Analysis
- max time kernel
149s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
05/09/2026, 21:42
General
- Target 2026-09-03_c3b0fe17345325c232c88008abf25c18_cryptbot_icedid_luca-stealer_njrat_stealc.exe
- Size 88.4MB
- Sample260905-1kcfhatbjd
- SHA256 ad5fed04bd56090fbffe586ffa6bd5544f9b2a8716b7275efb96037f24fee2f4
Malware Config
Signatures
- Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
- Detect SalatStealer payload 16 IoCs
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 16 IoCs
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 16 IoCs
- Detects executables (downlaoders) containing URLs to raw contents of a paste 1 IoCs
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers 16 IoCs
- UPX dump on OEP (original entry point) 21 IoCs
- Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 12 IoCs
- Loads dropped DLL 25 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- UPX packed file 21 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 9 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 2 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 4 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 7 IoCs
- Suspicious use of SendNotifyMessage 5 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-03_c3b0fe17345325c232c88008abf25c18_cryptbot_icedid_luca-stealer_njrat_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-03_c3b0fe17345325c232c88008abf25c18_cryptbot_icedid_luca-stealer_njrat_stealc.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\xeno.exe"C:\Users\Admin\AppData\Local\Temp\xeno.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Mozilla\sihost.exeC:\Users\Admin\AppData\Local\Mozilla\sihost.exe3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe4⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\sihost.exe"C:\Program Files (x86)\Microsoft\Edge\Application\sihost.exe" -4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Google\Chrome\Application\sihost.exe"C:\Program Files\Google\Chrome\Application\sihost.exe" -4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.60.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.60.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3HX07FOBiyOg71948xsiFB0hHSJ\Xeno-v1.3.60.exeC:\Users\Admin\AppData\Local\Temp\3HX07FOBiyOg71948xsiFB0hHSJ\Xeno-v1.3.60.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3HX07FOBiyOg71948xsiFB0hHSJ\Xeno-v1.3.60.exe"C:\Users\Admin\AppData\Local\Temp\3HX07FOBiyOg71948xsiFB0hHSJ\Xeno-v1.3.60.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Xeno" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1736 --field-trial-handle=1740,i,10147376381905074299,335408933900930400,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:24⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\3HX07FOBiyOg71948xsiFB0hHSJ\Xeno-v1.3.60.exe"C:\Users\Admin\AppData\Local\Temp\3HX07FOBiyOg71948xsiFB0hHSJ\Xeno-v1.3.60.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Xeno" --mojo-platform-channel-handle=2320 --field-trial-handle=1740,i,10147376381905074299,335408933900930400,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:84⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\3HX07FOBiyOg71948xsiFB0hHSJ\Xeno-v1.3.60.exe"C:\Users\Admin\AppData\Local\Temp\3HX07FOBiyOg71948xsiFB0hHSJ\Xeno-v1.3.60.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Xeno" --app-user-model-id=Xeno --app-path="C:\Users\Admin\AppData\Local\Temp\3HX07FOBiyOg71948xsiFB0hHSJ\resources\app.asar" --enable-sandbox --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2492 --field-trial-handle=1740,i,10147376381905074299,335408933900930400,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:14⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\3HX07FOBiyOg71948xsiFB0hHSJ\Xeno-v1.3.60.exe"C:\Users\Admin\AppData\Local\Temp\3HX07FOBiyOg71948xsiFB0hHSJ\Xeno-v1.3.60.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Xeno" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=3160 --field-trial-handle=1740,i,10147376381905074299,335408933900930400,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:24⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/xe-no4⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://discord.gg/xe-no5⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x230,0x234,0x238,0x22c,0x258,0x7ffae526c188,0x7ffae526c194,0x7ffae526c1a06⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1784,i,2849170429963310893,5725988408131564789,524288 --field-trial-handle=2292,i,2059117888011500984,6835295604330458423,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:36⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,8331053226602245920,13772020505257446762,262144 --field-trial-handle=2292,i,2059117888011500984,6835295604330458423,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:26⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2656,i,4402695003634373927,7395429878213576189,524288 --field-trial-handle=2292,i,2059117888011500984,6835295604330458423,262144 --variations-seed-version --mojo-platform-channel-handle=2668 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3488,i,5028555809155583517,17356215037652299172,2097152 --field-trial-handle=2292,i,2059117888011500984,6835295604330458423,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3492,i,9634811001216274695,15645477078298133307,2097152 --field-trial-handle=2292,i,2059117888011500984,6835295604330458423,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4260,i,11798478178733311752,18262938113607928228,2097152 --field-trial-handle=2292,i,2059117888011500984,6835295604330458423,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4288,i,739615335915379938,17674218007358449078,2097152 --field-trial-handle=2292,i,2059117888011500984,6835295604330458423,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:26⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5056,i,2641801808348510591,1139862758329878584,524288 --field-trial-handle=2292,i,2059117888011500984,6835295604330458423,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5292,i,14196822860283336691,1806866202789673080,524288 --field-trial-handle=2292,i,2059117888011500984,6835295604330458423,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5472,i,17467014313233145137,3118428499506042678,2097152 --field-trial-handle=2292,i,2059117888011500984,6835295604330458423,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3560,i,18097783368222356359,12636803035904643166,524288 --field-trial-handle=2292,i,2059117888011500984,6835295604330458423,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5664,i,6417217826377243761,17684133521627720918,524288 --field-trial-handle=2292,i,2059117888011500984,6835295604330458423,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5312,i,9756743251321092140,1711131454213513594,524288 --field-trial-handle=2292,i,2059117888011500984,6835295604330458423,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5304,i,481403689844593518,931807486423952974,524288 --field-trial-handle=2292,i,2059117888011500984,6835295604330458423,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:86⤵
- Modifies registry class
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6160,i,17159064900244390927,841658899013118738,524288 --field-trial-handle=2292,i,2059117888011500984,6835295604330458423,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6160,i,17159064900244390927,841658899013118738,524288 --field-trial-handle=2292,i,2059117888011500984,6835295604330458423,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6492,i,16605782980416071219,7839727008450868855,524288 --field-trial-handle=2292,i,2059117888011500984,6835295604330458423,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6368,i,16556205946116010927,15740311019962314689,524288 --field-trial-handle=2292,i,2059117888011500984,6835295604330458423,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6468,i,4540729273276463974,17738980676102359401,524288 --field-trial-handle=2292,i,2059117888011500984,6835295604330458423,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6432,i,9814804791922781570,3843291040708714520,524288 --field-trial-handle=2292,i,2059117888011500984,6835295604330458423,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6704,i,13888887157157596121,8425120024877193662,524288 --field-trial-handle=2292,i,2059117888011500984,6835295604330458423,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4360,i,3604626651614858658,11973325258153323786,524288 --field-trial-handle=2292,i,2059117888011500984,6835295604330458423,262144 --variations-seed-version --mojo-platform-channel-handle=6540 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4352,i,17511847866576348597,15433729826719964998,524288 --field-trial-handle=2292,i,2059117888011500984,6835295604330458423,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4836,i,13871970197063477773,8301428677039647345,524288 --field-trial-handle=2292,i,2059117888011500984,6835295604330458423,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1784,i,8615553117417623451,14563163949281563113,524288 --field-trial-handle=2292,i,2059117888011500984,6835295604330458423,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:36⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5188,i,16923307284359053187,11659677164299295387,524288 --field-trial-handle=2292,i,2059117888011500984,6835295604330458423,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6684,i,9364238594820126453,8374155842065262222,524288 --field-trial-handle=2292,i,2059117888011500984,6835295604330458423,262144 --variations-seed-version --mojo-platform-channel-handle=3720 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=744,i,10407363595973665124,2680063539824262963,524288 --field-trial-handle=2292,i,2059117888011500984,6835295604330458423,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3536,i,2419617143024134261,4948312493059215671,524288 --field-trial-handle=2292,i,2059117888011500984,6835295604330458423,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6452,i,18377926873668781879,6496260285014696001,262144 --field-trial-handle=2292,i,2059117888011500984,6835295604330458423,262144 --variations-seed-version --mojo-platform-channel-handle=3796 /prefetch:86⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\3HX07FOBiyOg71948xsiFB0hHSJ\Xeno-v1.3.60.exe"C:\Users\Admin\AppData\Local\Temp\3HX07FOBiyOg71948xsiFB0hHSJ\Xeno-v1.3.60.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --user-data-dir="C:\Users\Admin\AppData\Roaming\Xeno" --mojo-platform-channel-handle=2292 --field-trial-handle=1740,i,10147376381905074299,335408933900930400,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:84⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\3HX07FOBiyOg71948xsiFB0hHSJ\Xeno-v1.3.60.exe"C:\Users\Admin\AppData\Local\Temp\3HX07FOBiyOg71948xsiFB0hHSJ\Xeno-v1.3.60.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\Xeno" --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2700 --field-trial-handle=1740,i,10147376381905074299,335408933900930400,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:24⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3Replay Monitor
Loading Replay Monitor...
Downloads
manifest.json
manifest.json
manifest.json
protocols.json
settings.dat
78a6ba28-d800-4b18-af80-0a9aea6b97e8.tmp
BookmarkMergedSurfaceOrdering
the-real-index
SiteList-Enterprise.json
Edge Profile.ico
Network Persistent State
SCT Auditing Pending Reports
ed223f41-be7f-4d12-b6b1-d617ad6811f5.tmp
Preferences
Preferences
Secure Preferences
index.txt
index.txt
index.txt~RFe58e191.TMP
sync_diagnostic.log
OperationConfig
OperationConfig~RFe59c1fe.TMP
Local State
Local State
Local State
Local State
Local State
nav_config.json
metadata.json
metadata.json
metadata.json
metadata.json
5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
0fa41bf3-3a13-4929-b4e1-5ad74a91ffc4.tmp
chrome_100_percent.pak
588f89c1-d657-474b-9ff4-794b695521b2.tmp
846452936
__PSScriptPolicyTest_y002zkzb.qv2.ps1
LICENSE.electron.txt
LICENSES.chromium.html
chrome_200_percent.pak
d3dcompiler_47.dll
ffmpeg.dll
icudtl.dat
libEGL.dll
libGLESv2.dll
af.pak
am.pak
ar.pak
bg.pak
bn.pak
ca.pak
cs.pak
da.pak
de.pak
el.pak
en-GB.pak
en-US.pak
es-419.pak
es.pak
et.pak
fa.pak
fi.pak
fil.pak
fr.pak
gu.pak
he.pak
hi.pak
hr.pak
hu.pak
id.pak
it.pak
ja.pak
kn.pak
ko.pak
lt.pak
lv.pak
ml.pak
mr.pak
ms.pak
nb.pak
nl.pak
pl.pak
pt-BR.pak
pt-PT.pak
ro.pak
ru.pak
sk.pak
sl.pak
sr.pak
sv.pak
sw.pak
ta.pak
te.pak
th.pak
tr.pak
uk.pak
ur.pak
vi.pak
zh-CN.pak
zh-TW.pak
resources.pak
binding.gyp
addon.obj
vcpkg.applocal.log
win_delay_load_hook.obj
xeno.node.recipe
CL.command.1.tlog
CL.read.1.tlog
CL.write.1.tlog
Cl.items.tlog
link.command.1.tlog
link.read.1.tlog
link.secondary.1.tlog
link.write.1.tlog
xeno.lastbuildstate
xeno.iobj
xeno.ipdb
xeno.node
config.gypi
xeno.vcxproj
xeno.vcxproj.filters
package.json
elevate.exe
Failed.png
Xeno.dll
Xeno.ico
api-ms-win-crt-convert-l1-1-0.dll
api-ms-win-crt-environment-l1-1-0.dll
api-ms-win-crt-filesystem-l1-1-0.dll
api-ms-win-crt-heap-l1-1-0.dll
api-ms-win-crt-locale-l1-1-0.dll
api-ms-win-crt-math-l1-1-0.dll
api-ms-win-crt-runtime-l1-1-0.dll
api-ms-win-crt-stdio-l1-1-0.dll
api-ms-win-crt-string-l1-1-0.dll
api-ms-win-crt-utility-l1-1-0.dll
concrt140.dll
index.html
libcrypto-3-x64.dll
libcurl.dll
libssl-3-x64.dll
msvcp140.dll
msvcp140_1.dll
msvcrt.dll
notification.mp3
ucrtbase.dll
vcruntime140.dll
vcruntime140_1.dll
zlib1.dll
snapshot_blob.bin
v8_context_snapshot.bin
vk_swiftshader.dll
vk_swiftshader_icd.json
vulkan-1.dll
StdUtils.dll
System.dll
nsis7z.dll
2c6abc49-12cf-4ac0-951f-557f0e0c659f.tmp
content_new.js
xeno.exe
XENO_CACHE.bin
default.dic
data_0
data_1
data_2
data_3
Network Persistent State
Network Persistent State~RFe59de60.TMP
memory/1104-385-0x0000000000FE0000-0x0000000001C35000-memory.dmp
memory/1104-1005-0x0000000000FE0000-0x0000000001C35000-memory.dmp
memory/1104-18-0x0000000000FE0000-0x0000000001C35000-memory.dmp
memory/1104-1175-0x0000000000FE0000-0x0000000001C35000-memory.dmp
memory/3404-2292-0x0000000000840000-0x0000000001495000-memory.dmp
memory/3404-2483-0x0000000000840000-0x0000000001495000-memory.dmp
memory/3404-1174-0x0000000000840000-0x0000000001495000-memory.dmp
memory/3404-2431-0x0000000000840000-0x0000000001495000-memory.dmp
memory/3404-2660-0x0000000000840000-0x0000000001495000-memory.dmp
memory/3404-2505-0x0000000000840000-0x0000000001495000-memory.dmp
memory/3404-2574-0x0000000000840000-0x0000000001495000-memory.dmp
memory/3404-2546-0x0000000000840000-0x0000000001495000-memory.dmp
memory/3404-2264-0x0000000000840000-0x0000000001495000-memory.dmp
memory/3404-2625-0x0000000000840000-0x0000000001495000-memory.dmp
memory/3404-2605-0x0000000000840000-0x0000000001495000-memory.dmp
memory/3404-2465-0x0000000000840000-0x0000000001495000-memory.dmp
memory/4000-944-0x00007FFB047E0000-0x00007FFB047E1000-memory.dmp
memory/4000-943-0x00007FFB05E80000-0x00007FFB05E81000-memory.dmp
memory/4028-1015-0x00007FFB04300000-0x00007FFB04301000-memory.dmp
memory/4028-1933-0x0000024325EB0000-0x0000024325F5D000-memory.dmp
memory/6500-2397-0x00000000001C0000-0x0000000000E15000-memory.dmp
memory/6500-2401-0x00000000001C0000-0x0000000000E15000-memory.dmp
memory/6888-2654-0x0000019E6D130000-0x0000019E6D131000-memory.dmp
memory/6888-2646-0x0000019E6D130000-0x0000019E6D131000-memory.dmp
memory/6888-2648-0x0000019E6D130000-0x0000019E6D131000-memory.dmp
memory/6888-2647-0x0000019E6D130000-0x0000019E6D131000-memory.dmp
memory/6888-2658-0x0000019E6D130000-0x0000019E6D131000-memory.dmp
memory/6888-2657-0x0000019E6D130000-0x0000019E6D131000-memory.dmp
memory/6888-2656-0x0000019E6D130000-0x0000019E6D131000-memory.dmp
memory/6888-2655-0x0000019E6D130000-0x0000019E6D131000-memory.dmp
memory/6888-2653-0x0000019E6D130000-0x0000019E6D131000-memory.dmp
memory/6888-2652-0x0000019E6D130000-0x0000019E6D131000-memory.dmp
memory/7916-2426-0x0000000007930000-0x0000000007941000-memory.dmp
memory/7916-2428-0x0000000007970000-0x0000000007984000-memory.dmp
memory/7916-2300-0x0000000005400000-0x0000000005A28000-memory.dmp
memory/7916-2298-0x0000000002900000-0x0000000002936000-memory.dmp
memory/7916-2302-0x0000000005B60000-0x0000000005BC6000-memory.dmp
memory/7916-2399-0x0000000007530000-0x00000000075A6000-memory.dmp
memory/7916-2404-0x0000000004F80000-0x0000000004F9A000-memory.dmp
memory/7916-2312-0x0000000005C40000-0x0000000005F94000-memory.dmp
memory/7916-2303-0x0000000005BD0000-0x0000000005C36000-memory.dmp
memory/7916-2320-0x00000000062E0000-0x000000000632C000-memory.dmp
memory/7916-2313-0x0000000006230000-0x000000000624E000-memory.dmp
memory/7916-2430-0x00000000079A0000-0x00000000079A8000-memory.dmp
memory/7916-2429-0x0000000007A70000-0x0000000007A8A000-memory.dmp
memory/7916-2301-0x0000000005370000-0x0000000005392000-memory.dmp
memory/7916-2427-0x0000000007960000-0x000000000796E000-memory.dmp
memory/7916-2425-0x00000000079D0000-0x0000000007A66000-memory.dmp
memory/7916-2423-0x0000000007900000-0x000000000790A000-memory.dmp
memory/7916-2422-0x0000000007800000-0x00000000078A3000-memory.dmp
memory/7916-2421-0x00000000077E0000-0x00000000077FE000-memory.dmp
memory/7916-2413-0x0000000070660000-0x00000000709B4000-memory.dmp
memory/7916-2412-0x0000000070460000-0x00000000704AC000-memory.dmp
memory/7916-2411-0x00000000077A0000-0x00000000077D2000-memory.dmp
memory/7916-2393-0x00000000067B0000-0x00000000067F4000-memory.dmp
memory/7916-2403-0x0000000007C30000-0x00000000082AA000-memory.dmp
memory/7968-2309-0x0000000000740000-0x0000000001395000-memory.dmp
memory/7968-2297-0x0000000000740000-0x0000000001395000-memory.dmp