Analysis
- user interaction
yes - max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
26/04/2026, 11:15
General
- Target Xeno-v1.3.30.exe
- Size 84.0MB
- Sample260426-ncppmsfv4t
- SHA256 9350bb4f75399e95819e0225c93a4a3720d86349ccf0e5e37afaa22041345b99
Score
8/10
Malware Config
Signatures
- Downloads MZ/PE file 1 IoCs
- Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 11 IoCs
- Loads dropped DLL 30 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Drops file in Program Files directory 14 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 5 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 2 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 24 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 52 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3BowJzYWnq4atYoGlpgllfnOauG\Xeno-v1.3.30.exeC:\Users\Admin\AppData\Local\Temp\3BowJzYWnq4atYoGlpgllfnOauG\Xeno-v1.3.30.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3BowJzYWnq4atYoGlpgllfnOauG\Xeno-v1.3.30.exe"C:\Users\Admin\AppData\Local\Temp\3BowJzYWnq4atYoGlpgllfnOauG\Xeno-v1.3.30.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Xeno" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1720 --field-trial-handle=1732,i,14136057244209493731,6624032144038038281,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:23⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\3BowJzYWnq4atYoGlpgllfnOauG\Xeno-v1.3.30.exe"C:\Users\Admin\AppData\Local\Temp\3BowJzYWnq4atYoGlpgllfnOauG\Xeno-v1.3.30.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Xeno" --mojo-platform-channel-handle=2384 --field-trial-handle=1732,i,14136057244209493731,6624032144038038281,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:83⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\3BowJzYWnq4atYoGlpgllfnOauG\Xeno-v1.3.30.exe"C:\Users\Admin\AppData\Local\Temp\3BowJzYWnq4atYoGlpgllfnOauG\Xeno-v1.3.30.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Xeno" --app-user-model-id=Xeno --app-path="C:\Users\Admin\AppData\Local\Temp\3BowJzYWnq4atYoGlpgllfnOauG\resources\app.asar" --enable-sandbox --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2528 --field-trial-handle=1732,i,14136057244209493731,6624032144038038281,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:13⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\3BowJzYWnq4atYoGlpgllfnOauG\Xeno-v1.3.30.exe"C:\Users\Admin\AppData\Local\Temp\3BowJzYWnq4atYoGlpgllfnOauG\Xeno-v1.3.30.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Xeno" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1756 --field-trial-handle=1732,i,14136057244209493731,6624032144038038281,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:23⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/xe-no3⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c0,0x2c4,0x2c8,0x2bc,0x2d0,0x7fffe815c188,0x7fffe815c194,0x7fffe815c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1760,i,3439799650472791066,13928836787011649829,524288 --field-trial-handle=2584,i,17922227891349052230,10543174573348523529,262144 --variations-seed-version --mojo-platform-channel-handle=2612 /prefetch:34⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,17900770574896173305,7997696165196154486,262144 --field-trial-handle=2584,i,17922227891349052230,10543174573348523529,262144 --variations-seed-version --mojo-platform-channel-handle=2580 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2248,i,16421902762137179393,10508840920327518474,524288 --field-trial-handle=2584,i,17922227891349052230,10543174573348523529,262144 --variations-seed-version --mojo-platform-channel-handle=2620 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3364,i,16346892452266150194,12163667819360037457,2097152 --field-trial-handle=2584,i,17922227891349052230,10543174573348523529,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3368,i,5712229413403899234,4191408206816095765,2097152 --field-trial-handle=2584,i,17922227891349052230,10543174573348523529,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4060,i,15156670974844139153,13266788478931597899,2097152 --field-trial-handle=2584,i,17922227891349052230,10543174573348523529,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4068,i,5312851922936667012,14001517134455630661,2097152 --field-trial-handle=2584,i,17922227891349052230,10543174573348523529,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5032,i,12087528591731477214,17992923110595413329,524288 --field-trial-handle=2584,i,17922227891349052230,10543174573348523529,262144 --variations-seed-version --mojo-platform-channel-handle=4840 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5124,i,2699039097964895053,1927140141140997970,2097152 --field-trial-handle=2584,i,17922227891349052230,10543174573348523529,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5668,i,7380602587362028339,16573911889600121599,524288 --field-trial-handle=2584,i,17922227891349052230,10543174573348523529,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5668,i,7380602587362028339,16573911889600121599,524288 --field-trial-handle=2584,i,17922227891349052230,10543174573348523529,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5184,i,3818100177193931526,6344355088789178918,524288 --field-trial-handle=2584,i,17922227891349052230,10543174573348523529,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5260,i,8351219306264441142,17065651853908589274,524288 --field-trial-handle=2584,i,17922227891349052230,10543174573348523529,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5264,i,15312825088787401447,17833304010673892323,524288 --field-trial-handle=2584,i,17922227891349052230,10543174573348523529,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5468,i,12495476722969103267,11102670920740162678,524288 --field-trial-handle=2584,i,17922227891349052230,10543174573348523529,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5472,i,18085940245003518327,14034974493220672791,524288 --field-trial-handle=2584,i,17922227891349052230,10543174573348523529,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:84⤵
- Modifies registry class
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3432,i,18312558067498158749,15321657429931754393,524288 --field-trial-handle=2584,i,17922227891349052230,10543174573348523529,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6200,i,4501649082433346104,16957673078975246384,524288 --field-trial-handle=2584,i,17922227891349052230,10543174573348523529,262144 --variations-seed-version --mojo-platform-channel-handle=6660 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6688,i,8644734009780517454,2495679201400170555,524288 --field-trial-handle=2584,i,17922227891349052230,10543174573348523529,262144 --variations-seed-version --mojo-platform-channel-handle=6692 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4936,i,8296095756443193623,4902445726713197158,524288 --field-trial-handle=2584,i,17922227891349052230,10543174573348523529,262144 --variations-seed-version --mojo-platform-channel-handle=6612 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6868,i,14450874311330346445,7110999412555058162,524288 --field-trial-handle=2584,i,17922227891349052230,10543174573348523529,262144 --variations-seed-version --mojo-platform-channel-handle=6864 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4064,i,153389544951673494,8225778215036194505,524288 --field-trial-handle=2584,i,17922227891349052230,10543174573348523529,262144 --variations-seed-version --mojo-platform-channel-handle=4544 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=6756,i,2919533083941538785,1313297475678416995,2097152 --field-trial-handle=2584,i,17922227891349052230,10543174573348523529,262144 --variations-seed-version --mojo-platform-channel-handle=7012 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=4648,i,3482608146026290572,13197210855289229987,2097152 --field-trial-handle=2584,i,17922227891349052230,10543174573348523529,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=6692,i,15805692516651732210,10277797359263848023,2097152 --field-trial-handle=2584,i,17922227891349052230,10543174573348523529,262144 --variations-seed-version --mojo-platform-channel-handle=6968 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=6708,i,16177054084529410699,8609442535116070609,2097152 --field-trial-handle=2584,i,17922227891349052230,10543174573348523529,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6660,i,10848215928297876609,4570057859865546278,524288 --field-trial-handle=2584,i,17922227891349052230,10543174573348523529,262144 --variations-seed-version --mojo-platform-channel-handle=6724 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3432,i,9737964697069167700,6992108729361468259,524288 --field-trial-handle=2584,i,17922227891349052230,10543174573348523529,262144 --variations-seed-version --mojo-platform-channel-handle=6836 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6696,i,11915649461047717399,12979868442256519298,524288 --field-trial-handle=2584,i,17922227891349052230,10543174573348523529,262144 --variations-seed-version --mojo-platform-channel-handle=6792 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=6828,i,7299170133829808377,8239600896024256515,2097152 --field-trial-handle=2584,i,17922227891349052230,10543174573348523529,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=7176,i,9893739430209158497,15093051261531172516,2097152 --field-trial-handle=2584,i,17922227891349052230,10543174573348523529,262144 --variations-seed-version --mojo-platform-channel-handle=7188 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7288,i,5881254774832447646,14021305266612915902,524288 --field-trial-handle=2584,i,17922227891349052230,10543174573348523529,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7400,i,2259600959146341171,17001882473051937205,524288 --field-trial-handle=2584,i,17922227891349052230,10543174573348523529,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=4600,i,5234537042535211736,8540107533649921540,2097152 --field-trial-handle=2584,i,17922227891349052230,10543174573348523529,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=4204,i,2934621571489273511,10657359579308443160,2097152 --field-trial-handle=2584,i,17922227891349052230,10543174573348523529,262144 --variations-seed-version --mojo-platform-channel-handle=4660 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=860,i,3426853920500891377,6982103742262000620,2097152 --field-trial-handle=2584,i,17922227891349052230,10543174573348523529,262144 --variations-seed-version --mojo-platform-channel-handle=6732 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=4180,i,13498727694033249027,10469107132654436664,2097152 --field-trial-handle=2584,i,17922227891349052230,10543174573348523529,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=5888,i,16108427876093300335,2006516596237857653,2097152 --field-trial-handle=2584,i,17922227891349052230,10543174573348523529,262144 --variations-seed-version --mojo-platform-channel-handle=6908 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5636,i,4701110429754275321,11871889770354407720,524288 --field-trial-handle=2584,i,17922227891349052230,10543174573348523529,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=7432,i,1432898066325958374,7161151559765305013,2097152 --field-trial-handle=2584,i,17922227891349052230,10543174573348523529,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=7516,i,6478391150898670507,5700647571866750533,2097152 --field-trial-handle=2584,i,17922227891349052230,10543174573348523529,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=7644,i,4613939443964517396,13063941041519229400,2097152 --field-trial-handle=2584,i,17922227891349052230,10543174573348523529,262144 --variations-seed-version --mojo-platform-channel-handle=7664 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=8124,i,7343762355689900002,5538853998995376044,2097152 --field-trial-handle=2584,i,17922227891349052230,10543174573348523529,262144 --variations-seed-version --mojo-platform-channel-handle=8040 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=8136,i,18007755068305321158,3232347906140751202,2097152 --field-trial-handle=2584,i,17922227891349052230,10543174573348523529,262144 --variations-seed-version --mojo-platform-channel-handle=8024 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=8200,i,1851942219331567814,7889505081587218739,2097152 --field-trial-handle=2584,i,17922227891349052230,10543174573348523529,262144 --variations-seed-version --mojo-platform-channel-handle=8208 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7724,i,11305107184583450719,11669048733714735353,524288 --field-trial-handle=2584,i,17922227891349052230,10543174573348523529,262144 --variations-seed-version --mojo-platform-channel-handle=7952 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=8044,i,2649712831911872578,16739173594273303012,2097152 --field-trial-handle=2584,i,17922227891349052230,10543174573348523529,262144 --variations-seed-version --mojo-platform-channel-handle=7988 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8376,i,5238571040032182143,17274221100702308595,524288 --field-trial-handle=2584,i,17922227891349052230,10543174573348523529,262144 --variations-seed-version --mojo-platform-channel-handle=7856 /prefetch:84⤵
-
-
C:\Users\Admin\Downloads\cpu-z_2.19-en.exe"C:\Users\Admin\Downloads\cpu-z_2.19-en.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\is-LDB8I.tmp\cpu-z_2.19-en.tmp"C:\Users\Admin\AppData\Local\Temp\is-LDB8I.tmp\cpu-z_2.19-en.tmp" /SL5="$C0260,3920132,776192,C:\Users\Admin\Downloads\cpu-z_2.19-en.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\is-H37GF.tmp\_isetup\_setup64.tmphelper 105 0x4DC6⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\CPUID\CPU-Z\cpuz_readme.txt6⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6368,i,16403228825220861369,3160992067677379913,524288 --field-trial-handle=2584,i,17922227891349052230,10543174573348523529,262144 --variations-seed-version --mojo-platform-channel-handle=7440 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=8488,i,3339370731654335160,7440149099838072232,262144 --field-trial-handle=2584,i,17922227891349052230,10543174573348523529,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:84⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Users\Admin\AppData\Local\Temp\3BowJzYWnq4atYoGlpgllfnOauG\Xeno-v1.3.30.exe"C:\Users\Admin\AppData\Local\Temp\3BowJzYWnq4atYoGlpgllfnOauG\Xeno-v1.3.30.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --user-data-dir="C:\Users\Admin\AppData\Roaming\Xeno" --mojo-platform-channel-handle=3752 --field-trial-handle=1732,i,14136057244209493731,6624032144038038281,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:83⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\3BowJzYWnq4atYoGlpgllfnOauG\Xeno-v1.3.30.exe"C:\Users\Admin\AppData\Local\Temp\3BowJzYWnq4atYoGlpgllfnOauG\Xeno-v1.3.30.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\Xeno" --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1448 --field-trial-handle=1732,i,14136057244209493731,6624032144038038281,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:23⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files\CPUID\CPU-Z\cpuz.exe"C:\Program Files\CPUID\CPU-Z\cpuz.exe"1⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
cpuz.exe
unins000.exe
manifest.json
manifest.json
manifest.json
protocols.json
settings.dat
settings.dat
f_00009d
f_00009f
f_0000a0
f_0000a1
f_0000a2
f_0000a3
f_0000ee
f_0000ef
f_000115
f_00017f
f_000197
the-real-index
the-real-index
the-real-index~RFe59c7da.TMP
SiteList-Enterprise.json
Edge Profile.ico
HubApps
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Sdch Dictionaries
Sdch Dictionaries~RFe595d97.TMP
Preferences
Preferences
Preferences
Preferences
Secure Preferences
the-real-index
the-real-index~RFe5a06a8.TMP
index.txt
index.txt
index.txt
index.txt~RFe58c241.TMP
CURRENT
MANIFEST-000001
sync_diagnostic.log
OperationConfig
OperationConfig~RFe59a232.TMP
Local State
Local State
Local State
Local State
Local State
Local State
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter~RFe595cdc.TMP
nav_config.json
metadata.json
metadata.json
metadata.json
bab8e64d-143d-4894-be00-0af8237aa5a7.tmp
5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
chrome_100_percent.pak
d3dcompiler_47.dll
es.pak
hu.pak
ro.pak
ru.pak
4815e694-204b-4262-b265-31dd66f5ce6d.tmp
f5c329de-248f-4e97-931b-7b7b3729a026.tmp
LICENSE.electron.txt
LICENSES.chromium.html
chrome_200_percent.pak
ffmpeg.dll
icudtl.dat
libEGL.dll
libGLESv2.dll
af.pak
am.pak
ar.pak
bg.pak
bn.pak
ca.pak
cs.pak
da.pak
de.pak
el.pak
en-GB.pak
en-US.pak
es-419.pak
et.pak
fa.pak
fi.pak
fil.pak
fr.pak
gu.pak
he.pak
hi.pak
hr.pak
id.pak
it.pak
ja.pak
kn.pak
ko.pak
lt.pak
lv.pak
ml.pak
mr.pak
ms.pak
nb.pak
nl.pak
pl.pak
pt-BR.pak
pt-PT.pak
sk.pak
sl.pak
sr.pak
sv.pak
sw.pak
ta.pak
te.pak
th.pak
tr.pak
uk.pak
ur.pak
vi.pak
zh-CN.pak
zh-TW.pak
resources.pak
binding.gyp
addon.obj
vcpkg.applocal.log
win_delay_load_hook.obj
xeno.node.recipe
CL.command.1.tlog
CL.read.1.tlog
CL.write.1.tlog
Cl.items.tlog
link.command.1.tlog
link.read.1.tlog
link.secondary.1.tlog
link.write.1.tlog
xeno.lastbuildstate
xeno.iobj
xeno.ipdb
xeno.node
config.gypi
xeno.vcxproj
xeno.vcxproj.filters
package.json
elevate.exe
Failed.png
Xeno.dll
Xeno.ico
api-ms-win-crt-convert-l1-1-0.dll
api-ms-win-crt-environment-l1-1-0.dll
api-ms-win-crt-filesystem-l1-1-0.dll
api-ms-win-crt-heap-l1-1-0.dll
api-ms-win-crt-locale-l1-1-0.dll
api-ms-win-crt-math-l1-1-0.dll
api-ms-win-crt-runtime-l1-1-0.dll
api-ms-win-crt-stdio-l1-1-0.dll
api-ms-win-crt-string-l1-1-0.dll
api-ms-win-crt-utility-l1-1-0.dll
concrt140.dll
index.html
libcrypto-3-x64.dll
libcurl.dll
libssl-3-x64.dll
msvcp140.dll
msvcp140_1.dll
msvcrt.dll
notification.mp3
ucrtbase.dll
vcruntime140.dll
vcruntime140_1.dll
zlib1.dll
snapshot_blob.bin
v8_context_snapshot.bin
vk_swiftshader.dll
vk_swiftshader_icd.json
vulkan-1.dll
StdUtils.dll
System.dll
nsis7z.dll
content_new.js
58cce21f-a1a3-4258-93f3-232385dd6cf1.tmp
XENO_CACHE.bin
default.dic
ccba5a5986c77e43.customDestinations-ms
ccba5a5986c77e43.customDestinations-ms
data_0
data_1
data_2
data_3
Network Persistent State
Network Persistent State~RFe59c3c3.TMP
TransportSecurity
TransportSecurity~RFe592726.TMP
cpu-z_2.19-en.exe.crdownload
memory/1840-3626-0x000002AED6720000-0x000002AED6721000-memory.dmp
memory/1840-3628-0x000002AED6720000-0x000002AED6721000-memory.dmp
memory/1840-3618-0x000002AED6720000-0x000002AED6721000-memory.dmp
memory/1840-3623-0x000002AED6720000-0x000002AED6721000-memory.dmp
memory/1840-3619-0x000002AED6720000-0x000002AED6721000-memory.dmp
memory/1840-3627-0x000002AED6720000-0x000002AED6721000-memory.dmp
memory/1840-3625-0x000002AED6720000-0x000002AED6721000-memory.dmp
memory/1840-3624-0x000002AED6720000-0x000002AED6721000-memory.dmp
memory/1840-3617-0x000002AED6720000-0x000002AED6721000-memory.dmp
memory/3184-1002-0x00007FF804DA0000-0x00007FF804DA1000-memory.dmp
memory/3808-3605-0x0000000005BF0000-0x0000000005C9F000-memory.dmp
memory/4004-3601-0x0000000000CA0000-0x0000000000D83000-memory.dmp
memory/4004-3600-0x0000000000400000-0x0000000000706000-memory.dmp
memory/4088-909-0x00007FF805F60000-0x00007FF805F61000-memory.dmp
memory/4088-908-0x00007FF805640000-0x00007FF805641000-memory.dmp
memory/5464-3602-0x0000000000400000-0x00000000004CB000-memory.dmp
memory/5464-3542-0x0000000000400000-0x00000000004CB000-memory.dmp
memory/5820-2702-0x00000219BB090000-0x00000219BB091000-memory.dmp
memory/5820-2696-0x00000219BB090000-0x00000219BB091000-memory.dmp
memory/5820-2697-0x00000219BB090000-0x00000219BB091000-memory.dmp
memory/5820-2698-0x00000219BB090000-0x00000219BB091000-memory.dmp
memory/5820-2708-0x00000219BB090000-0x00000219BB091000-memory.dmp
memory/5820-2707-0x00000219BB090000-0x00000219BB091000-memory.dmp
memory/5820-2706-0x00000219BB090000-0x00000219BB091000-memory.dmp
memory/5820-2705-0x00000219BB090000-0x00000219BB091000-memory.dmp
memory/5820-2704-0x00000219BB090000-0x00000219BB091000-memory.dmp
memory/5820-2703-0x00000219BB090000-0x00000219BB091000-memory.dmp
memory/6200-3692-0x0000000002480000-0x000000000248C000-memory.dmp