Trojan.Siggen32.46118

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

<SYSTEM32>\tasks\services
<SYSTEM32>\tasks\dwm

Malicious functions

Injects code into

the following user processes:

xeno-v1.3.50.exe

Modifies file system

Creates the following files

%TEMP%\xeno-v1.3.50.exe
%TEMP%\exptyly.exe
%TEMP%\nsh1118.tmp\system.dll
%TEMP%\nsh1118.tmp\app-64.7z
%TEMP%\nsh1118.tmp\nsis7z.dll
%ProgramFiles(x86)%\internet explorer\services.exe
%ProgramFiles(x86)%\mozilla firefox\dwm.exe
%TEMP%\nsh1118.tmp\7z-out\chrome_100_percent.pak
%TEMP%\nsh1118.tmp\7z-out\chrome_200_percent.pak
%TEMP%\nsh1118.tmp\7z-out\icudtl.dat
%TEMP%\nsh1118.tmp\7z-out\license.electron.txt
%TEMP%\nsh1118.tmp\7z-out\licenses.chromium.html
%TEMP%\nsh1118.tmp\7z-out\locales\af.pak
%TEMP%\nsh1118.tmp\7z-out\locales\am.pak
%TEMP%\nsh1118.tmp\7z-out\locales\ar.pak
%TEMP%\nsh1118.tmp\7z-out\locales\bg.pak
%TEMP%\nsh1118.tmp\7z-out\locales\bn.pak
%TEMP%\nsh1118.tmp\7z-out\locales\ca.pak
%TEMP%\nsh1118.tmp\7z-out\locales\cs.pak
%TEMP%\nsh1118.tmp\7z-out\locales\da.pak
%TEMP%\nsh1118.tmp\7z-out\locales\de.pak
%TEMP%\nsh1118.tmp\7z-out\locales\el.pak
%TEMP%\nsh1118.tmp\7z-out\locales\en-gb.pak
%TEMP%\nsh1118.tmp\7z-out\locales\en-us.pak
%TEMP%\nsh1118.tmp\7z-out\locales\es-419.pak
%TEMP%\nsh1118.tmp\7z-out\locales\es.pak
%TEMP%\nsh1118.tmp\7z-out\locales\et.pak
%TEMP%\nsh1118.tmp\7z-out\locales\fa.pak
%TEMP%\nsh1118.tmp\7z-out\locales\fi.pak
%TEMP%\nsh1118.tmp\7z-out\locales\fil.pak
%TEMP%\nsh1118.tmp\7z-out\locales\fr.pak
%TEMP%\nsh1118.tmp\7z-out\locales\gu.pak
%TEMP%\nsh1118.tmp\7z-out\locales\he.pak
%TEMP%\nsh1118.tmp\7z-out\locales\hi.pak
%TEMP%\nsh1118.tmp\7z-out\locales\hr.pak
%TEMP%\nsh1118.tmp\7z-out\locales\hu.pak
%TEMP%\nsh1118.tmp\7z-out\locales\id.pak
%TEMP%\nsh1118.tmp\7z-out\locales\it.pak
%TEMP%\nsh1118.tmp\7z-out\locales\ja.pak
%TEMP%\nsh1118.tmp\7z-out\locales\kn.pak
%TEMP%\nsh1118.tmp\7z-out\locales\ko.pak
%TEMP%\nsh1118.tmp\7z-out\locales\lt.pak
%TEMP%\nsh1118.tmp\7z-out\locales\lv.pak
%TEMP%\nsh1118.tmp\7z-out\locales\ml.pak
%TEMP%\nsh1118.tmp\7z-out\locales\mr.pak
%TEMP%\nsh1118.tmp\7z-out\locales\ms.pak
%TEMP%\nsh1118.tmp\7z-out\locales\nb.pak
%TEMP%\nsh1118.tmp\7z-out\locales\nl.pak
%TEMP%\nsh1118.tmp\7z-out\locales\pl.pak
%TEMP%\nsh1118.tmp\7z-out\locales\pt-br.pak
%TEMP%\nsh1118.tmp\7z-out\locales\pt-pt.pak
%TEMP%\nsh1118.tmp\7z-out\locales\ro.pak
%TEMP%\nsh1118.tmp\7z-out\locales\ru.pak
%TEMP%\nsh1118.tmp\7z-out\locales\sk.pak
%TEMP%\nsh1118.tmp\7z-out\locales\sl.pak
%TEMP%\nsh1118.tmp\7z-out\locales\sr.pak
%TEMP%\nsh1118.tmp\7z-out\locales\sv.pak
%TEMP%\nsh1118.tmp\7z-out\locales\sw.pak
%TEMP%\nsh1118.tmp\7z-out\locales\ta.pak
%TEMP%\nsh1118.tmp\7z-out\locales\te.pak
%TEMP%\nsh1118.tmp\7z-out\locales\th.pak
%TEMP%\nsh1118.tmp\7z-out\locales\tr.pak
%TEMP%\nsh1118.tmp\7z-out\locales\uk.pak
%TEMP%\nsh1118.tmp\7z-out\locales\ur.pak
%TEMP%\nsh1118.tmp\7z-out\locales\vi.pak
%TEMP%\nsh1118.tmp\7z-out\locales\zh-cn.pak
%TEMP%\nsh1118.tmp\7z-out\locales\zh-tw.pak
%TEMP%\nsh1118.tmp\7z-out\resources\app.asar
%TEMP%\nsh1118.tmp\7z-out\resources\app.asar.unpacked\native\xeno-addon\binding.gyp
%TEMP%\nsh1118.tmp\7z-out\resources\app.asar.unpacked\native\xeno-addon\build\config.gypi
%TEMP%\nsh1118.tmp\7z-out\resources\app.asar.unpacked\native\xeno-addon\build\release\obj\xeno\src\addon.obj
%TEMP%\nsh1118.tmp\7z-out\resources\app.asar.unpacked\native\xeno-addon\build\release\obj\xeno\vcpkg.applocal.log
%TEMP%\nsh1118.tmp\7z-out\resources\app.asar.unpacked\native\xeno-addon\build\release\obj\xeno\win_delay_load_hook.obj
%TEMP%\nsh1118.tmp\7z-out\resources\app.asar.unpacked\native\xeno-addon\build\release\obj\xeno\xeno.node.recipe
%TEMP%\nsh1118.tmp\7z-out\resources\app.asar.unpacked\native\xeno-addon\build\release\obj\xeno\xeno.tlog\cl.command.1.tlog
%TEMP%\nsh1118.tmp\7z-out\resources\app.asar.unpacked\native\xeno-addon\build\release\obj\xeno\xeno.tlog\cl.items.tlog
%TEMP%\nsh1118.tmp\7z-out\resources\app.asar.unpacked\native\xeno-addon\build\release\obj\xeno\xeno.tlog\cl.read.1.tlog
%TEMP%\nsh1118.tmp\7z-out\resources\app.asar.unpacked\native\xeno-addon\build\release\obj\xeno\xeno.tlog\cl.write.1.tlog
%TEMP%\nsh1118.tmp\7z-out\resources\app.asar.unpacked\native\xeno-addon\build\release\obj\xeno\xeno.tlog\link.command.1.tlog
%TEMP%\nsh1118.tmp\7z-out\resources\app.asar.unpacked\native\xeno-addon\build\release\obj\xeno\xeno.tlog\link.read.1.tlog
%TEMP%\nsh1118.tmp\7z-out\resources\app.asar.unpacked\native\xeno-addon\build\release\obj\xeno\xeno.tlog\link.secondary.1.tlog
%TEMP%\nsh1118.tmp\7z-out\resources\app.asar.unpacked\native\xeno-addon\build\release\obj\xeno\xeno.tlog\link.write.1.tlog
%TEMP%\nsh1118.tmp\7z-out\resources\app.asar.unpacked\native\xeno-addon\build\release\obj\xeno\xeno.tlog\xeno.lastbuildstate
%TEMP%\nsh1118.tmp\7z-out\resources\app.asar.unpacked\native\xeno-addon\build\release\xeno.iobj
%TEMP%\nsh1118.tmp\7z-out\resources\app.asar.unpacked\native\xeno-addon\build\release\xeno.ipdb
%TEMP%\nsh1118.tmp\7z-out\resources\app.asar.unpacked\native\xeno-addon\build\release\xeno.node
%TEMP%\nsh1118.tmp\7z-out\resources\app.asar.unpacked\native\xeno-addon\build\xeno.vcxproj
%TEMP%\nsh1118.tmp\7z-out\resources\app.asar.unpacked\native\xeno-addon\build\xeno.vcxproj.filters
%TEMP%\nsh1118.tmp\7z-out\resources\app.asar.unpacked\native\xeno-addon\package.json
%TEMP%\nsh1118.tmp\7z-out\resources\public\failed.png
%TEMP%\nsh1118.tmp\7z-out\resources\public\index.html
%TEMP%\nsh1118.tmp\7z-out\resources\public\notification.mp3
%TEMP%\nsh1118.tmp\7z-out\resources\public\xeno.ico
%TEMP%\nsh1118.tmp\7z-out\resources.pak
%TEMP%\nsh1118.tmp\7z-out\snapshot_blob.bin
%TEMP%\nsh1118.tmp\7z-out\v8_context_snapshot.bin
%TEMP%\nsh1118.tmp\7z-out\vk_swiftshader_icd.json
%ProgramFiles(x86)%\microsoft\edge\application\dwm.exe
nul
%TEMP%\nsh1118.tmp\7z-out\d3dcompiler_47.dll
%TEMP%\nsh1118.tmp\7z-out\ffmpeg.dll
%TEMP%\nsh1118.tmp\7z-out\libegl.dll
%TEMP%\nsh1118.tmp\7z-out\libglesv2.dll
%TEMP%\nsh1118.tmp\7z-out\resources\elevate.exe
%TEMP%\nsh1118.tmp\7z-out\resources\public\api-ms-win-crt-convert-l1-1-0.dll
%TEMP%\nsh1118.tmp\7z-out\resources\public\api-ms-win-crt-environment-l1-1-0.dll
%TEMP%\nsh1118.tmp\7z-out\resources\public\api-ms-win-crt-filesystem-l1-1-0.dll
%TEMP%\nsh1118.tmp\7z-out\resources\public\api-ms-win-crt-heap-l1-1-0.dll
%TEMP%\nsh1118.tmp\7z-out\resources\public\api-ms-win-crt-locale-l1-1-0.dll
%TEMP%\nsh1118.tmp\7z-out\resources\public\api-ms-win-crt-math-l1-1-0.dll
%TEMP%\nsh1118.tmp\7z-out\resources\public\api-ms-win-crt-runtime-l1-1-0.dll
%TEMP%\nsh1118.tmp\7z-out\resources\public\api-ms-win-crt-stdio-l1-1-0.dll
%TEMP%\nsh1118.tmp\7z-out\resources\public\api-ms-win-crt-string-l1-1-0.dll
%TEMP%\nsh1118.tmp\7z-out\resources\public\api-ms-win-crt-utility-l1-1-0.dll
%TEMP%\nsh1118.tmp\7z-out\resources\public\concrt140.dll
%TEMP%\nsh1118.tmp\7z-out\resources\public\libcrypto-3-x64.dll
%TEMP%\nsh1118.tmp\7z-out\resources\public\libcurl.dll
%TEMP%\nsh1118.tmp\7z-out\resources\public\libssl-3-x64.dll
%TEMP%\nsh1118.tmp\7z-out\resources\public\msvcp140.dll
%TEMP%\nsh1118.tmp\7z-out\resources\public\msvcp140_1.dll
%TEMP%\nsh1118.tmp\7z-out\resources\public\msvcrt.dll
%TEMP%\nsh1118.tmp\7z-out\resources\public\ucrtbase.dll
%TEMP%\nsh1118.tmp\7z-out\resources\public\vcruntime140.dll
%TEMP%\nsh1118.tmp\7z-out\resources\public\vcruntime140_1.dll
%TEMP%\nsh1118.tmp\7z-out\resources\public\xeno.dll
%TEMP%\nsh1118.tmp\7z-out\resources\public\zlib1.dll
%TEMP%\nsh1118.tmp\7z-out\vk_swiftshader.dll
%TEMP%\nsh1118.tmp\7z-out\vulkan-1.dll
%TEMP%\nsh1118.tmp\7z-out\xeno-v1.3.50.exe
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\chrome_100_percent.pak
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\chrome_200_percent.pak
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\d3dcompiler_47.dll
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\ffmpeg.dll
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\icudtl.dat
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\libegl.dll
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\libglesv2.dll
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\license.electron.txt
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\licenses.chromium.html
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\resources.pak
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\snapshot_blob.bin
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\v8_context_snapshot.bin
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\vk_swiftshader.dll
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\vk_swiftshader_icd.json
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\vulkan-1.dll
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\xeno-v1.3.50.exe
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\locales\af.pak
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\locales\am.pak
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\locales\ar.pak
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\locales\bg.pak
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\locales\bn.pak
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\locales\ca.pak
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\locales\cs.pak
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\locales\da.pak
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\locales\de.pak
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\locales\el.pak
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\locales\en-gb.pak
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\locales\en-us.pak
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\locales\es-419.pak
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\locales\es.pak
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\locales\et.pak
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\locales\fa.pak
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\locales\fi.pak
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\locales\fil.pak
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\locales\fr.pak
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\locales\gu.pak
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\locales\he.pak
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\locales\hi.pak
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\locales\hr.pak
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\locales\hu.pak
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\locales\id.pak
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\locales\it.pak
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\locales\ja.pak
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\locales\kn.pak
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\locales\ko.pak
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\locales\lt.pak
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\locales\lv.pak
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\locales\ml.pak
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\locales\mr.pak
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\locales\ms.pak
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\locales\nb.pak
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\locales\nl.pak
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\locales\pl.pak
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\locales\pt-br.pak
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\locales\pt-pt.pak
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\locales\ro.pak
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\locales\ru.pak
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\locales\sk.pak
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\locales\sl.pak
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\locales\sr.pak
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\locales\sv.pak
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\locales\sw.pak
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\locales\ta.pak
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\locales\te.pak
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\locales\th.pak
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\locales\tr.pak
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\locales\uk.pak
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\locales\ur.pak
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\locales\vi.pak
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\locales\zh-cn.pak
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\locales\zh-tw.pak
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\resources\app.asar
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\resources\elevate.exe
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\resources\app.asar.unpacked\native\xeno-addon\binding.gyp
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\resources\app.asar.unpacked\native\xeno-addon\package.json
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\resources\app.asar.unpacked\native\xeno-addon\build\config.gypi
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\resources\app.asar.unpacked\native\xeno-addon\build\xeno.vcxproj
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\resources\app.asar.unpacked\native\xeno-addon\build\xeno.vcxproj.filters
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\resources\app.asar.unpacked\native\xeno-addon\build\release\xeno.iobj
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\resources\app.asar.unpacked\native\xeno-addon\build\release\xeno.ipdb
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\resources\app.asar.unpacked\native\xeno-addon\build\release\xeno.node
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\resources\app.asar.unpacked\native\xeno-addon\build\release\obj\xeno\vcpkg.applocal.log
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\resources\app.asar.unpacked\native\xeno-addon\build\release\obj\xeno\win_delay_load_hook.obj
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\resources\app.asar.unpacked\native\xeno-addon\build\release\obj\xeno\xeno.node.recipe
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\resources\app.asar.unpacked\native\xeno-addon\build\release\obj\xeno\src\addon.obj
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\resources\app.asar.unpacked\native\xeno-addon\build\release\obj\xeno\xeno.tlog\cl.command.1.tlog
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\resources\app.asar.unpacked\native\xeno-addon\build\release\obj\xeno\xeno.tlog\cl.items.tlog
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\resources\app.asar.unpacked\native\xeno-addon\build\release\obj\xeno\xeno.tlog\cl.read.1.tlog
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\resources\app.asar.unpacked\native\xeno-addon\build\release\obj\xeno\xeno.tlog\cl.write.1.tlog
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\resources\app.asar.unpacked\native\xeno-addon\build\release\obj\xeno\xeno.tlog\link.command.1.tlog
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\resources\app.asar.unpacked\native\xeno-addon\build\release\obj\xeno\xeno.tlog\link.read.1.tlog
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\resources\app.asar.unpacked\native\xeno-addon\build\release\obj\xeno\xeno.tlog\link.secondary.1.tlog
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\resources\app.asar.unpacked\native\xeno-addon\build\release\obj\xeno\xeno.tlog\link.write.1.tlog
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\resources\app.asar.unpacked\native\xeno-addon\build\release\obj\xeno\xeno.tlog\xeno.lastbuildstate
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\resources\public\api-ms-win-crt-convert-l1-1-0.dll
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\resources\public\api-ms-win-crt-environment-l1-1-0.dll
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\resources\public\api-ms-win-crt-filesystem-l1-1-0.dll
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\resources\public\api-ms-win-crt-heap-l1-1-0.dll
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\resources\public\api-ms-win-crt-locale-l1-1-0.dll
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\resources\public\api-ms-win-crt-math-l1-1-0.dll
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\resources\public\api-ms-win-crt-runtime-l1-1-0.dll
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\resources\public\api-ms-win-crt-stdio-l1-1-0.dll
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\resources\public\api-ms-win-crt-string-l1-1-0.dll
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\resources\public\api-ms-win-crt-utility-l1-1-0.dll
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\resources\public\concrt140.dll
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\resources\public\failed.png
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\resources\public\index.html
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\resources\public\libcrypto-3-x64.dll
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\resources\public\libcurl.dll
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\resources\public\libssl-3-x64.dll
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\resources\public\msvcp140.dll
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\resources\public\msvcp140_1.dll
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\resources\public\msvcrt.dll
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\resources\public\notification.mp3
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\resources\public\ucrtbase.dll
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\resources\public\vcruntime140.dll
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\resources\public\vcruntime140_1.dll
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\resources\public\xeno.dll
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\resources\public\xeno.ico
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\resources\public\zlib1.dll
%TEMP%\nsh1118.tmp\stdutils.dll
%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\logs\2026-05-30_21-17-48.log
%APPDATA%\xeno\local storage\leveldb\log
%APPDATA%\xeno\local storage\leveldb\manifest-000001
%APPDATA%\xeno\local storage\leveldb\000001.dbtmp
%APPDATA%\xeno\code cache\wasm\index
%APPDATA%\xeno\code cache\js\index
%APPDATA%\xeno\code cache\wasm\index-dir\temp-index
%APPDATA%\xeno\code cache\js\index-dir\temp-index
%APPDATA%\xeno\gpucache\index
%APPDATA%\xeno\gpucache\data_0
%APPDATA%\xeno\gpucache\data_1
%APPDATA%\xeno\gpucache\data_2
%APPDATA%\xeno\gpucache\data_3
%APPDATA%\xeno\dawncache\index
%APPDATA%\xeno\dawncache\data_0
%APPDATA%\xeno\dawncache\data_1
%APPDATA%\xeno\dawncache\data_2
%APPDATA%\xeno\dawncache\data_3
%APPDATA%\microsoft\windows\start menu\programs\xeno.lnk
%LOCALAPPDATA%\xeno\xeno_cache.bin
%APPDATA%\microsoft\spelling\en-us\default.dic
%APPDATA%\microsoft\spelling\en-us\default.exc
%APPDATA%\microsoft\spelling\en-us\default.acl
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6a1bb66f-dc8.pma
%LOCALAPPDATA%\xeno\settings.json
%APPDATA%\xeno\cache\cache_data\index
%APPDATA%\xeno\cache\cache_data\data_0
%APPDATA%\xeno\cache\cache_data\data_1
%APPDATA%\xeno\cache\cache_data\data_2
%APPDATA%\xeno\cache\cache_data\data_3
%APPDATA%\xeno\network\cookies-journal
%APPDATA%\xeno\network\cookies
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6a1bb673-56c.pma
%APPDATA%\xeno\local storage\leveldb\000003.log
%APPDATA%\xeno\cc934a19-d17f-4bdb-b6ba-3676799e3fa7.tmp
%LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000002
%LOCALAPPDATA%\microsoft\edge\user data\default\000002.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\log
%LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\index
%LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_0
%LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_2
%LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_3
%APPDATA%\xeno\79c6f243-fa5b-4e80-8179-c82d14dc8160.tmp
%LOCALAPPDATA%\microsoft\edge\user data\default\cookies-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\cookies
%LOCALAPPDATA%\microsoft\edge\user data\default\session storage\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\session storage\log
%LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000003.log
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\index
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_0
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_2
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_3
%APPDATA%\xeno\network\2b236d5a-76be-4be3-9f85-4726fb3a6f33.tmp
%LOCALAPPDATA%\microsoft\edge\user data\default\reporting and nel-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\reporting and nel
%APPDATA%\xeno\network\6bfebfc0-bb36-4c7c-b8f7-419b3972a7ab.tmp
%APPDATA%\xeno\network\dd3de80f-101d-46fe-8c28-488701ffe414.tmp
%APPDATA%\xeno\network\f08cbfa0-cadf-49fc-9bc2-b99f015f5b9d.tmp
%LOCALAPPDATA%\microsoft\edge\user data\default\extension state\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\extension state\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\extension state\log
%LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\manifest-000004
%LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\000004.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\shortcuts-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\shortcuts
%LOCALAPPDATA%\microsoft\edge\user data\default\network action predictor-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\network action predictor
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\log
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\log
%LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\log
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\000003.log
%LOCALAPPDATA%\microsoft\edge\user data\functional data-wal
%LOCALAPPDATA%\microsoft\edge\user data\functional san data-wal
%TEMP%\9f463544-e5ea-45ee-815a-6630592e4723.tmp
%APPDATA%\xeno\network\56743abb-a3f0-4330-81a0-8dd68b07c370.tmp

Deletes following files that it created itself

%ProgramFiles(x86)%\microsoft\edge\application\dwm.exe
%LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6a1bb66f-dc8.pma
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6a1bb673-56c.pma
%TEMP%\edge_bits_1388_1499583682\dde93974-5cbc-4ecc-898f-436e62207c34

Moves the following files

from %APPDATA%\xeno\local storage\leveldb\000001.dbtmp to %APPDATA%\xeno\local storage\leveldb\current
from %APPDATA%\xeno\code cache\wasm\index-dir\temp-index to %APPDATA%\xeno\code cache\wasm\index-dir\the-real-index
from %APPDATA%\xeno\code cache\js\index-dir\temp-index to %APPDATA%\xeno\code cache\js\index-dir\the-real-index
from %APPDATA%\xeno\cc934a19-d17f-4bdb-b6ba-3676799e3fa7.tmp to %APPDATA%\xeno\local state
from %LOCALAPPDATA%\microsoft\edge\user data\default\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\current
from %APPDATA%\xeno\79c6f243-fa5b-4e80-8179-c82d14dc8160.tmp to %APPDATA%\xeno\preferences
from %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\current
from %APPDATA%\xeno\network\2b236d5a-76be-4be3-9f85-4726fb3a6f33.tmp to %APPDATA%\xeno\network\network persistent state
from %APPDATA%\xeno\network\6bfebfc0-bb36-4c7c-b8f7-419b3972a7ab.tmp to %APPDATA%\xeno\network\transportsecurity
from %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\current
from %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\current
from %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\current
from %LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\current

Modifies the following files

%LOCALAPPDATA%\microsoft\edge\user data\last version
%LOCALAPPDATA%\microsoft\edge\user data\default\site characteristics database\log
%LOCALAPPDATA%\microsoft\edge\user data\default\sync data\leveldb\log
%LOCALAPPDATA%\microsoft\edge\user data\default\sync data\leveldb\000003.log
%LOCALAPPDATA%\microsoft\edge\user data\default\web data-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\web data
%LOCALAPPDATA%\microsoft\tokenbroker\cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres
%LOCALAPPDATA%\microsoft\edge\user data\last browser
%TEMP%\.ses
%LOCALAPPDATA%\microsoft\edge\user data\default\history-journal

Substitutes the following files

%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Platform Notifications\LOG
%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\LOG
%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\BudgetDatabase\LOG

Network activity

Connects to

'x3##.pages.dev':443
'dn#.google':443
'co####.edge.skype.com':443
'di##ord.gg':443
'di##ord.com':443
'8.#.112.6':443
'35.#90.80.1':443

TCP

Other

'x3##.pages.dev':443
'dn#.google':443
'co####.edge.skype.com':443
'di##ord.gg':443
'di##ord.com':443
'8.#.112.6':443
'35.#90.80.1':443

UDP

DNS ASK dn#.google
DNS ASK x3##.pages.dev
DNS ASK xe##.onl
DNS ASK co####.edge.skype.com
DNS ASK di##ord.gg
DNS ASK di##ord.com
'dn#.google':443
'18#.#14.96.1':443
'18#.#14.97.1':443
'35.#90.80.1':443
'90.##6.169.78':443

Miscellaneous

Searches for the following windows

ClassName: 'Edit' WindowName: ''
ClassName: '#32770' WindowName: ''
ClassName: 'Chrome_MessageWindow' WindowName: '%APPDATA%\Xeno'
ClassName: 'Chrome_MessageWindow' WindowName: '%LOCALAPPDATA%\Microsoft\Edge\User Data'

Creates and executes the following

'%TEMP%\exptyly.exe'
'%TEMP%\xeno-v1.3.50.exe'
'%ProgramFiles(x86)%\mozilla firefox\dwm.exe'
'%ProgramFiles(x86)%\microsoft\edge\application\dwm.exe' -
'%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\xeno-v1.3.50.exe'
'%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\xeno-v1.3.50.exe' --type=gpu-process --user-data-dir="%APPDATA%\Xeno" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAA...
'%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\xeno-v1.3.50.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="%APPDATA%\Xeno" --mojo-platform-channel-handle=2272 --field-trial-handle...
'%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\xeno-v1.3.50.exe' --type=renderer --user-data-dir="%APPDATA%\Xeno" --app-user-model-id=Xeno --app-path="%TEMP%\3EN8fkk4fN9qZoPDByWHenEQP7W\resources\app.asar" --enable-sandbox --first-renderer-process --lang=en-...
'%TEMP%\3en8fkk4fn9qzopdbywheneqp7w\xeno-v1.3.50.exe' --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --user-data-dir="%APPDATA%\Xeno" --mojo-platform-channel-handle=3732 --field-trial-handle=16...

Executes the following

'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe'
'<SYSTEM32>\svchost.exe' -k LocalSystemNetworkRestricted -p -s UmRdpService
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument https://discord.gg/xe-no
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --flag-switches-begin --flag-switches-end --do-not-de-elevate https://discord.gg/xe-no
'%ProgramFiles(x86)%\microsoft\edge\application\89.0.774.68\identity_helper.exe' --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1800,8113440562271906711,13188844459247321566,131072 --lang=en-US --service-sandbox-type=none --mojo-...
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' ' (with hidden window)
'%ProgramFiles(x86)%\microsoft\edge\application\dwm.exe' -' (with hidden window)
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --flag-switches-begin --flag-switches-end --do-not-de-elevate https://discord.gg/xe-no' (with hidden window)

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical Information

Curing recommendations

Free trial