Analysis
- max time kernel
30s - max time network
915s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/07/2026, 04:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Xeno-v1.3.55.exe
Resource
win10v2004-20260513-en
0 signatures
900 seconds
Behavioral task
behavioral2
Sample
Xeno-v1.3.55.exe
Resource
win11ltsc2024-20260706-en
8 signatures
900 seconds
General
- Target Xeno-v1.3.55.exe
- Size 88.3MB
- Sample260708-epf4labs3p
- SHA256 1d1cfdd1c23178e90796c614c210276a97fee0377ffda6a3ceb8cc9a1a37e39a
- MD5 77880d4a355e9af7ebd2ffe8aeb47d2b
- SHA1 441baec778370304a8239fa15712196e3bcc3a61
- SHA512 1b3a217e999158e3f18c57b43cf9a82f16fa599556b17d81af9b4fa263a682270c3b85e1e357fea7f4920ccef4c12d556e362ca32552cf30dbc8aa06921dfe61
- SSDEEP 1572864:mGgiSZ1Ycv1ymX6JfCihLPzSidEI1TLQYCUn1eBLTnDK7voT4+dLjLYURjK95lK:mGgiSZ1WmIhLPWibVQY9n1cm7hyLdRjt
- TLSH T140183335E08D1478F89BF0B5AE916F2BC770BA14193E3BDA1741FA52ABBF6608D50710
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
- Detect SalatStealer payload 64 IoCs
resource yara_rule behavioral2/memory/4716-14-0x0000000000BD0000-0x0000000001826000-memory.dmp family_salatstealer behavioral2/memory/2916-16-0x0000000000BD0000-0x0000000001826000-memory.dmp family_salatstealer behavioral2/memory/2068-20-0x0000000000BD0000-0x0000000001826000-memory.dmp family_salatstealer behavioral2/memory/5732-22-0x0000000000BD0000-0x0000000001826000-memory.dmp family_salatstealer behavioral2/memory/2772-25-0x0000000000BD0000-0x0000000001826000-memory.dmp family_salatstealer behavioral2/memory/2344-27-0x0000000000BD0000-0x0000000001826000-memory.dmp family_salatstealer behavioral2/memory/4068-29-0x0000000000BD0000-0x0000000001826000-memory.dmp family_salatstealer behavioral2/memory/1472-33-0x0000000000BD0000-0x0000000001826000-memory.dmp family_salatstealer behavioral2/memory/4068-34-0x0000000000BD0000-0x0000000001826000-memory.dmp family_salatstealer behavioral2/memory/2176-36-0x0000000000BD0000-0x0000000001826000-memory.dmp family_salatstealer behavioral2/memory/1404-35-0x0000000000BD0000-0x0000000001826000-memory.dmp family_salatstealer behavioral2/memory/4952-38-0x0000000000BD0000-0x0000000001826000-memory.dmp family_salatstealer behavioral2/memory/4068-39-0x0000000000BD0000-0x0000000001826000-memory.dmp family_salatstealer behavioral2/memory/5496-42-0x0000000000BD0000-0x0000000001826000-memory.dmp family_salatstealer behavioral2/memory/4588-44-0x0000000000BD0000-0x0000000001826000-memory.dmp family_salatstealer behavioral2/memory/2636-46-0x0000000000BD0000-0x0000000001826000-memory.dmp family_salatstealer behavioral2/memory/3652-48-0x0000000000BD0000-0x0000000001826000-memory.dmp family_salatstealer behavioral2/memory/4884-49-0x0000000000BD0000-0x0000000001826000-memory.dmp family_salatstealer behavioral2/memory/4068-51-0x0000000000BD0000-0x0000000001826000-memory.dmp family_salatstealer behavioral2/memory/1204-52-0x0000000000BD0000-0x0000000001826000-memory.dmp family_salatstealer behavioral2/memory/4068-53-0x0000000000BD0000-0x0000000001826000-memory.dmp family_salatstealer behavioral2/memory/1096-57-0x0000000000BD0000-0x0000000001826000-memory.dmp family_salatstealer behavioral2/memory/3412-58-0x0000000000BD0000-0x0000000001826000-memory.dmp family_salatstealer behavioral2/memory/4588-245-0x0000000000BD0000-0x0000000001826000-memory.dmp family_salatstealer behavioral2/memory/4532-246-0x0000000000BD0000-0x0000000001826000-memory.dmp family_salatstealer behavioral2/memory/4068-248-0x0000000000BD0000-0x0000000001826000-memory.dmp family_salatstealer behavioral2/memory/6000-250-0x0000000000BD0000-0x0000000001826000-memory.dmp family_salatstealer behavioral2/memory/3552-251-0x0000000000BD0000-0x0000000001826000-memory.dmp family_salatstealer behavioral2/memory/636-261-0x0000000000BD0000-0x0000000001826000-memory.dmp family_salatstealer behavioral2/memory/4068-262-0x0000000000BD0000-0x0000000001826000-memory.dmp family_salatstealer behavioral2/memory/4540-263-0x0000000000BD0000-0x0000000001826000-memory.dmp family_salatstealer behavioral2/memory/5692-265-0x0000000000BD0000-0x0000000001826000-memory.dmp family_salatstealer behavioral2/memory/4872-268-0x0000000000BD0000-0x0000000001826000-memory.dmp family_salatstealer behavioral2/memory/4732-270-0x0000000000BD0000-0x0000000001826000-memory.dmp family_salatstealer behavioral2/memory/1828-271-0x0000000000BD0000-0x0000000001826000-memory.dmp family_salatstealer behavioral2/memory/2636-274-0x0000000000BD0000-0x0000000001826000-memory.dmp family_salatstealer behavioral2/memory/2832-277-0x0000000000BD0000-0x0000000001826000-memory.dmp family_salatstealer behavioral2/memory/5316-280-0x0000000000BD0000-0x0000000001826000-memory.dmp family_salatstealer behavioral2/memory/4068-282-0x0000000000BD0000-0x0000000001826000-memory.dmp family_salatstealer behavioral2/memory/4372-281-0x0000000000BD0000-0x0000000001826000-memory.dmp family_salatstealer behavioral2/memory/1680-284-0x0000000000BD0000-0x0000000001826000-memory.dmp family_salatstealer behavioral2/memory/4068-290-0x0000000000BD0000-0x0000000001826000-memory.dmp family_salatstealer behavioral2/memory/4308-292-0x0000000000260000-0x0000000000EB6000-memory.dmp family_salatstealer behavioral2/memory/3284-293-0x0000000000BD0000-0x0000000001826000-memory.dmp family_salatstealer behavioral2/memory/6000-298-0x0000000000BD0000-0x0000000001826000-memory.dmp family_salatstealer behavioral2/memory/1684-300-0x0000000000BD0000-0x0000000001826000-memory.dmp family_salatstealer behavioral2/memory/5940-301-0x0000000000BD0000-0x0000000001826000-memory.dmp family_salatstealer behavioral2/memory/3436-305-0x0000000000BD0000-0x0000000001826000-memory.dmp family_salatstealer behavioral2/memory/4232-307-0x0000000000BD0000-0x0000000001826000-memory.dmp family_salatstealer behavioral2/memory/3512-309-0x0000000000BD0000-0x0000000001826000-memory.dmp family_salatstealer behavioral2/memory/4036-310-0x0000000000BD0000-0x0000000001826000-memory.dmp family_salatstealer behavioral2/memory/5996-312-0x0000000000BD0000-0x0000000001826000-memory.dmp family_salatstealer behavioral2/memory/940-317-0x0000000000BD0000-0x0000000001826000-memory.dmp family_salatstealer behavioral2/memory/4928-318-0x0000000000BD0000-0x0000000001826000-memory.dmp family_salatstealer behavioral2/memory/4712-320-0x0000000000BD0000-0x0000000001826000-memory.dmp family_salatstealer behavioral2/memory/4248-321-0x0000000000BD0000-0x0000000001826000-memory.dmp family_salatstealer behavioral2/memory/4876-322-0x0000000000BD0000-0x0000000001826000-memory.dmp family_salatstealer behavioral2/memory/2748-325-0x0000000000BD0000-0x0000000001826000-memory.dmp family_salatstealer behavioral2/memory/5996-326-0x0000000000BD0000-0x0000000001826000-memory.dmp family_salatstealer behavioral2/memory/2632-328-0x0000000000BD0000-0x0000000001826000-memory.dmp family_salatstealer behavioral2/memory/3492-331-0x0000000000BD0000-0x0000000001826000-memory.dmp family_salatstealer behavioral2/memory/6140-332-0x0000000000BD0000-0x0000000001826000-memory.dmp family_salatstealer behavioral2/memory/5356-334-0x0000000000BD0000-0x0000000001826000-memory.dmp family_salatstealer behavioral2/memory/1824-338-0x0000000000BD0000-0x0000000001826000-memory.dmp family_salatstealer - Executes dropped EXE 15 IoCs
pid Process 4068 xeno.exe 4716 xeno.exe 2916 xeno.exe 2068 xeno.exe 5732 xeno.exe 2772 xeno.exe 2344 xeno.exe 1472 xeno.exe 2176 xeno.exe 1404 xeno.exe 4952 xeno.exe 5496 xeno.exe 4588 xeno.exe 2636 xeno.exe 3652 xeno.exe -
resource yara_rule behavioral2/files/0x000e00000001c66b-4.dat upx behavioral2/memory/4068-9-0x0000000000BD0000-0x0000000001826000-memory.dmp upx behavioral2/memory/4716-11-0x0000000000BD0000-0x0000000001826000-memory.dmp upx behavioral2/memory/4716-14-0x0000000000BD0000-0x0000000001826000-memory.dmp upx behavioral2/memory/2916-16-0x0000000000BD0000-0x0000000001826000-memory.dmp upx behavioral2/memory/2068-20-0x0000000000BD0000-0x0000000001826000-memory.dmp upx behavioral2/memory/5732-22-0x0000000000BD0000-0x0000000001826000-memory.dmp upx behavioral2/memory/2344-24-0x0000000000BD0000-0x0000000001826000-memory.dmp upx behavioral2/memory/2772-25-0x0000000000BD0000-0x0000000001826000-memory.dmp upx behavioral2/memory/2344-27-0x0000000000BD0000-0x0000000001826000-memory.dmp upx behavioral2/memory/4068-29-0x0000000000BD0000-0x0000000001826000-memory.dmp upx behavioral2/memory/1472-33-0x0000000000BD0000-0x0000000001826000-memory.dmp upx behavioral2/memory/4068-34-0x0000000000BD0000-0x0000000001826000-memory.dmp upx behavioral2/memory/2176-36-0x0000000000BD0000-0x0000000001826000-memory.dmp upx behavioral2/memory/1404-35-0x0000000000BD0000-0x0000000001826000-memory.dmp upx behavioral2/memory/4952-38-0x0000000000BD0000-0x0000000001826000-memory.dmp upx behavioral2/memory/4068-39-0x0000000000BD0000-0x0000000001826000-memory.dmp upx behavioral2/memory/5496-42-0x0000000000BD0000-0x0000000001826000-memory.dmp upx behavioral2/memory/4588-44-0x0000000000BD0000-0x0000000001826000-memory.dmp upx behavioral2/memory/2636-46-0x0000000000BD0000-0x0000000001826000-memory.dmp upx behavioral2/memory/3652-48-0x0000000000BD0000-0x0000000001826000-memory.dmp upx behavioral2/memory/4884-49-0x0000000000BD0000-0x0000000001826000-memory.dmp upx behavioral2/memory/4068-51-0x0000000000BD0000-0x0000000001826000-memory.dmp upx behavioral2/memory/1204-52-0x0000000000BD0000-0x0000000001826000-memory.dmp upx behavioral2/memory/4068-53-0x0000000000BD0000-0x0000000001826000-memory.dmp upx behavioral2/memory/1096-57-0x0000000000BD0000-0x0000000001826000-memory.dmp upx behavioral2/memory/3412-58-0x0000000000BD0000-0x0000000001826000-memory.dmp upx behavioral2/memory/4588-245-0x0000000000BD0000-0x0000000001826000-memory.dmp upx behavioral2/memory/4532-246-0x0000000000BD0000-0x0000000001826000-memory.dmp upx behavioral2/memory/4068-248-0x0000000000BD0000-0x0000000001826000-memory.dmp upx behavioral2/memory/6000-250-0x0000000000BD0000-0x0000000001826000-memory.dmp upx behavioral2/memory/3552-251-0x0000000000BD0000-0x0000000001826000-memory.dmp upx behavioral2/memory/636-261-0x0000000000BD0000-0x0000000001826000-memory.dmp upx behavioral2/memory/4068-262-0x0000000000BD0000-0x0000000001826000-memory.dmp upx behavioral2/memory/4540-263-0x0000000000BD0000-0x0000000001826000-memory.dmp upx behavioral2/memory/5692-265-0x0000000000BD0000-0x0000000001826000-memory.dmp upx behavioral2/memory/4872-268-0x0000000000BD0000-0x0000000001826000-memory.dmp upx behavioral2/memory/4732-270-0x0000000000BD0000-0x0000000001826000-memory.dmp upx behavioral2/memory/1828-271-0x0000000000BD0000-0x0000000001826000-memory.dmp upx behavioral2/memory/2636-274-0x0000000000BD0000-0x0000000001826000-memory.dmp upx behavioral2/memory/2832-277-0x0000000000BD0000-0x0000000001826000-memory.dmp upx behavioral2/memory/5316-280-0x0000000000BD0000-0x0000000001826000-memory.dmp upx behavioral2/memory/4068-282-0x0000000000BD0000-0x0000000001826000-memory.dmp upx behavioral2/memory/4372-281-0x0000000000BD0000-0x0000000001826000-memory.dmp upx behavioral2/memory/1680-284-0x0000000000BD0000-0x0000000001826000-memory.dmp upx behavioral2/memory/4068-290-0x0000000000BD0000-0x0000000001826000-memory.dmp upx behavioral2/memory/4308-292-0x0000000000260000-0x0000000000EB6000-memory.dmp upx behavioral2/memory/3284-293-0x0000000000BD0000-0x0000000001826000-memory.dmp upx behavioral2/memory/6000-298-0x0000000000BD0000-0x0000000001826000-memory.dmp upx behavioral2/memory/1684-300-0x0000000000BD0000-0x0000000001826000-memory.dmp upx behavioral2/memory/5940-301-0x0000000000BD0000-0x0000000001826000-memory.dmp upx behavioral2/memory/3436-305-0x0000000000BD0000-0x0000000001826000-memory.dmp upx behavioral2/memory/4232-307-0x0000000000BD0000-0x0000000001826000-memory.dmp upx behavioral2/memory/3512-309-0x0000000000BD0000-0x0000000001826000-memory.dmp upx behavioral2/memory/4036-310-0x0000000000BD0000-0x0000000001826000-memory.dmp upx behavioral2/memory/5996-312-0x0000000000BD0000-0x0000000001826000-memory.dmp upx behavioral2/memory/940-317-0x0000000000BD0000-0x0000000001826000-memory.dmp upx behavioral2/memory/4928-318-0x0000000000BD0000-0x0000000001826000-memory.dmp upx behavioral2/memory/4712-320-0x0000000000BD0000-0x0000000001826000-memory.dmp upx behavioral2/memory/4248-321-0x0000000000BD0000-0x0000000001826000-memory.dmp upx behavioral2/memory/4876-322-0x0000000000BD0000-0x0000000001826000-memory.dmp upx behavioral2/memory/2748-325-0x0000000000BD0000-0x0000000001826000-memory.dmp upx behavioral2/memory/5996-326-0x0000000000BD0000-0x0000000001826000-memory.dmp upx behavioral2/memory/2632-328-0x0000000000BD0000-0x0000000001826000-memory.dmp upx - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 14 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xeno.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xeno.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xeno.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xeno.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xeno.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xeno.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xeno.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xeno.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xeno.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xeno.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xeno.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xeno.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xeno.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xeno.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1964 sihost.exe - Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 5944 wrote to memory of 4068 5944 Xeno-v1.3.55.exe 87 PID 5944 wrote to memory of 6060 5944 Xeno-v1.3.55.exe 88 PID 6060 wrote to memory of 4716 6060 Xeno-v1.3.55.exe 220 PID 6060 wrote to memory of 4708 6060 Xeno-v1.3.55.exe 90 PID 4708 wrote to memory of 2916 4708 Xeno-v1.3.55.exe 91 PID 4708 wrote to memory of 1308 4708 Xeno-v1.3.55.exe 92 PID 1308 wrote to memory of 2068 1308 Xeno-v1.3.55.exe 208 PID 1308 wrote to memory of 4696 1308 Xeno-v1.3.55.exe 94 PID 4696 wrote to memory of 5732 4696 Xeno-v1.3.55.exe 95 PID 4696 wrote to memory of 4016 4696 Xeno-v1.3.55.exe 96 PID 4016 wrote to memory of 2772 4016 Xeno-v1.3.55.exe 97 PID 4016 wrote to memory of 2876 4016 Xeno-v1.3.55.exe 98 PID 2876 wrote to memory of 2344 2876 Xeno-v1.3.55.exe 845 PID 2876 wrote to memory of 492 2876 Xeno-v1.3.55.exe 100 PID 492 wrote to memory of 1472 492 Xeno-v1.3.55.exe 610 PID 492 wrote to memory of 2980 492 Xeno-v1.3.55.exe 104 PID 2980 wrote to memory of 2176 2980 Xeno-v1.3.55.exe 1021 PID 2980 wrote to memory of 3804 2980 Xeno-v1.3.55.exe 107 PID 3804 wrote to memory of 1404 3804 Xeno-v1.3.55.exe 463 PID 3804 wrote to memory of 5960 3804 Xeno-v1.3.55.exe 109 PID 5960 wrote to memory of 4952 5960 Xeno-v1.3.55.exe 1503 PID 5960 wrote to memory of 4860 5960 Xeno-v1.3.55.exe 111 PID 4860 wrote to memory of 5496 4860 Xeno-v1.3.55.exe 1119 PID 4860 wrote to memory of 2872 4860 Xeno-v1.3.55.exe 114 PID 2872 wrote to memory of 4588 2872 Xeno-v1.3.55.exe 206 PID 2872 wrote to memory of 2780 2872 Xeno-v1.3.55.exe 116 PID 2780 wrote to memory of 2636 2780 Xeno-v1.3.55.exe 1009 PID 2780 wrote to memory of 3780 2780 Xeno-v1.3.55.exe 118 PID 3780 wrote to memory of 3652 3780 Xeno-v1.3.55.exe 1059 PID 3780 wrote to memory of 3556 3780 Xeno-v1.3.55.exe 120
Processes
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5944 -
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4068 -
C:\Program Files (x86)\Windows Media Player\explorer.exe"C:\Program Files (x86)\Windows Media Player\explorer.exe"3⤵PID:4308
-
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:6060 -
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4716
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2916
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"4⤵
- Suspicious use of WriteProcessMemory
PID:1308 -
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2068
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"5⤵
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5732
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"6⤵
- Suspicious use of WriteProcessMemory
PID:4016 -
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2772
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"7⤵
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2344
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"8⤵
- Suspicious use of WriteProcessMemory
PID:492 -
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1472
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"9⤵
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2176
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"10⤵
- Suspicious use of WriteProcessMemory
PID:3804 -
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1404
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"11⤵
- Suspicious use of WriteProcessMemory
PID:5960 -
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4952
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"12⤵
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5496
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"13⤵
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4588
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"14⤵
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2636
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"15⤵
- Suspicious use of WriteProcessMemory
PID:3780 -
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"16⤵
- Executes dropped EXE
PID:3652
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"16⤵PID:3556
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"17⤵PID:4884
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"17⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"18⤵PID:1204
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"18⤵PID:3768
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"19⤵PID:1096
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"19⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"20⤵PID:3412
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"20⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"21⤵PID:4588
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"21⤵PID:3532
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"22⤵PID:4532
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"22⤵PID:4320
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"23⤵PID:6000
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"23⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"24⤵PID:3552
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"24⤵PID:4216
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"25⤵PID:636
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"25⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"26⤵PID:4540
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"26⤵PID:628
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"27⤵PID:5692
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"27⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"28⤵PID:4872
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"28⤵PID:4276
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"29⤵PID:4732
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"29⤵PID:5096
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"30⤵PID:1828
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"30⤵PID:768
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"31⤵PID:2636
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"31⤵PID:4048
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"32⤵PID:2832
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"32⤵PID:5656
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"33⤵PID:5316
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"33⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"34⤵PID:4372
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"34⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"35⤵PID:1680
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"35⤵PID:3936
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"36⤵PID:3284
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"36⤵PID:6088
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"37⤵PID:5996
-
C:\Users\Admin\AppData\Local\Adobe\lsass.exeC:\Users\Admin\AppData\Local\Adobe\lsass.exe38⤵PID:4884
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe39⤵PID:2916
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\lsass.exe"C:\Program Files (x86)\Microsoft\Edge\Application\lsass.exe" -39⤵PID:1944
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"37⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"38⤵PID:6000
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"38⤵PID:5420
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"39⤵PID:1684
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"39⤵PID:3372
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"40⤵PID:5940
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"40⤵PID:5428
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"41⤵PID:3436
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"41⤵PID:4112
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"42⤵PID:4232
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"42⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"43⤵PID:4036
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"43⤵PID:440
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"44⤵PID:3512
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"44⤵PID:4252
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"45⤵PID:940
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"45⤵PID:3632
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"46⤵PID:4928
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"46⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"47⤵PID:4712
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"47⤵PID:4700
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"48⤵PID:4248
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"48⤵PID:3216
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"49⤵PID:4876
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"49⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"50⤵PID:2748
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"50⤵PID:4028
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"51⤵PID:2632
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"51⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"52⤵PID:3492
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"52⤵PID:4620
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"53⤵PID:6140
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"53⤵PID:4040
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"54⤵PID:5356
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"54⤵PID:4588
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"55⤵PID:1824
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"55⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"56⤵PID:5104
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"56⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"57⤵PID:4052
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"57⤵PID:804
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"58⤵PID:2808
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"58⤵PID:5720
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"59⤵PID:5128
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"59⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"60⤵PID:4680
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"60⤵PID:3300
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"61⤵PID:5632
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"61⤵PID:4716
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"62⤵PID:4612
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"62⤵PID:3760
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"63⤵PID:3080
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"63⤵PID:868
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"64⤵PID:1912
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"64⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"65⤵PID:2448
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"65⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"66⤵PID:5548
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"66⤵PID:3520
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"67⤵PID:5812
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"67⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"68⤵PID:1948
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"68⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"69⤵PID:5228
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"69⤵PID:3676
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"70⤵PID:240
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"70⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"71⤵PID:3020
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"71⤵PID:4476
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"72⤵PID:3728
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"72⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"73⤵PID:1624
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"73⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"74⤵PID:4668
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"74⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"75⤵PID:1020
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"75⤵PID:6140
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"76⤵PID:5140
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"76⤵PID:3284
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"77⤵PID:432
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"77⤵PID:1280
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"78⤵PID:5208
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"78⤵PID:5644
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"79⤵PID:5076
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"79⤵PID:5192
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"80⤵PID:2072
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"80⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"81⤵PID:5024
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"81⤵PID:4200
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"82⤵PID:4680
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"82⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"83⤵PID:2768
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"83⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"84⤵PID:2760
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"84⤵PID:3772
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"85⤵PID:2436
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"85⤵PID:252
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"86⤵PID:2388
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"86⤵PID:3844
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"87⤵PID:3856
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"87⤵PID:5540
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"88⤵PID:1256
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"88⤵PID:3712
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"89⤵PID:2232
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"89⤵PID:4416
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"90⤵PID:6012
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"90⤵PID:3088
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"91⤵PID:1828
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"91⤵PID:4248
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"92⤵PID:4924
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"92⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"93⤵PID:4412
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"93⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"94⤵PID:2636
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"94⤵PID:5160
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"95⤵PID:2852
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"95⤵PID:244
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"96⤵PID:1272
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"96⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"97⤵PID:5292
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"97⤵PID:996
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"98⤵PID:5412
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"98⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"99⤵PID:4188
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"99⤵PID:4164
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"100⤵PID:1168
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"100⤵PID:3092
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"101⤵PID:2512
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"101⤵PID:5704
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"102⤵PID:4812
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"102⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"103⤵PID:924
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"103⤵PID:4020
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"104⤵PID:4108
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"104⤵PID:4104
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"105⤵PID:856
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"105⤵PID:3316
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"106⤵PID:1672
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"106⤵PID:4140
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"107⤵PID:4888
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"107⤵PID:6092
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"108⤵PID:3652
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"108⤵PID:5436
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"109⤵PID:6100
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"109⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"110⤵PID:1688
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"110⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"111⤵PID:1904
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"111⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"112⤵PID:5536
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"112⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"113⤵PID:1260
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"113⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"114⤵PID:1132
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"114⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"115⤵PID:4412
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"115⤵PID:4000
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"116⤵PID:5484
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"116⤵PID:4172
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"117⤵PID:2500
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"117⤵PID:5980
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"118⤵PID:904
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"118⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"119⤵PID:3460
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"119⤵PID:4796
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"120⤵PID:5236
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"120⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"121⤵PID:5388
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"121⤵PID:432
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"122⤵PID:5076
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-