Analysis
- user interaction
yes - max time kernel
514s - max time network
511s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
30/08/2026, 23:41
General
- Target Xeno-v1.3.60/Xeno.exe
- Size 164KB
- Sample260830-3pspdst1a1
- SHA256 ae6fc5ba07dc314423a518f93b8ad69a5730df780669fd3b40283c32b24a56fc
Score
8/10
Malware Config
Signatures
- Downloads MZ/PE file 1 IoCs
- Executes dropped EXE 7 IoCs
- Loads dropped DLL 64 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Contacts third-party web service commonly abused for C2 1 TTPs 7 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 13 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies data under HKEY_USERS 15 IoCs
- Modifies registry class 64 IoCs
- Suspicious behavior: EnumeratesProcesses 14 IoCs
- Suspicious behavior: LoadsDriver 2 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 27 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 30 IoCs
- Suspicious use of SendNotifyMessage 6 IoCs
- Suspicious use of SetWindowsHookEx 7 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.60\Xeno.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.60\Xeno.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.NETCore.App&framework_version=9.0.0&arch=x64&rid=win-x64&os=win10&gui=true2⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ffb221ac188,0x7ffb221ac194,0x7ffb221ac1a03⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1912,i,10577839507151426716,1143315449903796389,262144 --field-trial-handle=2700,i,15759894049605389357,11627354212569386802,262144 --variations-seed-version --mojo-platform-channel-handle=2692 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1928,i,2634779674001711547,10831368744744654081,524288 --field-trial-handle=2700,i,15759894049605389357,11627354212569386802,262144 --variations-seed-version --mojo-platform-channel-handle=2736 /prefetch:113⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2548,i,2382589729081111630,14309830369423913908,524288 --field-trial-handle=2700,i,15759894049605389357,11627354212569386802,262144 --variations-seed-version --mojo-platform-channel-handle=2660 /prefetch:133⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3576,i,9666886451043756800,240294443725784650,2097152 --field-trial-handle=2700,i,15759894049605389357,11627354212569386802,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3580,i,5442684909388964676,11480736280678866098,2097152 --field-trial-handle=2700,i,15759894049605389357,11627354212569386802,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,1642486270870212226,7442954128948808807,2097152 --field-trial-handle=2700,i,15759894049605389357,11627354212569386802,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4192,i,17364873869744316031,1479790293373049163,2097152 --field-trial-handle=2700,i,15759894049605389357,11627354212569386802,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:93⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3852,i,5633870212302729338,15851671852138374850,524288 --field-trial-handle=2700,i,15759894049605389357,11627354212569386802,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5336,i,14732594213957942544,9455568078452628324,524288 --field-trial-handle=2700,i,15759894049605389357,11627354212569386802,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5320,i,1937725260148306897,8603427528698238557,524288 --field-trial-handle=2700,i,15759894049605389357,11627354212569386802,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5924,i,3360846581529474891,360803619652313937,2097152 --field-trial-handle=2700,i,15759894049605389357,11627354212569386802,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5744,i,9608389303039268186,16244729945753884661,524288 --field-trial-handle=2700,i,15759894049605389357,11627354212569386802,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5744,i,9608389303039268186,16244729945753884661,524288 --field-trial-handle=2700,i,15759894049605389357,11627354212569386802,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6376,i,12056373588760724084,4265006437027806498,524288 --field-trial-handle=2700,i,15759894049605389357,11627354212569386802,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6636,i,10570698934343216529,10357593880912276921,524288 --field-trial-handle=2700,i,15759894049605389357,11627354212569386802,262144 --variations-seed-version --mojo-platform-channel-handle=6644 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3648,i,8954564073146832072,11879100548311921253,524288 --field-trial-handle=2700,i,15759894049605389357,11627354212569386802,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6488,i,16836807861283030317,3962618546039407476,524288 --field-trial-handle=2700,i,15759894049605389357,11627354212569386802,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,2275870412471330022,4594279296340377442,524288 --field-trial-handle=2700,i,15759894049605389357,11627354212569386802,262144 --variations-seed-version --mojo-platform-channel-handle=7008 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6760,i,14767043359033281233,3831744414270035101,2097152 --field-trial-handle=2700,i,15759894049605389357,11627354212569386802,262144 --variations-seed-version --mojo-platform-channel-handle=7028 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4280,i,12086484321893459677,15460351894591137989,524288 --field-trial-handle=2700,i,15759894049605389357,11627354212569386802,262144 --variations-seed-version --mojo-platform-channel-handle=3760 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1364,i,2923272776956031890,1545793486447741499,524288 --field-trial-handle=2700,i,15759894049605389357,11627354212569386802,262144 --variations-seed-version --mojo-platform-channel-handle=1244 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1404,i,13031632846870215257,3468686567013304928,524288 --field-trial-handle=2700,i,15759894049605389357,11627354212569386802,262144 --variations-seed-version --mojo-platform-channel-handle=1232 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1432,i,16394538315915627155,11970589252252987676,524288 --field-trial-handle=2700,i,15759894049605389357,11627354212569386802,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6712,i,15459624993108528129,954938266004769240,524288 --field-trial-handle=2700,i,15759894049605389357,11627354212569386802,262144 --variations-seed-version --mojo-platform-channel-handle=7068 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4280,i,6793561050098985731,12843930863374428742,524288 --field-trial-handle=2700,i,15759894049605389357,11627354212569386802,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6220,i,8035685085616772616,3910287740007336700,524288 --field-trial-handle=2700,i,15759894049605389357,11627354212569386802,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:143⤵
-
-
C:\Users\Admin\Downloads\windowsdesktop-runtime-9.0.19-win-x64.exe"C:\Users\Admin\Downloads\windowsdesktop-runtime-9.0.19-win-x64.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{F3295DEC-04D4-4913-964C-E2009471D708}\.cr\windowsdesktop-runtime-9.0.19-win-x64.exe"C:\Windows\Temp\{F3295DEC-04D4-4913-964C-E2009471D708}\.cr\windowsdesktop-runtime-9.0.19-win-x64.exe" -burn.clean.room="C:\Users\Admin\Downloads\windowsdesktop-runtime-9.0.19-win-x64.exe" -burn.filehandle.attached=756 -burn.filehandle.self=6484⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{08E368DB-A67F-401D-9280-0BB2AD27060E}\.be\windowsdesktop-runtime-9.0.19-win-x64.exe"C:\Windows\Temp\{08E368DB-A67F-401D-9280-0BB2AD27060E}\.be\windowsdesktop-runtime-9.0.19-win-x64.exe" -q -burn.elevated BurnPipe.{62F420AF-B732-401B-A3D6-83C929AF7A71} {B22CD4FF-9663-42A8-B161-89532B669113} 24045⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6180,i,1453819018825092494,7407102188915365406,524288 --field-trial-handle=2700,i,15759894049605389357,11627354212569386802,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4196,i,9990785572786668809,3515925463061841201,262144 --field-trial-handle=2700,i,15759894049605389357,11627354212569386802,262144 --variations-seed-version --mojo-platform-channel-handle=7224 /prefetch:103⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=5952,i,7122497445837835613,6995669926271881169,2097152 --field-trial-handle=2700,i,15759894049605389357,11627354212569386802,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5944,i,820570420199658218,14187411909473796347,524288 --field-trial-handle=2700,i,15759894049605389357,11627354212569386802,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=4248,i,5046202221736429860,16828746101943168863,2097152 --field-trial-handle=2700,i,15759894049605389357,11627354212569386802,262144 --variations-seed-version --mojo-platform-channel-handle=1272 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=7280,i,3003201576583433834,6250162655134587536,2097152 --field-trial-handle=2700,i,15759894049605389357,11627354212569386802,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6192,i,11565687248199274528,3827293546450127266,524288 --field-trial-handle=2700,i,15759894049605389357,11627354212569386802,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=5024,i,13613468666610725391,16891042585590406961,2097152 --field-trial-handle=2700,i,15759894049605389357,11627354212569386802,262144 --variations-seed-version --mojo-platform-channel-handle=7452 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=7276,i,3549460307387758803,16591151902856295271,2097152 --field-trial-handle=2700,i,15759894049605389357,11627354212569386802,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7232,i,546032270378599747,9768929586458158651,524288 --field-trial-handle=2700,i,15759894049605389357,11627354212569386802,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=7336,i,11210845009287881195,2259214507279767952,2097152 --field-trial-handle=2700,i,15759894049605389357,11627354212569386802,262144 --variations-seed-version --mojo-platform-channel-handle=7284 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6192,i,7537150746882311082,10397201900115900246,524288 --field-trial-handle=2700,i,15759894049605389357,11627354212569386802,262144 --variations-seed-version --mojo-platform-channel-handle=7536 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7324,i,2664424832002154539,7551682033941328411,524288 --field-trial-handle=2700,i,15759894049605389357,11627354212569386802,262144 --variations-seed-version --mojo-platform-channel-handle=7300 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7732,i,1106306382727418318,5930413724024047898,524288 --field-trial-handle=2700,i,15759894049605389357,11627354212569386802,262144 --variations-seed-version --mojo-platform-channel-handle=7736 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5384,i,12580425832207987662,16160279753669129457,524288 --field-trial-handle=2700,i,15759894049605389357,11627354212569386802,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=8024,i,405610629986929959,12058888238429204009,2097152 --field-trial-handle=2700,i,15759894049605389357,11627354212569386802,262144 --variations-seed-version --mojo-platform-channel-handle=7936 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=8092,i,16103517160066356736,1587528110905757948,2097152 --field-trial-handle=2700,i,15759894049605389357,11627354212569386802,262144 --variations-seed-version --mojo-platform-channel-handle=7988 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=8200,i,14113220420767914869,9966758545669153939,2097152 --field-trial-handle=2700,i,15759894049605389357,11627354212569386802,262144 --variations-seed-version --mojo-platform-channel-handle=8204 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=8344,i,10370221750625095803,18217015936126028859,2097152 --field-trial-handle=2700,i,15759894049605389357,11627354212569386802,262144 --variations-seed-version --mojo-platform-channel-handle=8376 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=5616,i,2322288517291171414,3714271009024608874,2097152 --field-trial-handle=2700,i,15759894049605389357,11627354212569386802,262144 --variations-seed-version --mojo-platform-channel-handle=8588 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=1240,i,14367243730821932004,11801109399115561173,2097152 --field-trial-handle=2700,i,15759894049605389357,11627354212569386802,262144 --variations-seed-version --mojo-platform-channel-handle=8396 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=8364,i,737305854071122901,6001283013451150759,2097152 --field-trial-handle=2700,i,15759894049605389357,11627354212569386802,262144 --variations-seed-version --mojo-platform-channel-handle=7348 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=8220,i,9096811635123631846,2927056229788941672,2097152 --field-trial-handle=2700,i,15759894049605389357,11627354212569386802,262144 --variations-seed-version --mojo-platform-channel-handle=8400 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=5048,i,5048028294102996790,15063250993473748354,2097152 --field-trial-handle=2700,i,15759894049605389357,11627354212569386802,262144 --variations-seed-version --mojo-platform-channel-handle=8540 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --metrics-shmem-handle=8680,i,15334273799425086665,11172291679030682724,2097152 --field-trial-handle=2700,i,15759894049605389357,11627354212569386802,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=8752,i,11397198143309549862,16434053606635648418,2097152 --field-trial-handle=2700,i,15759894049605389357,11627354212569386802,262144 --variations-seed-version --mojo-platform-channel-handle=8736 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --metrics-shmem-handle=8876,i,11661114738924070235,11825977637394537048,2097152 --field-trial-handle=2700,i,15759894049605389357,11627354212569386802,262144 --variations-seed-version --mojo-platform-channel-handle=8896 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9320,i,1596758141030092653,1318757413184155674,524288 --field-trial-handle=2700,i,15759894049605389357,11627354212569386802,262144 --variations-seed-version --mojo-platform-channel-handle=9324 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8748,i,6491548224660013596,8919620136243079794,524288 --field-trial-handle=2700,i,15759894049605389357,11627354212569386802,262144 --variations-seed-version --mojo-platform-channel-handle=8736 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9016,i,6298164774244248440,449397389998587698,524288 --field-trial-handle=2700,i,15759894049605389357,11627354212569386802,262144 --variations-seed-version --mojo-platform-channel-handle=8740 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5768,i,14696245220219818653,2483352958996179318,524288 --field-trial-handle=2700,i,15759894049605389357,11627354212569386802,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8768,i,14185780903012318073,4240311990252949674,524288 --field-trial-handle=2700,i,15759894049605389357,11627354212569386802,262144 --variations-seed-version --mojo-platform-channel-handle=8484 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5824,i,4438128043299883348,9279794378270203150,524288 --field-trial-handle=2700,i,15759894049605389357,11627354212569386802,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --always-read-main-dll --metrics-shmem-handle=3212,i,16840639139262266113,10385566966252901535,2097152 --field-trial-handle=2700,i,15759894049605389357,11627354212569386802,262144 --variations-seed-version --mojo-platform-channel-handle=8740 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --always-read-main-dll --metrics-shmem-handle=8080,i,5733371999761267039,9844469245546030947,2097152 --field-trial-handle=2700,i,15759894049605389357,11627354212569386802,262144 --variations-seed-version --mojo-platform-channel-handle=8104 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8108,i,17962585004860647552,17064468854040355786,524288 --field-trial-handle=2700,i,15759894049605389357,11627354212569386802,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:143⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 61D2EB966C2BF535BD8FF405E3EF4E0B2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 639CAED3FE4ABAE1906EDF1476CA90D52⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 0A17B90CFAFD9709E2E069A2752F6D6A2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 1B80CAAEA58D87603A88647DD6B294462⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 1749FA85979EFA7AE9C2CBC61C5799542⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 9B1FCD58EBF6EE16F7972404ED4C1FB42⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\ProgramData\Package Cache\{7a013c32-dd46-48f5-81b1-2576c92468db}\windowsdesktop-runtime-9.0.19-win-x64.exe"C:\ProgramData\Package Cache\{7a013c32-dd46-48f5-81b1-2576c92468db}\windowsdesktop-runtime-9.0.19-win-x64.exe" /burn.runonce1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Package Cache\{7a013c32-dd46-48f5-81b1-2576c92468db}\windowsdesktop-runtime-9.0.19-win-x64.exe"C:\ProgramData\Package Cache\{7a013c32-dd46-48f5-81b1-2576c92468db}\windowsdesktop-runtime-9.0.19-win-x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_9.0.19_(x64)_20260831004433.log"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Package Cache\{7a013c32-dd46-48f5-81b1-2576c92468db}\windowsdesktop-runtime-9.0.19-win-x64.exe"C:\ProgramData\Package Cache\{7a013c32-dd46-48f5-81b1-2576c92468db}\windowsdesktop-runtime-9.0.19-win-x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{7a013c32-dd46-48f5-81b1-2576c92468db}\windowsdesktop-runtime-9.0.19-win-x64.exe" -burn.filehandle.attached=568 -burn.filehandle.self=588 /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_9.0.19_(x64)_20260831004433.log"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Package Cache\{7a013c32-dd46-48f5-81b1-2576c92468db}\windowsdesktop-runtime-9.0.19-win-x64.exe"C:\ProgramData\Package Cache\{7a013c32-dd46-48f5-81b1-2576c92468db}\windowsdesktop-runtime-9.0.19-win-x64.exe" -q -burn.elevated BurnPipe.{CEE00554-5D68-45D6-86C4-DEAB686F3166} {DB03E218-EDBE-4CF8-B18A-16C3E00072D3} 11884⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\Downloads\Xeno-v1.3.60\Xeno-v1.3.60\Xeno.exe"C:\Users\Admin\Downloads\Xeno-v1.3.60\Xeno-v1.3.60\Xeno.exe"1⤵
- Loads dropped DLL
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
e5ad2f4.rbs
e5ad2f9.rbs
e5ad2fe.rbs
e5ad305.rbs
e5ad309.rbs
e5ad30c.rbs
ThirdPartyNotices.txt
state.rsm
settings.dat
settings.dat
LOG.old
f_0000be
f_0000c2
f_0000c8
f_0000c9
f_0000cf
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index~RFe59ce81.TMP
SiteList-Enterprise.json
Edge Profile.ico
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Sdch Dictionaries
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index~RFe5b42a3.TMP
index.txt.tmp
the-real-index
the-real-index
the-real-index~RFe5b97a9.TMP
Session_13432607389089338
CURRENT
4e543394-c1a1-448b-9919-140741f0c0ca.tmp
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter~RFe5baf38.TMP
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
metadata.json
metadata.json
8db7a484-81d7-4cf5-b1fd-fb8cdf4385ba.tmp
Microsoft_Windows_Desktop_Runtime_-_9.0.19_(x64)_20260831004433_000_dotnet_runtime_9.0.19_win_x64.msi.log
Microsoft_Windows_Desktop_Runtime_-_9.0.19_(x64)_20260831004433_001_dotnet_hostfxr_9.0.19_win_x64.msi.log
Microsoft_Windows_Desktop_Runtime_-_9.0.19_(x64)_20260831004433_002_dotnet_host_9.0.19_win_x64.msi.log
Microsoft_Windows_Desktop_Runtime_-_9.0.19_(x64)_20260831004433_003_windowsdesktop_runtime_9.0.19_win_x64.msi.log
content_new.js
settings.json
Xeno-v1.3.60.zip
MSIE08E.tmp
LICENSE
bg.png
wixstdba.dll
dotnet_host_9.0.19_win_x64.msi
dotnet_hostfxr_9.0.19_win_x64.msi
dotnet_runtime_9.0.19_win_x64.msi
windowsdesktop_runtime_9.0.19_win_x64.msi
thm.wxl
windowsdesktop-runtime-9.0.19-win-x64.exe