xenorat | hxxps://github[.]com/moom825/xeno-rat/tree/main/xeno%20rat%20server

Resubmissions

28/07/2026, 11:17

260728-ndqckavfkc6

26/07/2026, 16:31

260726-t1g8csysex

26/07/2026, 16:28

260726-ty6g6sysdx10

Analysis

user interaction
yes
max time kernel
105s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/07/2026, 16:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/moom825/xeno-rat/tree/main/xeno%20rat%20server
Sample260726-ty6g6sysdx

Score

10^/10

discovery xenorat rat trojan

Malware Config

Extracted

Family

xenorat

Mutex

Xeno_rat_nd8912d

Attributes

delay
5000
install_path
nothingset
localhost
127.0.0.1
port
4444
startup_name
nothingset

Signatures

Family: XenoRat
XenoRat is a remote access trojan written in C#.
trojan rat xenorat

Detect XenoRat Payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000800000001e2bd-555.dat	family_xenorat
behavioral1/memory/1696-596-0x0000000000410000-0x0000000000422000-memory.dmp	family_xenorat

Executes dropped EXE 2 IoCs

pid	Process
1696	xeno.exe
1540	xeno.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
79	raw.githubusercontent.com
80	raw.githubusercontent.com
84	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xeno rat server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xeno.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xeno.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4348	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134295569499450168"	msedge.exe

Modifies registry class 39 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	xeno rat server.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	xeno rat server.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	xeno rat server.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	xeno rat server.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	xeno rat server.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\1	xeno rat server.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	xeno rat server.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	xeno rat server.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	xeno rat server.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{9859F564-216F-45C3-9C26-CEBF9692E069}	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0000000001000000ffffffff	xeno rat server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Generic"	xeno rat server.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	xeno rat server.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	xeno rat server.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	xeno rat server.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\1\NodeSlot = "3"	xeno rat server.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	xeno rat server.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	xeno rat server.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	xeno rat server.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	xeno rat server.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	xeno rat server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	xeno rat server.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	xeno rat server.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	xeno rat server.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	xeno rat server.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	xeno rat server.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	xeno rat server.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	xeno rat server.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = 0100000000000000ffffffff	xeno rat server.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	xeno rat server.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	xeno rat server.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	xeno rat server.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	xeno rat server.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\1 = 7e00310000000000ad5c6eb111004465736b746f7000680009000400efbead5c6ba7fa5ca4832e00000062e101000000010000000000000000003e00000000000cbb4c004400650073006b0074006f007000000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370036003900000016000000	xeno rat server.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\1\MRUListEx = ffffffff	xeno rat server.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	xeno rat server.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2172	xeno rat server.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe

Suspicious use of FindShellTrayWindow 44 IoCs

pid	Process
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
2172	xeno rat server.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2172	xeno rat server.exe
2172	xeno rat server.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 412 wrote to memory of 1996	412	msedge.exe	86
PID 412 wrote to memory of 4348	412	msedge.exe	87
PID 412 wrote to memory of 4040	412	msedge.exe	88
PID 412 wrote to memory of 4040	412	msedge.exe	88
PID 412 wrote to memory of 4040	412	msedge.exe	88
PID 412 wrote to memory of 2012	412	msedge.exe	89
PID 412 wrote to memory of 2012	412	msedge.exe	89
PID 412 wrote to memory of 5024	412	msedge.exe	91
PID 412 wrote to memory of 5024	412	msedge.exe	91
PID 412 wrote to memory of 5024	412	msedge.exe	91
PID 412 wrote to memory of 1700	412	msedge.exe	92
PID 412 wrote to memory of 1700	412	msedge.exe	92
PID 412 wrote to memory of 1700	412	msedge.exe	92
PID 412 wrote to memory of 3672	412	msedge.exe	93
PID 412 wrote to memory of 1260	412	msedge.exe	94
PID 412 wrote to memory of 3672	412	msedge.exe	93
PID 412 wrote to memory of 3672	412	msedge.exe	93
PID 412 wrote to memory of 1260	412	msedge.exe	94
PID 412 wrote to memory of 1260	412	msedge.exe	94
PID 412 wrote to memory of 1460	412	msedge.exe	99
PID 412 wrote to memory of 4540	412	msedge.exe	100
PID 412 wrote to memory of 1460	412	msedge.exe	99
PID 412 wrote to memory of 4540	412	msedge.exe	100
PID 412 wrote to memory of 632	412	msedge.exe	102
PID 412 wrote to memory of 2840	412	msedge.exe	107
PID 412 wrote to memory of 2840	412	msedge.exe	107
PID 412 wrote to memory of 1392	412	msedge.exe	108
PID 412 wrote to memory of 1392	412	msedge.exe	108
PID 412 wrote to memory of 1392	412	msedge.exe	108
PID 412 wrote to memory of 4840	412	msedge.exe	109
PID 412 wrote to memory of 2000	412	msedge.exe	110
PID 412 wrote to memory of 4168	412	msedge.exe	111
PID 412 wrote to memory of 3860	412	msedge.exe	112
PID 412 wrote to memory of 3312	412	msedge.exe	118
PID 412 wrote to memory of 3312	412	msedge.exe	118
PID 412 wrote to memory of 2192	412	msedge.exe	125
PID 412 wrote to memory of 2192	412	msedge.exe	125

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/moom825/xeno-rat/tree/main/xeno%20rat%20server
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x258,0x7fff6b8ec188,0x7fff6b8ec194,0x7fff6b8ec1a0
  2⤵
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,12402388763930501457,5243607240870986831,524288 --field-trial-handle=2248,i,10564266445193216771,16610027051640525096,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1624,i,11978088428325752856,7173559359393522,262144 --field-trial-handle=2248,i,10564266445193216771,16610027051640525096,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:2
  2⤵
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2548,i,4351213541519740761,12366301842622445502,524288 --field-trial-handle=2248,i,10564266445193216771,16610027051640525096,262144 --variations-seed-version --mojo-platform-channel-handle=2684 /prefetch:8
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,6759827371340403027,7667763648562392147,2097152 --field-trial-handle=2248,i,10564266445193216771,16610027051640525096,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,14775261011335888322,10747046731819481059,2097152 --field-trial-handle=2248,i,10564266445193216771,16610027051640525096,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4220,i,6762728903888513855,5106690635750137439,2097152 --field-trial-handle=2248,i,10564266445193216771,16610027051640525096,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:1
  2⤵
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4244,i,14382543558552102862,8020904238060345829,2097152 --field-trial-handle=2248,i,10564266445193216771,16610027051640525096,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:2
  2⤵
  PID:1260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5044,i,17252820203155513507,15525322983662064865,524288 --field-trial-handle=2248,i,10564266445193216771,16610027051640525096,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3652,i,1155075915768850512,6261166058196305328,524288 --field-trial-handle=2248,i,10564266445193216771,16610027051640525096,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,6990678677624637513,1248111438230799098,524288 --field-trial-handle=2248,i,10564266445193216771,16610027051640525096,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,6990678677624637513,1248111438230799098,524288 --field-trial-handle=2248,i,10564266445193216771,16610027051640525096,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4476,i,11481180955609743276,18210849617150214028,524288 --field-trial-handle=2248,i,10564266445193216771,16610027051640525096,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:8
  2⤵
  PID:2840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4472,i,7722290547323651621,14768085860335333207,2097152 --field-trial-handle=2248,i,10564266445193216771,16610027051640525096,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:1
  2⤵
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6468,i,12785328460803239419,7132928443361512457,524288 --field-trial-handle=2248,i,10564266445193216771,16610027051640525096,262144 --variations-seed-version --mojo-platform-channel-handle=760 /prefetch:8
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6464,i,15099105648500060274,16231393478573671992,524288 --field-trial-handle=2248,i,10564266445193216771,16610027051640525096,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:8
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6460,i,3578132682243106742,7610902613342479707,524288 --field-trial-handle=2248,i,10564266445193216771,16610027051640525096,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:8
  2⤵
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6424,i,17676846830669802716,16284014954147340406,524288 --field-trial-handle=2248,i,10564266445193216771,16610027051640525096,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:8
  2⤵
  PID:3860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6760,i,8547805636035023466,11687289788937835979,524288 --field-trial-handle=2248,i,10564266445193216771,16610027051640525096,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:8
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6288,i,3058659772421285296,3434040340707275533,524288 --field-trial-handle=2248,i,10564266445193216771,16610027051640525096,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:8
  2⤵
  PID:2192

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2744

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4388

C:\Users\Admin\Downloads\Release\xeno rat server.exe
"C:\Users\Admin\Downloads\Release\xeno rat server.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2172

C:\Users\Admin\Desktop\xeno.exe
"C:\Users\Admin\Desktop\xeno.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1696

C:\Users\Admin\Desktop\xeno.exe
"C:\Users\Admin\Desktop\xeno.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1540

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 deae8ba3a07225fe9f1490e4968fd83f8d308707a88a6d3d541d8ab416841ddf
MD5 1fcf11901014bf515178c91bdb7a6c5c
SHA1 4746b018067d9671617515224b7697b27fd2fc5f
SHA512 6059830103275d34e1aa4dd4e8d4177b6c2b684b2b3ad5417753387a227c838c0b258e662c78853cf649656ebd762f5d160c10349cd19ac1953380bd6572c660
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7p:fwUQC5VwBIiElEd2K57P7p
TLSH
T16EB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cd640af4b18734f838b65cd3f2b65e25dc669e7cc487a16f826240b353446af4
MD5 337b94f0014654439210355bd20e82dd
SHA1 26e4c8276331781253e2a807dd554b2ee3ad7e8e
SHA512 087107a51c83ccffad34c7d3f5423a0f231d30a9f78e9ed5db98eb770bada291f65c7b34d1e72284571b846a7acdf88b217ef4da25b7acff47964af1551b2e9b
TLSH
T1B6D012323B197041E71A8130E403C74017AE54B524864606A254C50D6DA90C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85f865adbe5e58c0596a4db9b9daa509b8e2bd087dbcc9a01a5a095a266757bc
MD5 29ddc94c4e214fd03f664130dd36edfe
SHA1 10dfd57508ad6ef16445956dc1ee4d8c2bffc4e3
SHA512 fa7477f3f8068f41dae4965a930de8ad11b234c1ccfcd17a84fb2bfe4c289beebc19be8d058f75ed01b6dbe7304af8270da91d31316fc94360f4fa750ab203bd
TLSH
T13AD012323B597441E71A8130E403C74017AE54B524868706A254C50D6DAA0C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 6KB
SHA256 721e18f43a8f7bc30684735d755f2b2bd02733a5d5e8fabf4b7243a14e065e0b
MD5 ce20506c372e6b91e7bf765b39b215d0
SHA1 0e3509fa10f8c4df3dddba4d0525c665a62b3817
SHA512 79b7101514c327efc1078495d0b85d2c63454281082d93410ff20d9588e9cae9d7e7ad640b6fba785d64b07d94be6a3d4876277b1ca9624926138154a6b6895f
SSDEEP 96:Z9+fACPyzMd2uKEUlGMgAthOsjupm1rvC:Z9SPyzMd2lxLgAfrSpmw
TLSH
T1EED185775D1284A8EB360233EAC1C696F27182D2F52F5EF9129007BCBC0A3B14DD7466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 956a8a11654f07e7177e739fb04304a52848f94031c90e8479ac47e620a13ec1
MD5 17e552725ccd6214637d49f22dcb3a3f
SHA1 8229efa3bed1f2b5d08ab33ed43f948844bab8f9
SHA512 671780e700b114fa229b9d007c27885f548b127b63223eb8ffbbbf8d4640f5952c50bbb4bd93e1a0debb9141184afda67ddf5de837749c5a14572f1e154f8865
SSDEEP 48:Bb93C9KvdKbBkf6dL2H2U1cGbaW6h6iKfyjetmI1mA7avGq6Of3ulnI6bHsxFlz:Bb9CkydSH2URnp2dcmA7nOfupxbHAFt
TLSH
T1E3C14D334A524468EB765333EAD2C45AF23082D6F52F6EE950901B7CFD0A3B18DD7926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58c510.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58c510.TMP
Size 3KB
SHA256 fd7e1fd45449b704c279cbe48e0be56be2ffca9e3b22607a92ae7c5e345dc1b2
MD5 8b697f95c1a315a77654aab922fcd453
SHA1 782989ccb7ee746cade81866d5cc66bd0617b964
SHA512 da951db10ab2f3524f042a0a166af64767588818ddd9fe25e12fc709a32ed2fdcaf51d57a0be56e538463d159d53e7fa4c445f91da87b7c310abeb3200e225d0
TLSH
T14171A3350A53426CE7570332EBC2C41A727186EAFA3F5DED24D0587C4D0B3F1815AA63
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 77e32b698d6ad7747390ae1a5d71c37fb406a7a353b4c44cb79a7ad913001303
MD5 4cc9aac759254b10588080c696f89117
SHA1 7bff84e3a840bea8ffa98f8bb48e8840cdc2cd8b
SHA512 bd0b78a05d06576d95d23d159df644c2fa9715199c9fb1adda062bc8296d5e78e315618f7949c68e395956ff63a4c2531c8faa7eb1fa3b7c7a672cad0684fad9
TLSH
T126417AF787E1856D8E125AF0AA18EE1BCE2C0611831C7C6985E0BE17D3E3871E101B5F
MD5 SHA1 SHA512 TLSH

Submit Download

a4d982ba-b407-44f4-b9e8-09364da999b4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\a4d982ba-b407-44f4-b9e8-09364da999b4.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 aaebe9161f074e2e2098c3a4148f56e562c05653e9ecc19b8cf99c4f4de5d3d2
MD5 4b4b425a5766ccc1f39c1e01c2e22dd9
SHA1 30c96b201dcb4d2dbdd2dce41e47fea296463c3d
SHA512 45ba833c492123e6bd3811c178996885899b78bd54b6804670a9f71b6ea234f60f1293193d3d92ba2b952aaf319794ca0426cf4d580645520df3137ea1d3d8e1
SSDEEP 192:sxZ9RMyM/jK1Ml8Mk0/fOsjcxNIdp9cbHW6+WNYrs/YzPNq0IgrJ:sxZ9iM0/fOsjcAUHbF/49
TLSH
T1AA52D6566A34997BCDCBD209FA55BB53D6F50472D3900E48AAFC8A0C05E6BED230781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 348ab94c8dc521917059949ab29a48d635463e757bd5f9679dfb673c131b50f4
MD5 8d66afb3074fc4931d8722e9df79ca5f
SHA1 9a33ade363ae4fde2287785ac65a45cd9a550229
SHA512 d5a4b8f7b3cc3c6121d3e6312fccfd246d5d2146d6b2835510e376fcbfb29c9ba06d19266a2676ab7466559228e4e6e5246c7775aad36334c56f42650378b7fb
SSDEEP 192:sxZ9RMyM/jK1Ml8Mj0/fOs83uNIdpvcWHW6+WNYcbdYziOq0Ig51J:sxZ9ib0/fOs83PjHb3dYd
TLSH
T17762C6567A34997BCDCBD209FA557B53E6F90422D2900E44AAFC8A0C05E6BED230781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 60f8166bce9c1d24ab4d6131c664fad370110db1de27f256f13d32203840338b
MD5 8f272db034c8a7c97b995a6fe6655dd1
SHA1 544674a17838e858d8b9651b23fe2f8a5c7de5ab
SHA512 4581da46878cf78138406206ddb617f0522213c677672cfbd7809c318acabdd65faf8eba48c8f6812331ab5153979e734eccd228c5dcfa7289765ba633dcfe4c
SSDEEP 192:sxZ9RMyM/jK1Ml8M90/fOs83uNIdp9cWHW6+WNYzIZYz8Sq0Ig51J:sxZ9i10/fOs83PRHb7Zad
TLSH
T10C52C7566A34997BCDCBD209FA557F53E6F91432D2900E44AAFC8A0C05E6BED230781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 1b86e8d7bf8284c12b1767284fbcfc84aa582b0f4fbb7064c95b016607cef09a
MD5 cfb004d39fa505a5eb9ce160752b5d7c
SHA1 c9d3795fdfe664152783c607d8d65d94daee3e75
SHA512 79466dc31c8a51b86a017e7e2a76598d187c542f3ab62cd09530aea7c56d60805bbd1c3deb3072fb1f565f05fc4f7783d85e33f2d429a83b5b30961f12740aed
SSDEEP 768:1wW7kf0Wvqida8F1+UoAYDCx9Tuqh0VfUC9xbog/OVX5LlWYSjoroIwiPY/:1wW7kf0Wvqidau1jaa5LA3jTD/
TLSH
T1ADD20B3B680CCB7E4F841E5CEC266F966ED801CB67988D5487FA884C03CB6EA51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 cb1cc3a75bf865dd2c37d7fc8752fc8d8149faa9534a78140756cfd247c4d71e
MD5 b1aa1b32b9717838705732ffc3c10037
SHA1 c67b7e5eb103b2c9cfa550c7804fc31c39bc2586
SHA512 b4b1eefc0782990da948ecc8c23d59c530236ee5848d27619d62da73282e8b0a8a537679b5ab9c696f2c18a5d9044a471c35f4b8122b741c58ea8cf4c513448a
SSDEEP 48:KfSVOyIQA2aQL9IZy2KYTbEIfKFmc3yZ8ILK9KcVjIpKYg:KIbCKcbEQKFmeK8gK9KGjCKYg
TLSH
T195910096713B150238BD2C59A35AC5358E81315338AD687FBFB400A22E66F134EFD9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

898d68b4-3697-4ca0-91fd-ad5fe87c0046.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\898d68b4-3697-4ca0-91fd-ad5fe87c0046.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 841b14ae1f9ecade584bf953db9e7af2edc2cc0a678703eeb34d19f0c905641d
MD5 9431bdb641fa5bc9d13d119396dfd3a5
SHA1 4d61ea17ae35435232f8a440364399b538363c24
SHA512 df42a3a05795e409a6c918fb56acde1bae498ab2360323366ff7ab75a8617a50eb111799a920f9cd03205718fb1b7864c0371259a2901269bf8751d7df7aba04
SSDEEP 192:umLsNsbQasyeKBbnDQmiU13ut4aGBPKDv+FdGE1VFC1SJrPdNZqny1B8v1:3sNsbJsrMb1AiPdlhCEJrvawK
TLSH
T173423B36ACB49C3B5EE2A151F44736135FB84177D7C82E84A6EDAB0C06DB79C2306C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 0befb9577e0e2807b247b17684ac54fe5bb43c73fb6e52b2d8bacf7357eb82e9
MD5 d95bf427078d94d0df359a07ffee5631
SHA1 2bf4817be1fe34ec98536f2bbe2663f2a9c841aa
SHA512 8f2186dcabcb649700e3b9b60340b9f8a3470703b2eede9ebcf5569e65c1bbe643640da6e236ac247711efca3be66ba9b78f5d143e07524bddecdd44e20e5404
SSDEEP 384:QiFTZcIjUsNk8TUNTUlIlWJsrMb5UiPdlhCEJr6awf:rFLwdwgECMOM7h6aA
TLSH
T1D5B208F658E7883ADAAE5743E77D2D124EBCC067F6845A40B3D89A0CCD961BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 3fe22579987e31cc13304eabf4941bf2b51314c93b8d5437ce71184d8953aeda
MD5 b785693395754e4a4f93711b10051bce
SHA1 addf57ce1a90dd59c7c8ed036003e0c54f93b82e
SHA512 103d514a2632fc3daf5ccd97fb26e0c5eaeb1db6abc84b8c630aa97c6242c1f4f632e0e6247d7416989fc414baea401a46a592d451198d22bc6930911a83bf2f
SSDEEP 384:QiF7ZcIjmsNk8TUNTUlIlWJsrMbMUiPdlhCEJrEawf:rFjCdwgECMNM7hEaA
TLSH
T180B208F258E7893ADAAE5743E77D2D024EBCC067F6845A44B3D89A0CCD961BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 851f5578b9d6acccae68ae3e253308478eb1d712c5da1d0ad3fc6ba51f7a8810
MD5 ba8b832fc09e6b46d2a971d6257e8554
SHA1 2ac4ecaee820964e3a20a9030ba4e7a86662033a
SHA512 3533dfdbe364731649791200c0d2924c4f6192b1940d89728d6726be6c850e3f5393f963acbe176d250010aaa9e43ac3ae8ff440f282169e094d2e0d54f58e72
SSDEEP 192:MONB64BAQmiUy215W5GBPKDv+FdGEIaD/rU6:MONB6eAFzWAdlxjU6
TLSH
T17F02F939AC786CBB9FA2AE45F48637175FD8113BE6C41F44EAE85B0C019764C230382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 17KB
SHA256 23b90156737fe819f0f0fdd0d5456e70ff3ed92fbaa5f76375fcfb3c52e8cfaf
MD5 542fc9faf47ddb52f20855c3d2ed812b
SHA1 bb6aa2a3f8e2ab2ada3d2ed8aa947dd939b9f522
SHA512 184497980c8a286177a78091b3b9e5b8414a2e3e955a109f5ba0e626b71fc92aef5e43b37fe38edc0635d775b1d6c777d2a9ee60470133a9f9ef524f8087867c
SSDEEP 192:uyb+xasuheOwQxM/sNsYzQasyeKBbn8QmiU13ut4aGBPKDv+FdGE1VFC1SJrPdNL:5ZcI0sNsWJsrMbMAiPdlhCEJrvawf
TLSH
T186727E76AC749C3B5AE6A141F84236135FF88077E7C82F44A1ECAB0C06E66981317C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 4a5d2d9c76536d3cc4e0a5d339571be8291c44cf1471c7e2ff03ba28fa7df06a
MD5 4bf19650979e5bddaafd1a1c9ed9be0a
SHA1 b3b1cc99282268eefb2972a780bff7f3afd4b817
SHA512 d79049c2c69b938c8bf23b6a437307e365c97e9c9539d2665a26de6013f0750ee24fa145f7f56f38989647c2ba2d6ef293162ce83951f428af3c15da251fc1bb
SSDEEP 192:+ON164BdQmiUyE5+5GBPKDv+FdGE1VFC1SJrgWwZqnU6:+ON16ebb+AdlhCEJrGaU6
TLSH
T196122B35ACB4AC6B5FD2B181F48736135EA9413BEBC56F84F6EC6B1C01EB65C2306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 44553e3ec1033369c3cf372e5915fe965a157c059f7209cb23366bf7d16f027a
MD5 6fc0fa8e20b8bc995a2a79a7c3687ab2
SHA1 75d1baef6c0b87a8c5aaf6ce5faf1ce84e8825e8
SHA512 fccf7a25175893a22a7300e91f4d5127028f87449ad9fe5321113a61350d4cd070ae45da098addde398cb2cf0c7a50fe56fa375b43f13cefd9b94ef6bb5de85d
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe58e50c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58e50c.TMP
Size 392B
SHA256 4218af31f012126730d504fe9bdc2423ab7f474d5a3235f88fe792f858b68c55
MD5 130a7f6f8d9060f298fcc8255ef90544
SHA1 54c7372b1a168916042c5a057d7e7204cece0100
SHA512 b0addc803ad78ea1fd65c3c3b7adf9d62368896ee573820de53d8863d77a7b5d17925970bb3ed68c22c1d4ee1a83860bc15e296743f3f6c00bab905c8a7a8f01
MD5 SHA1 SHA512

Submit Download

abb453d6-7684-4853-9d03-cf541a118dcd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\abb453d6-7684-4853-9d03-cf541a118dcd.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 b016dd3b637ff684bda6ead7e6444b57285bd4f4d167f789fbdb852439716779
MD5 c4887af90812ccdab886999c154a277b
SHA1 ea6c4dde7dfc451ec59aa1236bd88ea1144927e8
SHA512 023ec17bd0f0ad288a776fcce95ad21f3b0ab2d671f5f729c2972f6d843d284f375fb3e43358f01ed14341e8f7fdf1c5ae1edb3d5a3590c9329e60505867b518
TLSH
T18F41E658BAFD1144B3B76F1A9BF6A8AD487F79272E06D49D00010E4E0667A80C9A1737
MD5 SHA1 SHA512 TLSH

Submit Download

xeno.exe

Path C:\Users\Admin\Desktop\xeno.exe
Size 45KB
SHA256 5d00cfc66ae11f68bae4ac8e5a0f07158dae6bfd4ea34035b8c7c4e3be70f2c5
MD5 e069304f72f1993e3a4227b5fb5337a1
SHA1 131c2b3eb9afb6a806610567fe846a09d60b5115
SHA512 26f18e40b1d4d97d997815fe3921af11f8e75e99a9386bbe39fb8820af1cbe4e9f41d3328b6a051f1d63a4dfff5b674a0abafae975f848df4272aa036771e2e9
SSDEEP 768:JdhO/poiiUcjlJInvvH9Xqk5nWEZ5SbTDaJWI7CPW5h:Hw+jjgn3H9XqcnW85SbTAWI5
TLSH
T1A023F84C57AC8923E6AF1ABD9832426387B3F3669532E38F08CCD4E937933955905397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Release.zip.crdownload

Path C:\Users\Admin\Downloads\Release.zip.crdownload
Size 6.4MB
SHA256 e7b275d70655db9cb43fa606bbe2e4f22478ca4962bbf9f299d66eda567d63cd
MD5 89661a9ff6de529497fec56a112bf75e
SHA1 2dd31a19489f4d7c562b647f69117e31b894b5c3
SHA512 33c765bf85fbec0e58924ece948b80a7d73b7577557eaac8865e481c61ad6b71f8b5b846026103239b3bd21f438ff0d7c1430a51a4a149f16a215faad6dab68f
SSDEEP 196608:SYNI1S7C6S230UwVLW83FUSA7WQZzwM3/C2cM7m2:rNIs7CDvB1USA7WS/vcx2
TLSH
T1296633F2C706DF6EE1C6277A9A035907A51061F8863112CF548DC9FAEB52E42C2E7BD1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1696-596-0x0000000000410000-0x0000000000422000-memory.dmp

Download

memory/2172-526-0x0000000005A90000-0x0000000005AA4000-memory.dmp

Download

memory/2172-530-0x0000000009190000-0x00000000092B4000-memory.dmp

Download

memory/2172-531-0x0000000008F70000-0x0000000008F8A000-memory.dmp

Download

memory/2172-532-0x000000000D1C0000-0x000000000D272000-memory.dmp

Download

memory/2172-533-0x000000000D280000-0x000000000D5D4000-memory.dmp

Download

memory/2172-529-0x000000000A5E0000-0x000000000A602000-memory.dmp

Download

memory/2172-528-0x00000000086E0000-0x00000000086F2000-memory.dmp

Download

memory/2172-527-0x00000000086B0000-0x00000000086CA000-memory.dmp

Download

memory/2172-525-0x0000000005790000-0x000000000579A000-memory.dmp

Download

memory/2172-524-0x00000000057E0000-0x0000000005872000-memory.dmp

Download

memory/2172-523-0x0000000005F20000-0x00000000064C4000-memory.dmp

Download

memory/2172-522-0x0000000000B80000-0x0000000000D82000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads