Analysis
-
max time kernel
445s -
max time network
965s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
-
submitted
27-11-2024 19:26
General
-
Target
https://github.com/mategol/PySilon-malware/releases/tag/v3.7.5
Score
10/10
Malware Config
Extracted
Family
xenorat
C2
1683.3.3
158.346.1231
1683.3.3.3
127.0.0.1
Mutex
\asdawads
Attributes
-
delay
5000
-
install_path
temp
-
port
114234
-
startup_name
nolice
Signatures
-
Detect XenoRat Payload 8 IoCs
-
XenorRat
XenorRat is a remote access trojan written in C#.
-
Xenorat family
-
Executes dropped EXE 64 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs
-
Browser Information Discovery 1 TTPs
Enumerate browser information.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies registry class 48 IoCs
-
NTFS ADS 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 16 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 44 IoCs
-
Suspicious use of SendNotifyMessage 12 IoCs
-
Suspicious use of SetWindowsHookEx 13 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/mategol/PySilon-malware/releases/tag/v3.7.51⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff8fd713cb8,0x7ff8fd713cc8,0x7ff8fd713cd82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1904,8223567201305811035,11314531253229270995,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1924 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1904,8223567201305811035,11314531253229270995,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1904,8223567201305811035,11314531253229270995,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2560 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,8223567201305811035,11314531253229270995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,8223567201305811035,11314531253229270995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,8223567201305811035,11314531253229270995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4528 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,8223567201305811035,11314531253229270995,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,8223567201305811035,11314531253229270995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,8223567201305811035,11314531253229270995,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1904,8223567201305811035,11314531253229270995,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5440 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1904,8223567201305811035,11314531253229270995,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5296 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,8223567201305811035,11314531253229270995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4884 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1904,8223567201305811035,11314531253229270995,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4968 /prefetch:82⤵
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,8223567201305811035,11314531253229270995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,8223567201305811035,11314531253229270995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,8223567201305811035,11314531253229270995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5920 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,8223567201305811035,11314531253229270995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6004 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,8223567201305811035,11314531253229270995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5816 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,8223567201305811035,11314531253229270995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6604 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,8223567201305811035,11314531253229270995,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6628 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,8223567201305811035,11314531253229270995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,8223567201305811035,11314531253229270995,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6892 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,8223567201305811035,11314531253229270995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6492 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1904,8223567201305811035,11314531253229270995,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6456 /prefetch:82⤵
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1904,8223567201305811035,11314531253229270995,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=6540 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\PySilon-malware-3.7.5\PySilon-malware-3.7.5\PySilon.bat" "1⤵
-
C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exepython -m venv pysilon2⤵
-
-
C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exepython -m pip install --upgrade pip2⤵
-
-
C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exepython builder.py2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\PySilon-malware-3.7.5\PySilon-malware-3.7.5\PySilon.bat" "1⤵
-
C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exepython -m venv pysilon2⤵
-
-
C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exepython -m pip install --upgrade pip2⤵
-
-
C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exepython builder.py2⤵
-
-
C:\Users\Admin\Downloads\Release\xeno rat server.exe"C:\Users\Admin\Downloads\Release\xeno rat server.exe"1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Desktop\asds.exe"C:\Users\Admin\Desktop\asds.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"9⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"10⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"11⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"12⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"13⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"14⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"15⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"16⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"17⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"18⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"19⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"20⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"21⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"22⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"23⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"24⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"25⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"26⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"27⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"28⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"29⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"30⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"31⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"32⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"33⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"34⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"35⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"36⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"37⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"38⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"39⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"40⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"41⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"42⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"43⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"44⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"45⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"46⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"47⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"48⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"49⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"50⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"51⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"53⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"54⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"55⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"56⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"57⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"58⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"59⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"60⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"61⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"62⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"63⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"64⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"65⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"66⤵
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"67⤵
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"68⤵
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"69⤵
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"70⤵
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"71⤵
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"72⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"73⤵
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"74⤵
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"75⤵
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"76⤵
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"77⤵
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"78⤵
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"79⤵
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"80⤵
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"81⤵
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"82⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"83⤵
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"84⤵
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"85⤵
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"86⤵
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"87⤵
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"88⤵
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"89⤵
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"90⤵
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"91⤵
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"92⤵
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"93⤵
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"94⤵
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"95⤵
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"96⤵
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"97⤵
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"98⤵
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"99⤵
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"100⤵
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"101⤵
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"102⤵
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"103⤵
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"104⤵
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"105⤵
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"106⤵
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"107⤵
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"108⤵
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"109⤵
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"110⤵
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"111⤵
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"112⤵
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"113⤵
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"114⤵
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"115⤵
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"116⤵
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"117⤵
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"118⤵
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"119⤵
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"120⤵
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\asds.exe"121⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-