a83f3476e11bbbc9f7962cec2357e6e35fcdae691c8dd4ec19718e6d13873d92

Analysis

max time kernel
152s
max time network
161s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 07:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Xeno-v1.3.60.exe
Size 156.0MB
Sample260809-h19f3ashmb
SHA256 a83f3476e11bbbc9f7962cec2357e6e35fcdae691c8dd4ec19718e6d13873d92
MD5 133f6b3a3c0c5110fc33e9152e43690b
SHA1 14db35769ec3ac4c2d5596ab076ad04700901f3c
SHA512 1cb38ab62a30beca73c11ed916b10747cd2b19b00f9bd9507b4125ed6f4776dda82478c4c7f90e681c05cc75d21160ebe5cd29ceb773fc37de44ae94053f0564
SSDEEP 1572864:LVU4t/Ct6JMgabao+nh+bw4FlWMZBZHuoM2t52kOUeEbaVO7GJbdHDexdypGT+LY:lYUJkH0sEQ
TLSH
T1C6788B03E29A00E9E05DD1B587578237EE72B8864738A6DF2754175A2F77FE02B39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
34	discord.com
35	discord.com
41	discord.com
53	discord.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_1556995311\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_1556995311\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_1556995311\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_1556995311\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_1556995311\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_1556995311\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_1556995311\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_1556995311\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_183023721\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_925140561\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_1556995311\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_1556995311\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_1556995311\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_1556995311\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_1556995311\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_1556995311\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_1556995311\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_1556995311\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_1556995311\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_1556995311\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_1556995311\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_1556995311\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_1556995311\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_1556995311\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_1556995311\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_1556995311\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_1556995311\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_1556995311\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_1556995311\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_1556995311\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_1556995311\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_1556995311\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_1556995311\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_1556995311\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_1556995311\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_1556995311\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_1556995311\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_1556995311\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_1556995311\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_1556995311\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_1556995311\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_1556995311\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_1556995311\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_1556995311\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_1556995311\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_1556995311\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_1556995311\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_1556995311\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_1556995311\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_1556995311\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_1556995311\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_2143602634\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_925140561\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_1556995311\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_1556995311\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_1556995311\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_1556995311\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_1556995311\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_1556995311\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_1556995311\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_1556995311\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_1556995311\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_1556995311\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_1556995311\_locales\hi\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4464	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307335207267255"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4046655672-1449839301-2197395821-1000\{8939BCC1-D7CE-4C8C-806E-9E1B18D1D2C2}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4046655672-1449839301-2197395821-1000\{8CE372BB-FA2B-4B6A-B1C5-B816587D738E}	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
248	Xeno-v1.3.60.exe
248	Xeno-v1.3.60.exe
3396	Xeno-v1.3.60.exe
3396	Xeno-v1.3.60.exe
6388	msedge.exe
6388	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	248	Xeno-v1.3.60.exe
Token: SeCreatePagefilePrivilege	248	Xeno-v1.3.60.exe
Token: SeShutdownPrivilege	248	Xeno-v1.3.60.exe
Token: SeCreatePagefilePrivilege	248	Xeno-v1.3.60.exe
Token: SeShutdownPrivilege	248	Xeno-v1.3.60.exe
Token: SeCreatePagefilePrivilege	248	Xeno-v1.3.60.exe
Token: SeShutdownPrivilege	248	Xeno-v1.3.60.exe
Token: SeCreatePagefilePrivilege	248	Xeno-v1.3.60.exe
Token: SeShutdownPrivilege	248	Xeno-v1.3.60.exe
Token: SeCreatePagefilePrivilege	248	Xeno-v1.3.60.exe
Token: SeShutdownPrivilege	248	Xeno-v1.3.60.exe
Token: SeCreatePagefilePrivilege	248	Xeno-v1.3.60.exe
Token: SeShutdownPrivilege	248	Xeno-v1.3.60.exe
Token: SeCreatePagefilePrivilege	248	Xeno-v1.3.60.exe
Token: SeShutdownPrivilege	248	Xeno-v1.3.60.exe
Token: SeCreatePagefilePrivilege	248	Xeno-v1.3.60.exe
Token: SeShutdownPrivilege	248	Xeno-v1.3.60.exe
Token: SeCreatePagefilePrivilege	248	Xeno-v1.3.60.exe
Token: SeShutdownPrivilege	248	Xeno-v1.3.60.exe
Token: SeCreatePagefilePrivilege	248	Xeno-v1.3.60.exe
Token: SeShutdownPrivilege	248	Xeno-v1.3.60.exe
Token: SeCreatePagefilePrivilege	248	Xeno-v1.3.60.exe
Token: SeShutdownPrivilege	248	Xeno-v1.3.60.exe
Token: SeCreatePagefilePrivilege	248	Xeno-v1.3.60.exe
Token: SeShutdownPrivilege	248	Xeno-v1.3.60.exe
Token: SeCreatePagefilePrivilege	248	Xeno-v1.3.60.exe
Token: SeShutdownPrivilege	248	Xeno-v1.3.60.exe
Token: SeCreatePagefilePrivilege	248	Xeno-v1.3.60.exe
Token: SeShutdownPrivilege	248	Xeno-v1.3.60.exe
Token: SeCreatePagefilePrivilege	248	Xeno-v1.3.60.exe
Token: SeShutdownPrivilege	248	Xeno-v1.3.60.exe
Token: SeCreatePagefilePrivilege	248	Xeno-v1.3.60.exe
Token: SeShutdownPrivilege	248	Xeno-v1.3.60.exe
Token: SeCreatePagefilePrivilege	248	Xeno-v1.3.60.exe
Token: SeShutdownPrivilege	248	Xeno-v1.3.60.exe
Token: SeCreatePagefilePrivilege	248	Xeno-v1.3.60.exe
Token: SeShutdownPrivilege	248	Xeno-v1.3.60.exe
Token: SeCreatePagefilePrivilege	248	Xeno-v1.3.60.exe
Token: SeShutdownPrivilege	248	Xeno-v1.3.60.exe
Token: SeCreatePagefilePrivilege	248	Xeno-v1.3.60.exe
Token: SeShutdownPrivilege	248	Xeno-v1.3.60.exe
Token: SeCreatePagefilePrivilege	248	Xeno-v1.3.60.exe
Token: SeShutdownPrivilege	248	Xeno-v1.3.60.exe
Token: SeCreatePagefilePrivilege	248	Xeno-v1.3.60.exe
Token: SeShutdownPrivilege	248	Xeno-v1.3.60.exe
Token: SeCreatePagefilePrivilege	248	Xeno-v1.3.60.exe
Token: SeShutdownPrivilege	248	Xeno-v1.3.60.exe
Token: SeCreatePagefilePrivilege	248	Xeno-v1.3.60.exe
Token: SeShutdownPrivilege	248	Xeno-v1.3.60.exe
Token: SeCreatePagefilePrivilege	248	Xeno-v1.3.60.exe
Token: SeShutdownPrivilege	248	Xeno-v1.3.60.exe
Token: SeCreatePagefilePrivilege	248	Xeno-v1.3.60.exe
Token: SeShutdownPrivilege	248	Xeno-v1.3.60.exe
Token: SeCreatePagefilePrivilege	248	Xeno-v1.3.60.exe
Token: SeShutdownPrivilege	248	Xeno-v1.3.60.exe
Token: SeCreatePagefilePrivilege	248	Xeno-v1.3.60.exe
Token: SeShutdownPrivilege	248	Xeno-v1.3.60.exe
Token: SeCreatePagefilePrivilege	248	Xeno-v1.3.60.exe
Token: SeShutdownPrivilege	248	Xeno-v1.3.60.exe
Token: SeCreatePagefilePrivilege	248	Xeno-v1.3.60.exe
Token: SeShutdownPrivilege	248	Xeno-v1.3.60.exe
Token: SeCreatePagefilePrivilege	248	Xeno-v1.3.60.exe
Token: SeShutdownPrivilege	248	Xeno-v1.3.60.exe
Token: SeCreatePagefilePrivilege	248	Xeno-v1.3.60.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
248	Xeno-v1.3.60.exe
248	Xeno-v1.3.60.exe
248	Xeno-v1.3.60.exe
248	Xeno-v1.3.60.exe
3360	msedge.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
248	Xeno-v1.3.60.exe
248	Xeno-v1.3.60.exe
248	Xeno-v1.3.60.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 248 wrote to memory of 1352	248	Xeno-v1.3.60.exe	89
PID 248 wrote to memory of 1352	248	Xeno-v1.3.60.exe	89
PID 248 wrote to memory of 5784	248	Xeno-v1.3.60.exe	90
PID 248 wrote to memory of 3908	248	Xeno-v1.3.60.exe	91
PID 248 wrote to memory of 3908	248	Xeno-v1.3.60.exe	91
PID 248 wrote to memory of 3360	248	Xeno-v1.3.60.exe	92
PID 3360 wrote to memory of 3152	3360	msedge.exe	93
PID 248 wrote to memory of 5300	248	Xeno-v1.3.60.exe	94
PID 248 wrote to memory of 5300	248	Xeno-v1.3.60.exe	94
PID 3360 wrote to memory of 4464	3360	msedge.exe	95
PID 248 wrote to memory of 3408	248	Xeno-v1.3.60.exe	96
PID 248 wrote to memory of 3408	248	Xeno-v1.3.60.exe	96
PID 3360 wrote to memory of 4952	3360	msedge.exe	97
PID 3360 wrote to memory of 4952	3360	msedge.exe	97
PID 3360 wrote to memory of 4952	3360	msedge.exe	97
PID 3360 wrote to memory of 916	3360	msedge.exe	98
PID 3360 wrote to memory of 916	3360	msedge.exe	98
PID 3360 wrote to memory of 4816	3360	msedge.exe	100
PID 3360 wrote to memory of 4816	3360	msedge.exe	100
PID 3360 wrote to memory of 4816	3360	msedge.exe	100
PID 3360 wrote to memory of 5140	3360	msedge.exe	101
PID 3360 wrote to memory of 5140	3360	msedge.exe	101
PID 3360 wrote to memory of 5140	3360	msedge.exe	101
PID 3360 wrote to memory of 1072	3360	msedge.exe	102
PID 3360 wrote to memory of 3660	3360	msedge.exe	103
PID 3360 wrote to memory of 1072	3360	msedge.exe	102
PID 3360 wrote to memory of 1072	3360	msedge.exe	102
PID 3360 wrote to memory of 3660	3360	msedge.exe	103
PID 3360 wrote to memory of 3660	3360	msedge.exe	103
PID 3360 wrote to memory of 5036	3360	msedge.exe	105
PID 3360 wrote to memory of 5036	3360	msedge.exe	105
PID 3360 wrote to memory of 2692	3360	msedge.exe	106
PID 3360 wrote to memory of 2692	3360	msedge.exe	106
PID 3360 wrote to memory of 2692	3360	msedge.exe	106
PID 3360 wrote to memory of 1276	3360	msedge.exe	107
PID 3360 wrote to memory of 1276	3360	msedge.exe	107
PID 3360 wrote to memory of 3528	3360	msedge.exe	108
PID 3360 wrote to memory of 3528	3360	msedge.exe	108
PID 3360 wrote to memory of 5848	3360	msedge.exe	109
PID 3360 wrote to memory of 5084	3360	msedge.exe	110
PID 3360 wrote to memory of 5084	3360	msedge.exe	110
PID 3360 wrote to memory of 4436	3360	msedge.exe	112
PID 3360 wrote to memory of 3212	3360	msedge.exe	115
PID 3360 wrote to memory of 3212	3360	msedge.exe	115
PID 3360 wrote to memory of 4876	3360	msedge.exe	116
PID 3360 wrote to memory of 4876	3360	msedge.exe	116
PID 3360 wrote to memory of 6804	3360	msedge.exe	118
PID 3360 wrote to memory of 6796	3360	msedge.exe	117
PID 3360 wrote to memory of 6804	3360	msedge.exe	118
PID 3360 wrote to memory of 6796	3360	msedge.exe	117
PID 3360 wrote to memory of 5996	3360	msedge.exe	121
PID 3360 wrote to memory of 1408	3360	msedge.exe	122
PID 3360 wrote to memory of 3076	3360	msedge.exe	123
PID 3360 wrote to memory of 5484	3360	msedge.exe	124
PID 3360 wrote to memory of 5484	3360	msedge.exe	124
PID 3360 wrote to memory of 4324	3360	msedge.exe	128
PID 3360 wrote to memory of 4324	3360	msedge.exe	128
PID 3360 wrote to memory of 5200	3360	msedge.exe	129
PID 3360 wrote to memory of 5200	3360	msedge.exe	129
PID 3360 wrote to memory of 4788	3360	msedge.exe	130
PID 3360 wrote to memory of 4788	3360	msedge.exe	130
PID 248 wrote to memory of 3396	248	Xeno-v1.3.60.exe	131
PID 3360 wrote to memory of 6388	3360	msedge.exe	132
PID 3360 wrote to memory of 5324	3360	msedge.exe	133

C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.60.exe
"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.60.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:248
- C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.60.exe
  "C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.60.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Xeno" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1644 --field-trial-handle=1648,i,9248878473113232013,7659948085196171732,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
  2⤵
  PID:1352
- C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.60.exe
  "C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.60.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Xeno" --mojo-platform-channel-handle=2144 --field-trial-handle=1648,i,9248878473113232013,7659948085196171732,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
  2⤵
  PID:5784
- C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.60.exe
  "C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.60.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Xeno" --app-user-model-id=Xeno --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --enable-sandbox --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2544 --field-trial-handle=1648,i,9248878473113232013,7659948085196171732,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
  2⤵
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/xe-no
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x300,0x7ffdfa33c188,0x7ffdfa33c194,0x7ffdfa33c1a0
    3⤵
    PID:3152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1672,i,14851260757150618162,10922064205071345925,524288 --field-trial-handle=2540,i,1425851851297577228,15612513930328940774,262144 --variations-seed-version --mojo-platform-channel-handle=2636 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1540,i,5958639535116346418,7730075787288288584,262144 --field-trial-handle=2540,i,1425851851297577228,15612513930328940774,262144 --variations-seed-version --mojo-platform-channel-handle=2536 /prefetch:2
    3⤵
    PID:4952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2224,i,16125252554270911591,10938610452021504325,524288 --field-trial-handle=2540,i,1425851851297577228,15612513930328940774,262144 --variations-seed-version --mojo-platform-channel-handle=2812 /prefetch:13
    3⤵
    PID:916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3528,i,687871385548934864,397650754145342130,2097152 --field-trial-handle=2540,i,1425851851297577228,15612513930328940774,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
    3⤵
    PID:4816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3680,i,4259302530642694553,11580226016555446544,2097152 --field-trial-handle=2540,i,1425851851297577228,15612513930328940774,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
    3⤵
    PID:5140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4256,i,17548316359831879308,2553206615344690623,2097152 --field-trial-handle=2540,i,1425851851297577228,15612513930328940774,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:1
    3⤵
    PID:1072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4340,i,3824339747063295816,9669621038265091605,2097152 --field-trial-handle=2540,i,1425851851297577228,15612513930328940774,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:9
    3⤵
    PID:3660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5280,i,13144819154441169363,14178692943362875924,524288 --field-trial-handle=2540,i,1425851851297577228,15612513930328940774,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:14
    3⤵
    PID:5036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5452,i,11252412669449603931,6128672355440841940,2097152 --field-trial-handle=2540,i,1425851851297577228,15612513930328940774,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:1
    3⤵
    PID:2692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5628,i,14022581846278298322,15953387498747035279,524288 --field-trial-handle=2540,i,1425851851297577228,15612513930328940774,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:14
    3⤵
    PID:1276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5620,i,16556234698753924801,6065754184323784095,524288 --field-trial-handle=2540,i,1425851851297577228,15612513930328940774,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:14
    3⤵
    PID:3528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,12310296905366884869,2091211914099056784,524288 --field-trial-handle=2540,i,1425851851297577228,15612513930328940774,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:14
    3⤵
    - Modifies registry class
    PID:5848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,14416377581982095983,524672133939976340,524288 --field-trial-handle=2540,i,1425851851297577228,15612513930328940774,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:12
    3⤵
    PID:5084
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6492,i,5170373975676973854,18001722611002448644,524288 --field-trial-handle=2540,i,1425851851297577228,15612513930328940774,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:14
    3⤵
    PID:1132
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6492,i,5170373975676973854,18001722611002448644,524288 --field-trial-handle=2540,i,1425851851297577228,15612513930328940774,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:14
    3⤵
    PID:4436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6736,i,1699574768727400630,11208283829329063449,524288 --field-trial-handle=2540,i,1425851851297577228,15612513930328940774,262144 --variations-seed-version --mojo-platform-channel-handle=6752 /prefetch:14
    3⤵
    PID:3212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6900,i,10059888781276820279,7892680101282985162,524288 --field-trial-handle=2540,i,1425851851297577228,15612513930328940774,262144 --variations-seed-version --mojo-platform-channel-handle=6732 /prefetch:14
    3⤵
    PID:4876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6776,i,7083337639118632101,4524366764350124721,524288 --field-trial-handle=2540,i,1425851851297577228,15612513930328940774,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:14
    3⤵
    PID:6796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6976,i,6902708607073986766,6453218910545287282,524288 --field-trial-handle=2540,i,1425851851297577228,15612513930328940774,262144 --variations-seed-version --mojo-platform-channel-handle=7000 /prefetch:14
    3⤵
    PID:6804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6512,i,8530194505654910840,5134371444005460586,524288 --field-trial-handle=2540,i,1425851851297577228,15612513930328940774,262144 --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:14
    3⤵
    PID:5996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4880,i,5987267057373346355,9075746158848728969,524288 --field-trial-handle=2540,i,1425851851297577228,15612513930328940774,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:14
    3⤵
    PID:1408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3572,i,1643423451506754147,11249041398034027047,524288 --field-trial-handle=2540,i,1425851851297577228,15612513930328940774,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:14
    3⤵
    PID:3076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6640,i,783451595550458590,451826374651028349,524288 --field-trial-handle=2540,i,1425851851297577228,15612513930328940774,262144 --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:14
    3⤵
    PID:5484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,16213381915616483027,987065478176033033,524288 --field-trial-handle=2540,i,1425851851297577228,15612513930328940774,262144 --variations-seed-version --mojo-platform-channel-handle=3432 /prefetch:14
    3⤵
    PID:4324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7464,i,4942952264814885626,13469958603803547414,524288 --field-trial-handle=2540,i,1425851851297577228,15612513930328940774,262144 --variations-seed-version --mojo-platform-channel-handle=916 /prefetch:14
    3⤵
    PID:5200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3816,i,11849279698511277026,12171157117296960841,524288 --field-trial-handle=2540,i,1425851851297577228,15612513930328940774,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:14
    3⤵
    PID:4788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=916,i,17444976530444743145,6054378235702724863,262144 --field-trial-handle=2540,i,1425851851297577228,15612513930328940774,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:6388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5792,i,11602232492324639992,2355354888829624194,524288 --field-trial-handle=2540,i,1425851851297577228,15612513930328940774,262144 --variations-seed-version --mojo-platform-channel-handle=3352 /prefetch:14
    3⤵
    PID:5324
- C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.60.exe
  "C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.60.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Xeno" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2016 --field-trial-handle=1648,i,9248878473113232013,7659948085196171732,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
  2⤵
  PID:5300
- C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.60.exe
  "C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.60.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --user-data-dir="C:\Users\Admin\AppData\Roaming\Xeno" --mojo-platform-channel-handle=3960 --field-trial-handle=1648,i,9248878473113232013,7659948085196171732,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
  2⤵
  PID:3408
- C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.60.exe
  "C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.60.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --user-data-dir="C:\Users\Admin\AppData\Roaming\Xeno" --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2488 --field-trial-handle=1648,i,9248878473113232013,7659948085196171732,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3396

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3740

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2724

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:6848

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e35119268ad2455b6ec4314361db946ee09b095b28e62d25bbd7542d6be959b9
MD5 5c633da04aeb5bea485c08ea28f57d24
SHA1 1c5287022e764ef0bb6d895cd993be007ab68eba
SHA512 341697613439896bbdc5bae2e067bf2b52fd4ee959460166157f5fcf5f0647d000c9824a7394abad2ea244ee761164649972236a37dd919e413ac011474bb4b7
TLSH
T12DD09B947B50A50CCC41703229E5535579155461581D45450055F0799C646C246175BF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e75f270f1371188bd7f350113eee1f4d141652add7af8e5f7af0ab47dac6d1f2
MD5 e0e7da4c84e8882b494037c575bd294c
SHA1 04d43c383ac5d232ee362aad151519414dc6db2b
SHA512 70d9ca23de3befb782d3d04a586490c626e7c63ad00fac39b0fd9adeae2c1d8413a5d2474e847fabb4f48bbf1384f1fcd10e67765d21ed94ac67795b274b3c2e
TLSH
T122D09294BB60A90CCC81B0322AE66355BA1598A1182D868900A5F07A9CA8AC246179AF
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 9074e34f7b00aec2bc09ffe75f0777081d9bee923bb67fd5e56e50007addcf3a
MD5 f9bb574c04a2bd37a93f56bdddfd8639
SHA1 d4bbdd37ad99d6989844d8eb7e8cfd1ccf0039ce
SHA512 29b5377ff48b9821c7dd4068d2741395a573c05cdc9c4595c534c16aa4db7478d93e2e4952a605dd1c4821164f88af91d870e701a75c7103baef87f866b75627
SSDEEP 96:ozsyxGKuYCZjPjvxxBPThhF05DA2FBOcWIux/BY6bGKuQe06I:o2KuvZjdTLfF05DjPF2B1bT
TLSH
T115F1536A2FE30684EB9C657D1CD2275AF5F90141142B1E0A37638DB9D867FCC28F812B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5a2627.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a2627.TMP
Size 3KB
SHA256 e85fd975769c58d9e037a30dcd4d1b77f1f24d0b6e1d20ab13afb7709dc6479e
MD5 c0c87f62ac8fd94c360f6aade97b32fe
SHA1 8b6415036b6ea9e995f4bf49888436d39fbe0a18
SHA512 e26426a00c4a9b838739eb4bb160c5ed93da0012fe5afe86f57a828f626ed34c733c7386326349dd218f2f717421a9bbd89053c9d99771ef6d8b344e28eb8e7d
TLSH
T17761507333F25BD4D7254A7954E3755936FA5A950A0B6F0A4080ED76CC0BF0C59E1233
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 43e9ffd03c42f47f09bc16661fbc013287efd1e43681845b73b570a5f5dc6e6d
MD5 54b97521cefee68387879dc9fbc3755f
SHA1 55024bcf8502b73c9396b434a26e72213a6818a7
SHA512 087e64af0296fe165941d02d8f3fba3c8aeaa445c21848942cde3f1debbc1b71ddcd91d81773db7d636f5629dc23af27223789a93b9949bc7470ce8fa5d6b123
TLSH
T16581AEF3C7E8862DD91196F4AB146E1FCE2C0914432C3C2AC9D5AE1B93E2571F181A4F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 e29a087f403320193e1f5a3436b0b42f51da01ac52055b5a3b4bcee30ed96e26
MD5 a86f1c69514d9736ed4d673ffe4bef14
SHA1 9a3001ef5b7d300b674c923b20e93f6b619b703d
SHA512 398e380f0b5069546a5e21390dac89210dace4f988352a4577d6c7a06e8b2e63fb5f4f211da1c8a92f2a505b607c366b1cbe79f7719beb355cb3313674ad8c67
TLSH
T1ED61ACF383E8862DCA1596F4AB186E1FCE2C0914436C3C2AC5D4AE1B93E3471F141A8F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 1c2cc7e84d673d7c955e7658d9ea2a63035b5d80ec028b8a68ee9b64f50c8570
MD5 a4943a760e6dffa1cb167db56d3a059d
SHA1 ccb4d1f342876253c7b0bd10caa1db99c44ec385
SHA512 8bf12c464d4c2982d86533693f9b96b0d6b7e2aa0ba57c333550333f273e6add96c6aa81deb56158e6167f1fa498891b4005e8b3691973f5afa3782f0464c40c
TLSH
T11B319BF7C6E8567D8A4145F87A182E1BCE2D0854432C3D5AC5D4AF5BA7E1871E28089E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 f2667fd7618aa0441edd6e0dbfbaadf552f97dd7f0ba55bad0d21679348cef0e
MD5 9ce7d991ea7a89b3a4fa893a95ab56ba
SHA1 5a9e61e1eb49a38a81cfc58ba37f42297aa8e462
SHA512 6d56c9a12a6a04b31320b0ddfba598d1e65ce74b1defec138697326dd55c122d8bce1cac451f7194bd3ccc64a6c938b9d045ebcd961fe798cedbf91514a710d6
SSDEEP 192:sxR20aR5CAG/fEsC4XZYqBzoA8pl7/g6+WNpoI/eBWE3NiKU+GdIgVlV+J:sxR2LaAG/fEsC4p58Z/5J/eYVPo
TLSH
T16042D816A928693B5CD7D21DBA257F93E2F95032A1D05E58F7FC8A1C04E7ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 76981f870e5dbd6f485f278e97ba6288ec7da075ea2519bdf046353bbe98ef90
MD5 e3f30592f30ab12983934452fb034eb7
SHA1 baeac06650c24c8cbdb1d4ecbead8b9878128a4b
SHA512 279f994d52302c659c4b39710ef910dc688deae9b2651a153cfb1d5f0de23fdedb148975052437980a82f8a96a5051321c5be3f0903cd472b1af48e9422eb987
SSDEEP 192:sxR21aR5CAG/fEsq4XZYqBzoA8pl7/g6+WNpoI/eBWE3NiKU+GdIgD6lV+J:sxR24aAG/fEsq4p58Z/5J/eYVPT
TLSH
T1C542E816A928693B5CD7D21DFA557F93D2F95032A1D05E18B7FC9A1C04E7ADD220380F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 b912ced074aad431cbf1c8bd0d8d5a620cd050e7d05626702837ed89d6986d16
MD5 93f0d8a5ce113c2f523a5832482dc47b
SHA1 8370c414ef191f64ba71331afa2e504ff6e12308
SHA512 afe8ffb1293d33f8994716426d6474b1e3803b27f9cfdf56eb6e448436267e8086039ce0247000c9635da056312dee5c7c821402ffb4f7a3cab741f6ae6f1357
SSDEEP 192:sxR21aR5CAG/fEsqZXZYqBzoA8pl7/g6+WNpoI/eBWE8diKU+GdIgDglV+J:sxR24aAG/fEsqZp58Z/5J/edVPZ
TLSH
T10F42E916A928693B5CD7D21DFA557F93E2F95032A0D05E48B7FC9A1C04E7ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 14897a55b1e4e5d70988b5e2b80c10acb9650765529730fb7cd26b4725f7bba1
MD5 3d704786f5e1309fedcea093694bcafd
SHA1 bcdaf0dba0e0b308856ecfa1dd3c3b20e92bd1ca
SHA512 f3be0d6bea7b6f63f1a8ff4174b3922d39727ea391af935c3e2d81fa50eb89485ad65b39e71c061160783fdc5d9b7e7f4e3e44170601a1e8eb5e4860e9ea7500
SSDEEP 768:0UQis67pLuLfJaWgH7fqQ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVbB2OVqyroj6G:0UQisSEfJaWgH7fqQu1jawB2Iqpz
TLSH
T1A2D2DC7B640DCB7F4F804ADDDC197E9A6DA802CB9698CD8047FA981C03C7BEA51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 233B
SHA256 232359f54198b33bfe1d9b1575c85ae149022b3f9315416c8f327853e15c0c70
MD5 1cb1cc4d74a954947f502f6b5b1a6522
SHA1 604fb795a20d353f80f86532f877458ef089670b
SHA512 c2a1291efa478a43503cf1e6771e4a577f05a08b47befa38fcea39109503df81a81e98136c55f3365c8dd1ea29a1e5f61de625c5f9af2eea8056f186560d4961
TLSH
T16BD09787A7362480E72F0B831B21069A43112C8C2484900CA853363944F4B07B110FE2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 226B
SHA256 acd937dd15012635c243692f15f4cc5385280076730f5a7327e8655cdd0ee60c
MD5 24eeaf147dc924f8ad8f3d6ce219e939
SHA1 61cbb85bd9954b56824a885427be18d8245cb63d
SHA512 04581b60191c5127ff79f3c33ef62704d6b037a984e62d4693cfcf030dd4184e2e0b8bd560df24abc803055358f513e15b485ca74aaaac038996ec7a94bfb64e
TLSH
T144D09783A2392480E6AF4B831B1116AA43022C8C2088504CA852063948E4B47B001FE2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe59b52d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe59b52d.TMP
Size 138B
SHA256 a1038220ede942f40785da60d68d76555b523935d2b10144f947e3470355b5aa
MD5 df5d36ead12d4398f6c8e1ceb52d3ac5
SHA1 8b196a05bac87f5d443a257866bf7299416422af
SHA512 e5ad94bfff409c6900c1225ec5c347c97860473e8ac149644b1d0a8a66a4ceb824b4762a5861389dcc30617ffd91edbc505080275262d4a9c471cf6b42f13962
TLSH
T10EC02BA3B1582540CB160381033283DD47052CCC08C5904CF02339341078F173101FF1
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 0246d1a11e4c7ca6cc6262412efe7c7c9509e9f48723334f09738a68ab59e2f2
MD5 2f8b816155daac4ad080ccd29ba1a766
SHA1 6e3de3ec86f9b87f4ab94aae27bf9ab213474ffa
SHA512 05e8ecb06c5f4843893268a644929cb5b8bcafb2b285e4456cbf00e9379453da49fc712fe19f93e5518cb46db402d9d0423eed650b8332898f5b10b917272749
SSDEEP 96:KRdqjXNn7vWj4mgfvK4+gBvcldQzLkHI5MYKWaAW+jTgAAK4V7goKpiOP7O1Zz9O:CdqjXNn7Oj4XfV+gBkldQzLkHI5MYKWX
TLSH
T17191F54431BF46907C7FA52D8568986FD2813862302CF92F77E956920F67E424EFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a95d9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a95d9.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 51b9c844d48158adac05c69a7643b34afe2dd4d31a51505a331e20cd14a7ba2e
MD5 e7e468115cff311f481b59ac63821fd3
SHA1 886b3d86d3305b2552f93561ee9164750f7f97bb
SHA512 656e3461dce19fa746e63e94406105e73d78f35549e844323e328d2b6c86a36eafef40189d6931382f2cefeb37313350ee93fba65898c16e699ac6d1ebe037dc
SSDEEP 768:JF2S3jwgVqG7q5wK48dHeByERRFzjK3YW2ewBKZOMWk:OS3eGU48dHSyw/o2evZjx
TLSH
T1141338F098E79976D8AE8387673E6E4699FCC153B48859A4B3C85D0DCC821BFC70AC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 ef1bac386a0f8a6131d4b70441d7547ee77ce3cef4c3daa890cb9b0fa23ae6aa
MD5 60bc8a741152cf12f275c648e8eb1570
SHA1 b93520c81e856a2951710461c650d576d9fabe4b
SHA512 ad1c14d4f73ecd3ddad64b4a17a32d5acde4d40a5320c2a95fba2d15ab4c0c803c019295f50040a1acfa96aa003159206f1aee3f88335c13d12211e6915b8056
SSDEEP 768:Rx3hqGTWD/YK48dHeByERRFzjK3YW2ewBKZOMWk:Rx3kGS948dHSyw/o2evZjx
TLSH
T1E7F2AFB0A869AD734CEBD2497A577397EEF4412394D45A68D1DDEF0E448328C170BC2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 c4ce226c0175d4b3c1a8b7e50145f0c7c0c1563798adc57be756d4a1794bd4ac
MD5 c011df0572c05b067dad5649255ca4a8
SHA1 ef6abf54c8783e40523f1421c7ad4819cd26a252
SHA512 62f8eb75bca36384c26ed26037d142e5f6d70e3c15ab1716ca2e70f1eace174edd069ce61134078ef41f409205aadfc32750f2692c7546ad834f28ac62ad33ad
SSDEEP 768:Irv+4UNbd23tqGVWD/CK48dHeByERRFzjK3YWoE:Ibsb834GEz48dHSyw/ooE
TLSH
T1BA03BE70A8A89DB34CFBD149B6437693BFF4112384C41A68D1C9AE4E49872DD2B0BD5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 4e3b062a58725ad38995ea7e78aa4484b739ffb324793ab8a7f7371b42b2b9d2
MD5 9494077831a811f85bdee4017fdc40a5
SHA1 084ace109c9a643f14f1df3a7cb3ec8eeeb35d2d
SHA512 d70326f2c49e7d4510352b3a6a8a59fc9cac50d10cfed1794688faf28eb9943d4025b45616996e00b0547437a40a528b240599ee2ba794c5eafe7c5b61d8da20
SSDEEP 768:xrv+4UNbdf3dqGC4D/nK48dHeByERRFzjK3JWeVH1SCj:xbsbJ3IGtC48dHSyw/PEH1Z
TLSH
T18A03BF70A8A89E734CEB92497583B697BFF4012384C44BA4D4D9AF4E45875CD170FD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 48356e744de950912af4a0908cfabf2c0d7263b72535de90084856db1903bcec
MD5 21fbe33326b3e2eba900f567894c564b
SHA1 c4f167546c3a33eb1ccdbeb0515b9698dc8c1b8b
SHA512 3fe9bc987a7422254eeb32ce0456de2f0a2e16e4f4b0a5e42f34aff7bdab3838bfb5a07fc6c7d8c511896321c55bf63861a1ee38cb6845670567430e354a3512
SSDEEP 768:Qrv+4UNbdf3gqG3wD+K48dHeByERRFzjK3YSeVH1SCj:QbsbJ3hGY348dHSyw/EEH1Z
TLSH
T1D603BE71A8A85E774CE7D2897683B657BFF4412382D41BA4C4DD6F4E868B0DC130BD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a9e70f72-3548-43bf-9d74-594534f65d1b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a9e70f72-3548-43bf-9d74-594534f65d1b.tmp
Size 41KB
SHA256 9e11740ed9c6f405aef09e6572b09401769cc6f3f796189f8e87886007b9b68d
MD5 70c5c572f8864937893d95c8cd2bebcf
SHA1 f86cb52d6ee791e905b6c3c20b7b3e0073a1ad4e
SHA512 7f6c4329652cee61bf5c58681400c1b693be31f73b01381b7a29954d867c11b5bf1b9f3b6a7d83958bd5db8a3022f6dda0b285152786ace9f9af082a4a442b83
SSDEEP 768:urv+4UNbd23tqGTWD/YK48dHeByERRFzjK3YW2ewBKZOMWW:ubsb834GS948dHSyw/o2evZjD
TLSH
T19D13BE70A86CADB34CFB9149B6477687BFF4016394C41A68D5CDAF4E44862CD2B0BD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

195c0580-2a81-4ecf-9531-b9501aff44e5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\195c0580-2a81-4ecf-9531-b9501aff44e5.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json~RFe59d392.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json~RFe59d392.TMP
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

e7e315f3-7ee4-4753-81c0-bd9791effcdd.tmp

Path C:\Users\Admin\AppData\Local\Temp\e7e315f3-7ee4-4753-81c0-bd9791effcdd.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3360_1433140487\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XENO_CACHE.bin

Path C:\Users\Admin\AppData\Local\Xeno\XENO_CACHE.bin
Size 36B
SHA256 3bab55816f9c1c63b26bee8027a74983736938cfa748d9c91230391d4bacfb88
MD5 03b4e88d732421deccbdd05cb90b0513
SHA1 1ba9d3bd3af60ecc041e93251633b5a0fbac4d9b
SHA512 40e01403608fc8d8c0bc7bc6e1367a472778dea5d4dde4d242b37b0860d098075ac71cf24abd85c6b9ee67bf6adf80adaaf279a969f4477555807003276a2c75
MD5 SHA1 SHA512

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

Xeno.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Xeno.lnk
Size 2KB
SHA256 cf197fee735c3243d6337cce661b2e8bf1bce26afc39bfe9e5a0fa684616a386
MD5 c2696304a02d10f9f6a17c2b449cb94f
SHA1 70bd11f50a548c8d3fc569741ccb2db84026a8db
SHA512 1df081e2071563616c77654085ca5abc8b4843d432c24238832334214ce857dc1f998067f3dcdf931e4b44f586136c4870178856f80acd05dfbdbc7c04b1c654
TLSH
T164413822A9C51B11D3B6DA3798F73215EE797C92FB162F0D0040C2891E71A81AE94F2F
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\Xeno\DawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\Xeno\DawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\Xeno\DawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\Xeno\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\Xeno\Network\Network Persistent State
Size 494B
SHA256 a0d69150903b9d9a76d9d5d0d977135d7fe46403e094fa1e66e4a3b5dbc9ee3a
MD5 2fe189c652884850f28104866d4c814d
SHA1 6ae5f20330769b5a822437413398dc6d90c518b1
SHA512 3f47984c3e1804b0556f8b5d01308ef9b7e0dcf2631f58bb1a569736ef63b0b013d919012c2e8ecc61c9dfb4ad9b953b1e3c861574d462af19055c8ddbe9be9c
TLSH
T17EF09E97C2D84D7D464643F42B152E13C1BE0869521D3D03D5D8FF0E57B18B9A50044F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5ab920.TMP

Path C:\Users\Admin\AppData\Roaming\Xeno\Network\Network Persistent State~RFe5ab920.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3396-1383-0x00000196FC430000-0x00000196FC431000-memory.dmp

Download

memory/3396-1372-0x00000196FC430000-0x00000196FC431000-memory.dmp

Download

memory/3396-1374-0x00000196FC430000-0x00000196FC431000-memory.dmp

Download

memory/3396-1382-0x00000196FC430000-0x00000196FC431000-memory.dmp

Download

memory/3396-1381-0x00000196FC430000-0x00000196FC431000-memory.dmp

Download

memory/3396-1380-0x00000196FC430000-0x00000196FC431000-memory.dmp

Download

memory/3396-1379-0x00000196FC430000-0x00000196FC431000-memory.dmp

Download

memory/3396-1378-0x00000196FC430000-0x00000196FC431000-memory.dmp

Download

memory/3408-102-0x00007FFE1D550000-0x00007FFE1D551000-memory.dmp

Download

memory/3908-859-0x00000259AC660000-0x00000259AC68F000-memory.dmp

Download

memory/3908-860-0x00000259ACD50000-0x00000259AD446000-memory.dmp

Download

memory/3908-24-0x00007FFE1D850000-0x00007FFE1D851000-memory.dmp

Download

memory/3908-25-0x00007FFE1D030000-0x00007FFE1D031000-memory.dmp

Download