Analysis
- user interaction
yes - max time kernel
25s - max time network
160s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
06/07/2026, 08:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Xeno-v1.3.55.exe
Resource
win10v2004-20260513-en
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
Xeno-v1.3.55.exe
Resource
win11ltsc2024-20260629-en
7 signatures
150 seconds
General
- Target Xeno-v1.3.55.exe
- Size 88.3MB
- Sample260706-j4earsbz7x
- SHA256 1d1cfdd1c23178e90796c614c210276a97fee0377ffda6a3ceb8cc9a1a37e39a
- MD5 77880d4a355e9af7ebd2ffe8aeb47d2b
- SHA1 441baec778370304a8239fa15712196e3bcc3a61
- SHA512 1b3a217e999158e3f18c57b43cf9a82f16fa599556b17d81af9b4fa263a682270c3b85e1e357fea7f4920ccef4c12d556e362ca32552cf30dbc8aa06921dfe61
- SSDEEP 1572864:mGgiSZ1Ycv1ymX6JfCihLPzSidEI1TLQYCUn1eBLTnDK7voT4+dLjLYURjK95lK:mGgiSZ1WmIhLPWibVQY9n1cm7hyLdRjt
- TLSH T140183335E08D1478F89BF0B5AE916F2BC770BA14193E3BDA1741FA52ABBF6608D50710
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
- Detect SalatStealer payload 64 IoCs
resource yara_rule behavioral2/memory/4884-13-0x0000000000B10000-0x0000000001766000-memory.dmp family_salatstealer behavioral2/memory/2892-17-0x0000000000B10000-0x0000000001766000-memory.dmp family_salatstealer behavioral2/memory/6068-23-0x0000000000B10000-0x0000000001766000-memory.dmp family_salatstealer behavioral2/memory/5708-22-0x0000000000B10000-0x0000000001766000-memory.dmp family_salatstealer behavioral2/memory/1168-27-0x0000000000B10000-0x0000000001766000-memory.dmp family_salatstealer behavioral2/memory/3452-29-0x0000000000B10000-0x0000000001766000-memory.dmp family_salatstealer behavioral2/memory/3496-32-0x0000000000B10000-0x0000000001766000-memory.dmp family_salatstealer behavioral2/memory/3068-35-0x0000000000B10000-0x0000000001766000-memory.dmp family_salatstealer behavioral2/memory/1568-34-0x0000000000B10000-0x0000000001766000-memory.dmp family_salatstealer behavioral2/memory/3384-37-0x0000000000B10000-0x0000000001766000-memory.dmp family_salatstealer behavioral2/memory/4256-39-0x0000000000B10000-0x0000000001766000-memory.dmp family_salatstealer behavioral2/memory/5680-41-0x0000000000B10000-0x0000000001766000-memory.dmp family_salatstealer behavioral2/memory/6088-43-0x0000000000B10000-0x0000000001766000-memory.dmp family_salatstealer behavioral2/memory/3760-45-0x0000000000B10000-0x0000000001766000-memory.dmp family_salatstealer behavioral2/memory/5368-47-0x0000000000B10000-0x0000000001766000-memory.dmp family_salatstealer behavioral2/memory/3576-49-0x0000000000B10000-0x0000000001766000-memory.dmp family_salatstealer behavioral2/memory/5928-51-0x0000000000B10000-0x0000000001766000-memory.dmp family_salatstealer behavioral2/memory/3936-53-0x0000000000B10000-0x0000000001766000-memory.dmp family_salatstealer behavioral2/memory/4924-55-0x0000000000B10000-0x0000000001766000-memory.dmp family_salatstealer behavioral2/memory/5956-57-0x0000000000B10000-0x0000000001766000-memory.dmp family_salatstealer behavioral2/memory/592-59-0x0000000000B10000-0x0000000001766000-memory.dmp family_salatstealer behavioral2/memory/2392-61-0x0000000000B10000-0x0000000001766000-memory.dmp family_salatstealer behavioral2/memory/5980-63-0x0000000000B10000-0x0000000001766000-memory.dmp family_salatstealer behavioral2/memory/5248-65-0x0000000000B10000-0x0000000001766000-memory.dmp family_salatstealer behavioral2/memory/2904-67-0x0000000000B10000-0x0000000001766000-memory.dmp family_salatstealer behavioral2/memory/5136-69-0x0000000000B10000-0x0000000001766000-memory.dmp family_salatstealer behavioral2/memory/2580-71-0x0000000000B10000-0x0000000001766000-memory.dmp family_salatstealer behavioral2/memory/2892-73-0x0000000000B10000-0x0000000001766000-memory.dmp family_salatstealer behavioral2/memory/120-75-0x0000000000B10000-0x0000000001766000-memory.dmp family_salatstealer behavioral2/memory/3796-77-0x0000000000B10000-0x0000000001766000-memory.dmp family_salatstealer behavioral2/memory/3248-81-0x0000000000B10000-0x0000000001766000-memory.dmp family_salatstealer behavioral2/memory/5400-83-0x0000000000B10000-0x0000000001766000-memory.dmp family_salatstealer behavioral2/memory/1988-85-0x0000000000B10000-0x0000000001766000-memory.dmp family_salatstealer behavioral2/memory/1828-89-0x0000000000B10000-0x0000000001766000-memory.dmp family_salatstealer behavioral2/memory/5320-93-0x0000000000B10000-0x0000000001766000-memory.dmp family_salatstealer behavioral2/memory/2196-97-0x0000000000B10000-0x0000000001766000-memory.dmp family_salatstealer behavioral2/memory/704-101-0x0000000000B10000-0x0000000001766000-memory.dmp family_salatstealer behavioral2/memory/4960-113-0x0000000000B10000-0x0000000001766000-memory.dmp family_salatstealer behavioral2/memory/3080-119-0x0000000000B10000-0x0000000001766000-memory.dmp family_salatstealer behavioral2/memory/1220-121-0x0000000000B10000-0x0000000001766000-memory.dmp family_salatstealer behavioral2/memory/5416-123-0x0000000000B10000-0x0000000001766000-memory.dmp family_salatstealer behavioral2/memory/1880-125-0x0000000000B10000-0x0000000001766000-memory.dmp family_salatstealer behavioral2/memory/1764-127-0x0000000000B10000-0x0000000001766000-memory.dmp family_salatstealer behavioral2/memory/5352-129-0x0000000000B10000-0x0000000001766000-memory.dmp family_salatstealer behavioral2/memory/6072-131-0x0000000000B10000-0x0000000001766000-memory.dmp family_salatstealer behavioral2/memory/2560-133-0x0000000000B10000-0x0000000001766000-memory.dmp family_salatstealer behavioral2/memory/3276-135-0x0000000000B10000-0x0000000001766000-memory.dmp family_salatstealer behavioral2/memory/5928-139-0x0000000000B10000-0x0000000001766000-memory.dmp family_salatstealer behavioral2/memory/4924-144-0x0000000000B10000-0x0000000001766000-memory.dmp family_salatstealer behavioral2/memory/6012-145-0x0000000000B10000-0x0000000001766000-memory.dmp family_salatstealer behavioral2/memory/2556-146-0x0000000000B10000-0x0000000001766000-memory.dmp family_salatstealer behavioral2/memory/3076-147-0x0000000000B10000-0x0000000001766000-memory.dmp family_salatstealer behavioral2/memory/828-148-0x0000000000B10000-0x0000000001766000-memory.dmp family_salatstealer behavioral2/memory/1380-149-0x0000000000B10000-0x0000000001766000-memory.dmp family_salatstealer behavioral2/memory/3768-150-0x0000000000B10000-0x0000000001766000-memory.dmp family_salatstealer behavioral2/memory/1660-151-0x0000000000B10000-0x0000000001766000-memory.dmp family_salatstealer behavioral2/memory/3096-152-0x0000000000B10000-0x0000000001766000-memory.dmp family_salatstealer behavioral2/memory/704-143-0x0000000000B10000-0x0000000001766000-memory.dmp family_salatstealer behavioral2/memory/5068-141-0x0000000000B10000-0x0000000001766000-memory.dmp family_salatstealer behavioral2/memory/2248-137-0x0000000000B10000-0x0000000001766000-memory.dmp family_salatstealer behavioral2/memory/476-117-0x0000000000B10000-0x0000000001766000-memory.dmp family_salatstealer behavioral2/memory/4884-115-0x0000000000B10000-0x0000000001766000-memory.dmp family_salatstealer behavioral2/memory/5240-111-0x0000000000B10000-0x0000000001766000-memory.dmp family_salatstealer behavioral2/memory/3528-109-0x0000000000B10000-0x0000000001766000-memory.dmp family_salatstealer - Executes dropped EXE 27 IoCs
pid Process 3068 xeno.exe 4884 xeno.exe 2892 xeno.exe 5708 xeno.exe 6068 xeno.exe 1168 xeno.exe 3452 xeno.exe 1568 xeno.exe 3496 xeno.exe 3384 xeno.exe 4256 xeno.exe 5680 xeno.exe 6088 xeno.exe 3760 xeno.exe 5368 xeno.exe 3576 xeno.exe 5928 xeno.exe 3936 xeno.exe 4924 xeno.exe 5956 xeno.exe 592 xeno.exe 2392 xeno.exe 5980 xeno.exe 5248 xeno.exe 2904 xeno.exe 5136 xeno.exe 2580 xeno.exe -
resource yara_rule behavioral2/files/0x000e00000001c51a-4.dat upx behavioral2/memory/3068-9-0x0000000000B10000-0x0000000001766000-memory.dmp upx behavioral2/memory/4884-11-0x0000000000B10000-0x0000000001766000-memory.dmp upx behavioral2/memory/4884-13-0x0000000000B10000-0x0000000001766000-memory.dmp upx behavioral2/memory/2892-15-0x0000000000B10000-0x0000000001766000-memory.dmp upx behavioral2/memory/2892-17-0x0000000000B10000-0x0000000001766000-memory.dmp upx behavioral2/memory/6068-23-0x0000000000B10000-0x0000000001766000-memory.dmp upx behavioral2/memory/5708-22-0x0000000000B10000-0x0000000001766000-memory.dmp upx behavioral2/memory/1168-27-0x0000000000B10000-0x0000000001766000-memory.dmp upx behavioral2/memory/3452-29-0x0000000000B10000-0x0000000001766000-memory.dmp upx behavioral2/memory/3496-32-0x0000000000B10000-0x0000000001766000-memory.dmp upx behavioral2/memory/3068-35-0x0000000000B10000-0x0000000001766000-memory.dmp upx behavioral2/memory/1568-34-0x0000000000B10000-0x0000000001766000-memory.dmp upx behavioral2/memory/3384-37-0x0000000000B10000-0x0000000001766000-memory.dmp upx behavioral2/memory/4256-39-0x0000000000B10000-0x0000000001766000-memory.dmp upx behavioral2/memory/5680-41-0x0000000000B10000-0x0000000001766000-memory.dmp upx behavioral2/memory/6088-43-0x0000000000B10000-0x0000000001766000-memory.dmp upx behavioral2/memory/3760-45-0x0000000000B10000-0x0000000001766000-memory.dmp upx behavioral2/memory/5368-47-0x0000000000B10000-0x0000000001766000-memory.dmp upx behavioral2/memory/3576-49-0x0000000000B10000-0x0000000001766000-memory.dmp upx behavioral2/memory/5928-51-0x0000000000B10000-0x0000000001766000-memory.dmp upx behavioral2/memory/3936-53-0x0000000000B10000-0x0000000001766000-memory.dmp upx behavioral2/memory/4924-55-0x0000000000B10000-0x0000000001766000-memory.dmp upx behavioral2/memory/5956-57-0x0000000000B10000-0x0000000001766000-memory.dmp upx behavioral2/memory/592-59-0x0000000000B10000-0x0000000001766000-memory.dmp upx behavioral2/memory/2392-61-0x0000000000B10000-0x0000000001766000-memory.dmp upx behavioral2/memory/5980-63-0x0000000000B10000-0x0000000001766000-memory.dmp upx behavioral2/memory/5248-65-0x0000000000B10000-0x0000000001766000-memory.dmp upx behavioral2/memory/2904-67-0x0000000000B10000-0x0000000001766000-memory.dmp upx behavioral2/memory/5136-69-0x0000000000B10000-0x0000000001766000-memory.dmp upx behavioral2/memory/2580-71-0x0000000000B10000-0x0000000001766000-memory.dmp upx behavioral2/memory/2892-73-0x0000000000B10000-0x0000000001766000-memory.dmp upx behavioral2/memory/120-75-0x0000000000B10000-0x0000000001766000-memory.dmp upx behavioral2/memory/3796-77-0x0000000000B10000-0x0000000001766000-memory.dmp upx behavioral2/memory/3248-81-0x0000000000B10000-0x0000000001766000-memory.dmp upx behavioral2/memory/5400-83-0x0000000000B10000-0x0000000001766000-memory.dmp upx behavioral2/memory/1988-85-0x0000000000B10000-0x0000000001766000-memory.dmp upx behavioral2/memory/1828-89-0x0000000000B10000-0x0000000001766000-memory.dmp upx behavioral2/memory/5320-93-0x0000000000B10000-0x0000000001766000-memory.dmp upx behavioral2/memory/2196-97-0x0000000000B10000-0x0000000001766000-memory.dmp upx behavioral2/memory/704-101-0x0000000000B10000-0x0000000001766000-memory.dmp upx behavioral2/memory/4960-113-0x0000000000B10000-0x0000000001766000-memory.dmp upx behavioral2/memory/3080-119-0x0000000000B10000-0x0000000001766000-memory.dmp upx behavioral2/memory/1220-121-0x0000000000B10000-0x0000000001766000-memory.dmp upx behavioral2/memory/5416-123-0x0000000000B10000-0x0000000001766000-memory.dmp upx behavioral2/memory/1880-125-0x0000000000B10000-0x0000000001766000-memory.dmp upx behavioral2/memory/1764-127-0x0000000000B10000-0x0000000001766000-memory.dmp upx behavioral2/memory/5352-129-0x0000000000B10000-0x0000000001766000-memory.dmp upx behavioral2/memory/6072-131-0x0000000000B10000-0x0000000001766000-memory.dmp upx behavioral2/memory/2560-133-0x0000000000B10000-0x0000000001766000-memory.dmp upx behavioral2/memory/3276-135-0x0000000000B10000-0x0000000001766000-memory.dmp upx behavioral2/memory/5928-139-0x0000000000B10000-0x0000000001766000-memory.dmp upx behavioral2/memory/4924-144-0x0000000000B10000-0x0000000001766000-memory.dmp upx behavioral2/memory/6012-145-0x0000000000B10000-0x0000000001766000-memory.dmp upx behavioral2/memory/2556-146-0x0000000000B10000-0x0000000001766000-memory.dmp upx behavioral2/memory/3076-147-0x0000000000B10000-0x0000000001766000-memory.dmp upx behavioral2/memory/828-148-0x0000000000B10000-0x0000000001766000-memory.dmp upx behavioral2/memory/1380-149-0x0000000000B10000-0x0000000001766000-memory.dmp upx behavioral2/memory/3768-150-0x0000000000B10000-0x0000000001766000-memory.dmp upx behavioral2/memory/1660-151-0x0000000000B10000-0x0000000001766000-memory.dmp upx behavioral2/memory/3096-152-0x0000000000B10000-0x0000000001766000-memory.dmp upx behavioral2/memory/704-143-0x0000000000B10000-0x0000000001766000-memory.dmp upx behavioral2/memory/5068-141-0x0000000000B10000-0x0000000001766000-memory.dmp upx behavioral2/memory/2248-137-0x0000000000B10000-0x0000000001766000-memory.dmp upx - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 26 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xeno.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xeno.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xeno.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xeno.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xeno.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xeno.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xeno.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xeno.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xeno.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xeno.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xeno.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xeno.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xeno.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xeno.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xeno.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xeno.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xeno.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xeno.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xeno.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xeno.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xeno.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xeno.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xeno.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xeno.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xeno.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xeno.exe - Suspicious use of WriteProcessMemory 54 IoCs
description pid Process procid_target PID 2980 wrote to memory of 3068 2980 Xeno-v1.3.55.exe 88 PID 2980 wrote to memory of 1936 2980 Xeno-v1.3.55.exe 89 PID 1936 wrote to memory of 4884 1936 Xeno-v1.3.55.exe 184 PID 1936 wrote to memory of 3524 1936 Xeno-v1.3.55.exe 91 PID 3524 wrote to memory of 2892 3524 Xeno-v1.3.55.exe 142 PID 3524 wrote to memory of 4220 3524 Xeno-v1.3.55.exe 93 PID 4220 wrote to memory of 5708 4220 Xeno-v1.3.55.exe 94 PID 4220 wrote to memory of 5824 4220 Xeno-v1.3.55.exe 95 PID 5824 wrote to memory of 6068 5824 Xeno-v1.3.55.exe 96 PID 5824 wrote to memory of 300 5824 Xeno-v1.3.55.exe 97 PID 300 wrote to memory of 1168 300 Xeno-v1.3.55.exe 98 PID 300 wrote to memory of 576 300 Xeno-v1.3.55.exe 99 PID 576 wrote to memory of 3452 576 Xeno-v1.3.55.exe 195 PID 576 wrote to memory of 420 576 Xeno-v1.3.55.exe 101 PID 420 wrote to memory of 1568 420 Xeno-v1.3.55.exe 102 PID 420 wrote to memory of 4296 420 Xeno-v1.3.55.exe 103 PID 4296 wrote to memory of 3496 4296 Xeno-v1.3.55.exe 104 PID 4296 wrote to memory of 1092 4296 Xeno-v1.3.55.exe 105 PID 1092 wrote to memory of 3384 1092 Xeno-v1.3.55.exe 106 PID 1092 wrote to memory of 3008 1092 Xeno-v1.3.55.exe 107 PID 3008 wrote to memory of 4256 3008 Xeno-v1.3.55.exe 108 PID 3008 wrote to memory of 6112 3008 Xeno-v1.3.55.exe 109 PID 6112 wrote to memory of 5680 6112 Xeno-v1.3.55.exe 110 PID 6112 wrote to memory of 4396 6112 Xeno-v1.3.55.exe 111 PID 4396 wrote to memory of 6088 4396 Xeno-v1.3.55.exe 352 PID 4396 wrote to memory of 2376 4396 Xeno-v1.3.55.exe 113 PID 2376 wrote to memory of 3760 2376 Xeno-v1.3.55.exe 114 PID 2376 wrote to memory of 3972 2376 Xeno-v1.3.55.exe 115 PID 3972 wrote to memory of 5368 3972 Xeno-v1.3.55.exe 116 PID 3972 wrote to memory of 2096 3972 Xeno-v1.3.55.exe 117 PID 2096 wrote to memory of 3576 2096 Xeno-v1.3.55.exe 501 PID 2096 wrote to memory of 760 2096 Xeno-v1.3.55.exe 119 PID 760 wrote to memory of 5928 760 Xeno-v1.3.55.exe 482 PID 760 wrote to memory of 4092 760 Xeno-v1.3.55.exe 121 PID 4092 wrote to memory of 3936 4092 Xeno-v1.3.55.exe 122 PID 4092 wrote to memory of 1720 4092 Xeno-v1.3.55.exe 123 PID 1720 wrote to memory of 4924 1720 Xeno-v1.3.55.exe 254 PID 1720 wrote to memory of 4732 1720 Xeno-v1.3.55.exe 125 PID 4732 wrote to memory of 5956 4732 Xeno-v1.3.55.exe 406 PID 4732 wrote to memory of 2992 4732 Xeno-v1.3.55.exe 127 PID 2992 wrote to memory of 592 2992 Xeno-v1.3.55.exe 128 PID 2992 wrote to memory of 1588 2992 Xeno-v1.3.55.exe 129 PID 1588 wrote to memory of 2392 1588 Xeno-v1.3.55.exe 260 PID 1588 wrote to memory of 3632 1588 Xeno-v1.3.55.exe 131 PID 3632 wrote to memory of 5980 3632 Xeno-v1.3.55.exe 132 PID 3632 wrote to memory of 2128 3632 Xeno-v1.3.55.exe 133 PID 2128 wrote to memory of 5248 2128 Xeno-v1.3.55.exe 365 PID 2128 wrote to memory of 1084 2128 Xeno-v1.3.55.exe 135 PID 1084 wrote to memory of 2904 1084 Xeno-v1.3.55.exe 136 PID 1084 wrote to memory of 4156 1084 Xeno-v1.3.55.exe 137 PID 4156 wrote to memory of 5136 4156 Xeno-v1.3.55.exe 138 PID 4156 wrote to memory of 4172 4156 Xeno-v1.3.55.exe 139 PID 4172 wrote to memory of 2580 4172 Xeno-v1.3.55.exe 140 PID 4172 wrote to memory of 1200 4172 Xeno-v1.3.55.exe 141
Processes
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3068 -
C:\Users\Admin\AppData\Local\PeerDistRepub\SearchHost.exeC:\Users\Admin\AppData\Local\PeerDistRepub\SearchHost.exe3⤵PID:4368
-
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4884
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:3524 -
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2892
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"4⤵
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5708
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"5⤵
- Suspicious use of WriteProcessMemory
PID:5824 -
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6068
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"6⤵
- Suspicious use of WriteProcessMemory
PID:300 -
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1168
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"7⤵
- Suspicious use of WriteProcessMemory
PID:576 -
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3452
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"8⤵
- Suspicious use of WriteProcessMemory
PID:420 -
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1568
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"9⤵
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3496
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"10⤵
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3384
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"11⤵
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4256
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"12⤵
- Suspicious use of WriteProcessMemory
PID:6112 -
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5680
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"13⤵
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6088
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"14⤵
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3760
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"15⤵
- Suspicious use of WriteProcessMemory
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5368
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"16⤵
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3576
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"17⤵
- Suspicious use of WriteProcessMemory
PID:760 -
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5928
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"18⤵
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3936
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"19⤵
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4924
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"20⤵
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5956
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"21⤵
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:592
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"22⤵
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2392
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"23⤵
- Suspicious use of WriteProcessMemory
PID:3632 -
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5980
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"24⤵
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5248
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"25⤵
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2904
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"26⤵
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5136
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"27⤵
- Suspicious use of WriteProcessMemory
PID:4172 -
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"28⤵
- Executes dropped EXE
PID:2580
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"28⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"29⤵PID:2892
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"29⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"30⤵PID:120
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"30⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"31⤵PID:3796
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"31⤵PID:5324
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"32⤵PID:3516
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"32⤵PID:776
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"33⤵PID:3248
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"33⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"34⤵PID:5400
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"34⤵PID:3536
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"35⤵PID:1988
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"35⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"36⤵PID:5152
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"36⤵PID:5284
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"37⤵PID:1828
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"37⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"38⤵PID:2024
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"38⤵PID:3440
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"39⤵PID:5320
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"39⤵PID:5924
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"40⤵PID:5976
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"40⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"41⤵PID:2196
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"41⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"42⤵PID:1576
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"42⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"43⤵PID:704
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"43⤵PID:3296
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"44⤵PID:5580
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"44⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"45⤵PID:2588
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"45⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"46⤵PID:5420
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"46⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"47⤵PID:3528
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"47⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"48⤵PID:5240
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"48⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"49⤵PID:4960
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"49⤵PID:3900
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"50⤵PID:4884
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"50⤵PID:5652
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"51⤵PID:476
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"51⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"52⤵PID:3080
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"52⤵PID:256
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"53⤵PID:1220
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"53⤵PID:248
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"54⤵PID:5416
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"54⤵PID:872
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"55⤵PID:1880
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"55⤵PID:3452
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"56⤵PID:1764
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"56⤵PID:5472
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"57⤵PID:5352
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"57⤵PID:5208
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"58⤵PID:6072
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"58⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"59⤵PID:2560
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"59⤵PID:4416
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"60⤵PID:3276
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"60⤵PID:5984
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"61⤵PID:2248
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"61⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"62⤵PID:5928
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"62⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"63⤵PID:5068
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"63⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"64⤵PID:704
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"64⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"65⤵PID:4924
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"65⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"66⤵PID:6012
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"66⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"67⤵PID:2556
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"67⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"68⤵PID:3076
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"68⤵PID:5876
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"69⤵PID:828
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"69⤵PID:5524
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"70⤵PID:1380
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"70⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"71⤵PID:3768
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"71⤵PID:1152
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"72⤵PID:1660
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"72⤵PID:1344
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"73⤵PID:3096
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"73⤵PID:1360
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"74⤵PID:1860
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"74⤵PID:5684
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"75⤵PID:1292
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"75⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"76⤵PID:2860
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"76⤵PID:4240
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"77⤵PID:2404
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"77⤵PID:5232
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"78⤵PID:1940
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"78⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"79⤵PID:2676
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"79⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"80⤵PID:2692
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"80⤵PID:5392
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"81⤵PID:6020
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"81⤵PID:3600
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"82⤵PID:2628
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"82⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"83⤵PID:1576
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"83⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"84⤵PID:2664
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"84⤵PID:6040
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"85⤵PID:4924
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"85⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"86⤵PID:6012
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"86⤵PID:4084
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"87⤵PID:4236
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"87⤵PID:5420
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"88⤵PID:2392
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"88⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"89⤵PID:5288
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"89⤵PID:3336
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"90⤵PID:3024
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"90⤵PID:5060
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"91⤵PID:3848
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"91⤵PID:5272
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"92⤵PID:6120
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"92⤵PID:3080
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"93⤵PID:3116
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"93⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"94⤵PID:5052
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"94⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"95⤵PID:5156
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"95⤵PID:2340
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"96⤵PID:3292
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"96⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"97⤵PID:4720
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"97⤵PID:6056
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"98⤵PID:1676
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"98⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"99⤵PID:4976
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"99⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"100⤵PID:1644
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"100⤵PID:4828
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"101⤵PID:1968
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"101⤵PID:3984
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"102⤵PID:3576
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"102⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"103⤵PID:3052
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"103⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"104⤵PID:1864
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"104⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"105⤵PID:5428
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"105⤵PID:6124
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"106⤵PID:824
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"106⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"107⤵PID:3160
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"107⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"108⤵PID:5552
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"108⤵PID:384
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"109⤵PID:5956
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"109⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"110⤵PID:3568
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"110⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"111⤵PID:696
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"111⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"112⤵PID:5996
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"112⤵PID:1000
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"113⤵PID:2996
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"113⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"114⤵PID:824
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"114⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"115⤵PID:5072
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"115⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"116⤵PID:4708
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"116⤵PID:276
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"117⤵PID:1264
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"117⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"118⤵PID:6020
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"118⤵PID:6100
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"119⤵PID:5428
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"119⤵PID:3580
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"120⤵PID:5372
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"120⤵PID:5976
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"121⤵PID:5140
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"121⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"122⤵PID:5020
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-