Analysis
- user interaction
yes - max time kernel
900s - max time network
897s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
04/08/2026, 20:10
General
- Target https://www.mediafire.com/file/fq7iw1ljebwz9nf/XenoAnalyzer_RobloxTargetCheck_WithDump_FinalFix.zip/file
- Sample260804-yxncesdn2y
Score
8/10
Malware Config
Signatures
- Downloads MZ/PE file 2 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 27 IoCs
- Loads dropped DLL 64 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Network Share Discovery 1 TTPs
Attempt to gather information on host network.
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 35 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Connections Discovery 1 TTPs 9 IoCs
Attempt to get a listing of network connections.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 6 IoCs
- Gathers network information 2 TTPs 9 IoCs
Uses commandline utility to view network configuration.
- Modifies data under HKEY_USERS 12 IoCs
- Modifies registry class 64 IoCs
- Suspicious behavior: EnumeratesProcesses 47 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 35 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 50 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.mediafire.com/file/fq7iw1ljebwz9nf/XenoAnalyzer_RobloxTargetCheck_WithDump_FinalFix.zip/file1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffb8646c188,0x7ffb8646c194,0x7ffb8646c1a02⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,18200961125768521454,16922796745456939568,262144 --field-trial-handle=2284,i,12098618082242341690,4059727013059236539,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1824,i,4617660357116169233,16446587724266375930,524288 --field-trial-handle=2284,i,12098618082242341690,4059727013059236539,262144 --variations-seed-version --mojo-platform-channel-handle=3104 /prefetch:32⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2488,i,1592972437939367375,4329488225003058693,524288 --field-trial-handle=2284,i,12098618082242341690,4059727013059236539,262144 --variations-seed-version --mojo-platform-channel-handle=3128 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,714979101848557038,7812900225376805617,2097152 --field-trial-handle=2284,i,12098618082242341690,4059727013059236539,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3520,i,10182821374763536292,3224931645528529058,2097152 --field-trial-handle=2284,i,12098618082242341690,4059727013059236539,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4184,i,18408565198426219456,3449411130862190405,2097152 --field-trial-handle=2284,i,12098618082242341690,4059727013059236539,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4212,i,5426611320576122109,5710773380498891078,2097152 --field-trial-handle=2284,i,12098618082242341690,4059727013059236539,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5028,i,12945209338150693473,9680620749873319677,2097152 --field-trial-handle=2284,i,12098618082242341690,4059727013059236539,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5248,i,11943775924969223156,15162780658426370711,2097152 --field-trial-handle=2284,i,12098618082242341690,4059727013059236539,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5552,i,4388128780378629488,6590791792479566813,2097152 --field-trial-handle=2284,i,12098618082242341690,4059727013059236539,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5616,i,4824872537872957189,508501863730885891,524288 --field-trial-handle=2284,i,12098618082242341690,4059727013059236539,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5620,i,3859990546208679516,15223644698677923236,524288 --field-trial-handle=2284,i,12098618082242341690,4059727013059236539,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6240,i,708292138566701176,5081424966745023290,2097152 --field-trial-handle=2284,i,12098618082242341690,4059727013059236539,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6704,i,10434591029182872992,17579440965661010244,2097152 --field-trial-handle=2284,i,12098618082242341690,4059727013059236539,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6820,i,5706940529409455261,13336532194842352279,524288 --field-trial-handle=2284,i,12098618082242341690,4059727013059236539,262144 --variations-seed-version --mojo-platform-channel-handle=6836 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6820,i,5706940529409455261,13336532194842352279,524288 --field-trial-handle=2284,i,12098618082242341690,4059727013059236539,262144 --variations-seed-version --mojo-platform-channel-handle=6836 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6900,i,14538987811250854884,17837374329704808361,2097152 --field-trial-handle=2284,i,12098618082242341690,4059727013059236539,262144 --variations-seed-version --mojo-platform-channel-handle=6840 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=4212,i,17840427759895027191,17717568802347592982,2097152 --field-trial-handle=2284,i,12098618082242341690,4059727013059236539,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5296,i,15959387697270383200,4828212868570360175,2097152 --field-trial-handle=2284,i,12098618082242341690,4059727013059236539,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5388,i,16331013766737963669,17983894755402809012,2097152 --field-trial-handle=2284,i,12098618082242341690,4059727013059236539,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,6378697593071042256,13118087477137663618,524288 --field-trial-handle=2284,i,12098618082242341690,4059727013059236539,262144 --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=5364,i,11442940718947617841,15913675752284606330,2097152 --field-trial-handle=2284,i,12098618082242341690,4059727013059236539,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=5188,i,11431449937717948502,5153455662434933575,2097152 --field-trial-handle=2284,i,12098618082242341690,4059727013059236539,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=4480,i,7825710096887040481,12143553759777430120,2097152 --field-trial-handle=2284,i,12098618082242341690,4059727013059236539,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=5068,i,4922205679962325168,9797593943442527058,2097152 --field-trial-handle=2284,i,12098618082242341690,4059727013059236539,262144 --variations-seed-version --mojo-platform-channel-handle=6896 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6088,i,14034214495535826431,4407287201270066818,2097152 --field-trial-handle=2284,i,12098618082242341690,4059727013059236539,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7244,i,5146067756317182914,5317517092703994500,2097152 --field-trial-handle=2284,i,12098618082242341690,4059727013059236539,262144 --variations-seed-version --mojo-platform-channel-handle=7256 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7452,i,2979552406168493537,4923976062248913933,2097152 --field-trial-handle=2284,i,12098618082242341690,4059727013059236539,262144 --variations-seed-version --mojo-platform-channel-handle=7492 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,9005868604618690517,1266026164228960444,524288 --field-trial-handle=2284,i,12098618082242341690,4059727013059236539,262144 --variations-seed-version --mojo-platform-channel-handle=7620 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=7764,i,16195080472719382946,10732935772104465678,2097152 --field-trial-handle=2284,i,12098618082242341690,4059727013059236539,262144 --variations-seed-version --mojo-platform-channel-handle=7720 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=7668,i,5191839278243905482,685284107221266364,2097152 --field-trial-handle=2284,i,12098618082242341690,4059727013059236539,262144 --variations-seed-version --mojo-platform-channel-handle=7888 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=7184,i,17775931058525004721,1481042590489224833,2097152 --field-trial-handle=2284,i,12098618082242341690,4059727013059236539,262144 --variations-seed-version --mojo-platform-channel-handle=7988 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=8140,i,7545800743511306578,16368823453111573155,2097152 --field-trial-handle=2284,i,12098618082242341690,4059727013059236539,262144 --variations-seed-version --mojo-platform-channel-handle=8108 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7232,i,10050519482984942291,2215395296149053178,524288 --field-trial-handle=2284,i,12098618082242341690,4059727013059236539,262144 --variations-seed-version --mojo-platform-channel-handle=3964 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3524,i,9971119815355934998,14220075514461068840,524288 --field-trial-handle=2284,i,12098618082242341690,4059727013059236539,262144 --variations-seed-version --mojo-platform-channel-handle=7764 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7476,i,16134978324677406211,2979904853102493619,524288 --field-trial-handle=2284,i,12098618082242341690,4059727013059236539,262144 --variations-seed-version --mojo-platform-channel-handle=7496 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5728,i,13274657219928345762,9627810656470440578,524288 --field-trial-handle=2284,i,12098618082242341690,4059727013059236539,262144 --variations-seed-version --mojo-platform-channel-handle=7248 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=5524,i,13778610511796501253,14644526005418911209,2097152 --field-trial-handle=2284,i,12098618082242341690,4059727013059236539,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=6500,i,1836996649539423039,9389853090963204415,2097152 --field-trial-handle=2284,i,12098618082242341690,4059727013059236539,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=560,i,13343888379650193997,4684762353446906033,524288 --field-trial-handle=2284,i,12098618082242341690,4059727013059236539,262144 --variations-seed-version --mojo-platform-channel-handle=748 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,17629347778969526562,12101061032127344760,524288 --field-trial-handle=2284,i,12098618082242341690,4059727013059236539,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=5860,i,13073892811705360727,14938339966163499273,2097152 --field-trial-handle=2284,i,12098618082242341690,4059727013059236539,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=6804,i,9169296845084620004,18256386680218278821,2097152 --field-trial-handle=2284,i,12098618082242341690,4059727013059236539,262144 --variations-seed-version --mojo-platform-channel-handle=8140 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=6640,i,6456112683250945358,12663866828846004057,2097152 --field-trial-handle=2284,i,12098618082242341690,4059727013059236539,262144 --variations-seed-version --mojo-platform-channel-handle=7136 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=7540,i,5914563910318532612,4937618459443708207,2097152 --field-trial-handle=2284,i,12098618082242341690,4059727013059236539,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7656,i,9343493929235926015,13646626521997448441,524288 --field-trial-handle=2284,i,12098618082242341690,4059727013059236539,262144 --variations-seed-version --mojo-platform-channel-handle=7940 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5764,i,9862117544644946948,15720290801997296054,524288 --field-trial-handle=2284,i,12098618082242341690,4059727013059236539,262144 --variations-seed-version --mojo-platform-channel-handle=7340 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=5764,i,18320457397548579137,10943930105876617357,2097152 --field-trial-handle=2284,i,12098618082242341690,4059727013059236539,262144 --variations-seed-version --mojo-platform-channel-handle=7500 /prefetch:12⤵
-
-
C:\Users\Admin\Downloads\windowsdesktop-runtime-9.0.18-win-x64 (1).exe"C:\Users\Admin\Downloads\windowsdesktop-runtime-9.0.18-win-x64 (1).exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\Temp\{984B76F6-42C7-4620-8079-4D031B702001}\.cr\windowsdesktop-runtime-9.0.18-win-x64 (1).exe"C:\Windows\Temp\{984B76F6-42C7-4620-8079-4D031B702001}\.cr\windowsdesktop-runtime-9.0.18-win-x64 (1).exe" -burn.clean.room="C:\Users\Admin\Downloads\windowsdesktop-runtime-9.0.18-win-x64 (1).exe" -burn.filehandle.attached=720 -burn.filehandle.self=7243⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Windows\Temp\{6A753A83-1612-43EF-9CE0-413CABBB6C19}\.be\windowsdesktop-runtime-9.0.18-win-x64.exe"C:\Windows\Temp\{6A753A83-1612-43EF-9CE0-413CABBB6C19}\.be\windowsdesktop-runtime-9.0.18-win-x64.exe" -q -burn.elevated BurnPipe.{DE5C16CB-05B9-4165-B70E-38A328FBB467} {52442F59-FDE6-40F9-BC58-4B6F892B31CD} 52484⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7668,i,9463553372580654843,1780534191625388450,262144 --field-trial-handle=2284,i,12098618082242341690,4059727013059236539,262144 --variations-seed-version --mojo-platform-channel-handle=7760 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=7464,i,16956547008074007490,10589267335639620659,2097152 --field-trial-handle=2284,i,12098618082242341690,4059727013059236539,262144 --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=7568,i,18354935999372376885,13498795907415913720,2097152 --field-trial-handle=2284,i,12098618082242341690,4059727013059236539,262144 --variations-seed-version --mojo-platform-channel-handle=7684 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5676,i,446840485252690382,399262498933371616,524288 --field-trial-handle=2284,i,12098618082242341690,4059727013059236539,262144 --variations-seed-version --mojo-platform-channel-handle=7408 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5832,i,6288665672460048401,7988184140638666758,524288 --field-trial-handle=2284,i,12098618082242341690,4059727013059236539,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5792,i,17508705792326545834,1475562661498151332,524288 --field-trial-handle=2284,i,12098618082242341690,4059727013059236539,262144 --variations-seed-version --mojo-platform-channel-handle=7040 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6552,i,16089739604449803502,18290987284602776846,524288 --field-trial-handle=2284,i,12098618082242341690,4059727013059236539,262144 --variations-seed-version --mojo-platform-channel-handle=3380 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7632,i,6952804155658100980,14179807883578852775,524288 --field-trial-handle=2284,i,12098618082242341690,4059727013059236539,262144 --variations-seed-version --mojo-platform-channel-handle=7952 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7508,i,1916817422995921200,4417403286375506864,524288 --field-trial-handle=2284,i,12098618082242341690,4059727013059236539,262144 --variations-seed-version --mojo-platform-channel-handle=7468 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\XenoAnalyzer_RobloxTargetCheck_WithDump_FinalFix\BUILD_ALL.cmd" "1⤵
- Executes a command shell one-liner
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\Downloads\XenoAnalyzer_RobloxTargetCheck_WithDump_FinalFix\BUILD_ALL.ps1"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /nologo /target:exe /optimize+ /langversion:5 /reference:System.dll /reference:System.Core.dll /reference:System.Security.dll /out:C:\Users\Admin\Downloads\XenoAnalyzer_RobloxTargetCheck_WithDump_FinalFix\XenoHandleScanWorker.exe C:\Users\Admin\Downloads\XenoAnalyzer_RobloxTargetCheck_WithDump_FinalFix\XenoHandleScanWorker.cs3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAF85.tmp" "c:\Users\Admin\Downloads\XenoAnalyzer_RobloxTargetCheck_WithDump_FinalFix\CSCB516A18EE9C841B2A32524CA674EF1FA.TMP"4⤵
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /nologo /target:exe /optimize+ /langversion:5 /reference:System.dll /reference:System.Core.dll /reference:System.Security.dll /win32manifest:C:\Users\Admin\Downloads\XenoAnalyzer_RobloxTargetCheck_WithDump_FinalFix\requireAdministrator.manifest /out:C:\Users\Admin\Downloads\XenoAnalyzer_RobloxTargetCheck_WithDump_FinalFix\XenoDropFrozenScansAnalyzer.exe C:\Users\Admin\Downloads\XenoAnalyzer_RobloxTargetCheck_WithDump_FinalFix\XenoDropFrozenScansAnalyzer.cs3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB07F.tmp" "c:\Users\Admin\Downloads\XenoAnalyzer_RobloxTargetCheck_WithDump_FinalFix\CSCCF6311BF95504F6F9155D3665562E61.TMP"4⤵
-
-
-
C:\Users\Admin\Downloads\XenoAnalyzer_RobloxTargetCheck_WithDump_FinalFix\XenoDropFrozenScansAnalyzer.exe"C:\Users\Admin\Downloads\XenoAnalyzer_RobloxTargetCheck_WithDump_FinalFix\XenoDropFrozenScansAnalyzer.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.xeno.now/downloads/Xeno-v1.3.55-d47d833e.zip4⤵
-
-
C:\Windows\SYSTEM32\reg.exe"reg.exe" query "HKCU\Software\Microsoft\Windows\CurrentVersion\Run"4⤵
-
-
C:\Windows\SYSTEM32\reg.exe"reg.exe" query "HKLM\Software\Microsoft\Windows\CurrentVersion\Run"4⤵
-
-
C:\Windows\SYSTEM32\reg.exe"reg.exe" query "HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run"4⤵
-
-
C:\Users\Admin\Downloads\XenoAnalyzer_RobloxTargetCheck_WithDump_FinalFix\XenoHandleScanWorker.exe"C:\Users\Admin\Downloads\XenoAnalyzer_RobloxTargetCheck_WithDump_FinalFix\XenoHandleScanWorker.exe" 44524⤵
- Executes dropped EXE
-
-
C:\Windows\SYSTEM32\netstat.exe"netstat.exe" -ano -p tcp4⤵
- System Network Connections Discovery
- Gathers network information
-
-
C:\Users\Admin\Downloads\XenoAnalyzer_RobloxTargetCheck_WithDump_FinalFix\XenoHandleScanWorker.exe"C:\Users\Admin\Downloads\XenoAnalyzer_RobloxTargetCheck_WithDump_FinalFix\XenoHandleScanWorker.exe" 44524⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Downloads\XenoAnalyzer_RobloxTargetCheck_WithDump_FinalFix\XenoHandleScanWorker.exe"C:\Users\Admin\Downloads\XenoAnalyzer_RobloxTargetCheck_WithDump_FinalFix\XenoHandleScanWorker.exe" 44524⤵
- Executes dropped EXE
-
-
C:\Windows\SYSTEM32\netstat.exe"netstat.exe" -ano -p tcp4⤵
- System Network Connections Discovery
- Gathers network information
-
-
C:\Users\Admin\Downloads\XenoAnalyzer_RobloxTargetCheck_WithDump_FinalFix\XenoHandleScanWorker.exe"C:\Users\Admin\Downloads\XenoAnalyzer_RobloxTargetCheck_WithDump_FinalFix\XenoHandleScanWorker.exe" 44524⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Downloads\XenoAnalyzer_RobloxTargetCheck_WithDump_FinalFix\XenoHandleScanWorker.exe"C:\Users\Admin\Downloads\XenoAnalyzer_RobloxTargetCheck_WithDump_FinalFix\XenoHandleScanWorker.exe" 44524⤵
- Executes dropped EXE
-
-
C:\Windows\SYSTEM32\netstat.exe"netstat.exe" -ano -p tcp4⤵
- System Network Connections Discovery
- Gathers network information
-
-
C:\Users\Admin\Downloads\XenoAnalyzer_RobloxTargetCheck_WithDump_FinalFix\XenoHandleScanWorker.exe"C:\Users\Admin\Downloads\XenoAnalyzer_RobloxTargetCheck_WithDump_FinalFix\XenoHandleScanWorker.exe" 44524⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Downloads\XenoAnalyzer_RobloxTargetCheck_WithDump_FinalFix\XenoHandleScanWorker.exe"C:\Users\Admin\Downloads\XenoAnalyzer_RobloxTargetCheck_WithDump_FinalFix\XenoHandleScanWorker.exe" 44524⤵
- Executes dropped EXE
-
-
C:\Windows\SYSTEM32\netstat.exe"netstat.exe" -ano -p tcp4⤵
- System Network Connections Discovery
- Gathers network information
-
-
C:\Users\Admin\Downloads\XenoAnalyzer_RobloxTargetCheck_WithDump_FinalFix\XenoHandleScanWorker.exe"C:\Users\Admin\Downloads\XenoAnalyzer_RobloxTargetCheck_WithDump_FinalFix\XenoHandleScanWorker.exe" 44524⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Downloads\XenoAnalyzer_RobloxTargetCheck_WithDump_FinalFix\XenoHandleScanWorker.exe"C:\Users\Admin\Downloads\XenoAnalyzer_RobloxTargetCheck_WithDump_FinalFix\XenoHandleScanWorker.exe" 44524⤵
- Executes dropped EXE
-
-
C:\Windows\SYSTEM32\netstat.exe"netstat.exe" -ano -p tcp4⤵
- System Network Connections Discovery
- Gathers network information
-
-
C:\Users\Admin\Downloads\XenoAnalyzer_RobloxTargetCheck_WithDump_FinalFix\XenoHandleScanWorker.exe"C:\Users\Admin\Downloads\XenoAnalyzer_RobloxTargetCheck_WithDump_FinalFix\XenoHandleScanWorker.exe" 44524⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Downloads\XenoAnalyzer_RobloxTargetCheck_WithDump_FinalFix\XenoHandleScanWorker.exe"C:\Users\Admin\Downloads\XenoAnalyzer_RobloxTargetCheck_WithDump_FinalFix\XenoHandleScanWorker.exe" 44524⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Downloads\XenoAnalyzer_RobloxTargetCheck_WithDump_FinalFix\XenoHandleScanWorker.exe"C:\Users\Admin\Downloads\XenoAnalyzer_RobloxTargetCheck_WithDump_FinalFix\XenoHandleScanWorker.exe" 44524⤵
- Executes dropped EXE
-
-
C:\Windows\SYSTEM32\netstat.exe"netstat.exe" -ano -p tcp4⤵
- System Network Connections Discovery
- Gathers network information
-
-
C:\Users\Admin\Downloads\XenoAnalyzer_RobloxTargetCheck_WithDump_FinalFix\XenoHandleScanWorker.exe"C:\Users\Admin\Downloads\XenoAnalyzer_RobloxTargetCheck_WithDump_FinalFix\XenoHandleScanWorker.exe" 44524⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Downloads\XenoAnalyzer_RobloxTargetCheck_WithDump_FinalFix\XenoHandleScanWorker.exe"C:\Users\Admin\Downloads\XenoAnalyzer_RobloxTargetCheck_WithDump_FinalFix\XenoHandleScanWorker.exe" 44524⤵
- Executes dropped EXE
-
-
C:\Windows\SYSTEM32\netstat.exe"netstat.exe" -ano -p tcp4⤵
- System Network Connections Discovery
- Gathers network information
-
-
C:\Users\Admin\Downloads\XenoAnalyzer_RobloxTargetCheck_WithDump_FinalFix\XenoHandleScanWorker.exe"C:\Users\Admin\Downloads\XenoAnalyzer_RobloxTargetCheck_WithDump_FinalFix\XenoHandleScanWorker.exe" 44524⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Downloads\XenoAnalyzer_RobloxTargetCheck_WithDump_FinalFix\XenoHandleScanWorker.exe"C:\Users\Admin\Downloads\XenoAnalyzer_RobloxTargetCheck_WithDump_FinalFix\XenoHandleScanWorker.exe" 44524⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Downloads\XenoAnalyzer_RobloxTargetCheck_WithDump_FinalFix\XenoHandleScanWorker.exe"C:\Users\Admin\Downloads\XenoAnalyzer_RobloxTargetCheck_WithDump_FinalFix\XenoHandleScanWorker.exe" 44524⤵
- Executes dropped EXE
-
-
C:\Windows\SYSTEM32\netstat.exe"netstat.exe" -ano -p tcp4⤵
- System Network Connections Discovery
- Gathers network information
-
-
C:\Users\Admin\Downloads\XenoAnalyzer_RobloxTargetCheck_WithDump_FinalFix\XenoHandleScanWorker.exe"C:\Users\Admin\Downloads\XenoAnalyzer_RobloxTargetCheck_WithDump_FinalFix\XenoHandleScanWorker.exe" 44524⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Downloads\XenoAnalyzer_RobloxTargetCheck_WithDump_FinalFix\XenoHandleScanWorker.exe"C:\Users\Admin\Downloads\XenoAnalyzer_RobloxTargetCheck_WithDump_FinalFix\XenoHandleScanWorker.exe" 44524⤵
- Executes dropped EXE
-
-
C:\Windows\SYSTEM32\netstat.exe"netstat.exe" -ano -p tcp4⤵
- System Network Connections Discovery
- Gathers network information
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
-
C:\Users\Admin\Downloads\XenoAnalyzer_RobloxTargetCheck_WithDump_FinalFix\XenoHandleScanWorker.exe"C:\Users\Admin\Downloads\XenoAnalyzer_RobloxTargetCheck_WithDump_FinalFix\XenoHandleScanWorker.exe" 44524⤵
- Executes dropped EXE
-
-
-
-
C:\Users\Admin\Downloads\Xeno-v1.3.55-d47d833e\Xeno-v1.3.55\Xeno.exe"C:\Users\Admin\Downloads\Xeno-v1.3.55-d47d833e\Xeno-v1.3.55\Xeno.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.NETCore.App&framework_version=9.0.0&arch=x64&rid=win-x64&os=win10&gui=true2⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.NETCore.App&framework_version=9.0.0&arch=x64&rid=win-x64&os=win10&gui=true3⤵
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 47C86735BE426803D0CD13A489E3C27F2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 2A20B44323A695C2596D6288911143EA2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 9586B3069B4F8774196EA8F78ED4FE342⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding CFA6B2F144413FEE9A1A5350DAE37DF62⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\ProgramData\Package Cache\{b21e7fe8-9175-483b-a67f-0fd948722740}\windowsdesktop-runtime-9.0.18-win-x64.exe"C:\ProgramData\Package Cache\{b21e7fe8-9175-483b-a67f-0fd948722740}\windowsdesktop-runtime-9.0.18-win-x64.exe" /burn.runonce1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{b21e7fe8-9175-483b-a67f-0fd948722740}\windowsdesktop-runtime-9.0.18-win-x64.exe"C:\ProgramData\Package Cache\{b21e7fe8-9175-483b-a67f-0fd948722740}\windowsdesktop-runtime-9.0.18-win-x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_9.0.18_(x64)_20260804211137.log"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{b21e7fe8-9175-483b-a67f-0fd948722740}\windowsdesktop-runtime-9.0.18-win-x64.exe"C:\ProgramData\Package Cache\{b21e7fe8-9175-483b-a67f-0fd948722740}\windowsdesktop-runtime-9.0.18-win-x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{b21e7fe8-9175-483b-a67f-0fd948722740}\windowsdesktop-runtime-9.0.18-win-x64.exe" -burn.filehandle.attached=524 -burn.filehandle.self=544 /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_9.0.18_(x64)_20260804211137.log"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\Downloads\Xeno-v1.3.55-d47d833e\Xeno-v1.3.55\Xeno.exe"C:\Users\Admin\Downloads\Xeno-v1.3.55-d47d833e\Xeno-v1.3.55\Xeno.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Xeno.exe --webview-exe-version=1.3.55+87ae4f96f8a0927052c1120167982fb069afd1b4 --user-data-dir="C:\Users\Admin\Downloads\Xeno-v1.3.55-d47d833e\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --mojo-named-platform-channel-pipe=4452.4368.170658411423933336512⤵
- Drops file in Program Files directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\Downloads\Xeno-v1.3.55-d47d833e\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\Downloads\Xeno-v1.3.55-d47d833e\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x164,0x168,0x16c,0x140,0xe0,0x7ffb5d56b078,0x7ffb5d56b084,0x7ffb5d56b0903⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\Xeno-v1.3.55-d47d833e\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView" --webview-exe-name=Xeno.exe --webview-exe-version=1.3.55+87ae4f96f8a0927052c1120167982fb069afd1b4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1684,i,15783050722510825188,15336080923451894927,262144 --variations-seed-version --mojo-platform-channel-handle=1668 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\Xeno-v1.3.55-d47d833e\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView" --webview-exe-name=Xeno.exe --webview-exe-version=1.3.55+87ae4f96f8a0927052c1120167982fb069afd1b4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=1996,i,15783050722510825188,15336080923451894927,262144 --variations-seed-version --mojo-platform-channel-handle=2000 /prefetch:33⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\Xeno-v1.3.55-d47d833e\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView" --webview-exe-name=Xeno.exe --webview-exe-version=1.3.55+87ae4f96f8a0927052c1120167982fb069afd1b4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2284,i,15783050722510825188,15336080923451894927,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\Xeno-v1.3.55-d47d833e\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView" --webview-exe-name=Xeno.exe --webview-exe-version=1.3.55+87ae4f96f8a0927052c1120167982fb069afd1b4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3528,i,15783050722510825188,15336080923451894927,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\Xeno-v1.3.55-d47d833e\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView" --webview-exe-name=Xeno.exe --webview-exe-version=1.3.55+87ae4f96f8a0927052c1120167982fb069afd1b4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=3740,i,15783050722510825188,15336080923451894927,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\Xeno-v1.3.55-d47d833e\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView" --webview-exe-name=Xeno.exe --webview-exe-version=1.3.55+87ae4f96f8a0927052c1120167982fb069afd1b4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=752,i,15783050722510825188,15336080923451894927,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\Xeno-v1.3.55-d47d833e\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView" --webview-exe-name=Xeno.exe --webview-exe-version=1.3.55+87ae4f96f8a0927052c1120167982fb069afd1b4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4544,i,15783050722510825188,15336080923451894927,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\Xeno-v1.3.55-d47d833e\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView" --webview-exe-name=Xeno.exe --webview-exe-version=1.3.55+87ae4f96f8a0927052c1120167982fb069afd1b4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=4312,i,15783050722510825188,15336080923451894927,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\Xeno-v1.3.55-d47d833e\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView" --webview-exe-name=Xeno.exe --webview-exe-version=1.3.55+87ae4f96f8a0927052c1120167982fb069afd1b4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=4356,i,15783050722510825188,15336080923451894927,262144 --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\Xeno-v1.3.55-d47d833e\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView" --webview-exe-name=Xeno.exe --webview-exe-version=1.3.55+87ae4f96f8a0927052c1120167982fb069afd1b4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=4520,i,15783050722510825188,15336080923451894927,262144 --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\Xeno-v1.3.55-d47d833e\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView" --webview-exe-name=Xeno.exe --webview-exe-version=1.3.55+87ae4f96f8a0927052c1120167982fb069afd1b4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2188,i,15783050722510825188,15336080923451894927,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\Xeno-v1.3.55-d47d833e\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView" --webview-exe-name=Xeno.exe --webview-exe-version=1.3.55+87ae4f96f8a0927052c1120167982fb069afd1b4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=3732,i,15783050722510825188,15336080923451894927,262144 --variations-seed-version --mojo-platform-channel-handle=3796 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\Xeno-v1.3.55-d47d833e\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView" --webview-exe-name=Xeno.exe --webview-exe-version=1.3.55+87ae4f96f8a0927052c1120167982fb069afd1b4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=3796,i,15783050722510825188,15336080923451894927,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\Xeno-v1.3.55-d47d833e\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView" --webview-exe-name=Xeno.exe --webview-exe-version=1.3.55+87ae4f96f8a0927052c1120167982fb069afd1b4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=3960,i,15783050722510825188,15336080923451894927,262144 --variations-seed-version --mojo-platform-channel-handle=3768 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\Xeno-v1.3.55-d47d833e\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView" --webview-exe-name=Xeno.exe --webview-exe-version=1.3.55+87ae4f96f8a0927052c1120167982fb069afd1b4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=3816,i,15783050722510825188,15336080923451894927,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\Xeno-v1.3.55-d47d833e\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView" --webview-exe-name=Xeno.exe --webview-exe-version=1.3.55+87ae4f96f8a0927052c1120167982fb069afd1b4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=4448,i,15783050722510825188,15336080923451894927,262144 --variations-seed-version --mojo-platform-channel-handle=3784 /prefetch:83⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/xe-no2⤵
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
3PowerShell
1Windows Command Shell
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Discovery
Browser Information Discovery
1Network Share Discovery
1Peripheral Device Discovery
1Query Registry
5System Information Discovery
6System Location Discovery
1System Language Discovery
1System Network Connections Discovery
1System Time Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
e5986ec.rbs
e5986f1.rbs
e5986f6.rbs
e5986fd.rbs
manifest.json
Staging
manifest.json
hyph-as.hyb
hyph-hi.hyb
hyph-nb.hyb
manifest.json
manifest.json
manifest.fingerprint
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
ThirdPartyNotices.txt
78fe0865-9ec9-41da-a0cc-6b8e68b942de.tmp
blocklist
settings.dat
settings.dat
settings.dat
settings.dat
LOG.old
LOG.old
LOG.old
BookmarkMergedSurfaceOrdering
the-real-index
the-real-index
the-real-index~RFe58d433.TMP
SiteList-Enterprise.json
Edge Profile.ico
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Preferences
Preferences
Preferences
Secure Preferences
the-real-index
the-real-index~RFe5cabf7.TMP
index.txt
the-real-index
sync_diagnostic.log
2a0ab528-418b-4f20-9151-c776089250cf.tmp
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter~RFe587df5.TMP
e87525ea-42a1-41cf-b1a5-3722cdde8efc.tmp
5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
RESAF85.tmp
RESB07F.tmp
__PSScriptPolicyTest_zusvrfwf.ni5.ps1
XENO_CACHE.bin
settings.json
ccba5a5986c77e43.customDestinations-ms
protocols.json
crl-set
settings.dat
data_0
data_1
data_2
data_3
MANIFEST-000001
Network Persistent State
Network Persistent State~RFe5b7df6.TMP
Preferences
Preferences~RFe5b005a.TMP
CURRENT
Local State
Local State
Local State
Local State
Local State~RFe5a60ee.TMP
crs.pb
ct_config.pb
kp_pinslist.pb
Filtering Rules
LICENSE
Advertising
Analytics
CompatExceptions
Content
Cryptomining
Entities
Fingerprinting
LICENSE
Other
Social
TransparentAdvertisers
Advertising
Analytics
Content
Cryptomining
Entities
Fingerprinting
LICENSE
Other
Social
manifest.fingerprint
keys.json
XenoDropFrozenScansAnalyzer.exe
MSIA85F.tmp
thm.wxl
bg.png
wixstdba.dll
dotnet_host_9.0.18_win_x64.msi
dotnet_hostfxr_9.0.18_win_x64.msi
dotnet_runtime_9.0.18_win_x64.msi
windowsdesktop_runtime_9.0.18_win_x64.msi
windowsdesktop-runtime-9.0.18-win-x64 (1).exe
CSCB516A18EE9C841B2A32524CA674EF1FA.TMP
CSCCF6311BF95504F6F9155D3665562E61.TMP
memory/2644-1858-0x0000022239C60000-0x0000022239D0D000-memory.dmp
memory/2644-1614-0x00007FFBA0B40000-0x00007FFBA0B41000-memory.dmp
memory/4340-1714-0x00007FFBA0B40000-0x00007FFBA0B41000-memory.dmp
memory/5448-609-0x0000021079E70000-0x0000021079E92000-memory.dmp
memory/5460-1591-0x0000000000690000-0x0000000000698000-memory.dmp
memory/5680-2320-0x000002CE65F50000-0x000002CE65F51000-memory.dmp
memory/5680-2310-0x000002CE65F50000-0x000002CE65F51000-memory.dmp
memory/5680-2318-0x000002CE65F50000-0x000002CE65F51000-memory.dmp
memory/5680-2309-0x000002CE65F50000-0x000002CE65F51000-memory.dmp
memory/5680-2308-0x000002CE65F50000-0x000002CE65F51000-memory.dmp
memory/5680-2315-0x000002CE65F50000-0x000002CE65F51000-memory.dmp
memory/5680-2319-0x000002CE65F50000-0x000002CE65F51000-memory.dmp
memory/5680-2316-0x000002CE65F50000-0x000002CE65F51000-memory.dmp
memory/5680-2314-0x000002CE65F50000-0x000002CE65F51000-memory.dmp
memory/5680-2317-0x000002CE65F50000-0x000002CE65F51000-memory.dmp
memory/5784-632-0x00000000000A0000-0x00000000000AC000-memory.dmp
memory/6088-1680-0x00007FFBA23B0000-0x00007FFBA23B1000-memory.dmp
memory/6088-1681-0x00007FFBA1A00000-0x00007FFBA1A01000-memory.dmp