Analysis
- max time kernel
151s - max time network
159s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
20/10/2026, 19:09
General
- Target 2026-10-19_5dc214dca21b234e1db18c478addc12b_cryptbot_icedid_luca-stealer_njrat_stealc.exe
- Size 88.4MB
- Sample261020-xt3ghahs6q
- SHA256 5f4ec7021c325f1cf87d7793cab691adbcaf2df82419a6ab8b184b4f9879b5ef
Score
10/10
Malware Config
Signatures
- Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
- Detect SalatStealer payload 11 IoCs
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 11 IoCs
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 11 IoCs
- Detects executables (downlaoders) containing URLs to raw contents of a paste 1 IoCs
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers 11 IoCs
- UPX dump on OEP (original entry point) 13 IoCs
- Executes dropped EXE 10 IoCs
- Loads dropped DLL 31 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- UPX packed file 13 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies registry class 2 IoCs
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 5 IoCs
- Suspicious use of SendNotifyMessage 3 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_5dc214dca21b234e1db18c478addc12b_cryptbot_icedid_luca-stealer_njrat_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-19_5dc214dca21b234e1db18c478addc12b_cryptbot_icedid_luca-stealer_njrat_stealc.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Xeno=v1.3.60.exe"C:\Users\Admin\AppData\Local\Temp\Xeno=v1.3.60.exe"2⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno_v1.3.60.exe"C:\Users\Admin\AppData\Local\Temp\Xeno_v1.3.60.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3HX07FOBiyOg71948xsiFB0hHSJ\Xeno-v1.3.60.exeC:\Users\Admin\AppData\Local\Temp\3HX07FOBiyOg71948xsiFB0hHSJ\Xeno-v1.3.60.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3HX07FOBiyOg71948xsiFB0hHSJ\Xeno-v1.3.60.exe"C:\Users\Admin\AppData\Local\Temp\3HX07FOBiyOg71948xsiFB0hHSJ\Xeno-v1.3.60.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Xeno" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1664 --field-trial-handle=1668,i,6446436915222125935,11188616287012882905,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:24⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\3HX07FOBiyOg71948xsiFB0hHSJ\Xeno-v1.3.60.exe"C:\Users\Admin\AppData\Local\Temp\3HX07FOBiyOg71948xsiFB0hHSJ\Xeno-v1.3.60.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Xeno" --mojo-platform-channel-handle=2128 --field-trial-handle=1668,i,6446436915222125935,11188616287012882905,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:84⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\3HX07FOBiyOg71948xsiFB0hHSJ\Xeno-v1.3.60.exe"C:\Users\Admin\AppData\Local\Temp\3HX07FOBiyOg71948xsiFB0hHSJ\Xeno-v1.3.60.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Xeno" --app-user-model-id=Xeno --app-path="C:\Users\Admin\AppData\Local\Temp\3HX07FOBiyOg71948xsiFB0hHSJ\resources\app.asar" --enable-sandbox --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2324 --field-trial-handle=1668,i,6446436915222125935,11188616287012882905,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:14⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\3HX07FOBiyOg71948xsiFB0hHSJ\Xeno-v1.3.60.exe"C:\Users\Admin\AppData\Local\Temp\3HX07FOBiyOg71948xsiFB0hHSJ\Xeno-v1.3.60.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Xeno" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=3308 --field-trial-handle=1668,i,6446436915222125935,11188616287012882905,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:24⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\3HX07FOBiyOg71948xsiFB0hHSJ\Xeno-v1.3.60.exe"C:\Users\Admin\AppData\Local\Temp\3HX07FOBiyOg71948xsiFB0hHSJ\Xeno-v1.3.60.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Xeno" --mojo-platform-channel-handle=2964 --field-trial-handle=1668,i,6446436915222125935,11188616287012882905,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:84⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/xe-no4⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x314,0x7ff9afb4c188,0x7ff9afb4c194,0x7ff9afb4c1a05⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1652,i,290852865312115615,9667271527025410233,524288 --field-trial-handle=2320,i,18278328388679281702,121920550191101271,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:115⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1520,i,11036417279428587867,1242443420000665663,262144 --field-trial-handle=2320,i,18278328388679281702,121920550191101271,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:25⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2244,i,11570461333478100567,3491749445324564338,524288 --field-trial-handle=2320,i,18278328388679281702,121920550191101271,262144 --variations-seed-version --mojo-platform-channel-handle=2600 /prefetch:135⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3548,i,9157241468185076947,18132697673318237252,2097152 --field-trial-handle=2320,i,18278328388679281702,121920550191101271,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3552,i,2351604834285482769,14552091827368496879,2097152 --field-trial-handle=2320,i,18278328388679281702,121920550191101271,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4300,i,8233986475694400025,8820406710163785793,2097152 --field-trial-handle=2320,i,18278328388679281702,121920550191101271,262144 --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4312,i,702705200383763811,10967730133670831391,2097152 --field-trial-handle=2320,i,18278328388679281702,121920550191101271,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:95⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3572,i,8265199662375573815,3957614545769492302,524288 --field-trial-handle=2320,i,18278328388679281702,121920550191101271,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5456,i,48949069862230120,3351701130456575655,2097152 --field-trial-handle=2320,i,18278328388679281702,121920550191101271,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5444,i,14193397918118830120,4979195250476730197,524288 --field-trial-handle=2320,i,18278328388679281702,121920550191101271,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,17547017786826136398,16721141154278695359,524288 --field-trial-handle=2320,i,18278328388679281702,121920550191101271,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6152,i,13347356040360902419,7332973606711332129,524288 --field-trial-handle=2320,i,18278328388679281702,121920550191101271,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6152,i,13347356040360902419,7332973606711332129,524288 --field-trial-handle=2320,i,18278328388679281702,121920550191101271,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6436,i,5009265278376399994,9816806456471172216,524288 --field-trial-handle=2320,i,18278328388679281702,121920550191101271,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6624,i,7867195677847189598,15226331021925096776,524288 --field-trial-handle=2320,i,18278328388679281702,121920550191101271,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:145⤵
- Modifies registry class
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6620,i,10036704071825442218,4381991300347445619,524288 --field-trial-handle=2320,i,18278328388679281702,121920550191101271,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:125⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6428,i,5567908942118980226,8573673457948790367,524288 --field-trial-handle=2320,i,18278328388679281702,121920550191101271,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6608,i,11635591277571198740,5547292094124851724,524288 --field-trial-handle=2320,i,18278328388679281702,121920550191101271,262144 --variations-seed-version --mojo-platform-channel-handle=6552 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6500,i,9284786868487698265,186204332072812800,524288 --field-trial-handle=2320,i,18278328388679281702,121920550191101271,262144 --variations-seed-version --mojo-platform-channel-handle=6820 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6172,i,5583353654420135515,9709913698931207748,524288 --field-trial-handle=2320,i,18278328388679281702,121920550191101271,262144 --variations-seed-version --mojo-platform-channel-handle=7704 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7744,i,9948031432540171594,4988186647136234810,524288 --field-trial-handle=2320,i,18278328388679281702,121920550191101271,262144 --variations-seed-version --mojo-platform-channel-handle=7692 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7712,i,173596514422676260,11693309322245091596,524288 --field-trial-handle=2320,i,18278328388679281702,121920550191101271,262144 --variations-seed-version --mojo-platform-channel-handle=7572 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3680,i,17786973483494129366,1936145249848181575,524288 --field-trial-handle=2320,i,18278328388679281702,121920550191101271,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,7525573681814889388,8334663070840852807,524288 --field-trial-handle=2320,i,18278328388679281702,121920550191101271,262144 --variations-seed-version --mojo-platform-channel-handle=7652 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,4878657028498372526,7134566535603918955,524288 --field-trial-handle=2320,i,18278328388679281702,121920550191101271,262144 --variations-seed-version --mojo-platform-channel-handle=912 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7100,i,11942589815997717257,14754634946010098201,524288 --field-trial-handle=2320,i,18278328388679281702,121920550191101271,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7392,i,14930630656308780148,10737149321676848558,262144 --field-trial-handle=2320,i,18278328388679281702,121920550191101271,262144 --variations-seed-version --mojo-platform-channel-handle=7328 /prefetch:105⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Users\Admin\AppData\Local\Temp\3HX07FOBiyOg71948xsiFB0hHSJ\Xeno-v1.3.60.exe"C:\Users\Admin\AppData\Local\Temp\3HX07FOBiyOg71948xsiFB0hHSJ\Xeno-v1.3.60.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --user-data-dir="C:\Users\Admin\AppData\Roaming\Xeno" --mojo-platform-channel-handle=3624 --field-trial-handle=1668,i,6446436915222125935,11188616287012882905,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:84⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\3HX07FOBiyOg71948xsiFB0hHSJ\Xeno-v1.3.60.exe"C:\Users\Admin\AppData\Local\Temp\3HX07FOBiyOg71948xsiFB0hHSJ\Xeno-v1.3.60.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --user-data-dir="C:\Users\Admin\AppData\Roaming\Xeno" --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2700 --field-trial-handle=1668,i,6446436915222125935,11188616287012882905,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:24⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
13cc6779-23a0-4e56-afba-50b154e3442e.tmp
6a375391-9f3f-427d-8936-610858b16506.tmp
84d0fcfe-f37f-461f-8599-12e6c0295c13.tmp
9901f15b-de03-4964-9af8-ee7a3449e7e4.tmp
9d8db4d4-9e68-4669-8561-17d27f4eaa1c.tmp
settings.dat
settings.dat
4de84824-b1e9-4b2e-9158-1d163097fa70.tmp
6b913e3c-c631-4ec0-bf70-f3477ad79947.tmp
6df40175-b370-47bb-9abf-d65b9f815e28.tmp
temp-index
the-real-index
b8d5ca5b-4f2d-4f9a-b678-02192d44cc7c.tmp
dasherSettingSchema.json
50254910-3719-45b1-85a3-5c11765c550d.tmp
6df6e243-ce5a-48eb-9aa4-cf96464b6c20.tmp
d2cbf0f9-2f80-47ac-aa0b-5f29065dc439.tmp
index
index.txt
index.txt.tmp
index.txt.tmp
a72ad470-1b00-46ae-85b8-0b36ccb442c0.tmp
deda39d1-8d6b-40f7-b04e-2854ba32e651.tmp
8769f2b4-1038-4593-a517-02c6de3ced31.tmp
OperationConfig
Local State
19f568e0-4e86-41ff-a9f5-c0a01bc6ddea.tmp
222fcd92-25d9-402d-bb3e-62f22c4b4627.tmp
d49c2c31-003f-416b-b65a-06c74c698f74.tmp
3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
56bf876e-4e82-4d3e-b8cb-79bc711cd54f.tmp
metadata.json
5a50450f-0cfe-4706-9dae-6b82d04fe663.tmp
Xeno=v1.3.60.exe
e059a907-0b79-414b-a980-13cdc4536ccf.tmp
LICENSE.electron.txt
LICENSES.chromium.html
chrome_100_percent.pak
chrome_200_percent.pak
d3dcompiler_47.dll
ffmpeg.dll
icudtl.dat
libEGL.dll
libGLESv2.dll
af.pak
am.pak
ar.pak
bg.pak
bn.pak
ca.pak
cs.pak
da.pak
de.pak
el.pak
en-GB.pak
en-US.pak
es-419.pak
es.pak
et.pak
fa.pak
fi.pak
fil.pak
fr.pak
gu.pak
he.pak
hi.pak
hr.pak
hu.pak
id.pak
it.pak
ja.pak
kn.pak
ko.pak
lt.pak
lv.pak
ml.pak
mr.pak
ms.pak
nb.pak
nl.pak
pl.pak
pt-BR.pak
pt-PT.pak
ro.pak
ru.pak
sk.pak
sl.pak
sr.pak
sv.pak
sw.pak
ta.pak
te.pak
th.pak
tr.pak
uk.pak
ur.pak
vi.pak
zh-CN.pak
zh-TW.pak
resources.pak
binding.gyp
addon.obj
vcpkg.applocal.log
win_delay_load_hook.obj
xeno.node.recipe
CL.command.1.tlog
CL.read.1.tlog
CL.write.1.tlog
Cl.items.tlog
link.command.1.tlog
link.read.1.tlog
link.secondary.1.tlog
link.write.1.tlog
xeno.lastbuildstate
xeno.iobj
xeno.ipdb
xeno.node
config.gypi
xeno.vcxproj
xeno.vcxproj.filters
package.json
elevate.exe
Failed.png
Xeno.dll
Xeno.ico
api-ms-win-crt-convert-l1-1-0.dll
api-ms-win-crt-environment-l1-1-0.dll
api-ms-win-crt-filesystem-l1-1-0.dll
api-ms-win-crt-heap-l1-1-0.dll
api-ms-win-crt-locale-l1-1-0.dll
api-ms-win-crt-math-l1-1-0.dll
api-ms-win-crt-runtime-l1-1-0.dll
api-ms-win-crt-stdio-l1-1-0.dll
api-ms-win-crt-string-l1-1-0.dll
api-ms-win-crt-utility-l1-1-0.dll
concrt140.dll
index.html
libcrypto-3-x64.dll
libcurl.dll
libssl-3-x64.dll
msvcp140.dll
msvcp140_1.dll
msvcrt.dll
notification.mp3
ucrtbase.dll
vcruntime140.dll
vcruntime140_1.dll
zlib1.dll
snapshot_blob.bin
v8_context_snapshot.bin
vk_swiftshader.dll
vk_swiftshader_icd.json
vulkan-1.dll
StdUtils.dll
System.dll
nsis7z.dll
content.js
messages.json
XENO_CACHE.bin
default.exc
Xeno.lnk
data_0
data_1
data_2
data_3
CURRENT
02977f69-9198-4fdc-a90e-6ef3421d72c7.tmp
Network Persistent State
manifest.json
manifest.json
manifest.json
memory/2320-2257-0x00000231F4160000-0x00000231F4161000-memory.dmp
memory/2320-2251-0x00000231F4160000-0x00000231F4161000-memory.dmp
memory/2320-2249-0x00000231F4160000-0x00000231F4161000-memory.dmp
memory/2320-2255-0x00000231F4160000-0x00000231F4161000-memory.dmp
memory/2320-2260-0x00000231F4160000-0x00000231F4161000-memory.dmp
memory/2320-2259-0x00000231F4160000-0x00000231F4161000-memory.dmp
memory/2320-2258-0x00000231F4160000-0x00000231F4161000-memory.dmp
memory/2320-2256-0x00000231F4160000-0x00000231F4161000-memory.dmp
memory/3700-668-0x00007FF9D4490000-0x00007FF9D4491000-memory.dmp
memory/3700-667-0x00007FF9D38E0000-0x00007FF9D38E1000-memory.dmp
memory/4316-788-0x00007FF9D4370000-0x00007FF9D4371000-memory.dmp
memory/4812-2044-0x00000000003B0000-0x0000000001004000-memory.dmp
memory/4812-643-0x00000000003B0000-0x0000000001004000-memory.dmp
memory/4812-2247-0x00000000003B0000-0x0000000001004000-memory.dmp
memory/4812-2071-0x00000000003B0000-0x0000000001004000-memory.dmp
memory/4812-2208-0x00000000003B0000-0x0000000001004000-memory.dmp
memory/4812-2025-0x00000000003B0000-0x0000000001004000-memory.dmp
memory/4812-1982-0x00000000003B0000-0x0000000001004000-memory.dmp
memory/4812-635-0x00000000003B0000-0x0000000001004000-memory.dmp
memory/4812-2229-0x00000000003B0000-0x0000000001004000-memory.dmp
memory/4812-991-0x00000000003B0000-0x0000000001004000-memory.dmp
memory/4812-2152-0x00000000003B0000-0x0000000001004000-memory.dmp
memory/4812-15-0x00000000003B0000-0x0000000001004000-memory.dmp