File scan report
Verdict Suspicious
Is Xeno-
Three malware-specific YARA matches, a failed signature, one detection from a major antivirus engine, and divided sandbox results outweigh the file's broad distribution and…
Read the whole reasonShow less
Why Suspicious? One antivirus engine (Dr.Web) flags it and a community rule for known malware matched it.
Moderate evidence · More than one sign points to a problem, but nothing confirms it is harmful.
If it came from a link, an attachment or a stranger, delete it.
What to do now4 steps
Some signs point to a problem, but nothing confirms it is harmful. Treat it with caution.
What to do
Don't run it unless you're sure where it came from.
Check where you got it: an unexpected attachment, a link someone sent you or a re-upload is a red flag.
If you can't confirm where it came from, delete it. If you need the program, download it again from the publisher's own website.
If you already ran it
Stop using it, run a full scan with your antivirus and watch for unexpected behavior or security alerts.
Not sure what to do?
Ask the MalwareTips community before you run it. If you already ran it, follow the cleanup guide.
- Ask for free help on the MalwareTips forumWindows malware removal help, answered by volunteers. (opens malwaretips.com in a new tab)
- Remove malware from WindowsStep-by-step cleanup with free tools. (opens malwaretips.com in a new tab)
Paste this report's link in your topic so helpers can see what was found.
Antivirus results
1 of 52 flagged
- Flagged 1
- No detection 51
- No result 23
- Code signing Signer not verified
- Test run Completed
- First seen 17d ago
Chapter 02
Why we think so
4 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
This executable carries several independent warning signs: three malware-specific YARA matches, a failed certificate chain, and a DrWeb trojan detection. Sandbox conclusions were divided rather than conclusive, while broad distribution and benign file it created references provide counterweight, so it should not be run outside an isolated research environment.
One of the 52 antivirus engines that checked it flagged the executable, with DrWeb using a generic Siggen36 trojan label rather than identifying a reliable malware family. More importantly, three malware-specific YARA rules matched patterns associated with a bot framework, a modified packer hook, and clipboard manipulation. The signature merely claims the name Rizve A because its certificate chain ends at an untrusted root, so it cannot establish authorship. Sandbox conclusions were divided between malicious and clean, and the uncorroborated technique mappings do not prove injection, credential theft, or encryption. Broad distribution across 3,654 sources and seven known-software files it created are meaningful counter-signals, but they do not adequately neutralize the combined hostile evidence.
What We Detected
DrWeb was the only engine to flag the executable, reporting a generic Siggen36 trojan label. Three malware-specific YARA rules also matched patterns associated with a bot framework, a modified packer hook, and clipboard manipulation. No dependable malware-family consensus was established.
Threat Behavior
The sandbox evidence was divided: the combined results included both malicious and clean labels. No named injection target, credential-store access, persistence indicator, or sample-originated network contact was recorded, so the technique mappings alone do not demonstrate those actions. The claimed publisher certificate failed verification because its chain ended at an untrusted root.
What To Do Now
Do not run this executable on a normal or production system. Keep security software enabled, obtain the file from a verifiable official release channel, and use an isolated disposable environment only if analysis is necessary.
Where this verdict could be wrong5 caveats
- Only 1 of the 52 antivirus engines that checked it flagged the executable, and several major engines that reported a result did not detect it.
- The file was submitted by 3,654 distinct sources, indicating broad distribution.
- Seven inspected files it created matched known-software reference entries, and none of the inspected children was malicious or suspicious.
- The sandbox evidence was divided: one combined label was malicious while another was clean.
- The three prior safe files with the same import-table fingerprint had different or unverified publishers, so those matches provide only weak reassurance.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- Only 1 of the 52 antivirus engines that checked it flagged the executable.
- The file was submitted by 3,654 distinct sources.
- Seven inspected files it created matched known-software reference records, with no malicious or suspicious child verdicts.
- No sample-originated network contact or named injection target was recorded.
- The antivirus analysis found no high-entropy code or identified packer.
- Three malware-specific community rules matched patterns involving a bot framework, a modified packer hook, and clipboard manipulation.
- DrWeb reported a generic trojan detection.
- The publisher certificate failed verification because its chain ended at an untrusted root.
- Sandbox conclusions included both a malicious and a clean result, leaving unresolved runtime concern.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in 7 isolated tests; 1 test environment rated what it did as risky.
Test run summary
Capture complete- 7isolated sandbox runs
- 41sandbox rule tags
- 5spawned processes
- 0network contacts
- 40filesystem & mutex artifacts
What the test run showed
What the file did on a test computer
Confirmed in the test run
High concern: Encrypted files on the test computer, as ransomware does.
Moderate concern: Contains packed or scrambled code that is harder to inspect (common in installers too).
Moderate concern: Ran commands or a script on the test computer.
Moderate concern: Unpacked hidden content while it ran.
Moderate concern: Checked whether it was running on a test computer.
Note: Read the user name of the test computer.
Note: Listed the programs running on the test computer.
Sandbox labels we could not confirm (common in safe files too)
Not confirmed: A sandbox rule tagged this run as password-store access, but nothing touched the Windows password store.
Not confirmed: A sandbox rule tagged this run as code injection, but no injected program was recorded.
Not confirmed: A sandbox rule tagged this run as contacting a server, but no contacted host was recorded.
Not confirmed: A sandbox rule tagged this run as setting up auto-start; no auto-start entry was recorded.
This file was run on a test computer (a sandbox), not on yours. Labels we could not confirm are listed so you can see them, but they are not treated as evidence against the file.
Recorded behavior
What happened in the test
Grouped by step. The order is not a timeline.
- 1
Input file
The submitted object
- Evidence 1 of 5: FileSeen in the test run
Xeno-v1.3.65.exe
829c1e8861cadb5835fe968b98d06254254e6a4120250d9f5cf612d3f152c7a1
Uploaded file
- 2
Processes
What ran
- Evidence 2 of 5: ProcessSeen in the test run
OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
Test run - Evidence 3 of 5: ProcessSeen in the test run
Xeno-v1.3.65.exe
"C:\Users\<USER>\AppData\Local\Temp\3KyUqhCJZ5zlHiOQfYR15XZ3zaE\Xeno-v1.3.65.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\<USER>\AppData\Roaming\Xeno" --mojo-platform-channel-handle=2580 --field-trial-handle=1816,i,4875788451381389941,2585783611525294392,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
Test run - +1 more recorded observation
- 2
Files
Created or changed
- Evidence 4 of 5: Written fileSeen in the test run
thumbcache_idx.db
C:\Users\<USER>\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db
Test run - Evidence 5 of 5: Written fileSeen in the test run
thumbcache_32.db
C:\Users\<USER>\AppData\Local\Microsoft\Windows\Explorer\thumbcache_32.db
Test run - +1 more recorded observation
5 facts from the test run. See the full activity list.
Includes the sandbox verdicts, 41 mapped techniques, every process, file, registry and network entry and 10 dropped files.
Show the technical evidenceChapter 04
Technical details
1 of the 52 antivirus engines that checked it flags it; a signature that did not verify.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 1
- DrWeb (major engine)Trojan.Siggen36.47113
File fingerprint
- Last analyzed
- Nov 7, 2026, 5:31 PM UTC
- SHA-256
829c1e8861cadb5835fe968b98d06254254e6a4120250d9f5cf612d3f152c7a1- SHA-1
1062875afbb81eba98b1f121d723cb86d194fc9c- MD5
a9f2c1d8645d1c9ef97fc01771815dd1
About this file
Xeno-v1.3.65.exe says it is New Electron UI for Xeno (Xeno-v1.3.65), 88.9 MB.
- Claims to be
- New Electron UI for Xeno (Xeno-v1.3.65)From the file's own version information, written by whoever built it.
- Type and size
- Win32 EXE · 88.9 MB
- Signer
- Rizve A (unverified signature)Worth noting: Malware sometimes copies or steals a company's signature, so this does not mean that company made it.
- First seen
- Oct 20, 2026On VirusTotal.
- Submitted by
- 3,654 distinct sources
- Packer
- None detected
- Entropy
- 2.25 of 8
First scanned
Includes every engine result (75), 9 matched signature rules, PE section entropy and packers and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 7 questions people ask most about this file.
Is Xeno-v1.3.65.exe safe, or is it malware?
What is Xeno-v1.3.65.exe?
How many antivirus engines detected Xeno-v1.3.65.exe?
What should I do if I already ran Xeno-v1.3.65.exe?
Is Xeno-v1.3.65.exe digitally signed?
What is the SHA-256 hash of Xeno-v1.3.65.exe?
How up to date is this analysis of Xeno-v1.3.65.exe?
Community
Member reviews and reports for this exact file hash.
