Trojan.Siggen32.60731

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

<SYSTEM32>\tasks\tmpxnuthk4i

Malicious functions

To complicate detection of its presence in the operating system,

adds antivirus exclusion:

'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass "Add-MpPreference -ExclusionProcess '%APPDATA%\PlatformRuntime\tmpxnuthk4i.exe'"

Injects code into

the following user processes:

xeno-v1.3.55.exe

Modifies file system

Creates the following files

%TEMP%\_mei40682\vcruntime140.dll
%TEMP%\_mei40682\_bz2.pyd
%TEMP%\_mei40682\_decimal.pyd
%TEMP%\_mei40682\_hashlib.pyd
%TEMP%\_mei40682\_lzma.pyd
%TEMP%\_mei40682\_socket.pyd
%TEMP%\_mei40682\base_library.zip
%TEMP%\_mei40682\libcrypto-1_1.dll
%TEMP%\_mei40682\python310.dll
%TEMP%\_mei40682\select.pyd
%TEMP%\_mei40682\unicodedata.pyd
%TEMP%\76am9iz3
%TEMP%\tmp1zbq82no.exe
%TEMP%\tmpxnuthk4i.exe
%TEMP%\nsp947c.tmp\system.dll
%TEMP%\costura\950bdad80d65ea7fc5fd07f1244f1737\aforge.dll
%TEMP%\costura\950bdad80d65ea7fc5fd07f1244f1737\aforge.video.directshow.dll
%TEMP%\costura\950bdad80d65ea7fc5fd07f1244f1737\aforge.video.dll
%TEMP%\costura\950bdad80d65ea7fc5fd07f1244f1737\costura.dll
%TEMP%\nsp947c.tmp\app-64.7z
%TEMP%\costura\950bdad80d65ea7fc5fd07f1244f1737\microsoft.win32.registry.dll
%TEMP%\costura\950bdad80d65ea7fc5fd07f1244f1737\naudio.asio.dll
%TEMP%\costura\950bdad80d65ea7fc5fd07f1244f1737\naudio.core.dll
%TEMP%\costura\950bdad80d65ea7fc5fd07f1244f1737\naudio.dll
%TEMP%\costura\950bdad80d65ea7fc5fd07f1244f1737\naudio.midi.dll
%TEMP%\costura\950bdad80d65ea7fc5fd07f1244f1737\naudio.wasapi.dll
%TEMP%\costura\950bdad80d65ea7fc5fd07f1244f1737\naudio.winforms.dll
%TEMP%\costura\950bdad80d65ea7fc5fd07f1244f1737\naudio.winmm.dll
%TEMP%\costura\950bdad80d65ea7fc5fd07f1244f1737\newtonsoft.json.dll
%TEMP%\costura\950bdad80d65ea7fc5fd07f1244f1737\stuff.dll
%TEMP%\costura\950bdad80d65ea7fc5fd07f1244f1737\system.buffers.dll
%TEMP%\costura\950bdad80d65ea7fc5fd07f1244f1737\system.memory.dll
%TEMP%\costura\950bdad80d65ea7fc5fd07f1244f1737\system.numerics.vectors.dll
%TEMP%\costura\950bdad80d65ea7fc5fd07f1244f1737\system.resources.extensions.dll
%TEMP%\costura\950bdad80d65ea7fc5fd07f1244f1737\system.runtime.compilerservices.unsafe.dll
%TEMP%\costura\950bdad80d65ea7fc5fd07f1244f1737\system.security.accesscontrol.dll
%TEMP%\costura\950bdad80d65ea7fc5fd07f1244f1737\system.security.principal.windows.dll
%APPDATA%\platformruntime\tmpxnuthk4i.exe
%APPDATA%\temp\cleanup_uar9j1gtiupd0ffaiv7ldtwqkeo3k0.bat
nul
%TEMP%\nsp947c.tmp\nsis7z.dll
%LOCALAPPDATA%\microsoft\clr_v4.0\usagelogs\tmpxnuthk4i.exe.log
%TEMP%\nsp947c.tmp\7z-out\chrome_100_percent.pak
%TEMP%\nsp947c.tmp\7z-out\chrome_200_percent.pak
%TEMP%\nsp947c.tmp\7z-out\icudtl.dat
%TEMP%\nsp947c.tmp\7z-out\license.electron.txt
%TEMP%\nsp947c.tmp\7z-out\licenses.chromium.html
%TEMP%\nsp947c.tmp\7z-out\locales\af.pak
%TEMP%\nsp947c.tmp\7z-out\locales\am.pak
%TEMP%\nsp947c.tmp\7z-out\locales\ar.pak
%TEMP%\nsp947c.tmp\7z-out\locales\bg.pak
%TEMP%\nsp947c.tmp\7z-out\locales\bn.pak
%TEMP%\nsp947c.tmp\7z-out\locales\ca.pak
%TEMP%\nsp947c.tmp\7z-out\locales\cs.pak
%TEMP%\nsp947c.tmp\7z-out\locales\da.pak
%TEMP%\nsp947c.tmp\7z-out\locales\de.pak
%TEMP%\nsp947c.tmp\7z-out\locales\el.pak
%TEMP%\nsp947c.tmp\7z-out\locales\en-gb.pak
%TEMP%\nsp947c.tmp\7z-out\locales\en-us.pak
%TEMP%\nsp947c.tmp\7z-out\locales\es-419.pak
%TEMP%\nsp947c.tmp\7z-out\locales\es.pak
%TEMP%\nsp947c.tmp\7z-out\locales\et.pak
%TEMP%\nsp947c.tmp\7z-out\locales\fa.pak
%TEMP%\nsp947c.tmp\7z-out\locales\fi.pak
%TEMP%\nsp947c.tmp\7z-out\locales\fil.pak
%TEMP%\nsp947c.tmp\7z-out\locales\fr.pak
%TEMP%\nsp947c.tmp\7z-out\locales\gu.pak
%TEMP%\nsp947c.tmp\7z-out\locales\he.pak
%TEMP%\nsp947c.tmp\7z-out\locales\hi.pak
%TEMP%\nsp947c.tmp\7z-out\locales\hr.pak
%TEMP%\nsp947c.tmp\7z-out\locales\hu.pak
%TEMP%\nsp947c.tmp\7z-out\locales\id.pak
%TEMP%\nsp947c.tmp\7z-out\locales\it.pak
%TEMP%\nsp947c.tmp\7z-out\locales\ja.pak
%TEMP%\nsp947c.tmp\7z-out\locales\kn.pak
%TEMP%\nsp947c.tmp\7z-out\locales\ko.pak
%TEMP%\nsp947c.tmp\7z-out\locales\lt.pak
%TEMP%\nsp947c.tmp\7z-out\locales\lv.pak
%TEMP%\nsp947c.tmp\7z-out\locales\ml.pak
%TEMP%\nsp947c.tmp\7z-out\locales\mr.pak
%TEMP%\nsp947c.tmp\7z-out\locales\ms.pak
%TEMP%\nsp947c.tmp\7z-out\locales\nb.pak
%TEMP%\nsp947c.tmp\7z-out\locales\nl.pak
%TEMP%\nsp947c.tmp\7z-out\locales\pl.pak
%TEMP%\nsp947c.tmp\7z-out\locales\pt-br.pak
%TEMP%\nsp947c.tmp\7z-out\locales\pt-pt.pak
%TEMP%\nsp947c.tmp\7z-out\locales\ro.pak
%TEMP%\nsp947c.tmp\7z-out\locales\ru.pak
%TEMP%\nsp947c.tmp\7z-out\locales\sk.pak
%TEMP%\nsp947c.tmp\7z-out\locales\sl.pak
%TEMP%\nsp947c.tmp\7z-out\locales\sr.pak
%TEMP%\nsp947c.tmp\7z-out\locales\sv.pak
%TEMP%\nsp947c.tmp\7z-out\locales\sw.pak
%TEMP%\nsp947c.tmp\7z-out\locales\ta.pak
%TEMP%\nsp947c.tmp\7z-out\locales\te.pak
%TEMP%\nsp947c.tmp\7z-out\locales\th.pak
%TEMP%\nsp947c.tmp\7z-out\locales\tr.pak
%TEMP%\nsp947c.tmp\7z-out\locales\uk.pak
%TEMP%\nsp947c.tmp\7z-out\locales\ur.pak
%TEMP%\nsp947c.tmp\7z-out\locales\vi.pak
%TEMP%\nsp947c.tmp\7z-out\locales\zh-cn.pak
%TEMP%\nsp947c.tmp\7z-out\locales\zh-tw.pak
%TEMP%\nsp947c.tmp\7z-out\resources\app.asar
%TEMP%\nsp947c.tmp\7z-out\resources\app.asar.unpacked\native\xeno-addon\binding.gyp
%TEMP%\nsp947c.tmp\7z-out\resources\app.asar.unpacked\native\xeno-addon\build\config.gypi
%TEMP%\nsp947c.tmp\7z-out\resources\app.asar.unpacked\native\xeno-addon\build\release\obj\xeno\src\addon.obj
%TEMP%\nsp947c.tmp\7z-out\resources\app.asar.unpacked\native\xeno-addon\build\release\obj\xeno\vcpkg.applocal.log
%TEMP%\nsp947c.tmp\7z-out\resources\app.asar.unpacked\native\xeno-addon\build\release\obj\xeno\win_delay_load_hook.obj
%TEMP%\nsp947c.tmp\7z-out\resources\app.asar.unpacked\native\xeno-addon\build\release\obj\xeno\xeno.node.recipe
%TEMP%\nsp947c.tmp\7z-out\resources\app.asar.unpacked\native\xeno-addon\build\release\obj\xeno\xeno.tlog\cl.command.1.tlog
%TEMP%\nsp947c.tmp\7z-out\resources\app.asar.unpacked\native\xeno-addon\build\release\obj\xeno\xeno.tlog\cl.items.tlog
%TEMP%\nsp947c.tmp\7z-out\resources\app.asar.unpacked\native\xeno-addon\build\release\obj\xeno\xeno.tlog\cl.read.1.tlog
%TEMP%\nsp947c.tmp\7z-out\resources\app.asar.unpacked\native\xeno-addon\build\release\obj\xeno\xeno.tlog\cl.write.1.tlog
%TEMP%\nsp947c.tmp\7z-out\resources\app.asar.unpacked\native\xeno-addon\build\release\obj\xeno\xeno.tlog\link.command.1.tlog
%TEMP%\nsp947c.tmp\7z-out\resources\app.asar.unpacked\native\xeno-addon\build\release\obj\xeno\xeno.tlog\link.read.1.tlog
%TEMP%\nsp947c.tmp\7z-out\resources\app.asar.unpacked\native\xeno-addon\build\release\obj\xeno\xeno.tlog\link.secondary.1.tlog
%TEMP%\nsp947c.tmp\7z-out\resources\app.asar.unpacked\native\xeno-addon\build\release\obj\xeno\xeno.tlog\link.write.1.tlog
%TEMP%\nsp947c.tmp\7z-out\resources\app.asar.unpacked\native\xeno-addon\build\release\obj\xeno\xeno.tlog\xeno.lastbuildstate
%TEMP%\nsp947c.tmp\7z-out\resources\app.asar.unpacked\native\xeno-addon\build\release\xeno.iobj
%TEMP%\nsp947c.tmp\7z-out\resources\app.asar.unpacked\native\xeno-addon\build\release\xeno.ipdb
%TEMP%\nsp947c.tmp\7z-out\resources\app.asar.unpacked\native\xeno-addon\build\release\xeno.node
%TEMP%\nsp947c.tmp\7z-out\resources\app.asar.unpacked\native\xeno-addon\build\xeno.vcxproj
%TEMP%\nsp947c.tmp\7z-out\resources\app.asar.unpacked\native\xeno-addon\build\xeno.vcxproj.filters
%TEMP%\nsp947c.tmp\7z-out\resources\app.asar.unpacked\native\xeno-addon\package.json
%TEMP%\nsp947c.tmp\7z-out\resources\public\failed.png
%TEMP%\nsp947c.tmp\7z-out\resources\public\index.html
%TEMP%\nsp947c.tmp\7z-out\resources\public\notification.mp3
%TEMP%\nsp947c.tmp\7z-out\resources\public\xeno.ico
%TEMP%\nsp947c.tmp\7z-out\resources.pak
%TEMP%\nsp947c.tmp\7z-out\snapshot_blob.bin
%TEMP%\nsp947c.tmp\7z-out\v8_context_snapshot.bin
%TEMP%\nsp947c.tmp\7z-out\vk_swiftshader_icd.json
%TEMP%\nsp947c.tmp\7z-out\d3dcompiler_47.dll
%TEMP%\nsp947c.tmp\7z-out\ffmpeg.dll
%TEMP%\nsp947c.tmp\7z-out\libegl.dll
%TEMP%\nsp947c.tmp\7z-out\libglesv2.dll
%TEMP%\nsp947c.tmp\7z-out\resources\elevate.exe
%TEMP%\nsp947c.tmp\7z-out\resources\public\api-ms-win-crt-convert-l1-1-0.dll
%TEMP%\nsp947c.tmp\7z-out\resources\public\api-ms-win-crt-environment-l1-1-0.dll
%TEMP%\nsp947c.tmp\7z-out\resources\public\api-ms-win-crt-filesystem-l1-1-0.dll
%TEMP%\nsp947c.tmp\7z-out\resources\public\api-ms-win-crt-heap-l1-1-0.dll
%TEMP%\nsp947c.tmp\7z-out\resources\public\api-ms-win-crt-locale-l1-1-0.dll
%TEMP%\nsp947c.tmp\7z-out\resources\public\api-ms-win-crt-math-l1-1-0.dll
%TEMP%\nsp947c.tmp\7z-out\resources\public\api-ms-win-crt-runtime-l1-1-0.dll
%TEMP%\nsp947c.tmp\7z-out\resources\public\api-ms-win-crt-stdio-l1-1-0.dll
%TEMP%\nsp947c.tmp\7z-out\resources\public\api-ms-win-crt-string-l1-1-0.dll
%TEMP%\nsp947c.tmp\7z-out\resources\public\api-ms-win-crt-utility-l1-1-0.dll
%TEMP%\nsp947c.tmp\7z-out\resources\public\concrt140.dll
%TEMP%\nsp947c.tmp\7z-out\resources\public\libcrypto-3-x64.dll
%TEMP%\nsp947c.tmp\7z-out\resources\public\libcurl.dll
%TEMP%\nsp947c.tmp\7z-out\resources\public\libssl-3-x64.dll
%TEMP%\nsp947c.tmp\7z-out\resources\public\msvcp140.dll
%TEMP%\nsp947c.tmp\7z-out\resources\public\msvcp140_1.dll
%TEMP%\nsp947c.tmp\7z-out\resources\public\msvcrt.dll
%TEMP%\nsp947c.tmp\7z-out\resources\public\ucrtbase.dll
%TEMP%\nsp947c.tmp\7z-out\resources\public\vcruntime140.dll
%TEMP%\nsp947c.tmp\7z-out\resources\public\vcruntime140_1.dll
%TEMP%\nsp947c.tmp\7z-out\resources\public\xeno.dll
%TEMP%\nsp947c.tmp\7z-out\resources\public\zlib1.dll
%TEMP%\nsp947c.tmp\7z-out\vk_swiftshader.dll
%TEMP%\nsp947c.tmp\7z-out\vulkan-1.dll
%TEMP%\nsp947c.tmp\7z-out\xeno-v1.3.55.exe
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\chrome_100_percent.pak
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\chrome_200_percent.pak
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\d3dcompiler_47.dll
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\ffmpeg.dll
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\icudtl.dat
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\libegl.dll
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\libglesv2.dll
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\license.electron.txt
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\licenses.chromium.html
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\resources.pak
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\snapshot_blob.bin
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\v8_context_snapshot.bin
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\vk_swiftshader.dll
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\vk_swiftshader_icd.json
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\vulkan-1.dll
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\xeno-v1.3.55.exe
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\locales\af.pak
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\locales\am.pak
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\locales\ar.pak
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\locales\bg.pak
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\locales\bn.pak
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\locales\ca.pak
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\locales\cs.pak
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\locales\da.pak
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\locales\de.pak
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\locales\el.pak
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\locales\en-gb.pak
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\locales\en-us.pak
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\locales\es-419.pak
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\locales\es.pak
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\locales\et.pak
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\locales\fa.pak
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\locales\fi.pak
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\locales\fil.pak
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\locales\fr.pak
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\locales\gu.pak
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\locales\he.pak
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\locales\hi.pak
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\locales\hr.pak
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\locales\hu.pak
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\locales\id.pak
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\locales\it.pak
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\locales\ja.pak
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\locales\kn.pak
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\locales\ko.pak
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\locales\lt.pak
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\locales\lv.pak
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\locales\ml.pak
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\locales\mr.pak
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\locales\ms.pak
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\locales\nb.pak
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\locales\nl.pak
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\locales\pl.pak
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\locales\pt-br.pak
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\locales\pt-pt.pak
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\locales\ro.pak
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\locales\ru.pak
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\locales\sk.pak
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\locales\sl.pak
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\locales\sr.pak
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\locales\sv.pak
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\locales\sw.pak
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\locales\ta.pak
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\locales\te.pak
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\locales\th.pak
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\locales\tr.pak
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\locales\uk.pak
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\locales\ur.pak
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\locales\vi.pak
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\locales\zh-cn.pak
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\locales\zh-tw.pak
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\resources\app.asar
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\resources\elevate.exe
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\resources\app.asar.unpacked\native\xeno-addon\binding.gyp
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\resources\app.asar.unpacked\native\xeno-addon\package.json
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\resources\app.asar.unpacked\native\xeno-addon\build\config.gypi
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\resources\app.asar.unpacked\native\xeno-addon\build\xeno.vcxproj
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\resources\app.asar.unpacked\native\xeno-addon\build\xeno.vcxproj.filters
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\resources\app.asar.unpacked\native\xeno-addon\build\release\xeno.iobj
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\resources\app.asar.unpacked\native\xeno-addon\build\release\xeno.ipdb
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\resources\app.asar.unpacked\native\xeno-addon\build\release\xeno.node
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\resources\app.asar.unpacked\native\xeno-addon\build\release\obj\xeno\vcpkg.applocal.log
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\resources\app.asar.unpacked\native\xeno-addon\build\release\obj\xeno\win_delay_load_hook.obj
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\resources\app.asar.unpacked\native\xeno-addon\build\release\obj\xeno\xeno.node.recipe
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\resources\app.asar.unpacked\native\xeno-addon\build\release\obj\xeno\src\addon.obj
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\resources\app.asar.unpacked\native\xeno-addon\build\release\obj\xeno\xeno.tlog\cl.command.1.tlog
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\resources\app.asar.unpacked\native\xeno-addon\build\release\obj\xeno\xeno.tlog\cl.items.tlog
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\resources\app.asar.unpacked\native\xeno-addon\build\release\obj\xeno\xeno.tlog\cl.read.1.tlog
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\resources\app.asar.unpacked\native\xeno-addon\build\release\obj\xeno\xeno.tlog\cl.write.1.tlog
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\resources\app.asar.unpacked\native\xeno-addon\build\release\obj\xeno\xeno.tlog\link.command.1.tlog
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\resources\app.asar.unpacked\native\xeno-addon\build\release\obj\xeno\xeno.tlog\link.read.1.tlog
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\resources\app.asar.unpacked\native\xeno-addon\build\release\obj\xeno\xeno.tlog\link.secondary.1.tlog
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\resources\app.asar.unpacked\native\xeno-addon\build\release\obj\xeno\xeno.tlog\link.write.1.tlog
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\resources\app.asar.unpacked\native\xeno-addon\build\release\obj\xeno\xeno.tlog\xeno.lastbuildstate
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\resources\public\api-ms-win-crt-convert-l1-1-0.dll
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\resources\public\api-ms-win-crt-environment-l1-1-0.dll
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\resources\public\api-ms-win-crt-filesystem-l1-1-0.dll
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\resources\public\api-ms-win-crt-heap-l1-1-0.dll
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\resources\public\api-ms-win-crt-locale-l1-1-0.dll
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\resources\public\api-ms-win-crt-math-l1-1-0.dll
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\resources\public\api-ms-win-crt-runtime-l1-1-0.dll
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\resources\public\api-ms-win-crt-stdio-l1-1-0.dll
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\resources\public\api-ms-win-crt-string-l1-1-0.dll
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\resources\public\api-ms-win-crt-utility-l1-1-0.dll
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\resources\public\concrt140.dll
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\resources\public\failed.png
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\resources\public\index.html
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\resources\public\libcrypto-3-x64.dll
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\resources\public\libcurl.dll
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\resources\public\libssl-3-x64.dll
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\resources\public\msvcp140.dll
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\resources\public\msvcp140_1.dll
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\resources\public\msvcrt.dll
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\resources\public\notification.mp3
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\resources\public\ucrtbase.dll
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\resources\public\vcruntime140.dll
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\resources\public\vcruntime140_1.dll
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\resources\public\xeno.dll
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\resources\public\xeno.ico
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\resources\public\zlib1.dll
%TEMP%\nsp947c.tmp\stdutils.dll
%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\logs\2026-06-25_17-53-29.log
%APPDATA%\xeno\local storage\leveldb\log
%APPDATA%\xeno\local storage\leveldb\manifest-000001
%APPDATA%\xeno\local storage\leveldb\000001.dbtmp
%APPDATA%\xeno\code cache\wasm\index
%APPDATA%\xeno\code cache\js\index
%APPDATA%\xeno\code cache\js\index-dir\temp-index
%APPDATA%\xeno\code cache\wasm\index-dir\temp-index
%APPDATA%\xeno\gpucache\index
%APPDATA%\xeno\gpucache\data_0
%APPDATA%\xeno\gpucache\data_1
%APPDATA%\xeno\gpucache\data_2
%APPDATA%\xeno\gpucache\data_3
%APPDATA%\xeno\dawncache\index
%APPDATA%\xeno\dawncache\data_0
%APPDATA%\xeno\dawncache\data_1
%APPDATA%\xeno\dawncache\data_2
%APPDATA%\xeno\dawncache\data_3
%APPDATA%\microsoft\windows\start menu\programs\xeno.lnk
%LOCALAPPDATA%\xeno\xeno_cache.bin
%APPDATA%\microsoft\spelling\en-us\default.dic
%APPDATA%\microsoft\spelling\en-us\default.exc
%APPDATA%\microsoft\spelling\en-us\default.acl
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6a3dcd8d-acc.pma
%LOCALAPPDATA%\xeno\settings.json
%APPDATA%\xeno\cache\cache_data\index
%APPDATA%\xeno\cache\cache_data\data_0
%APPDATA%\xeno\cache\cache_data\data_1
%APPDATA%\xeno\cache\cache_data\data_2
%APPDATA%\xeno\cache\cache_data\data_3
%APPDATA%\xeno\network\cookies-journal
%APPDATA%\xeno\network\cookies
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6a3dcd91-5e0.pma
%APPDATA%\xeno\6500eae6-4135-4836-a54d-acb36bd71171.tmp
%APPDATA%\xeno\local storage\leveldb\000003.log
%LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000002
%LOCALAPPDATA%\microsoft\edge\user data\default\000002.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\log
%APPDATA%\xeno\6892fd4b-a94f-4015-8e4c-8642e65e2b2f.tmp
%LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\index
%LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_0
%LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_2
%LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_3
%LOCALAPPDATA%\microsoft\edge\user data\default\cookies-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\cookies
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\index
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_0
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_2
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_3
%LOCALAPPDATA%\microsoft\edge\user data\default\session storage\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\session storage\log
%LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000003.log
%LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\log
%LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000003.log
%LOCALAPPDATA%\microsoft\edge\user data\default\reporting and nel-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\reporting and nel
%APPDATA%\xeno\network\a8972531-3c97-4785-b9a9-550f3811c10d.tmp
%APPDATA%\xeno\network\7f27a6e2-ec9a-41fd-baaf-0e8d7126c956.tmp
%APPDATA%\xeno\network\a0e86feb-1973-46b4-be13-77bcec736c1a.tmp
%LOCALAPPDATA%\microsoft\edge\user data\default\extension state\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\extension state\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\extension state\log
%LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\manifest-000004
%LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\000004.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\shortcuts-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\shortcuts
%LOCALAPPDATA%\microsoft\edge\user data\default\network action predictor-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\network action predictor
%LOCALAPPDATA%\microsoft\edge\user data\last browser
%LOCALAPPDATA%\microsoft\edge\user data\default\preferredapps
%LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\log
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\log
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\log
%LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\log
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\000003.log
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000001
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000002
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000003
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000004
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000005
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000006
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\c1284440b6660268_0
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000007
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\948a8cfa21785056_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\f0fefd91b632e2d5_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\460430657b864140_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\fe34d49fb5a64b2d_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\d64f909153ecaa03_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\e8ee30ae83ea4522_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\b05ec9fab81ffb5e_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\e4d66e3bcd0dc442_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\6d896ad9e26d8d24_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\92a1c0efec8cc399_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\9b533952f80ab0e6_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\0fa11cd3c4b38eb0_0
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000008
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\e091217463cf2a57_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\1316120dc888f7fd_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\600c9e0e47d7b3fb_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\ea50a718a9e40be3_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\2bf8fff8187d2afe_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\fe813e47d046597a_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\098d72dc51bd4ae0_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\21c355c4b59a1487_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\2cdd71c50843523f_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\f5ec6e1bef98172f_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\caba2e888327334c_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\8bd96a2b2c15179b_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\f0c28c7870e21cc3_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\71ff9969ebc44a58_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\ea408b2d67e6e120_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\b29d29f4b6d7bbfc_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\7c183c0f69d0dff5_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\b498f59d4119c126_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\03527e21ff9cae39_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\00dd29e2060cc171_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\c6d6e4d91923c351_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\57dc6cbefb95778e_0
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000009
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00000a
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\72d61b63f7fafd17_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\bcc0b41bbfc84663_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\c3c8133f1449463a_0
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00000b
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00000c
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\106666c328093fda_0
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00000d
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00000e
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\0b0f4b20917bca0d_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\7d82d5dd49c7c9cb_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\92a040dda94022c0_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\6b51560327c5f82c_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\7866dc5cec47c81b_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\5e488290a125b3e9_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\e3ae698cbb4a3aed_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\57c527440a89936a_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\fd95dcbe3d10fafc_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\75ee3abc3a4b76ad_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\4922cec826a0555c_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\09e08d1f21ce024a_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\83211c70f754dfca_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\c0bf19dce998b845_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\ccdb9881eda18293_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\2fde948c8efe3b49_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\45cb541ae1016974_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\f9ae1be628af196c_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\8b046a9ee4752730_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\6c845d50636c9bcd_0
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00000f
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\930d94892c60bc59_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\da32d4d097500e58_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\6f5030415a622670_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\89919cd063a3d912_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\a31fe6e7aac2d828_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\4d2f54560a6413b9_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\daf7ae542c25cc2a_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\56a60ce272342ab0_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\bf4839226e20e5dc_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\403c1d3de5acaf33_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\afbd01e740f08ba3_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\c2798553138e2c42_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\07d917c49d833a66_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\7e1fd8fe71851a34_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\96abf6dcc3640f3e_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\9f1257cf127ed1c3_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\70b420f0b4c223b0_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\51073b50c826c1d5_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\7dbe07584fcc143f_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\a4d2bae030f0bde6_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\9585de25de2a3ce5_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\008576397601f4f3_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\b40d61f0b406bda1_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\f8ada96193583a16_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\c21ecf33b8aa7393_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\15a254b148503a01_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\c86383d2c56d8eac_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\c9c14d1c2447cbfb_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\5f33652ccf310776_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\0038b2919f07444c_0
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000010
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\5f16fc4cf18326dc_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\fb9afebf0e324a47_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\09ea470a69c0b578_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\077873fd10318e01_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\e9b5ce69e9e0844b_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\93065ea6ed021d46_0
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000011
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\d669a2b0bc0d1be8_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\326b9118341470c2_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\fca73c33117db4b0_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\c9fea6ee1d6fe1b4_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\ec946798aa0fe4b4_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\912eb175d47179c1_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\3ea58f2f194a917d_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\e7ee64ac274a6ada_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\968d79cc1a5c0896_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\3f82455e8890cffe_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\c05b886dca0d4b7e_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\a285c66c211c52ae_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\6ac1a0283dcd5586_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\eed9ee6db235d264_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\b22da731cccfbe7e_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\dbc06f21b152d1a2_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\4972d3f551308dc4_0
%TEMP%\39f665ad-0986-43d5-81ae-4622a979e98a.tmp
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\75b2c0be4541e586_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\f08ad67c87939241_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\2cdae328d63719e8_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\aca0485dee872383_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\f02931ba3f7ec069_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\81ff9622c9657d07_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\ef1ed1af046cc866_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\40bf247f10fa8939_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\fbef29f3ab140e5e_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\5d72ec6c2a51b293_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\f1e27a4638f804fd_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\b58597f22cd06b3a_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\f3d1a3e6ae7f4220_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\baa8676a244435fd_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\aa018248e733fabd_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\0b0ec8d6cefc6196_0
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000012
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\131fd6561951775c_0
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000013
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\12d70bb21428ada9_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\11087d822988a820_0
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000014
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\c3e18cfcc07b9274_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\107240aa6d57135b_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\46a29b8322be5720_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\ff8d3079f003dd89_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\a54b25b3e68ba504_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\3d66e6f93cbf05d1_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\4d8613779c2f7bc8_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\6ba76a9a3445cd50_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\e9e115a7c39c0454_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\7a6223746a796b9e_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\aaad37f157df431d_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\63913bb8863b667d_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\ad875c2ac3e3d3d4_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\688ed937657668ae_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\efcae8e4f953f8f3_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\88e89d59491d6444_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\c7f5b79135ecbf2e_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\3986be37fed1801a_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\647cc4246b3827d1_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\9711a6c1a91160a4_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\3e363e3f55371096_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\3caa68a946659465_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\b5704f4fb64b6f3d_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\97a838013a62edd0_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\306a9f812befcab5_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\b5c361f2482ce2f5_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\85ee95c0be6cea0e_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\5f2f23e0ea4c7834_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\abb48dd55496c93e_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\3bb0d080d74557ca_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\e73df993ab8f326e_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\d7fe1d238cc0d653_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\d85ca4a264e2968f_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\1503d8aa68d550f3_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\ec5c7e3fe03e4bbf_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\eec7a035205fd7bb_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\6abdbfe43e06688a_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\8e3c9f15aa8ccb62_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\2a824aa0c6249ec5_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\56ef4fe4b5ee4d77_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\9b8c8ec3d4a05f5e_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\b3f19c1af110995e_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\43fc75f6b642af9d_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\226277f9b570ea7e_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\a92d29ed5a42f841_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\1d641f02ff6422ea_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\ae1f9ccf56898adf_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\c4872877c4e6a15a_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\3ffa10981993ede4_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\9e306105bc262e07_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\c4f11744888335a1_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\2dfb9f78e3eaf62d_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\bddf8a93792b47c2_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\9dc4dccedd473dfb_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\d42aa67f232ad873_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\ed4931ed4dc29f90_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\59e2a0301c8b62e7_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\b6408d2ed2a3ec35_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\0f67bf0b5f107f7c_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\6dc354f546f1065d_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\133c54641483f83a_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\2f356fa8fddad59b_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\330d1a5c9b1142c0_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\58340824fe68250d_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\9ae46f4bbc90bcf4_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\aa1ea7003ad0060a_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\cffedccf8a732c9e_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\b437db0150459fc5_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\71fe7b748ab14b78_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\83cee4f0248bebb4_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\156acd3564d51b17_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\d19c675be3914016_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\b90d1f318846a3de_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\74f0ad3211746292_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\faa0c22865e982cf_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\9b884cc2a94e3f27_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\2877ebd7b98f9762_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\a56216f821825327_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\cbcb9494b3883cc5_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\0f658b5d69214b33_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\7d4fbcd3ca50fede_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\3f0e1790012619ef_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\4930fcd52be6218e_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\f3ef7c0bf0122c07_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\4fa4c824ad0078f8_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\36b049d3f8071d1c_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\4c5783150682db00_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\304fdc3d6362749d_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\b9d19d04046a881c_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\cbf7ed86a1895621_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\5b2263b1228871d2_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\1d2049bbf6b32b71_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\bcfcf9fdcbad6c2a_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\fcd666f85dcbd37f_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\c0fbb82f890d22c1_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\330079bc1398b8ff_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\29a865c2bb326fbb_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\a8804d4c16afa0e9_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\4f66bd3474fc1a98_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\02088b6f009d55cf_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\707e30eb57fb30fa_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\f2fde30273660d13_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\c7613c95750ffe77_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\7f50babcefdfdd54_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\00d526c9e5d044bc_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\162cde29ae9594e2_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\5b4028671ecd4c8e_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\e4ca39073aa3a26e_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\1545c8dbf37d61a2_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\a5c80b9a43ea9d2f_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\0db1b4ca0af9d25d_0
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000015
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\5d5ee1e11b9b8b10_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\529f72f04d63f983_0
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000016
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\28e5643ca0139d22_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\69d2ee32c20ac271_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\1d1253dbfcb063e0_0
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000017
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000018
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000019
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00001a
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00001b
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\a313107b0b57176f_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\2c3272d727f042e4_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\25746e4185e6fde2_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\e80aff0431236020_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\cd3ef5bc885c87a9_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\1007aed921cbbf22_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\bb6b31b3037a8cac_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\51e50b03cb89ac86_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\b99e5179b5174ba4_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\fa82e8a627ac7c9b_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\3be0943e777ede5f_0
%LOCALAPPDATA%\microsoft\edge\user data\functional data-wal
%LOCALAPPDATA%\microsoft\edge\user data\functional san data-wal
%TEMP%\219d1f89-163b-4cd3-92a5-a79bc34a9982.tmp
%APPDATA%\xeno\network\7653a41f-98cd-4116-8eea-c1c8a6f8332d.tmp
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00001c
%APPDATA%\xeno\network\674e1048-e6df-44fe-8f63-c3f9c0795e4e.tmp

Sets the 'hidden' attribute to the following files

%APPDATA%\platformruntime\tmpxnuthk4i.exe

Deletes following files that it created itself

%TEMP%\76am9iz3
%TEMP%\_mei40682\base_library.zip
%TEMP%\_mei40682\libcrypto-1_1.dll
%TEMP%\_mei40682\python310.dll
%TEMP%\_mei40682\select.pyd
%TEMP%\_mei40682\unicodedata.pyd
%TEMP%\_mei40682\vcruntime140.dll
%TEMP%\_mei40682\_bz2.pyd
%TEMP%\_mei40682\_decimal.pyd
%TEMP%\_mei40682\_hashlib.pyd
%TEMP%\_mei40682\_lzma.pyd
%TEMP%\_mei40682\_socket.pyd
%LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6a3dcd8d-acc.pma
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6a3dcd91-5e0.pma
%TEMP%\edge_bits_1504_87844383\dde93974-5cbc-4ecc-898f-436e62207c34

Moves the following files

from %APPDATA%\xeno\local storage\leveldb\000001.dbtmp to %APPDATA%\xeno\local storage\leveldb\current
from %APPDATA%\xeno\code cache\wasm\index-dir\temp-index to %APPDATA%\xeno\code cache\wasm\index-dir\the-real-index
from %APPDATA%\xeno\code cache\js\index-dir\temp-index to %APPDATA%\xeno\code cache\js\index-dir\the-real-index
from %APPDATA%\xeno\6500eae6-4135-4836-a54d-acb36bd71171.tmp to %APPDATA%\xeno\local state
from %LOCALAPPDATA%\microsoft\edge\user data\default\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\current
from %APPDATA%\xeno\6892fd4b-a94f-4015-8e4c-8642e65e2b2f.tmp to %APPDATA%\xeno\preferences
from %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\current
from %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\current
from %APPDATA%\xeno\network\a8972531-3c97-4785-b9a9-550f3811c10d.tmp to %APPDATA%\xeno\network\network persistent state
from %APPDATA%\xeno\network\7f27a6e2-ec9a-41fd-baaf-0e8d7126c956.tmp to %APPDATA%\xeno\network\transportsecurity
from %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\current
from %LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\current
from %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\current
from %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\current
from %LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\current

Modifies the following files

%LOCALAPPDATA%\microsoft\edge\user data\last version
%LOCALAPPDATA%\microsoft\edge\user data\default\sync data\leveldb\log
%LOCALAPPDATA%\microsoft\edge\user data\default\site characteristics database\log
%LOCALAPPDATA%\microsoft\edge\user data\default\sync data\leveldb\000003.log
%LOCALAPPDATA%\microsoft\edge\user data\default\web data-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\web data
%LOCALAPPDATA%\microsoft\tokenbroker\cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres
%LOCALAPPDATA%\microsoft\edge\user data\default\visited links
%LOCALAPPDATA%\microsoft\edge\user data\default\history-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\local storage\leveldb\000003.log
%LOCALAPPDATA%\microsoft\edge\user data\default\history
%LOCALAPPDATA%\microsoft\edge\user data\default\favicons-journal
%TEMP%\.ses
%LOCALAPPDATA%\microsoft\edge\user data\default\favicons

Substitutes the following files

%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Platform Notifications\LOG
%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\LOG

Network activity

Connects to

'17#.#15.236.150':44454
'x3##.pages.dev':443
'dn#.google':443
'di##ord.gg':443
'co####.edge.skype.com':443
'di##ord.com':443
'localhost':6463
'cd#.##scordapp.com':443
'localhost':6464
'8.#.112.6':443
'a.###.#loudflare.com':443
'localhost':6465
'localhost':6466
'localhost':6467
'localhost':6468
'localhost':6469
'localhost':6470
'localhost':6471

TCP

Other

'x3##.pages.dev':443
'dn#.google':443
'di##ord.gg':443
'co####.edge.skype.com':443
'di##ord.com':443
'cd#.##scordapp.com':443
'8.#.112.6':443
'a.###.#loudflare.com':443

UDP

DNS ASK x3##.pages.dev
DNS ASK dn#.google
DNS ASK di##ord.gg
DNS ASK co####.edge.skype.com
DNS ASK di##ord.com
DNS ASK cd#.##scordapp.com
'dn#.google':443
'a.###.#loudflare.com':443

Miscellaneous

Searches for the following windows

ClassName: '#32770' WindowName: ''
ClassName: 'Chrome_MessageWindow' WindowName: '%APPDATA%\Xeno'
ClassName: 'Chrome_MessageWindow' WindowName: '%LOCALAPPDATA%\Microsoft\Edge\User Data'

Creates and executes the following

'%TEMP%\tmp1zbq82no.exe'
'%TEMP%\tmpxnuthk4i.exe'
'%APPDATA%\platformruntime\tmpxnuthk4i.exe'
'%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\xeno-v1.3.55.exe'
'%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\xeno-v1.3.55.exe' --type=gpu-process --user-data-dir="%APPDATA%\Xeno" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAA...
'%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\xeno-v1.3.55.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="%APPDATA%\Xeno" --mojo-platform-channel-handle=2264 --field-trial-handle...
'%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\xeno-v1.3.55.exe' --type=renderer --user-data-dir="%APPDATA%\Xeno" --app-user-model-id=Xeno --app-path="%TEMP%\3EgI6LboeIQcxAwjCbQ9fkFuDXA\resources\app.asar" --enable-sandbox --first-renderer-process --lang=en-...
'%TEMP%\3egi6lboeiqcxawjcbq9fkfudxa\xeno-v1.3.55.exe' --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --user-data-dir="%APPDATA%\Xeno" --mojo-platform-channel-handle=3704 --field-trial-handle=15...

Restarts the analyzed sample

Executes the following

'<SYSTEM32>\cmd.exe' /c ""%APPDATA%\Temp\cleanup_UAR9j1GtIUpd0fFAIV7LDtwqKeO3K0.bat""
'<SYSTEM32>\chcp.com' 65001
'<SYSTEM32>\timeout.exe' /t 2 /nobreak
'<SYSTEM32>\timeout.exe' /t 1 /nobreak
'<SYSTEM32>\schtasks.exe' /create /tn "tmpxnuthk4i" /sc ONLOGON /tr "\"%APPDATA%\PlatformRuntime\tmpxnuthk4i.exe\"" /rl HIGHEST /f
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument https://discord.gg/xe-no
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --flag-switches-begin --flag-switches-end --do-not-de-elevate https://discord.gg/xe-no
'%ProgramFiles(x86)%\microsoft\edge\application\89.0.774.68\identity_helper.exe' --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1828,2661872787237832097,13616921857970776196,131072 --lang=en-US --service-sandbox-type=none --mojo-...
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --flag-switches-begin --flag-switches-end --do-not-de-elevate https://discord.gg/xe-no' (with hidden window)

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней