Analysis
- user interaction
yes - max time kernel
149s - max time network
153s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
19/04/2026, 01:18
General
- Target Xeno-v1.3.30.exe
- Size 88.4MB
- Sample260419-bpcvdsa14l
- SHA256 55dc3d80eefa1a276c12f81605e3ce10147aa1ef44e6d45bb864fb2bc8e1a2bb
Score
10/10
Malware Config
Signatures
- Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
- Detect SalatStealer payload 17 IoCs
- Executes dropped EXE 64 IoCs
- UPX packed file 26 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e584dcd.exe"C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e584dcd.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e585acd.exe"C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e585acd.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e5868b8.exe"C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e5868b8.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e5875d7.exe"C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e5875d7.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e58842f.exe"C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e58842f.exe"7⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"6⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e58911f.exe"C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e58911f.exe"8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"7⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e589fb6.exe"C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e589fb6.exe"9⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"8⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e58b1c7.exe"C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e58b1c7.exe"10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"9⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"10⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"10⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e58c658.exe"C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e58c658.exe"12⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"11⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e58d368.exe"C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e58d368.exe"13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"12⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e58e172.exe"C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e58e172.exe"14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"13⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e58eff9.exe"C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e58eff9.exe"15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"14⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e58fdf3.exe"C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e58fdf3.exe"16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"15⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e5909ca.exe"C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e5909ca.exe"17⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"16⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e59165d.exe"C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e59165d.exe"18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"17⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e592428.exe"C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e592428.exe"19⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"18⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e593195.exe"C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e593195.exe"20⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"19⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e593e96.exe"C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e593e96.exe"21⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"20⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e594b57.exe"C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e594b57.exe"22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"21⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e5957cb.exe"C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e5957cb.exe"23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"22⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e596509.exe"C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e596509.exe"24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"23⤵
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e59716d.exe"C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e59716d.exe"25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"24⤵
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e597e00.exe"C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e597e00.exe"26⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"25⤵
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e598a64.exe"C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e598a64.exe"27⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"26⤵
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e599699.exe"C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e599699.exe"28⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"27⤵
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"28⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e59a34b.exe"C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e59a34b.exe"29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"28⤵
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e59af03.exe"C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e59af03.exe"30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"29⤵
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"30⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e59bba5.exe"C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e59bba5.exe"31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"30⤵
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e59c809.exe"C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e59c809.exe"32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"31⤵
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e59d48c.exe"C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e59d48c.exe"33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"32⤵
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"33⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e59e12f.exe"C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e59e12f.exe"34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"33⤵
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e59ed73.exe"C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e59ed73.exe"35⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"34⤵
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"35⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e59f9a8.exe"C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e59f9a8.exe"36⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"35⤵
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"36⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e5a066a.exe"C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e5a066a.exe"37⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"36⤵
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"37⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e5a12ce.exe"C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e5a12ce.exe"38⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"37⤵
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"38⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e5a1f51.exe"C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e5a1f51.exe"39⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"38⤵
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"39⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e5a2c22.exe"C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e5a2c22.exe"40⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"39⤵
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"40⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e5a3847.exe"C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e5a3847.exe"41⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"40⤵
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"41⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e5a4519.exe"C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e5a4519.exe"42⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"41⤵
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"42⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e5a51bb.exe"C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e5a51bb.exe"43⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"42⤵
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"43⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e5a5dc1.exe"C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e5a5dc1.exe"44⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"43⤵
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"44⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e5a6a25.exe"C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e5a6a25.exe"45⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"44⤵
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"45⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e5a766a.exe"C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e5a766a.exe"46⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"45⤵
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"46⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"46⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Xeno-v1.3.30.exe.log
Xeno-v1.3.3.exe
0e584dcd.exe
memory/232-149-0x000000003F330000-0x000000003F8D8000-memory.dmp
memory/232-150-0x0000000000E50000-0x0000000000ECB000-memory.dmp
memory/572-137-0x00000000005D0000-0x000000000115E000-memory.dmp
memory/572-138-0x0000000022200000-0x000000002227B000-memory.dmp
memory/756-164-0x00000000060A0000-0x00000000060AC000-memory.dmp
memory/916-73-0x00000000008C0000-0x000000000144E000-memory.dmp
memory/916-74-0x0000000021F00000-0x0000000021F7B000-memory.dmp
memory/916-72-0x00000000008C0000-0x000000000144E000-memory.dmp
memory/1316-75-0x000000003F330000-0x000000003F8D8000-memory.dmp
memory/1316-76-0x0000000001110000-0x000000000118B000-memory.dmp
memory/1472-15-0x00000000087B0000-0x00000000087BC000-memory.dmp
memory/1472-1-0x00000000087D0000-0x00000000087E0000-memory.dmp
memory/1472-0-0x0000000000D80000-0x00000000065EC000-memory.dmp
memory/1732-118-0x0000000001260000-0x00000000012DB000-memory.dmp
memory/1732-117-0x000000003F330000-0x000000003F8D8000-memory.dmp
memory/2312-24-0x0000000006D60000-0x0000000006D6C000-memory.dmp
memory/2472-44-0x0000000000300000-0x0000000000E8E000-memory.dmp
memory/2472-48-0x0000000000300000-0x0000000000E8E000-memory.dmp
memory/2472-47-0x0000000021F00000-0x0000000021F7B000-memory.dmp
memory/2724-140-0x0000000000F10000-0x0000000000F8B000-memory.dmp
memory/2724-139-0x000000003F330000-0x000000003F8D8000-memory.dmp
memory/2808-159-0x00000000009F0000-0x000000000157E000-memory.dmp
memory/2808-160-0x0000000022600000-0x000000002267B000-memory.dmp
memory/3012-111-0x0000000022940000-0x00000000229BB000-memory.dmp
memory/3012-112-0x0000000000D60000-0x00000000018EE000-memory.dmp
memory/3012-109-0x0000000000D60000-0x00000000018EE000-memory.dmp
memory/3152-142-0x00000000067A0000-0x00000000067AC000-memory.dmp
memory/3300-67-0x00000000085E0000-0x00000000085EC000-memory.dmp
memory/3744-87-0x000000003F330000-0x000000003F8D8000-memory.dmp
memory/3744-88-0x0000000000FC0000-0x000000000103B000-memory.dmp
memory/3804-78-0x0000000006C70000-0x0000000006C7C000-memory.dmp
memory/3864-115-0x000000003F330000-0x000000003F8D8000-memory.dmp
memory/3864-116-0x0000000001360000-0x00000000013DB000-memory.dmp
memory/3932-63-0x0000000000840000-0x00000000013CE000-memory.dmp
memory/3932-62-0x0000000022440000-0x00000000224BB000-memory.dmp
memory/3932-59-0x0000000000840000-0x00000000013CE000-memory.dmp
memory/3972-128-0x0000000021F00000-0x0000000021F7B000-memory.dmp
memory/3972-127-0x0000000000830000-0x00000000013BE000-memory.dmp
memory/4056-154-0x00000000062D0000-0x00000000062DC000-memory.dmp
memory/4104-51-0x0000000001460000-0x00000000014DB000-memory.dmp
memory/4104-50-0x000000003F330000-0x000000003F8D8000-memory.dmp
memory/4136-169-0x0000000000FA0000-0x0000000001B2E000-memory.dmp
memory/4136-170-0x0000000022500000-0x000000002257B000-memory.dmp
memory/4148-35-0x0000000001B50000-0x0000000001BCB000-memory.dmp
memory/4148-36-0x0000000000370000-0x0000000000EFE000-memory.dmp
memory/4148-32-0x0000000000370000-0x0000000000EFE000-memory.dmp
memory/4156-162-0x0000000001510000-0x000000000158B000-memory.dmp
memory/4156-161-0x000000003F330000-0x000000003F8D8000-memory.dmp
memory/4276-152-0x0000000000A10000-0x000000000159E000-memory.dmp
memory/4276-121-0x0000000000A10000-0x000000000159E000-memory.dmp
memory/4276-22-0x0000000000A10000-0x000000000159E000-memory.dmp
memory/4276-49-0x0000000000A10000-0x000000000159E000-memory.dmp
memory/4276-91-0x0000000000A10000-0x000000000159E000-memory.dmp
memory/4276-53-0x0000000000A10000-0x000000000159E000-memory.dmp
memory/4276-54-0x0000000022740000-0x00000000227BB000-memory.dmp
memory/4456-33-0x0000000006760000-0x000000000676C000-memory.dmp
memory/4488-120-0x0000000006AB0000-0x0000000006ABC000-memory.dmp
memory/4660-129-0x000000003F330000-0x000000003F8D8000-memory.dmp
memory/4660-130-0x0000000000CA0000-0x0000000000D1B000-memory.dmp
memory/4692-45-0x0000000006FA0000-0x0000000006FAC000-memory.dmp
memory/4980-90-0x00000000065A0000-0x00000000065AC000-memory.dmp
memory/5000-148-0x0000000021D80000-0x0000000021DFB000-memory.dmp
memory/5000-147-0x0000000000A30000-0x00000000015BE000-memory.dmp
memory/5068-38-0x00000000019E0000-0x0000000001A5B000-memory.dmp
memory/5068-37-0x000000003F330000-0x000000003F8D8000-memory.dmp
memory/5084-25-0x000000003F330000-0x000000003F8D8000-memory.dmp
memory/5084-26-0x0000000000EC0000-0x0000000000F3B000-memory.dmp
memory/5216-132-0x00000000068B0000-0x00000000068BC000-memory.dmp
memory/5308-114-0x0000000006B20000-0x0000000006B2C000-memory.dmp
memory/5516-83-0x0000000000EE0000-0x0000000001A6E000-memory.dmp
memory/5516-85-0x0000000022100000-0x000000002217B000-memory.dmp
memory/5516-86-0x0000000000EE0000-0x0000000001A6E000-memory.dmp
memory/5644-100-0x0000000000290000-0x0000000000E1E000-memory.dmp
memory/5644-99-0x0000000001B60000-0x0000000001BDB000-memory.dmp
memory/5644-97-0x0000000000290000-0x0000000000E1E000-memory.dmp
memory/5728-104-0x0000000007B30000-0x0000000007B3C000-memory.dmp
memory/5824-101-0x000000003F330000-0x000000003F8D8000-memory.dmp
memory/5824-102-0x0000000001060000-0x00000000010DB000-memory.dmp
memory/5940-60-0x0000000007D50000-0x0000000007D5C000-memory.dmp
memory/6108-65-0x0000000001250000-0x00000000012CB000-memory.dmp
memory/6108-64-0x000000003F330000-0x000000003F8D8000-memory.dmp