	msedge.exe	130
PID 3844 wrote to memory of 4480	3844	msedge.exe	131
PID 3844 wrote to memory of 1300	3844	msedge.exe	133
PID 3844 wrote to memory of 4080	3844	msedge.exe	134
PID 3844 wrote to memory of 4080	3844	msedge.exe	134
PID 3844 wrote to memory of 5032	3844	msedge.exe	135
PID 3844 wrote to memory of 5032	3844	msedge.exe	135
PID 3844 wrote to memory of 3736	3844	msedge.exe	136
PID 3844 wrote to memory of 3736	3844	msedge.exe	136
PID 3844 wrote to memory of 4556	3844	msedge.exe	137
PID 3844 wrote to memory of 4556	3844	msedge.exe	137
PID 3844 wrote to memory of 4232	3844	msedge.exe	138
PID 3844 wrote to memory of 4232	3844	msedge.exe	138
PID 3844 wrote to memory of 4316	3844	msedge.exe	140
PID 3844 wrote to memory of 5048	3844	msedge.exe	141
PID 3844 wrote to memory of 4316	3844	msedge.exe	140
PID 3844 wrote to memory of 5048	3844	msedge.exe	141
PID 3844 wrote to memory of 5048	3844	msedge.exe	141
PID 3844 wrote to memory of 1684	3844	msedge.exe	143
PID 3844 wrote to memory of 2004	3844	msedge.exe	144
PID 3844 wrote to memory of 3728	3844	msedge.exe	145
PID 2004 wrote to memory of 568	2004	windowsdesktop-runtime-9.0.18-win-x64.exe	146
PID 3728 wrote to memory of 1748	3728	windowsdesktop-runtime-9.0.18-win-x64.exe	147
PID 1748 wrote to memory of 3936	1748	windowsdesktop-runtime-9.0.18-win-x64.exe	148
PID 2240 wrote to memory of 536	2240	windowsdesktop-runtime-9.0.18-win-x64.exe	152
PID 536 wrote to memory of 4536	536	windowsdesktop-runtime-9.0.18-win-x64.exe	153
PID 2464 wrote to memory of 4004	2464	msiexec.exe	154
PID 2464 wrote to memory of 2692	2464	msiexec.exe	156
PID 2464 wrote to memory of 2604	2464	msiexec.exe	158
PID 2464 wrote to memory of 1820	2464	msiexec.exe	161
PID 3924 wrote to memory of 324	3924	Xeno.exe	165
PID 3924 wrote to memory of 4956	3924	Xeno.exe	166
PID 4956 wrote to memory of 4896	4956	msedgewebview2.exe	167
PID 324 wrote to memory of 3192	324	msedge.exe	168

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55\Microsoft.Web.WebView2.Core.dll,#1
1⤵
PID:1128

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3620

C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55\Xeno.exe
"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55\Xeno.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.NETCore.App&framework_version=9.0.0&arch=x64&rid=win-x64&os=win10&gui=true
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.NETCore.App&framework_version=9.0.0&arch=x64&rid=win-x64&os=win10&gui=true
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x244,0x7ffef87cc188,0x7ffef87cc194,0x7ffef87cc1a0
      4⤵
      PID:1464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=1820,i,9637383739757959383,12827376911863408705,524288 --field-trial-handle=1956,i,12663544334774629807,239523417834760597,262144 --variations-seed-version --mojo-platform-channel-handle=2060 /prefetch:3
      4⤵
      Downloads MZ/PE file
      System Time Discovery
      PID:936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1644,i,17191420121138932321,18079115086992630060,262144 --field-trial-handle=1956,i,12663544334774629807,239523417834760597,262144 --variations-seed-version --mojo-platform-channel-handle=1952 /prefetch:2
      4⤵
      PID:2160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=2632,i,1795159206860324214,2299855759745732637,524288 --field-trial-handle=1956,i,12663544334774629807,239523417834760597,262144 --variations-seed-version --mojo-platform-channel-handle=2760 /prefetch:8
      4⤵
      PID:1176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3504,i,13555872028712557987,3982410998586023416,2097152 --field-trial-handle=1956,i,12663544334774629807,239523417834760597,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
      4⤵
      PID:2536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3516,i,9176307865985863976,5006168369855588267,2097152 --field-trial-handle=1956,i,12663544334774629807,239523417834760597,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
      4⤵
      PID:4316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4284,i,431108698765775438,2750224373504601146,2097152 --field-trial-handle=1956,i,12663544334774629807,239523417834760597,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:1
      4⤵
      PID:2424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4300,i,1457081238953583806,17563573551895543437,2097152 --field-trial-handle=1956,i,12663544334774629807,239523417834760597,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:2
      4⤵
      PID:2608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=3700,i,3404310267284901908,17695957196057286334,524288 --field-trial-handle=1956,i,12663544334774629807,239523417834760597,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:8
      4⤵
      PID:4824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=4628,i,1480907509579582854,9384902561728098326,524288 --field-trial-handle=1956,i,12663544334774629807,239523417834760597,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:8
      4⤵
      PID:816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3684,i,9701449527805576193,10254768717945670046,2097152 --field-trial-handle=1956,i,12663544334774629807,239523417834760597,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
      4⤵
      PID:4160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=4636,i,9814802750256475863,7309048547081577816,524288 --field-trial-handle=1956,i,12663544334774629807,239523417834760597,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:8
      4⤵
      PID:1012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=3632,i,11455597399074568713,941012748136737734,524288 --field-trial-handle=1956,i,12663544334774629807,239523417834760597,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:8
      4⤵
      PID:4480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5644,i,9357582357107279418,10637641788057793209,524288 --field-trial-handle=1956,i,12663544334774629807,239523417834760597,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:8
      4⤵
      PID:4868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5644,i,9357582357107279418,10637641788057793209,524288 --field-trial-handle=1956,i,12663544334774629807,239523417834760597,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:8
      4⤵
      PID:1300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6048,i,636594995212918506,13799891122182107817,524288 --field-trial-handle=1956,i,12663544334774629807,239523417834760597,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:8
      4⤵
      PID:4080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5760,i,6401483436627691056,18301565027090812742,524288 --field-trial-handle=1956,i,12663544334774629807,239523417834760597,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:8
      4⤵
      PID:5032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6652,i,10695594467676007324,13524061246700195889,524288 --field-trial-handle=1956,i,12663544334774629807,239523417834760597,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:8
      4⤵
      PID:3736
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6180,i,18160977528220706630,4344683048294768713,524288 --field-trial-handle=1956,i,12663544334774629807,239523417834760597,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:8
      4⤵
      PID:4556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6192,i,16351088868695744737,10212576197688959997,524288 --field-trial-handle=1956,i,12663544334774629807,239523417834760597,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:8
      4⤵
      PID:4232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6240,i,12581044896650721420,3244159229899704635,524288 --field-trial-handle=1956,i,12663544334774629807,239523417834760597,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:8
      4⤵
      PID:4316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6780,i,7569695867183360955,15950268947387892497,2097152 --field-trial-handle=1956,i,12663544334774629807,239523417834760597,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:1
      4⤵
      PID:5048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6340,i,7449301570672641257,5892104992261076639,524288 --field-trial-handle=1956,i,12663544334774629807,239523417834760597,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:8
      4⤵
      PID:1684
  - - C:\Users\Admin\Downloads\windowsdesktop-runtime-9.0.18-win-x64.exe
      "C:\Users\Admin\Downloads\windowsdesktop-runtime-9.0.18-win-x64.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2004
    - - C:\Windows\Temp\{F75CDD35-6B08-4D7D-9D4D-5CF679BC0659}\.cr\windowsdesktop-runtime-9.0.18-win-x64.exe
        
        "C:\Windows\Temp\{F75CDD35-6B08-4D7D-9D4D-5CF679BC0659}\.cr\windowsdesktop-runtime-9.0.18-win-x64.exe" -burn.clean.room="C:\Users\Admin\Downloads\windowsdesktop-runtime-9.0.18-win-x64.exe" -burn.filehandle.attached=660 -burn.filehandle.self=688
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:568
  - - C:\Users\Admin\Downloads\windowsdesktop-runtime-9.0.18-win-x64.exe
      "C:\Users\Admin\Downloads\windowsdesktop-runtime-9.0.18-win-x64.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3728
    - - C:\Windows\Temp\{BFD7A2CC-5B10-46ED-B9BD-1E1EE0CD96C4}\.cr\windowsdesktop-runtime-9.0.18-win-x64.exe
        
        "C:\Windows\Temp\{BFD7A2CC-5B10-46ED-B9BD-1E1EE0CD96C4}\.cr\windowsdesktop-runtime-9.0.18-win-x64.exe" -burn.clean.room="C:\Users\Admin\Downloads\windowsdesktop-runtime-9.0.18-win-x64.exe" -burn.filehandle.attached=688 -burn.filehandle.self=692
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:1748
      - C:\Windows\Temp\{DAE78D96-0A0C-4685-B297-0276B6D3014A}\.be\windowsdesktop-runtime-9.0.18-win-x64.exe
        
        "C:\Windows\Temp\{DAE78D96-0A0C-4685-B297-0276B6D3014A}\.be\windowsdesktop-runtime-9.0.18-win-x64.exe" -q -burn.elevated BurnPipe.{86956D98-A8BF-45F9-B4A3-5D68E7FC168B} {0C775120-26CB-4A92-920F-0E2D90AEC58E} 1748
        6⤵
        Adds Run key to start application
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:3936

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1896

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2464
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 1FB7CA30829BAB94046B9346E503D55C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4004
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 41C5C1772C582CCEAC2A4DFE0F8BD657
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2692
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding D1697E81B0594E4E4186D4A9DC20C4AD
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2604
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding DE991F8D1EC287974CF26CDCBB395701
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1820

C:\ProgramData\Package Cache\{b21e7fe8-9175-483b-a67f-0fd948722740}\windowsdesktop-runtime-9.0.18-win-x64.exe
"C:\ProgramData\Package Cache\{b21e7fe8-9175-483b-a67f-0fd948722740}\windowsdesktop-runtime-9.0.18-win-x64.exe" /burn.runonce
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2240
- C:\ProgramData\Package Cache\{b21e7fe8-9175-483b-a67f-0fd948722740}\windowsdesktop-runtime-9.0.18-win-x64.exe
  "C:\ProgramData\Package Cache\{b21e7fe8-9175-483b-a67f-0fd948722740}\windowsdesktop-runtime-9.0.18-win-x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_9.0.18_(x64)_20260724190520.log"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:536
- - C:\ProgramData\Package Cache\{b21e7fe8-9175-483b-a67f-0fd948722740}\windowsdesktop-runtime-9.0.18-win-x64.exe
    "C:\ProgramData\Package Cache\{b21e7fe8-9175-483b-a67f-0fd948722740}\windowsdesktop-runtime-9.0.18-win-x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{b21e7fe8-9175-483b-a67f-0fd948722740}\windowsdesktop-runtime-9.0.18-win-x64.exe" -burn.filehandle.attached=520 -burn.filehandle.self=540 /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_9.0.18_(x64)_20260724190520.log"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:4536

C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55\Xeno.exe
"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55\Xeno.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/xe-no
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c0,0x2c8,0x2cc,0x2c4,0x35c,0x7ffef87cc188,0x7ffef87cc194,0x7ffef87cc1a0
    3⤵
    PID:3192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1748,i,16395218326920043636,12913982165917947483,524288 --field-trial-handle=2244,i,13946605215037642102,15011696511006176234,262144 --variations-seed-version --mojo-platform-channel-handle=2616 /prefetch:3
    3⤵
    - System Time Discovery
    PID:4160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1616,i,7069855537254111224,3180860581611254346,262144 --field-trial-handle=2244,i,13946605215037642102,15011696511006176234,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:2
    3⤵
    PID:1920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,17754266967975751833,12046042192310517316,524288 --field-trial-handle=2244,i,13946605215037642102,15011696511006176234,262144 --variations-seed-version --mojo-platform-channel-handle=2624 /prefetch:8
    3⤵
    PID:3064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3396,i,6190141151383932081,12385215920364321682,2097152 --field-trial-handle=2244,i,13946605215037642102,15011696511006176234,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:1
    3⤵
    PID:5068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3404,i,11640761824058983542,12455261331835578480,2097152 --field-trial-handle=2244,i,13946605215037642102,15011696511006176234,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:1
    3⤵
    PID:1344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4784,i,1907229326378485921,6848882108440997760,2097152 --field-trial-handle=2244,i,13946605215037642102,15011696511006176234,262144 --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:1
    3⤵
    PID:1604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    PID:4248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ffef87cc188,0x7ffef87cc194,0x7ffef87cc1a0
      4⤵
      PID:2052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1836,i,13979898601548458179,728473486712608459,524288 --field-trial-handle=2280,i,4223730365438684860,13469384811196958510,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:3
      4⤵
      System Time Discovery
      PID:2324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1672,i,17649528622084858916,14678267907363776982,262144 --field-trial-handle=2280,i,4223730365438684860,13469384811196958510,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:2
      4⤵
      PID:2580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2604,i,5040863678384805824,10665153969793233121,524288 --field-trial-handle=2280,i,4223730365438684860,13469384811196958510,262144 --variations-seed-version --mojo-platform-channel-handle=2624 /prefetch:8
      4⤵
      PID:380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4492,i,10409407205949900130,1744493159309743081,524288 --field-trial-handle=2280,i,4223730365438684860,13469384811196958510,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:8
      4⤵
      PID:488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4492,i,10409407205949900130,1744493159309743081,524288 --field-trial-handle=2280,i,4223730365438684860,13469384811196958510,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:8
      4⤵
      PID:4696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4760,i,15613851080151747145,17052357710701287920,524288 --field-trial-handle=2280,i,4223730365438684860,13469384811196958510,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:8
      4⤵
      PID:3812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4756,i,12567738240335296149,15104858123034911917,524288 --field-trial-handle=2280,i,4223730365438684860,13469384811196958510,262144 --variations-seed-version --mojo-platform-channel-handle=4720 /prefetch:8
      4⤵
      PID:4420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4764,i,6188990979576585094,8065136532647808185,524288 --field-trial-handle=2280,i,4223730365438684860,13469384811196958510,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:8
      4⤵
      PID:1952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4860,i,17322816655422097831,13139732781548256508,524288 --field-trial-handle=2280,i,4223730365438684860,13469384811196958510,262144 --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:8
      4⤵
      PID:2136
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Xeno.exe --webview-exe-version=1.3.55+87ae4f96f8a0927052c1120167982fb069afd1b4 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --mojo-named-platform-channel-pipe=3924.4612.5381151533211118197
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4956
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ffeec79b078,0x7ffeec79b084,0x7ffeec79b090
    3⤵
    PID:4896
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView" --webview-exe-name=Xeno.exe --webview-exe-version=1.3.55+87ae4f96f8a0927052c1120167982fb069afd1b4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1736,i,4267030573132910883,4133724876813530180,262144 --variations-seed-version --mojo-platform-channel-handle=1704 /prefetch:2
    3⤵
    PID:708
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView" --webview-exe-name=Xeno.exe --webview-exe-version=1.3.55+87ae4f96f8a0927052c1120167982fb069afd1b4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=1904,i,4267030573132910883,4133724876813530180,262144 --variations-seed-version --mojo-platform-channel-handle=2028 /prefetch:3
    3⤵
    PID:4724
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView" --webview-exe-name=Xeno.exe --webview-exe-version=1.3.55+87ae4f96f8a0927052c1120167982fb069afd1b4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=1336,i,4267030573132910883,4133724876813530180,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:8
    3⤵
    PID:1828
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView" --webview-exe-name=Xeno.exe --webview-exe-version=1.3.55+87ae4f96f8a0927052c1120167982fb069afd1b4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3488,i,4267030573132910883,4133724876813530180,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
    3⤵
    PID:2024
- C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55\Xeno.exe
  "C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55\Xeno.exe" -useconsole
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  PID:3064
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Xeno.exe --webview-exe-version=1.3.55+87ae4f96f8a0927052c1120167982fb069afd1b4 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --mojo-named-platform-channel-pipe=3064.4216.300666615504278460
    3⤵
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    PID:2452
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x164,0x168,0x16c,0x140,0xe8,0x7ffeec79b078,0x7ffeec79b084,0x7ffeec79b090
      4⤵
      PID:3248
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView" --webview-exe-name=Xeno.exe --webview-exe-version=1.3.55+87ae4f96f8a0927052c1120167982fb069afd1b4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1900,i,1652986790566369463,10467264759601412346,262144 --variations-seed-version --mojo-platform-channel-handle=1896 /prefetch:2
      4⤵
      PID:4312
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView" --webview-exe-name=Xeno.exe --webview-exe-version=1.3.55+87ae4f96f8a0927052c1120167982fb069afd1b4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=1872,i,1652986790566369463,10467264759601412346,262144 --variations-seed-version --mojo-platform-channel-handle=2064 /prefetch:3
      4⤵
      PID:2480
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView" --webview-exe-name=Xeno.exe --webview-exe-version=1.3.55+87ae4f96f8a0927052c1120167982fb069afd1b4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2276,i,1652986790566369463,10467264759601412346,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:8
      4⤵
      PID:4200
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView" --webview-exe-name=Xeno.exe --webview-exe-version=1.3.55+87ae4f96f8a0927052c1120167982fb069afd1b4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3492,i,1652986790566369463,10467264759601412346,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
      4⤵
      PID:3136

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4008

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4880

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3720

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5fe49f.rbs

Path C:\Config.Msi\e5fe49f.rbs
Size 48KB
SHA256 2f4a0710fcd159dd6e44d709bda11868e7363531a870eab4c8da095655253b9a
MD5 482ecc2c138d349d5956a10dcb3e1f13
SHA1 4ab6c4471d19ab34d42213bfd6a874b17d0c5f3c
SHA512 e41bcd5cab154201d40e0624c70fb483c455b057838bf8b2493a5e7cef063b18d554a52a3abe7be6aaeebeffd16f41f02dd82605be2afa90c7a109f8e0c7ec2c
SSDEEP 1536:GlV+cORT3I/4tktvfftgMQ4dskJhTaOTagmDxjHxW9nXzYnj2NE43H+lPSc6ScTB:tD4
TLSH
T12A230F94DF00C4D2F233BBB6A374E90437588EA93F14944D67CED145C79AE89EAF9182
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5fe4a4.rbs

Path C:\Config.Msi\e5fe4a4.rbs
Size 9KB
SHA256 70eff6db39b8bc464cfcd87fac15802d77e388801f409f8418ca4f7c66cb5676
MD5 4c5521e2270e3754941247de673201b8
SHA1 bf6df5abeb9c4e2ed44b24d2eeca30e00cbda8fc
SHA512 cb2c2b7559c3f883d74c4016717a6e3cdfe7b62b39c6da1fed57ddec4cdcad41db8a29e1bf804d015b4131cf0d8a01cfbbf8e031fc1700c4d624893eb028c84b
SSDEEP 96:+m7Du5DSiS5XrLDCCeCUvuUteD2mon8CsTl7UteD2mon8C6jCFS2YD+TlGYDQVEU:3WMiS7ZebBIonTIeIonTjKEJWdhLvpF
TLSH
T1C11222097A1186F3E8561F35C747272437BBD3CAE700A24B06EF91289F9774C0AA859E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5fe4a9.rbs

Path C:\Config.Msi\e5fe4a9.rbs
Size 10KB
SHA256 4a9b76fc355d23d2b37075d34c04548ae65158ff2bc161a47c15c5e8e33b53e1
MD5 638b1c22601a7f0e6eb88555d28dc427
SHA1 e3279a2853b1a99ab66659d22fd7a3b61f15a816
SHA512 0f961b95463844409a541654dd8f91627c5d45ab553fe89fa3e913b508ff18a71d5a9e9cc330fea153f4c0cfa1cfe46f3dcab931629c64cf9607f6c15bb53c19
SSDEEP 192:UmuIxFX5Hhbw/e33vB8nonTIJ8nonT8yCEoV99vpO:UmuIxFX5Hxd358nonC8nonYPK
TLSH
T18F223101AA09C5D3D9921B70C3432BB137F3D3AE8704574F25DDB2706F8B7885AB929A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5fe4b0.rbs

Path C:\Config.Msi\e5fe4b0.rbs
Size 88KB
SHA256 8db1ba2bd01ce66a5a438dc85644ac354015008e56a66a9c7d1e56aee2bd1d38
MD5 eebd8ef03e5bd3cb3a43f2465320f908
SHA1 292920af5a9f003666186c792bb8b9c0adfa010c
SHA512 0ee995f00a62198f66546542cedc447da19a34091fbb647feb8e5d3697f3189035a2312acd1bc7e1f1c98d83c6fbbf20a0cb8dcd64f97a065cf32bb233530e5b
SSDEEP 1536:5k1eK8ItgdYnfGxhM4lEiJVLFnnzcp2X/60ir+XUfxLCekwFp8NFpSoBjMQRTsSN:NwpIs/3StbIAjKy7XxBss
TLSH
T1DD93E1B96710C186DD333A8883BBEA09AE015DAF53499E7A1BC5013AD9D3E971F7C4D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ThirdPartyNotices.txt

Path C:\Program Files\dotnet\ThirdPartyNotices.txt
Size 77KB
SHA256 e8ddd95ac905467e4e519b446ca023fa00c31732bebd9b66e65101c712092ee7
MD5 406d07d20e58568365df0557629fadc6
SHA1 9ab5ba1ef3866afa75b8cf3c392b7dd3d7f52026
SHA512 c6025a947faa5dc2b41a14d75e228ca2bd0df094e8cef914c58a6d2f5854424972a647b2c8ca8173345e40ba7557843d03efa85c5098c6e0e6726377efc8a38f
SSDEEP 1536:HA9jHwsGfgg39/zwgAVkguQxrDjugtSEGepkWvrpX7anuqdLSVnfiStPq+3Lefrb:HA97w/ogz1AVxuMjHtSFULryLOgrGWwa
TLSH
T1F573A45F7E45077319E2C3916569A8C5F22FA02E3B6B2A44346EF248133B42DD6FF858
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hostfxr.dll

Path C:\Program Files\dotnet\host\fxr\9.0.18\hostfxr.dll
Size 365KB
SHA256 729a16b9e4a5f4c9d0bb1740e07320c84da798ba37dbfb05d8888644bc3e12d1
MD5 6a3550b19e58a36f177bcecf75ee6226
SHA1 5869545dda759fde6f10f70d9d7d854a75c2be72
SHA512 7de9271a2500ff9c34160b49e94ea68bff5de648a600e6ba89fca17c8329327007a5e0afec6769f4228fcdd6164c3251588d84eff2744a365c53290a55701508
SSDEEP 6144:Y4ipHMZyxuvYXbhnpuVuogUK7BXrGyc/PuCrG3OxeP2TqDoTTNdcwv3zmjzsXiXU:26ObRTBXrjjCqeSw7cLXU
TLSH
T13D842916D7E8047DF0B79678C9B28901EB727C894B74D6DF139089A61E73BD09E39322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

state.rsm

Path C:\ProgramData\Package Cache\{b21e7fe8-9175-483b-a67f-0fd948722740}\state.rsm
Size 932B
SHA256 a8482ac4edbea2ffb94b21e511532326e8f176c080d52cb758ffcb6a8b8d965f
MD5 67f41a663f9a5a337f452d82bcfe4784
SHA1 1d9ae5f9e7460a56e77a28069f5112e44e2b2c72
SHA512 057db331df4c3ae137feb160ab6095d55b85e58a0c9eb631338be6e8dbac09fe2d38a12255fcea7bffba20773d1f9f5d6d9af98c2a80c984ef80eb6b20bea6ca
TLSH
T1CD119A515FFA0129E3FA6B30A9F92711643AB8120D32C16C0101318A8E32BA0C870F77
MD5 SHA1 SHA512 TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 deae8ba3a07225fe9f1490e4968fd83f8d308707a88a6d3d541d8ab416841ddf
MD5 1fcf11901014bf515178c91bdb7a6c5c
SHA1 4746b018067d9671617515224b7697b27fd2fc5f
SHA512 6059830103275d34e1aa4dd4e8d4177b6c2b684b2b3ad5417753387a227c838c0b258e662c78853cf649656ebd762f5d160c10349cd19ac1953380bd6572c660
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7p:fwUQC5VwBIiElEd2K57P7p
TLSH
T16EB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 102a1da8e9fb7c5abf83825e61e33a8d6015cfab929bde1d3e5e82a51c7986f7
MD5 28e9f525a82d1f430e2bd38adf9ad321
SHA1 3e7a5269d8d1f195a23eb27b87645232c6a1b278
SHA512 76922b0acb7e28a44a8f852bf13f02b4dc527bebdb03cb27fd61a251cfa84d69d3c6a4fe4380fce53f455e691b0ac47afc25314d7509e969e312605a421f4c43
TLSH
T12AD0A7707A756441C70B5030B401D691339A82B4248ED66251A5501D6DA508592DF186
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8b48e8cf5551b0d5034c801f10f6bea33052a69f8e6511e787ec73bd23dcd5dd
MD5 5295bedf8f2b1ce1b962f391f8e80e89
SHA1 bffdcb89cbaedef4f7f950448051440690904936
SHA512 26f76e9c996e832daf3744148d9e4851652148316990c0798ad0db76d4c5c95b7892dc50c0c300f5cb11848d5a46ddbf9ec17e686e2dc1e5ecd87985d55f6e49
TLSH
T1FCD0A7707A756441C70B5030B811D691339A82B4248ED66251A5501D6DA508592DF186
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cd640af4b18734f838b65cd3f2b65e25dc669e7cc487a16f826240b353446af4
MD5 337b94f0014654439210355bd20e82dd
SHA1 26e4c8276331781253e2a807dd554b2ee3ad7e8e
SHA512 087107a51c83ccffad34c7d3f5423a0f231d30a9f78e9ed5db98eb770bada291f65c7b34d1e72284571b846a7acdf88b217ef4da25b7acff47964af1551b2e9b
TLSH
T1B6D012323B197041E71A8130E403C74017AE54B524864606A254C50D6DA90C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85f865adbe5e58c0596a4db9b9daa509b8e2bd087dbcc9a01a5a095a266757bc
MD5 29ddc94c4e214fd03f664130dd36edfe
SHA1 10dfd57508ad6ef16445956dc1ee4d8c2bffc4e3
SHA512 fa7477f3f8068f41dae4965a930de8ad11b234c1ccfcd17a84fb2bfe4c289beebc19be8d058f75ed01b6dbe7304af8270da91d31316fc94360f4fa750ab203bd
TLSH
T13AD012323B597441E71A8130E403C74017AE54B524868706A254C50D6DAA0C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 03c9714ceda41208919b91db8014de24ae37606ed2abc96a2531b3653937df48
MD5 8c2296de8b61220530f453b2f30415dd
SHA1 2c66c88bc6a0f8267af3c1881fe9195ca1582177
SHA512 c741a1ee72d19a8af3a3823ca6df21b2e3afeeede73da7c80eb421ce9f7370fb162d00a8565078ba3856a8ccf78493a4b12f92955afe287b59ec5f2dc6911402
TLSH
T1E7D023307A3671C0C21E0030E4110B40236E40B230CF43476194440DADB40C1D2DFEC7
MD5 SHA1 SHA512 TLSH

Submit Download

55fd8c35-a8e4-4e21-b9ea-72ebcf299425.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\55fd8c35-a8e4-4e21-b9ea-72ebcf299425.tmp
Size 414B
SHA256 9edef1bd943e207976bfed979277b974ae04aa3ab22a8d063889e53eea728647
MD5 9fd051b8d01325282ce6ad35b8f3b703
SHA1 f227c0d1019b82cf462c8cc81b8e0791c03e8441
SHA512 0f97b98374c0809b69404bae23cb76b05e75a4da0fba203761ac4087d9839fe19dbf6d4ae2cb888f5dac2c581b6a70a4303e03aa7bffb1cf0b31d2d6ca22bd2d
TLSH
T173E02BA9C825AC3B48FD471DE0550786F65203673BC0894F3B3DC5094FB063E0646C1C
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 262e9055c130b3e2689b050ff01e99c7f1c8fb9ed85eac1993588f293d27cc79
MD5 966cf7988d1456463e6f330d7b8a4301
SHA1 43a48e9ac098345fd4d97c8653c1ec41e95973e7
SHA512 7cd817556b538c4e24782bdfb74c007e8f7195506b19bbd295e4cb65a0a4a63b61a999ec38fea08bb47191c5997abec807c91aec32fa3bd88a70425469a4fb80
TLSH
T1E1814E38C54D5561E7D1533244E11193B83D82CBF807FE4541A0BB7797E2B138AADD47
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5fe131.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5fe131.TMP
Size 3KB
SHA256 ae4a70f5799a6c0571f7606b13b32792384ec07aaec745b116f7dd4be69762d6
MD5 e7b9d58c305f07bb45ef510f7c835873
SHA1 61bb28763d55cf2df61b722b89d0380b3a4d4467
SHA512 72ddba9a9827769099f459956e1c21008ce35f9ccac8466821ff3afdac7e2cca1a2c785aa0cf15ec0115e400f40099e4a1c9c8157789544ccd71ae8737279a2a
TLSH
T1B4713A39C50E48A5E7D1133291E10157B87D82CBF803FE8552A0BBB717E4713868EC87
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9e529d43-be8c-471e-8e4d-947a515ce83e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\9e529d43-be8c-471e-8e4d-947a515ce83e.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 7b5c357a94480eec215bd214f01d9b86dd20922347f126be09efc13d84a4f7d1
MD5 3fb8ab140253cdcb57e7e6bec5d6adb5
SHA1 7208a4fb433aa1823b156b2966ead07602eefe3b
SHA512 949822ec0bb4b8442a880cb1dc317b7ef912879e538cfa4b921453c163de7120f161ddfa9ae3046391cc7f7db58e4224019c285808b2d0d6810f242ce8cc1254
TLSH
T17861BEF787B4856ECA0195F0AA18AE2FCF2D0515431C7C6A89D4EE27D7E3472E10165F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 6ff7edb887bde162132c208d1d649e9ce06be0400141d431abde665f40377ee1
MD5 4dfec4d5006f01bc0f8e02b8e53fe1cc
SHA1 1102ea69ccba23d2ad466d9a5ffdcb914220215f
SHA512 e96c7fa86ca08e6ffc9b8a184836838f1dd1d12dde8919410c6caa44c54f068af11a6ad4a193019a7c5bd27f8bfaf060a2fe8621c06954aaa7132e10c3432173
TLSH
T18251CFF783B4856E8A0195F0AA18AE2FDF2D0515431C3C6A89D4EE27D7E3472E10165F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 b9bc96d5048948b27823dd0d2a647a6511f1aeceab4c97089b2202bfe832174a
MD5 65864a9d992ccd0b0d458ea5f54e27cf
SHA1 94ba794a8c84e861580d39ae47eb1ec27ebae8b5
SHA512 1ee20b2eac194245cfdf3f46f02e2dc8aee271e72d9359c992761c8fe87f48ff2fa3b692dca3cd35970b1c9f9993a574cc001e690d8296268090c8c42b530b27
TLSH
T1FA61BDF787B4896ECA0196F0AA18AE2FCF2D0515431C7C6A89D4EE27D7E3472E10165F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 dcb81772293800fa55d021396b336be859b98e63be4d07a324bf4944560b4d28
MD5 96f94a0d3fe9b444950462ff1f0ff283
SHA1 5d4dcfcdbb7dc7830366d864b9086c2b04bcbab1
SHA512 d905f88b9b167167095caa39d473a422600727725c264d4ef781238abf0d9b9bc2a812fafd7d6224e2f34c79dbfed509e8499cbce2a0b9d142817dd716d8234e
TLSH
T121217963C57EB47B103D0A7F0D487845AA77A8314172D8F8EA5E922CF081DF34722426
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 b6c1dc91cf68d9f490efe217a4a626cf4b31bdaba3252fcee8da832cae7c4ad8
MD5 57bc54462edd263a7e6b77fc9674b2e6
SHA1 34b5dea2ec5202bdfcdb6fc037beea350295ae79
SHA512 f64624f523b767d9b2232731ea6bcc9e1dc401253fdebbe97c8b7216474c231cc7a8aecce67cc4af35fa57368245fb89e4b0faeab168f1e5234bddbc23a5b746
SSDEEP 192:sxZHtR/yM/jK1Ml8Mz+/fiswe1EwQ0fIdpwPHW6+WNreU/AuRzbK1JRKIg4J:sxZHtvL+/fiswQlC2HbZ/Tp4Kc
TLSH
T12C52D816AA349977CCDBD209FA45BB53D6F54463D2901E44AAFCCA0C04E6BED230782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 915231306e29f8d240865318f7e77e88438c464656d3c406c5bf967c21eed735
MD5 3a4455e8a95e372ab6d3e60a86f281d4
SHA1 8a93088c0931c765daf3f8331b714e1a8d53d104
SHA512 1a9651684999ae663af3d2d38dbf419ca3e26b6ee53f9fefbbcacd0f7ca559119c92a7ec018b17a0eb041bdfbb40446262db1875d68df78e526e3f66e3678e1a
SSDEEP 192:sxZHtR/yM/jK1hl8km+/fisfWpVmejEwQmCHfzodpEKPHW6+WNnwLuTh2eU/AuRU:sxZHtww+/fisfWvmglFjfHbwkY/ThK7
TLSH
T1DD72C706A534597BCCDBD219FA45BB63D6F91463D2905E44A9FCCA0C05E6BED230382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 597e3b83382118e0024fd7fc79dd8bc004dfd5754e9c60bcdcd2adfb78a27a7a
MD5 9fcc8698165f8734996fdd49b7740f9b
SHA1 e3da951e3b5c290b8d37de51cfa141ae171d9aaf
SHA512 b65926b85b5841a79aacd9d8f6e5b2312c4680814d5d27bc988e3cd538fa3ce55fdf38d83dd4792d492a3d7d8e432338de68d41fb5bac684d9ef849f4a1c987f
SSDEEP 192:sxZHtR/yM/jK1Ml8vm+/fisiWpVae1EwQlfIdpwPHW6+WNZ0eU/AuRTlKsnPKIg7:sxZHtvX+/fisiWvaQlb2HbM/TnHK7
TLSH
T1D162C816AA34597BCCDBD219FA45BB53D6F90463D2905E44A9FCCA1C04E6BED230382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 6e4615e5ad02697a4ce0bec7043378cabb0adf90583c78702306fddc91d52b47
MD5 ce8af634e51c90f479a3aec8148862fc
SHA1 bf6071f2a75b5dc17bbeed12d7dbf10b216bb3e2
SHA512 8c0d22036f7e1f15cb3de730c43dfae2b1a6b15c4629ce726ffa815417efd3564cfcb3eb33e33bf7c12594c795908551e1614ff9e4ac28aafa1d939f43ceca44
SSDEEP 768:j2W7k6o7pLuLf80Wvqida8F1+UoAYDCx9Tuqh0VfUC9xbog/OVeya5LlWYSj4ros:j2W7k6UEf80Wvqidau1jaXya5LA3jDaR
TLSH
T122F2FA3B680CCB7E4F804E9CED2A7E9A6DE801CB96D8C95447FA844C03C66EB15165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 95287e822748b91019f40895d30dd5e2814121463987d328a6ee0e6476252647
MD5 f10c14ebf35b10adbd81d7d4793ebabe
SHA1 125c586b7ca34fe9922fbe1f035eccbe48c5e815
SHA512 c6e90ec595606325d25fd629514cd09407b69515a0456447dad8b186ca32396854878ad0069075aeda7e5c4afbf6594c9d359e64458d4a165220d326ad1a5618
SSDEEP 768:jAc7k6o7pLuLfq0WvqiRa8F1+UoAYDCx9Tuqh0VfUC9xbog/OVeyw5LlWYSn4rof:jAc7k6UEfq0WvqiRau1jaXyw5LA3nD3v
TLSH
T192F2FB3B780CCB7E4F800E9CED2A7E9A6DE801CB96D8C95487FA444C03C66EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 ec49025ca0aad66a22f499a2d6a112329f9c031d486f839a32be058d2a250236
MD5 38b2751598ec566499a38a638c528800
SHA1 16f3b2b3073f4d48ff316c645204d6a878a93f29
SHA512 5822859ce1272cebf3c91690b02c4f7f955ea8d10271ef5c133013ac71e00d7234d3abb469230506527e31e79403274c8ff1d7dab9cf5e2cbe2c7385150d5b56
SSDEEP 48:KfSVOyIQA2aQL9IZy2KYTWVce7I1KcEI7y1BItKC4AGBIlKSooHyD:KIbCKcWVce7KKcE2WBiKC45B2KSoag
TLSH
T141A1921AB23616013C3D6D5CA56B86779F8372A3310464AF3FB844A60E6AE124DFC9DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

51cdf500-500d-4519-9487-ca57bd4a5617.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\51cdf500-500d-4519-9487-ca57bd4a5617.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 01eaea04b95e74d032959ce57b0b0b88e36e3cc6be6d3c13c88acb8672790be0
MD5 76e29c554cd1000ea48a53c19471902b
SHA1 2f09925f175827bf677009c1fc85502f1a0f9f46
SHA512 77847b5047915d510bd41d373abb79fc003bf1169e7749cf3aa1edd752a1b9b78b6deb403b01728fd34843f0470bdb76c93c515b6ce11510c6172fe95f74b106
SSDEEP 192:MONT64BAQmiUyy1NW5GBPKRV+FdGy5LaDFvPSU6:MONT6eAxzWcd56dSU6
TLSH
T12A0209396C786C6B9EB2AE45F48637175FA8117BE6806B44EAE85F0C00D764C2303827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5f23c46137dde7699d7541b6df8fee104e454a4988755b57819c5536e4c9454e
MD5 ceedb85116fe04c32591173999b92101
SHA1 70805034da3c7a1f99fac2bd30f405db4d18b579
SHA512 9d49441cd8b0edaca3cde7763a70f8fedb7d1490efd1b764ffa039599742a64d377ea845c89e871b919e8f3b600b28fdba12c8a7eacbe8ea576ea12566796d71
SSDEEP 192:PONm64BEQmiUyoNR5GBPKRV+FdGy5gk+2kWwDqVU6:PONm6eU/Rcd5L+26WU6
TLSH
T1A5122B36AC74AC2B5EA27155F08736035EA5426BEBC46B94E6EC6F1C01EF79C2307816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 a9c15f1f5696e406b8e5afee8dc51c8efdf42f935226a5d610564a6f56494680
MD5 a43e67284fe31c63daa5f8278d56f10d
SHA1 f60aaf09426b83e15791c0d4fa8716b265156a73
SHA512 b89be5385cf0783ac9d1127f4792bd7859eb94254f27d20aaa1f2c21cd45f8a4b48e9b472ec956caa05dc66f2e6d6d38155881ed73492e5f97262779f818dcd7
SSDEEP 384:n/ZcIj3sNpG+MboLDzd5L+2zEXOObjI9G6w7gHA/7Izt:Xj3gMyvrlzEX29MU
TLSH
T1AFA28C356C349D7759A7A106F29A2B036FF960BBD6C85F88E1FDDF0E04426AC270B416
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 48KB
SHA256 9300fbf45a79407a12427fb67e0807e17ff9497a79b0ef394a9120acf975dfe3
MD5 ace3eef41d65dc36204edd8e1c01ee6b
SHA1 00a84e6234f66d5a346fa2a9bd27d83958790562
SHA512 31d43ffd51689bfd684064a8ad257f3cca5b9f91f87c3aabb6ce773807b59c379178d28d4b25147de167f0d0cd7506d0e470809dd6cec63fa7428460c3bfa18b
SSDEEP 768:EF7j3Twg/MXVo++fq2LpszLe20rbY8I3nZr84dcd+wBKu5xMP2I79MU:Qj3D6B0Y8UnZr84dccr6xe2I7+U
TLSH
T1312338F598D789BBD8AE9383A77D6E0259FCC063B1985888B7E85D0DDC465BFC306804
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 05745cdea024e01a46dd59b60ae94abfadb25e05a68c0f842255923fc0bfcee1
MD5 519f064072941105978a81ed580ea9d0
SHA1 a2e420c76cbc94219e5c6bf181164ff45ad5d005
SHA512 8aae8d48e1c0ffed60b8192b5a3ecb680f3598fc2e121f3a1505015281a8b9268d05871cee10a36c55b1339dc5ac649a66281657338912e11115ff8a55775d9d
SSDEEP 384:nLZcIhsNb3+Mb7wDzd5L+2xWOObjI9G6w7N:ThzMIvrlxW29MN
TLSH
T187929F325C345D3B99B3B111F0863A035FF9917BD7D86B88A1EDEF0C05AA6AC1316816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 8e9409c9109fc0ca020ab7986869cf7f08d4ecd6f363582c2749478d3299734e
MD5 6018e42e8feb29ead4b0c07a3e7ed728
SHA1 b7885de16854742b1e407b56dfcd9752ee9646e0
SHA512 078a11a36fbf5dde0bda371fbd6220c5f7a2b76b5d1ee141203e9391bbaec3629c87a84939f8b6cdad9eaf3973fcd54b58e243dcf0a63e4563d3f16d91f5e97a
SSDEEP 384:nrZcIssNbz+MbbODzd5L+2833vKASB5a/srk97kcrKOObjI9G6w7N:zsnMuvrl8PtS3rk9VrK29MN
TLSH
T1D0C26C71D8644DEB44A2E1C5A189F5062EF8423BC69C9A4CF2FDFB3D316F9B85322815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 dd69282611d68e82abef6418c497e24d78eb7452515a272bfa216b67995aa6ce
MD5 525797771354ca09dba8993731a3abff
SHA1 b797165b7cd16205c9a39b2f69a57e19cbffbc87
SHA512 9e9b9604c2bdb85fe0918bc52f6493bf24836016b5bdff7afd2e7f6bf271eb2e7a19ebd34d33a3580f9f164d2dff3e39e097859d9258d32cb620856a6b7a8f84
SSDEEP 384:nfZcIj3sN1z+MboKDzd5L+2tYHA8pNomY7A5idMBiOObjI9G6w7gHA/7Izt:3j3dMDvrltx8QmqA5iMBi29MU
TLSH
T187C26C70E8645DE745A2E9C5A649FA073EF8113BC698594CE6FCFB3E301F9B81312426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 5e12567135d1c32e2d8ae721d3bc892b988e99dd35dadcd8cc975ef805c42cbb
MD5 3804aabfe8c3c9ed64590e2ab7f6c7c2
SHA1 2b30e2cca08593898b63c79b8a32881a6fc1a942
SHA512 0936a98bcf6c6fdc623552a26495168f0b977d73d50990eac6c3dc7e2c3bd6820851034e12b65bfba4a3b7bc68b5e2dedaae801042a313c338fcfe0214f8ed86
SSDEEP 384:nVZcIj3sNEG+MboLDzd5HdvtAu5xMP2I4AObjI9G6w7gHA/7Izt:tj3TMyvnBKu5xMP2IH9MU
TLSH
T1F6B27C35AC645DFB58A6E0C5B685AA132EF9417BD38C5A4CA1FCFB1E205F9BC4303816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\OriginTrials\0.0.1.7\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

93c736f9-8243-4c2b-a6fb-0577c87c96b8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\93c736f9-8243-4c2b-a6fb-0577c87c96b8.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 77d5feebd92e8a70ea9868f43eea875eed23ca7a48e6e258ae1c041b99254f0c
MD5 9caa12bb7531cb04bc64b93918a9fb61
SHA1 eec791ca684b926b44711e32a6baa18388170bf5
SHA512 fab036e4fe0c306c9e7efd552c00204237249d07cd00a48b9db0949ad1a3aaffac882402390cb054c672316f224d6b2d6971c825a9241187e9ecea9b00a7ec62
TLSH
T146412B5CB6F95148B3B7AF16ABF2B86D487AB9372F06D49D10110D4E0A32A40C971737
MD5 SHA1 SHA512 TLSH

Submit Download

59235953-3bb4-4b18-a1c2-cc713fd251a9.tmp

Path C:\Users\Admin\AppData\Local\Temp\59235953-3bb4-4b18-a1c2-cc713fd251a9.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

Microsoft_Windows_Desktop_Runtime_-_9.0.18_(x64)_20260724190520_000_dotnet_runtime_9.0.18_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_9.0.18_(x64)_20260724190520_000_dotnet_runtime_9.0.18_win_x64.msi.log
Size 2KB
SHA256 9c70756cbdb35b74c5ad56d1937dcb3252927ce731a9d3a79c99e66c0de0017c
MD5 a3ce1f2089b9e51c7dae95407bbb3b29
SHA1 afd2b7b935d377d5d055d950a1b2db5d3b2f48e3
SHA512 7f0c109195ed844e5c8867482014a62643d682d89527446cd64ba4b9b3cdbf5305a8c4c3c5216b27823757982940650aa92d747e3f986d108925189b04b4bf13
TLSH
T14F41E47A1FD50815B2F697079AF3D4526A33FCC1A838DF4C138583590667D0668A8BAE
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_9.0.18_(x64)_20260724190520_001_dotnet_hostfxr_9.0.18_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_9.0.18_(x64)_20260724190520_001_dotnet_hostfxr_9.0.18_win_x64.msi.log
Size 2KB
SHA256 93ce79ae583d310c45ea60cab33fb57f5cb2a09ba4f5d14fd23e5eb342587773
MD5 9424de9065fcb1a019b019f0ba1ae55e
SHA1 a132530175cec242659b98c1afaf992d8b9e30c0
SHA512 ab583ce74b1d533c6bf88554dc8a4f2228790708ead61a9cc4ed3812b804c98087601df3fa32e3dd05bc3c07fd6fe9f39962b72000d4dde8d584cef65860b403
TLSH
T1FD41D2612ED50816B1F75747AEF39412AA33FCD2B834CF4C1345836A46A7D0668A8B6A
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_9.0.18_(x64)_20260724190520_002_dotnet_host_9.0.18_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_9.0.18_(x64)_20260724190520_002_dotnet_host_9.0.18_win_x64.msi.log
Size 2KB
SHA256 d469e9c09495ad9def44f6cf35c38b6c5486f0c696961a5869dd8bdaecb0bf7d
MD5 ea75bcd3653abcd6cdc3c589fa9c89f3
SHA1 163dbd426ecc5d2d1da7472e5a45d5b383137a00
SHA512 53b385c6734e355e75e45c184c8af0f3ab28a640767799fddd31bd6591298fcd7b7c5be05e2743652bc452bd944f9820a2868332c238e7041306a3fdd8b4306e
TLSH
T1184112601FE60905B1F35B0B9EF7D0236A33BC817838CB4C2345836E076B90958A9B7E
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_9.0.18_(x64)_20260724190520_003_windowsdesktop_runtime_9.0.18_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_9.0.18_(x64)_20260724190520_003_windowsdesktop_runtime_9.0.18_win_x64.msi.log
Size 2KB
SHA256 8f2caa99e80ba646c971467317803d92dc73ee0de2fc0021ba104c41283ddbbb
MD5 2332ffc1384d3bb13d54a79f702d50a5
SHA1 67dc5488a382fab6173361822599f3b947e0bcfc
SHA512 0ec8ce2d3bffd606f319d5d841bb004639aa4cf46bc7ba5faad188442968e4190a0403815f19376702ead619b06d9da02783971aec60a6754e66c17d4963bf4a
TLSH
T1914112202EEA0955F2F657479AF3D4539A33FC927834CB4C23468369066BD055CA8BBE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 eb752f53c4112cf476091f4f66050c2ad87ee47c4b5a692bbf3c5db281608d93
MD5 b328da0776221666f23e57624e81fe32
SHA1 610b48def5c234fe32d4bf2a5ea9f8de3b76dfc0
SHA512 56249821dcf1a505842367809a92bcb067cd3729d88a7a6ac946a9699bd468ebb9d91cb62f80fa9f537875dea4986c890e52ddd367365ac52e4d0e36a5cc32f4
TLSH
T1C3D0122636210334C41024735002B20C0400D11B40068000542C895E6E0405449164E1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 f8af5b9825517ab38eb295d5da9ff454572c49fd68f9fe46e3ebd090291d85cb
MD5 c2b53d5d8a9cc400f297062f81dec2c5
SHA1 e2066d4d6290026992202df79bafc560f871b340
SHA512 a17fb65db74a0f1f70a7b6de31b29a99ee226bd39c28a185b446377a69d290a3b69ff8c366a8585657409dfd6d4546182d60fadd116ce3a82e1e565646170632
TLSH
T149D0C0F533350B31C3243073C0C1E0482140C11B208781281D38EEBC1DA48A309EC4D0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 4b643c1a26b1dd35806edbe91c77b7bc0e9e9862410c46b0244191ae06ba640d
MD5 93052488b678518bd7aa48c6b3d07ed4
SHA1 ae6e1e4fd49ce7e0f12eac3de2a6be7ab28e2c00
SHA512 2c1065312a8a02474a0d3aa6f1131f37ff701cb78cf5013d004b327d09c63b16a468fa861baf46d6cbfae67be1724b056ef033d6d1bcd99a334e017c5b6f4ed5
TLSH
T107D0C0F537351731C3243172C080E0482240C01B208782281D38DEBC1DA48A349EC4D0
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView\Default\Network\Network Persistent State
Size 229B
SHA256 153938ecc186cd98a2f1ebd1f53ae88cfe9d9884bd470e9166a53348a071fb2b
MD5 5c9f79435fd36dd2a8914a542651f839
SHA1 81f4f5faf2f14d448626b3f49618d11fd4295cad
SHA512 0e7cf3372f919b11b0c6341bc4df2bb8ba5106463b06c74f0736b14755fa23a78db7e9b3111938570225435169bd01f7198b6124007defa77e90bbe21fd14588
TLSH
T17AD0A7B655601AFE075583E01A24685BCE7D4003422C9DBAC6347B2D43A11B9901095B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe60db22.TMP

Path C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView\Default\Network\Network Persistent State~RFe60db22.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView\Default\Preferences
Size 6KB
SHA256 226971ae6462c2c36cd8197bca42d8311bbec4cea74f21ed56df712ceaad16f6
MD5 957299bb8beae9ed078636f996540825
SHA1 b9aa01d34cfa2d2f171ac78f8b8d16b7b7b17875
SHA512 df593260e70ff86b29aa140949b30966a4188e036baa22ec9957e64179d713dd60ad16c9a0fd34652d6e6d5d8e757e0620d06c1f1079af0c5dd3c69f47b9fea4
SSDEEP 96:st885sAJ7Ib9vffqIgZ8i0vhEbkm4m/7qx+WVHMSm+uecadQj5+gFRMyKEB:st88bmfzgZ8pajx/S+Wi8dULRMyK8
TLSH
T1DED1B9065F28A97B4CC7E21DBA35FB02D2FA106261D41E98EBFC861C08D66CD530780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView\Default\Preferences
Size 6KB
SHA256 994f45be1b396716c00dc5aa1fec8908c4c8ae8a6696b37af14ed9178bd407f8
MD5 e04681a6ef7bbea2fb0bd444b430d068
SHA1 cb5d5faab867775430e6bfc85d58d7f7ee972472
SHA512 c0f16104586986a1b5720724f323d4dc99c1dd4717a81d7a48ee1ae00827f5e5daee8c770ee95e9ae2ce607b836d12c5d71c94e0e1af3bd56704f0ffb4fe107b
SSDEEP 96:st8C5sAJ7qbDvffqIgZ8i0vhEIkmFDm/7qx+WVHMSm+uecadQj5+gFRMC+MEB:st8CbKfzgZ8pagFy/S+Wi8dULRMC+M8
TLSH
T133D1A6065E28A97B4CC7E61DBA35FB42D2FA106362D55E98EBF8861C08D66CC530790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView\Default\Preferences
Size 6KB
SHA256 03e1fce4e126b39526eec6af0e284d4cfab4211cdc82767ee2fe3b0481200eab
MD5 55c3b7393fc6dedb00490fa7e26a15de
SHA1 7117bcbaa4b341b8b22738a82d04cc267639fd05
SHA512 49a4f5ae2e7fd867108c3e0b439e5fd5d3aa616fa4269f5e14e7787cb59f092c1385ede665d3bfe81d7128b994df40f60c2f5d7ccecba44cfb7fb3ecb5580293
SSDEEP 96:st8C5sAJ7qbDmLffqIgZ8i0vhEIkmFDm/7qx+WVHMSm+uecadQj5+gForZMC+MOB:st8Cb/fzgZ8pagFy/S+Wi8dULoNMC+MC
TLSH
T1A8E1B6069E28697B4CC7E61DBA35BF52E2FA106361D11E98EBFC861C05E66CC530780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe60daa5.TMP

Path C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView\Default\Preferences~RFe60daa5.TMP
Size 6KB
SHA256 50798763ed378d393bd1b62311c7f502ad0872f68184bbad85082b4f2729ba0e
MD5 9ecec02aa0f77097e3847e23b33fcdd9
SHA1 26971b3ca2871ba3e37316f806fc2d0f967f28d8
SHA512 ce3526691cfea2aca94347e4d09e4a30d71710ef713f066b7f4adf6af70adf201d99ad8ca9e6a883cba613579867e79c0f4f3da99ce2a7ee98ff16a17ac3ad62
SSDEEP 96:st885sAJ7Ib9vfflZ8i0vhEbkm4m/7qx+WVHMSm+uecadQj5+gFrM+MEB:st88bmfNZ8pajx/S+Wi8dULrM+M8
TLSH
T166D1A8035F2869774CC7E21DBA35FB42E2FA106261D51E98EBFC861C08E66CD531790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView\Local State
Size 3KB
SHA256 550d2537832f1ae43c2851ee6ae04523435b6ff6f1d8b9cf626aa3072e9a8700
MD5 3d494d05a14e3f7b5bf7e61ae589d2b5
SHA1 3869c3302a0e6d85ccb1e704520759d545ecf0bd
SHA512 bf191e3b62733d6357272698415d0a9ca77e20dc23c1996d5f2ef108299c3f9feb96f6a6bb61b34a214a709a114b767bfafbe6c090f6d17627daaeddf5042430
TLSH
T16671733BA864A92B4DE39D41F8897B1676B65163D6913FE8C6EC0F0D01E73D82352C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView\Local State
Size 16KB
SHA256 e5abc1009a88dd286b5e31ab72ab075ec57101b24958dba949cb99c56ddb5b5e
MD5 6cdf804686f4e80b048d6a1699a772a3
SHA1 dd5d03e842b56677b08444b0d71c78f65f54c959
SHA512 11ccaa1a0a3b9920dd610955b8290bda9a1d7e4b2e11f6832e58946318b2485fbe3cb2c02edc7dfc24136c8de99b86e96c010b37fd30a0c955492b2b224aaa58
SSDEEP 384:zS+aQikB+z/xvxjg/qhEwNbLIbT3lTN9zw:h/UxvxjgC+hblTNFw
TLSH
T1B4729E3B95686E2355F3E905B95D4B4B9BB980B281C16AFC4EED1F0A06DB3E80312D17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView\Local State
Size 1KB
SHA256 1f6442fd6cb0a2ef2438bf340f2711dfc9b59087b8ad3d78393f3bfbc8ef4a10
MD5 2ed94454667da5db98424960e3e8ed75
SHA1 d7ca89a61a2357987f7b1cd64d95e9feeb91d0cf
SHA512 9275bf01563dc02ee31a2fc029b2cf3f3ea734ff021ae102d232a06de64ab248f8236285d1a845849b366cde0628c111590d45baeb6d01ae1021191e7ddab5f9
TLSH
T189316577D8601B7228D39982F215FA572E310067C2604EC893ED0B0D02F72DDA636D27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView\Local State
Size 2KB
SHA256 85559bf1e8917f8df1558691cd6474e681c162be2f14ee35703ea0aff7d16ae5
MD5 fb074bfc91e9b5bacf315a83ee74d910
SHA1 50814ed59c712dd7a565288dc5ee283a4e47badd
SHA512 33c33f78898d7f59f06146dd76230712449c10223ab6daca9a57c0d4a2f755d535e9f1b78a5d22203f2e7569d3fccab3cdb2f255260b012e6b0ae90a61f4572c
TLSH
T1D251A573EC14AA7748E39944F94E7F236A3650A2D7612FE496ED0B0D01E769C2322C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView\Local State
Size 17KB
SHA256 cf8224f964253e163e2fda7a5a4f8a095d0a2c8dde88ff6d4b28de39c2ed19fa
MD5 db85133f3a22eea600b2ee15a25895b1
SHA1 812ee6f1ce6fce32d6566e201b0c931001a0ac95
SHA512 370ba5097a0f67bd4801cb36c5f791342e5fe5edcbd7729996374876eca0cc980d91b34a7439fe8cf82997419e100b941902840be19b1eb135cec4fb249d7ab2
SSDEEP 384:z8+aQikB+z/xvxjg/qhEj3NbynaT3liGukDzC9zT://UxvxjgC+j5blifFT
TLSH
T1D8828E2F98686D2355F3E905BA6C5B4BA7F9807381C12EF84AED1F0A16DB3940303816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe607f08.TMP

Path C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView\Local State~RFe607f08.TMP
Size 1KB
SHA256 ff6d98469fcc03e115c8d024057dd46d63599719328e88cbbe162b44135b14a0
MD5 85e1a1bff53cd9fc25e2bc295778b1f7
SHA1 fa8f01a3caffc323448e53bcd76fa8eb8e44114a
SHA512 058ed3813f95fa6e4cfb1f82c809dc823100dcb698ef896bde510f3ecf7a61a3335f275a2e9fe23cce43648458ca2051915af6257f1a0e03639ede1cb4105ca1
TLSH
T1B821623BC8A46A7228938C91F216FB4B2E604066C2204F9C93ED170E16E71DD9676D33
MD5 SHA1 SHA512 TLSH

Submit Download

d9c652ae-755c-4746-a3b1-bb719d553458.tmp

Path C:\Users\Admin\AppData\Local\Temp\d9c652ae-755c-4746-a3b1-bb719d553458.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8ffc08c6-852b-4d16-b092-a5c8c4040377.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3844_133574317\8ffc08c6-852b-4d16-b092-a5c8c4040377.tmp
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3844_880135992\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XENO_CACHE.bin

Path C:\Users\Admin\AppData\Local\Xeno\XENO_CACHE.bin
Size 36B
SHA256 3bab55816f9c1c63b26bee8027a74983736938cfa748d9c91230391d4bacfb88
MD5 03b4e88d732421deccbdd05cb90b0513
SHA1 1ba9d3bd3af60ecc041e93251633b5a0fbac4d9b
SHA512 40e01403608fc8d8c0bc7bc6e1367a472778dea5d4dde4d242b37b0860d098075ac71cf24abd85c6b9ee67bf6adf80adaaf279a969f4477555807003276a2c75
MD5 SHA1 SHA512

Submit Download

settings.json

Path C:\Users\Admin\AppData\Local\Xeno\settings.json
Size 101B
SHA256 88e5c8567b1cad0fa2a42a21ac273a1ffb8a6992be41e5de548d11f281f4c373
MD5 7109faf92716c37ae9d65f89a2477be0
SHA1 de2903bb44600fd8a69649c395335d4fc226c5e0
SHA512 f41ca49622d3458c1365fd9f610e1c27fd3dd816ce5c910e785532dcc39d94ceb1a00991909cc247ab4b9e9da0ac583245168853d8bdcc235116f0a7a4538b2f
TLSH
T11CB09232984108FC01608299C841D80203118E0120662E02B4BE025928308346000FD8
MD5 SHA1 SHA512 TLSH

Submit Download

MSIE836.tmp

Path C:\Windows\Installer\MSIE836.tmp
Size 219KB
SHA256 2bf33a9b9980e44d21d48f04cc6ac4eed4c68f207bd5990b7d3254a310b944ae
MD5 928f4b0fc68501395f93ad524a36148c
SHA1 084590b18957ca45b4a0d4576d1cc72966c3ea10
SHA512 7f2163f651693f9b73a67e90b5c820af060a23502667a5c32c3beb2d6b043f5459f22d61072a744089d622c05502d80f7485e0f86eb6d565ff711d5680512372
SSDEEP 3072:FVzl3qiEZybztEwiUx6D02cWVsV1v2vZR3X6j7zo6k2FkngTLrOrORT9flQnS6lg:FVIMEgXmEAR3oHon2VaFuG0eEp
TLSH
T1AF248D217494947EEAFA0832A57EDA71BF3DF2241760C8AEC3409D1E6D604C167B7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BootstrapperApplicationData.xml

Path C:\Windows\Temp\{D4E7598C-697B-4D06-8475-6C53CCB833CA}\.ba\BootstrapperApplicationData.xml
Size 7KB
SHA256 4d6b96253fa1aed27974c2ec2da521112005b0083c7f3c1ce72a22268b5e7357
MD5 a674558d8f5039f3361b9ac634d6e3b4
SHA1 40bbe7fba815543df6bff87ce8619b2d613dcf3f
SHA512 5c66b0cfff3d80536ca1a33136abc914898a1eefa76e3394cb03a6de1d924fde1d0e30f784ba20c16f6350d1d1b716ab3b634002c37ff0773e55a1f3fed170cf
SSDEEP 96:XeV2VS/V2VvPMtn6nVAYHF0wUycqkn6v8xA0wcycpZ4n6DkF0w4ycavn6qWf0wz1:X0sesvPyUXu0rk8mcLIv4Vvpj5FmEym2
TLSH
T16BF126142FFD0325F0F74F84E9F8511A5A35BC926D38CA5D02551E0E8973B8299A2FBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.xml

Path C:\Windows\Temp\{D4E7598C-697B-4D06-8475-6C53CCB833CA}\.ba\thm.xml
Size 11KB
SHA256 83ca096f7ba2c83fc3b3aeb697b8139a788fa35eb8632943e26bb9fff7c78e63
MD5 302563a713b142ee41b59e3eeac53a90
SHA1 1340e90cc3c6c5fc19a7feb61d7779f4a4f0fdb5
SHA512 c9d4dfc20802bb542178300d1044bb94b35593b834ab0b50875a32953f890e48da456199128500e2c1fee26eaaf8c2c4fcaffb308b37914215f900cdd5c4cbc8
SSDEEP 96:eCdhlFGZRd4UyAi0Rz96zYFGiRdl6dXXdT9gUoLNEmRG3QBinRFRK03K8+GGI9ki:eCSfiozEW/A
TLSH
T1A2325BA986DE7C00D232E711ABF271D6AF126862C4C46E58F94C39BB4FE25406C7727D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{DAE78D96-0A0C-4685-B297-0276B6D3014A}\.ba\1033\thm.wxl
Size 5KB
SHA256 81a68046b06e09385be8449373e7ceb9e79f7724c3cf11f0b18a4489a8d4926a
MD5 d5070cb3387a0a22b7046ae5ab53f371
SHA1 bc9da146a42bbf9496de059ac576869004702a97
SHA512 8fcf621fb9ce74725c3712e06e5b37b619145078491e828c6069e153359de3bd5486663b1fa6f3bcf1c994d5c556b9964ea1a1355100a634a6c700ef37d381e3
SSDEEP 96:MT0abTxmup/vrCKATQdYQHdYCwgoVOBq9LjP5dbSE7:OQNkdYQHdYCYXt7
TLSH
T1F1C1DBA778CF53C128731255EA925AAA5911C19C537F2DF4FC8B454B838A827A373F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bg.png

Path C:\Windows\Temp\{DAE78D96-0A0C-4685-B297-0276B6D3014A}\.ba\bg.png
Size 4KB
SHA256 9095bf7b6baa0107b40a4a6d727215be077133a190f4ca9bd89a176842141e79
MD5 9eb0320dfbf2bd541e6a55c01ddc9f20
SHA1 eb282a66d29594346531b1ff886d455e1dcd6d99
SHA512 9ada3a1757a493fbb004bd767fab8f77430af69d71479f340b8b8ede904cc94cd733700db593a4a2d2e1184c0081fd0648318d867128e1cb461021314990931d
SSDEEP 48:u+Xg+NXWbdlIr33lx9W5OstaDIy3r5XpPyvZKmXYTDeiByNxcaaaaaaaaaaaaaaE:AaXWPIrHT932JsdpPyjqDeioatEn
TLSH
T19891B4D8FCF95322C6002BF255F4C0735A0215B713ABFEC82F496BD90E6878E25058B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixstdba.dll

Path C:\Windows\Temp\{DAE78D96-0A0C-4685-B297-0276B6D3014A}\.ba\wixstdba.dll
Size 190KB
SHA256 dcea15f3710822ffc262e62ec04cc7bbbf0f33f5d1a853609fbfb65cb6a45640
MD5 f1919c6bd85d7a78a70c228a5b227fbe
SHA1 71647ebf4e7bed3bc1663d520419ac550fe630ff
SHA512 c7ff9b19c9bf320454a240c6abbc382950176a6befce05ea73150eeb0085d0b6ed5b65b2dcb4b04621ef9cca1d5c4e59c6682b9c85d1d5845e5ce3e5eedfd2eb
SSDEEP 3072:sjEoXsLW9OLG8Qp51ySdjDXY33b+Av7O5IkI+/AYkPAEc527uu3k/gLtxavf0ir2:sjEo8LW9553hXWy15I2YrAW7FUVEihs3
TLSH
T1FF14AF1176D0A07AEBFB16307A39A5216E7DBA200FA0C9DF63449D2B1D715C19B36B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet_host_9.0.18_win_x64.msi

Path C:\Windows\Temp\{DAE78D96-0A0C-4685-B297-0276B6D3014A}\dotnet_host_9.0.18_win_x64.msi
Size 704KB
SHA256 999adf7d2c62e5c3dcf84f7d37de7b7239ed181320a34333be24e711ea31ac0a
MD5 84d594d4a01a5ef833b7f128e6527b4f
SHA1 c37629ebc7c6222903a49a6cbda70f9bca084cbf
SHA512 9a0f17c1f661777035637bb1122d3b07e1b5eea66e75659157da270bf37a3b8282bcfd0de84fb084f6eeee62d36d19b312451ad118bf05d2ae8cfdd5cbd53bbf
SSDEEP 12288:VDcWJ8xeV1EgXmEI3os2Qx7E4D4Rxbp4K+1uiq:pcJkXdc3/7Rin+s
TLSH
T1A3E49D237D80803AD9BA1D31953DD7B16F3EBD204A64889B5380B91DDDF11C0AF76AE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet_hostfxr_9.0.18_win_x64.msi

Path C:\Windows\Temp\{DAE78D96-0A0C-4685-B297-0276B6D3014A}\dotnet_hostfxr_9.0.18_win_x64.msi
Size 776KB
SHA256 1e32234822baf467c0eb2e2b1b498ea5f19e68a37fa74a4fb54b4b0c880d7a76
MD5 91fbf55d6cc731e4742cfed4db34fa82
SHA1 199284451a7a4c5904e63e691dd1fc8d8f4ffcc4
SHA512 fec81c0ad9bd574690c7950fb0a4a973ece04caadcba92b9b1a1a0f7ce27bd6f718fa4e75fcc50ead37d965c7d6db1dcbf947a51b727a481610bd06e472e9038
SSDEEP 12288:0flV+AtnKhJXV1EgXmEI3os2Qx7E4D4Rxbp4K+1uiq:Qj+A0hJXXdc3/7Rin+s
TLSH
T108F4AE137D80803AD9BA1D719539D7B16F3DBD204A64889B63807A1DDDF11C0AF36BE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet_runtime_9.0.18_win_x64.msi

Path C:\Windows\Temp\{DAE78D96-0A0C-4685-B297-0276B6D3014A}\dotnet_runtime_9.0.18_win_x64.msi
Size 27.5MB
SHA256 16d8a182dcb54a7d93defedea3bd23cc44f291a5d430e9a41b3379add5c9c963
MD5 59589f076158800d29bf3f83136b3c38
SHA1 2298f1a89ce7c1208274675e90861f3e0c35c61e
SHA512 74ad9447089266ecb00a3646c063fb61f84e46c903b4663a7816165adc2b37118ddfbc214fc4fb0c760051bbe6da74d3a8534a4e948e22d8ed6e72c6365617c7
SSDEEP 786432:0mwF1ZdIi7qAuVQGdtzBg88DHVT3GwXd9L2:GFqVnhg8fwX3L
TLSH
T13A573393FD82843AE17D1D3194BE97B46A3D6E111B0ACC1BA254381DFDF22D04A72ED6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windowsdesktop_runtime_9.0.18_win_x64.msi

Path C:\Windows\Temp\{DAE78D96-0A0C-4685-B297-0276B6D3014A}\windowsdesktop_runtime_9.0.18_win_x64.msi
Size 30.0MB
SHA256 87a9ba31111ed5aab4d44e31e3ece65126150e27447f5e30aade964694589517
MD5 70cf6a2e93dc90095236ba5477b2c767
SHA1 1b52740168aea04639d6c9ceba8e498a90e5ba9f
SHA512 d38565990bd8b75fc946e0d0f769b7a990982d05d585ced1f6121ead5f615b9a5561b328e4258f9cb75f2b6dd32551695d796104910a4c4ef952c1e516364bc2
SSDEEP 786432:yl9KaCo8bNp5Q5leTPY+OK/iAcWWHUto1Pe:a9KBXQXeTSWW0toQ
TLSH
T1FD6733137D53E174E89A0E75823A9B60AF3F6E241A208DE74310BA1CDDF06D05D76BE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windowsdesktop-runtime-9.0.18-win-x64.exe

Path C:\Windows\Temp\{F75CDD35-6B08-4D7D-9D4D-5CF679BC0659}\.cr\windowsdesktop-runtime-9.0.18-win-x64.exe
Size 607KB
SHA256 78a6d3bcdd33c659ba2e04ca01276bf725f4ced3654698f14706eeb93b924d3b
MD5 1be627af972f9f81164a08b0d7d6dfd6
SHA1 4d144311e2b9fb2d6f3470f3669eb5990c2c240d
SHA512 418fcea8100c6dae3f7f6a3eba06a9e64831ff7c03575fe3474074c6cb157cc9da742e7fb59a0df7ca0ae47f22281779e0746ce04a40c0e8bb3d2537474a08b7
SSDEEP 12288:CmEsd9PZfePv3xl7ft7V+6uC+zd5qLlJF3wURiy7nlEM0Dnma:Cm39PZfePv3r7fm6t+jqpz37rzCM0x
TLSH
T1B4D48D32A5614032F7F10673B92896303E3CE328175488AAE7D4AD1D7EB88D667F7257
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/708-1515-0x00007FFF139B0000-0x00007FFF139B1000-memory.dmp

Download

memory/1828-1564-0x00007FFF128D0000-0x00007FFF128D1000-memory.dmp

Download

memory/1828-1563-0x00007FFF13EE0000-0x00007FFF13EE1000-memory.dmp

Download

memory/2024-1596-0x00007FFF139B0000-0x00007FFF139B1000-memory.dmp

Download