aa2818266e03c443f4f6480f552cfc330fa74d5164a4244e4bccab4f3efae715

Resubmissions

14/08/2026, 19:24

260814-x4dacszdrb

14/08/2026, 19:20

260814-x2eqeazdnb6

Analysis

max time kernel
150s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 19:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Xeno-v1.3.60/Xeno.exe
Size 160KB
Sample260814-x2eqeazdnb
SHA256 aa2818266e03c443f4f6480f552cfc330fa74d5164a4244e4bccab4f3efae715
MD5 ea47d036d690aee0d3e8b87fb2056ac0
SHA1 63cadbb8b0e5047132271960881d2e3da8a28da9
SHA512 88c81f6ec1912cd71de04a3225084b0c1248be0f8f5ab6681414600bc49068b2f341b465a4009e13bfd6d5150897bf3d8cf83900971540574aa794f702ead877
SSDEEP 3072:CqeXA/4yIg9vkNPNu6H6xCYOiVUE265AJwizR:CvgvkNFNaxmNEgJdR
TLSH
T134F34B07A6A850BDE1B7C678C9924D41FB727C598B71A6CF03507AB60E737D0AE39302
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Xeno.exe

Contacts third-party web service commonly abused for C2 1 TTPs 8 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
47	raw.githubusercontent.com
50	discord.com
35	raw.githubusercontent.com
36	raw.githubusercontent.com
40	raw.githubusercontent.com
43	discord.com
44	discord.com
46	discord.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_257671100\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5756_843497643\hyph-da.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5756_843497643\hyph-es.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5756_843497643\hyph-lv.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5756_843497643\hyph-sv.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5756_843497643\hyph-hy.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5756_843497643\hyph-ka.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5756_843497643\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5756_843497643\hyph-pa.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5756_2006219168\ct_config.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5756_843497643\hyph-as.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5756_843497643\hyph-bn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5756_843497643\hyph-it.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5756_843497643\hyph-mul-ethi.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_315878336\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5756_843497643\hyph-ru.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_390736700\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5756_843497643\hyph-gl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5756_843497643\hyph-gu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5756_843497643\hyph-te.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5756_2006219168\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5756_843497643\hyph-cu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5756_843497643\hyph-ml.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5756_843497643\hyph-uk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5756_843497643\hyph-sl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5756_843497643\hyph-af.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5756_843497643\hyph-en-us.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5756_843497643\hyph-ga.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5756_843497643\hyph-mn-cyrl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5756_843497643\hyph-bg.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5756_843497643\hyph-el.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5756_843497643\hyph-et.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5756_843497643\hyph-hu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5756_843497643\hyph-tk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5756_843497643\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5756_1579817816\crl-set	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5756_843497643\hyph-hr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5756_843497643\hyph-or.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5756_843497643\hyph-pt.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5756_843497643\hyph-sq.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5756_843497643\hyph-kn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5756_843497643\hyph-nn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5756_843497643\hyph-ta.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5756_2006219168\crs.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5756_2006219168\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5756_843497643\hyph-be.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5756_843497643\hyph-mr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5756_843497643\hyph-sk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5756_843497643\hyph-de-1996.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5756_843497643\hyph-de-ch-1901.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5756_843497643\hyph-en-gb.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5756_843497643\hyph-nb.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5756_1579817816\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5756_2006219168\kp_pinslist.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5756_843497643\hyph-cs.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5756_843497643\hyph-cy.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5756_843497643\hyph-lt.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_257671100\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5756_843497643\hyph-de-1901.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5756_843497643\hyph-fr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5756_843497643\hyph-la.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_315878336\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5756_843497643\hyph-nl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5756_843497643\hyph-und-ethi.hyb	msedgewebview2.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2680	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134312089327449622"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{B2FD535A-9826-40DB-AE65-F7B742DA3A70}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{262FFEF9-E2B4-4761-836E-339DBEDA9C44}	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5080	Xeno.exe
5080	Xeno.exe
3628	msedge.exe
3628	msedge.exe
6628	msedgewebview2.exe
6628	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
5756	msedgewebview2.exe
4660	msedge.exe
4660	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4660	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5080 wrote to memory of 4660	5080	Xeno.exe	89
PID 4660 wrote to memory of 300	4660	msedge.exe	90
PID 5080 wrote to memory of 5756	5080	Xeno.exe	91
PID 5756 wrote to memory of 5104	5756	msedgewebview2.exe	92
PID 4660 wrote to memory of 5284	4660	msedge.exe	93
PID 4660 wrote to memory of 2680	4660	msedge.exe	94
PID 4660 wrote to memory of 5284	4660	msedge.exe	93
PID 4660 wrote to memory of 5284	4660	msedge.exe	93
PID 4660 wrote to memory of 1060	4660	msedge.exe	95
PID 4660 wrote to memory of 1060	4660	msedge.exe	95
PID 4660 wrote to memory of 2408	4660	msedge.exe	97
PID 4660 wrote to memory of 2408	4660	msedge.exe	97
PID 4660 wrote to memory of 2408	4660	msedge.exe	97
PID 4660 wrote to memory of 1948	4660	msedge.exe	98
PID 4660 wrote to memory of 1948	4660	msedge.exe	98
PID 4660 wrote to memory of 1948	4660	msedge.exe	98
PID 5756 wrote to memory of 4944	5756	msedgewebview2.exe	99
PID 5756 wrote to memory of 4944	5756	msedgewebview2.exe	99
PID 5756 wrote to memory of 4944	5756	msedgewebview2.exe	99
PID 5756 wrote to memory of 4944	5756	msedgewebview2.exe	99
PID 5756 wrote to memory of 5636	5756	msedgewebview2.exe	100
PID 5756 wrote to memory of 5408	5756	msedgewebview2.exe	101
PID 5756 wrote to memory of 5408	5756	msedgewebview2.exe	101
PID 5756 wrote to memory of 5408	5756	msedgewebview2.exe	101
PID 4660 wrote to memory of 1120	4660	msedge.exe	102
PID 4660 wrote to memory of 1120	4660	msedge.exe	102
PID 4660 wrote to memory of 1120	4660	msedge.exe	102
PID 4660 wrote to memory of 3616	4660	msedge.exe	103
PID 4660 wrote to memory of 3616	4660	msedge.exe	103
PID 4660 wrote to memory of 3616	4660	msedge.exe	103
PID 5756 wrote to memory of 2052	5756	msedgewebview2.exe	104
PID 5756 wrote to memory of 2052	5756	msedgewebview2.exe	104
PID 5756 wrote to memory of 2052	5756	msedgewebview2.exe	104
PID 5756 wrote to memory of 2052	5756	msedgewebview2.exe	104
PID 5756 wrote to memory of 2052	5756	msedgewebview2.exe	104
PID 4660 wrote to memory of 5060	4660	msedge.exe	105
PID 4660 wrote to memory of 5060	4660	msedge.exe	105
PID 4660 wrote to memory of 2756	4660	msedge.exe	107
PID 4660 wrote to memory of 2756	4660	msedge.exe	107
PID 4660 wrote to memory of 2756	4660	msedge.exe	107
PID 4660 wrote to memory of 5732	4660	msedge.exe	109
PID 4660 wrote to memory of 4508	4660	msedge.exe	108
PID 4660 wrote to memory of 5732	4660	msedge.exe	109
PID 4660 wrote to memory of 4508	4660	msedge.exe	108
PID 4660 wrote to memory of 4424	4660	msedge.exe	110
PID 4660 wrote to memory of 1288	4660	msedge.exe	111
PID 4660 wrote to memory of 1288	4660	msedge.exe	111
PID 4660 wrote to memory of 6060	4660	msedge.exe	113
PID 4660 wrote to memory of 3140	4660	msedge.exe	114
PID 4660 wrote to memory of 3140	4660	msedge.exe	114
PID 4660 wrote to memory of 6436	4660	msedge.exe	117
PID 4660 wrote to memory of 6436	4660	msedge.exe	117
PID 4660 wrote to memory of 6744	4660	msedge.exe	120
PID 4660 wrote to memory of 6812	4660	msedge.exe	121
PID 4660 wrote to memory of 6804	4660	msedge.exe	122
PID 4660 wrote to memory of 7144	4660	msedge.exe	123
PID 4660 wrote to memory of 7144	4660	msedge.exe	123
PID 5756 wrote to memory of 6544	5756	msedgewebview2.exe	127
PID 5756 wrote to memory of 6544	5756	msedgewebview2.exe	127
PID 5756 wrote to memory of 6544	5756	msedgewebview2.exe	127
PID 4660 wrote to memory of 6784	4660	msedge.exe	128
PID 4660 wrote to memory of 6784	4660	msedge.exe	128
PID 5756 wrote to memory of 6104	5756	msedgewebview2.exe	129
PID 5756 wrote to memory of 6104	5756	msedgewebview2.exe	129

C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.60\Xeno.exe
"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.60\Xeno.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/xe-no
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x394,0x7ffc688ec188,0x7ffc688ec194,0x7ffc688ec1a0
    3⤵
    PID:300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1540,i,2909766879695111700,2959839241999926032,262144 --field-trial-handle=2548,i,17526496938479951372,3411968673352510469,262144 --variations-seed-version --mojo-platform-channel-handle=2544 /prefetch:2
    3⤵
    PID:5284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1672,i,1259096497444681251,1534229435154861566,524288 --field-trial-handle=2548,i,17526496938479951372,3411968673352510469,262144 --variations-seed-version --mojo-platform-channel-handle=2576 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1892,i,399042034868463966,18036240782191841602,524288 --field-trial-handle=2548,i,17526496938479951372,3411968673352510469,262144 --variations-seed-version --mojo-platform-channel-handle=2844 /prefetch:13
    3⤵
    PID:1060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3624,i,15601679003249299086,10566779012634108651,2097152 --field-trial-handle=2548,i,17526496938479951372,3411968673352510469,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:1
    3⤵
    PID:2408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3632,i,3390914111662349325,2240954724923677385,2097152 --field-trial-handle=2548,i,17526496938479951372,3411968673352510469,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:1
    3⤵
    PID:1948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4304,i,4513820635773158666,1165060116408430806,2097152 --field-trial-handle=2548,i,17526496938479951372,3411968673352510469,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:1
    3⤵
    PID:1120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4348,i,16238758376029442350,8510562321729495472,2097152 --field-trial-handle=2548,i,17526496938479951372,3411968673352510469,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:9
    3⤵
    PID:3616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3812,i,7959738433629510179,11330454107118100111,524288 --field-trial-handle=2548,i,17526496938479951372,3411968673352510469,262144 --variations-seed-version --mojo-platform-channel-handle=3808 /prefetch:14
    3⤵
    PID:5060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5392,i,5532116513876845495,14029125084933916091,2097152 --field-trial-handle=2548,i,17526496938479951372,3411968673352510469,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:1
    3⤵
    PID:2756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3840,i,4202950103266129424,11549233909491595977,524288 --field-trial-handle=2548,i,17526496938479951372,3411968673352510469,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:14
    3⤵
    PID:4508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3748,i,17576853226261430503,8548227581979340205,524288 --field-trial-handle=2548,i,17526496938479951372,3411968673352510469,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:14
    3⤵
    PID:5732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5984,i,3834296875395531694,868626852370562906,524288 --field-trial-handle=2548,i,17526496938479951372,3411968673352510469,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:14
    3⤵
    - Modifies registry class
    PID:4424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5996,i,1007383784649247923,14759575946516583409,524288 --field-trial-handle=2548,i,17526496938479951372,3411968673352510469,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:12
    3⤵
    PID:1288
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3688,i,12718654400210891259,7785133817432452467,524288 --field-trial-handle=2548,i,17526496938479951372,3411968673352510469,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:14
    3⤵
    PID:7156
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3688,i,12718654400210891259,7785133817432452467,524288 --field-trial-handle=2548,i,17526496938479951372,3411968673352510469,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:14
    3⤵
    PID:6060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3880,i,3749650983490596355,17066375304132036395,524288 --field-trial-handle=2548,i,17526496938479951372,3411968673352510469,262144 --variations-seed-version --mojo-platform-channel-handle=3904 /prefetch:14
    3⤵
    PID:3140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7016,i,2371712803450627061,10042960207149284577,524288 --field-trial-handle=2548,i,17526496938479951372,3411968673352510469,262144 --variations-seed-version --mojo-platform-channel-handle=3884 /prefetch:14
    3⤵
    PID:6436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6700,i,14528410906300575823,18384554305838860286,524288 --field-trial-handle=2548,i,17526496938479951372,3411968673352510469,262144 --variations-seed-version --mojo-platform-channel-handle=6732 /prefetch:14
    3⤵
    PID:6744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6708,i,15229987190100526947,342213357512408249,524288 --field-trial-handle=2548,i,17526496938479951372,3411968673352510469,262144 --variations-seed-version --mojo-platform-channel-handle=7024 /prefetch:14
    3⤵
    PID:6812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6668,i,6088531319327061960,6319714945426837572,524288 --field-trial-handle=2548,i,17526496938479951372,3411968673352510469,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:14
    3⤵
    PID:6804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3220,i,12707100371062295780,12621495041316659421,524288 --field-trial-handle=2548,i,17526496938479951372,3411968673352510469,262144 --variations-seed-version --mojo-platform-channel-handle=2400 /prefetch:14
    3⤵
    PID:7144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6652,i,9036632448320001167,3554383758150761226,524288 --field-trial-handle=2548,i,17526496938479951372,3411968673352510469,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:14
    3⤵
    PID:6784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=912,i,13127121962288503505,17572327756050670149,524288 --field-trial-handle=2548,i,17526496938479951372,3411968673352510469,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:14
    3⤵
    PID:5716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6632,i,15638661916886649361,11482202509796584289,262144 --field-trial-handle=2548,i,17526496938479951372,3411968673352510469,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1212,i,936202729699604003,7832398262200710721,524288 --field-trial-handle=2548,i,17526496938479951372,3411968673352510469,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:14
    3⤵
    PID:4316
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Xeno.exe --webview-exe-version=1.3.60+87ae4f96f8a0927052c1120167982fb069afd1b4 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.60\Xeno.exe.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=5080.3436.9178733247111936449 /pfhostedapp:f063a4c42eba2dd4e09a3035db4a5a44cff0b703
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:5756
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.60\Xeno.exe.WebView2\EBWebView /prefetch:4 /pfhostedapp:f063a4c42eba2dd4e09a3035db4a5a44cff0b703 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.60\Xeno.exe.WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x190,0x194,0x198,0x16c,0x148,0x7ffc68165fd8,0x7ffc68165fe4,0x7ffc68165ff0
    3⤵
    PID:5104
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.60\Xeno.exe.WebView2\EBWebView" --webview-exe-name=Xeno.exe --webview-exe-version=1.3.60+87ae4f96f8a0927052c1120167982fb069afd1b4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1788 --field-trial-handle=1792,i,9807868557052078747,11786606054384789245,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:f063a4c42eba2dd4e09a3035db4a5a44cff0b703
    3⤵
    PID:4944
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.60\Xeno.exe.WebView2\EBWebView" --webview-exe-name=Xeno.exe --webview-exe-version=1.3.60+87ae4f96f8a0927052c1120167982fb069afd1b4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2132 --field-trial-handle=1792,i,9807868557052078747,11786606054384789245,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:f063a4c42eba2dd4e09a3035db4a5a44cff0b703
    3⤵
    PID:5636
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.60\Xeno.exe.WebView2\EBWebView" --webview-exe-name=Xeno.exe --webview-exe-version=1.3.60+87ae4f96f8a0927052c1120167982fb069afd1b4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2456 --field-trial-handle=1792,i,9807868557052078747,11786606054384789245,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:f063a4c42eba2dd4e09a3035db4a5a44cff0b703
    3⤵
    PID:5408
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.60\Xeno.exe.WebView2\EBWebView" --webview-exe-name=Xeno.exe --webview-exe-version=1.3.60+87ae4f96f8a0927052c1120167982fb069afd1b4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3420 --field-trial-handle=1792,i,9807868557052078747,11786606054384789245,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:f063a4c42eba2dd4e09a3035db4a5a44cff0b703 /prefetch:1
    3⤵
    PID:2052
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.60\Xeno.exe.WebView2\EBWebView" --webview-exe-name=Xeno.exe --webview-exe-version=1.3.60+87ae4f96f8a0927052c1120167982fb069afd1b4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4384 --field-trial-handle=1792,i,9807868557052078747,11786606054384789245,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:f063a4c42eba2dd4e09a3035db4a5a44cff0b703
    3⤵
    PID:6544
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.60\Xeno.exe.WebView2\EBWebView" --webview-exe-name=Xeno.exe --webview-exe-version=1.3.60+87ae4f96f8a0927052c1120167982fb069afd1b4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4472 --field-trial-handle=1792,i,9807868557052078747,11786606054384789245,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:f063a4c42eba2dd4e09a3035db4a5a44cff0b703
    3⤵
    PID:6104
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.60\Xeno.exe.WebView2\EBWebView" --webview-exe-name=Xeno.exe --webview-exe-version=1.3.60+87ae4f96f8a0927052c1120167982fb069afd1b4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4492 --field-trial-handle=1792,i,9807868557052078747,11786606054384789245,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:f063a4c42eba2dd4e09a3035db4a5a44cff0b703
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:6628
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.60\Xeno.exe.WebView2\EBWebView" --webview-exe-name=Xeno.exe --webview-exe-version=1.3.60+87ae4f96f8a0927052c1120167982fb069afd1b4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4504 --field-trial-handle=1792,i,9807868557052078747,11786606054384789245,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:f063a4c42eba2dd4e09a3035db4a5a44cff0b703
    3⤵
    PID:6524

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1408

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6272

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:6300

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

018eea2e-000d-45f7-8d8f-fe55eb26170f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\018eea2e-000d-45f7-8d8f-fe55eb26170f.tmp
Size 12KB
SHA256 c99b3b87755023b967283724e19b36645f17784619ca313151dbcef1d9ac30e8
MD5 868d77e5bac466b0de99dbf013f4ced6
SHA1 f44281e049672a541f32718ecb0be1cb2ffde021
SHA512 b000daa8aa56ee45d965546ad45b55fbad975ed0c471fcc23e938e2622fb65ead8b6b9afff679fce589e9d1aa5c4f2fb751e05cb388c7c0fa374f3168391f223
SSDEEP 192:sxRiRaCE/fUsNVJDde5lSLzoD8plu/g6+WNp2l/eBUCsuOO+GmIgVSJ:sxRiHE/fUsNVJc5l2w/5C/eYOwM
TLSH
T13E42D916AE68AD3B4CC7E21DBB55BF53D3F9503261D41E58ABFC861C04EA6DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 7KB
SHA256 99b55dcb746186470d2be9f475eca0b61824cf891558a45a6c399350b5c49e9a
MD5 809bdd0cc851d5417658210a18d2ed44
SHA1 b6ce98129e6e82b04cfe9e8f806093d7278ed313
SHA512 1c6678d70a2a6b7b3f16739d08a731954a0af37863ae59bb4ba1dd5fd7fe4c2a5877ce5d40933bf942fbaea4ec3f37607ad659f6cabd412396bbbd3dbf76c026
SSDEEP 192:m0nbmg5eOOG+L4998XvlzY1uyiZRrTckr:Zar49wvlzYwp
TLSH
T179F120AA32D8278ACBB504BD51F676C871F1336E8AC39D8A43212DB3046AFC11ED50D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe59f3eb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59f3eb.TMP
Size 3KB
SHA256 83a3cdf3216d98141d60ef30c2785661a60b884583a97c0d4438be38b6d8a512
MD5 98fb0163fc20190cc1bb45ab0c982c10
SHA1 47f49833fa84364f3bf27c51fc3780f14ed7864e
SHA512 733b26cba5d1719f9314a7f74fab5ee07514aceb1e76c200cab6c2cd0d3f7f0de9c330db51ade9ebac1a408a6ceda6e5a73e71533d5eb7b190d932693b00c596
TLSH
T153611DC233611781C7A918BD86E5B74D32F6469DCA87E95E8090ADB64CB2FC12CD21D3
MD5 SHA1 SHA512 TLSH

Submit Download

6d9d0557-6015-486c-8f0d-f2baf04fd8ae.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\6d9d0557-6015-486c-8f0d-f2baf04fd8ae.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 d9df2c5071c02e6cf4d83927049d93575c73275199ce1c4b444d286e21472e47
MD5 4db47395f0af47cc2d85b91cbb8cc85e
SHA1 3649c40a8c5d2d880b87bd233b05975b198f2b8f
SHA512 2569278c651489fd031ce5de875dcb0613302cc57276db19f112c33f3f45d95a5fe454ff192bc68c360a970e1101fb7bb1a7174ae4a096e8d028204dd2bbc85c
TLSH
T16E717EF787E8862DDA1156F4AB146E1FCE2C0924432C3C6AC9D4AE1B93E3571F181A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 17d5919c11e746c112b104d705d9c88e0bf582035580d3cf9401fb0d62267af0
MD5 e4c320f5f157ca2810188eb18de37f94
SHA1 98617989c893257ffed5752e3e7bfa31ed07bbaf
SHA512 8a606603749b81cab1025d85cf662c438beeec0b2cbc567176cccde18615e7e58e57a851bc6ac8b5f8e43a322f9916187983fd9d872e8ac2eae8775b5622876c
TLSH
T1E56180F787E4862DDA1156F4AB146E1FCE2C0924432C3C6AC9D49E2B93E3571F181A9F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 3a1b68cd9084144fcf6ead67d684ffc7f3253cb80f2362242956b19c2f491a13
MD5 199478ae21faf5a700f0c93386103f50
SHA1 2d0435a1ceeac156d9923582cbb7fda7b5755f3d
SHA512 ac46a1bf09100a707ed64b1087199d0190a7cea8f5bfb3139580cb26bf40e6c9acff28cb590a75d36dab3c2904fc839ab7321aa0958fe3ce6698e1d535853b53
SSDEEP 192:sxR5RaCE/fUsXVJPZtruzoD8plu/g6+WNp2l/eBUCniuOO+GmIgDlGJ:sxR5HE/fUsXVJRFyw/5C/eqOwA
TLSH
T14842D916EE68AD3B4CC7E21DBB55BF63D3F9503261941E58AAFC871C04EA6DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 a597f0674dcc0522cb345e25b411e4ede3284d6c6055274e4870d162ee869304
MD5 7a378651133b7d72b38266cf6b50dfb9
SHA1 af5b97d05374fcf10524533c911c4ebdf8cac4f1
SHA512 1189647dae8877192e3582923a6daca0f9e553c1cf0bb7b12b69fd6dc622a54a4e6f6f2685dd8ee38f7d3d4b0e09742691b4add256c219a51f38526d1971a33c
SSDEEP 192:sxR5RaCE/fUsXVVPZtruzoD8plu/g6+WNp2l/eBUC02uOO+GmIgD/GJ:sxR5HE/fUsXVVRFyw/5C/enOwG
TLSH
T1F342D816AD68AD3B4CC7E21CBB55BF63D3F9503261941E58AAFC871C10E66DD220340B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 f6abb48e89b6600398232ed5ea1a9d8676ce08e33076f96485575d895c1f6843
MD5 3cdc5df6a41cd71556c12b62629c08ef
SHA1 ce059f421aec408587bb23b3d9b7425614f87d85
SHA512 f425ee79457850a17e4b3cd2c9f02b814a22a0cd233d0b92cdd37d1067c402cd5b44347e33a25640a070b1e9a5bfecf8db1a6ba8eb28dc400167e0852b6a52a1
SSDEEP 768:jC+vpN7pLuL7JQWgQ+fk+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOQqceroZ9:jC+vp7E7JQWgQ+fk+u1jaZVc1r
TLSH
T159C2FA7B740DCB7F4F800ADDAC197E9B6D6802CB5698CD9047FE941C02C6BEA92194DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\17dc018b-3deb-4853-8557-5a61ea74a4f1\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 226B
SHA256 a4f12f3ed9a665d85f3d6f4dde3fcdd31855c964e850be32aa369bf04815280e
MD5 0e37337f62dc76248806efa45760e63e
SHA1 a6c8a7a54b2fc1f2ae677bee5d3ded983e0239c4
SHA512 e01deb234cc90fdbdc890c37c40e08db960d1fe15afdf354d94229ce526c157dca8268c3b46273ec88fefb1259e00325bd5fca61a02d0ef8e1cae11c838b2c9d
TLSH
T172D0A7ABB5A90850EBFB4A855B25006D83143C8518D5905CF947022A48F5F5AA616E96
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 233B
SHA256 2f84418332fdd6c9a665f0da4f5b52d77e965f03c2ed6bc33d80b441f7a0cddc
MD5 5ea176af3e62a8dda8fc08f90eba87e1
SHA1 eb73ff64d6b225a1f976964ff3799aeb21b5a7a9
SHA512 5ddaf6ec13837300d0113792a9137cb82a0bc85af95e250e45bb08c64c789115adf9480a47332119bedc36326b2bfeb263637ffa3119259a90e570b94f7e3a30
TLSH
T122D097ABF8B50840EBFB06810B3500AD83143C8408C1904CE907222E04B4E4AE219E86
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5984b7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe5984b7.TMP
Size 138B
SHA256 1901c97d3083284c8542277a82f8960b9afbf352f47445b960d34d99dd7754e8
MD5 7311ea62e95b98cc762a44ca0634e3d2
SHA1 0bdfca45a8301e1f715e0e2c7ce638cb8a2ea954
SHA512 e4109136dc577969d455d629c1bdaa6b8e9f8cfd1f69ef75585b66bd1e92af5e9142b96332245a59eee9690ababc59c2b569b5caad9dabc36bb4fe75b3bedb3c
TLSH
T1E4C08CE7B0480414CF6102814626401943087C8A08C1804CB203312A10B0A232202E95
MD5 SHA1 SHA512 TLSH

Submit Download

8f1d920e-5638-4c99-97f6-deeb1ada092f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\8f1d920e-5638-4c99-97f6-deeb1ada092f.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 4c0460f05b781b358782235549746a8c774ee1225cf0ced1ef3835893923ae40
MD5 a7e2745a53c16cca5c72f9c9b4261343
SHA1 372041ecdc0c275a0369cc4c3efb68e173ea647d
SHA512 c59f611fd5a124f555a4792a8205310b033f6e7d87770492524ea278d3dae7d6945bdc6a25ea6ad6123d771be291f46c5881332593031643a8d34ac6972e7a4a
SSDEEP 768:Brv+4UNbdD3abBYZp8+p3bd66j+4BRv86aLIWkF:Bbsbp39H8+p3Z6n4yaF
TLSH
T11A03AE72F8A9DD738CF6D644B24776837FB810A395C00EE4E9D96B4E018619E270B937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 350fdd9c9d125c73ecfcd8eeaad4070d457df44b61b68eda6f4510b52cf5a97d
MD5 d9018d07742cff2a715dc4b473987e96
SHA1 707fedf679852516aeca1f926cd3b469c3166515
SHA512 b7c5d8edcd71bae1c52bbfd22f7a1831b0a63a314921cb095dec33d5aede9662403fe8731feb03276a6fe9d6006afd15ca667190c7e5a9b0529963d0d5508737
SSDEEP 768:ec3cbBYZp8+p3bd66j+4BRv86aLIWkPi9P/:ec3/H8+p3Z6n4yaPo
TLSH
T1CCF2AF71F8A99D639CFAE784B28637436FF41463A5C00ED8E8DCAB0E118615E170B837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 cb365b5182cb79df67ba829bd798e852242ea30cf60fb153cebc14599acb3c13
MD5 3574fc36887c4c532babb2dd01be717d
SHA1 54b2a92ca71c93dc8732e000f3a76e7732be276f
SHA512 661d2436685cc614743c52d8260386a2045780c648f3b76eef26db485adbd628d692a0b00e2366263d43578371b80947c5d9f13a996ae765c598d3af6dae61d8
SSDEEP 768:jFQf3swgJAsZp8+p3bd66j+4BRv86aLIWkPi9P/:Gf3y8+p3Z6n4yaPo
TLSH
T166039E72E8A8DE67ACF6DB85B34576439EF411A3C5C45DD8E9C8AF0D008719E170BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 084a2d157bd208999baa44320054c5681b695dde317b15d6abc8136b51e2500d
MD5 829ab7e0316ebc23844d8880e1d60b77
SHA1 93c8fe258a449d1ce5e8303f47ec6d3957fafee9
SHA512 66bb583d7fba9de87f87b4c2a54ca22aa18379714a182de544bebba36463b50d7b5bc6c2dda954dbccf0b6aa63049eb16367ea5ab7c8ecca9c60d2269405542a
SSDEEP 768:Vrv+4UNbdD3+bBYIp8+p3bd66j+4BRv86aLIWkF:Vbsbp3ZW8+p3Z6n4yaF
TLSH
T1F003AF72F8A9DD738CF6D644B14776837FF810A395C00EE4E9D96B4E018619E270B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 f3b206193df0ca489c6b74442b6a38f1cbf0ba88ec39c17eeb53292a399200b9
MD5 c79bb5dbf3278fe09f30ad6c0542770d
SHA1 101793d306b861c20b7408a88ce14a2737d9b345
SHA512 f336396b6dcb5d5fb0d3f36465b2dbb70daecf5bbf8c14c9e985a31b42b9bddafc56048ad44f68546eec8e3cb633856c9b8bf742b6065e8cdc8202010dbb62f7
SSDEEP 768:Irv+4UNbdD3zcHNp8+p3bd66j+4BRv86aLIidM2bwCl1:Ibsbp3aL8+p3Z6n4y7M0ww
TLSH
T1CA03CE33F8A899739CE6C644B24A7A433FF851A396C10EC4D5DD2B4E415A19E630BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 303274f8e200ecddd94e908fff16610aed8b36ab4bae092a25ccef2ec708ca09
MD5 d6c66cba3093303a281b47ea6e64e6ed
SHA1 459fc3fd96e55ae2c2a78777b0908da0f59864bc
SHA512 7a70b18b89e207bacadc1d87586e3ed28b0f8812d41bc79fb24ad9924ba3a64134acbdbf0c3c227a9081cfd11765a0df2791465e27a3c27ca94d94cc3d232440
SSDEEP 768:Zrv+4UNbdD3V1BYNp8+p3bd66j+4BRv86aLITk2bwCl1:Zbsbp3OL8+p3Z6n4y10ww
TLSH
T1DA03BE72E4A8ED739CE6D644B14677837FB811A399C10ED4E8D96B4E005A19E370B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

6407157f-90f6-45db-b99d-ffc085bcbfd0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\6407157f-90f6-45db-b99d-ffc085bcbfd0.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5785a8d5-66c8-4966-9cd3-b2231e7b7a3a.tmp

Path C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.60\Xeno.exe.WebView2\EBWebView\5785a8d5-66c8-4966-9cd3-b2231e7b7a3a.tmp
Size 3KB
SHA256 b6783f8080e646f693e471b3540c3e875e4444c779c6819056c462d14ea9a692
MD5 1a726bd2736f5cbd48936f4a16cd869d
SHA1 301f895aa869afd367f8d85c62c589740f79ea8b
SHA512 2de461b3ae65320b1b5b110b362c683a96c7b252f7a2f95d93f544ae1acc62b0e615c720524fa880ba387014f085dd93f235eb020e6989a28891a496f737a3f3
TLSH
T138618337A564A9774AF3EA04B9862B23A7655123E9C53FA5CAEC0F0D029728D1341827
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.60\Xeno.exe.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 7d065ef7032614074237e73270bd8ad9f71ed86062fd7bf6cbbb335c352bf507
MD5 3245da019d35444b016c58b0ab69f21f
SHA1 1c5422cd410d36c4d83b4746bb1fe1404c1af095
SHA512 ddea974f55d80fc83902721458183dc1c4e3de1c2b61f562194f22c03791e15e7dbc50721eac0706f86a4573484ad473364adbb183f80d393e1e4a7f4032cc7e
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.60\Xeno.exe.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 421cd87bd8c0eda3a428e5fff057bf414c5153459b7d2a07cbb5e158ecda6b32
MD5 c05bcf0ccab7068c43c5a5ec1b230c5a
SHA1 c8da14b8fd763cbbb2566fc506241ee18927fea6
SHA512 50cdfc287db6d8b8750d51a211af7548eb12866939dea20277a957fe8ee1c3dfde031a11c14ee62b5e3e2f71c0e45dae9df6c6a6ac126ca6c7014d00785803a6
TLSH
T1D4D0122237510278C0102073103269480401D50F804580485429851E3F140641E07492
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.60\Xeno.exe.WebView2\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.60\Xeno.exe.WebView2\EBWebView\Default\Network\Network Persistent State
Size 229B
SHA256 153938ecc186cd98a2f1ebd1f53ae88cfe9d9884bd470e9166a53348a071fb2b
MD5 5c9f79435fd36dd2a8914a542651f839
SHA1 81f4f5faf2f14d448626b3f49618d11fd4295cad
SHA512 0e7cf3372f919b11b0c6341bc4df2bb8ba5106463b06c74f0736b14755fa23a78db7e9b3111938570225435169bd01f7198b6124007defa77e90bbe21fd14588
TLSH
T17AD0A7B655601AFE075583E01A24685BCE7D4003422C9DBAC6347B2D43A11B9901095B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a8c63.TMP

Path C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.60\Xeno.exe.WebView2\EBWebView\Default\Network\Network Persistent State~RFe5a8c63.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.60\Xeno.exe.WebView2\EBWebView\Default\Preferences
Size 5KB
SHA256 2d37fd043de405e11c18b448b3e4a41d7b1813f02f748e03bc788ce8b3d8e0aa
MD5 6360ee4354ed9770a6bf0ad5658a500b
SHA1 f0d20217dfa8dd0e2d573b8c2e4e6b3855303906
SHA512 cbf1695efce0166584396b9312c522dff9c3a6ecb0b2aa930fe85da6d374a25ca59c4e67014826c3d4dcc11e07615900c19566946bca740d33dd3432172c4417
SSDEEP 96:st9XdSAYQ0kb9Nk2o5h16Zdbs7/x+6Mhmuecmje3K+gn128XM1C7K:stlpJDvosbsV+FijJPG6K
TLSH
T1E5C186026E68787B4CC6F619BA39BA13E2F9643270D51D58EBF8462C08DB5DD230790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.60\Xeno.exe.WebView2\EBWebView\Default\Preferences
Size 6KB
SHA256 c2ce75294e990bbbf09ab7ff402f64cdd0fd54cc0cf4cbd00d61aedfd398d05d
MD5 16b24ef7b137770e84cabb9287a441f8
SHA1 cca16071074680698993bff00cbb89b46cbbcd9d
SHA512 e7f961803eb027ef21da2eec3844d038a127ad8b10e3210ee9855d71b7840d929ff4a09caf7e03e2fb693cdf3d22a4f209050ceff3d367363d3af38dc92f53a6
SSDEEP 96:st9XdSAYQ7Gkb9Nk2o5h16Zdbs7/x+6Mhmuecmje3K+gag28XM1C7K:stlpJBvosbsV+FijJbG6K
TLSH
T1EAD186025E68787B4CC7F519BA297A13E2F9643260951E58EBF8462C08DB5DD230790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe59c20e.TMP

Path C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.60\Xeno.exe.WebView2\EBWebView\Default\Preferences~RFe59c20e.TMP
Size 5KB
SHA256 09636aa3af904e22f89a3305bd33506b741ca9a5c2b604d1b26072e9fe423b91
MD5 606734f1954a325455daec5d1d9d2889
SHA1 932738e236f57bf42414de13377962e7fd52cc39
SHA512 3546a3f6018e0a4cdcf7b6138c3aec8fbbcacae98e3230556da1ef748753a553a680a6c181838d289530ce35b61d8cad124c30b9230ad60de5e3d57c0cbb9b2f
SSDEEP 96:r9XdSAYQ0kb9Nkodo5h16Zdbs7/x+6Mhmuecmje3K+gn128XM1C7K:rlpJDBosbsV+FijJPG6K
TLSH
T11CC186029E68787B4CC6F619BA39BA13D2F9643270D51E58EBF8462C08DB5DD230790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.60\Xeno.exe.WebView2\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.60\Xeno.exe.WebView2\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.60\Xeno.exe.WebView2\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.60\Xeno.exe.WebView2\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.60\Xeno.exe.WebView2\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.60\Xeno.exe.WebView2\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.60\Xeno.exe.WebView2\EBWebView\Local State
Size 15KB
SHA256 f6aa20a9c77ae4c1c200381a2bec2bb23fa3072f2053a9f8e6922ec68d6f4e78
MD5 c7a27858a0e0e390d27948970e7889f2
SHA1 b889faf6ebc5cf8fb30679537324eea049da2a02
SHA512 2c6f0469f69bc1509da05b75140504b8f6eb4f2bae74b583d7f9b1c71dace99b2c0b9145e45115a6e52b6d8687e639fccc36a70abf54fa04d58444a3e6182675
SSDEEP 384:A+aQikB+z/xvxjg/qhEwNBSx9we7AVdpq8u9zO:f/UxvxjgC+vJ7UsFO
TLSH
T1CE72AE2B94796E37A6F3FA04794D579BCBB884B295C12DB84EFD5F0E07872981342813
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.60\Xeno.exe.WebView2\EBWebView\Local State
Size 3KB
SHA256 26ca9af5a3f9169c7449172e76afa7f46da8c93a74a448d4a0dd5b24f94dddc0
MD5 52a0f3b8b06ca4476b7277858d2abbd2
SHA1 d2de4d2e6355025128bff01ab13aa742648a9b56
SHA512 3c830e2afe77baf7412b38edad3df1c83c09e00bc17fcca63eff20ba3dcf80f0a9c6ce271ec526561d244e99c3723480f79f37fa3c9186520ec2e54d334ebdda
TLSH
T101717536A574AE774EF3E604B9863B13A7655123D9C53FA9DAEC0F0D42DB28E1341823
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.60\Xeno.exe.WebView2\EBWebView\Local State
Size 2KB
SHA256 5d1262c6ff3e6bf3d8cc10bab746dfc0c7571cd58623284f0856445867d65850
MD5 2456fd3e9534b3259097bc89ce9235cf
SHA1 54fdf10431e62841e6ce0e3252cc898392dad1f7
SHA512 742dd07a07a183702b808967582cf2470a26d9cb18aab0f5974261ac83377974e4d3a56e7fb32f269aef69f777091f0355cdc74164a95829fb218412d95f5d12
TLSH
T1FD519233B414AF7786F3A60879477E339F3951629E922F609AEC0B19429B11E2345837
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe597006.TMP

Path C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.60\Xeno.exe.WebView2\EBWebView\Local State~RFe597006.TMP
Size 1KB
SHA256 e7d925f3ca7b735a879227ad613e8258fa29379f03abe50b28e3cc4bfe3227ad
MD5 c7efd8546d2dbd3f2510917e11839a02
SHA1 71141256f0980d91520929cbdb870fbad2dab536
SHA512 1f7600cfd8eed83d7fc44065ffcec3b2e3fea5dd4ddb97ac8f56e5c7fd1b4b6801570d9481f847dc7f402ec85cc4cab8244dff94c68b61d890a17849137b1bc2
TLSH
T14D2165B2E1609F73ADA2B2493143BA235F31116687914E0066ED4B2A43AB11E635D833
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4660_1757105883\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XENO_CACHE.bin

Path C:\Users\Admin\AppData\Local\Xeno\XENO_CACHE.bin
Size 36B
SHA256 3bab55816f9c1c63b26bee8027a74983736938cfa748d9c91230391d4bacfb88
MD5 03b4e88d732421deccbdd05cb90b0513
SHA1 1ba9d3bd3af60ecc041e93251633b5a0fbac4d9b
SHA512 40e01403608fc8d8c0bc7bc6e1367a472778dea5d4dde4d242b37b0860d098075ac71cf24abd85c6b9ee67bf6adf80adaaf279a969f4477555807003276a2c75
MD5 SHA1 SHA512

Submit Download

settings.json

Path C:\Users\Admin\AppData\Local\Xeno\settings.json
Size 101B
SHA256 88e5c8567b1cad0fa2a42a21ac273a1ffb8a6992be41e5de548d11f281f4c373
MD5 7109faf92716c37ae9d65f89a2477be0
SHA1 de2903bb44600fd8a69649c395335d4fc226c5e0
SHA512 f41ca49622d3458c1365fd9f610e1c27fd3dd816ce5c910e785532dcc39d94ceb1a00991909cc247ab4b9e9da0ac583245168853d8bdcc235116f0a7a4538b2f
TLSH
T11CB09232984108FC01608299C841D80203118E0120662E02B4BE025928308346000FD8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-bn.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5756_843497643\hyph-bn.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-mr.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5756_843497643\hyph-mr.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nn.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5756_843497643\hyph-nn.hyb
Size 141KB
SHA256 5bcbb58eaf65f13f6d039244d942f37c127344e3a0a2e6c32d08236945132809
MD5 f2d8fe158d5361fc1d4b794a7255835a
SHA1 6c8744fa70651f629ed887cb76b6bc1bed304af9
SHA512 946f4e41be624458b5e842a6241d43cd40369b2e0abc2cacf67d892b5f3d8a863a0e37e8120e11375b0bacb4651eedb8d324271d9a0c37527d4d54dd4905afab
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgY:p73HEUP8dsiinTThjy90VKY
TLSH
T1C1E319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2052-149-0x00007FFC8F220000-0x00007FFC8F221000-memory.dmp

Download

memory/4944-128-0x00007FFC8F220000-0x00007FFC8F221000-memory.dmp

Download

memory/6544-1187-0x00007FFC8EB40000-0x00007FFC8EB41000-memory.dmp

Download

memory/6544-1188-0x00007FFC8EE40000-0x00007FFC8EE41000-memory.dmp

Download

memory/6628-1340-0x0000021C1FEF0000-0x0000021C1FEF1000-memory.dmp

Download

memory/6628-1339-0x0000021C1FEF0000-0x0000021C1FEF1000-memory.dmp

Download

memory/6628-1337-0x0000021C1FEF0000-0x0000021C1FEF1000-memory.dmp

Download

memory/6628-1336-0x0000021C1FEF0000-0x0000021C1FEF1000-memory.dmp

Download

memory/6628-1341-0x0000021C1FEF0000-0x0000021C1FEF1000-memory.dmp

Download

memory/6628-1338-0x0000021C1FEF0000-0x0000021C1FEF1000-memory.dmp

Download

memory/6628-1332-0x0000021C1FEF0000-0x0000021C1FEF1000-memory.dmp

Download

memory/6628-1330-0x0000021C1FEF0000-0x0000021C1FEF1000-memory.dmp

Download