xenorat | 74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
06-05-2024 13:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe
Size

242KB
MD5

9df5ae6de71325d7cd996258ea3b6645
SHA1

294d82183f1b263c02b893a93b4f5da3adb13908
SHA256

74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b
SHA512

27c36babb8a43e3a9fbccfbb56ab580d5e2d4c97bf401189a1c2910afbea9527ab16660dec0489a5c6990b600040cd81df3807e5c3a4e9754bb60fc972a62f69
SSDEEP

6144:JKy7eUxWYV3ZsB1913qgkgtMKe6HypaY+kFNyNI:aU4YVpsBvYgkgGKe6HypaY+kFNy2

Score

10^/10

xenorat rat trojan

Malware Config

Extracted

Family

xenorat

dns.requimacofradian.site

Mutex

Xeno_rat_nd8818g

Attributes

delay
60000
install_path
appdata
port
1243
startup_name
uic

Signatures

XenorRat
XenorRat is a remote access trojan written in C#.
trojan rat xenorat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe

Executes dropped EXE 4 IoCs

pid	Process
2288	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe
3820	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe
3768	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe
4264	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 1416 set thread context of 2324	1416	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe	88
PID 1416 set thread context of 2576	1416	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe	89
PID 1416 set thread context of 3952	1416	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe	90
PID 2288 set thread context of 3820	2288	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe	95
PID 2288 set thread context of 3768	2288	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe	96
PID 2288 set thread context of 4264	2288	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe	97

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3616	2324	WerFault.exe	88

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3984	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2576	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe
2576	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe
2576	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe
2576	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe
2576	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe
2576	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe
2576	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe
2576	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe
2576	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe
2576	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe
2576	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe
2576	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe
2576	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe
2576	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe
2576	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe
2576	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe
2576	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe
2576	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe
2576	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe
2576	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe
2576	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe
2576	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe
2576	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe
2576	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe
2576	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe
2576	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe
2576	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe
2576	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe
2576	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe
2576	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe
2576	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe
2576	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe
2576	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe
2576	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe
2576	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe
2576	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe
2576	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe
2576	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe
2576	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe
2576	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe
2576	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe
2576	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe
2576	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe
2576	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe
2576	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe
2576	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe
2576	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe
2576	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe
2576	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe
2576	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe
2576	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe
2576	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe
2576	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe
2576	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe
2576	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe
2576	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe
2576	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe
2576	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe
2576	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe
2576	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe
2576	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe
2576	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe
2576	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe
2576	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1416	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe
Token: SeDebugPrivilege	2288	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe
Token: SeDebugPrivilege	2576	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2324	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 1416 wrote to memory of 2324	1416	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe	88
PID 1416 wrote to memory of 2324	1416	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe	88
PID 1416 wrote to memory of 2324	1416	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe	88
PID 1416 wrote to memory of 2324	1416	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe	88
PID 1416 wrote to memory of 2324	1416	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe	88
PID 1416 wrote to memory of 2324	1416	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe	88
PID 1416 wrote to memory of 2324	1416	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe	88
PID 1416 wrote to memory of 2324	1416	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe	88
PID 1416 wrote to memory of 2576	1416	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe	89
PID 1416 wrote to memory of 2576	1416	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe	89
PID 1416 wrote to memory of 2576	1416	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe	89
PID 1416 wrote to memory of 2576	1416	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe	89
PID 1416 wrote to memory of 2576	1416	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe	89
PID 1416 wrote to memory of 2576	1416	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe	89
PID 1416 wrote to memory of 2576	1416	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe	89
PID 1416 wrote to memory of 2576	1416	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe	89
PID 1416 wrote to memory of 3952	1416	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe	90
PID 1416 wrote to memory of 3952	1416	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe	90
PID 1416 wrote to memory of 3952	1416	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe	90
PID 1416 wrote to memory of 3952	1416	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe	90
PID 1416 wrote to memory of 3952	1416	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe	90
PID 1416 wrote to memory of 3952	1416	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe	90
PID 1416 wrote to memory of 3952	1416	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe	90
PID 1416 wrote to memory of 3952	1416	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe	90
PID 3952 wrote to memory of 2288	3952	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe	93
PID 3952 wrote to memory of 2288	3952	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe	93
PID 3952 wrote to memory of 2288	3952	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe	93
PID 2288 wrote to memory of 3820	2288	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe	95
PID 2288 wrote to memory of 3820	2288	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe	95
PID 2288 wrote to memory of 3820	2288	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe	95
PID 2288 wrote to memory of 3820	2288	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe	95
PID 2288 wrote to memory of 3820	2288	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe	95
PID 2288 wrote to memory of 3820	2288	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe	95
PID 2288 wrote to memory of 3820	2288	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe	95
PID 2288 wrote to memory of 3820	2288	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe	95
PID 2288 wrote to memory of 3768	2288	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe	96
PID 2288 wrote to memory of 3768	2288	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe	96
PID 2288 wrote to memory of 3768	2288	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe	96
PID 2288 wrote to memory of 3768	2288	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe	96
PID 2288 wrote to memory of 3768	2288	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe	96
PID 2288 wrote to memory of 3768	2288	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe	96
PID 2288 wrote to memory of 3768	2288	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe	96
PID 2288 wrote to memory of 3768	2288	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe	96
PID 2288 wrote to memory of 4264	2288	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe	97
PID 2288 wrote to memory of 4264	2288	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe	97
PID 2288 wrote to memory of 4264	2288	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe	97
PID 2288 wrote to memory of 4264	2288	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe	97
PID 2288 wrote to memory of 4264	2288	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe	97
PID 2288 wrote to memory of 4264	2288	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe	97
PID 2288 wrote to memory of 4264	2288	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe	97
PID 2288 wrote to memory of 4264	2288	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe	97
PID 2576 wrote to memory of 3984	2576	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe	113
PID 2576 wrote to memory of 3984	2576	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe	113
PID 2576 wrote to memory of 3984	2576	74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe	113

C:\Users\Admin\AppData\Local\Temp\74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe
"C:\Users\Admin\AppData\Local\Temp\74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1416
- C:\Users\Admin\AppData\Local\Temp\74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe
  C:\Users\Admin\AppData\Local\Temp\74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe
  2⤵
  - Suspicious use of UnmapMainImage
  PID:2324
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2324 -s 12
    3⤵
    - Program crash
    PID:3616
- C:\Users\Admin\AppData\Local\Temp\74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe
  C:\Users\Admin\AppData\Local\Temp\74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2576
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks.exe" /Create /TN "uic" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1C3D.tmp" /F
    3⤵
    - Creates scheduled task(s)
    PID:3984
- C:\Users\Admin\AppData\Local\Temp\74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe
  C:\Users\Admin\AppData\Local\Temp\74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:3952
- - C:\Users\Admin\AppData\Roaming\XenoManager\74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe
    "C:\Users\Admin\AppData\Roaming\XenoManager\74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2288
  - - C:\Users\Admin\AppData\Roaming\XenoManager\74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe
      C:\Users\Admin\AppData\Roaming\XenoManager\74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe
      4⤵
      Executes dropped EXE
      PID:3820
  - - C:\Users\Admin\AppData\Roaming\XenoManager\74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe
      C:\Users\Admin\AppData\Roaming\XenoManager\74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe
      4⤵
      Executes dropped EXE
      PID:3768
  - - C:\Users\Admin\AppData\Roaming\XenoManager\74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe
      C:\Users\Admin\AppData\Roaming\XenoManager\74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe
      4⤵
      Executes dropped EXE
      PID:4264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2324 -ip 2324
1⤵
PID:3168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe.log

Filesize
706B

MD5
d95c58e609838928f0f49837cab7dfd2

SHA1
55e7139a1e3899195b92ed8771d1ca2c7d53c916

SHA256
0407c814aef0d62aec7fd39b7c2f614746f0d8ff41f8ef957736f520f14b0339

SHA512
405310b29a833604c6627063bfdcf055a197e01f633ef21da238f1a6415a02e21315d689b4a6669db23e82152bed6f3492afb60963e6b2a0e9bb2ac09a480b5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp1C3D.tmp

Filesize
1KB

MD5
674a6923e4d1f31025222b257ea1a232

SHA1
edd6ceb220ddf1168e6c95186794cf6c5bfb3c56

SHA256
804ff306b72cb9087df130d0edd3e0c44485f0d1a8ae76be85623c42e5e37313

SHA512
b021ae08721e4a747c3d87665180b02a6ae876f49db8e9e613e3864fc382b40bca9684f0d5bebc8b7d26a2a6f04caed87b02b395ae6bf1ac2ae5cc20599f3577

Download Submit
C:\Users\Admin\AppData\Roaming\XenoManager\74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b.exe

Filesize
242KB

MD5
9df5ae6de71325d7cd996258ea3b6645

SHA1
294d82183f1b263c02b893a93b4f5da3adb13908

SHA256
74584aaf23f595a032038d90aefa403c5d0533da00130b885e42e76ae0cb975b

SHA512
27c36babb8a43e3a9fbccfbb56ab580d5e2d4c97bf401189a1c2910afbea9527ab16660dec0489a5c6990b600040cd81df3807e5c3a4e9754bb60fc972a62f69

Download Submit
memory/1416-8-0x00000000050D0000-0x00000000050D6000-memory.dmp

Filesize
24KB

Download
memory/1416-4-0x0000000005000000-0x0000000005040000-memory.dmp

Filesize
256KB

Download
memory/1416-5-0x00000000053B0000-0x000000000544C000-memory.dmp

Filesize
624KB

Download
memory/1416-6-0x0000000005A00000-0x0000000005FA4000-memory.dmp

Filesize
5.6MB

Download
memory/1416-7-0x0000000005450000-0x00000000054E2000-memory.dmp

Filesize
584KB

Download
memory/1416-0-0x000000007456E000-0x000000007456F000-memory.dmp

Filesize
4KB

Download
memory/1416-3-0x0000000074560000-0x0000000074D10000-memory.dmp

Filesize
7.7MB

Download
memory/1416-17-0x0000000074560000-0x0000000074D10000-memory.dmp

Filesize
7.7MB

Download
memory/1416-2-0x0000000004FF0000-0x0000000004FF6000-memory.dmp

Filesize
24KB

Download
memory/1416-1-0x0000000000680000-0x00000000006C6000-memory.dmp

Filesize
280KB

Download
memory/2288-29-0x0000000074560000-0x0000000074D10000-memory.dmp

Filesize
7.7MB

Download
memory/2288-37-0x0000000074560000-0x0000000074D10000-memory.dmp

Filesize
7.7MB

Download
memory/2324-9-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2576-14-0x0000000074560000-0x0000000074D10000-memory.dmp

Filesize
7.7MB

Download
memory/2576-38-0x0000000074560000-0x0000000074D10000-memory.dmp

Filesize
7.7MB

Download
memory/2576-16-0x0000000074560000-0x0000000074D10000-memory.dmp

Filesize
7.7MB

Download
memory/2576-41-0x0000000005F50000-0x0000000005FB6000-memory.dmp

Filesize
408KB

Download
memory/3952-30-0x0000000074560000-0x0000000074D10000-memory.dmp

Filesize
7.7MB

Download
memory/3952-15-0x0000000074560000-0x0000000074D10000-memory.dmp

Filesize
7.7MB

Download