Analysis
- user interaction
yes - max time kernel
14s - max time network
161s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/08/2026, 02:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Xeno-v1.3.55.exe
Resource
win10v2004-20260513-en
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
Xeno-v1.3.55.exe
Resource
win11ltsc2024-20260709-en
7 signatures
150 seconds
General
- Target Xeno-v1.3.55.exe
- Size 88.3MB
- Sample260807-ckbl7sen2x
- SHA256 1d1cfdd1c23178e90796c614c210276a97fee0377ffda6a3ceb8cc9a1a37e39a
- MD5 77880d4a355e9af7ebd2ffe8aeb47d2b
- SHA1 441baec778370304a8239fa15712196e3bcc3a61
- SHA512 1b3a217e999158e3f18c57b43cf9a82f16fa599556b17d81af9b4fa263a682270c3b85e1e357fea7f4920ccef4c12d556e362ca32552cf30dbc8aa06921dfe61
- SSDEEP 1572864:mGgiSZ1Ycv1ymX6JfCihLPzSidEI1TLQYCUn1eBLTnDK7voT4+dLjLYURjK95lK:mGgiSZ1WmIhLPWibVQY9n1cm7hyLdRjt
- TLSH T140183335E08D1478F89BF0B5AE916F2BC770BA14193E3BDA1741FA52ABBF6608D50710
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
- Detect SalatStealer payload 64 IoCs
resource yara_rule behavioral2/memory/3348-13-0x0000000000210000-0x0000000000E66000-memory.dmp family_salatstealer behavioral2/memory/3336-17-0x0000000000210000-0x0000000000E66000-memory.dmp family_salatstealer behavioral2/memory/4388-20-0x0000000000210000-0x0000000000E66000-memory.dmp family_salatstealer behavioral2/memory/1092-22-0x0000000000210000-0x0000000000E66000-memory.dmp family_salatstealer behavioral2/memory/6552-27-0x0000000000210000-0x0000000000E66000-memory.dmp family_salatstealer behavioral2/memory/5684-29-0x0000000000210000-0x0000000000E66000-memory.dmp family_salatstealer behavioral2/memory/1088-34-0x0000000000210000-0x0000000000E66000-memory.dmp family_salatstealer behavioral2/memory/4200-33-0x0000000000210000-0x0000000000E66000-memory.dmp family_salatstealer behavioral2/memory/2940-37-0x0000000000210000-0x0000000000E66000-memory.dmp family_salatstealer behavioral2/memory/2876-39-0x0000000000210000-0x0000000000E66000-memory.dmp family_salatstealer behavioral2/memory/3228-40-0x0000000000210000-0x0000000000E66000-memory.dmp family_salatstealer behavioral2/memory/4664-43-0x0000000000210000-0x0000000000E66000-memory.dmp family_salatstealer behavioral2/memory/3436-45-0x0000000000210000-0x0000000000E66000-memory.dmp family_salatstealer behavioral2/memory/4740-47-0x0000000000210000-0x0000000000E66000-memory.dmp family_salatstealer behavioral2/memory/1108-48-0x0000000000210000-0x0000000000E66000-memory.dmp family_salatstealer behavioral2/memory/4248-50-0x0000000000210000-0x0000000000E66000-memory.dmp family_salatstealer behavioral2/memory/3716-52-0x0000000000210000-0x0000000000E66000-memory.dmp family_salatstealer behavioral2/memory/2344-54-0x0000000000210000-0x0000000000E66000-memory.dmp family_salatstealer behavioral2/memory/2452-56-0x0000000000210000-0x0000000000E66000-memory.dmp family_salatstealer behavioral2/memory/4792-58-0x0000000000210000-0x0000000000E66000-memory.dmp family_salatstealer behavioral2/memory/5760-59-0x0000000000210000-0x0000000000E66000-memory.dmp family_salatstealer behavioral2/memory/3340-62-0x0000000000210000-0x0000000000E66000-memory.dmp family_salatstealer behavioral2/memory/1520-63-0x0000000000210000-0x0000000000E66000-memory.dmp family_salatstealer behavioral2/memory/2900-66-0x0000000000210000-0x0000000000E66000-memory.dmp family_salatstealer behavioral2/memory/4248-69-0x0000000000210000-0x0000000000E66000-memory.dmp family_salatstealer behavioral2/memory/2340-67-0x0000000000210000-0x0000000000E66000-memory.dmp family_salatstealer behavioral2/memory/5736-70-0x0000000000210000-0x0000000000E66000-memory.dmp family_salatstealer behavioral2/memory/3732-73-0x0000000000210000-0x0000000000E66000-memory.dmp family_salatstealer behavioral2/memory/6040-75-0x0000000000210000-0x0000000000E66000-memory.dmp family_salatstealer behavioral2/memory/3956-77-0x0000000000210000-0x0000000000E66000-memory.dmp family_salatstealer behavioral2/memory/4476-78-0x0000000000210000-0x0000000000E66000-memory.dmp family_salatstealer behavioral2/memory/5376-82-0x0000000000210000-0x0000000000E66000-memory.dmp family_salatstealer behavioral2/memory/4812-81-0x0000000000210000-0x0000000000E66000-memory.dmp family_salatstealer behavioral2/memory/6120-85-0x0000000000210000-0x0000000000E66000-memory.dmp family_salatstealer behavioral2/memory/1280-87-0x0000000000210000-0x0000000000E66000-memory.dmp family_salatstealer behavioral2/memory/6488-88-0x0000000000210000-0x0000000000E66000-memory.dmp family_salatstealer behavioral2/memory/7072-91-0x0000000000210000-0x0000000000E66000-memory.dmp family_salatstealer behavioral2/memory/5668-93-0x0000000000210000-0x0000000000E66000-memory.dmp family_salatstealer behavioral2/memory/6356-94-0x0000000000210000-0x0000000000E66000-memory.dmp family_salatstealer behavioral2/memory/6900-97-0x0000000000210000-0x0000000000E66000-memory.dmp family_salatstealer behavioral2/memory/3680-98-0x0000000000210000-0x0000000000E66000-memory.dmp family_salatstealer behavioral2/memory/3752-101-0x0000000000210000-0x0000000000E66000-memory.dmp family_salatstealer behavioral2/memory/4260-102-0x0000000000210000-0x0000000000E66000-memory.dmp family_salatstealer behavioral2/memory/4356-105-0x0000000000210000-0x0000000000E66000-memory.dmp family_salatstealer behavioral2/memory/5480-115-0x0000000000210000-0x0000000000E66000-memory.dmp family_salatstealer behavioral2/memory/1820-151-0x0000000000210000-0x0000000000E66000-memory.dmp family_salatstealer behavioral2/memory/5668-152-0x0000000000210000-0x0000000000E66000-memory.dmp family_salatstealer behavioral2/memory/6488-150-0x0000000000210000-0x0000000000E66000-memory.dmp family_salatstealer behavioral2/memory/5604-149-0x0000000000210000-0x0000000000E66000-memory.dmp family_salatstealer behavioral2/memory/2184-148-0x0000000000210000-0x0000000000E66000-memory.dmp family_salatstealer behavioral2/memory/2776-147-0x0000000000210000-0x0000000000E66000-memory.dmp family_salatstealer behavioral2/memory/6340-146-0x0000000000210000-0x0000000000E66000-memory.dmp family_salatstealer behavioral2/memory/6192-145-0x0000000000210000-0x0000000000E66000-memory.dmp family_salatstealer behavioral2/memory/4088-144-0x0000000000210000-0x0000000000E66000-memory.dmp family_salatstealer behavioral2/memory/5468-143-0x0000000000210000-0x0000000000E66000-memory.dmp family_salatstealer behavioral2/memory/6980-141-0x0000000000210000-0x0000000000E66000-memory.dmp family_salatstealer behavioral2/memory/3384-139-0x0000000000210000-0x0000000000E66000-memory.dmp family_salatstealer behavioral2/memory/1508-137-0x0000000000210000-0x0000000000E66000-memory.dmp family_salatstealer behavioral2/memory/2700-135-0x0000000000210000-0x0000000000E66000-memory.dmp family_salatstealer behavioral2/memory/3164-133-0x0000000000210000-0x0000000000E66000-memory.dmp family_salatstealer behavioral2/memory/1608-131-0x0000000000210000-0x0000000000E66000-memory.dmp family_salatstealer behavioral2/memory/2748-129-0x0000000000210000-0x0000000000E66000-memory.dmp family_salatstealer behavioral2/memory/2144-127-0x0000000000210000-0x0000000000E66000-memory.dmp family_salatstealer behavioral2/memory/2688-125-0x0000000000210000-0x0000000000E66000-memory.dmp family_salatstealer - Executes dropped EXE 29 IoCs
pid Process 3348 xeno.exe 4248 xeno.exe 3336 xeno.exe 4388 xeno.exe 1092 xeno.exe 6552 xeno.exe 5684 xeno.exe 1088 xeno.exe 4200 xeno.exe 2940 xeno.exe 2876 xeno.exe 3228 xeno.exe 4664 xeno.exe 3436 xeno.exe 4740 xeno.exe 1108 xeno.exe 3716 xeno.exe 2344 xeno.exe 2452 xeno.exe 4792 xeno.exe 5760 xeno.exe 3340 xeno.exe 1520 xeno.exe 2900 xeno.exe 2340 xeno.exe 5736 xeno.exe 3732 xeno.exe 6040 xeno.exe 4476 xeno.exe -
resource yara_rule behavioral2/files/0x000d00000001c751-4.dat upx behavioral2/memory/3348-9-0x0000000000210000-0x0000000000E66000-memory.dmp upx behavioral2/memory/4248-11-0x0000000000210000-0x0000000000E66000-memory.dmp upx behavioral2/memory/3348-13-0x0000000000210000-0x0000000000E66000-memory.dmp upx behavioral2/memory/3336-17-0x0000000000210000-0x0000000000E66000-memory.dmp upx behavioral2/memory/4388-20-0x0000000000210000-0x0000000000E66000-memory.dmp upx behavioral2/memory/1092-22-0x0000000000210000-0x0000000000E66000-memory.dmp upx behavioral2/memory/5684-25-0x0000000000210000-0x0000000000E66000-memory.dmp upx behavioral2/memory/6552-27-0x0000000000210000-0x0000000000E66000-memory.dmp upx behavioral2/memory/5684-29-0x0000000000210000-0x0000000000E66000-memory.dmp upx behavioral2/memory/1088-34-0x0000000000210000-0x0000000000E66000-memory.dmp upx behavioral2/memory/4200-33-0x0000000000210000-0x0000000000E66000-memory.dmp upx behavioral2/memory/2940-37-0x0000000000210000-0x0000000000E66000-memory.dmp upx behavioral2/memory/2876-39-0x0000000000210000-0x0000000000E66000-memory.dmp upx behavioral2/memory/3228-40-0x0000000000210000-0x0000000000E66000-memory.dmp upx behavioral2/memory/4664-43-0x0000000000210000-0x0000000000E66000-memory.dmp upx behavioral2/memory/3436-45-0x0000000000210000-0x0000000000E66000-memory.dmp upx behavioral2/memory/4740-47-0x0000000000210000-0x0000000000E66000-memory.dmp upx behavioral2/memory/1108-48-0x0000000000210000-0x0000000000E66000-memory.dmp upx behavioral2/memory/4248-50-0x0000000000210000-0x0000000000E66000-memory.dmp upx behavioral2/memory/3716-52-0x0000000000210000-0x0000000000E66000-memory.dmp upx behavioral2/memory/2344-54-0x0000000000210000-0x0000000000E66000-memory.dmp upx behavioral2/memory/2452-56-0x0000000000210000-0x0000000000E66000-memory.dmp upx behavioral2/memory/4792-58-0x0000000000210000-0x0000000000E66000-memory.dmp upx behavioral2/memory/5760-59-0x0000000000210000-0x0000000000E66000-memory.dmp upx behavioral2/memory/3340-62-0x0000000000210000-0x0000000000E66000-memory.dmp upx behavioral2/memory/1520-63-0x0000000000210000-0x0000000000E66000-memory.dmp upx behavioral2/memory/2900-66-0x0000000000210000-0x0000000000E66000-memory.dmp upx behavioral2/memory/4248-69-0x0000000000210000-0x0000000000E66000-memory.dmp upx behavioral2/memory/2340-67-0x0000000000210000-0x0000000000E66000-memory.dmp upx behavioral2/memory/5736-70-0x0000000000210000-0x0000000000E66000-memory.dmp upx behavioral2/memory/3732-73-0x0000000000210000-0x0000000000E66000-memory.dmp upx behavioral2/memory/6040-75-0x0000000000210000-0x0000000000E66000-memory.dmp upx behavioral2/memory/3956-77-0x0000000000210000-0x0000000000E66000-memory.dmp upx behavioral2/memory/4476-78-0x0000000000210000-0x0000000000E66000-memory.dmp upx behavioral2/memory/5376-82-0x0000000000210000-0x0000000000E66000-memory.dmp upx behavioral2/memory/4812-81-0x0000000000210000-0x0000000000E66000-memory.dmp upx behavioral2/memory/6120-85-0x0000000000210000-0x0000000000E66000-memory.dmp upx behavioral2/memory/1280-87-0x0000000000210000-0x0000000000E66000-memory.dmp upx behavioral2/memory/6488-88-0x0000000000210000-0x0000000000E66000-memory.dmp upx behavioral2/memory/7072-91-0x0000000000210000-0x0000000000E66000-memory.dmp upx behavioral2/memory/5668-93-0x0000000000210000-0x0000000000E66000-memory.dmp upx behavioral2/memory/6356-94-0x0000000000210000-0x0000000000E66000-memory.dmp upx behavioral2/memory/6900-97-0x0000000000210000-0x0000000000E66000-memory.dmp upx behavioral2/memory/3680-98-0x0000000000210000-0x0000000000E66000-memory.dmp upx behavioral2/memory/3752-101-0x0000000000210000-0x0000000000E66000-memory.dmp upx behavioral2/memory/4260-102-0x0000000000210000-0x0000000000E66000-memory.dmp upx behavioral2/memory/4356-105-0x0000000000210000-0x0000000000E66000-memory.dmp upx behavioral2/memory/5480-115-0x0000000000210000-0x0000000000E66000-memory.dmp upx behavioral2/memory/1820-151-0x0000000000210000-0x0000000000E66000-memory.dmp upx behavioral2/memory/5668-152-0x0000000000210000-0x0000000000E66000-memory.dmp upx behavioral2/memory/6488-150-0x0000000000210000-0x0000000000E66000-memory.dmp upx behavioral2/memory/5604-149-0x0000000000210000-0x0000000000E66000-memory.dmp upx behavioral2/memory/2184-148-0x0000000000210000-0x0000000000E66000-memory.dmp upx behavioral2/memory/2776-147-0x0000000000210000-0x0000000000E66000-memory.dmp upx behavioral2/memory/6340-146-0x0000000000210000-0x0000000000E66000-memory.dmp upx behavioral2/memory/6192-145-0x0000000000210000-0x0000000000E66000-memory.dmp upx behavioral2/memory/4088-144-0x0000000000210000-0x0000000000E66000-memory.dmp upx behavioral2/memory/5468-143-0x0000000000210000-0x0000000000E66000-memory.dmp upx behavioral2/memory/6980-141-0x0000000000210000-0x0000000000E66000-memory.dmp upx behavioral2/memory/3384-139-0x0000000000210000-0x0000000000E66000-memory.dmp upx behavioral2/memory/1508-137-0x0000000000210000-0x0000000000E66000-memory.dmp upx behavioral2/memory/2700-135-0x0000000000210000-0x0000000000E66000-memory.dmp upx behavioral2/memory/3164-133-0x0000000000210000-0x0000000000E66000-memory.dmp upx - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 28 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xeno.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xeno.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xeno.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xeno.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xeno.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xeno.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xeno.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xeno.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xeno.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xeno.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xeno.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xeno.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xeno.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xeno.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xeno.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xeno.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xeno.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xeno.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xeno.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xeno.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xeno.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xeno.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xeno.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xeno.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xeno.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xeno.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xeno.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xeno.exe - Suspicious use of WriteProcessMemory 58 IoCs
description pid Process procid_target PID 2004 wrote to memory of 3348 2004 Xeno-v1.3.55.exe 89 PID 2004 wrote to memory of 4152 2004 Xeno-v1.3.55.exe 90 PID 4152 wrote to memory of 4248 4152 Xeno-v1.3.55.exe 91 PID 4152 wrote to memory of 2016 4152 Xeno-v1.3.55.exe 92 PID 2016 wrote to memory of 3336 2016 Xeno-v1.3.55.exe 93 PID 2016 wrote to memory of 6944 2016 Xeno-v1.3.55.exe 94 PID 6944 wrote to memory of 4388 6944 Xeno-v1.3.55.exe 95 PID 6944 wrote to memory of 944 6944 Xeno-v1.3.55.exe 96 PID 944 wrote to memory of 1092 944 Xeno-v1.3.55.exe 303 PID 944 wrote to memory of 6852 944 Xeno-v1.3.55.exe 98 PID 6852 wrote to memory of 6552 6852 Xeno-v1.3.55.exe 99 PID 6852 wrote to memory of 4672 6852 Xeno-v1.3.55.exe 100 PID 4672 wrote to memory of 5684 4672 Xeno-v1.3.55.exe 101 PID 4672 wrote to memory of 7084 4672 Xeno-v1.3.55.exe 102 PID 7084 wrote to memory of 1088 7084 Xeno-v1.3.55.exe 371 PID 7084 wrote to memory of 4660 7084 Xeno-v1.3.55.exe 104 PID 4660 wrote to memory of 4200 4660 Xeno-v1.3.55.exe 105 PID 4660 wrote to memory of 1728 4660 Xeno-v1.3.55.exe 106 PID 1728 wrote to memory of 2940 1728 Xeno-v1.3.55.exe 107 PID 1728 wrote to memory of 2620 1728 Xeno-v1.3.55.exe 108 PID 2620 wrote to memory of 2876 2620 Xeno-v1.3.55.exe 312 PID 2620 wrote to memory of 4656 2620 Xeno-v1.3.55.exe 110 PID 4656 wrote to memory of 3228 4656 Xeno-v1.3.55.exe 314 PID 4656 wrote to memory of 2484 4656 Xeno-v1.3.55.exe 112 PID 2484 wrote to memory of 4664 2484 Xeno-v1.3.55.exe 318 PID 2484 wrote to memory of 6832 2484 Xeno-v1.3.55.exe 114 PID 6832 wrote to memory of 3436 6832 Xeno-v1.3.55.exe 115 PID 6832 wrote to memory of 6868 6832 Xeno-v1.3.55.exe 116 PID 6868 wrote to memory of 4740 6868 Xeno-v1.3.55.exe 357 PID 6868 wrote to memory of 4624 6868 Xeno-v1.3.55.exe 118 PID 4624 wrote to memory of 1108 4624 Xeno-v1.3.55.exe 322 PID 4624 wrote to memory of 936 4624 Xeno-v1.3.55.exe 120 PID 936 wrote to memory of 3716 936 Xeno-v1.3.55.exe 325 PID 936 wrote to memory of 2080 936 Xeno-v1.3.55.exe 122 PID 2080 wrote to memory of 2344 2080 Xeno-v1.3.55.exe 123 PID 2080 wrote to memory of 880 2080 Xeno-v1.3.55.exe 124 PID 880 wrote to memory of 2452 880 Xeno-v1.3.55.exe 125 PID 880 wrote to memory of 4480 880 Xeno-v1.3.55.exe 126 PID 4480 wrote to memory of 4792 4480 Xeno-v1.3.55.exe 331 PID 4480 wrote to memory of 3648 4480 Xeno-v1.3.55.exe 128 PID 3648 wrote to memory of 5760 3648 Xeno-v1.3.55.exe 129 PID 3648 wrote to memory of 6364 3648 Xeno-v1.3.55.exe 130 PID 6364 wrote to memory of 3340 6364 Xeno-v1.3.55.exe 131 PID 6364 wrote to memory of 4728 6364 Xeno-v1.3.55.exe 132 PID 4728 wrote to memory of 1520 4728 Xeno-v1.3.55.exe 133 PID 4728 wrote to memory of 3704 4728 Xeno-v1.3.55.exe 134 PID 3704 wrote to memory of 2900 3704 Xeno-v1.3.55.exe 209 PID 3704 wrote to memory of 4176 3704 Xeno-v1.3.55.exe 136 PID 4176 wrote to memory of 2340 4176 Xeno-v1.3.55.exe 274 PID 4176 wrote to memory of 4400 4176 Xeno-v1.3.55.exe 138 PID 4400 wrote to memory of 5736 4400 Xeno-v1.3.55.exe 139 PID 4400 wrote to memory of 4712 4400 Xeno-v1.3.55.exe 140 PID 4712 wrote to memory of 3732 4712 Xeno-v1.3.55.exe 141 PID 4712 wrote to memory of 2500 4712 Xeno-v1.3.55.exe 142 PID 2500 wrote to memory of 6040 2500 Xeno-v1.3.55.exe 713 PID 2500 wrote to memory of 5648 2500 Xeno-v1.3.55.exe 144 PID 5648 wrote to memory of 4476 5648 Xeno-v1.3.55.exe 145 PID 5648 wrote to memory of 4764 5648 Xeno-v1.3.55.exe 146
Processes
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3348
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4248 -
C:\Program Files (x86)\Internet Explorer\dwm.exe"C:\Program Files (x86)\Internet Explorer\dwm.exe"4⤵PID:5820
-
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3336
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"4⤵
- Suspicious use of WriteProcessMemory
PID:6944 -
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4388
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"5⤵
- Suspicious use of WriteProcessMemory
PID:944 -
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1092
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"6⤵
- Suspicious use of WriteProcessMemory
PID:6852 -
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6552
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"7⤵
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5684
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"8⤵
- Suspicious use of WriteProcessMemory
PID:7084 -
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1088
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"9⤵
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4200
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"10⤵
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2940
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"11⤵
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2876
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"12⤵
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3228
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"13⤵
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4664
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"14⤵
- Suspicious use of WriteProcessMemory
PID:6832 -
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3436
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"15⤵
- Suspicious use of WriteProcessMemory
PID:6868 -
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4740
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"16⤵
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1108
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"17⤵
- Suspicious use of WriteProcessMemory
PID:936 -
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3716
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"18⤵
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2344
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"19⤵
- Suspicious use of WriteProcessMemory
PID:880 -
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2452
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"20⤵
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4792
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"21⤵
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5760
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"22⤵
- Suspicious use of WriteProcessMemory
PID:6364 -
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3340
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"23⤵
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1520
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"24⤵
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2900
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"25⤵
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2340
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"26⤵
- Suspicious use of WriteProcessMemory
PID:4400 -
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5736
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"27⤵
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3732
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"28⤵
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6040
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"29⤵
- Suspicious use of WriteProcessMemory
PID:5648 -
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"30⤵
- Executes dropped EXE
PID:4476
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"30⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"31⤵PID:3956
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"31⤵PID:5400
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"32⤵PID:4812
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"32⤵PID:5160
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"33⤵PID:5376
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"33⤵PID:5632
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"34⤵PID:6120
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"34⤵PID:3412
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"35⤵PID:1280
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"35⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"36⤵PID:6488
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"36⤵PID:7024
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"37⤵PID:7072
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"37⤵PID:6176
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"38⤵PID:5668
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"38⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"39⤵PID:6356
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"39⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"40⤵PID:6900
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"40⤵PID:5968
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"41⤵PID:3680
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"41⤵PID:4324
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"42⤵PID:3752
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"42⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"43⤵PID:4260
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"43⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"44⤵PID:4356
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"44⤵PID:5404
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"45⤵PID:5628
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"45⤵PID:5460
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"46⤵PID:5664
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"46⤵PID:6244
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"47⤵PID:6172
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"47⤵PID:4364
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"48⤵PID:1332
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"48⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"49⤵PID:5692
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"49⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"50⤵PID:5480
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"50⤵PID:3720
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"51⤵PID:852
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"51⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"52⤵PID:2664
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"52⤵PID:7160
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"53⤵PID:4732
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"53⤵PID:4208
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"54⤵PID:1108
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"54⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"55⤵PID:2688
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"55⤵PID:5484
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"56⤵PID:2144
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"56⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"57⤵PID:2748
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"57⤵PID:4164
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"58⤵PID:1608
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"58⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"59⤵PID:3164
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"59⤵PID:460
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"60⤵PID:2700
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"60⤵PID:3640
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"61⤵PID:1508
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"61⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"62⤵PID:3384
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"62⤵PID:4856
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"63⤵PID:6980
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"63⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"64⤵PID:5468
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"64⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"65⤵PID:4088
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"65⤵PID:1116
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"66⤵PID:6192
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"66⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"67⤵PID:6340
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"67⤵PID:376
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"68⤵PID:2776
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"68⤵PID:3968
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"69⤵PID:2184
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"69⤵PID:5624
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"70⤵PID:5604
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"70⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"71⤵PID:6488
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"71⤵PID:4668
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"72⤵PID:1820
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"72⤵PID:696
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"73⤵PID:5668
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"73⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"74⤵PID:1500
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"74⤵PID:7048
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"75⤵PID:5040
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"75⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"76⤵PID:4884
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"76⤵PID:1040
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"77⤵PID:3760
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"77⤵PID:3796
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"78⤵PID:6840
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"78⤵PID:6772
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"79⤵PID:5892
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"79⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"80⤵PID:1564
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"80⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"81⤵PID:6368
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"81⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"82⤵PID:3580
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"82⤵PID:6060
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"83⤵PID:4252
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"83⤵PID:3176
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"84⤵PID:7088
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"84⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"85⤵PID:3144
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"85⤵PID:6676
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"86⤵PID:2040
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"86⤵PID:5240
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"87⤵PID:7152
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"87⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"88⤵PID:2688
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"88⤵PID:3556
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"89⤵PID:2416
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"89⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"90⤵PID:1144
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"90⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"91⤵PID:436
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"91⤵PID:4484
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"92⤵PID:6764
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"92⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"93⤵PID:5032
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"93⤵PID:3892
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"94⤵PID:2340
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"94⤵PID:6684
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"95⤵PID:3520
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"95⤵PID:6804
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"96⤵PID:5316
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"96⤵PID:3088
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"97⤵PID:4564
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"97⤵PID:5832
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"98⤵PID:3484
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"98⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"99⤵PID:1260
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"99⤵PID:3672
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"100⤵PID:4120
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"100⤵PID:1000
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"101⤵PID:6044
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"101⤵PID:4744
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"102⤵PID:6184
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"102⤵PID:6132
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"103⤵PID:7132
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"103⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"104⤵PID:1304
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"104⤵PID:4460
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"105⤵PID:2816
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"105⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"106⤵PID:1696
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"106⤵PID:6188
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"107⤵PID:6084
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"107⤵PID:5640
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"108⤵PID:5368
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"108⤵PID:1092
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"109⤵PID:6136
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"109⤵PID:3688
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"110⤵PID:4212
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"110⤵PID:3264
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"111⤵PID:2168
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"111⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"112⤵PID:780
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"112⤵PID:6368
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"113⤵PID:2876
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"113⤵PID:3580
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"114⤵PID:3228
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"114⤵PID:4252
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"115⤵PID:5656
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"115⤵PID:3980
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"116⤵PID:4664
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"116⤵PID:852
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"117⤵PID:1772
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"117⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"118⤵PID:1108
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"118⤵PID:7152
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"119⤵PID:1044
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"119⤵PID:3716
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"120⤵PID:2416
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"120⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"121⤵PID:1172
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"121⤵PID:4264
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"122⤵PID:5012
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-