hxxps://www[.]xeno[.]now/downloads/Xeno-v1[.]3[.]55-d47d833e[.]zip

Analysis

user interaction
yes
max time kernel
900s
max time network
900s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/08/2026, 23:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.xeno.now/downloads/Xeno-v1.3.55-d47d833e.zip
Sample260802-3mmqcstepd

Score

8^/10

discovery persistence ransomware

Malware Config

Signatures

Downloads MZ/PE file 3 IoCs

flow	pid	Process
174	2880	chrome.exe
205	2880	chrome.exe
288	1840	msedge.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	aspnetcore-runtime-8.0.29-win-x64 (1).exe
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	windowsdesktop-runtime-9.0.18-win-x64.exe
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	windowsdesktop-runtime-9.0.18-win-x64.exe
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	VC_redist.x64.exe

Executes dropped EXE 23 IoCs

pid	Process
3324	VC_redist.x64.exe
4520	VC_redist.x64.exe
4228	VC_redist.x64.exe
4996	VC_redist.x64.exe
2692	VC_redist.x64.exe
5116	VC_redist.x64.exe
2876	VC_redist.x64.exe
2296	VC_redist.x64.exe
892	aspnetcore-runtime-8.0.29-win-x64 (1).exe
3752	aspnetcore-runtime-8.0.29-win-x64 (1).exe
3040	AspNetCoreSharedFrameworkBundle-x64.exe
2952	AspNetCoreSharedFrameworkBundle-x64.exe
4684	AspNetCoreSharedFrameworkBundle-x64.exe
1760	AspNetCoreSharedFrameworkBundle-x64.exe
5760	windowsdesktop-runtime-9.0.18-win-x64.exe
5884	windowsdesktop-runtime-9.0.18-win-x64.exe
5868	windowsdesktop-runtime-9.0.18-win-x64.exe
5344	windowsdesktop-runtime-9.0.18-win-x64.exe
5948	windowsdesktop-runtime-9.0.18-win-x64.exe
5564	windowsdesktop-runtime-9.0.18-win-x64.exe
1408	windowsdesktop-runtime-9.0.18-win-x64.exe
5104	windowsdesktop-runtime-9.0.18-win-x64.exe
5304	windowsdesktop-runtime-9.0.18-win-x64.exe

Loads dropped DLL 64 IoCs

pid	Process
4520	VC_redist.x64.exe
4996	VC_redist.x64.exe
1680	VC_redist.x64.exe
2296	VC_redist.x64.exe
3752	aspnetcore-runtime-8.0.29-win-x64 (1).exe
2912	MsiExec.exe
1760	AspNetCoreSharedFrameworkBundle-x64.exe
5884	windowsdesktop-runtime-9.0.18-win-x64.exe
5344	windowsdesktop-runtime-9.0.18-win-x64.exe
5168	MsiExec.exe
5168	MsiExec.exe
4696	MsiExec.exe
5104	windowsdesktop-runtime-9.0.18-win-x64.exe
4696	MsiExec.exe
5400	MsiExec.exe
5400	MsiExec.exe
2216	MsiExec.exe
2216	MsiExec.exe
5608	MsiExec.exe
5608	MsiExec.exe
3284	MsiExec.exe
3284	MsiExec.exe
4696	MsiExec.exe
4696	MsiExec.exe
5416	Xeno.exe
5416	Xeno.exe
5416	Xeno.exe
5416	Xeno.exe
5416	Xeno.exe
5416	Xeno.exe
5416	Xeno.exe
5416	Xeno.exe
5416	Xeno.exe
5416	Xeno.exe
5416	Xeno.exe
5416	Xeno.exe
5416	Xeno.exe
5416	Xeno.exe
5416	Xeno.exe
5416	Xeno.exe
5416	Xeno.exe
5416	Xeno.exe
5416	Xeno.exe
5416	Xeno.exe
5416	Xeno.exe
5416	Xeno.exe
5416	Xeno.exe
5416	Xeno.exe
5416	Xeno.exe
5416	Xeno.exe
5416	Xeno.exe
5416	Xeno.exe
5416	Xeno.exe
5416	Xeno.exe
5416	Xeno.exe
5416	Xeno.exe
5416	Xeno.exe
5416	Xeno.exe
5416	Xeno.exe
5416	Xeno.exe
5416	Xeno.exe
5416	Xeno.exe
5416	Xeno.exe
5416	Xeno.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0} = "\"C:\\ProgramData\\Package Cache\\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\\VC_redist.x64.exe\" /burn.runonce"	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{6458568f-cbe1-43bf-b480-1b3901bc4c87} = "\"C:\\ProgramData\\Package Cache\\{6458568f-cbe1-43bf-b480-1b3901bc4c87}\\AspNetCoreSharedFrameworkBundle-x64.exe\" /burn.runonce"	AspNetCoreSharedFrameworkBundle-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{b21e7fe8-9175-483b-a67f-0fd948722740} = "\"C:\\ProgramData\\Package Cache\\{b21e7fe8-9175-483b-a67f-0fd948722740}\\windowsdesktop-runtime-9.0.18-win-x64.exe\" /burn.runonce"	windowsdesktop-runtime-9.0.18-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{b21e7fe8-9175-483b-a67f-0fd948722740} = "\"C:\\ProgramData\\Package Cache\\{b21e7fe8-9175-483b-a67f-0fd948722740}\\windowsdesktop-runtime-9.0.18-win-x64.exe\" /burn.runonce"	windowsdesktop-runtime-9.0.18-win-x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
321	discord.com
325	raw.githubusercontent.com
326	raw.githubusercontent.com
328	raw.githubusercontent.com
318	discord.com
319	discord.com

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in System32 directory 51 IoCs

description	ioc	Process
File created	C:\Windows\system32\mfc140esn.dll	msiexec.exe
File created	C:\Windows\system32\mfc140kor.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcruntime140_1.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_2.dll	msiexec.exe
File created	C:\Windows\system32\vccorlib140.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140_threads.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140esn.dll	msiexec.exe
File created	C:\Windows\system32\mfc140enu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcamp140.dll	msiexec.exe
File created	C:\Windows\system32\vcamp140.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140_1.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140cht.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140fra.dll	msiexec.exe
File created	C:\Windows\system32\mfc140cht.dll	msiexec.exe
File created	C:\Windows\system32\mfc140jpn.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_1.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_atomic_wait.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcomp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140deu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140jpn.dll	msiexec.exe
File created	C:\Windows\system32\mfc140.dll	msiexec.exe
File created	C:\Windows\system32\mfc140chs.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcruntime140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_2.dll	msiexec.exe
File created	C:\Windows\system32\mfc140deu.dll	msiexec.exe
File created	C:\Windows\system32\mfc140fra.dll	msiexec.exe
File created	C:\Windows\system32\mfc140u.dll	msiexec.exe
File created	C:\Windows\system32\concrt140.dll	msiexec.exe
File created	C:\Windows\system32\mfcm140.dll	msiexec.exe
File created	C:\Windows\system32\mfcm140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140chs.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_codecvt_ids.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vccorlib140.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_atomic_wait.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140ita.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140kor.dll	msiexec.exe
File opened for modification	C:\Windows\system32\concrt140.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_1.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_codecvt_ids.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140rus.dll	msiexec.exe
File created	C:\Windows\system32\mfc140ita.dll	msiexec.exe
File created	C:\Windows\system32\mfc140rus.dll	msiexec.exe
File created	C:\Windows\system32\vcomp140.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140enu.dll	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\it\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\pl\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6004_762053049\hyph-de-1996.hyb	msedgewebview2.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.18\System.IO.Compression.FileSystem.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.18\System.Xml.XPath.XDocument.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\pl\UIAutomationTypes.resources.dll	msiexec.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6004_762053049\hyph-tk.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5920_1755599114\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6004_1431297067\Part-FR	msedgewebview2.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.18\System.Private.DataContractSerialization.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\tr\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\es\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\zh-Hans\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\System.Windows.Forms.Primitives.dll	msiexec.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6004_762053049\hyph-as.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6004_762053049\hyph-te.hyb	msedgewebview2.exe
File created	C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App\8.0.29\Microsoft.AspNetCore.WebSockets.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.18\System.Diagnostics.Process.dll	msiexec.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6004_762053049\hyph-et.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6592_437462085\manifest.json	msedge.exe
File created	C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App\8.0.29\Microsoft.AspNetCore.Mvc.RazorPages.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App\8.0.29\Microsoft.Extensions.FileSystemGlobbing.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\DirectWriteForwarder.dll	msiexec.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5920_1238793757\smart_switch_list.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6004_1431297067\Filtering Rules-CA	msedgewebview2.exe
File created	C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App\8.0.29\Microsoft.Extensions.Configuration.FileExtensions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App\8.0.29\Microsoft.AspNetCore.HttpsPolicy.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\pt-BR\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\ru\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\ru\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\ja\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\es\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\it\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App\8.0.29\Microsoft.AspNetCore.Mvc.Cors.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App\8.0.29\Microsoft.Extensions.Logging.EventSource.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App\8.0.29\Microsoft.AspNetCore.ResponseCaching.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App\8.0.29\Microsoft.AspNetCore.Components.Web.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\System.Windows.Forms.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\ja\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\es\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\ja\WindowsBase.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App\8.0.29\Microsoft.AspNetCore.Authentication.BearerToken.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App\8.0.29\Microsoft.AspNetCore.ResponseCompression.dll	msiexec.exe
File created	C:\Program Files\dotnet\dotnet.exe	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\pl\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6592_248391499\manifest.json	msedge.exe
File created	C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App\8.0.29\Microsoft.AspNetCore.Components.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\ru\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.18\System.Runtime.Handles.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\de\UIAutomationTypes.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\ja\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\pl\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6004_762053049\hyph-bn.hyb	msedgewebview2.exe
File created	C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App\8.0.29\Microsoft.Extensions.Options.ConfigurationExtensions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App\8.0.29\Microsoft.Extensions.Logging.Configuration.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.18\System.Threading.ThreadPool.dll	msiexec.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5920_1755599114\nav_config.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6004_167882096\kp_pinslist.pb	msedgewebview2.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.18\System.Xml.XmlDocument.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.18\System.IO.IsolatedStorage.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.18\System.Text.RegularExpressions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.18\System.ComponentModel.Annotations.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\pt-BR\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\zh-Hans\UIAutomationTypes.resources.dll	msiexec.exe

Drops file in Windows directory 62 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSIEA10.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{35EC5E45-F900-4AE8-B6FC-E96FB9249F74}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAD9.tmp	msiexec.exe
File created	C:\Windows\Installer\e5ef9be.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5ef9be.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE22F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFEB7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5ef9a3.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI683.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5ef9b9.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{290D3A76-E4EC-3BEB-8012-7EE137801844}	msiexec.exe
File created	C:\Windows\Installer\e5ef9c2.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149\fileCoreHostExe	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\e5ef9bd.msi	msiexec.exe
File created	C:\Windows\Installer\e5ef990.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFD2A.tmp	msiexec.exe
File created	C:\Windows\Installer\e5ef9b8.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF634.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{EDFAA9B4-1B98-43B0-95C5-6010790950B5}	msiexec.exe
File created	C:\Windows\Installer\SourceHash{B9CB3C69-65ED-445D-A35F-38FCC2058C35}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1678.tmp	msiexec.exe
File created	C:\Windows\Installer\e5ef9a3.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID53D.tmp	msiexec.exe
File created	C:\Windows\Installer\e5ef9c3.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1CA7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI77.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5ef9c8.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF399.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI17A1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5ef990.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\e5ef9cf.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5ef9cf.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF9B0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5ef9c3.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFB5B.tmp	msiexec.exe
File created	C:\Windows\Installer\e5ef9b9.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF26F.tmp	msiexec.exe
File created	C:\Windows\Installer\e5ef9d3.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF72.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1C48.tmp	msiexec.exe
File created	C:\Windows\Installer\e5ef9c8.msi	msiexec.exe
File created	C:\Windows\Installer\e5ef9ce.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF80E.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{6FA797CF-6B76-4B6D-87EE-768F92008720}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE906.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIECF0.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{931A2CF0-2404-45EA-82F5-345735AE6A90}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID210.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2479.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI24E7.tmp	msiexec.exe
File created	C:\Windows\Installer\e5ef9a2.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{0CADB010-02E6-4833-B505-BD81F85D0915}	msiexec.exe
File created	C:\Windows\Installer\e5ef9c7.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149\fileCoreHostExe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1800.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1B6C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2032.tmp	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 34 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AspNetCoreSharedFrameworkBundle-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-9.0.18-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnetcore-runtime-8.0.29-win-x64 (1).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-9.0.18-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AspNetCoreSharedFrameworkBundle-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-9.0.18-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-9.0.18-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-9.0.18-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AspNetCoreSharedFrameworkBundle-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-9.0.18-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-9.0.18-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnetcore-runtime-8.0.29-win-x64 (1).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-9.0.18-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AspNetCoreSharedFrameworkBundle-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-9.0.18-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

System Time Discovery 1 TTPs 6 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2880	chrome.exe
892	aspnetcore-runtime-8.0.29-win-x64 (1).exe
3752	aspnetcore-runtime-8.0.29-win-x64 (1).exe
1840	msedge.exe
5648	msedge.exe
6444	msedge.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ee0681d78f5363a20000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000ee0681d70000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900ee0681d7000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1aee0681d7000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dee0681d7000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 15 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 33 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2d	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\30	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\30	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\32	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\31	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2B\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2f	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\32	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2D	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2F	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\31	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\33	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2C\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2e	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2E	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134301876284538822"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0FC2A1394042AE54285F437553EAA609	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{6458568f-cbe1-43bf-b480-1b3901bc4c87}\Dependents	AspNetCoreSharedFrameworkBundle-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FC797AF667B6D6B478EE67F829007802\Version = "238259607"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\010BDAC06E2033845B50DB188FD59051\PackageCode = "E65350071DC5D4947B27B36EF90204B9"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{b21e7fe8-9175-483b-a67f-0fd948722740}\DisplayName = "Microsoft Windows Desktop Runtime - 9.0.18 (x64)"	windowsdesktop-runtime-9.0.18-win-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_72.72.55158_x64\Version = "72.72.55158"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0FC2A1394042AE54285F437553EAA609\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{931A2CF0-2404-45EA-82F5-345735AE6A90}v14.51.36247\\packages\\vcRuntimeMinimum_amd64\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FC797AF667B6D6B478EE67F829007802\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{6458568f-cbe1-43bf-b480-1b3901bc4c87}\Dependents\{6458568f-cbe1-43bf-b480-1b3901bc4c87}	AspNetCoreSharedFrameworkBundle-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_72.72.55185_x64\Dependents\{b21e7fe8-9175-483b-a67f-0fd948722740}	windowsdesktop-runtime-9.0.18-win-x64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{0B4B9514-A9B2-4C08-A782-5B020A6867CF}	msedge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FC797AF667B6D6B478EE67F829007802\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\67A3D092CE4EBEB30821E71E73088144\FT_ProductInfo	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_72.72.55158_x64	windowsdesktop-runtime-9.0.18-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\Dependents\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}	VC_redist.x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\67A3D092CE4EBEB30821E71E73088144	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{b21e7fe8-9175-483b-a67f-0fd948722740}\Version = "9.0.18.36217"	windowsdesktop-runtime-9.0.18-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4B9AAFDE89B10B34595C06019790055B\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\010BDAC06E2033845B50DB188FD59051\ProductName = "Microsoft .NET Host FX Resolver - 9.0.18 (x64)"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FC797AF667B6D6B478EE67F829007802\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{b21e7fe8-9175-483b-a67f-0fd948722740}\Dependents\{b21e7fe8-9175-483b-a67f-0fd948722740}	windowsdesktop-runtime-9.0.18-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4B9AAFDE89B10B34595C06019790055B\SourceList\PackageName = "dotnet-runtime-9.0.18-win-x64.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_72.72.55158_x64\Dependents\{b21e7fe8-9175-483b-a67f-0fd948722740}	windowsdesktop-runtime-9.0.18-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\09A86F63C932FD435BC8463B1035EC53	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\09A86F63C932FD435BC8463B1035EC53\0FC2A1394042AE54285F437553EAA609	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4B9AAFDE89B10B34595C06019790055B\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_72.72.55185_x64\Version = "72.72.55185"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\67A3D092CE4EBEB30821E71E73088144\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\010BDAC06E2033845B50DB188FD59051	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\010BDAC06E2033845B50DB188FD59051\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\54E5CE53009F8EA46BCF9EF69B42F947\Version = "1212733302"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\09A86F63C932FD435BC8463B1035EC53	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0FC2A1394042AE54285F437553EAA609\SourceList\Media\1 = ";"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FC797AF667B6D6B478EE67F829007802\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{6FA797CF-6B76-4B6D-87EE-768F92008720}v14.51.36247\\packages\\vcRuntimeAdditional_amd64\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\14A921B74F157796319B9A1F31F508AB\4B9AAFDE89B10B34595C06019790055B	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\010BDAC06E2033845B50DB188FD59051\SourceList\PackageName = "dotnet-hostfxr-9.0.18-win-x64.msi"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\54E5CE53009F8EA46BCF9EF69B42F947\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_9.0_x64\Dependents	windowsdesktop-runtime-9.0.18-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0FC2A1394042AE54285F437553EAA609\ProductName = "Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.51.36247"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0FC2A1394042AE54285F437553EAA609\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\67A3D092CE4EBEB30821E71E73088144\Version = "134217757"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\67A3D092CE4EBEB30821E71E73088144\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{9A2823C6-0DDF-4879-923B-BF933D266D4F}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\010BDAC06E2033845B50DB188FD59051	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96C3BC9BDE56D5443AF583CF2C50C853\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{6458568f-cbe1-43bf-b480-1b3901bc4c87}	AspNetCoreSharedFrameworkBundle-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\67A3D092CE4EBEB30821E71E73088144\ProductName = "Microsoft ASP.NET Core 8.0.29 Shared Framework (x64)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_9.0_x64\ = "{35EC5E45-F900-4AE8-B6FC-E96FB9249F74}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\dotnet_runtime_72.72.55158_x64	windowsdesktop-runtime-9.0.18-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_72.72.55185_x64\ = "{B9CB3C69-65ED-445D-A35F-38FCC2058C35}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.51,bundle\Dependents\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}	VC_redist.x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\0FC2A1394042AE54285F437553EAA609	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3693C0A713552476F4E3AD22D8059B9B\010BDAC06E2033845B50DB188FD59051	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{b21e7fe8-9175-483b-a67f-0fd948722740}\Version = "9.0.18.36217"	windowsdesktop-runtime-9.0.18-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_72.72.55158_x64\DisplayName = "Microsoft .NET Host FX Resolver - 9.0.18 (x64)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_9.0_x64\DisplayName = "Microsoft .NET Host - 9.0.18 (x64)"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96C3BC9BDE56D5443AF583CF2C50C853\SourceList\Media	msiexec.exe

Suspicious behavior: EnumeratesProcesses 40 IoCs

pid	Process
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
2120	chrome.exe
2120	chrome.exe
2096	msiexec.exe
2096	msiexec.exe
2096	msiexec.exe
2096	msiexec.exe
2096	msiexec.exe
2096	msiexec.exe
2096	msiexec.exe
2096	msiexec.exe
2096	msiexec.exe
2096	msiexec.exe
2096	msiexec.exe
2096	msiexec.exe
2096	msiexec.exe
2096	msiexec.exe
2096	msiexec.exe
2096	msiexec.exe
2096	msiexec.exe
2096	msiexec.exe
2096	msiexec.exe
2096	msiexec.exe
2096	msiexec.exe
2096	msiexec.exe
2096	msiexec.exe
2096	msiexec.exe
5416	Xeno.exe
5416	Xeno.exe
3980	msedge.exe
3980	msedge.exe
3976	msedgewebview2.exe
3976	msedgewebview2.exe
6592	msedge.exe
6592	msedge.exe
6168	msedge.exe
6168	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 31 IoCs

pid	Process
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
3688	chrome.exe
5920	msedge.exe
5920	msedge.exe
6004	msedgewebview2.exe
5920	msedge.exe
5920	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
4996	VC_redist.x64.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3688 wrote to memory of 5000	3688	chrome.exe	86
PID 3688 wrote to memory of 3892	3688	chrome.exe	87
PID 3688 wrote to memory of 2880	3688	chrome.exe	88
PID 3688 wrote to memory of 3892	3688	chrome.exe	87
PID 3688 wrote to memory of 4924	3688	chrome.exe	89
PID 3688 wrote to memory of 4924	3688	chrome.exe	89
PID 3688 wrote to memory of 3308	3688	chrome.exe	91
PID 3688 wrote to memory of 3308	3688	chrome.exe	91
PID 3688 wrote to memory of 1580	3688	chrome.exe	92
PID 3688 wrote to memory of 1580	3688	chrome.exe	92
PID 3688 wrote to memory of 4364	3688	chrome.exe	93
PID 3688 wrote to memory of 4364	3688	chrome.exe	93
PID 3688 wrote to memory of 396	3688	chrome.exe	95
PID 3688 wrote to memory of 3868	3688	chrome.exe	100
PID 3688 wrote to memory of 3868	3688	chrome.exe	100
PID 3688 wrote to memory of 1732	3688	chrome.exe	101
PID 3688 wrote to memory of 1732	3688	chrome.exe	101
PID 3688 wrote to memory of 3976	3688	chrome.exe	106
PID 3688 wrote to memory of 3976	3688	chrome.exe	106
PID 3688 wrote to memory of 3624	3688	chrome.exe	107
PID 3688 wrote to memory of 4188	3688	chrome.exe	114
PID 3688 wrote to memory of 2520	3688	chrome.exe	115
PID 3688 wrote to memory of 560	3688	chrome.exe	116
PID 3688 wrote to memory of 2912	3688	chrome.exe	120
PID 3688 wrote to memory of 2912	3688	chrome.exe	120
PID 3688 wrote to memory of 3064	3688	chrome.exe	121
PID 3688 wrote to memory of 3064	3688	chrome.exe	121
PID 3688 wrote to memory of 2164	3688	chrome.exe	122
PID 3688 wrote to memory of 2164	3688	chrome.exe	122
PID 3688 wrote to memory of 1304	3688	chrome.exe	123
PID 3688 wrote to memory of 1304	3688	chrome.exe	123
PID 3688 wrote to memory of 2120	3688	chrome.exe	124
PID 3688 wrote to memory of 4944	3688	chrome.exe	125
PID 3688 wrote to memory of 4944	3688	chrome.exe	125
PID 3688 wrote to memory of 4664	3688	chrome.exe	129
PID 3688 wrote to memory of 4664	3688	chrome.exe	129
PID 3688 wrote to memory of 1832	3688	chrome.exe	130
PID 3688 wrote to memory of 1832	3688	chrome.exe	130
PID 3688 wrote to memory of 812	3688	chrome.exe	131
PID 3688 wrote to memory of 812	3688	chrome.exe	131
PID 3688 wrote to memory of 4552	3688	chrome.exe	132
PID 3688 wrote to memory of 4552	3688	chrome.exe	132
PID 3688 wrote to memory of 3752	3688	chrome.exe	133
PID 3688 wrote to memory of 3752	3688	chrome.exe	133
PID 3688 wrote to memory of 1436	3688	chrome.exe	140
PID 3688 wrote to memory of 1436	3688	chrome.exe	140
PID 3688 wrote to memory of 1408	3688	chrome.exe	141
PID 3688 wrote to memory of 3324	3688	chrome.exe	142
PID 3324 wrote to memory of 4520	3324	VC_redist.x64.exe	144
PID 3688 wrote to memory of 4228	3688	chrome.exe	145
PID 4228 wrote to memory of 4996	4228	VC_redist.x64.exe	146
PID 4996 wrote to memory of 2692	4996	VC_redist.x64.exe	147
PID 5116 wrote to memory of 2876	5116	VC_redist.x64.exe	158
PID 2876 wrote to memory of 2296	2876	VC_redist.x64.exe	159
PID 2692 wrote to memory of 4000	2692	VC_redist.x64.exe	160
PID 4000 wrote to memory of 1680	4000	VC_redist.x64.exe	161
PID 1680 wrote to memory of 4936	1680	VC_redist.x64.exe	162
PID 3688 wrote to memory of 1252	3688	chrome.exe	165
PID 3688 wrote to memory of 1252	3688	chrome.exe	165
PID 3688 wrote to memory of 1804	3688	chrome.exe	166
PID 3688 wrote to memory of 1804	3688	chrome.exe	166
PID 3688 wrote to memory of 2344	3688	chrome.exe	167
PID 3688 wrote to memory of 2344	3688	chrome.exe	167
PID 3688 wrote to memory of 372	3688	chrome.exe	168

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.xeno.now/downloads/Xeno-v1.3.55-d47d833e.zip
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xdc,0xe0,0xd4,0xd8,0x104,0x7ffab533c728,0x7ffab533c734,0x7ffab533c740
  2⤵
  PID:5000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1676,i,14155636374361743984,15722920451873912396,262144 --field-trial-handle=2132,i,1446014166966637666,15083760368454363428,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:3892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1564,i,3664045065532742591,4047821377618728947,524288 --field-trial-handle=2132,i,1446014166966637666,15083760368454363428,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2160 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:2880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2296,i,14854792213386058031,18337132059852947465,524288 --field-trial-handle=2132,i,1446014166966637666,15083760368454363428,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2452 /prefetch:8
  2⤵
  PID:4924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3212,i,15638416798675520486,12679593333245635954,2097152 --field-trial-handle=2132,i,1446014166966637666,15083760368454363428,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:3308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3216,i,6177889826115241825,14969354977179754709,2097152 --field-trial-handle=2132,i,1446014166966637666,15083760368454363428,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:1580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4304,i,4398373751281589881,4125631201621300951,2097152 --field-trial-handle=2132,i,1446014166966637666,15083760368454363428,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4316 /prefetch:2
  2⤵
  PID:4364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5320,i,12718136054214580723,16683002888114547044,524288 --field-trial-handle=2132,i,1446014166966637666,15083760368454363428,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5324 /prefetch:8
  2⤵
  PID:396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5488,i,13786987622575001336,14980355426650446465,2097152 --field-trial-handle=2132,i,1446014166966637666,15083760368454363428,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5476 /prefetch:1
  2⤵
  PID:3868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5700,i,13939156268202985204,17233054523935235934,2097152 --field-trial-handle=2132,i,1446014166966637666,15083760368454363428,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5708 /prefetch:1
  2⤵
  PID:1732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5984,i,11675312086197373526,1291010343992986088,2097152 --field-trial-handle=2132,i,1446014166966637666,15083760368454363428,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3592 /prefetch:1
  2⤵
  PID:3976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5700,i,2627600069051987331,8585834042467878167,524288 --field-trial-handle=2132,i,1446014166966637666,15083760368454363428,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3620 /prefetch:8
  2⤵
  PID:3624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6036,i,13807254204621819679,9186817942821550642,524288 --field-trial-handle=2132,i,1446014166966637666,15083760368454363428,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2428 /prefetch:8
  2⤵
  PID:4188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=1524,i,17662688441866989780,7535651028608710687,524288 --field-trial-handle=2132,i,1446014166966637666,15083760368454363428,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6040 /prefetch:8
  2⤵
  PID:2520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5600,i,12777613176318128474,7827181352679529840,524288 --field-trial-handle=2132,i,1446014166966637666,15083760368454363428,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6168 /prefetch:8
  2⤵
  PID:560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6372,i,15325524222579030827,6921802501134097834,2097152 --field-trial-handle=2132,i,1446014166966637666,15083760368454363428,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6396 /prefetch:1
  2⤵
  PID:2912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6528,i,6872114011952161653,2575671631649426204,2097152 --field-trial-handle=2132,i,1446014166966637666,15083760368454363428,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6332 /prefetch:1
  2⤵
  PID:3064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6500,i,3906159391522107669,13171619682696362140,2097152 --field-trial-handle=2132,i,1446014166966637666,15083760368454363428,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6340 /prefetch:1
  2⤵
  PID:2164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6424,i,10680505893715332617,5054262299418327703,2097152 --field-trial-handle=2132,i,1446014166966637666,15083760368454363428,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6492 /prefetch:1
  2⤵
  PID:1304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3252,i,1732951938285554735,10183068622965680486,262144 --field-trial-handle=2132,i,1446014166966637666,15083760368454363428,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4692 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4692,i,10244714236183238896,9577118617896848744,524288 --field-trial-handle=2132,i,1446014166966637666,15083760368454363428,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3256 /prefetch:8
  2⤵
  PID:4944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4692,i,14830429018465397706,4238769395811795215,524288 --field-trial-handle=2132,i,1446014166966637666,15083760368454363428,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5420 /prefetch:8
  2⤵
  PID:4664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6684,i,7353668952321035608,13135632877261967430,2097152 --field-trial-handle=2132,i,1446014166966637666,15083760368454363428,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6664 /prefetch:1
  2⤵
  PID:1832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6820,i,7021976191217928603,14127550542082334375,2097152 --field-trial-handle=2132,i,1446014166966637666,15083760368454363428,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6832 /prefetch:1
  2⤵
  PID:812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=3372,i,17566904804226042948,9509599787607584705,2097152 --field-trial-handle=2132,i,1446014166966637666,15083760368454363428,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6672 /prefetch:1
  2⤵
  PID:4552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6856,i,17920621784620226830,9348972191523659528,2097152 --field-trial-handle=2132,i,1446014166966637666,15083760368454363428,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:3752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=6352,i,6870535704955620736,81882572150444544,2097152 --field-trial-handle=2132,i,1446014166966637666,15083760368454363428,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6524 /prefetch:1
  2⤵
  PID:1436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5460,i,4097983793032585074,11067513854869660920,524288 --field-trial-handle=2132,i,1446014166966637666,15083760368454363428,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7096 /prefetch:8
  2⤵
  PID:1408
- C:\Users\Admin\Downloads\VC_redist.x64.exe
  "C:\Users\Admin\Downloads\VC_redist.x64.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3324
- - C:\Windows\Temp\{8D07D3ED-CA83-4894-BFDE-B3B1C175C739}\.cr\VC_redist.x64.exe
    "C:\Windows\Temp\{8D07D3ED-CA83-4894-BFDE-B3B1C175C739}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\Users\Admin\Downloads\VC_redist.x64.exe" -burn.filehandle.attached=716 -burn.filehandle.self=720
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:4520
- C:\Users\Admin\Downloads\VC_redist.x64.exe
  "C:\Users\Admin\Downloads\VC_redist.x64.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4228
- - C:\Windows\Temp\{984EF7E1-C70D-4454-87E8-8DCF8A1E9D50}\.cr\VC_redist.x64.exe
    "C:\Windows\Temp\{984EF7E1-C70D-4454-87E8-8DCF8A1E9D50}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\Users\Admin\Downloads\VC_redist.x64.exe" -burn.filehandle.attached=688 -burn.filehandle.self=692
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4996
  - - C:\Windows\Temp\{B4A5A59B-716A-422C-B023-D332FBD768E7}\.be\VC_redist.x64.exe
      "C:\Windows\Temp\{B4A5A59B-716A-422C-B023-D332FBD768E7}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{9580CCB0-7994-491D-B8DD-B5EAABDCF427} {3D2263CA-2ED1-4B25-AD71-392D0AE54FF1} 4996
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:2692
    - - C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={0e3bb569-69d6-4c34-bff9-c2f81db5e5f0} -burn.filehandle.self=1068 -burn.embedded BurnPipe.{CB35CABD-477A-4BB2-BD1F-4E7442173436} {6D0C1130-EABD-479B-84EE-7E276668249B} 2692
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4000
      - C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=516 -burn.filehandle.self=536 -uninstall -quiet -burn.related.upgrade -burn.ancestors={0e3bb569-69d6-4c34-bff9-c2f81db5e5f0} -burn.filehandle.self=1068 -burn.embedded BurnPipe.{CB35CABD-477A-4BB2-BD1F-4E7442173436} {6D0C1130-EABD-479B-84EE-7E276668249B} 2692
        6⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1680
        
        C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{259113A6-DD24-4B31-99B9-E0A383E33168} {BBEF0640-B757-4883-93FA-379E31B9F6E9} 1680
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=6444,i,10874434545503334725,15266320725030477343,2097152 --field-trial-handle=2132,i,1446014166966637666,15083760368454363428,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3644 /prefetch:1
  2⤵
  PID:1252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=6408,i,7916930308129713649,10489279356505663627,2097152 --field-trial-handle=2132,i,1446014166966637666,15083760368454363428,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:1804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=6876,i,11910869727039995892,9715691053744396209,2097152 --field-trial-handle=2132,i,1446014166966637666,15083760368454363428,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6932 /prefetch:1
  2⤵
  PID:2344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=7124,i,16021482163282940043,8998120220284763260,2097152 --field-trial-handle=2132,i,1446014166966637666,15083760368454363428,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7140 /prefetch:1
  2⤵
  PID:372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2428,i,6419087388845894061,17381323959893224738,524288 --field-trial-handle=2132,i,1446014166966637666,15083760368454363428,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1524 /prefetch:8
  2⤵
  PID:3624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --metrics-shmem-handle=6180,i,5548094608418808758,2350243119766739714,524288 --field-trial-handle=2132,i,1446014166966637666,15083760368454363428,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2428 /prefetch:8
  2⤵
  PID:2584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --metrics-shmem-handle=7128,i,2567630380586201543,7779113942350301668,524288 --field-trial-handle=2132,i,1446014166966637666,15083760368454363428,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5832 /prefetch:8
  2⤵
  PID:2996
- C:\Users\Admin\Downloads\aspnetcore-runtime-8.0.29-win-x64 (1).exe
  "C:\Users\Admin\Downloads\aspnetcore-runtime-8.0.29-win-x64 (1).exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Time Discovery
  PID:892
- - C:\Windows\Temp\{7C8CE3A5-F29D-4453-979D-9BE13C35CBA6}\.cr\aspnetcore-runtime-8.0.29-win-x64 (1).exe
    "C:\Windows\Temp\{7C8CE3A5-F29D-4453-979D-9BE13C35CBA6}\.cr\aspnetcore-runtime-8.0.29-win-x64 (1).exe" -burn.clean.room="C:\Users\Admin\Downloads\aspnetcore-runtime-8.0.29-win-x64 (1).exe" -burn.filehandle.attached=716 -burn.filehandle.self=720
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - System Time Discovery
    PID:3752
  - - C:\Windows\Temp\{AF976ABF-7F32-456B-A0E5-29FB07665F3A}\.be\AspNetCoreSharedFrameworkBundle-x64.exe
      "C:\Windows\Temp\{AF976ABF-7F32-456B-A0E5-29FB07665F3A}\.be\AspNetCoreSharedFrameworkBundle-x64.exe" -q -burn.elevated BurnPipe.{6137CB1C-5399-4A57-BFD6-5AE8CCA300CE} {62F6A0B8-B928-4DBA-9498-35E8A1C94195} 3752
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:3040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=3388,i,8589166877941781384,14144814105678622327,2097152 --field-trial-handle=2132,i,1446014166966637666,15083760368454363428,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6040 /prefetch:1
  2⤵
  PID:5716

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2232

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3864

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2656

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_Xeno-v1.3.55-d47d833e.zip\Xeno-v1.3.55\ReadMe.txt
1⤵
PID:4380

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:4968

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
PID:556

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2096
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 52E3D74303223E066FD7E6663C2E88F7
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2912
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding B6D233774B494BCE179D78D87BB099D1
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5168
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 1E71CF6CEB811C4EC59E5D06CC1BA154
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4696
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding F6C03C85527D6087D04F230322432DB6
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5400
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding BEBE37BF5DB2D78B7BA57D83B2A58324
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2216
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 59A5FBEF0496FD4A75891FA391C95ED6
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5608
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 1C3A929CA37DF50D44D2948CBC10E1B3
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3284
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding EABBC249C5CC99F74DF9B07383B59132
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4696

C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe
"C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe" /burn.runonce
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5116
- C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe
  "C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260803004655.log"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2876
- - C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe
    "C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe" -burn.filehandle.attached=520 -burn.filehandle.self=540 /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260803004655.log"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2296

C:\ProgramData\Package Cache\{6458568f-cbe1-43bf-b480-1b3901bc4c87}\AspNetCoreSharedFrameworkBundle-x64.exe
"C:\ProgramData\Package Cache\{6458568f-cbe1-43bf-b480-1b3901bc4c87}\AspNetCoreSharedFrameworkBundle-x64.exe" /burn.runonce
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2952
- C:\ProgramData\Package Cache\{6458568f-cbe1-43bf-b480-1b3901bc4c87}\AspNetCoreSharedFrameworkBundle-x64.exe
  "C:\ProgramData\Package Cache\{6458568f-cbe1-43bf-b480-1b3901bc4c87}\AspNetCoreSharedFrameworkBundle-x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_dd_AspNetCoreSharedFramework___20260803004809.log"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4684
- - C:\ProgramData\Package Cache\{6458568f-cbe1-43bf-b480-1b3901bc4c87}\AspNetCoreSharedFrameworkBundle-x64.exe
    "C:\ProgramData\Package Cache\{6458568f-cbe1-43bf-b480-1b3901bc4c87}\AspNetCoreSharedFrameworkBundle-x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{6458568f-cbe1-43bf-b480-1b3901bc4c87}\AspNetCoreSharedFrameworkBundle-x64.exe" -burn.filehandle.attached=520 -burn.filehandle.self=540 /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_dd_AspNetCoreSharedFramework___20260803004809.log"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:1760

C:\Users\Admin\Downloads\Xeno-v1.3.55-d47d833e\Xeno-v1.3.55\Xeno.exe
"C:\Users\Admin\Downloads\Xeno-v1.3.55-d47d833e\Xeno-v1.3.55\Xeno.exe"
1⤵
PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.NETCore.App&framework_version=9.0.0&arch=x64&rid=win-x64&os=win10&gui=true
  2⤵
  PID:4596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.NETCore.App&framework_version=9.0.0&arch=x64&rid=win-x64&os=win10&gui=true
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    PID:720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x25c,0x7ffaa301c188,0x7ffaa301c194,0x7ffaa301c1a0
      4⤵
      PID:1556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1904,i,2500115392635225985,12805200939820117128,524288 --field-trial-handle=2256,i,9328787006798414981,8536995605337753554,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:3
      4⤵
      Downloads MZ/PE file
      System Time Discovery
      PID:1840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,7547897656279887050,1139179964918065872,262144 --field-trial-handle=2256,i,9328787006798414981,8536995605337753554,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:2
      4⤵
      PID:4944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2348,i,9744024889917398238,6376493360225633581,524288 --field-trial-handle=2256,i,9328787006798414981,8536995605337753554,262144 --variations-seed-version --mojo-platform-channel-handle=2580 /prefetch:8
      4⤵
      PID:1272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,16775717050324465239,13477756833305867195,2097152 --field-trial-handle=2256,i,9328787006798414981,8536995605337753554,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
      4⤵
      PID:4936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,1460010626290149309,13538761705025860095,2097152 --field-trial-handle=2256,i,9328787006798414981,8536995605337753554,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
      4⤵
      PID:4816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4216,i,12300007722684343780,1230782351838055657,2097152 --field-trial-handle=2256,i,9328787006798414981,8536995605337753554,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:1
      4⤵
      PID:1076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4232,i,7623106102482549046,5464781542806278103,2097152 --field-trial-handle=2256,i,9328787006798414981,8536995605337753554,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:2
      4⤵
      PID:2376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,11217133199612177886,6999129424833088508,524288 --field-trial-handle=2256,i,9328787006798414981,8536995605337753554,262144 --variations-seed-version --mojo-platform-channel-handle=3400 /prefetch:8
      4⤵
      PID:5524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5236,i,753967874798486621,3097851544878026968,524288 --field-trial-handle=2256,i,9328787006798414981,8536995605337753554,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:8
      4⤵
      PID:5608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5360,i,12345931875098019111,281976751781901673,2097152 --field-trial-handle=2256,i,9328787006798414981,8536995605337753554,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:1
      4⤵
      PID:5996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3580,i,7605235808325500198,3825114704341609158,524288 --field-trial-handle=2256,i,9328787006798414981,8536995605337753554,262144 --variations-seed-version --mojo-platform-channel-handle=3400 /prefetch:8
      4⤵
      PID:6088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3520,i,15781666041963610579,4487743518689389107,524288 --field-trial-handle=2256,i,9328787006798414981,8536995605337753554,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:8
      4⤵
      PID:6092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,15231547836330799407,2356953665847205201,524288 --field-trial-handle=2256,i,9328787006798414981,8536995605337753554,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
      4⤵
      PID:2456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,15231547836330799407,2356953665847205201,524288 --field-trial-handle=2256,i,9328787006798414981,8536995605337753554,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
      4⤵
      PID:5332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5768,i,14526017181569075238,16774744598747764100,524288 --field-trial-handle=2256,i,9328787006798414981,8536995605337753554,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:8
      4⤵
      PID:5936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6208,i,12855039710979358813,954346618841278573,524288 --field-trial-handle=2256,i,9328787006798414981,8536995605337753554,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:8
      4⤵
      PID:5176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6224,i,4868427930550554448,15690884401319929996,524288 --field-trial-handle=2256,i,9328787006798414981,8536995605337753554,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:8
      4⤵
      PID:5344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,12050282257490689566,12676996456428567378,524288 --field-trial-handle=2256,i,9328787006798414981,8536995605337753554,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:8
      4⤵
      PID:5428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6516,i,6395297563312923011,15776035739392844180,524288 --field-trial-handle=2256,i,9328787006798414981,8536995605337753554,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:8
      4⤵
      PID:5620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4856,i,11026207750948034361,5128215927301447045,524288 --field-trial-handle=2256,i,9328787006798414981,8536995605337753554,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:8
      4⤵
      PID:4188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6492,i,10328475928164087319,6997426191965837715,2097152 --field-trial-handle=2256,i,9328787006798414981,8536995605337753554,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:1
      4⤵
      PID:5180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6340,i,782060112415469727,14431370979042143584,524288 --field-trial-handle=2256,i,9328787006798414981,8536995605337753554,262144 --variations-seed-version --mojo-platform-channel-handle=6996 /prefetch:8
      4⤵
      PID:5932
  - - C:\Users\Admin\Downloads\windowsdesktop-runtime-9.0.18-win-x64.exe
      "C:\Users\Admin\Downloads\windowsdesktop-runtime-9.0.18-win-x64.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5760
    - - C:\Windows\Temp\{7A8A409C-FF00-48DD-89CE-79F13F870EC1}\.cr\windowsdesktop-runtime-9.0.18-win-x64.exe
        
        "C:\Windows\Temp\{7A8A409C-FF00-48DD-89CE-79F13F870EC1}\.cr\windowsdesktop-runtime-9.0.18-win-x64.exe" -burn.clean.room="C:\Users\Admin\Downloads\windowsdesktop-runtime-9.0.18-win-x64.exe" -burn.filehandle.attached=556 -burn.filehandle.self=692
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:5884
  - - C:\Users\Admin\Downloads\windowsdesktop-runtime-9.0.18-win-x64.exe
      "C:\Users\Admin\Downloads\windowsdesktop-runtime-9.0.18-win-x64.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5868
    - - C:\Windows\Temp\{499E25F5-B91F-4BC3-BE13-DD513FF9E04D}\.cr\windowsdesktop-runtime-9.0.18-win-x64.exe
        
        "C:\Windows\Temp\{499E25F5-B91F-4BC3-BE13-DD513FF9E04D}\.cr\windowsdesktop-runtime-9.0.18-win-x64.exe" -burn.clean.room="C:\Users\Admin\Downloads\windowsdesktop-runtime-9.0.18-win-x64.exe" -burn.filehandle.attached=556 -burn.filehandle.self=692
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:5344
      - C:\Windows\Temp\{3E804F69-6020-4364-9642-D6B8F4966240}\.be\windowsdesktop-runtime-9.0.18-win-x64.exe
        
        "C:\Windows\Temp\{3E804F69-6020-4364-9642-D6B8F4966240}\.be\windowsdesktop-runtime-9.0.18-win-x64.exe" -q -burn.elevated BurnPipe.{A72D9050-DBD2-4C3C-AC5C-B33DA41FC38E} {F5D11DF5-A341-427C-BBB8-5E2EC9078B6D} 5344
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5948

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2456

C:\ProgramData\Package Cache\{b21e7fe8-9175-483b-a67f-0fd948722740}\windowsdesktop-runtime-9.0.18-win-x64.exe
"C:\ProgramData\Package Cache\{b21e7fe8-9175-483b-a67f-0fd948722740}\windowsdesktop-runtime-9.0.18-win-x64.exe" /burn.runonce
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5564
- C:\ProgramData\Package Cache\{b21e7fe8-9175-483b-a67f-0fd948722740}\windowsdesktop-runtime-9.0.18-win-x64.exe
  "C:\ProgramData\Package Cache\{b21e7fe8-9175-483b-a67f-0fd948722740}\windowsdesktop-runtime-9.0.18-win-x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_9.0.18_(x64)_20260803004906.log"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1408
- - C:\ProgramData\Package Cache\{b21e7fe8-9175-483b-a67f-0fd948722740}\windowsdesktop-runtime-9.0.18-win-x64.exe
    "C:\ProgramData\Package Cache\{b21e7fe8-9175-483b-a67f-0fd948722740}\windowsdesktop-runtime-9.0.18-win-x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{b21e7fe8-9175-483b-a67f-0fd948722740}\windowsdesktop-runtime-9.0.18-win-x64.exe" -burn.filehandle.attached=532 -burn.filehandle.self=548 /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_9.0.18_(x64)_20260803004906.log"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:5104
  - - C:\ProgramData\Package Cache\{b21e7fe8-9175-483b-a67f-0fd948722740}\windowsdesktop-runtime-9.0.18-win-x64.exe
      "C:\ProgramData\Package Cache\{b21e7fe8-9175-483b-a67f-0fd948722740}\windowsdesktop-runtime-9.0.18-win-x64.exe" -q -burn.elevated BurnPipe.{47F03F69-E3FB-485D-819F-E0BDF32C0EFD} {ED89A2F8-0EE7-4391-8D3E-73AF55E0EEBD} 5104
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:5304

C:\Users\Admin\Downloads\Xeno-v1.3.55-d47d833e\Xeno-v1.3.55\Xeno.exe
"C:\Users\Admin\Downloads\Xeno-v1.3.55-d47d833e\Xeno-v1.3.55\Xeno.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:5416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/xe-no
  2⤵
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  PID:5920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2cc,0x2d0,0x2d4,0x2c8,0x31c,0x7ffaa301c188,0x7ffaa301c194,0x7ffaa301c1a0
    3⤵
    PID:5900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1848,i,2683261664666187453,7857064099802243779,524288 --field-trial-handle=2256,i,18308295591411667598,10357778663338850339,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:3
    3⤵
    - System Time Discovery
    PID:5648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1716,i,11729878510781760171,13491269818649298630,262144 --field-trial-handle=2256,i,18308295591411667598,10357778663338850339,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:2
    3⤵
    PID:6140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1956,i,6479519644612333794,8204625966764210283,524288 --field-trial-handle=2256,i,18308295591411667598,10357778663338850339,262144 --variations-seed-version --mojo-platform-channel-handle=2544 /prefetch:8
    3⤵
    PID:5772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3392,i,6929862718749273207,5036509128941284503,2097152 --field-trial-handle=2256,i,18308295591411667598,10357778663338850339,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
    3⤵
    PID:1840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3396,i,18153655657854596340,18223138680210113787,2097152 --field-trial-handle=2256,i,18308295591411667598,10357778663338850339,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
    3⤵
    PID:4704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4800,i,10057649663772647960,4985015989908033868,2097152 --field-trial-handle=2256,i,18308295591411667598,10357778663338850339,262144 --variations-seed-version --mojo-platform-channel-handle=4820 /prefetch:1
    3⤵
    PID:5696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5064,i,15513971843025092949,13652839692021103884,524288 --field-trial-handle=2256,i,18308295591411667598,10357778663338850339,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:8
    3⤵
    PID:6632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5004,i,4384938882555600335,15255668037949376399,524288 --field-trial-handle=2256,i,18308295591411667598,10357778663338850339,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:8
    3⤵
    PID:6624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3520,i,8409005160275903445,6343955423150874446,524288 --field-trial-handle=2256,i,18308295591411667598,10357778663338850339,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:8
    3⤵
    PID:6444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3532,i,13775783573416596017,17599422008628216187,524288 --field-trial-handle=2256,i,18308295591411667598,10357778663338850339,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:8
    3⤵
    PID:6452
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,8753591643752255738,14132821907234521819,524288 --field-trial-handle=2256,i,18308295591411667598,10357778663338850339,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:8
    3⤵
    PID:6616
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,8753591643752255738,14132821907234521819,524288 --field-trial-handle=2256,i,18308295591411667598,10357778663338850339,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:8
    3⤵
    PID:6772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5984,i,4981926974531321425,9404443828925433318,524288 --field-trial-handle=2256,i,18308295591411667598,10357778663338850339,262144 --variations-seed-version --mojo-platform-channel-handle=6784 /prefetch:8
    3⤵
    PID:6360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5996,i,9566193539621936206,3154716061135944802,524288 --field-trial-handle=2256,i,18308295591411667598,10357778663338850339,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:8
    3⤵
    PID:6424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5992,i,3338312731280692280,13246307538219110431,524288 --field-trial-handle=2256,i,18308295591411667598,10357778663338850339,262144 --variations-seed-version --mojo-platform-channel-handle=6900 /prefetch:8
    3⤵
    PID:6412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2820,i,9407083536849299210,8224616436819610950,524288 --field-trial-handle=2256,i,18308295591411667598,10357778663338850339,262144 --variations-seed-version --mojo-platform-channel-handle=6860 /prefetch:8
    3⤵
    PID:7000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,10664356646986166795,6047845014216692663,524288 --field-trial-handle=2256,i,18308295591411667598,10357778663338850339,262144 --variations-seed-version --mojo-platform-channel-handle=2016 /prefetch:8
    3⤵
    PID:6260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3280,i,278640422453918490,1511355482353191691,524288 --field-trial-handle=2256,i,18308295591411667598,10357778663338850339,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:8
    3⤵
    PID:6560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=864,i,17379993782970906138,14095277482009342208,524288 --field-trial-handle=2256,i,18308295591411667598,10357778663338850339,262144 --variations-seed-version --mojo-platform-channel-handle=6804 /prefetch:8
    3⤵
    PID:6532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6236,i,1666792359807686650,2752731616445974775,524288 --field-trial-handle=2256,i,18308295591411667598,10357778663338850339,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:8
    3⤵
    PID:7084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5352,i,15808007401388447713,8641914032215032746,262144 --field-trial-handle=2256,i,18308295591411667598,10357778663338850339,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6152,i,6338029079685433930,3390528324494202296,524288 --field-trial-handle=2256,i,18308295591411667598,10357778663338850339,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:8
    3⤵
    PID:4964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6648,i,12245218652616574541,7841692017050707925,524288 --field-trial-handle=2256,i,18308295591411667598,10357778663338850339,262144 --variations-seed-version --mojo-platform-channel-handle=4692 /prefetch:8
    3⤵
    PID:4032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Drops file in Program Files directory
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    PID:6592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffaa301c188,0x7ffaa301c194,0x7ffaa301c1a0
      4⤵
      PID:5956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1892,i,6608497266506684213,1813362196519486577,524288 --field-trial-handle=2272,i,14791393876193450028,5758507837652868951,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:3
      4⤵
      System Time Discovery
      PID:6444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1660,i,14604154366137822761,5449531020361028634,262144 --field-trial-handle=2272,i,14791393876193450028,5758507837652868951,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:2
      4⤵
      PID:6504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2608,i,18179661895245138040,15976852553838646617,524288 --field-trial-handle=2272,i,14791393876193450028,5758507837652868951,262144 --variations-seed-version --mojo-platform-channel-handle=2788 /prefetch:8
      4⤵
      PID:6240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4568,i,14243495959196067493,9264489906209173545,524288 --field-trial-handle=2272,i,14791393876193450028,5758507837652868951,262144 --variations-seed-version --mojo-platform-channel-handle=4584 /prefetch:8
      4⤵
      PID:6856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4568,i,14243495959196067493,9264489906209173545,524288 --field-trial-handle=2272,i,14791393876193450028,5758507837652868951,262144 --variations-seed-version --mojo-platform-channel-handle=4584 /prefetch:8
      4⤵
      PID:816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4792,i,9229701198302907737,12287972030599512273,524288 --field-trial-handle=2272,i,14791393876193450028,5758507837652868951,262144 --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:8
      4⤵
      PID:5548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4784,i,10035132664743735035,14323570641980539966,524288 --field-trial-handle=2272,i,14791393876193450028,5758507837652868951,262144 --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:8
      4⤵
      PID:1272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4780,i,12103424435549476901,18287214552681392343,524288 --field-trial-handle=2272,i,14791393876193450028,5758507837652868951,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:8
      4⤵
      PID:6804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4948,i,16893151588939560573,11557792919134128267,524288 --field-trial-handle=2272,i,14791393876193450028,5758507837652868951,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:8
      4⤵
      PID:7128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3584,i,16026708754423767553,1329913034385815551,524288 --field-trial-handle=2272,i,14791393876193450028,5758507837652868951,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:8
      4⤵
      PID:1580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4948,i,14734262622303453634,4288385931783742030,524288 --field-trial-handle=2272,i,14791393876193450028,5758507837652868951,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:8
      4⤵
      PID:5840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4948,i,16478442515176302029,9649936695146957491,524288 --field-trial-handle=2272,i,14791393876193450028,5758507837652868951,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:8
      4⤵
      PID:1084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4948,i,2071101806230362475,16290253882539430175,262144 --field-trial-handle=2272,i,14791393876193450028,5758507837652868951,262144 --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:6168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4876,i,3960884144395846884,5075575141452237694,524288 --field-trial-handle=2272,i,14791393876193450028,5758507837652868951,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:8
      4⤵
      PID:5688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4196,i,13706610716634116963,7417122022412358100,524288 --field-trial-handle=2272,i,14791393876193450028,5758507837652868951,262144 --variations-seed-version --mojo-platform-channel-handle=1316 /prefetch:8
      4⤵
      PID:5660
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Xeno.exe --webview-exe-version=1.3.55+87ae4f96f8a0927052c1120167982fb069afd1b4 --user-data-dir="C:\Users\Admin\Downloads\Xeno-v1.3.55-d47d833e\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --mojo-named-platform-channel-pipe=5416.1676.3899366891386472888
  2⤵
  - Drops file in Program Files directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  PID:6004
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\Downloads\Xeno-v1.3.55-d47d833e\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\Downloads\Xeno-v1.3.55-d47d833e\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x160,0x164,0x168,0x13c,0x170,0x7ffa97c4b078,0x7ffa97c4b084,0x7ffa97c4b090
    3⤵
    PID:5384
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\Xeno-v1.3.55-d47d833e\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView" --webview-exe-name=Xeno.exe --webview-exe-version=1.3.55+87ae4f96f8a0927052c1120167982fb069afd1b4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1784,i,6464479759764034707,2737260229699097581,262144 --variations-seed-version --mojo-platform-channel-handle=1732 /prefetch:2
    3⤵
    PID:5996
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\Xeno-v1.3.55-d47d833e\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView" --webview-exe-name=Xeno.exe --webview-exe-version=1.3.55+87ae4f96f8a0927052c1120167982fb069afd1b4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=1320,i,6464479759764034707,2737260229699097581,262144 --variations-seed-version --mojo-platform-channel-handle=2008 /prefetch:3
    3⤵
    PID:5412
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\Xeno-v1.3.55-d47d833e\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView" --webview-exe-name=Xeno.exe --webview-exe-version=1.3.55+87ae4f96f8a0927052c1120167982fb069afd1b4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2292,i,6464479759764034707,2737260229699097581,262144 --variations-seed-version --mojo-platform-channel-handle=2172 /prefetch:8
    3⤵
    PID:2612
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\Xeno-v1.3.55-d47d833e\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView" --webview-exe-name=Xeno.exe --webview-exe-version=1.3.55+87ae4f96f8a0927052c1120167982fb069afd1b4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3596,i,6464479759764034707,2737260229699097581,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
    3⤵
    PID:4424
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\Xeno-v1.3.55-d47d833e\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView" --webview-exe-name=Xeno.exe --webview-exe-version=1.3.55+87ae4f96f8a0927052c1120167982fb069afd1b4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=4604,i,6464479759764034707,2737260229699097581,262144 --variations-seed-version --mojo-platform-channel-handle=2144 /prefetch:8
    3⤵
    PID:5448
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\Xeno-v1.3.55-d47d833e\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView" --webview-exe-name=Xeno.exe --webview-exe-version=1.3.55+87ae4f96f8a0927052c1120167982fb069afd1b4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=760,i,6464479759764034707,2737260229699097581,262144 --variations-seed-version --mojo-platform-channel-handle=4600 /prefetch:8
    3⤵
    PID:6704
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\Xeno-v1.3.55-d47d833e\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView" --webview-exe-name=Xeno.exe --webview-exe-version=1.3.55+87ae4f96f8a0927052c1120167982fb069afd1b4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4528,i,6464479759764034707,2737260229699097581,262144 --variations-seed-version --mojo-platform-channel-handle=4568 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3976
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\Xeno-v1.3.55-d47d833e\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView" --webview-exe-name=Xeno.exe --webview-exe-version=1.3.55+87ae4f96f8a0927052c1120167982fb069afd1b4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=4392,i,6464479759764034707,2737260229699097581,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:8
    3⤵
    PID:3872
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\Xeno-v1.3.55-d47d833e\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView" --webview-exe-name=Xeno.exe --webview-exe-version=1.3.55+87ae4f96f8a0927052c1120167982fb069afd1b4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=4228,i,6464479759764034707,2737260229699097581,262144 --variations-seed-version --mojo-platform-channel-handle=4776 /prefetch:8
    3⤵
    PID:3108
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\Xeno-v1.3.55-d47d833e\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView" --webview-exe-name=Xeno.exe --webview-exe-version=1.3.55+87ae4f96f8a0927052c1120167982fb069afd1b4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=4732,i,6464479759764034707,2737260229699097581,262144 --variations-seed-version --mojo-platform-channel-handle=4700 /prefetch:8
    3⤵
    PID:5840
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\Xeno-v1.3.55-d47d833e\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView" --webview-exe-name=Xeno.exe --webview-exe-version=1.3.55+87ae4f96f8a0927052c1120167982fb069afd1b4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=4688,i,6464479759764034707,2737260229699097581,262144 --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:8
    3⤵
    PID:7016
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\Xeno-v1.3.55-d47d833e\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView" --webview-exe-name=Xeno.exe --webview-exe-version=1.3.55+87ae4f96f8a0927052c1120167982fb069afd1b4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=4820,i,6464479759764034707,2737260229699097581,262144 --variations-seed-version --mojo-platform-channel-handle=932 /prefetch:8
    3⤵
    PID:4376

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5632

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3376

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4012

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5ef995.rbs

Path C:\Config.Msi\e5ef995.rbs
Size 19KB
SHA256 bb46f924425c0766bd2c6e77717734e5faea2ebab080c8fad7a38ed55ac59a45
MD5 14b54bb53003448221b8209938824c84
SHA1 68c868222f0ba867e58069ba10ce1086d3f55433
SHA512 c0b88493b83345655a2ac358766fae778f51676b59547356647902027ae9d655be2564485e6c4fcdc27c4139e7033fca32a4921c1c5a5aac348cd5ef404f96ba
SSDEEP 192:6jRP1kR815dXcFUADIc1L+W+y4+agPuO37:6jRP6R8TeC81L/c637
TLSH
T17792FC526680C9D3D8766B30CD631B653B76DBD9A350838B50DC90308FA3BCA2F9D69D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5ef9a1.rbs

Path C:\Config.Msi\e5ef9a1.rbs
Size 19KB
SHA256 4cb0f248377cfd938ebc4532a851f3657a5cd684598a1d56a495ccf6d27e834d
MD5 4b83155d7258e83bd2bea51fafeeaa10
SHA1 571fb6b352392bb61872b85c01cb172ad4141462
SHA512 6d1ac30ba80a27c341a8696a35a6c03b20a137c163e5246783e36784e3b185f655421a49b3261c8a54718e69542b232532db892c6f2c66f583084435616021bf
SSDEEP 384:NVhpsucPI+wHORW6NrhiIRTJv4JvjrP2F:NVhpsucPI+wHORW6NMIbeLCF
TLSH
T16F921E01BA44C5E3D4A62B30EE5B27243B35D7D9A721674B84DCC1308F877C5AF9E68A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5ef9a8.rbs

Path C:\Config.Msi\e5ef9a8.rbs
Size 21KB
SHA256 36a040532bd076bd5922ebb392929775c2b47639400d18c7946cdaf9df52554e
MD5 c1de177fec9b78c3e74e3db4e24d4f15
SHA1 1f166aea11a79333f5152d0506b784b361d8545d
SHA512 d2c534a25ee3dd174c2668339b25e29017db02d667c52758afc4a766b259a273ca45443a5142fc65a687159692449234a8681d182d57dbdaa6dab685aa0e4742
SSDEEP 384:N7RCGR1nAKxNAUhUC7xJjrMNYPVIbS/08MbieZKzQhjkP:NVzJAKhCsB
TLSH
T1CCA21E03768099E3C86227B1DD671BA83B73D7D99350434B10ECD1388F633C76E5AA9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5ef9b7.rbs

Path C:\Config.Msi\e5ef9b7.rbs
Size 21KB
SHA256 ca73c013b62703328c0244ec8702cb21e926766bdc8d58fec958bee1fd1e1b97
MD5 5db17a87ae5613f366ffee879656dbc0
SHA1 7381322e1238f47daa7d0ecafb108cb8909725e7
SHA512 c787b6381b35d38d1b47191b1d2f7a3b86e2675f6474d52c1d5561ec84da7899c1eb3aa9bb03fed994915a65bef0ad1048c0d3b85872671038f6b14de7ddd0dc
SSDEEP 384:44OphE89gMipMzZjr4/mUBsalckU72eC6JKK5saMgsJW4JWC6cesUp:44OphE89gMipMzZ3umUFKiaOdX6c/0
TLSH
T106A2B802BA04D593D8A72B70DD9B5B143BBAD3D99791534B04CDC0305E837CB2F9EA9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5ef9bc.rbs

Path C:\Config.Msi\e5ef9bc.rbs
Size 41KB
SHA256 5223c9b0cc43319c4e0b7b92086eaf9d72e6d546e2fd654776516402024050a5
MD5 0455fb6cc52d437d8150abfaa58fc179
SHA1 90401fb4d71f60804467ec518ea5f0bb89a8b3fe
SHA512 69db736ea6896e62f0baa0380109b2dd5df4985fc059a5937520a26802bf43a2aec028a8cfddf1c5924f32625225fc5607eeae0b4e64a798ab722942907dd205
SSDEEP 768:ouYgr5f7sydCKzOhe2xfizlQeKGFGqJylkq3aS48tFiyg4t1k17hnxtykm46NifN:lYgr5f7sydCKzOhPxfizlQeKGFGqJylC
TLSH
T1321312E2FB06C2DAF133B9BD9B807B09731C9AD76680F54E09CD51699416BD4EEE80C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5ef9c1.rbs

Path C:\Config.Msi\e5ef9c1.rbs
Size 48KB
SHA256 dd6a21d9c1decb80cf6f645f14c48e257d8ae19d6e617dc351f6a049a2a5f5ed
MD5 ebfdfd8a5e70bf71b2c33569e50b7cd3
SHA1 2d0e8f8a3cfe1e12c3ca64aa1a50314e6205a5ca
SHA512 fe38c113dfd6581adad218c9521d8935d76a9a6fa053a01ef645caa45cf0be7ec0c1b0e3dca50555f77e42f89b2518307748bcdffe5377aab98f8bb8fa8db6d9
SSDEEP 1536:blV+cORT3I/4tktvfftgMQ4dskJhTaOTagmDxjHxW9nXzYnj2NE43H+lPSc6ScTA:s44
TLSH
T195230F94DF00C4D2F233BBB6A374E90437588EA93F14944D67CED145C79AE89EAF9182
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5ef9c6.rbs

Path C:\Config.Msi\e5ef9c6.rbs
Size 9KB
SHA256 c63f1a2a9394acbfc5fea4fdb378b491d3d8178c8f7310d57eb07901c030a50a
MD5 52910f5e76dcd56daa5313376dd02175
SHA1 da0bd61b6af6da0149b278bdcd66a45c9e24b29b
SHA512 d91e43df194bf23ff47673fb5116884d217e7a2dd948f6b09848f003d66275595ae6f59bc823be19696431b9dfda14a32684a5dd6dfed11532d9d90276a3c7e1
SSDEEP 96:7xm7Du5DSiS5XrLDCCeLWDA+vuU7eD2mon8CsTl7U7eD2mon8C6jCFS2YD+TlGYk:7MWMiS7ZekBGonTIeGonTjKEJWdhLvpF
TLSH
T1161222097A1186F3E8561F35C747271437BBD3CBE700A24B06EFA5289F9774C0AA859E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5ef9cb.rbs

Path C:\Config.Msi\e5ef9cb.rbs
Size 10KB
SHA256 da038a30a5f3b9e0f11d43ecc0afe6ca1ae2b2ce3f345509649d7803ff50415c
MD5 589300ff735c9286f9264a248707aa09
SHA1 e3b7309e63be03d1e46577853e6d5b01124ec631
SHA512 c078f7cf2cf46e3b61db2180ecef3d49635c1b6b474969422fac6c27ad706929783468201d9b1fbd392071d57f44fcb020fac344c2c4bfd65438a40f89c7ba2f
SSDEEP 192:FmuIxFX5HRbw/eVxYvB6nonTIJ6nonT8yCEoV99vpO:FmuIxFX5HhvxY56nonC6nonYPK
TLSH
T173223101AA09C5D3D9A21B70C3431BB137F3D3AE8704574F65DDB2706F8B7885AB929A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5ef9d2.rbs

Path C:\Config.Msi\e5ef9d2.rbs
Size 88KB
SHA256 e5e3fbffe799a4d97b007362b76c37b97cbcf286c28eea3597e262418a3e7012
MD5 73cca22fb7593fefabbe1cd23203133c
SHA1 ec700e6ebd80b5f93be0299cb3b572e32cea8e4e
SHA512 73a4ba597476dbe0b73ddfde66fd185f58523854a99fd7e5b9dd1817ebf6971f074e0ef41df6fcd07316424cd9af0678c1b324b406cfeee5d0dd09e2c3e7dad8
SSDEEP 1536:mk1eK8ItgdYnfGxhM4lEiJVLFnnzcp2X/60ir+XUfxLCekwFp8NFpSoBjMQRTsSK:mwpIs/3StbIAjKy7XeBss
TLSH
T1E493E1B96710C186DD333A8883BBEA09AE015DAF53499E7A1BC5013AD9D3E971F7C4D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5ef9d6.rbs

Path C:\Config.Msi\e5ef9d6.rbs
Size 3KB
SHA256 4795807536e989f76c649d9be31d05fc351363d7ac2b075d21c8a648df1d1073
MD5 4c476decb4858552c6ae69d3b7b264e8
SHA1 0821ff09292c6b6e7bde438c31aba03623fc401a
SHA512 789178daf40b9079156dd4e051ca7c7793194ac08346c6fc040bf6522f2620c95af9339098e3b2b1ae1ccc00e691be4a88d5f322928df5f9dec8d72494b4130c
TLSH
T1F8818902AA04D6E3ECA22F71CA571B11337BE3DBD710C387018D91745E9BB895FE958A
MD5 SHA1 SHA512 TLSH

Submit Download

e5ef9d9.rbs

Path C:\Config.Msi\e5ef9d9.rbs
Size 3KB
SHA256 5a89f0171b1b34e1c43a532c31f10d44136a50c2fc3d9a0685cba2854d70ef28
MD5 c4f41b6a47e978d34c810adae41afb15
SHA1 293607e162377e07e571f0d682f504c354fea1ca
SHA512 fd594d5aaf66c66109b2ad51bfa4e4bf08bd984bdba1ea0d615be356ac7a159fa09618b186cae8fe97fc8d2f0abc73373af10d632f716473f36ccc51f5961547
TLSH
T101716E029A08D5C3DDA31F70C9171B6133B7D7EE9724838B548DB1701E8BB999EFA186
MD5 SHA1 SHA512 TLSH

Submit Download

e5ef9dc.rbs

Path C:\Config.Msi\e5ef9dc.rbs
Size 3KB
SHA256 f1a22503b2aa8d281ec58bf113555a23c3de41d82c9631f3bc8f7327779f1769
MD5 276df454d9004fcd5b55428b9f62e424
SHA1 a9dc3131fcd63570e9d7b9cdecb4f0427d2269f4
SHA512 ac9f823cf33e134f4b2ed352c35298b6a1eeac4e5bf723f52624abe490e281c232e8fc5008ff44d0aebb26f95a21c9f6a8d578b8e2ff266531923fae271b75c0
TLSH
T10E8188439A009983EDA22F30CA6707133777D7EBC724438745CC92344E87F965E9A68A
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5920_1238793757\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5920_1755599114\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5920_2095575141\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Program Files\chrome_Unpacker_BeginUnzipping6004_1148237292\LICENSE
Size 1KB
SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
MD5 ee002cb9e51bb8dfa89640a406a1090a
SHA1 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
SHA512 d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
TLSH
T17D31535723840B9306DA2B4566AEBDC4B0DDC02D7F27AE05186EF394537B52ED8B3443
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping6004_1148237292\manifest.json
Size 79B
SHA256 7ea98f2308a9c51d17a1ac71b64afbe2a41ff0a083a166a0e4cc428bf44f0715
MD5 817fea104100763cd1bf4f15a51bfe94
SHA1 589717cf98cf7e2d55fc0d6025a4b8e215ed13d6
SHA512 da7b959d93113c5a6be360f90d9c721989c5e7acad7fa592081b582c4c3a0c4a9066a71473fd8492ce7fe7b0fbfd6870d939428a67fbd508fcf6b2c6dc1a41ea
TLSH
T15EA0122058019233108407600360478243551C022015244809461041258813A12A3128
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping6004_1431297067\manifest.json
Size 116B
SHA256 181a1631374b5ac1fff89559f7e23498ad9ee4796885d7b956d5e7d5f9c3f8c7
MD5 daf93729356a67ea1f849554827fdab1
SHA1 17dad0cbc82d5e04fb068896a5832f983e124c01
SHA512 473d9d608f2f3324d5db6eddeb4554a7271df4a6b62377820d935c001a8a2376479aa4d3e3b80ffbfdd3ba80f56fe72f1bc9dd020bcb396182b753353b883a30
TLSH
T1FBB09262A8084633249523F4A2639363CBA86D4A91346606091B9480659E73B22A5219
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping6004_167882096\manifest.json
Size 102B
SHA256 932322ae700a7d7606efb182239db5fd9550dd6cb5860e0a17bfb6fe3bcb5f35
MD5 19322c8a94f1ac01a70f8c58cdbbc720
SHA1 7c90dac178c47dac9087dfce738f24a4a627f022
SHA512 f54a9cab8dbe96333862a67912e88c4f26cc3e25a7dc93e8f06d1fb5b0b8e91d53cc0f5619c192380573a2846034ee583276d7eda73dc9fc93bb0d9168f4e099
TLSH
T156B01221EC10B4B32004036C086CC3C063272F032C4079280DE19F84E90D9DBE471528
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-as.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping6004_762053049\hyph-as.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-hi.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping6004_762053049\hyph-hi.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nb.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping6004_762053049\hyph-nb.hyb
Size 141KB
SHA256 c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
MD5 677edd1a17d50f0bd11783f58725d0e7
SHA1 98fedc5862c78f3b03daed1ff9efbe5e31c205ee
SHA512 c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgk:p73HEUP8dsiinTThjy90VKk
TLSH
T1CCE319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping6004_762053049\manifest.json
Size 82B
SHA256 d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665
MD5 2617c38bed67a4190fc499142b6f2867
SHA1 a37f0251cd6be0a6983d9a04193b773f86d31da1
SHA512 b08053050692765f172142bad7afbcd038235275c923f3cd089d556251482b1081e53c4ad7367a1fb11ca927f2ad183dc63d31ccfbf85b0160cf76a31343a6d0
TLSH
T137A022A0BC0880333E8803A8023E83E3C3BE3E0A20003C0002A33C8022EC33B3038E2C
MD5 SHA1 SHA512 TLSH

Submit Download

crl-set

Path C:\Program Files\chrome_Unpacker_BeginUnzipping6004_795231795\crl-set
Size 22KB
SHA256 6ddcaf50aaff98b960d067054ce2ce17872ac0719d02abbb7fe56b9eabc818f2
MD5 d01869348d5a783f61f90cbb27b82a78
SHA1 d4eccc91435adaf01f8589cf7f3589cf65425de2
SHA512 7ad7f27d1f559d1f50f1f009518ccca5d6d01696cd70657ad94c9fe37db7bbe06e4afc13170bc5c065cf72d69a92c3df78f637b7faa2f968bb89aa154fe371da
SSDEEP 384:2t71+UygzeWhU6yVS2Ddc0fp/9yYoIJgWUeJuDzeG0LOsr2h9ltQYX9hVPz/HG1y:m4OBwVPDdFhVyYoPWUiuXeG0K5dQYXFr
TLSH
T1B8A2BE9FAF48F112E211523D94245F40DD24D54A23996AB74F943F30ADAE42AAF3CC7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping6004_795231795\manifest.json
Size 113B
SHA256 98821f71a1973ac61b45967ce0c121eb598ac6e95abaa23c912d2f33e4237d8c
MD5 7ef3c71464d0fef472bc1d81fd363c62
SHA1 230e8ec0f849bf34d444c55ef548ba0c9c94d39b
SHA512 f74b96ec3b9569e360a02bfdd4fe237efad8ee2a5deaf46db891bcadd39dba22fd6d59a4e9aafe5511152625ce9f468519dadd53fc0c9b6c8826dc58cbe6cd7c
TLSH
T1C8B09262DC80D872693A93AC0E2246C4F228234B2558AA493630048C0A3A3F082A2321
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping6592_248391499\manifest.json
Size 177B
SHA256 096e772e0f2e8c15e6dec9087ee0a1fb8b0c56b25061626aedc9e7e705adfc2e
MD5 2714a51ed8c2a891ad73b7488ab655b9
SHA1 9a8cc479aec8de1b4eb678e5d68b23b16a39dc99
SHA512 4811522c06ad6946626a9f4d12eb62a1d623825d18a1cd0ad7b628f4c059f37d299b5857abffd959e4ea53239412490539f5705b4aa6c6951d13c68e6d5b72ad
TLSH
T1E6C012EFDC509DB215EB4323156D43C4E733CF4B1546490935FB66082A25981C193500
MD5 SHA1 SHA512 TLSH

Submit Download

automation.js

Path C:\Program Files\chrome_Unpacker_BeginUnzipping6592_437462085\automation.js
Size 4KB
SHA256 dfc5596bf78e6b83c069c18092837f1cb55f40634500a4fd93cff0ca36b75686
MD5 26db57709242c137cb49f9ececdf094d
SHA1 e823dc2fac142a98a0ab2b7cd0b0881e12021e9e
SHA512 d223502285ce62d496c9a1b6ba8abc931bc7ac5adea486d85f1f7ca5a41beb9085a27f4ad4808545da05c6b6e3263e3910a1116838bd155b4a5dfcc766b0acb2
SSDEEP 96:1rOqpMXG4Eja7tzhr2W4KNgYCI5mvXzYUsChfHF+wRWctlyScN4Qn:1rOqGXLGaRNr2O6YCICXzzrhflbR5tty
TLSH
T1C49163D830FBD235C6A451DF92905195F35908BABCDDC99AE2054C0B7C7A803A7FE662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping6592_437462085\manifest.json
Size 135B
SHA256 cb929ae2d466e597ecc4f588ba22faf68f7cfc204b3986819c85ac608d6f82b5
MD5 4055ba4ebd5546fb6306d6a3151a236a
SHA1 609a989f14f8ee9ed9bffbd6ddba3214fd0d0109
SHA512 58d39f7ae0dafd067c6dba34c686506c1718112ad5af8a255eb9a7d6ec0edca318b557565f5914c5140eb9d1b6e2ffbb08c9d596f43e7a79fdb4ef95457bf29a
TLSH
T1CEC09223CC019CB119743B642AB2AB82F7B41B0B6869705A3AB3148C1F7E1B48082680
MD5 SHA1 SHA512 TLSH

Submit Download

verified_contents.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping6592_482154943\_metadata\verified_contents.json
Size 1KB
SHA256 c50e8b66b9c681cbc2fa16cb2d8fd7cc934df1a7863dcf4f0ebedf6a5b78638d
MD5 449dd45bb3743ba9d74d22e229d240b9
SHA1 5416597a6279971cb80324d89a19eaf15c8ed112
SHA512 fedd551f65c62f157240c1dc360efe0d5b9793a34ed71291d6ea4c65a7f0cda6c32f0f2608ce4bcbc61591acdae76d9d4a610337d9d35eadd10f80bd43544e4d
TLSH
T16031F956010CE1DA3A8F13B90FFEEE12D35F10D2A2E525316AC6571EE0DA746D2315A1
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping6592_781970955\manifest.json
Size 119B
SHA256 7169d86e87f904218238cd293e043e20b7828afad9acd1ff2e5d64188530b9d7
MD5 7382260298fc06c135b7c7399e9acff9
SHA1 6a829f795a3b8be25200675e00abfa1908fdefdf
SHA512 f0ce77f9f72fb6721bcfa9b03f77b0771e8217988183787c00dba4f9d9f19cdba252ddd656422336035f81939cb97c8b5dcb4f036a39280198c17cd04faaaed4
TLSH
T191B09273A800E83830E9EB91093A8243F320AB4BA585640A3625485C0B2B9F990606C4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping6592_963731934\manifest.json
Size 238B
SHA256 1bdda4a8fc3e2b965fbb52c9b23a9a34871bc345abfb332a87ea878f4472efbd
MD5 15b69964f6f79654cbf54953aad0513f
SHA1 013fb9737790b034195cdeddaa620049484c53a7
SHA512 7eeee58e06bba59b1ef874436035202416079617b7953593abf6d9af42a55088ab37f45fdee394166344f0186c0cb7092f55ed201c213737bb5d5318e9f47908
TLSH
T178D0A727EC008DB611B207580AF5A742E3B1630F7C012509377308CC0F3D1744081285
MD5 SHA1 SHA512 TLSH

Submit Download

ThirdPartyNotices.txt

Path C:\Program Files\dotnet\ThirdPartyNotices.txt
Size 77KB
SHA256 e8ddd95ac905467e4e519b446ca023fa00c31732bebd9b66e65101c712092ee7
MD5 406d07d20e58568365df0557629fadc6
SHA1 9ab5ba1ef3866afa75b8cf3c392b7dd3d7f52026
SHA512 c6025a947faa5dc2b41a14d75e228ca2bd0df094e8cef914c58a6d2f5854424972a647b2c8ca8173345e40ba7557843d03efa85c5098c6e0e6726377efc8a38f
SSDEEP 1536:HA9jHwsGfgg39/zwgAVkguQxrDjugtSEGepkWvrpX7anuqdLSVnfiStPq+3Lefrb:HA97w/ogz1AVxuMjHtSFULryLOgrGWwa
TLSH
T1F573A45F7E45077319E2C3916569A8C5F22FA02E3B6B2A44346EF248133B42DD6FF858
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

state.rsm

Path C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\state.rsm
Size 876B
SHA256 0b9efdb076ac691370eb985fc15e3b6366e67671683d490643bf23685cef0017
MD5 cc70a7269fdcf09ec1dbd9962c6282cc
SHA1 05844921a139be317910a6a4485de4180cd415a6
SHA512 f423883b276a7cea6e0e1e7ca514d22e71a840a4836d123f324c958d9a949e7c67b2beeb0697245229cfecec05d6718172995c71d19914f93a0581a3b6fbca60
TLSH
T10E11B4608FF24029F3F76A7038B90655187BB8125D32811D0141308A8F31790C874B62
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 32d39786e22a1e73d9a7f6798e5c4e5f43bd1f5a4a0889d8383306b247659e28
MD5 fefc67a54864ca05fc89c32bd0918d65
SHA1 8a7ae886d0b04fbf70ca091976be52bbda1e9bb5
SHA512 b5b0230878a78490eefe1a32803da73568aa2e91a452388d085425eead14eb1d38e453ea7f9867a3fc118b1ee614d1f0773afb00fd815ac85526b200f9ce0afc
TLSH
T171E02BA9C921FD275CFD471D50940F46EA1013572760895B363C921CCFB1677458589C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000005

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000005
Size 70KB
SHA256 202f6947db28f364478faf1adfb51acbf040157ef4a3e26404b8f1075a0c5d8f
MD5 1f5c87e7e976d26a5d082bfbbb43e5cf
SHA1 25f240f331ff78dc584b3fc047eb9df63034d1b9
SHA512 7d7d174dc67deb8730918f064638cf9cf1bbaf6f2e7d04215b5a6977f940acd9143e2a299afa594f98d1cf6b3dcc15d729b321eb0e77a331a14008fa4d2d91f5
SSDEEP 1536:DGgRo2P4EXELm9zQFG44t0kgAoSuEhsqjwKELAr4Nvoygkm1A7vWPmQ7P:DGg5P4GE8zQFGhYE/EcUNvo0v4D7P
TLSH
T1496302E1CCF31F1103EDD73516A1556CE09EEA7B28E750D7B111B658862B34F9C90E8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000014

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000014
Size 331KB
SHA256 db4ffbf0ec662620013dc14bc1268bdad6256d19d7d511ec7eff8446887e6900
MD5 05ef8155cf66131654d3bb9c9cba5853
SHA1 e79d53fcb604921222dd1dbc2f1c10c631ff6075
SHA512 ee38793245d91683ddb1f847e5b56a09864fd32ec059055459b3ebe101abed79683ee59c80f30b8f6249d2bbd83fbf7bca83dafb4ef2b634ceff6969c80fed23
SSDEEP 6144:FljUD58FLTW53eaLkNv+Ps0dj1fpqaGjYf0NIcB3bM1rJZ24:FDm5uaLcv+PFj7ajJNImbM1rD
TLSH
T1247423A9B50E3C8AC94F9473827EAFD2A4356FF38D47BAA3634241F401874342E4676D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 66ba9fea901450e8bd8b8688a82360a68677255b32dc7c2d826eafafa2b7b83f
MD5 7e16cf98305350bb14ef995116ef8167
SHA1 880a8e3480a81b863a94ddd6a497fecd9070a4b1
SHA512 e4500331c9ed33d99f27e165e3169a40d0b375b04f9fea26401a1043977bec006418638b3d3e53756a726448055e9e90800b052cda251610787c76605feb1d58
TLSH
T11131CA31E184BE55FB03D07159F228CDB7B206067623DED34D549F39412E7B412DA9EA
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 0607bd83918fee07de9476947fdb0d7bf3ae967ed24e63a93830ad760ed9cd7b
MD5 06c1bc40a1e7e1da823ae2fa09caf2ed
SHA1 c66cdda48843f4a38bc8e5c71917d51d696ca027
SHA512 3f536807b69c40764f7f6c294d9357c6d7246e7964b42f1de9d4d91934efbac24d026e307fd22509baa3ed9638513cb31803834535d5d182bd0a2316568aad44
TLSH
T12031D930E194BD55FB03C07158F228DDB7B206167623DED34D188F79412E7B412DA8EA
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 4d4906c11fd9431ab4a6422796e5e48b50ffe263b6991334deec2a05cbe6ae97
MD5 e5d7a4cc72f31ea62774b3bd9133ffc5
SHA1 38832e18634f698996712b326b4be350419ec08b
SHA512 1b504b464c60bfddfd2fac7ca046308388c72abcba83b831fe61df771ac591d247c42c563ad7d95f93f3c0f6c2f9ad1a99743cb1bfd24fb3cde27d82debdff55
TLSH
T19D418432E088B9E1FB07C67644F628C9B3B2411662139ED34E809F3C602F3B805D64F6
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 ff7251d4add9b738b0a1872bdf01f1f4cca2972a49eb2299473e562f0bf6ab2a
MD5 ede5230c9fc8014e04104f64a04caa44
SHA1 32e673d4096f568dba0ec029dc1a58f79d24dc64
SHA512 5ab198816e097d7c20646176cab7eee35f0ce0e69c8aa0373e10772341fe16624dc6f408f869638d8763ca9e5fa7dc63696523ea54befcd0bb90a30b73198eca
TLSH
T115312D31E184BD45FB03C47158F228CCB7B206067623DEC349549F39012F7B422D98EA
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 80152b1efa91d9dee6a96af58478d8c9641b5461bb46cdfebbed5bff525da613
MD5 e5d6351fdec418949ed0fcfca08f69cc
SHA1 1f23378677954d7dd1a9a1810e027dfd52477b29
SHA512 5319560474358edce4acfdd578fca9e500cacf9fae5911380c5c958983156c7fef20bf185d7bc3f476dfee497ebf9dbf7b86221f68f66fcc17161b3e0eb40c66
TLSH
T13F413131E589B9E1FB07C17544F628C9B3B242166223DEC78E545F7DA02F3B805D68E6
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 e00a84dce4517460c58ecc63419f34716ed82c83a0a47526afa492bf3cdfae6e
MD5 e087e2209ef59c41e8079c9718c73121
SHA1 d4b8406cacf8b28f76791cdfefa89e75388b6162
SHA512 650670f70ebefdba13940c69344fe1340a20a27a00b06bcddddc254194e239c7d72b97d8ce7e05ed1c1779c85b8435b46a7f072860ab4e5f7e08ad05e6e74cea
TLSH
T157518AF7C7E4C66D8911A6F4DB216F1FCE2A0A24021C3C6688D4AF5B53E2872D21138E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 a875b22f0d6561a64681c8bf3598dd377ef9199933c7b49e5f1f405591bb774a
MD5 885715d5fd919be0da95192946ac5dda
SHA1 c88ca85ec9472e894c8d269ff216b83b30512951
SHA512 10a254662543e6cc4fb13d74a2adefd38a607da311898887422b84bf6f479178081b34fe66384eb5b6dedda0c573e5197d839692edf58535c162320cb71d1559
SSDEEP 192:Dk0uwE/IP8XBjYaIGQf2I+2hVCQ/JHhjhXlLSn5mfdf7NB5bj:Dk0uwE/IP8XBjYaIGc2I+2hVCQ/JHhBf
TLSH
T11612AFF7C3E4C66DC80162F59F287E1BCE2A0924526C3D6789D4EE4B63E2472E24064F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 9bd0fd2e4045b313ef60efdbcc93553c4ecbc905646768c870200965d9b75346
MD5 e0dde34c084d90ddc4829c710f9626ed
SHA1 40a6f8593b754a6cdaa8c5e06b5db73f7432cbe3
SHA512 6a418156956ae1a7b7e41406286380e89d5ed901462267666079d2a892070c2f2b0c2dd6baea2846438fc76e443a5bb90aaee0c7293b137a863161a6073e2b23
SSDEEP 192:Dk0uwE/IP8XBjYaIGdaf2Nd7I+2hVCQ/JHhjhn3lLSnR:Dk0uwE/IP8XBjYaIGdq2Nd7I+2hVCQ/e
TLSH
T1FAF18FF783E4C67DC80172F59F287E1BCE6A092462683D6789D4EE4B53E6473E24064E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 096cdb7e8fc3d6ab8e9c4ccc3f7ca185e7457f7cdf2c2bafe5ae808ca23b78d9
MD5 0d086c98e0d1f158fbc6c8387b77e6e9
SHA1 002e446dd5c3eda3fd4a7b884809563b16c6da32
SHA512 a7d30a6e85f1032417da09c05c0da24f996db3203efe28442c03230dc0016527b0654d1b7f2abef419c9ca5d851632bb79ef8f6cf24d70d42302ace2819a631e
SSDEEP 192:DwAWPxqhDW7yJm+OaIGQf2z+2hVRQm+Hhjhnyq36kHb5Kfed854lG37i8YIXvhLS:DwAWPxqhDW7yJm+OaIGc2z+2hVRQm+HT
TLSH
T105229CF783E4C62EC90166F49B28BE1BCE290924522C3C6689D4EE5793E3473E24174F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 481c0549510c502af3377a44c9d0b83d2ce2858e3f4f9c436dfe05550781aac8
MD5 d348b9712750fd021c3701e440ed47ba
SHA1 709df26d1bb160d6cffb6dbf38d2018a701cd484
SHA512 b9ab9a18a0b1c1fca0e44c3a0094ea58a391f980a187ca80710576f2a46a26fa9cf8889d84961a866545c183bac1f4286dd29e19f14657b8e38533050f48a44b
SSDEEP 192:DAe8JE/IP8XZaIGdafzf6p7I+2hVooQabJHziNjhq:DAe8JE/IP8XZaIGdqzf6p7I+2hVooQaR
TLSH
T1AAF18DB7C3E4D67DC81162F59F243E1BCE6E092452683D67C9D4EE8B63E2472E24064E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 0b25c9424b7b94854578a8cd10eeb487f70389557c92189abc6475abf6d99816
MD5 cebda14f0abacc710fa32c039ad54c3a
SHA1 28097021ac5a8b8b630fe2c3ac71882f963a341e
SHA512 8bb4a88ef6e68917aeee72c2a7cf54589760bfdde118cf0263318f0fff8af38bb58c8655879e3d4be11360305883948e711b0828edc436c1886d72824e3307b1
SSDEEP 192:DAe8JE/IP8XB3aIGdaf66p7I+2hVCQ/JHhjhSqEGrMR:DAe8JE/IP8XB3aIGdq66p7I+2hVCQ/J6
TLSH
T1DE029FB7C3E4C67DC80172F59F247E1BCE6A092462683D6789D4EE4B63E6472E24064E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 ea24637029637bd57fefa3329302b2a98d60897be7b9fdbbef4db25db089d5ba
MD5 2636ec5bad34c95b33d6d376bb7b8e53
SHA1 f57c4efa8d831f8e67bbdea7c47985f3da830d21
SHA512 f24584339736f9f95f6ab6709385e91b5333290efbedee06b8fcb98f76b002ab3b4108ab875d639247c6b3eca437b23166559d9e5251f6d85fbbb9b25f06225f
SSDEEP 192:DAWPxqhDW7SJm+8cyaIGQf2z+2hVRQm+Hhjhnyq36mb5Kfedb54lG37i8YIXvbLr:DAWPxqhDW7SJm+8cyaIGc2z+2hVRQm+z
TLSH
T148228DF783E4C66EC911A6F09B287E1BCE690924522C3C6689D4EE5793E3473E24174F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 314a62449ab8b6e6367105897e9113195c92ab876383718e85a5af1975a0b0e6
MD5 183e99c50b934025675d7360e569ab7b
SHA1 454fe1caef8ca9aff3161832528f23395fe6cf67
SHA512 d804b49523a7a96aca555f29a940090fd7516e27c61b4f60e0918541355ea1880647fd102580968fdadf7d8f89e9339437d9f1764f58d569315c082234ac571a
SSDEEP 192:DwAWPxqhDWcyJmWaIGQf2z+2hVRQm+Hhjhnlq36kHb5Kfed854lG37mR842:DwAWPxqhDWcyJmWaIGc2z+2hVRQm+Hhr
TLSH
T128029BF783E4866EC901A6F49F28BE1BCE290524536C3C6689D4EE5793E3473E24164F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 2KB
SHA256 870b5228ea59965998c4809d9261dc539c422ed419dbdf1279d70908dcde11cc
MD5 8bf20ca0cb0b3bdd4ae2e8ff42082e30
SHA1 bb79762c5c5826f81623bc153e196e0d44054b6b
SHA512 578c2f9b55875c0e99aa83fb1fed0d35a3691e5c01ff5d3ad3b2440b313a3792f1ee1fac00f35f74d61caf0a2e91428aa71f693d6e9737ed4b77c751bb5da06e
TLSH
T1B3415AABD67EF4AB513C58BF1D19BC093D7AA43102526CF8DB9A91BCF0815F31B12056
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 66166fb604031a7185c3c24c70167478574fa402154431f3c96aa211b25059ad
MD5 04f8bb62f4c8e1e242df067a3112175a
SHA1 e7f7532ae8e282df3d7dbad3ec4b97ef2ab06cd3
SHA512 3f0102152088c33753c425ba49fa4fd42edfa950fbe6f8a923c939dcc1b1f0ad476cbfec820ed990c7c6dd52808f32da545351113b08fe70f8a36d1518213183
SSDEEP 192:IRYeGd2Ek8lSS1iv7ApAPRp2l9qHsb+WNn5oPFr9kwUaGPXKur9+VyIsnAUge:IRYek2ipukUXmkw+PD0asX792e
TLSH
T1BE42B62AEE14793BECDAC229FA653763E7F5102525942E84EAFC892C14E75CD221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 c9c946b71fed41d0a0c89516323c280590d085bfc738ebd587229c57546ac543
MD5 b693c23af73dc1c5e2009825bdfac14d
SHA1 e763129a51064da8bb8561fd788d34c82973c4a6
SHA512 fa594cdfe91a89233e8f12975812eb04b0e4b10068e7cd4af2f3d61d9ac5a83d33c11ff6304a7b199fe6cfef5088fa44ab6bfbdff4251d53be36716137547093
SSDEEP 192:FRYuGd2Ek8lSSAHv7AhbPRpjl9qHsVb+WNnvsnHUCr9kwUaGPXKue9+VyIsnAUgE:FRYuk2i8PkZXJkY0nD0asXO92E
TLSH
T16952C62EEE14393BECDBD229FA553B63E7F5202521942E84EAFC892C14E75CD2217117
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 f146632cff95e68ed835e2a56f551817557ff0892f0ed825f11ea3c2229853b7
MD5 80538723700be3f4940bed207128f148
SHA1 8a0b49deaed723482936a115e519f9d41412b611
SHA512 f9135dcb02f59d6429649adf7af8045ed032a68c04fcf1dab14cd0a7bd631c476dd7a3052ceb3959776f1b60dc9139b4b44c2a699f31522ec6312b06fd24a418
SSDEEP 192:uRYuGd2Ek8lSSeHv7AhbPRpjVU09qHsVb+WNnx2OUyQN2XJUCr9kwUaGPXKue9+O:uRYuk2iiPkZXi0kQsB9N2X10asXO92E
TLSH
T1AD52D62BEE10793BDCDBD229FA557B27E7F5102521942E88EAFC892C14E75CD221B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 15ce4675ee2ccdc408ab19630c37214beca6102d58d432a086527bd806af4794
MD5 21aa8ed9069da6bb2e8cdbe2ac96de6b
SHA1 bae77957a5647ec24b3c8754371ac423c26f7cd0
SHA512 af36355d139c7cb63a008308d7933c219920a6b700532d40addd5cb811ef494324631073be525e93d2294dfc82cbd05834579269deca2225b73f502bb844229b
SSDEEP 192:iRYXGd2Ek8lSSVMv7AMbPRpjXgiU09qHsVb+WN7upeQ22sTgs2/OaUCr9kwUaGPd:iRYXk2iRYkMXu0kQzE35OI0asXO925
TLSH
T17762C52BED203A3BDCEAD229FA557B27E7F5102125942E84EAFC892C14E75DD3217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 8645f790eda0eedbb88c8f359a85ae4801b6300a300045d7dac6c4060a61c05d
MD5 8fe086423095d4c9e171f80bce60b940
SHA1 5a837db839b8d8496c8e2e3491db18e2bff36ad4
SHA512 6a1e6c856d0bd71e952ed3b887099268254f9683a3c5539dc9550945751d5e7c1f1cb3e84b791234412bea487a13ef026d1049b62e6902605cc29cc8607bf6e2
SSDEEP 192:uRYuGd2Ek8lSSeHv7AhbPRpjXhU09qHsVb+WNnx2OhWe5UCr9kwUaGPXKue9+VyN:uRYuk2iiPkZXe0kQsNel0asXO92E
TLSH
T15752C52BEE10793BDCDAD229F9557B27E7F5102524942EC4EAFC892C14E75CD221B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 0cf5747e1ea057c710de8d429b487f27e92e9083c590e2647aa4e0a275c949a6
MD5 5f95bf3805d8f440f25c2b18b0d6e2ea
SHA1 1ae87464900298e0db5d76640162ab10d695b747
SHA512 d8b0916f75a7b0ecd7a5770c01f3ecf661f3575fb40d655a58fd18ab19408efc51cd4035a379c2d58b03d6faf173f1ada9a555d16bd4900a45727fdc1ec83fc6
SSDEEP 192:2RYuGd2Ek8lSSriv7AhAPRp2l9qHsb+WNnjI0Jr9kwUaGPXKur9+VyIsnAUge:2RYuk2iPuk8Xmkws0X0asX792e
TLSH
T15642B72EEE14793BDCDBC229FA653B27E7F5102525942E84EAFC892C14E75CD221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 4cfb0231d4de7b49fc58594f621d09ea9f24e41adbd981875ec2074c8d154f8f
MD5 7f130db3e7249e7eba41b28130cffddc
SHA1 f1da7549542930961ca67a34e4117e377a0f6521
SHA512 284569d805e675c3f301d11166432ecbff3a3524357556bf69d42730c7bf268443a1cba3e18df769e07eaf13c29ed092a69eff2708acd8f6aed294c637bdaa60
SSDEEP 192:uRYuGd2Ek8lSSe9v7AhbPRpjXhU09qHsVb+WNnx2Ox2Yr1UCr9kwUaGPXKue9+Vo:uRYuk2ii9kZXe0kQs1YrJ0asXO92E
TLSH
T19452C52BEE10793BECDAD229F9557B27E7F5102520A42EC4EAFC892C14E75CD221B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 f0900924ed72f4c0b9ed4f0c07e23de65386ffb4e1c72906b4f13668eb673649
MD5 ea1bdcb24d7de049faea30df0f90226e
SHA1 3e11173e12fbabbdd31b6c7fb3cc89d889b98fe9
SHA512 7a250f0d7573d236c3ec1af3fedd4956c518afefe9b5efe3b496d7a9837d17e55be30500b80730cd85f04ed2ebbf2323771f10ead152a74f4d673d262f1d06f0
SSDEEP 192:uRYuGd2Ek8lSSe3v7AhbPRpjXhU09qHsVb+WNnx2OgoEYUCr9kwUaGPXKue9+VyN:uRYuk2iifkZXe0kQs2E20asXO92E
TLSH
T19B52B42BEE10793BECDAD229F9557B27E7F5102524A42EC4EAFC892C14E75CD221B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 206e34a1ce4e176e7a902bbb2c5efda5fc224200bc14a3086f964e1fa55eb9d0
MD5 a0e1dfb0b9da2cfaec8de186828849aa
SHA1 6ea7368aa91a5e04f628f85d2d20eea7ce58947b
SHA512 c1035f7b90192e80d12908cac5cef2eca1ce57aaa884fed6e1188268c2b6916a627b7436fc9c3c0831edb88e8b3eb290c07b322de8a57fce879e25ef8e33bd28
SSDEEP 192:uRYuGd2Ek8lSSeUv7AhbPRpjXhU09qHsVb+WNnx2O6IeqUCr9kwUaGPXKue9+VyN:uRYuk2iiQkZXe0kQsQeY0asXO92E
TLSH
T1ED52C42BEE10793BDCDBD229F9567B27E7F1102525A42E84EAFC892C14E75CD221B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 7fd3de831f5703a683bf07001e2b9b5b03b6af0e3b47cce435fa91964af02111
MD5 fe25aa2c0566d220657ed43b97e6a191
SHA1 a65a30217d31a20c00a481a5eb268c5ba3c409b1
SHA512 fd7d8806201182480a0ba8eb1f347f3e9cab7378fb5ab020f5a2a5a75990c4028ba441e12e9b3f0c8a5c046a35ade9e6d5092b710c57737b932059f268297a3a
SSDEEP 384:9RYwk2iRYkMXA0kQzO3rP5Oma0asXO925:Qwk2iRd70kQK3QmeF9k
TLSH
T1C962C42BED103A3BDCEAD229FA557B27E7F5102225902E84EAFC892C14E75DD3217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 5adb838197bdc4c6ab9c2daefc5cd1ee9281502d868d716fe786e17bf6f0d044
MD5 841798f373b8c4d7f5741428d3d92355
SHA1 82b3b087e0e056a0fad4e8e926c6da4bb4ab37c6
SHA512 c3f6cb6c8ee5cc21a9839619ca0b61600166fe1d99a5bc3d0ef99016e1c50a11e90a10ae3c96520fe7eee98d20f9b705938a1f539371b41d41211b87331c89f6
SSDEEP 192:iRYXGd2Ek8lSSmMv7AMbPRpjXgeU09qHsVb+WNnpeSTgs2/OzUCr9kwUaGPXKuee:iRYXk2iSYkMXi0kQwd5OH0asXO925
TLSH
T16B62C42BEE143A3BDCDAC229F9557B27E7F5102225A42E84EAFC892C14E75DD3217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 0e9312288cb5cfedac24045a4690d3dec5031267260bfb6b699977cba45edd28
MD5 f3b7f036b2b937066ec754a22770582b
SHA1 f4a8dcc6013c3d3566c53f9dc64f79c4d487d8a7
SHA512 666ed7e984526e0d57c9c205739846f36cff80df71fda2514702311080ab5479bfa3ea152fcda5851b30e2621c674a40836bc299dfc7f344fd60685ac73981f1
SSDEEP 192:uRYuGd2Ek8lSSetv7AhbPRpjXhU09qHsVb+WNnx2Otzc5UCr9kwUaGPXKue9+VyN:uRYuk2iiNkZXe0kQsQcl0asXO92E
TLSH
T18E52C52BEE10793BDCDAC229FA557B27E7F1102525A42E84EAFC892C14E75CD321B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 4e7778e68c86538b6f1b5542b3cd6997ea02d831f005434791bdc93609ffc621
MD5 f894be6b4c4c321ddef0d17f73327c3e
SHA1 f3e33039d3f384094600dea09d702b9d55ee0bc2
SHA512 4942e657e272359b914f86dbfc78d4d5951b7a9f28613b1a54ca82a9218a3ce9ad802c37b6822aed9158fcabb9cff46b63c3355d212307e22ad2e61909629c79
SSDEEP 192:iRYuGd2Ek8lSSmMv7AMbPRpjXgeU09qHsVb+WNnpeSV602/O5UCr9kwUaGPXKuee:iRYuk2iSYkMXi0kQwDhOl0asXO925
TLSH
T13D62D52BEE143A3BDCDAC229F9557B27E7F5102525A42E84EAFC892C14E75CD321B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 761a57515e1832e5c1941bbc5722953e9fbf7bfee40ab7108485ab441aa0ee10
MD5 bacc1c1a901be087340d484dc849dc6c
SHA1 cfb8bd6bd8fbd42671addcafbe356429bea95a1c
SHA512 60a4a900883dcab2bd0077802749cc35fc106299c09fb6a6444ae46aeb2aabdb4aef4263cf2cad406d5678490c066bed40cf07fd1a29c2eadd23b010b4a71e81
SSDEEP 192:uRYuGd2Ek8lSSezv7AhbPRpjXhU09qHsVb+WNnx2O2/OaUCr9kwUaGPXKue9+Vy8:uRYuk2iiLkZXe0kQsTOI0asXO925
TLSH
T19952C52BEE10393BECDAD229F9567B23E7F5102525A42EC4EAFC892C14E75CD2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 5a363424a7e070f509e997dacfc39f091a7ba5a8c7e3e0df3d545845f4fc6ade
MD5 7f8f94b5f5aca49095ae98e22471143e
SHA1 c065533bcf7db7d228bf7980086db3cd72064fe8
SHA512 eadc59d729e2f078e2700d142b530cf87413a3e25e6ba29eb638d78845296793e09bb3561fa3760da1ce6e15cf22791aa6d775476453e855969400052b9ca5af
SSDEEP 384:9RYxk2iAYk2XA0kQOrh3rP5Ox0asXO925:Qxk2iAdV0kQu3QVF9k
TLSH
T16062C52AED143A3BDCEAD229FA557B27E7F5102225D02E84EAFC892C14E75DC3217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 13805701603dbbca9403b94e006c712edafb4f98a8e0ae4ce0ad1b025b835f93
MD5 28aca1b912d001e337a9e715a111a353
SHA1 177a8b35a6fa74a15deedffd79dc9066169fc496
SHA512 0e554b40f873ea651a22f9b91cf52ad45cc99b35e2db0e34845d695aa13aaf61497b6646f39f5b0ba26fc4a43100e92a0aff8ad949d0289fb397cfe00b0cede5
SSDEEP 384:V7jxY7KxkXqKf/pUZNCgVLH2HfgsluX7pLuLcSjvKXODx4+ErU31PHG0pdpS8gfp:V3xY7KxkXqKf/pUZNCgVLH2HfgskX7pf
TLSH
T1A4720967AC0C9E374F94D6CCDC277B4FADB5015B61E9886483FA981903D5BCA110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 d9dbe1a49c4b187ee99c6857e653b416a4cf45ca79ec913d97703e7aa93f874b
MD5 1dae59b03f9a27a88a5893c9c8337237
SHA1 3e60eb422229da87e16dbf2c18b1ff9f7f6bbebd
SHA512 e01e725097f0eeb76dbc13165f648ff54195e52e8b3886b953d468f8702a41207437b20deb1074ac6a726f81a263b542b43cef145792b8d117842079453b3411
TLSH
T1DDB0125080425142C04203F4215314C8B1549F209A0A1F0143E0AF3288255918435054
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 144B
SHA256 2f90ea74158c907dd45a321fa709735cdb449bf066ea8eb9a731e0254a6c542a
MD5 08966f84c63334bc423aeb2d94c9b81d
SHA1 869afea2072dd02ef03b9da9910671a3ed9a32b9
SHA512 da6f08b290b835fb20869e561771eab934b73adfe1b4669e7891f1cccee9cc4f20dce99fae924d9b540fb9fc7efc735d3ec9239359d32d9d38484a4c7c57348d
TLSH
T139C012B5C101F571C89603F51473F89C7914AF28DE0E974C53E0AE36D835560C01A161
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5914f5.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5914f5.TMP
Size 96B
SHA256 83eaf0a4b2c4282d61570f0758541e8e7016877701aaeda9a58ed5ebefbbd5b1
MD5 e24072714f2fe58a81aecd674bef4566
SHA1 08fd4b30dc85ce44c4aed55c66b1c2eccef0bc9c
SHA512 c627d72f2e2fd7b2c4f0b29492f68840c22e22529996d0e58e2dd7f762dfacac8aac577cc687bac794cafeca7e5bcad5edf8ce2d331359bafad22abf1207f363
TLSH
T19DB02202C0022302C08203B03CA280EC30B0CF20EA030222C3F02AB2CC20AB00828A20
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 7fede1efac2e8dd9382ed92fd86c89e45932fbcd5778d000717b3ea2210e63a4
MD5 4e5438b488d6ef1c6e1f6cd12ef6fc7e
SHA1 9e45bf2396697fa7888c816df2dd39181704406f
SHA512 d76623034947cc5aa91a3fcf5c741a0e43cd7a362740fd88f627732faf6c45cb8fa9f5b78c65a5e23a9f34b5760559dcfb53196ab93e07074be0d15904f4cfe0
SSDEEP 3072:HwGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:bm7Rkm1tYpBeh2BAog
TLSH
T165C3023B5D74A83B9DB5B74FA04E0A2F2EF249A7C920DE52C8D85A0433F97CD1A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 941e7cefbf550f161845d1a8981a1e2b73cf6aed2d48d51e9a38fe31989645ca
MD5 0973d90c364fafb358ca48e3ff19cf7e
SHA1 ac91606bdb67dd3b3339ce62c8bb8d05e4f9ed6e
SHA512 fa38fd96bcadb79cb9254c1a956051d1080da6e1d4d28889cd37a1bc46ba814d1f1d3c4661ed73768332ca8a33c659ef53c8775a96a31d2d210abf1ba6df1bb3
SSDEEP 3072:HTGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:Km7Rkm1tYpBeh2BAog
TLSH
T15AC3023B5D74A83B9DB5B74FA04E0A2F2EF249A7C920DE52C8D85A0433F97CD1A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 34bf60ef341ab209c08539b3b107e50c62e843ff3e8ac4a3945562375d79b55f
MD5 6a952e6feec7c22e895ab7b7b5301b33
SHA1 b9c05fb13a8b9218aa443e82c90317f666a2eae0
SHA512 ee0f8442b8115e9b94d66564720a4c88226544e0d0c88e787fcfe633cb69f62e499e45389c3d7215078aa32fc59a6d95a7136877964e812eb5132b81f14f6a4a
SSDEEP 3072:HdGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:Um7Rkm1tYpBeh2BAog
TLSH
T1BDC3023B5D74A83B9DB5B74FA04E0A2F2DF249A7C920DE52C8D85A0433F97CD1A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 098df18ef85584faaa37298388d2be4fa48f9a324c5e4ed6bc0479cb837a9c54
MD5 a75e4740a63300f7c2914e74c8402da4
SHA1 f62cf9b2942559465c8827e671c2b87074b596b4
SHA512 9c32131da94df264494bfa00ba291be05b4a82d19bf079acdd9730c14958efb60f96854ffce0bd300d8ee1ef9f02ad1964e160c3da2b5de1a39f827a6a548250
SSDEEP 3072:U+Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:4m7Rkm1tYpBeh2BAog
TLSH
T1D3C3123B5D74E83B5DB5B71EA04E0A1F1EF249A7C920DE92C8D85B0423F9BCD1A45A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 2b0e79d4fd88635aa91263091e1a7c08e0ef8e9d74494ad6a712229ab0a8cc6c
MD5 73f321488bc089895f931e73f0fa8cc1
SHA1 437c78bfb31fc4fe89547c0c22747c9eac479da8
SHA512 7baf3b645d837222a531e2e6a889172f792af7d6ae6dcfe0a82b42f593f38cbb7193742ca24b64499e5d340d2261d79fadce18ba10c825c300eeddcdea6b771b
SSDEEP 3072:PdGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:Mm7Rkm1tYpBeh2BAog
TLSH
T1AAC3023B9D74A83B9DB5B74FA04E0A2F2DF249A7C920DE52C8D85A0433F97CD1A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 d0b62403a0965e8e156205eb364ec099c91f074ef9f3929d4988dd145933db62
MD5 d16bea0ac0ce05a6a0771ac5fdc1d9a0
SHA1 d3c1f5c7af93462b20e1fe868fdff2b9951e2e1f
SHA512 3b870104a460e5ff07a73c79964224b97b511265c06c43523868c3e7d1d4f3f8872182e9ecb8905b6587030cfc0ea9a08c68aa0044671d9bca8576c756842d3e
SSDEEP 3072:A/Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:Zm7Rkm1tYpBeh2BAog
TLSH
T195C3023B5D75E93B9CB5A74EB08E0B1E2EF149A6C930DE9288D85A0437F97CD0A44934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 4d464e6c1e05a6c5d93229d472e6b1c57410747e3ced2448a9ba75983a6b73b8
MD5 e282ca2bef481468e6855326ba59ad01
SHA1 1d5dd1f72d64e3bb135cd6d2be00749f9947f91f
SHA512 2efb6a1ffa917d43e38064d6f4973e67dabe672969410a49fc9ed631f37a02182d5155be26dc9e5a6ae3a3227c7f29e9f2458cbc625b46872b68cbf34cda543c
SSDEEP 3072:UqGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:om7Rkm1tYpBeh2BAog
TLSH
T12FC3123B5D64E83B5DB5B71EA04E0A1F1EF249A7C920DE92C8D85B0423F9BCD1A45A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 0831e8cda2cc3c6dbed5e27d0197d5c85f0eb3b5d4dbd562598710ae5e5bba99
MD5 6e9dfd247a35f1ef03af3b122490073a
SHA1 319ebe9c8d189ce96a6283a28653c91f4b360dda
SHA512 1bd213361ff8622ece2db43f67a9e748cbbfc1af5bb2bd4ca601b2d165e75c3a441d35cba30188dde2db7974e1d07a20a0ca37fc36939af660874286c5ce7f70
SSDEEP 3072:HqGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:Nm7Rkm1tYpBeh2BAog
TLSH
T155C3123B5D64E8375CB5B71EB04E0A1F2EF249A7C920DE92C8D85B0423F9BCD1A45A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 1d19fb7403bc5829713ff6d0201ebef52821f471f68502b841e4ab87d5f5d25b
MD5 a289aefed36a7439ace3a14753e3c923
SHA1 41c0ceec46fb2115ee08412b34c5f95bc6f466d6
SHA512 a14110821d4f2b8dd766bbf12b0e321603189ba41aba3ca992e6173603deea8d15b00e39c1e1fd8592ec632773624169cbcd44bc33c3c54440f63006d2863e47
SSDEEP 3072:P3Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:um7Rkm1tYpBeh2BAog
TLSH
T132C3023B9D74A83B9CB5B70FA04E0A2F2DF249A7C920DE52C8D85A0433F97CD1A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 a0f44929e4dc7ea2e2144a7f13f7ba56dc7dbb1a4a1f513bbf608db8bc186798
MD5 dbfd1f9ff7239c6d899c18041d22aa60
SHA1 71ef9f666af2252e3e9bea0d820079f83257e2dd
SHA512 515501245fa9c3a1477218a7450acd694d45910d8692fc5af200cb300e6b2fcae72facfb72adc4dee02ea14d0c6e24223a31b59e1678061ddbc47be757182429
SSDEEP 3072:PqGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:lm7Rkm1tYpBeh2BAog
TLSH
T12EC3023B9D74A83B9DB5B74FA04E0A2F2DF249A7C920DE52C8D85A0433F97CD1A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

autofill_bypass_cache_forms.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\autofill_bypass_cache_forms.json
Size 161B
SHA256 f7510e38f81f8a84027304070205dd55127e3233fdf011411465ede67b5b5d92
MD5 4b1a79b1996f03fb926a97912835c881
SHA1 ca43e23f7bbb4ff3839751f722df3c38ef7bd8a7
SHA512 c2e07a1b311ab71d94c7b874d645fe1114fdccfe4468875d6b23318fbe327481a60b2782af105b7546b3c1e6c3a7ec67261b21a0587f914cc7bf77c55f1f568e
TLSH
T1E5C08C07ABB804230B414E0B590DEFC9990476F6D5C146FEAB75A5A98A3C6B0005B74A
MD5 SHA1 SHA512 TLSH

Submit Download

edge_autofill_global_block_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\edge_autofill_global_block_list.json
Size 6KB
SHA256 7d3c45c8207ba69066516e51e10a2137bc4f1fce070a692e0c65225f9856e04c
MD5 5d4464dabc1289c3a010e14c05b92c57
SHA1 d2d185faca1cd13a6d42dea68803a9941074707d
SHA512 f93f4b58efc0127946ffa1b2950a1cf71da6f77a6ab4cf98ad8ada6a751d6261be4818ff8c64fe1f1d45467aa070e0823d15be36c8259c1044fb2d1289df9994
SSDEEP 192:C73stL7O9FnLk25+tF4B8K5b+QiGoztWuDpR6lFuftdHAa4/i:nwJ2r
TLSH
T133D16A2BA91C54B32A044839128E5BE47DDD73B6DD6008D6D650C0B9AEDFCB8203FDA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v1FieldTypes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\v1FieldTypes.json
Size 509KB
SHA256 611e7995ab7599a0c89f98d6c6152a42aaedf7449748109a465bb5b0badd0af2
MD5 b1c140ef49f01eea089d3957da1a529f
SHA1 de64781f20aac98b4d2bbc497e3defa83b25aa8f
SHA512 02ddfcbaf9eaff793f251bd983394cf473b1340182ac1f3217cb7258ddfbd2de066ab08af16b47a378644bcc1871ad6ed8c641f6a053802c90e77f648e4f4be8
SSDEEP 1536:jlKS/dYt+dtxX9U2/W++dGcUooTHR6rF1azQmkEMUmxralqDAtyttVJAC5c8KrVx:B
TLSH
T148B48E2BF9F25C634D822A32053E18996A30615F5CEC6CD4BB3E211F4F2C1791E797A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ec6419a915c6f94199df67c6cf1d67bc666c22ef160c8377d6792913a6518679
MD5 a8d0099e5966b86c13c6997282a63770
SHA1 df541b93a0caebe364906ec90c768bb625495f4c
SHA512 a2093c42c3f547b910f560ee7a58cb187cef96045e8e335276c7bde87fdc5e9894b670421e94170d0878e86a2bea8125d914e11181882004f966732f9670a693
TLSH
T135D09B303B597442D7074031E8064790169E84B5249BC7076554410D7D5B4C5E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ab98da7535c8de464335204ae97fd672936e639269325c3a388b3039d8396b83
MD5 1656a3560c7aeae221756f3891b89fd3
SHA1 e48441fe2b843ba3bd0bb7799c07b22a27db8eb7
SHA512 c06d7152d11e33601716d4c5c33c7373ac4e0c16571e80ac4a8ffb9cabb52fae51d4fe8d808fc75be943287b55a320e90a186d71a5f06e9db006f6ab89266400
TLSH
T1CFD09B307B597042D3074031E8074790169E84B5249B86066554410D7D5A485E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 03c9714ceda41208919b91db8014de24ae37606ed2abc96a2531b3653937df48
MD5 8c2296de8b61220530f453b2f30415dd
SHA1 2c66c88bc6a0f8267af3c1881fe9195ca1582177
SHA512 c741a1ee72d19a8af3a3823ca6df21b2e3afeeede73da7c80eb421ce9f7370fb162d00a8565078ba3856a8ccf78493a4b12f92955afe287b59ec5f2dc6911402
TLSH
T1E7D023307A3671C0C21E0030E4110B40236E40B230CF43476194440DADB40C1D2DFEC7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b1918b6704ae6e4663b37e4093445e7354aa890ce7b1f05700f8421cb5595ab7
MD5 597dcc6fd12c28cf01aa5191c6f8f634
SHA1 448f2f1a3fe7f5ecc97ad07c00f91d4c5464f6c3
SHA512 ed67c6bce4248388b7bbaf87a721b1a31a66d78a17b56bae9fafd1f6e84b85053f37c34ca7d9fac3222e69d7cb10e914a64d247c405dde9e4b7da8258462ad7c
TLSH
T1E5D0A770B7159650C60E4030A816A65027AA8174309F8A639095540D6D99088D2DF585
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b8ffabfb85bd5921d57a7afe6be4c0e844f0c022ad8f230a9d510656a7299a13
MD5 7f04b0311252ca1f7d38abb921d396f8
SHA1 9ee9fe48da966e84646840685cb7f617fd9c2df8
SHA512 8aecb9c96d34a3817f02c69265a8e1224ffd502db1fc8a61ebc608e4f69e1066ad3c2b4cede7031a436ee0364f8ceb58a1071f20a88a052b7bcbf7fb7973a779
TLSH
T142D0A770B7159650C60E4030EC16A65027AA81B4309F8A639095540D6D99088D2DF585
MD5 SHA1 SHA512 TLSH

Submit Download

7329ac87-d613-4011-ae4c-c6c0fb1a3d63.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7329ac87-d613-4011-ae4c-c6c0fb1a3d63.tmp
Size 414B
SHA256 0d4019fef52c535aab2becc1d6923d61c10b7b237a6101feacfd9ab2f8de5426
MD5 0de7e9041d03ae108e7d4b10f0f440f2
SHA1 a95a0467cabceae2fd00c7f68cb0c8502a546084
SHA512 6f2a55d4d5bfb1a0ee0b7827fe0b6bb5e77ff8ec9c54779705f2a6be431be4db68566064bac7e4abb04132f78b3246c1afbe570dad4a368fb09a5b36adf1c6f2
TLSH
T105E02BE5CC20DC7708FE1B5890554B46FA44135B3A518A1F7A3C510CCFF5B3A42C586C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000077

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000077
Size 23KB
SHA256 cbd89e5637327e186b67ddf3d1d27f53566022e627530ab3cf0c5e38aff8cd5a
MD5 c1b1b034b050af51bdea2dae6f390a97
SHA1 2855882b8159541682b4ceff0176c5f1ce6472ae
SHA512 0d49ae4d90414c35b18c02c1a928daded1782def517f55e27a69156a9ad22c2b295653bd1403c1705c4d68979856b1929d9925cee47fce220e2076912f224d35
SSDEEP 384:P0zrnuA3jB866z80wRGWV+D+plmj95IFBP7Fu9IXt+fTptL4EGMGlvxMni7/xcH:cOyeD8DDVu+pA9K5Xt8ArH2iWH
TLSH
T16EB26C6433E05B24D66B223C889E972C9D7AFC253631C25F21A99D3D1C646C1AF217FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007a
Size 277KB
SHA256 fffdae14e4a2069965e70692b96604ad5d21538909385b2abe55c2a6974d3336
MD5 ce652fa0b4be29f35baffdbd972d282f
SHA1 0045f03a54529eb75ca1be477076f5613e7650e3
SHA512 1e7117e865e9d33bb0bad7c04bb009f5fa109a093d2df1d1dd969fb41a0e31514afb5c5e01bb679d71cc6cd426bacaa538cc081e9f544383ce807660bb4154d4
SSDEEP 6144:PvSlPvtEIJuopV9WzgP80d77NjIZ3IZt0wS+1TF8IZKF+Q9:PvSlPeIJuAG0d77NjIZ3IZt0Zce3F+I
TLSH
T15F546DBFF7C8306D02071347B945B739B62D0639B2A1D5C6A888E53E11D1FD5C42ABBA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 8KB
SHA256 e42401d74c3fe8ab9842c98d70ec2a3e7db8cf3f31d85cd0e7d1be551f177103
MD5 b8314eaf29732a976c74f3c0c353c88d
SHA1 47a737546cb1f40f52602ee421311cc419538d4a
SHA512 63a970c655330bced76d4a90f2c5621f21a438a48be747ed464a59357d512ab263d5bd857af4ab1bd632b2b2541971281e2f89794d8612879584414abfe0b6bc
SSDEEP 96:qmr4+Ixp62Da2xjSA1P4sCZZEYXRhedLXgim2Uz9anfk2gyudJcqTPQMyrljISHt:xrnCDa26sCZ4LXgil8XcmqjISq+N
TLSH
T18F026F7086C32554EB5235BED4F9CE2CF97562E4F9A3BDF684AE05742F0E35182681C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 75ea24fe88c3e4ef71f7bbd0757b2bb59403eedd6c414e7461173b6e86601885
MD5 8d63013533c1c0c60b2ddb84cc79849d
SHA1 7af07134d4791d2772974bd727658578b908d920
SHA512 d1e121986fc45be6c14f86f15e459ef2682c837b0a220af21edf9231b2b6faa9fb21847e8bd7619fe5477fa0304153db86b12ae420c51ae02906ed4ee2b7a719
TLSH
T197718138C78306A4DB6175B294FD0F24787A83D8F9B32E8AC89C19386F1B351C3681D9
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe60c5f4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe60c5f4.TMP
Size 3KB
SHA256 825525e9f00a0caf192cee0f30a016d6b5c9f11e4cf9652e78f2fbfffb19f891
MD5 d740b190abd5afba4fd48cddd09cd231
SHA1 8b43efdf8fbf29ae69df532a12879e216a24a4fb
SHA512 482ae01406ac1e41bc6d351bd59fd4897a4ac1a65e7a407f2658aabcf913c221d3f5edc59a1ddc0d1b2cc22ca9c9e9af259efa2892b1313d3a82d773bf22085b
TLSH
T1F4618238C78309A5D7A174B294FD0F24797687D8FAF32D85D85819346F1B751C3682D8
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 6aa54fad20dad79d700ed6b1adea3be00f589c50eb34bf734d5d8364a5f9a5ba
MD5 56bceaf538587aeb0266175b9ca2a57e
SHA1 b68ea5901a42f90cc78aec0726168db9f4d82045
SHA512 289dbaa59c0bd758f643425836177360aca236c10b1d8f71ae551316b838fbee12afe0a2c0d727785e52ac00e4cc7683f363fb97098045a25a5bf32d062886a2
TLSH
T1CC51ABF787A4856ECA1196F09A18AE2FDF2D0615431C3C6989D4EE27D3E3472E10265F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 d1047e5fb5e132850eb29023e42ff2a52776765b42779880a712bc05f7492e9f
MD5 33fa6d132bec1a9bae12fc410ce221db
SHA1 cee56eeb68687adea50988cf11c2b662c24849d8
SHA512 017cc81d8c88f33673e29325cdccbb9bd46869e0189761327c52ad70f10a3f89065a8da2643e3f3ee083d553890295c62f8ae35810f6ed9b834c15db5e5050f8
SSDEEP 96:DzOYuH1udu+Zfz+aPBG2iMBbKfLBlwd3AB9P0Qwueuu6QIufuxGwQ:DKY61GVlSa5di4bKfdlG309UrufwkGT
TLSH
T12BA1AAF787E4866ECA1156F09A18AE2FCF2D0914431C3C2AC9D4EE6B97E3472E14165F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 5e8dc98430c73287ed0ab27d02a912a3124a7ce7d1a1dced2958726772d31e22
MD5 178eb2b97b35485b13859273330a901a
SHA1 cb3cc546eeef7b8b89b8ec012d4ed6408be66e97
SHA512 1ad8369024a464f1c8adb57a2eadcc267ecea3a79232530ec9cb12d72e749333487112b23557b00f8e74563c2c06a7e6df607769e139b65cad753f8cbd0a2875
SSDEEP 96:DzOYuH1udu+Zfz+aPBG2iMBbKfLBlwd3AB9P0Qwueuu6juxGwQYuM:DKY61GVlSa5di4bKfdlG309UruVkGQx
TLSH
T1AFA1AAF787E4866ECA1156F09A18AE2FCF2D0914431C3C2AC9D4EE6B97E3472E14165F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 cd85933f96ba9748c1e0637ad29a3c1f154d5fbe6a20ca7cd1be5e9a679562fe
MD5 c5931a36e5a3fa350a85855e2325da97
SHA1 cd732fb8d104e8bc0f1179f9dd7b55e2179afd26
SHA512 39a1b2b5737c32b55ed78b2ff375c55bac5e8f41fb427148a8ff1346db97b6774dde4df9b40bb7993400a7e447382bdd047a6d77bdfe673c757f0b6fb2d8b18e
SSDEEP 96:DzOYuH1ukZfz+aPBG2iMBbKfLBlwd3AB9P0Qwueuu6QIueGwQ:DKY61zlSa5di4bKfdlG309Uruf1GT
TLSH
T10491BBF787E4866ECA1156F09A18AE2FDF2C0914431C3C6AC9D4EE2B97E3472E14165F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 1696d5bd8f24392416602b40b29904389c13e1754815c263d53cc7a624940140
MD5 a587ccb0bcf2781ad356a1c45d1dd445
SHA1 58b9c07ef0915910617ce2f1de558320e571fc69
SHA512 9d00445a45f9e9ea338d49b0abe85cf134881b308ec59d8db9195c27f1243bdd04718e6744e9e44df21a38ce162c5f51f2f6a6416589d0c4d587b495e783fde6
TLSH
T1AE2104A7C67FF5AB2039197F1D45BC093A77A83A0152ACFADB56D26CA0818F30B15016
MD5 SHA1 SHA512 TLSH

Submit Download

f328b8b8-b4db-4f05-96d8-bdcabdaa1709.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\f328b8b8-b4db-4f05-96d8-bdcabdaa1709.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 81ec5654dbb5a02547b772ead4f1cf8f19ae64708283fce86abf1a28b1648f2d
MD5 d00fbf7620d4090e25bf595357864b00
SHA1 61f1c22680122d63a94e095c3bd3291ac5a8ffa1
SHA512 1af326b4b5640ee292288601848cce4c8d282e8559bf9695de52f171187cbe6c6ea8c1d9d86269c04ccab38bc8c0859b996a7ab563a7c854bea1d36277cccba1
SSDEEP 192:sxZtR3PzG/f4sggFGKfHIdpwJHW6+WNr+e/AazOKueIg4J:sxZtBG/f4srF8gHbz/zc
TLSH
T1E732D952AD38A93B8CCBD219BA19BF13D6F5103291C11E58E6FCD61C04EBADD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 f6914316125858cc0efba4e134fe9379074379ed58e0a7a842e906a7442eff77
MD5 cb99c84c4a7d8388393e55f196127d53
SHA1 b63e6ce18263cedcd048ddaa7572c8a212d37bb2
SHA512 de929714abeb37e35eb094f7aed15f143196234995c9fa5b6658e0571f6585cafad9500b2ea5bf21d45e7c5f90d5e94bc94fcdb65b13cd819da9480dfd7dbaf1
SSDEEP 192:sxZtR3cmG/f4suWpVqgFGK0HIdpwJHW6+WN9Y+e/AaT0qyWsIgbvJ:sxZt/G/f4suWvJFzgHbK/wV9
TLSH
T11642D842AD34A97B8CC7D21DFA19BF13D6F9102291D15E58A6FCD61C05EBAED220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 9818e24e6a462caf51966a2f7effa914b4c0f9638377e30aaedb464a87f0ed00
MD5 152f41d0be726ca036287ed73537b94c
SHA1 12c177f98a85d73599573a33a6e1d1bd7e4ae9a8
SHA512 4dc1e03039ba62ca620937e0f54b606debe295ae8e4143fb92a815b0878c4bb001962030947b7348fb0b1ab36adba9d9f1f51b2de12358f55431382743b60821
SSDEEP 192:sxZtR3cmG/f4sHIvWpVcBnPKvB2HzodpEJJHW6+WN9ily2+e/eBFaT3ryT+eIgb8:sxZt/G/f4sHIvWvmn8VcHbPS/e7Tjyd
TLSH
T1B452EA52A934A97B8CDBD21DFA197B13D7F9002291D11E58A6FCC61C04EBBED320781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 daf1a911a9ad4faa44953449df84082f1ea0730af1f44c0d0d917cd62b1f3285
MD5 33fc6f9d5a11fa599cfd8f271dea8e3b
SHA1 d84538f5d25374256649ffa57a8cba72b5877122
SHA512 ab1eede54ffc02a0f9db3f75781aa7718980845350c2ea9010a0b12bccb758b4a26019c6df64ec78256030fcf875e99e6182bae70a7cabd3fb933e6141fbdaaa
SSDEEP 192:sxZtR3cmG/f4sHIvWpVcBzGKvB2HzodpEJJHW6+WN9ily2+e/eBFaTaxyT+eIgbx:sxZt/G/f4sHIvWvmzTVcHbPS/eOTj9
TLSH
T12952EA42A934A97B8CDBD21DFA19BB13D6F9003291D45D58A6FCD61C04EBBED320781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 cca5ca46aed96e5aef0d9aa597c2095243ff3dfc5912b2032aee165f1db2902b
MD5 315e8351812b99bcb29d29cac87c2989
SHA1 dd69daddf2f23930b525d7b8a5a8bc050bf83614
SHA512 be1cb02afaba4c05a5a6b75fa615ccb98b52962feb197f518148577a4d58a190d12ade291d597ab7d5a2a45994c37b8e72df0c63a0fd7eaea4c7c699b1750d8a
SSDEEP 192:sxZtR3FGmG/f4sHIvWpVcBnPKvB2Hzodp+JJHW6+WNIuQi/E++e/eBFaTqNqTNxJ:sxZtPG/f4sHIvWvmn8VqHb26/eYTkyd
TLSH
T1F562EA42A934597B8CDBD21DFA197B13D7F9102291D01E58AAFCD91C01EBBED320781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 774f05ca374266a31f72747076524a406bf29937dc299d68657712b306c775ab
MD5 370826b6184072948d59cb122c541bb8
SHA1 2e1061aa4bb10b6c1a9c0998666985838aa39cff
SHA512 2956330ed7cb145f8734414b93b2546ec31283f452cfbbb636d116a87d39543c03bb0cbdcd7cf66945fc31a5c9668a7f193e53b9c186e50c5409e8f61798308a
SSDEEP 192:sxZtR3FGmG/f4sWWpVcBnPKvB2Hzodp+JJHW6+WNIuQi/E++e/eBFaTqNqTNveI5:sxZtPG/f4sWWvmn8VqHb26/eYTMyd
TLSH
T1C162EA46A934597B8CDBD21DFA197B23D7F9102291D05E58AAFCD91C00EBBED320781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 ec8690f3672675f9f922fca2c4238addb8e874c0140d5b250d122f6f6674d2b6
MD5 dcbfaa4f4234ff7f86ee91d7cb892d80
SHA1 bc10584d65ff4fb6fa196fcb5a2af52eb919e0c4
SHA512 749764e8fb8a185ca94f9e7cc77f31ff7a86c8f2de90e55ab2502ac3955464cf7b61cc411d73d2347cdecf63b4cd68134490c66f34df89b46e0f8b5cf63a80a4
SSDEEP 768:19k7uHd7pLuLfg0WvqiEa8F1+UoAYDCx9Tuqh0VfUC9xbog/OVkvi5LlWYSBero1:19k7uHLEfg0WvqiEau1jaNvi5LA3B1UW
TLSH
T1CCE2EC7B780CCA7E4F800E9CED1A7F9B7EA802CB56D8C95087F9945C02C76EA51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\c7305d9d-3718-4725-a696-6ae041817ab9\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 233B
SHA256 4fd2827b4fa835cfed343a366ad42022a9404711cadb22da2e3c8a876ef91a5a
MD5 616bfbf2d66c272ff1af7d117b656bab
SHA1 c791f662cc7d407f18869d23e5f0bc59d860d0e9
SHA512 13dc509c63f76cae13b1ac8493ff4d710b0f4c5761095f950b8be175612a5ab389189d4fcd765131db029e780898d5558376b3f35e694a4fb1bad3800ff024bb
TLSH
T1D1D0A757E1D15450E76B4B421661009F4BA47CCA5487999CD903303D6971647D261ED3
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 226B
SHA256 b885aa8f1b972cfbde14e907f67f6f340b796e4923c409bd7fa3095df094cc42
MD5 104a2e0acf778d9f4e9d615fc43c47c1
SHA1 5034c224e9daa453e30fb4849345862a208a8a8b
SHA512 a862f48d40dd7c71b3222613ce21e0522a8e0b7d63249c70b43434d2aedd5fc1cf49d7f6da31809339e20d8a6f8f05c05a94b094211399a513de2fa359eae120
TLSH
T140D09757E0C09010F6AF8F420211006F0B543CCB109A89ACE8020038AC506078262ED3
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe616d6f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe616d6f.TMP
Size 138B
SHA256 c1e68287eeb6b67608575820be6e4fe2f2a15b22ef2078b5a51127340b88a904
MD5 03cf02efb75dc03154c46d63316018f2
SHA1 142a3cac1f9bd68ec00f75a12eb3a113ebb89eae
SHA512 6d05997b16a7c41aa7c3fe10abb097342f714a3fb5fac9e5d368ca64a4dacef9c8b34af46deb02712680617116f1617b4232beefa6b2835fb3704660b5980432
TLSH
T1E4C02BE7B0C000018B2B03410232414D47087CCE4C8784CD651334343471E236141ED3
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 582d756a98bed62fbc641aa78ae790cd4c0906c217d62fad651d7ede9b82ab25
MD5 6127074e2d5eac40b7d7b4f377b4f5cb
SHA1 a513c40dad67c9ee3c6a42afc4369b492bbdc368
SHA512 579d50a3748d269f14dff686801b53c2bf2ce19f1c50483103497d7f646f9586a6fb0edcb6d81962f3ea66b885081f41109278b4da81ec30e2ac0e7975456d9e
SSDEEP 48:KfSVOyIQA2aQL9IZy2KYTTIIjK1Kc7y5CI/KT60/yIfKLl:KIbCKcTIwK1K6aCgKT6IyUKLl
TLSH
T116917406307A0F55387F294EA29795365F4232633015B5AF7FB800A21E6BE254EFE8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe624cc3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe624cc3.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

office_endpoints_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2026.6.5.1\office_endpoints_list.json
Size 9KB
SHA256 f0c77aaacfc571e0bc3f51387febe134d991bf3c7f1941af303ed901f288dcd6
MD5 30719122f9edf4e23019a3b74e4f4325
SHA1 6707d64052797b9c5f1a5ccf016e5859c8ef898b
SHA512 ec2e1a33fcd1301f282512ffafb611ea705dc5df09d9aee014276909c1b62b0c73600121d94e9b6d9e160296672b41f2cb8c3ba23f121244ad2ea6521680723c
SSDEEP 96:DdQ/JJvwjyUsrdfsysVsnQfbJNZidYusysXYs2sFsdv12XvlRT07s/DkhcrHPglW:D7d7mfgiIWRcV4sobxezQd1Y
TLSH
T11512BB3BC4B49F229AB060659705E244F13C43BF5600C6FF76B9829C1F366ECA58E1E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 ad54e40cf8ea148e94d46632d78b552a98a09dc455ee20f612b8a69c3052db99
MD5 7febb239bbd49a13db00e40dd69798f7
SHA1 4ec623577e14b056e311f131d3c0d32008ffd433
SHA512 0f10c540740ee962f2f18222b19ac010bda306d19519468a0bd3495e49a52a6f4e74899b6fa37949eab6cbc2d61526698a616df6c17ad73ee68ce31ab8ac1b0a
SSDEEP 384:nBZcIYsNcge62b4aQ2Mdtp5CEJr8hZvKASBv9dsO97xL6HlytEDq12W3:JY189zph8XtSOO97xLoy6DqYW3
TLSH
T1ACB25DB098B46DE748A6F0C5A489F5036EF8413796D85E5CA2FDFB3C309F9B81326815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 4641ee65657fd71abeb2049ac1208ddc19f9c485c5e891a6d6bba4ddd0955bf8
MD5 b3e8233ce0d7b33b7b6a4270330c1b8a
SHA1 0b73cdf2c670f3d92ebb5397054c91c101f9a99e
SHA512 c1fc1b14f19dc68a8dc931b9cc3c080f04ce0dc29ffbdae1891c6400ec5525b7413b32acf4c4d4154a7a0d8d4208da49f491f11b403430475ef17fe00016b173
SSDEEP 192:+ONt64BVQmiUy+I+i5GBPKK7+FdG29p9hFC1SJrfWwiqjU6:+ONt6ezliLdtp5CEJrLDU6
TLSH
T16F120935ACB96C7B5DA2B145F48736036EE8413BFA856F90F2DC6B1C01EF66C2316846
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 62672ea1b38976f736f0ce48e9e4112c1417f6357c6e9eefbc8a64b6b100f17c
MD5 f49175bd1daa7a11ff53571bafa2d9c0
SHA1 14f9eccca7bdee52549b80a8ec23ce8407fd7879
SHA512 c1a3e6cd5a5a1b0e67d80fd3afceb848c674e9396fa7657007ab6718931b19bce8cff70f4268ab73929f0517f7147b559f7cf0e26cb3084c51be6445f1b63026
SSDEEP 384:npZcIhsNcge62bI42Mdtp5CEJr8D6HlytEDq12W3:hh1hzph8Doy6DqYW3
TLSH
T17F928E315C746D3B9DB7B105F48A3A039FF84137A7D45E94B2EDAB1C01DA6B8131B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 15fa266360b270cf3a1ff34e87a9b3fd8ef146e241e9c08d6b2c57aa0d684b35
MD5 95c6eb382892f7b887cfb5497a7c7bdd
SHA1 8737330d32703aefca0de59ece6cd0096520683f
SHA512 f70ff0302488442a1bb1f58d891e95243717d36608d716d028dcee3eadda4ef0c513f476a998e5dcef5252356a30f3d01001cb7eaf18a2dc8a4162f1e08a52f0
SSDEEP 192:MONY64BAQmiUy+I1+W5GBPKK7+FdG29poaDYUxU6:MONY6eA08WLdtpR3U6
TLSH
T15F021A356C796C7B9EB2AE45F58637176FE8113BE6C01B44E6E85B0C01D765C2303827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 af36ca167f2fedd32b2fba20d1485a38fe22a776ba4867c2a86a885b178cb92c
MD5 e2d3336983fbf4c267fe4c3a1f58b9ae
SHA1 5f41825c3d002ce0ee96c1f4600b735727b4d28a
SHA512 6c86f425e88841cfabb939044fecf0c73dd1100537479da156dcd01ac049ecdb6343c602666fedacb0595123b7dd3a326a28b98d42e59b4836c91d712073c7a0
SSDEEP 768:SrFpd37wgbOVo++ie4pheYStm5jMPSoy6DqYWn:Sbd39SjeSmXy
TLSH
T120F27FF084D399B6D8AD93C3577DAD0269BCC133B5884988B7E4A92CEC4B5BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 d6b94f7c72a8d62400d5549c295eb923ccc31f3614b0256e1bc624d483a79283
MD5 18c9f500fb7527463f5f7e09f379e9a1
SHA1 d895e1f5e87f3332d47f1a6bafb02f41505a2b49
SHA512 cb681f7c4db0dedb9c60625843336959deee8c6ca6281286e9ba8cf879a144c7dd6054d89047c15a7afae9cb0ba82df64fb75172996b5d9b3cdbe46f8cb51953
SSDEEP 384:nQZcIYsN9UMe62bmR2Mdtp5CEJrJ3R6HlytEDq12WjHx/7IzS:uYDYzphJ3Roy6DqYWn
TLSH
T126A28D3458746CB79DB6F506F59E3E03AFF81037A6D40E94F2EDAB1D00866A92317826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 0641fa5d837caa1a777ba3a0b090130328775f5407baee63eff985addb0b5a79
MD5 6dfdd84e24e385a2fa29d1cadcffb5ff
SHA1 70cf8bb5688373069708394821aad3ba3b7c4089
SHA512 ca18bd6aa1ee79c15acde0a733f9011b8b63bfe6a554349ab632baccee19361fc777bb1bd922e714890a57e7f99b37a64c5c07fd2d27f1cd61e1cbc9d5ded0c1
SSDEEP 768:vFpd3hwgbOVo++He4LAKz5jMPg9y6DqYWn:/d3ZdjegPXy
TLSH
T139F2C3F088D399B7D8AE9783977D6D0299FCC123B5884988B7D86D1CDC8A4BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 31KB
SHA256 c727f2758adc0506be1412c7aca2ef752af433e1db2cfa5c0afe703e44fbd85d
MD5 2f0fefabc0ab36dd7f2ef07c50051e2b
SHA1 9546162f80880535592b1df33e0ddf109acb5dfb
SHA512 44580d3559d2b810c0bd044023a06e4a636733908300033317cb8fdb2f9d147b0cb3488fd98c02e0a38b196e7518e818746f558893ef9ec56f6d8bc5608f5832
SSDEEP 384:nSQiFPZcINCsNu8TUNTUlIlMe62bmsVo++z2ZDfw4dtp5CEJrz3R6HlytEDq12Wn:SrFHsnwgbzVo++zP4phz3Roy6DqYWn
TLSH
T178E2A1F588E39976E9AE5783A77D2E029EFCC063B5884894B7D95D0CCC825BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 5922721f45a4a224774289ea719e2e4463cf7e84ae0378c503e6f8dbe6ed94c5
MD5 2319eb467481b4e998a0f4e9e55cf3cb
SHA1 41dd5376014f326318235d0689c5e6f6bc03ffa8
SHA512 79968a15b568b4e7efb983b9ae75297369db31b359457de0d4fec7a308f9dc1a3ac11e7d95891971a39186b13b99991d9ee1224c4d22c0c31f03a85f49eab8b1
SSDEEP 384:nZZcIYsN9Upe62bmR2Mdtp5CEJrJ3R6HlytEDq12WjHx/7IzS:xYQYzphJ3Roy6DqYWn
TLSH
T147A29D3458746CB79DB6B506F59E3E03AFF81037A6D40E94F2EDAB1D00866A92317826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\OriginTrials\0.0.1.7\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

nav_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
Size 2KB
SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
MD5 499d9e568b96e759959dc69635470211
SHA1 2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6
SHA512 3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905
TLSH
T16B51DB73D5988C4B9BF4A29CE919A309F11107CF75D48C0B76BE010C1F7757AB5C6588
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 972B
SHA256 13dcfd09b2e663c495a86938f17b473176b6fd857cae846f4a5536a0324eef23
MD5 0920827c19f9fc0e3b60e94b12256e44
SHA1 d67762e10c8555d71cce711dd8bbc68c17012d34
SHA512 cb0f594953c6f4e5c28a08a5ab0889855b00312a5e7ee39ce7aa7d00c268169058f082940ca2d0fc6012951ea12645c18fe65a1dd4094843c69b8885b5eb217d
TLSH
T11B1110D1183A1EC1D6BE0FAFA4873AFD40D8D626F2E434B918C9EC54563955E2111CBF
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 c8348e757ec581ff772a994ca3d7dd216b8387c7326b3bae5df55666f7a1c9dd
MD5 6a58459ec3bd5129f47f7f0b79fbdc2b
SHA1 d161d7825b80149c765039a1605edf0a5c1de3f6
SHA512 d332b3c7f2895abaa1e3645490ae5ef8fccd25319798bb15c85ef0563748699b47835ba09ef5f3efe53f67993b5dfe448741bfe1b6ed8f1e0a3bc8369a10424e
TLSH
T10421F1A0583D1EC1D17D0EEFB09729EC40D89226F5D434792899EC68563E5592240CBF
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 05b5d3bfc3b8d1322c0583392be73a8e397329605f42005ca61572f4901154bd
MD5 4f3d689239ce8ad683b858c07c5e3848
SHA1 dc556260632259644e1082f17921628a8ad69882
SHA512 10153a7da3b608079b385ff76483fef33604b32f095eaf258984c63db4a4ee35af0042d5da1fe44f46940118b70d59062a930679f2252133bd7fa1efeb4a6412
TLSH
T1EC11F0D1283A1EC1D5BD0EEFB4872AED40D8D226F1D434781888EC58563E55E2111C7F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 852B
SHA256 df02d158fdd20afea19834920489dfb4be4dbbca14f9004dcd61dda8fa31bf12
MD5 dfca35fd5f3723ba47eb4029e44c22bf
SHA1 8dff18af766e4093b271817480aad000ff0e1242
SHA512 92e4dd0924d6588fb34f5934039a76fc9d48ff99c732d59b52036925f0e3052e56cca1ac89160f7f91bb709b3cf0b19b74cea996a80c4b54bab0b9e381322abd
TLSH
T1830112D0587A1EC5D67E0F9FA04726ED40C8D626F29434B808C9E854557945E3505C7E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 732B
SHA256 91fcec9b45e5b06ad86affa43858adbfdbab3a062843f37dfbfc99a980f22437
MD5 013c1f809fc23d83b76e260e28760fe4
SHA1 6b3fbbdc43bec9427c4fe3d26b9c8f6208c38c10
SHA512 6f079a159652e15d81dc345ab62e4f03f36be7ebfe58cdd836f4adb2ec1d7e2f4f5b0bd2f12d9478e80ec8a9424470ce8ae5fdae21512ae1b0030ba76521e756
TLSH
T1030110D158391EC5CA7D0FEFA04726EC04C8952AB2D524F908CDE864553A45E3101C7E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

59ffddc9-1532-4622-9c11-b64a29171209.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\59ffddc9-1532-4622-9c11-b64a29171209.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 5068e2096fd014daad3d56ab8ada5e746cf5ff87af60259d4950616629098f57
MD5 2e1dd8ce00786aa885da7685c9075561
SHA1 4f20960dc2536e174a212cd3c710dca405e76c01
SHA512 6deda3043d2649ce33a25e56b6307f0e0e4c2dfa298d9888efe02927e7b342a5e1a20bddc5ceab353728188637711d74a52d58d06d81538aadf6438beed38af6
TLSH
T1FA414A6CAAE91118B3B37F169BF6B86E487E79372E06D44D10010D4E0A23B00DDB1B37
MD5 SHA1 SHA512 TLSH

Submit Download

1aecd286-144a-453f-88ae-379352cd84c1.tmp

Path C:\Users\Admin\AppData\Local\Temp\1aecd286-144a-453f-88ae-379352cd84c1.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6054631f-60cb-41b3-8812-c6defe0cf91f.tmp

Path C:\Users\Admin\AppData\Local\Temp\6054631f-60cb-41b3-8812-c6defe0cf91f.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

dd_vcredist_amd64_20260803004655_000_vcRuntimeMinimum_x64.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260803004655_000_vcRuntimeMinimum_x64.log
Size 2KB
SHA256 335c336fa1f5b9992270074a9464a03ff0c4ce52d1da9dd0c579e1563a2c6078
MD5 60c5f1af59177037c50be2de43605cd1
SHA1 b738a7c4da00268952e3f136226d338eafc898f2
SHA512 3f19db623158c4d128f81f240f9a82cdf8acf5ea67ca14354a1faef23490a9ee54142803108828bb165fe90e33476b45c717428a54215ca2da96e2e665e94fa8
TLSH
T1084118642FD50C5AB1B76607EEF3C0536A33FCC598749F0C2345831A066BD0299A477A
MD5 SHA1 SHA512 TLSH

Submit Download

dd_vcredist_amd64_20260803004655_001_vcRuntimeAdditional_x64.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260803004655_001_vcRuntimeAdditional_x64.log
Size 2KB
SHA256 a3f710fee840840c85fd3498cffeecff3c4943624ec59831af7634c079ad5208
MD5 cfd53d7310307f3d2781601d906b8d5f
SHA1 d44f43d1ad73e3fb9cdb599579f839c6e4d99bcb
SHA512 e7377d28498926fec3510a1fd707a3161ab264027544150be167ea8a5d7c059ba17dcd2f6323c2c9715b9f036ccaa28b16189ca5523831de02eed1e37e324a51
TLSH
T1FF41C6742BD50809B1B79747EEF3C0625E73FCC9A4349B0C2385821D46ABD0699A877A
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir720_1646223385\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

598f253a-5b78-42ef-914a-cb970484adfb.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir720_429050392\598f253a-5b78-42ef-914a-cb970484adfb.tmp
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XENO_CACHE.bin

Path C:\Users\Admin\AppData\Local\Xeno\XENO_CACHE.bin
Size 36B
SHA256 3bab55816f9c1c63b26bee8027a74983736938cfa748d9c91230391d4bacfb88
MD5 03b4e88d732421deccbdd05cb90b0513
SHA1 1ba9d3bd3af60ecc041e93251633b5a0fbac4d9b
SHA512 40e01403608fc8d8c0bc7bc6e1367a472778dea5d4dde4d242b37b0860d098075ac71cf24abd85c6b9ee67bf6adf80adaaf279a969f4477555807003276a2c75
MD5 SHA1 SHA512

Submit Download

settings.json

Path C:\Users\Admin\AppData\Local\Xeno\settings.json
Size 101B
SHA256 88e5c8567b1cad0fa2a42a21ac273a1ffb8a6992be41e5de548d11f281f4c373
MD5 7109faf92716c37ae9d65f89a2477be0
SHA1 de2903bb44600fd8a69649c395335d4fc226c5e0
SHA512 f41ca49622d3458c1365fd9f610e1c27fd3dd816ce5c910e785532dcc39d94ceb1a00991909cc247ab4b9e9da0ac583245168853d8bdcc235116f0a7a4538b2f
TLSH
T11CB09232984108FC01608299C841D80203118E0120662E02B4BE025928308346000FD8
MD5 SHA1 SHA512 TLSH

Submit Download

Unconfirmed 133165.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 133165.crdownload
Size 17.9MB
SHA256 843068991daaa1f73ad9f6239bce4d0f6a07a51f18c37ea2a867e9beca71295c
MD5 8da7373f3ec287fe1c3ad72a7b2922f0
SHA1 46adcdfbe9aebe767657b7a802cc366f827ced77
SHA512 c42c82cfd5eaa2165b600f6109cb14ff4308cdf4cff656a1375b4a933f1630bfe54c99c4d0fb9ed3bea4dc4e4fdaa3db8e7c58356cca07c2954f4c297757d62d
SSDEEP 393216:rCpQ/hbBWGW1tkWSz61gUM0SOm53TgypRvlxoMtBpMw4OrW:rCpQpbQ1tBj1gR0SP53tRvlLpM2K
TLSH
T133173332A4742132F6F16437F968F1307E3CA72863D09D99D3C8AD99396488267F725B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unconfirmed 213786.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 213786.crdownload
Size 10.0MB
SHA256 4264934f253fbb689255a9a497a60588b8d51e7034ae3146c4c8be17d336021c
MD5 2b32b0751ef39d2e825d64d167cd02eb
SHA1 584b843e0cfa94eb56c346ae91cd36a069412156
SHA512 1557ebbc182b901cd195b65743e46bf1f43644ca5f7f0719d91e72887c745e29318f1e43f2f8f864c814038c7b5f4143502ea527039a6761ddb186fce9067f00
SSDEEP 196608:EgZ2Jq0tWHeeyOcZRZ7IaF681K1TtRF7zjrA54/MXwiBGUO4HL0TWJyT:J2JqrwOcLZ7m9zjEoM1ZOzX
TLSH
T197B6333161A45136EAF40277B968D6347E3CF2291750897EE3D4FD1E2DA48D26BF3222
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Xeno-v1.3.55-d47d833e.zip.crdownload

Path C:\Users\Admin\Downloads\Xeno-v1.3.55-d47d833e.zip.crdownload
Size 6.8MB
SHA256 1c289425268302a153c03e144c0ee13fcbbac0081780f68db6a0a793a7adb658
MD5 76ed2d5e9804bfbc38a3a16c2a30eb82
SHA1 7d238524a38180bedb841d40b64ff38ae83383f4
SHA512 2e00bbede4d28ae14f7b395eb948755c7144c4ce45231757e4623b476ad3ff8f10122355b88473a84dca6137d1ff58d15a5f854566ec8401059356116704a846
SSDEEP 196608:d/Fs72qPGBvG7bM0t2XaCzx/sQ/28lgSjJh7d5yV/vJg:d/F62qP/nM7ha8lgU5yV/vJg
TLSH
T1F86633ECA7F818C2F92481BD9D601BF87613F7857611961BE24814D272D7DC0AA87B2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\Downloads\Xeno-v1.3.55-d47d833e\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 12c12076ace0d89ac928815ea23cf42145b69d829705ec6c2b15ef78f682d025
MD5 43aaf0ae8c3f2af07fd14164ba687bba
SHA1 4a3e0ed8676987512cfc63a90395ccccb66508c5
SHA512 47b89c2190b3462d4e8da093715de5b230306e5f61e642a010b73ad8902e3db165222e03c28e494c1484d3b161d3b8bd03290d163898feb50564e7c4695d6ec3
TLSH
T13ED012337641053CC0103177081265090400C10FC51A41445828D56D5A180900D02842
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\Downloads\Xeno-v1.3.55-d47d833e\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\Downloads\Xeno-v1.3.55-d47d833e\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\Downloads\Xeno-v1.3.55-d47d833e\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\Downloads\Xeno-v1.3.55-d47d833e\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\Downloads\Xeno-v1.3.55-d47d833e\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView\Default\Network\Network Persistent State
Size 229B
SHA256 153938ecc186cd98a2f1ebd1f53ae88cfe9d9884bd470e9166a53348a071fb2b
MD5 5c9f79435fd36dd2a8914a542651f839
SHA1 81f4f5faf2f14d448626b3f49618d11fd4295cad
SHA512 0e7cf3372f919b11b0c6341bc4df2bb8ba5106463b06c74f0736b14755fa23a78db7e9b3111938570225435169bd01f7198b6124007defa77e90bbe21fd14588
TLSH
T17AD0A7B655601AFE075583E01A24685BCE7D4003422C9DBAC6347B2D43A11B9901095B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe6286ed.TMP

Path C:\Users\Admin\Downloads\Xeno-v1.3.55-d47d833e\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView\Default\Network\Network Persistent State~RFe6286ed.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\Downloads\Xeno-v1.3.55-d47d833e\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView\Default\Preferences
Size 6KB
SHA256 1f1b1e7dd48b76850cbe6dc9ed659b0acfa436ec5f8b283e0b96bc8f52b96e30
MD5 0ec3c824970cc20dcebea6d29b5b1ab7
SHA1 5d5a5536fc671af7ab2a6343cde65e84c2b68ffe
SHA512 ffb932d663bdcd95e7c5879faac6bb96cf781f95a925df8a8665c56eed7e82ed50192d9ea05f0b67234283d729efe76e59da5c00f34a3354acd3cc8921b88d30
SSDEEP 96:stQ85sAJHLQb9TffzZ8i0vhESkm9Fm/7qx+WVHMSm+uecadQj2+g93c+MOB:stQ8b6fLZ8paCm/S+Wi8dL7c+MC
TLSH
T1EFD198025F6869778CC7F7197A36BB12E2F5502321D10E98FBFC861C09DA5DD221790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe62026b.TMP

Path C:\Users\Admin\Downloads\Xeno-v1.3.55-d47d833e\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView\Default\Preferences~RFe62026b.TMP
Size 6KB
SHA256 c346e65a5a0a0075446d2fecc3fba0e69d384ce0895abab1a031c072ce474e08
MD5 33bab2719faab839ad39c1a39d5d95d8
SHA1 fc46695fe1fa9412bacd0b526837528b0233d8b9
SHA512 6a9fc36ac0e7d55970050569fde1afa4167af359fe605f7050f6958a12dfaa290b7f8202a4b20b39bd2ff82e8a109d3e9cf8db5049b97d4244afa51b18cb33e6
SSDEEP 96:stQ85sAJHLQb9jffzZ8i0vhESkm9Fm/7qx+WVHMSm+uecadQj2+g9pc+MEB:stQ8bmfLZ8paCm/S+Wi8dLlc+M8
TLSH
T1AFD187025F68797B4CC7E3197A36BB42D1FA602221D50E98FBFD851C08DA5DD621790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\Downloads\Xeno-v1.3.55-d47d833e\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\Downloads\Xeno-v1.3.55-d47d833e\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView\Local State
Size 3KB
SHA256 7d8f3041701b8f0e53d56cea70fbead597c034635e230980f2463081adb892f1
MD5 98117680d220e9c5ff603a0db1b4c3ca
SHA1 fe47ec82f2e7dc309eeba42551497ac4763bf377
SHA512 a60adb850421b2bfd6ecd1e78e084f8c011eb5e55e60eaafac05b36993ca10f63db0f22a110ae2d5a896cd8c447ab5f9b50270285ff917bfffef31c51e2f8681
TLSH
T187719826AD64AA3B4DF39A40B98A3B17B6755037D1913FA4C5ED0F0C01DF7A82312C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\Downloads\Xeno-v1.3.55-d47d833e\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView\Local State
Size 16KB
SHA256 95f42af1e52ecdb73351af3e379ec37edc45508a59469c70604df1891649969f
MD5 35614f3988c02efdfd3f387a8f01e638
SHA1 fe8fb452cc4425f57c60d7095e49c6ae64106e84
SHA512 26bb71236aebcff1438a297622b22a74835cd6cd4de6aa0fab38b10e916f37c3fc81f3266bf2ee0b20aeafa1d288385631cba94bac65d1be53036fe0a660a04c
SSDEEP 384:zk+aQikB+z/xvxjg/qhEwNbT+uT6lsxdj9zF:X/UxvxjgC+i+ls3jFF
TLSH
T13C729E3B55787E2799F3FA04B94D0B4BDBB9847380C12AB88AED5F0906CB7A41356D12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\Downloads\Xeno-v1.3.55-d47d833e\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView\Local State
Size 2KB
SHA256 d7869d2f55eeadfb52ac4da8206907ff779c0940559d447d6ea2b53ade10a3b5
MD5 be67563f5fa7d108f07090113902f056
SHA1 99c3b1fac097f5f060d6a7fd7f42c4dc77aa8165
SHA512 9faa2cf9134c6d3b8cade9319553e209e62e7ee1c55849265adca394826d1c4d7631ae42c464f96720e58349eb8e43cb19dda490ee7cec85a09965c1e9bdd59b
TLSH
T17B516372AD54AA778DB25A40B94F3B13A9355066D6522F6096DD0B0C01EFA7C2326C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\Downloads\Xeno-v1.3.55-d47d833e\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView\Local State
Size 1KB
SHA256 74706774890e3f4abda43754822b540214ca8619a461fd827ca0f2919e81978f
MD5 b5fd2ad9f18f84bf3251e95c80447aaf
SHA1 bce4f423ddcd89dbdbda05f38d93215521bbb363
SHA512 8ac2cfab50b5b2ffe9fb2f82d7eb1ac28b20f73b824cbed7edde2f5b435e62a50575062d5ec6a0a1a8cf7104c410ecac37aa15c2225beebc3b2f490f4d879805
TLSH
T1B4316272E9A46B739DA26641B14F7A472D20103BD1114E54D2DE4A1C02FFABCA63AC33
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe61637c.TMP

Path C:\Users\Admin\Downloads\Xeno-v1.3.55-d47d833e\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView\Local State~RFe61637c.TMP
Size 1KB
SHA256 34cbac9df8b9e6af10528f861ab1a185a7096214cdad4951e6e295957d683f1a
MD5 06ce4b68ea8c8bd8de000f8874151bb8
SHA1 63dcdbcc999bcd9486eefc1aa2f7e266b91f47b5
SHA512 6e393b6c92cf8ccaae0c91101f1f9ca86de2eac347bc999b77aad90beeb86574cbe191017d07878c414add14c7a6e87cac7f1da48e05c46bfcfe854a9483f329
TLSH
T19D214272D9A86B77ADA15950F14B7A8B2D60503AD1015F18D2DE461C02EF9BC973BC33
MD5 SHA1 SHA512 TLSH

Submit Download

crs.pb

Path C:\Users\Admin\Downloads\Xeno-v1.3.55-d47d833e\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView\PKIMetadata\46.0.0.0\crs.pb
Size 233KB
SHA256 c132e2ba94619caf6143b3bbdd9c32944e80cbf3bff87364175c42801afe2584
MD5 8bbfaa2cd5cdd9a5019da146cf4deed5
SHA1 17ed2fb07543c5d4bc196a1989dd16a9dbcaacc1
SHA512 cfeee2916f19648ed408b4287e234b4140cf82254cd4b83d918c0a4c3bac2b0467d921915aec290823355be4a0cc82017557be588f65134b466b7192f795f6c2
SSDEEP 6144:KKiD4F7BVps9YpVW+J2i/P66k8GyST+uUP:KB69Vps9C2GAQb
TLSH
T14A34AE9A0F3C3A11BFD2DEA466C8D9377D79B3E06A6928172111C4F169927E07D8C12F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ct_config.pb

Path C:\Users\Admin\Downloads\Xeno-v1.3.55-d47d833e\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView\PKIMetadata\46.0.0.0\ct_config.pb
Size 16KB
SHA256 aaeeb46cd91a4a392223cf2885f449bf532f0878c087d50bb0cb3fc7fa873a60
MD5 ca6e253c3fc7718b4455493460053be3
SHA1 4085dcccd29a931b8ea9b74f008e26409edf78ad
SHA512 0004e83a845bdab07f01df32094c202c9f3b8767a6dadd707abc19796f917221f869791673315e9d2c5a6a1fc50b922cceb622db98601055df5949818dd6ea58
SSDEEP 384:7tomWvvtJvzm9myvg+FN2VOhikm5hV5+QiyA94pDmiDyDS1c8CazaUhszz:7l5Zhk5hV5+Qis2DS1cbe7Kzz
TLSH
T13A72C9BFA1169F000383D558D6E157AAA12363DACCF3763DB1E1C005F5423E6B1A567B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kp_pinslist.pb

Path C:\Users\Admin\Downloads\Xeno-v1.3.55-d47d833e\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView\PKIMetadata\46.0.0.0\kp_pinslist.pb
Size 10KB
SHA256 b5b2a45a5b25becb901916b13752e3477d4126a42d088f29863bd8672320ecf6
MD5 8061c7027f406f3e20ea5d26969f00bd
SHA1 635d6260e16d1ac595f760df9c5bdda8279629a4
SHA512 7be0be7d59ed46b7ce6adbc1ddc42119426b3223491a03ff068dae66d13a261cc954640916ff4379a6040e021689f070b33dc82b45c010b728ee59abd42f3610
SSDEEP 96:Bxk+yBjecaikDBwrBnnoxGwMAy5z5tBT6c5MacFwn2Xh6g/gw:I1IDCrBnYQ5jlMacFwn2c9w
TLSH
T1362204B37904F99350E7E0BE1041F59AE93343A540ADF98A528C4A7635F1F0719BB4EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Filtering Rules

Path C:\Users\Admin\Downloads\Xeno-v1.3.55-d47d833e\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView\Subresource Filter\Unindexed Rules\10.34.0.84\Filtering Rules
Size 2.1MB
SHA256 5e301c48e6d7290990971e9f0bcb2263c8adba06ed0a2c6db5086949825d999b
MD5 43f62d9f35fa6597cec4e2ad5643e282
SHA1 8dba6404724ffd6a2e89901e8dc6e5e55fed3374
SHA512 91891d23464f89e6769d9ec7a28867e28f77925e6e3b3b75fb628d8672157ba239676c07699c931ac307a21ccc4dae95dd707d410f988ff82be4015103d4d6a3
SSDEEP 49152:ua2qP9SKIrivd04TxN/7Uw+zJEhs6dl61n4Kmq9SL6bbBT0HjTsQc8cxjw:u8d
TLSH
T1BAA55D237518BDF45BB31F3EA44B6D48823962A483E3EDC5EA2BD10ED5E014F79601B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE

Path C:\Users\Admin\Downloads\Xeno-v1.3.55-d47d833e\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView\Subresource Filter\Unindexed Rules\10.34.0.84\LICENSE
Size 24KB
SHA256 ed0f972d56566a96fb2f128a7b58091dfbf32dc365b975bc9318c9701677f44d
MD5 aad9405766b20014ab3beb08b99536de
SHA1 486a379bdfeecdc99ed3f4617f35ae65babe9d47
SHA512 bd9bf257306fdaff3f1e3e1fccb1f0d6a3181d436035124bd4953679d1af2cd5b4cc053b0e2ef17745ae44ae919cd8fd9663fbc0cd9ed36607e9b2472c206852
SSDEEP 384:mva5sf5dXrCN7tnBxpxkepTqzazijFgZk231Py9zD6WApYbm9:mvagXreRnTqzazWgj0v6XqK
TLSH
T140B2526EB64903731AF30116AA4B64DBF31ED03F362A4564346CC1481FB6E7443FA6EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keys.json

Path C:\Users\Admin\Downloads\Xeno-v1.3.55-d47d833e\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView\TrustTokenKeyCommitments\2026.3.23.1\keys.json
Size 8KB
SHA256 ae6e69a145f84c0a261b4e82888779fbf137f193881d687588e1af71609ae947
MD5 d3ebc1cb4b692c6e2d29a4625420fe73
SHA1 4ce74c1e9af6fd34d6379ec0fec6afb24082a7c1
SHA512 e34b855615e6a3bf770f27d85aa29ca57a324c08bd8f8d9c0130e2a142c0e4a5f17bffd0861b725acc8a2316f73b7fe50406b0af26264a5c2d8f37599b260860
SSDEEP 192:uNtGbR+mFGfvPNyR9Pm4lOvMwkoR9PuGMXcy:ORmqwKjA
TLSH
T18402A57F14A41181CE7FC1698F0B78B78FA038065BCA3A83539BFA49494296D173B5B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIE22F.tmp

Path C:\Windows\Installer\MSIE22F.tmp
Size 219KB
SHA256 2bf33a9b9980e44d21d48f04cc6ac4eed4c68f207bd5990b7d3254a310b944ae
MD5 928f4b0fc68501395f93ad524a36148c
SHA1 084590b18957ca45b4a0d4576d1cc72966c3ea10
SHA512 7f2163f651693f9b73a67e90b5c820af060a23502667a5c32c3beb2d6b043f5459f22d61072a744089d622c05502d80f7485e0f86eb6d565ff711d5680512372
SSDEEP 3072:FVzl3qiEZybztEwiUx6D02cWVsV1v2vZR3X6j7zo6k2FkngTLrOrORT9flQnS6lg:FVIMEgXmEAR3oHon2VaFuG0eEp
TLSH
T1AF248D217494947EEAFA0832A57EDA71BF3DF2241760C8AEC3409D1E6D604C167B7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5ef9bd.msi

Path C:\Windows\Installer\e5ef9bd.msi
Size 9.8MB
SHA256 3699ec264257593813fc71c8406500e5e70dc75551bb7b9f2c37fd6d55097f56
MD5 4dad953dc722f367e25d53ce40367aa8
SHA1 5c0d45b533f16f07b130d176da15943b3ea6bb0e
SHA512 9a3d26ccff5ff7b9f699b41dbcd3a94ee66bf507ae2599b302e4289a318c2427e1e6176aaf9f0037c689e4d4cc611a55d3da29fb9b9adecd77113aeb8047ea74
SSDEEP 196608:s+tkMKMOvBCBRI1mQvEGYvPxqZDnvX7cdJylOm7b+2I+0:sSMBSMMGYB6/1lVy2S
TLSH
T11AA633233DC5957AC8ED0C7165B983649F3EFD215690CA5B6340BA1DDCF08E09EB2AE1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5ef9c2.msi

Path C:\Windows\Installer\e5ef9c2.msi
Size 27.5MB
SHA256 16d8a182dcb54a7d93defedea3bd23cc44f291a5d430e9a41b3379add5c9c963
MD5 59589f076158800d29bf3f83136b3c38
SHA1 2298f1a89ce7c1208274675e90861f3e0c35c61e
SHA512 74ad9447089266ecb00a3646c063fb61f84e46c903b4663a7816165adc2b37118ddfbc214fc4fb0c760051bbe6da74d3a8534a4e948e22d8ed6e72c6365617c7
SSDEEP 786432:0mwF1ZdIi7qAuVQGdtzBg88DHVT3GwXd9L2:GFqVnhg8fwX3L
TLSH
T13A573393FD82843AE17D1D3194BE97B46A3D6E111B0ACC1BA254381DFDF22D04A72ED6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5ef9c3.msi

Path C:\Windows\Installer\e5ef9c3.msi
Size 776KB
SHA256 1e32234822baf467c0eb2e2b1b498ea5f19e68a37fa74a4fb54b4b0c880d7a76
MD5 91fbf55d6cc731e4742cfed4db34fa82
SHA1 199284451a7a4c5904e63e691dd1fc8d8f4ffcc4
SHA512 fec81c0ad9bd574690c7950fb0a4a973ece04caadcba92b9b1a1a0f7ce27bd6f718fa4e75fcc50ead37d965c7d6db1dcbf947a51b727a481610bd06e472e9038
SSDEEP 12288:0flV+AtnKhJXV1EgXmEI3os2Qx7E4D4Rxbp4K+1uiq:Qj+A0hJXXdc3/7Rin+s
TLSH
T108F4AE137D80803AD9BA1D719539D7B16F3DBD204A64889B63807A1DDDF11C0AF36BE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5ef9d3.msi

Path C:\Windows\Installer\e5ef9d3.msi
Size 30.0MB
SHA256 87a9ba31111ed5aab4d44e31e3ece65126150e27447f5e30aade964694589517
MD5 70cf6a2e93dc90095236ba5477b2c767
SHA1 1b52740168aea04639d6c9ceba8e498a90e5ba9f
SHA512 d38565990bd8b75fc946e0d0f769b7a990982d05d585ced1f6121ead5f615b9a5561b328e4258f9cb75f2b6dd32551695d796104910a4c4ef952c1e516364bc2
SSDEEP 786432:yl9KaCo8bNp5Q5leTPY+OK/iAcWWHUto1Pe:a9KBXQXeTSWW0toQ
TLSH
T1FD6733137D53E174E89A0E75823A9B60AF3F6E241A208DE74310BA1CDDF06D05D76BE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windowsdesktop-runtime-9.0.18-win-x64.exe

Path C:\Windows\Temp\{3E804F69-6020-4364-9642-D6B8F4966240}\.be\windowsdesktop-runtime-9.0.18-win-x64.exe
Size 607KB
SHA256 78a6d3bcdd33c659ba2e04ca01276bf725f4ced3654698f14706eeb93b924d3b
MD5 1be627af972f9f81164a08b0d7d6dfd6
SHA1 4d144311e2b9fb2d6f3470f3669eb5990c2c240d
SHA512 418fcea8100c6dae3f7f6a3eba06a9e64831ff7c03575fe3474074c6cb157cc9da742e7fb59a0df7ca0ae47f22281779e0746ce04a40c0e8bb3d2537474a08b7
SSDEEP 12288:CmEsd9PZfePv3xl7ft7V+6uC+zd5qLlJF3wURiy7nlEM0Dnma:Cm39PZfePv3r7fm6t+jqpz37rzCM0x
TLSH
T1B4D48D32A5614032F7F10673B92896303E3CE328175488AAE7D4AD1D7EB88D667F7257
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BootstrapperApplicationData.xml

Path C:\Windows\Temp\{4F2E221A-118A-4B08-B7BC-1CCAA11221C3}\.ba\BootstrapperApplicationData.xml
Size 7KB
SHA256 4d6b96253fa1aed27974c2ec2da521112005b0083c7f3c1ce72a22268b5e7357
MD5 a674558d8f5039f3361b9ac634d6e3b4
SHA1 40bbe7fba815543df6bff87ce8619b2d613dcf3f
SHA512 5c66b0cfff3d80536ca1a33136abc914898a1eefa76e3394cb03a6de1d924fde1d0e30f784ba20c16f6350d1d1b716ab3b634002c37ff0773e55a1f3fed170cf
SSDEEP 96:XeV2VS/V2VvPMtn6nVAYHF0wUycqkn6v8xA0wcycpZ4n6DkF0w4ycavn6qWf0wz1:X0sesvPyUXu0rk8mcLIv4Vvpj5FmEym2
TLSH
T16BF126142FFD0325F0F74F84E9F8511A5A35BC926D38CA5D02551E0E8973B8299A2FBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.xml

Path C:\Windows\Temp\{4F2E221A-118A-4B08-B7BC-1CCAA11221C3}\.ba\thm.xml
Size 11KB
SHA256 83ca096f7ba2c83fc3b3aeb697b8139a788fa35eb8632943e26bb9fff7c78e63
MD5 302563a713b142ee41b59e3eeac53a90
SHA1 1340e90cc3c6c5fc19a7feb61d7779f4a4f0fdb5
SHA512 c9d4dfc20802bb542178300d1044bb94b35593b834ab0b50875a32953f890e48da456199128500e2c1fee26eaaf8c2c4fcaffb308b37914215f900cdd5c4cbc8
SSDEEP 96:eCdhlFGZRd4UyAi0Rz96zYFGiRdl6dXXdT9gUoLNEmRG3QBinRFRK03K8+GGI9ki:eCSfiozEW/A
TLSH
T1A2325BA986DE7C00D232E711ABF271D6AF126862C4C46E58F94C39BB4FE25406C7727D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{50A8D8C1-5DFC-4EE8-8185-0E011ABEE055}\.ba\1033\thm.wxl
Size 5KB
SHA256 81a68046b06e09385be8449373e7ceb9e79f7724c3cf11f0b18a4489a8d4926a
MD5 d5070cb3387a0a22b7046ae5ab53f371
SHA1 bc9da146a42bbf9496de059ac576869004702a97
SHA512 8fcf621fb9ce74725c3712e06e5b37b619145078491e828c6069e153359de3bd5486663b1fa6f3bcf1c994d5c556b9964ea1a1355100a634a6c700ef37d381e3
SSDEEP 96:MT0abTxmup/vrCKATQdYQHdYCwgoVOBq9LjP5dbSE7:OQNkdYQHdYCYXt7
TLSH
T1F1C1DBA778CF53C128731255EA925AAA5911C19C537F2DF4FC8B454B838A827A373F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bg.png

Path C:\Windows\Temp\{50A8D8C1-5DFC-4EE8-8185-0E011ABEE055}\.ba\bg.png
Size 4KB
SHA256 9095bf7b6baa0107b40a4a6d727215be077133a190f4ca9bd89a176842141e79
MD5 9eb0320dfbf2bd541e6a55c01ddc9f20
SHA1 eb282a66d29594346531b1ff886d455e1dcd6d99
SHA512 9ada3a1757a493fbb004bd767fab8f77430af69d71479f340b8b8ede904cc94cd733700db593a4a2d2e1184c0081fd0648318d867128e1cb461021314990931d
SSDEEP 48:u+Xg+NXWbdlIr33lx9W5OstaDIy3r5XpPyvZKmXYTDeiByNxcaaaaaaaaaaaaaaE:AaXWPIrHT932JsdpPyjqDeioatEn
TLSH
T19891B4D8FCF95322C6002BF255F4C0735A0215B713ABFEC82F496BD90E6878E25058B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logo.png

Path C:\Windows\Temp\{5500A78F-015B-4BB8-8B87-793CE2A438CB}\.ba\logo.png
Size 1KB
SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
MD5 d6bd210f227442b3362493d046cea233
SHA1 ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
SHA512 464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
TLSH
T1CF312CF34748B7A7D30581351471819AD242FFD8F9CE291E35CD5307664018115C75CF
MD5 SHA1 SHA512 TLSH

Submit Download

wixstdba.dll

Path C:\Windows\Temp\{5500A78F-015B-4BB8-8B87-793CE2A438CB}\.ba\wixstdba.dll
Size 215KB
SHA256 e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
MD5 f68f43f809840328f4e993a54b0d5e62
SHA1 01da48ce6c81df4835b4c2eca7e1d447be893d39
SHA512 a7a799ecf1784fb5e8cd7191bf78b510ff5b07db07363388d7b32ed21f4fddc09e34d1160113395f728c0f4e57d13768a0350dbdb207d9224337d2153dc791e1
SSDEEP 6144:K6EZdi6e93SuDeTKZxQfsRy26BqbUHYJe:K62i6eNSYeuZ2sRDK
TLSH
T15E24AF12B5D0907AEBFB19305939E5216DBDBA210FA0C9CE5348AD2B2E705C1DB36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BootstrapperApplicationData.xml

Path C:\Windows\Temp\{6B44EA07-563A-473A-A46C-3CCF9744D409}\.ba\BootstrapperApplicationData.xml
Size 7KB
SHA256 0af0673e1f3ca87701e3c00d5ff004fccb00e2a983df1d72671c429cfef7f3c5
MD5 26b905ce74a8c0b0a30f538f87e6687a
SHA1 6120047d20501f22e28b4016a1061637316623e8
SHA512 8556763e3cc715810d96b3a4afc74bd8af1b1e84691654e0e17827f8f82567daa96461412f13fdadb675f8860e5c3a108f6990636ce44625cb319a8c08aafe4d
SSDEEP 192:X0skADp8pTtHxLUrizLG0LPTtHJC5300I0dNBL5LYLVLGlLYLJolB:X0swtR0OJjTt4IAVEp+Ea
TLSH
T125F106642BFD0119F1F34F84EEF455629E76FC963938C81D01612E0E4972E819962FBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{6B44EA07-563A-473A-A46C-3CCF9744D409}\.ba\thm.wxl
Size 3KB
SHA256 21a76eb702fe727ca06de6632be2294ed1caa9e1d3798d01ed1428e0f40e19ea
MD5 8d7baa10be22463697654d8aca5d2a1f
SHA1 67a757111562a216f8b7da791a0151bb1b0fb3e4
SHA512 9935a5da93d229ea879f1b1dba01ba42655517e68797bb65fcb0ad9c07f1bb92c2ddfbca702c256afd7cae81cac8d048e5f26db7bd9a5988b7098dab0f9dfddc
TLSH
T133519AA77CCF639028735125EAD2596A6920C19C923F2DF1FC4A914B838D532A373F57
MD5 SHA1 SHA512 TLSH

Submit Download

thm.xml

Path C:\Windows\Temp\{6B44EA07-563A-473A-A46C-3CCF9744D409}\.ba\thm.xml
Size 8KB
SHA256 8d67851408a62b0f04dbaaddc588cd98499cf3630ec5df9f7c0699f0d367f79c
MD5 c29a69f34ff31ff63c3ec6b2d4f903e5
SHA1 44e58eb62821c8d023bc91b51975162841647abd
SHA512 b46d13206c1a6064fe4857dc3de96769a773711fbdf5f8cc979216bd6b8e62703f1bdc3d3b86ed07405249613eb22697f0cdd039963f741bf2b13a4e3addd199
SSDEEP 96:8L2HdQG+3UzHfz96zYFGaPSWXdHRAmImlqFQKFBiUxn7ye5tM82rkO/pWL3nswP:ZH9z//S
TLSH
T126026AB546DDB801D232FB1166E231D27F126971C0C46E99F90C3AFB5FE1140A8B72AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aspnetcore-runtime-8.0.29-win-x64 (1).exe

Path C:\Windows\Temp\{7C8CE3A5-F29D-4453-979D-9BE13C35CBA6}\.cr\aspnetcore-runtime-8.0.29-win-x64 (1).exe
Size 589KB
SHA256 74f1056b86cbe00ef14f393e5aeacefa488449c3844e8cb38bafea0c0389b1fb
MD5 c525c2dc4bc301538039610ab1570567
SHA1 63e0aa712f8bee3f848c1bf26603b9baa4cb208d
SHA512 daf6f3feb04609ba91d1a2b87bbc20075dc79acb982153082f4b4c6983f87b09e6507b90c9d187a5703a49d6dc71ada0a747c2f01f96db48df0d0bb05a1ad302
SSDEEP 12288:ymEsd9PZfePv3xl7ft7V+6uC+zd5qLl1z+w2rCYJjsXs8Ngk:ym39PZfePv3r7fm6t+jqp1+PCsC
TLSH
T1B6D47C32A5614032E7F10673B968E6303D3CE328275489AAE7C4AD1D7EB84D667F7253
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VC_redist.x64.exe

Path C:\Windows\Temp\{8D07D3ED-CA83-4894-BFDE-B3B1C175C739}\.cr\VC_redist.x64.exe
Size 615KB
SHA256 dbcc159853d8b83c1df0a0a698127ab98e926af1b6dee86e96f541dc94b34948
MD5 2de7a2a87f61fd6ead5276047feaf36c
SHA1 d9a03aa94dfb0f485a9fd281d89d2edd499408f7
SHA512 ea8dac8d0cf79b2d8302a4405ba2d44be8dbca316038d90f19bce6d0760685105771e87b1e905ff58e6ee10e154ec9ad6c00fc575dd8c82ea4eed856fb5569ac
SSDEEP 12288:73mgqnIZuYfCYqFet4CovkM7RVYnE2EwCeYG1LM7d:73WnIZuMCxezot7rgd4e2d
TLSH
T1AAD48D32A5614033FBF105B3B928A6303E7CE728275188A9D7D4BD1D7EA84C1A7F7256
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logo.png

Path C:\Windows\Temp\{AF976ABF-7F32-456B-A0E5-29FB07665F3A}\.ba\logo.png
Size 12KB
SHA256 c8e23a42e04fbd73f5f66f3b9f2ba34a777bc4769c413a0f78335a4e757baad5
MD5 84709eb22e4b05688067699ca9b0d322
SHA1 7c3381d8b6a58087cda95577cc2d25e7aa2c21d8
SHA512 04de70b7317ee1cbde73ac0fe84bd70983cf0ff7e769e5f9626c69eaa6e3e9724c95b14ccb7a5478ee639848d3f8c98e4dec599cc5e33ad71de638da589ba319
SSDEEP 192:k4VwCaltyB5RgMq8RymiBg06po6jKeTvw:k4VzalIB5Rgh8YmiBg06W6jKKw
TLSH
T16F42C15EE9EE8248E52D065234DB6E1A997A4CEF2E9D66B2E1B57E340C303E30D47481
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixstdba.dll

Path C:\Windows\Temp\{AF976ABF-7F32-456B-A0E5-29FB07665F3A}\.ba\wixstdba.dll
Size 190KB
SHA256 dcea15f3710822ffc262e62ec04cc7bbbf0f33f5d1a853609fbfb65cb6a45640
MD5 f1919c6bd85d7a78a70c228a5b227fbe
SHA1 71647ebf4e7bed3bc1663d520419ac550fe630ff
SHA512 c7ff9b19c9bf320454a240c6abbc382950176a6befce05ea73150eeb0085d0b6ed5b65b2dcb4b04621ef9cca1d5c4e59c6682b9c85d1d5845e5ce3e5eedfd2eb
SSDEEP 3072:sjEoXsLW9OLG8Qp51ySdjDXY33b+Av7O5IkI+/AYkPAEc527uu3k/gLtxavf0ir2:sjEo8LW9553hXWy15I2YrAW7FUVEihs3
TLSH
T1FF14AF1176D0A07AEBFB16307A39A5216E7DBA200FA0C9DF63449D2B1D715C19B36B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cab2C04DDC374BD96EB5C8EB8208F2C7C92

Path C:\Windows\Temp\{B4A5A59B-716A-422C-B023-D332FBD768E7}\cab2C04DDC374BD96EB5C8EB8208F2C7C92
Size 5.4MB
SHA256 19c0cdc59ae89d0491c025a966f6d40515adc2449af40f2c6c6f52e2f293ad1c
MD5 6686bcb455d5f62a61d86891d16181c9
SHA1 d6058d6c6ef18488234d63cbfa4f7fd1db7cd3d1
SHA512 08f0d948fe7d775b138c8e82c5cb4440da313f3ba3b194093949cac9c74551b6660a70575bf06d8dffdd457e7dbc84cbe06986dcfbcd47864c461079c493864f
SSDEEP 98304:IxLTWXWLzK9s4JjKw6DikdiE6UXdw2Ar8NmIcdG3LCFPnlXv1jtAol/QXAEDI:MLzK9sQKpBlw20PIcdnFflXNBl+DI
TLSH
T10C46335E6D3632190494BC0A4E95EF68C270F23D27D71D11A188EB113A167A6FAFF0CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cab5046A8AB272BF37297BB7928664C9503

Path C:\Windows\Temp\{B4A5A59B-716A-422C-B023-D332FBD768E7}\cab5046A8AB272BF37297BB7928664C9503
Size 1.0MB
SHA256 6e8ee73933678c55973e83366e48e948b394c7a36743a36b7224c95de979b13f
MD5 6ec3f250b554e0d25091313f9ec4f4c2
SHA1 21a16c194602bd649d37d0a27b21b9e60171e8b5
SHA512 cef3af4a024ebdb1b4ea6ac80ad5af5f3ceae80344c7582019ed8a94a632d817e460f91544da77aa967031f8c6195dbc24d4742ea7a52780440de73ccdc63fc3
SSDEEP 24576:OMOHVhmG5++niVUuK2O7UB0yKHP3goh4Q5keEuAQdTWBf7e:SFUVUunOQWVHP3gY4YBWte
TLSH
T124353352B882B059D5535A26CFFA114ABC9773B25CA6C3B401CC26C8BF7D349A277CC5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcRuntimeAdditional_x64

Path C:\Windows\Temp\{B4A5A59B-716A-422C-B023-D332FBD768E7}\vcRuntimeAdditional_x64
Size 208KB
SHA256 476427800c1c958dc4e71d9a0f2f3983b2608da70835db9ee5f3b8ac387e9617
MD5 84c946189fda9171c59b683de5d603d2
SHA1 4f96a4bb0f64451ca98c1b7824763f2a9bc24dfc
SHA512 ec1dad777ee1f27de02f097ce1175b3ef64c3e65d6a97361f3b9ad6ca61ba9f3cd9c4002f51e69c31df1126e4bf589910003b5796df9e1d631eab864eb7931fe
SSDEEP 3072:c9laht5Xel69YGnfxC2WB/bEPcefrKROjibDPxriT65yRW:alaZeKFxCnBheIdluyS
TLSH
T19824AF12B5808033DAFE1A311178DB615F3DBE608F544A9B6364B6AD1E717C08F369B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcRuntimeMinimum_x64

Path C:\Windows\Temp\{B4A5A59B-716A-422C-B023-D332FBD768E7}\vcRuntimeMinimum_x64
Size 208KB
SHA256 bab5d0257e6a18a4a008e683442e3077b38172dd61af3cb1c588b46724a714e2
MD5 929579267bee38006631f56eff1d4366
SHA1 1bda1592ce7edca6c30421c2c8a00ba3ddf448d8
SHA512 ea52b41f16c06a53e1b9f8d2d4268b2dfaf89968bfd97e033f13bd26ee44bfb3e6b377c873900224ab6e4e3b0b7dcb5037ae0f46c77d3afd6266b4f1dffac44d
SSDEEP 3072:K9laht5Xel69YGnfxC2WB/bEPcefrKROjibDPxriTE:0laZeKFxCnBheIdlu
TLSH
T1F324AF12B5808033DAFE1A350578DB615F3DBE608E544A9B6364B6AC1E717C0CF36AB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixstdba.dll

Path C:\Windows\Temp\{BB99B0B7-DBF0-45A2-B351-72A95397B699}\.ba\wixstdba.dll
Size 191KB
SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
MD5 eab9caf4277829abdf6223ec1efa0edd
SHA1 74862ecf349a9bedd32699f2a7a4e00b4727543d
SHA512 45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2
SSDEEP 3072:OXoiFK6b0k77I+QfaIl191rSJHvlalB+8BHkY6v53EfcUzN0m6I+WxBlnKzeZuqt:OXoQNb++gDrSJdr8BHkPh3wIgnK/IU1a
TLSH
T103149E11B5D0907AE7FB1A385938B5216D7FBA201B60C99E17589D6F2DF02C0AF35B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{C4107CE0-52D4-4393-B79F-489A447EF656}\.ba\thm.wxl
Size 4KB
SHA256 65507ddc6f2ab2a93b684684ba1d69fdf0b024296367cdce5dad31d5e49813d0
MD5 d4226d322e0a676476db291ab59c0cd1
SHA1 572f5e80c1b56aadfb15e227d96fb4b6fea47ce9
SHA512 b69e606d117785412744c131e9559c597d5efbb0b38b97f1369b11f39efd5330c7918369d6825a8f2a4a1490cd4a076981f0008621fbc28c08278481e6d74810
SSDEEP 96:JTNREsRDTxmupv9/KATZgoVOBq9Lr878U:zvNDW7R
TLSH
T18C91AA63B8CB27D1287361A4EE9195B95911D09C823B2CF4FC47454B838E927A3B3F67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1680-824-0x0000000000940000-0x00000000009B7000-memory.dmp

Download

memory/2612-2834-0x00007FFAC4750000-0x00007FFAC4751000-memory.dmp

Download

memory/2612-2833-0x00007FFAC4CD0000-0x00007FFAC4CD1000-memory.dmp

Download

memory/3976-4221-0x000001F732160000-0x000001F732161000-memory.dmp

Download

memory/3976-4218-0x000001F732160000-0x000001F732161000-memory.dmp

Download

memory/3976-4217-0x000001F732160000-0x000001F732161000-memory.dmp

Download

memory/3976-4216-0x000001F732160000-0x000001F732161000-memory.dmp

Download

memory/3976-4219-0x000001F732160000-0x000001F732161000-memory.dmp

Download

memory/3976-4220-0x000001F732160000-0x000001F732161000-memory.dmp

Download

memory/3976-4211-0x000001F732160000-0x000001F732161000-memory.dmp

Download

memory/3976-4210-0x000001F732160000-0x000001F732161000-memory.dmp

Download

memory/3976-4215-0x000001F732160000-0x000001F732161000-memory.dmp

Download

memory/3976-4209-0x000001F732160000-0x000001F732161000-memory.dmp

Download

memory/4000-825-0x0000000000940000-0x00000000009B7000-memory.dmp

Download

memory/4424-2887-0x00007FFAC4AC0000-0x00007FFAC4AC1000-memory.dmp

Download

memory/4936-822-0x0000000000940000-0x00000000009B7000-memory.dmp

Download

memory/5996-2787-0x00007FFAC4AC0000-0x00007FFAC4AC1000-memory.dmp

Download