Analysis
- max time kernel
301s - max time network
311s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
15/10/2026, 16:10
General
- Target Xeno-v.1.3.60.exe
- Size 84.8MB
- Sample261015-tmfsdayvfs
- SHA256 40b7ae6ba61e438679fd79082a5f904a82f0652323a5a0973262336dad32adfd
Score
10/10
Malware Config
Extracted
Family
-
sheetrat
Campaign
-
Sheet_nbszmiyxtax
C2
-
bore.pub:43689
Signatures
- Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Detects Sheetrat obfuscated V1.8 and higher 2 IoCs
Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Detects Sheetrat obfuscated version 2 IoCs
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
- Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
- Executes dropped EXE 9 IoCs
- Loads dropped DLL 64 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service 1 TTPs 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in Program Files directory 2 IoCs
- Drops file in Windows directory 24 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies registry class 9 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 5 IoCs
- Suspicious use of SendNotifyMessage 3 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v.1.3.60.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v.1.3.60.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Paint.NET" /tr "C:\Program Files\xdwdWireshark Host.exe" & exit3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeSchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Paint.NET" /tr "C:\Program Files\xdwdWireshark Host.exe"4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Docker Upgrade" /tr "C:\Users\Admin\Music\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST & exit3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo 5 /tn "Docker Upgrade" /tr "C:\Users\Admin\Music\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit3⤵
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST4⤵
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit3⤵
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST4⤵
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit3⤵
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST4⤵
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST4⤵
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit3⤵
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST4⤵
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST4⤵
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit3⤵
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST4⤵
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit3⤵
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST4⤵
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit3⤵
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST4⤵
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST4⤵
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit3⤵
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST4⤵
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit3⤵
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit3⤵
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit3⤵
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST4⤵
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST4⤵
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST4⤵
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit3⤵
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit3⤵
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST4⤵
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST4⤵
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit3⤵
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit3⤵
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit3⤵
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST4⤵
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit3⤵
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "DaVinci Resolve Update" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.60.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.60.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3HX07FOBiyOg71948xsiFB0hHSJ\Xeno-v1.3.60.exeC:\Users\Admin\AppData\Local\Temp\3HX07FOBiyOg71948xsiFB0hHSJ\Xeno-v1.3.60.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3HX07FOBiyOg71948xsiFB0hHSJ\Xeno-v1.3.60.exe"C:\Users\Admin\AppData\Local\Temp\3HX07FOBiyOg71948xsiFB0hHSJ\Xeno-v1.3.60.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Xeno" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1656 --field-trial-handle=1664,i,10835949097225209502,5331696719257168519,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:24⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\3HX07FOBiyOg71948xsiFB0hHSJ\Xeno-v1.3.60.exe"C:\Users\Admin\AppData\Local\Temp\3HX07FOBiyOg71948xsiFB0hHSJ\Xeno-v1.3.60.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Xeno" --mojo-platform-channel-handle=2292 --field-trial-handle=1664,i,10835949097225209502,5331696719257168519,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:84⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\3HX07FOBiyOg71948xsiFB0hHSJ\Xeno-v1.3.60.exe"C:\Users\Admin\AppData\Local\Temp\3HX07FOBiyOg71948xsiFB0hHSJ\Xeno-v1.3.60.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Xeno" --app-user-model-id=Xeno --app-path="C:\Users\Admin\AppData\Local\Temp\3HX07FOBiyOg71948xsiFB0hHSJ\resources\app.asar" --enable-sandbox --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2480 --field-trial-handle=1664,i,10835949097225209502,5331696719257168519,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:14⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/xe-no4⤵
- Loads dropped DLL
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x390,0x7ffae413c188,0x7ffae413c194,0x7ffae413c1a05⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1532,i,6446760982054814843,325804877280072241,262144 --field-trial-handle=2308,i,4228637325939082130,18274562489751208496,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:25⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1712,i,17781835972379218684,2182336193802788756,524288 --field-trial-handle=2308,i,4228637325939082130,18274562489751208496,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:115⤵
- Loads dropped DLL
- System Time Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2436,i,3843368070710689259,5602180148574872013,524288 --field-trial-handle=2308,i,4228637325939082130,18274562489751208496,262144 --variations-seed-version --mojo-platform-channel-handle=3224 /prefetch:135⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3496,i,3713045816881080507,986214750038960361,2097152 --field-trial-handle=2308,i,4228637325939082130,18274562489751208496,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3500,i,2225964479929901952,2370218065845948273,2097152 --field-trial-handle=2308,i,4228637325939082130,18274562489751208496,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4204,i,3944790363765273302,8481046729197722162,2097152 --field-trial-handle=2308,i,4228637325939082130,18274562489751208496,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4220,i,9943554084518150435,17710657467957049163,2097152 --field-trial-handle=2308,i,4228637325939082130,18274562489751208496,262144 --variations-seed-version --mojo-platform-channel-handle=4872 /prefetch:95⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3764,i,13779060056733308193,15072571320781342537,2097152 --field-trial-handle=2308,i,4228637325939082130,18274562489751208496,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5408,i,17271746571267430788,28674209245527271,524288 --field-trial-handle=2308,i,4228637325939082130,18274562489751208496,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5384,i,16467999886383992564,960334113338119549,524288 --field-trial-handle=2308,i,4228637325939082130,18274562489751208496,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,4105257114432919872,4204627198474881641,524288 --field-trial-handle=2308,i,4228637325939082130,18274562489751208496,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6008,i,722115074529135635,18099265448624627613,524288 --field-trial-handle=2308,i,4228637325939082130,18274562489751208496,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:145⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6036,i,5342137639178595163,149956465255475698,524288 --field-trial-handle=2308,i,4228637325939082130,18274562489751208496,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:125⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6808,i,14201843681190606784,13466776463040790375,524288 --field-trial-handle=2308,i,4228637325939082130,18274562489751208496,262144 --variations-seed-version --mojo-platform-channel-handle=6788 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6808,i,14201843681190606784,13466776463040790375,524288 --field-trial-handle=2308,i,4228637325939082130,18274562489751208496,262144 --variations-seed-version --mojo-platform-channel-handle=6788 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6436,i,16854398669664735841,5687153150285671722,524288 --field-trial-handle=2308,i,4228637325939082130,18274562489751208496,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6388,i,7379044452565480510,16891479203405213173,524288 --field-trial-handle=2308,i,4228637325939082130,18274562489751208496,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4936,i,3966406201239170189,9393470953448535103,524288 --field-trial-handle=2308,i,4228637325939082130,18274562489751208496,262144 --variations-seed-version --mojo-platform-channel-handle=6760 /prefetch:145⤵
- Loads dropped DLL
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4932,i,18108574844609257146,16890130216633531187,524288 --field-trial-handle=2308,i,4228637325939082130,18274562489751208496,262144 --variations-seed-version --mojo-platform-channel-handle=6776 /prefetch:145⤵
- Loads dropped DLL
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4904,i,7747936383178283147,14719344837445279077,524288 --field-trial-handle=2308,i,4228637325939082130,18274562489751208496,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:145⤵
- Loads dropped DLL
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2052,i,17935632297633097277,9762526716224201899,524288 --field-trial-handle=2308,i,4228637325939082130,18274562489751208496,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6812,i,1735739090963440829,14379898225240178998,524288 --field-trial-handle=2308,i,4228637325939082130,18274562489751208496,262144 --variations-seed-version --mojo-platform-channel-handle=7536 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6700,i,8102448031962573882,467142998872407631,524288 --field-trial-handle=2308,i,4228637325939082130,18274562489751208496,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7608,i,10132717669813538761,11315001177077167120,524288 --field-trial-handle=2308,i,4228637325939082130,18274562489751208496,262144 --variations-seed-version --mojo-platform-channel-handle=7412 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5072,i,5121160105607069589,14326078452925150025,262144 --field-trial-handle=2308,i,4228637325939082130,18274562489751208496,262144 --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:105⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5428,i,5287379809593001774,13258542159025733796,524288 --field-trial-handle=2308,i,4228637325939082130,18274562489751208496,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3696,i,10963564655518622814,7562708508028754784,524288 --field-trial-handle=2308,i,4228637325939082130,18274562489751208496,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,353486934310485042,16361900846400703969,524288 --field-trial-handle=2308,i,4228637325939082130,18274562489751208496,262144 --variations-seed-version --mojo-platform-channel-handle=3816 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5812,i,9212157844299686039,577238085222309443,524288 --field-trial-handle=2308,i,4228637325939082130,18274562489751208496,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5048,i,7038427890510458197,14109098649273688540,524288 --field-trial-handle=2308,i,4228637325939082130,18274562489751208496,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3000,i,5391066193272207182,12539276737436701051,524288 --field-trial-handle=2308,i,4228637325939082130,18274562489751208496,262144 --variations-seed-version --mojo-platform-channel-handle=7608 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5816,i,12248534326880713904,12125379209525473906,524288 --field-trial-handle=2308,i,4228637325939082130,18274562489751208496,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:145⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\3HX07FOBiyOg71948xsiFB0hHSJ\Xeno-v1.3.60.exe"C:\Users\Admin\AppData\Local\Temp\3HX07FOBiyOg71948xsiFB0hHSJ\Xeno-v1.3.60.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Xeno" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=3736 --field-trial-handle=1664,i,10835949097225209502,5331696719257168519,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:24⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\3HX07FOBiyOg71948xsiFB0hHSJ\Xeno-v1.3.60.exe"C:\Users\Admin\AppData\Local\Temp\3HX07FOBiyOg71948xsiFB0hHSJ\Xeno-v1.3.60.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --user-data-dir="C:\Users\Admin\AppData\Roaming\Xeno" --mojo-platform-channel-handle=3604 --field-trial-handle=1664,i,10835949097225209502,5331696719257168519,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:84⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\3HX07FOBiyOg71948xsiFB0hHSJ\Xeno-v1.3.60.exe"C:\Users\Admin\AppData\Local\Temp\3HX07FOBiyOg71948xsiFB0hHSJ\Xeno-v1.3.60.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --user-data-dir="C:\Users\Admin\AppData\Roaming\Xeno" --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2904 --field-trial-handle=1664,i,10835949097225209502,5331696719257168519,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:24⤵
- Executes dropped EXE
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Event Triggered Execution
1AppInit DLLs
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Event Triggered Execution
1AppInit DLLs
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
3b3d53cb-d352-4718-bd1d-b795f6755419.tmp
499fb07a-0129-4d5c-8c01-eda26234bfe2.tmp
6f200306-bdf0-48dc-8730-cb5e6daf3741.tmp
73004439-e3d2-43af-a1ee-adb510da1890.tmp
75fd3dc2-78d0-41c0-a778-e16c0cdfd35a.tmp
7dac0971-b3cd-454e-9795-31a48240a43e.tmp
settings.dat
settings.dat
12ca6d02-7721-4dfb-bdce-11d4289464d4.tmp
426e06e0-d921-4ecc-b56f-0d3c889b3640.tmp
4f4277cd-fd34-444c-836d-f286705564e9.tmp
7f56f967-4348-4b06-b0a8-a2f2ddb58789.tmp
LOG.old
temp-index
the-real-index~RFe5b78d6.TMP
b99a3b80-f788-4308-b0d1-d28567c23aca.tmp
20cd0c9f-249f-4102-a7ba-82bcd6193516.tmp
7a1b4049-7612-4f88-ab60-2600d8276554.tmp
eb7447b1-b294-497f-9bfa-187602943c0c.tmp
index
index.txt
index.txt.tmp
index.txt.tmp
f2ed1565-aac2-4911-aff2-d0daa6571bad.tmp
OperationConfig
b02a2667-cd9b-4ea4-ab77-2c7c5b4b1411.tmp
071f7407-3b72-4345-b308-5b5a7b72d669.tmp
0f570697-34be-4c0e-9b24-0448c08c5a84.tmp
14b15663-f0d8-4357-8895-83c96768b852.tmp
345fbf52-9d4b-4c92-9f7f-ea333d1ecfa3.tmp
612c967a-2dae-42a8-ad55-17cc1b64cb5b.tmp
b9f37322-f0a3-4cd4-906a-2bcc7ccad36d.tmp
f7b68ce9-3ec5-443b-88f5-90122d270822.tmp
e674009e-4239-48c2-99ee-f2610194f6e1.tmp
1a0d0b57-1d56-4102-90d9-9b93f6e5ce37.tmp
3e47892d-71ab-417d-a396-91af38a9616c.tmp
7717e44f-6165-4270-9cf1-9a3f13e92ab1.tmp
Client.exe
LICENSE.electron.txt
LICENSES.chromium.html
chrome_100_percent.pak
chrome_200_percent.pak
d3dcompiler_47.dll
ffmpeg.dll
icudtl.dat
libEGL.dll
libGLESv2.dll
af.pak
am.pak
ar.pak
bg.pak
bn.pak
ca.pak
cs.pak
da.pak
de.pak
el.pak
en-GB.pak
en-US.pak
es-419.pak
es.pak
et.pak
fa.pak
fi.pak
fil.pak
fr.pak
gu.pak
he.pak
hi.pak
hr.pak
hu.pak
id.pak
it.pak
ja.pak
kn.pak
ko.pak
lt.pak
lv.pak
ml.pak
mr.pak
ms.pak
nb.pak
nl.pak
pl.pak
pt-BR.pak
pt-PT.pak
ro.pak
ru.pak
sk.pak
sl.pak
sr.pak
sv.pak
sw.pak
ta.pak
te.pak
th.pak
tr.pak
uk.pak
ur.pak
vi.pak
zh-CN.pak
zh-TW.pak
resources.pak
binding.gyp
addon.obj
vcpkg.applocal.log
win_delay_load_hook.obj
xeno.node.recipe
CL.command.1.tlog
CL.read.1.tlog
CL.write.1.tlog
Cl.items.tlog
link.command.1.tlog
link.read.1.tlog
link.secondary.1.tlog
link.write.1.tlog
xeno.lastbuildstate
xeno.iobj
xeno.ipdb
xeno.node
config.gypi
xeno.vcxproj
xeno.vcxproj.filters
package.json
elevate.exe
Failed.png
Xeno.dll
Xeno.ico
api-ms-win-crt-convert-l1-1-0.dll
api-ms-win-crt-environment-l1-1-0.dll
api-ms-win-crt-filesystem-l1-1-0.dll
api-ms-win-crt-heap-l1-1-0.dll
api-ms-win-crt-locale-l1-1-0.dll
api-ms-win-crt-math-l1-1-0.dll
api-ms-win-crt-runtime-l1-1-0.dll
api-ms-win-crt-stdio-l1-1-0.dll
api-ms-win-crt-string-l1-1-0.dll
api-ms-win-crt-utility-l1-1-0.dll
concrt140.dll
index.html
libcrypto-3-x64.dll
libcurl.dll
libssl-3-x64.dll
msvcp140.dll
msvcp140_1.dll
msvcrt.dll
notification.mp3
ucrtbase.dll
vcruntime140.dll
vcruntime140_1.dll
zlib1.dll
snapshot_blob.bin
v8_context_snapshot.bin
vk_swiftshader.dll
vk_swiftshader_icd.json
vulkan-1.dll
StdUtils.dll
System.dll
nsis7z.dll
content.js
XENO_CACHE.bin
default.exc
data_0
data_1
data_2
data_3
CURRENT
Network Persistent State
f6e3406b-8757-4b8d-b58e-b92002918d58.tmp
manifest.json
manifest.json
manifest.json
manifest.json
LICENSE
manifest.json
manifest.json
manifest.json
xdwd.dll
memory/464-13-0x00007FFAEF4C0000-0x00007FFAEFE64000-memory.dmp
memory/464-19-0x00007FFAEF4C0000-0x00007FFAEFE64000-memory.dmp
memory/464-12-0x00000000009F0000-0x0000000000A82000-memory.dmp
memory/464-214-0x00007FFAEF4C0000-0x00007FFAEFE64000-memory.dmp
memory/916-789-0x00007FFB10390000-0x00007FFB10391000-memory.dmp
memory/916-788-0x00007FFB11630000-0x00007FFB11631000-memory.dmp
memory/5636-0-0x00007FFAEF64F000-0x00007FFAEF650000-memory.dmp
memory/5636-2-0x0000000000870000-0x0000000005D38000-memory.dmp
memory/5636-3-0x00007FFAEF4C0000-0x00007FFAEFE64000-memory.dmp
memory/5636-1-0x00007FFAEF4C0000-0x00007FFAEFE64000-memory.dmp
memory/5636-21-0x00007FFAEF4C0000-0x00007FFAEFE64000-memory.dmp
memory/5636-23-0x00007FFAEF4C0000-0x00007FFAEFE64000-memory.dmp
memory/5772-1430-0x00007FFB11630000-0x00007FFB11631000-memory.dmp
memory/6616-3103-0x000002BFD06F0000-0x000002BFD06F1000-memory.dmp
memory/6616-3108-0x000002BFD06F0000-0x000002BFD06F1000-memory.dmp
memory/6616-3109-0x000002BFD06F0000-0x000002BFD06F1000-memory.dmp
memory/6616-3110-0x000002BFD06F0000-0x000002BFD06F1000-memory.dmp
memory/6616-3111-0x000002BFD06F0000-0x000002BFD06F1000-memory.dmp
memory/6616-3112-0x000002BFD06F0000-0x000002BFD06F1000-memory.dmp
memory/6616-3107-0x000002BFD06F0000-0x000002BFD06F1000-memory.dmp
memory/6616-3101-0x000002BFD06F0000-0x000002BFD06F1000-memory.dmp