a83f3476e11bbbc9f7962cec2357e6e35fcdae691c8dd4ec19718e6d13873d92

Analysis

max time kernel
149s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/10/2026, 12:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Xeno-v1.3.60.exe
Size 156.0MB
Sample261017-pypr7sft5m
SHA256 a83f3476e11bbbc9f7962cec2357e6e35fcdae691c8dd4ec19718e6d13873d92
MD5 133f6b3a3c0c5110fc33e9152e43690b
SHA1 14db35769ec3ac4c2d5596ab076ad04700901f3c
SHA512 1cb38ab62a30beca73c11ed916b10747cd2b19b00f9bd9507b4125ed6f4776dda82478c4c7f90e681c05cc75d21160ebe5cd29ceb773fc37de44ae94053f0564
SSDEEP 1572864:LVU4t/Ct6JMgabao+nh+bw4FlWMZBZHuoM2t52kOUeEbaVO7GJbdHDexdypGT+LY:lYUJkH0sEQ
TLSH
T1C6788B03E29A00E9E05DD1B587578237EE72B8864738A6DF2754175A2F77FE02B39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	Xeno-v1.3.60.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	Xeno-v1.3.60.exe

Loads dropped DLL 1 IoCs

pid	Process
1736	msedge.exe

Contacts third-party web service commonly abused for C2 1 TTPs 7 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
36	discord.com
37	discord.com
39	discord.com
40	discord.com
44	discord.com
52	discord.com
74	discord.com

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1736_558329979\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1736_558329979\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1736_558329979\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1736_1050754227\deny_etld1_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1736_1050754227\deny_full_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1736_910188940\well_known_domains.dll	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1736_558329979\keys.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1736_1050754227\deny_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1736_1050754227\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1736_910188940\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Xeno-v1.3.60.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Xeno-v1.3.60.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Xeno-v1.3.60.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Xeno-v1.3.60.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4492	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2091445952-3649787497-104050984-1000\{0E18CA04-7203-4354-841E-8679EBBD678A}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2091445952-3649787497-104050984-1000\{BD6DEC7E-4C99-4B09-8C9B-3141E810D576}	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
748	Xeno-v1.3.60.exe
748	Xeno-v1.3.60.exe
6708	Xeno-v1.3.60.exe
6708	Xeno-v1.3.60.exe
6844	msedge.exe
6844	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	748	Xeno-v1.3.60.exe
Token: SeCreatePagefilePrivilege	748	Xeno-v1.3.60.exe
Token: SeShutdownPrivilege	748	Xeno-v1.3.60.exe
Token: SeCreatePagefilePrivilege	748	Xeno-v1.3.60.exe
Token: SeShutdownPrivilege	748	Xeno-v1.3.60.exe
Token: SeCreatePagefilePrivilege	748	Xeno-v1.3.60.exe
Token: SeShutdownPrivilege	748	Xeno-v1.3.60.exe
Token: SeCreatePagefilePrivilege	748	Xeno-v1.3.60.exe
Token: SeShutdownPrivilege	748	Xeno-v1.3.60.exe
Token: SeCreatePagefilePrivilege	748	Xeno-v1.3.60.exe
Token: SeShutdownPrivilege	748	Xeno-v1.3.60.exe
Token: SeCreatePagefilePrivilege	748	Xeno-v1.3.60.exe
Token: SeShutdownPrivilege	748	Xeno-v1.3.60.exe
Token: SeCreatePagefilePrivilege	748	Xeno-v1.3.60.exe
Token: SeShutdownPrivilege	748	Xeno-v1.3.60.exe
Token: SeCreatePagefilePrivilege	748	Xeno-v1.3.60.exe
Token: SeShutdownPrivilege	748	Xeno-v1.3.60.exe
Token: SeCreatePagefilePrivilege	748	Xeno-v1.3.60.exe
Token: SeShutdownPrivilege	748	Xeno-v1.3.60.exe
Token: SeCreatePagefilePrivilege	748	Xeno-v1.3.60.exe
Token: SeShutdownPrivilege	748	Xeno-v1.3.60.exe
Token: SeCreatePagefilePrivilege	748	Xeno-v1.3.60.exe
Token: SeShutdownPrivilege	748	Xeno-v1.3.60.exe
Token: SeCreatePagefilePrivilege	748	Xeno-v1.3.60.exe
Token: SeShutdownPrivilege	748	Xeno-v1.3.60.exe
Token: SeCreatePagefilePrivilege	748	Xeno-v1.3.60.exe
Token: SeShutdownPrivilege	748	Xeno-v1.3.60.exe
Token: SeCreatePagefilePrivilege	748	Xeno-v1.3.60.exe
Token: SeShutdownPrivilege	748	Xeno-v1.3.60.exe
Token: SeCreatePagefilePrivilege	748	Xeno-v1.3.60.exe
Token: SeShutdownPrivilege	748	Xeno-v1.3.60.exe
Token: SeCreatePagefilePrivilege	748	Xeno-v1.3.60.exe
Token: SeShutdownPrivilege	748	Xeno-v1.3.60.exe
Token: SeCreatePagefilePrivilege	748	Xeno-v1.3.60.exe
Token: SeShutdownPrivilege	748	Xeno-v1.3.60.exe
Token: SeCreatePagefilePrivilege	748	Xeno-v1.3.60.exe
Token: SeShutdownPrivilege	748	Xeno-v1.3.60.exe
Token: SeCreatePagefilePrivilege	748	Xeno-v1.3.60.exe
Token: SeShutdownPrivilege	748	Xeno-v1.3.60.exe
Token: SeCreatePagefilePrivilege	748	Xeno-v1.3.60.exe
Token: SeShutdownPrivilege	748	Xeno-v1.3.60.exe
Token: SeCreatePagefilePrivilege	748	Xeno-v1.3.60.exe
Token: SeShutdownPrivilege	748	Xeno-v1.3.60.exe
Token: SeCreatePagefilePrivilege	748	Xeno-v1.3.60.exe
Token: SeShutdownPrivilege	748	Xeno-v1.3.60.exe
Token: SeCreatePagefilePrivilege	748	Xeno-v1.3.60.exe
Token: SeShutdownPrivilege	748	Xeno-v1.3.60.exe
Token: SeCreatePagefilePrivilege	748	Xeno-v1.3.60.exe
Token: SeShutdownPrivilege	748	Xeno-v1.3.60.exe
Token: SeCreatePagefilePrivilege	748	Xeno-v1.3.60.exe
Token: SeShutdownPrivilege	748	Xeno-v1.3.60.exe
Token: SeCreatePagefilePrivilege	748	Xeno-v1.3.60.exe
Token: SeShutdownPrivilege	748	Xeno-v1.3.60.exe
Token: SeCreatePagefilePrivilege	748	Xeno-v1.3.60.exe
Token: SeShutdownPrivilege	748	Xeno-v1.3.60.exe
Token: SeCreatePagefilePrivilege	748	Xeno-v1.3.60.exe
Token: SeShutdownPrivilege	748	Xeno-v1.3.60.exe
Token: SeCreatePagefilePrivilege	748	Xeno-v1.3.60.exe
Token: SeShutdownPrivilege	748	Xeno-v1.3.60.exe
Token: SeCreatePagefilePrivilege	748	Xeno-v1.3.60.exe
Token: SeShutdownPrivilege	748	Xeno-v1.3.60.exe
Token: SeCreatePagefilePrivilege	748	Xeno-v1.3.60.exe
Token: SeShutdownPrivilege	748	Xeno-v1.3.60.exe
Token: SeCreatePagefilePrivilege	748	Xeno-v1.3.60.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
748	Xeno-v1.3.60.exe
748	Xeno-v1.3.60.exe
748	Xeno-v1.3.60.exe
748	Xeno-v1.3.60.exe
748	Xeno-v1.3.60.exe
1736	msedge.exe

Suspicious use of SendNotifyMessage 5 IoCs

pid	Process
748	Xeno-v1.3.60.exe
748	Xeno-v1.3.60.exe
748	Xeno-v1.3.60.exe
748	Xeno-v1.3.60.exe
748	Xeno-v1.3.60.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 748 wrote to memory of 5560	748	Xeno-v1.3.60.exe	86
PID 748 wrote to memory of 5560	748	Xeno-v1.3.60.exe	86
PID 748 wrote to memory of 1720	748	Xeno-v1.3.60.exe	87
PID 748 wrote to memory of 5344	748	Xeno-v1.3.60.exe	88
PID 748 wrote to memory of 5344	748	Xeno-v1.3.60.exe	88
PID 748 wrote to memory of 2032	748	Xeno-v1.3.60.exe	89
PID 748 wrote to memory of 2032	748	Xeno-v1.3.60.exe	89
PID 748 wrote to memory of 1736	748	Xeno-v1.3.60.exe	91
PID 748 wrote to memory of 2532	748	Xeno-v1.3.60.exe	92
PID 748 wrote to memory of 2532	748	Xeno-v1.3.60.exe	92
PID 1736 wrote to memory of 5292	1736	msedge.exe	93
PID 1736 wrote to memory of 4492	1736	msedge.exe	95
PID 1736 wrote to memory of 4784	1736	msedge.exe	96
PID 1736 wrote to memory of 4620	1736	msedge.exe	97
PID 1736 wrote to memory of 4784	1736	msedge.exe	96
PID 1736 wrote to memory of 4784	1736	msedge.exe	96
PID 1736 wrote to memory of 4620	1736	msedge.exe	97
PID 1736 wrote to memory of 3940	1736	msedge.exe	98
PID 1736 wrote to memory of 4184	1736	msedge.exe	99
PID 1736 wrote to memory of 3940	1736	msedge.exe	98
PID 1736 wrote to memory of 3940	1736	msedge.exe	98
PID 1736 wrote to memory of 4184	1736	msedge.exe	99
PID 1736 wrote to memory of 4184	1736	msedge.exe	99
PID 1736 wrote to memory of 2488	1736	msedge.exe	104
PID 1736 wrote to memory of 2488	1736	msedge.exe	104
PID 1736 wrote to memory of 2488	1736	msedge.exe	104
PID 1736 wrote to memory of 1240	1736	msedge.exe	106
PID 1736 wrote to memory of 3800	1736	msedge.exe	105
PID 1736 wrote to memory of 3800	1736	msedge.exe	105
PID 1736 wrote to memory of 3972	1736	msedge.exe	111
PID 1736 wrote to memory of 5804	1736	msedge.exe	112
PID 1736 wrote to memory of 3972	1736	msedge.exe	111
PID 1736 wrote to memory of 5804	1736	msedge.exe	112
PID 1736 wrote to memory of 1884	1736	msedge.exe	114
PID 1736 wrote to memory of 6952	1736	msedge.exe	120
PID 1736 wrote to memory of 6960	1736	msedge.exe	121
PID 1736 wrote to memory of 6968	1736	msedge.exe	122
PID 1736 wrote to memory of 6248	1736	msedge.exe	123
PID 1736 wrote to memory of 6248	1736	msedge.exe	123
PID 1736 wrote to memory of 1576	1736	msedge.exe	126
PID 1736 wrote to memory of 1576	1736	msedge.exe	126
PID 1736 wrote to memory of 2880	1736	msedge.exe	127
PID 1736 wrote to memory of 2880	1736	msedge.exe	127
PID 748 wrote to memory of 6708	748	Xeno-v1.3.60.exe	128
PID 1736 wrote to memory of 6844	1736	msedge.exe	129
PID 1736 wrote to memory of 6760	1736	msedge.exe	130
PID 1736 wrote to memory of 6760	1736	msedge.exe	130

C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.60.exe
"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.60.exe"
1⤵
- Checks computer location settings
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:748
- C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.60.exe
  "C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.60.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Xeno" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1656 --field-trial-handle=1680,i,255129307811075879,6008653712728266771,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
  2⤵
  PID:5560
- C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.60.exe
  "C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.60.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Xeno" --mojo-platform-channel-handle=2292 --field-trial-handle=1680,i,255129307811075879,6008653712728266771,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  PID:1720
- C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.60.exe
  "C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.60.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Xeno" --app-user-model-id=Xeno --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --enable-sandbox --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2516 --field-trial-handle=1680,i,255129307811075879,6008653712728266771,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
  2⤵
  - Checks computer location settings
  PID:5344
- C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.60.exe
  "C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.60.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Xeno" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2992 --field-trial-handle=1680,i,255129307811075879,6008653712728266771,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
  2⤵
  PID:2032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/xe-no
  2⤵
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x358,0x7ff8413dc188,0x7ff8413dc194,0x7ff8413dc1a0
    3⤵
    PID:5292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1752,i,374761390047601768,14709137905320123467,524288 --field-trial-handle=2620,i,1495528252713845797,10458106645910507227,262144 --variations-seed-version --mojo-platform-channel-handle=2648 /prefetch:3
    3⤵
    - System Time Discovery
    PID:4492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1624,i,16036386131136336142,6349128136806641319,262144 --field-trial-handle=2620,i,1495528252713845797,10458106645910507227,262144 --variations-seed-version --mojo-platform-channel-handle=2616 /prefetch:2
    3⤵
    PID:4784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2176,i,12011213464881703002,7445529506213676934,524288 --field-trial-handle=2620,i,1495528252713845797,10458106645910507227,262144 --variations-seed-version --mojo-platform-channel-handle=2656 /prefetch:8
    3⤵
    PID:4620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3404,i,13060821528451610501,830837461670458391,2097152 --field-trial-handle=2620,i,1495528252713845797,10458106645910507227,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
    3⤵
    PID:3940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3408,i,5037233376696190485,10170892791629466823,2097152 --field-trial-handle=2620,i,1495528252713845797,10458106645910507227,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
    3⤵
    PID:4184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4920,i,5309975817696477191,16486585889533553183,2097152 --field-trial-handle=2620,i,1495528252713845797,10458106645910507227,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:1
    3⤵
    PID:2488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5252,i,10793144497956010355,16972519783004106957,524288 --field-trial-handle=2620,i,1495528252713845797,10458106645910507227,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:8
    3⤵
    PID:3800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5248,i,16445260577775211423,6003814240121115208,524288 --field-trial-handle=2620,i,1495528252713845797,10458106645910507227,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:8
    3⤵
    - Modifies registry class
    PID:1240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5760,i,4871034985526857887,5343472480833544312,524288 --field-trial-handle=2620,i,1495528252713845797,10458106645910507227,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:8
    3⤵
    PID:3972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5764,i,142703646419326638,17632367371400284882,524288 --field-trial-handle=2620,i,1495528252713845797,10458106645910507227,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:8
    3⤵
    PID:5804
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6264,i,9076242384546251899,8891258051755829099,524288 --field-trial-handle=2620,i,1495528252713845797,10458106645910507227,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:8
    3⤵
    PID:5172
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6264,i,9076242384546251899,8891258051755829099,524288 --field-trial-handle=2620,i,1495528252713845797,10458106645910507227,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:8
    3⤵
    PID:1884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6308,i,11964035321166288013,13455249110470219003,524288 --field-trial-handle=2620,i,1495528252713845797,10458106645910507227,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:8
    3⤵
    PID:6952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6448,i,1408280430934667093,2565213191504597143,524288 --field-trial-handle=2620,i,1495528252713845797,10458106645910507227,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:8
    3⤵
    PID:6960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6264,i,17779665617993429776,6415176229458713562,524288 --field-trial-handle=2620,i,1495528252713845797,10458106645910507227,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:8
    3⤵
    PID:6968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6032,i,7410592604196008909,10648790296525542623,524288 --field-trial-handle=2620,i,1495528252713845797,10458106645910507227,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:8
    3⤵
    PID:6248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6564,i,1825301774689310094,16714983594065100722,524288 --field-trial-handle=2620,i,1495528252713845797,10458106645910507227,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:8
    3⤵
    PID:1576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6204,i,577019732919837236,8373322103262853455,524288 --field-trial-handle=2620,i,1495528252713845797,10458106645910507227,262144 --variations-seed-version --mojo-platform-channel-handle=6636 /prefetch:8
    3⤵
    PID:2880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6400,i,13703890752711617638,10572034513241909324,262144 --field-trial-handle=2620,i,1495528252713845797,10458106645910507227,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:6844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6180,i,13964234413942094970,16144635808674826850,524288 --field-trial-handle=2620,i,1495528252713845797,10458106645910507227,262144 --variations-seed-version --mojo-platform-channel-handle=6732 /prefetch:8
    3⤵
    PID:6760
- C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.60.exe
  "C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.60.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --user-data-dir="C:\Users\Admin\AppData\Roaming\Xeno" --mojo-platform-channel-handle=3968 --field-trial-handle=1680,i,255129307811075879,6008653712728266771,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
  2⤵
  PID:2532
- C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.60.exe
  "C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.60.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\Xeno" --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2936 --field-trial-handle=1680,i,255129307811075879,6008653712728266771,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6708

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4632

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4996

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

deny_domains.list

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1736_1050754227\deny_domains.list
Size 12B
SHA256 f51a7acfffec56d6751561966d947d3fd199b74528c07dabdcf5fcb33d5b2e85
MD5 085a334bdb7c8e27b7d925a596bfc19a
SHA1 1e4ad53dc335af5c6a8da2e4b4a175f37fafe2f2
SHA512 c883cb43c97a136825c6fd143f539210c234c66f9b76dfd8431f6ff014094e20b9410d7462aadee2344df8ca158def6b9a807e7cadbdfa947f6f8592e7283e34
MD5 SHA1 SHA512

Submit Download

deny_etld1_domains.list

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1736_1050754227\deny_etld1_domains.list
Size 6KB
SHA256 8babf90cf0c44b6e36537a8535a0e3d89e04001ae8b08a7fb50a51419c88a2e9
MD5 412aad0c01696dda21dfd839dc7ae2c7
SHA1 28a3a41d4d8dfee7fcda638c4373aeb2b384cad9
SHA512 944d8cb2340ba8fe3dfb84dcaf2b600f33f5e944e488be0bcade0787a73d3f6fa4255f005d230d74e0d8d13a7ccd4d3e2144626d6ea4ea3beb078f3cdcf71e31
SSDEEP 192:6D8dUysbBX9GyjW7xeU1ypJ5cz626OpqRiaFDBGUPJ:I8dUystXqsU16J5lvoEFlFB
TLSH
T1C7E1BFECF4C887F13BF43727C47F2A431A0EA119BD5A5229C91E6F00311D748182553D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

deny_full_domains.list

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1736_1050754227\deny_full_domains.list
Size 12KB
SHA256 19e871f69e774c847717469957dd18f342712e702d2c54c5efb8542907bcbabd
MD5 85a2a44606d0d937cb7c3cb97549d1dc
SHA1 27081c556bfa37eef2ac2b0bfafecf90dfa8662d
SHA512 3f564a6b0b71ff54e3cf0e7addd91fb63a2e0d477cacaf73409fcd4c29cfa2076e76d0ca0e330c4fd0fba6cdaec8f118401bb2ce0f83af9e334cd603adb61d24
SSDEEP 192:3zjGRPX/DE6OGcrMHNK17dYuybxV3SOZTAnbtIBzkJkW9ELtW74zPJ1vRbmZM0ED:PAPYmhKh8RvOkWYtW74zBI1F71WqEgOR
TLSH
T16D42D04EF5E8A884C70E0AE50B8C759EDE0A514087A22BD53FB57B5F6988CB9FB11601
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1736_558329979\LICENSE
Size 1KB
SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
MD5 ee002cb9e51bb8dfa89640a406a1090a
SHA1 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
SHA512 d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
TLSH
T17D31535723840B9306DA2B4566AEBDC4B0DDC02D7F27AE05186EF394537B52ED8B3443
MD5 SHA1 SHA512 TLSH

Submit Download

verified_contents.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1736_558329979\_metadata\verified_contents.json
Size 1KB
SHA256 c9e76a313bb06d9d761611d7cb8c2ab8de59eb9959b77458138630dacebaeb0e
MD5 243afa1f565d5789d05d9762162cfa32
SHA1 7c7b6757be9b6ae391a59b940ddfb646cf6ce732
SHA512 671b53dd21e4566df6fb4ef811fb95382447f57a82d497de029ce1528aaaa47f26277615f6ca91ffe4834598b2a0b5b78ec2f2dabed2ef704581cbb990ad67a2
TLSH
T11F3119B8380E324F90A7E30425BB9D33534570BE13E0A517B1C26A4E5598A40B2732FA
MD5 SHA1 SHA512 TLSH

Submit Download

well_known_domains.dll

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1736_910188940\well_known_domains.dll
Size 86KB
SHA256 f63a806e2b89ed1db25687026abff5df4675a82a13882cdb2a47d1b08d2c996e
MD5 94e3e395b95eed4fe8857e0258d62491
SHA1 0e9bb0173cb2df4be5eea77cef5a09bb5b3116b3
SHA512 b680ece7a8b72a6f78a1643ee52a606fe7a094fe058bac041c25b775dd472834a1df349d45594a11fe6eb4c41d083bdb9809e944d9ff254d795f04e177ac19d7
SSDEEP 1536:HJxEzwtlOEMkVXvopF0BYDfBny/nXi7IruMPzEVWHxgeBz4:HA2DMggpuusPXBuEuaxgEc
TLSH
T17583F14A7AAC149BE9EB8674E2645E17BB72775B071893EF1342D0040DF73C1AE35A38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

271568e2-a4f8-44ad-8394-93cc58cd0757.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\271568e2-a4f8-44ad-8394-93cc58cd0757.tmp
Size 26KB
SHA256 df90cfef95e5609e06bb5e11c60ed6505a7fa2c94e052ddd94425bc7c5421b98
MD5 5f8d7b0f8d83cee65420d67c225b5cbb
SHA1 00ce6223ef1799261e9e50c8e266f4e41d9a353b
SHA512 0a6145f519b1c526218fcbf1e7255dfba8ab9febad0cf02ed12f8a7658d89e47035b05cdfb544b258f1ca83ef18b4a915b10e5c50cf74e458bdc4d9e372ca302
SSDEEP 384:ntiFzQkUSvu3sNr8TUNTUlI4+aKMP7Zw2f0BCpcM9qiJbMTlgL/7IzwIIl9:kFdu3Gwgyx4BC4iJbMTGL7
TLSH
T1B6C24A35E8A9DEABDDEB4F99E35A3647EEE00153D8984AD8E9C91D5C00C31DD2307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

38523ab1-f418-47ff-8a7e-a37e0a9ee45e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\38523ab1-f418-47ff-8a7e-a37e0a9ee45e.tmp
Size 31KB
SHA256 45ef0d6254c4649444e4dfa955a9509565b5281a861b3e0a5980f2b8cbff8da4
MD5 4b25653f7fa331b86f46d0893a2b55f1
SHA1 8d4d18eca1f27d324ce115dbb046d6a63eca94eb
SHA512 fde94615d8b98ad5a5a0653aaab681b7839bd0bbe3ca78b918a2658f19e654690d5edb1c4b23cba3cfcca94ead93cc4bab4b8312c6ab5e23a5e8d25f1d2e6fed
SSDEEP 384:nxiFzQkUSvj/3sNr8TUNTUlI4+aKMPSZw2f0BCpcM95mJbMTlgL/7IzwIIl9:YFdT3Gwgyg4BCTmJbMTGL7
TLSH
T194E28FF5A8D799B7D9AE4B97A33D2E029ABCC153B4984984F7C50D0CCC821BFD306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3c759090-0001-4067-8bb8-57652b420ba9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3c759090-0001-4067-8bb8-57652b420ba9.tmp
Size 25KB
SHA256 d8f415d84900c1d9cdde66dc373dc8db174c93dec690b05a5c60a468469458a1
MD5 380d0a2ca61b59d3df32198c9f9e6fdc
SHA1 d8cf52800d083a2270579e939b47514b0d5d6750
SHA512 1648e2a663f60ec2c7154c087f82cb80c4ecacbd09972de3833b73fb28a0dcc319e289d282ae09f8002a74ee22f845f1811516ad1f85031862a7df74f46128d6
SSDEEP 384:npiFiZcI63sNw8TUNTUlIm2aKMiDN4w2f0BCpcM2F6osa+VYGRgL/7Iz5JoS:AFQ63dwgcSZBC6F6ohgPJ1
TLSH
T16AC23932EC98DDABE8FB4FD9AB4A7607DEF01153949C99C4DAD81D1D00876AD1307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

656be061-38be-465e-9be9-7ada1f96753d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\656be061-38be-465e-9be9-7ada1f96753d.tmp
Size 26KB
SHA256 7b8695aaa149826041f06447b7e59d797d3222bd6ba65dfd97017015bdb1e470
MD5 05fb8bdde6516d9dccb86e3cfa0a80be
SHA1 b9b321fca2c07ab8d066b0ca038c21e8cbb41603
SHA512 c80c7050a45b4cfab3be41d0b5761b7f2fe4dfce50962a1f166468a5347e0c46aa64ab6f6c52696ee32c12aba4f89a7488c24967f3068daf7ce7218a20bacb71
SSDEEP 384:nziFzQkUSvu3sNr8TUNTUlI4+aKM47Zw2f0BCpcM9qiJbMTlgL/7IzwIIl9:eFdu3Gwgy04BC4iJbMTGL7
TLSH
T161C24A35E8A9DEABDDEB4F99E35A3647EEE00153D8984AD8E9C91D1C00C31DD2307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2f67a665126f0d437497b394b50cc87ce72773b6abd85385bb78adf0ad326302
MD5 a98f4348736e1c7c5e70799864c15774
SHA1 fa2e3725e970aab935f77d155b649177f50be7d6
SHA512 c1dd68c743d45af6f713c7d8fade4a675abe4d224e86b956c5aaf959ccda0a92b9824b0e784a0ee9992843bfc2a7a73f85267479d6e5ffa0aa5827760492419d
TLSH
T19ED02B20B6A87654E006343C0114428C31CE5570140BB400809413A40FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3c1c88a1dc8e5439a1a520e9db930955bf4755654f664147c54e6cba8b43ed4c
MD5 22184503a294aa98846d9a4c3975971b
SHA1 44809070563819cceeff10eeef861544783faf98
SHA512 5d29c381872b72159a2d05366e0578c0ad56eb5ef51240db505660b787e0b3b88212c74bad2c16783f95846d95fdad86172cdc01a84d34426cca804e937a679d
TLSH
T1F4D02B24B2AC7654E01A343C0114428C30CE5970140BB400805413940FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

22cf09df-37e4-4d84-8385-935bf1419131.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\22cf09df-37e4-4d84-8385-935bf1419131.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

5bb8c915-46f4-4908-b9fd-74de2d57e34d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5bb8c915-46f4-4908-b9fd-74de2d57e34d.tmp
Size 414B
SHA256 586ac00444bba12afd762bab4060c628b8479343ddff7525ea7fdbd3fb4fc556
MD5 c6d6cda10865c82a3ceb839f7e0af976
SHA1 c1eb459995a56dc83af594f51d2100598a35dc34
SHA512 38e7b37c9eb3c695a710a524ba3ad9223de5878a7f0a491574e89826480b3773a2e57902dae4e83d9641b109a82667328e740fdc5b87b0e13583a1ad75d43a35
TLSH
T141E02B6AC811EC3B18FD1B7860A40246E740232B2B41984B3B3EC00C8FF09368586DAC
MD5 SHA1 SHA512 TLSH

Submit Download

64d38cc5-8922-434c-a1d1-71f3d6eceed4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\64d38cc5-8922-434c-a1d1-71f3d6eceed4.tmp
Size 12KB
SHA256 5b22a76c1cee43a9dc27d3cc496aa4cf1a75acbc42d0ffccf8ced84b9750be31
MD5 cf4c94a3d8f10fe1f3f4f84d3989bb86
SHA1 166d5ec557bc35dbf9b64ed9dd224cc5cf73685a
SHA512 8d33311f305c4ce418230eab39dc7cf056b8eb2ff92c4a25d8500ba2de71c9db6800cb31c3d0e4d6735defb345da02b06d451f6077dcc8361606dfe92c8fc0fe
SSDEEP 192:sxZvRUjI/fosBoaQZLjO8ezodp++HW6+WNzLx/YoK+VS1yHrIg5otpJ:sxZv2I/fosTOPVFhHbh//S0+tT
TLSH
T18042D855AD28693B4CCBD219FB557F53D3F91032A4950E44BAFC8A1C14E76DD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7044ee7c-f10a-4317-8119-cda942d783d5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7044ee7c-f10a-4317-8119-cda942d783d5.tmp
Size 12KB
SHA256 3daf971a2bcd27d70e68e5e9a47e85ea2095e9252dc885fe6448be252cb50121
MD5 20d7ce1174652e643b1fa56df5fcd9ed
SHA1 db4b3d72b941ff5d03b718e0b6c5435ef10fa35e
SHA512 43147cdbf903f4bb243601618ecc93763f3109cc25eec14db55fc1b2b07fc5001e84394759696dd1ae4db7c13b7dd60b0caac89168b1545ce9537d76a12757b0
SSDEEP 192:sxZvRUjI/fosvaQZLjO8ezodp++HW6+WNzLx/YoK+VS1yHrIgjtpJ:sxZv2I/fosCOPVFhHbh//S0jtT
TLSH
T10742D655AD28A93B8CCBD619FB557F53E3F91032A4850E44BAFC8A1C14EB6DD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

751de7b4-5d2a-4bbd-96e7-7d94fad4b854.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\751de7b4-5d2a-4bbd-96e7-7d94fad4b854.tmp
Size 12KB
SHA256 84a719d98c7ec1e74eb45a0e2a69646cb62e82f87376c10867ad82adbea3f5af
MD5 6b08af0401eaac9ab61ecc007085b408
SHA1 c9170ec6bae730b4b8fae3213402350c649d3be8
SHA512 8c862e36c4ece484f41c5df996accaf6045ddff2d869bf83cf05d029f653fcc814179d8e682016c4143d527af67da765186ab5ef265fabc8144022c856a8866a
SSDEEP 192:sxZvRUjI/fosBFQZLjO8ezodp++HW6+WNzLx/Yo++VS1yHrIg5ULttJ:sxZv2I/fosTOPVFhHbh/rS0mt3
TLSH
T11A42D755AD28A93B4CCBD619FB557F53E3F91032A0850E88BAFC8A1C14E76DD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9233ca0b-254c-4603-a2fe-35742d402b1d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9233ca0b-254c-4603-a2fe-35742d402b1d.tmp
Size 32KB
SHA256 71e82753105af38f17cec068c24cfc2704bfe5131783fffe704ee4e443ccea15
MD5 f733fc3b229a07ebbe38bc16c1eb1f9b
SHA1 0054f83d3646efef0f70d17e369fa025d40facae
SHA512 d3ca9a923a5b1f3dc38b7ed1f99645aa6400703efd316aff23cd2064eada750a90ddaed4e8a6ff8350abc85dec36207915d4714ad6400fd1f178224f99e72cca
SSDEEP 768:Px6r8sW7pLuLbG+Wviy8K8F1+UoAYDCx9Tuqh0VfUC9xbog/OVx1qpLlvVajYroB:Px6r8s2EbG+Wviy8Ku1jaU1qpLd4jjok
TLSH
T10AE2E97B780CCF7E4FC05A9DDD1A7F8A6DA802CB9698C94087FA945C02C67EA51170DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 9KB
SHA256 28b7c7b60165e8079fce07f458e4c24069db291999b2345e5a6351bc68b5a5af
MD5 143cdbb67d12eb2ff17bbb89d9152960
SHA1 ed3bc667e8a56ace35a2e25449996be2eb5fbcc4
SHA512 ea6344d88250026a310c90846b1bcc72ea3c7343428c34daa00c7e8ffa144273b582fa94a447f251a699b6592f23869a635e476b9052241a79c8e44877622192
SSDEEP 96:+RFImj+2Hz6T0+0BoX96EMb/IwYEfttsVknxTG6VTaWqfIHLgwsBmuWi+Va7ySpM:UIYGFp6Rb/IwYgjxCJWy7Qb7/JT
TLSH
T13312824208726590F759B57E4AD388623270D93B51670EBAE2BDF877681E73B1337844
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 318613313672fec0656489e83d28d73e02128a61f4f3a63f679da3af14b37cc3
MD5 97449ce8762d538c6729c362a6e96f11
SHA1 9d0629ad69787f41adc0486e1f4b9de4fd8af347
SHA512 52492909592b1dfb834975588c04229e22a2394028ee3ce81790a19762cf565bb7a51cc59779ae49d0a65c3872263cc7441d04c09cd3f8448172768ee9665083
TLSH
T101617F820993BEE0F3994576AFE509873BB05EAC91B71F1E3794CCB8B80EF162141C60
MD5 SHA1 SHA512 TLSH

Submit Download

a5f9aa69-d3ba-4a54-bc42-e7bf088ead1d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\a5f9aa69-d3ba-4a54-bc42-e7bf088ead1d.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

1d9654a4-c937-4b3d-aefb-22d76a3ac45f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\1d9654a4-c937-4b3d-aefb-22d76a3ac45f.tmp
Size 3KB
SHA256 8511d8dc2d3a86c576273f4ef4b9b98e169dc320e7e58b72e06119ffff8c068a
MD5 b0c2b91aec18dddf55a4ded9d7fb2757
SHA1 93819a69c39b73ab85b6113c8c961a201cceabd2
SHA512 1f91d7ea0f98e9d90d9a7ffa1e7d1ebec8120d8d8cd9d6e79f37b617dfda10bd1e4f362dd72c6c87065762655166ede874d31bd1bb4dbbf0ff2e985d3ad8ac3b
TLSH
T1CD619DF387E8862DCA1156F4AA147E1BCE2C0954431C3C6EC4E4AE5B93E25B1F18165F
MD5 SHA1 SHA512 TLSH

Submit Download

88d16835-b70d-47e1-b719-4c24be9859d4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\88d16835-b70d-47e1-b719-4c24be9859d4.tmp
Size 2KB
SHA256 1e24aa582b28e313e63831b57a0d702c5fca9c7384975f2af8201890e1a7617f
MD5 c6481f20e69877c58a87d21bd5f9d49d
SHA1 aa49afeedc62f42d2ac8ed1c911ba24a12aa73bc
SHA512 f8f92b444d518a3d754d731337b02243276699a2a034adb2506be8ec9d941cbce758ecd0c083ccfcbd5c425817c9d91e7d9c977ed63eeb512b32f5bc99dd2d88
TLSH
T1AB517DF387E8862DCA1156F4AA186E1BCE2C0954431C3D6AC4E4AE2B93E25B1F18165F
MD5 SHA1 SHA512 TLSH

Submit Download

98a9c13c-d5b0-4145-a64d-effa3cd54827.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\98a9c13c-d5b0-4145-a64d-effa3cd54827.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

9a865312-4112-4090-9f65-65f9092481de.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\9a865312-4112-4090-9f65-65f9092481de.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

d2928a50-99bd-43c8-9e78-c983acb0afff.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\d2928a50-99bd-43c8-9e78-c983acb0afff.tmp
Size 1KB
SHA256 ce4043574da71be16df3e9760945fbc211a657edb8093bf889cd5aa97acc8db1
MD5 d8dc7167f8c7447e3a39d69b2cd15b73
SHA1 37f48f2d898c60af824cc9143c152af54f0a868a
SHA512 ebae0aeeddc837448afa32eb768f7ff4d7c26dc154cf337c51c7c76d2e4ceffb1b00e4b7f567ff17cab1b1a96ed4f8e47c9ffc0d2b7fb3ce3d94aa51fcbe68ba
TLSH
T1FC318EF3C3E4C66E8A0096F0A618BE2BDE2D0554432C3D9AC9E4AF2BD3E3471D14165B
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\0a34aacd-be09-4963-a204-5f7f01182584\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 138B
SHA256 dfa03463724e7294fd0d86812f5d0c6e719f230ede4f30d70adddfda0b69f5f3
MD5 aaf7e65ed18613129c16f6f752f75648
SHA1 fbfc0ae3cb806a524c86cee71b98acff1eb8d68d
SHA512 fae241b2809d0328f5de937a7b8b65783247c3d60ebba5a650d4ce1bebf7a4652d5483ffd5c64e61483c4b05701d51fe339cae9f2ffa0f16086f232f2b352846
TLSH
T1B6C02BE3A00710A1C72107E00333091FC3012CCC4C8E80CDF00330142270E133102EE1
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt.tmp
Size 233B
SHA256 49db41a8e7a86433f3072e56355654ad155d6d5232aec4e63c8f4b79b66f61bb
MD5 77d7767abe726ca9f873f0874f784067
SHA1 e8b7886c7abff76326f4a3388ecf7f0e4f197f56
SHA512 d3dc16c1ac8040b9eda6cc88586005d66cdcc4690031969859bd35ffedc96b20ad0f74dbcab5e4c4d084a5cafc79ea8abdea57252594758eece820ea9b2e88cf
TLSH
T150D0A797E0571591D7B74BD1567608ABC3643C8C589DC58CE503341D89B4E43A226FA2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt.tmp
Size 226B
SHA256 194720f8fca2600c411449784cb88a2b2a73309fe31220c6057e47b0e1ad211b
MD5 2608c7b183127974b5486f5056d85987
SHA1 15ae2c1934bf846f6fe67418d231f91a63e2092b
SHA512 ca1422e7841d9ebd4c58d4242b413c096546d2f53f7343d7389d82686a218d0247f4f578325046940576a6f7812a7207d79055aa29d5ad83da2a24bd41989cf5
TLSH
T1DDD0A797A05B1591D7BB4FD116760877C3143C8C549DC58CE4031419C994E536117FE2
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 7c99230907c75873023181b5c624fd72f9e9a9edbbc54c777e9f90f89242fafe
MD5 8d9e683ae07cc858df32c58702a0008b
SHA1 7304546b2b310bf9f3f2538e2c8b4f1da0119d60
SHA512 99baea98e7fa5edc0215a4daf868189da799e7ac7d1d86277f9d7e3c1051fd91f6913a1f60ce0c8e098a85781387b6c6014a953fa3542456eaacaae4fbed64cd
SSDEEP 96:KM8wKFqmq2sK3qsrWKIcKKsAKVK66QKTywO3aKoErbWKY0KGnuKc82DOhVLZZdgZ:ST/2dXOJhJlpfnpp3tNXVrN3+rv6
TLSH
T1C5B2445571BB421039FE390892B5872E164272B33159E66B7FBD00B68E2BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keys.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2026.10.12.1\keys.json
Size 3KB
SHA256 b0724d5592e6441a840c6622d7ad51caad2564a3746e563ce1f1bbde30944b2b
MD5 a86e3ddeb60db5984686f5bd89a95646
SHA1 e5f417a8f70c34b293ee20bb9f54a423a07982ec
SHA512 f3df95b51940a12ffd2d58648c302fbd649dc3097e0961a86da65e324690488d1b3d80c6267a6a0685f220a89c279ba54cb56fc02f19860e99ffcd6448cf0db5
TLSH
T19971D6BF14A40082CF3BD16A8F0735A78FB23C0623C67AC3965FE94A04425AC276F475
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2026.10.12.1\manifest.json
Size 80B
SHA256 abe933f0db95b1a75786da21de82feb5270ffa7ae072270923da2437710d93ba
MD5 3790d9257ba14f8be2ba08acf259a57f
SHA1 c54ab2e79d0ac9dc27425c7450e01ad593f02d60
SHA512 9568fef732369f06aafd8270638a38531a26f6f40a1c7c65fb7254eed36807789756e1c6efabaec86017b3decead2773de9ef5814650dbb334e6000ebd44a467
TLSH
T1A8A012605811E13310C403700260438243E01C112015240405461140218823713A3129
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Web Notifications Deny List\2.0.0.155\manifest.json
Size 177B
SHA256 77a882c1ca9977c89f8e67a15ec1854a8eb84e1e79bf7009808ae9eaf5193b65
MD5 b9662cf1a01e6a1e875d12cf69862abf
SHA1 8644cbd5900e21cf6422e12dcd8b12c203f32504
SHA512 840e37081ac9b9974a0c9c151d17c04544be2b70810a0a2d5baf30f0decfa927596df9282a8b9728f9588a6da051962b45b3198328c1df05bec31c2a7b9b0858
TLSH
T109C012EFDC509DB115EB4323156D43C4E733CF0B1546450935FB66082E25981C193500
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Well Known Domains\1.2.0.3\manifest.json
Size 141B
SHA256 fe8c5046a79693a9b7f32bfc3ed7c8fdf84c5d186f5326a527ac508345a44009
MD5 3a5a48cc06d7f5cf2ec6e467e34915dd
SHA1 b6c3679e8961f0af7b5a56704992d5561ebaf6c1
SHA512 ae2de2b1827831eaeae6c9d00d081aa7be570fb050368eabc6b549469b14d7409b55e3726d4ac8ceb6cf75e48b3a88604345cb56a53f0686dd84cf8cb262125a
TLSH
T130C04C5585005D71509D87781D6C97054B12CF5618946509DDC68309EC1DCCB64B234F
MD5 SHA1 SHA512 TLSH

Submit Download

6f28a867-7fe3-4659-9848-04c971dbdd18.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\6f28a867-7fe3-4659-9848-04c971dbdd18.tmp
Size 2KB
SHA256 718948e2480d298ffacee7928714283b879d477ca07a8dd58010c43b7f51de32
MD5 f2629f44f904309122414d0f98ea7374
SHA1 926e49bacae9a7de25aa236c163f7a14b0de4fcf
SHA512 7d55567e9a575a81bc02bab8d542929ea244382353016ceed8a7363ac0c22cb62777a7471c5598ec484ce6ff4a35fbdd26e043ee1ed10b0edcd765d1cf4eca61
TLSH
T19F511EE05C385AD1D1BD0E7EB49B35EC90EC8721B4A4387E3868ED984A7A61D708483F
MD5 SHA1 SHA512 TLSH

Submit Download

9eb491b7-18b8-4933-9fc1-fc9538f78aaf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\9eb491b7-18b8-4933-9fc1-fc9538f78aaf.tmp
Size 2KB
SHA256 20ba2e358e3c132c870e955be160aedd3194ca6317733c11995a9f47ede2c337
MD5 e6a1ca020e86e9319bae7d943801f621
SHA1 fe3f1029547c52fa937cd3bf95cefc0a909106b8
SHA512 9191717e2ff8f3f2d622ede4bec97a5a0eee2f6b11acb0dd2c17a264c1df600d67d5f9bdf4f86a5a6a6440ae1c0ad5afa776c88684245afcd2050b2acb9e4c51
TLSH
T156411BE058386AD1D0BD0E6EB49B35EC90EC8621B490387E7858ED988A7A61D7084C3F
MD5 SHA1 SHA512 TLSH

Submit Download

fb016b8a-4698-46fd-a469-c93c967d2664.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\fb016b8a-4698-46fd-a469-c93c967d2664.tmp
Size 2KB
SHA256 afa940dba154165541dd17593783cab9180a37a5e4c182148e436878a2f11f81
MD5 95f790db9c93f0a31845538cd81fb105
SHA1 7db175430b82ecdf2ad8464e7553fae864cc6342
SHA512 a3aa85c2741ecc86ccadcf9d1e4c9d92751bd1a86d29bc54170601754aec27e4e6e653a6b29a90089c6b492e670eafb4d631c3e4139af7d245522d5feda361d7
TLSH
T1FD510FD05C385AD1D1BD0E7EE49B35FC94DC8621B4A4387E2868ED98897AA1D7044C3F
MD5 SHA1 SHA512 TLSH

Submit Download

d9653236-0877-4c8d-be0e-369f4a9da87b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d9653236-0877-4c8d-be0e-369f4a9da87b.tmp
Size 26KB
SHA256 af12d6088e19057a753f12caa9b3cd99cb74e0e436d1b3808a9648dbe4594df4
MD5 95b0558205370dbb44d1fcec7eba460b
SHA1 2c0bd887f09a8ab08b099f12c64d7c837afb43d6
SHA512 f97b43154808188986bd5edddb9119b0f6e01dc77696f3e7ad192bae33aeb4dffd17517d6af4c367f9c8800a5f3ac88b96cb39f66db3e11af2f475b3fbbcb52a
SSDEEP 384:nDiFiZcI63sN/8TUNTUlIm2aKMdTNKw2f0BCpcM9niJbsa+VYGRgL/7Iz5JoS:uFQ63Wwgc9PBCFiJbhgPJ1
TLSH
T16FC24932EC98D9ABECFB4FD9E74A7603DEE40253849C99C4DAD91D1D00976AD1307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 cae650a206a4a0abd6cbfb891af3bddc199cdfa04c9bb14726381d5f075a4a27
MD5 e02d140a200df8ecee0a845fd43f2706
SHA1 267fbccbbd473df34d4b64e9038b22091284f30a
SHA512 abc0bfde4259b8ffded8ced677b1b2900461086f66447b8d9897ea6bfb9f322376ef7b8abd7624efa2843bbc6687649a37bccf69f7197def34fa3a57e844a47f
TLSH
T1FA412A5CB6EE1108B3B76E169BF7A96D447BB9772F0AD45D10010E4E0B73A40C9A1B37
MD5 SHA1 SHA512 TLSH

Submit Download

XENO_CACHE.bin

Path C:\Users\Admin\AppData\Local\Xeno\XENO_CACHE.bin
Size 36B
SHA256 3bab55816f9c1c63b26bee8027a74983736938cfa748d9c91230391d4bacfb88
MD5 03b4e88d732421deccbdd05cb90b0513
SHA1 1ba9d3bd3af60ecc041e93251633b5a0fbac4d9b
SHA512 40e01403608fc8d8c0bc7bc6e1367a472778dea5d4dde4d242b37b0860d098075ac71cf24abd85c6b9ee67bf6adf80adaaf279a969f4477555807003276a2c75
MD5 SHA1 SHA512

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

Xeno.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Xeno.lnk
Size 2KB
SHA256 0c296ef43cb0172dd46f01a154a86ffef3b328910fc95c4bb69b633049ec595f
MD5 8299878192daffb643545d83d371323a
SHA1 a5cbe8b3b54a13dd5ee1ac1211ef9ad47767f8b3
SHA512 74818488e6df550687d3366a00852895a235786ee418d4d4d075f8b72b5d7f77796b8a5340962c927b0f173eb260e07219d74765785f11c61a0bc8097523452b
TLSH
T14D412026E5E11B11E361D53AA9F722469B76BC19F7192F4C0101C3C90D72F829E84F2F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\Xeno\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 2c9e4fcdd06e8110b25f7c62db9bffe2971b09ba983744c36859593cdcaaaac7
MD5 5ef6a745f5999fd60ea7cc1362a33d47
SHA1 a3ca6208c2d12ef6b7cac800d0ea8405ea232f18
SHA512 b44494e3face86d829bf045bf22e3da1a5a002add58f39eb47d221dacac9eaa36eee6a1cf6e9bcc01e9a5f8b91fb14a328fb0a3112dcdd1a9deec8acb941aef8
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\Xeno\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\Xeno\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\Xeno\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\Xeno\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\Xeno\Local Storage\leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

5451f450-6619-43e1-9b56-9564ca6e26bd.tmp

Path C:\Users\Admin\AppData\Roaming\Xeno\Network\5451f450-6619-43e1-9b56-9564ca6e26bd.tmp
Size 494B
SHA256 51c1e0681de04c746b73fe5d00d2a0fb3920d3dfa1a9956a58beb9f03f13c7b7
MD5 4939c64189c843795c3fd9abc715ccea
SHA1 7ad6e88426a92d30b9b3ba208e8abdb02075a31c
SHA512 5284431bad71902a824de5b21195ad5ace7ef254c5cbda338eafd44b5e1c6c4dd0f0973fa6371c1d28e1023dd118c1675e12c2d74d23bdc30c838a9ecc8e9e92
TLSH
T104F09EA7C3E4597E474553F42B253D23C1BD1889521D3D02D5D8EB0E57B14B5550044F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\Xeno\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1884-1050-0x0000021BEED50000-0x0000021BEFD50000-memory.dmp

Download

memory/2532-84-0x00007FF85CCA0000-0x00007FF85CCA1000-memory.dmp

Download

memory/5344-13-0x00007FF85D700000-0x00007FF85D701000-memory.dmp

Download

memory/5344-12-0x00007FF85E6F0000-0x00007FF85E6F1000-memory.dmp

Download

memory/6708-1320-0x00000267EDB50000-0x00000267EDB51000-memory.dmp

Download

memory/6708-1321-0x00000267EDB50000-0x00000267EDB51000-memory.dmp

Download

memory/6708-1313-0x00000267EDB50000-0x00000267EDB51000-memory.dmp

Download

memory/6708-1319-0x00000267EDB50000-0x00000267EDB51000-memory.dmp

Download

memory/6708-1317-0x00000267EDB50000-0x00000267EDB51000-memory.dmp

Download

memory/6708-1318-0x00000267EDB50000-0x00000267EDB51000-memory.dmp

Download

memory/6708-1322-0x00000267EDB50000-0x00000267EDB51000-memory.dmp

Download

memory/6708-1323-0x00000267EDB50000-0x00000267EDB51000-memory.dmp

Download

memory/6708-1312-0x00000267EDB50000-0x00000267EDB51000-memory.dmp

Download

memory/6708-1311-0x00000267EDB50000-0x00000267EDB51000-memory.dmp

Download