Analysis
- geolocation tags
- user interaction
yes - max time kernel
500s - max time network
494s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
27/04/2026, 14:36
General
- Target https://xeno.onl/install?hash=Tee6QlJdmQF3rqZknsTLoRteq1N87aFX4kgSsUW4c8aRTeHNFctsHXNaKNhLrFc2
- Sample260427-ryq2dady3s
Score
8/10
Malware Config
Signatures
- Downloads MZ/PE file 2 IoCs
- Executes dropped EXE 24 IoCs
- Loads dropped DLL 59 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 7 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops desktop.ini file(s) 3 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 36 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 38 IoCs
- Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 2 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 2 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks processor information in registry 2 TTPs 64 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 8 IoCs
- Kills process with taskkill 1 IoCs
- Modifies Internet Explorer settings 1 TTPs 6 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 41 IoCs
- NTFS ADS 2 IoCs
- Suspicious behavior: EnumeratesProcesses 26 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 29 IoCs
- Suspicious use of SendNotifyMessage 6 IoCs
- Suspicious use of SetWindowsHookEx 41 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://xeno.onl/install?hash=Tee6QlJdmQF3rqZknsTLoRteq1N87aFX4kgSsUW4c8aRTeHNFctsHXNaKNhLrFc2"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://xeno.onl/install?hash=Tee6QlJdmQF3rqZknsTLoRteq1N87aFX4kgSsUW4c8aRTeHNFctsHXNaKNhLrFc22⤵
- Downloads MZ/PE file
- Subvert Trust Controls: Mark-of-the-Web Bypass
- Checks processor information in registry
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1972 -prefsLen 27097 -prefMapHandle 1976 -prefMapSize 270279 -ipcHandle 1760 -initialChannelId {3f0bd45e-7a60-4b1d-b5cb-63a9b786d0ee} -parentPid 3200 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3200" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2424 -prefsLen 27133 -prefMapHandle 2428 -prefMapSize 270279 -ipcHandle 2436 -initialChannelId {9bc5c24c-570b-4120-859b-575a5e42816a} -parentPid 3200 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3200" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3900 -prefsLen 25213 -prefMapHandle 3904 -prefMapSize 270279 -jsInitHandle 3908 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3916 -initialChannelId {ebaab793-3836-4eaf-be52-c9e9544b4720} -parentPid 3200 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3200" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3972 -prefsLen 27323 -prefMapHandle 3960 -prefMapSize 270279 -ipcHandle 4156 -initialChannelId {ad70d163-63b7-4d97-bb8c-378d89a3d21a} -parentPid 3200 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3200" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2892 -prefsLen 34822 -prefMapHandle 3832 -prefMapSize 270279 -jsInitHandle 3108 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3080 -initialChannelId {17424ad2-9e92-4305-b4b2-b9908eaa83a7} -parentPid 3200 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3200" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 3932 -prefsLen 35010 -prefMapHandle 5068 -prefMapSize 270279 -ipcHandle 5084 -initialChannelId {f5beae5b-13d0-4907-8342-45d022b45a7c} -parentPid 3200 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3200" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2700 -prefsLen 32952 -prefMapHandle 2976 -prefMapSize 270279 -jsInitHandle 2980 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3068 -initialChannelId {854d1224-2a73-4a99-b7f2-3233aec41ae4} -parentPid 3200 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3200" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5600 -prefsLen 32952 -prefMapHandle 5604 -prefMapSize 270279 -jsInitHandle 5608 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2864 -initialChannelId {f6a74032-fd0b-400a-89a7-573214faed37} -parentPid 3200 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3200" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5696 -prefsLen 32952 -prefMapHandle 5700 -prefMapSize 270279 -jsInitHandle 5704 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5712 -initialChannelId {3bb284cf-b8b4-49ab-a090-7224966c29c7} -parentPid 3200 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3200" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5316 -prefsLen 32952 -prefMapHandle 6032 -prefMapSize 270279 -jsInitHandle 6036 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5312 -initialChannelId {0af3f312-d47f-49dd-878f-df8071e37c43} -parentPid 3200 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3200" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6208 -prefsLen 32952 -prefMapHandle 6212 -prefMapSize 270279 -jsInitHandle 6240 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6248 -initialChannelId {68b22036-c61b-4539-9948-0c7b8763443f} -parentPid 3200 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3200" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6456 -prefsLen 32952 -prefMapHandle 6460 -prefMapSize 270279 -jsInitHandle 6464 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6476 -initialChannelId {25d0afde-f5c0-4b0d-93ee-4d051f6b128e} -parentPid 3200 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3200" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6824 -prefsLen 33002 -prefMapHandle 6828 -prefMapSize 270279 -jsInitHandle 6860 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6864 -initialChannelId {ff6048e3-113b-409c-a652-1bfcda01fb76} -parentPid 3200 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3200" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7040 -prefsLen 33002 -prefMapHandle 7044 -prefMapSize 270279 -jsInitHandle 7048 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7056 -initialChannelId {17a18064-a3f9-43a8-9856-fe73e53f27cc} -parentPid 3200 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3200" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 7404 -prefsLen 35129 -prefMapHandle 7408 -prefMapSize 270279 -ipcHandle 7412 -initialChannelId {156ca889-444a-4ae4-92c1-f0cd1aa10b1d} -parentPid 3200 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3200" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 utility3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7628 -prefsLen 33002 -prefMapHandle 7632 -prefMapSize 270279 -jsInitHandle 7636 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5628 -initialChannelId {ec7da93f-44eb-4cb7-8cc8-4f3ff522e02f} -parentPid 3200 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3200" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 16 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5620 -prefsLen 33002 -prefMapHandle 6352 -prefMapSize 270279 -jsInitHandle 6356 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7712 -initialChannelId {c988e6a9-7ca3-4640-9674-fd54fbd819d3} -parentPid 3200 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3200" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 17 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7828 -prefsLen 33002 -prefMapHandle 7832 -prefMapSize 270279 -jsInitHandle 7836 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7844 -initialChannelId {4632409c-d621-4a46-af8c-fb17c96bb934} -parentPid 3200 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3200" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 18 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4804 -prefsLen 36778 -prefMapHandle 7868 -prefMapSize 270279 -jsInitHandle 7008 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3104 -initialChannelId {8cf979dd-d3fc-4e3c-bfe7-c074b09e2961} -parentPid 3200 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3200" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 19 tab3⤵
- Checks processor information in registry
-
-
C:\Users\Admin\Downloads\Xeno-v1.3.30.exe"C:\Users\Admin\Downloads\Xeno-v1.3.30.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\3BowJzYWnq4atYoGlpgllfnOauG\Xeno-v1.3.30.exeC:\Users\Admin\AppData\Local\Temp\3BowJzYWnq4atYoGlpgllfnOauG\Xeno-v1.3.30.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3BowJzYWnq4atYoGlpgllfnOauG\Xeno-v1.3.30.exe"C:\Users\Admin\AppData\Local\Temp\3BowJzYWnq4atYoGlpgllfnOauG\Xeno-v1.3.30.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Xeno" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1628 --field-trial-handle=1632,i,6796005520949897669,18297978649041975541,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:25⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Downloads MZ/PE file
- Drops desktop.ini file(s)
- Subvert Trust Controls: Mark-of-the-Web Bypass
- Checks processor information in registry
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1908 -prefsLen 31111 -prefMapHandle 1916 -prefMapSize 270975 -ipcHandle 2000 -initialChannelId {65dbda53-e6fa-441d-aa68-4b65d4931381} -parentPid 2880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2880" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2188 -prefsLen 31111 -prefMapHandle 2192 -prefMapSize 270975 -ipcHandle 2212 -initialChannelId {61f106c5-05e8-47c1-86d0-1efd77a407d3} -parentPid 2880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3108 -prefsLen 31617 -prefMapHandle 3112 -prefMapSize 270975 -jsInitHandle 3116 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3124 -initialChannelId {952bdbff-faf6-4da9-8ab8-a8e4d9c1d3b6} -parentPid 2880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3340 -prefsLen 31617 -prefMapHandle 3344 -prefMapSize 270975 -ipcHandle 3352 -initialChannelId {8148fd8d-2127-432b-8f26-c2eda2cf0471} -parentPid 2880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2880" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3996 -prefsLen 31758 -prefMapHandle 4000 -prefMapSize 270975 -jsInitHandle 4004 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4008 -initialChannelId {e184a150-09b3-438a-957a-c14aeee709ef} -parentPid 2880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 3696 -prefsLen 39368 -prefMapHandle 2852 -prefMapSize 270975 -ipcHandle 3804 -initialChannelId {745d48a1-a5bf-40f4-a1d3-eb203d98a608} -parentPid 2880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3016 -prefsLen 36299 -prefMapHandle 5616 -prefMapSize 270975 -jsInitHandle 5624 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5400 -initialChannelId {a1b7e537-3e7d-4c27-954d-89d969b3519a} -parentPid 2880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5796 -prefsLen 36299 -prefMapHandle 5800 -prefMapSize 270975 -jsInitHandle 5804 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5812 -initialChannelId {6a8bda40-7756-48b4-a6bf-0d16f8b37c85} -parentPid 2880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6032 -prefsLen 36299 -prefMapHandle 6036 -prefMapSize 270975 -jsInitHandle 6040 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6048 -initialChannelId {ddc8bbb0-3e45-40ef-a1ba-c7b154ccf946} -parentPid 2880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5852 -prefsLen 36339 -prefMapHandle 5864 -prefMapSize 270975 -jsInitHandle 5796 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5608 -initialChannelId {03e72077-17a8-447b-8056-94ed37379f80} -parentPid 2880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3548 -prefsLen 36381 -prefMapHandle 3588 -prefMapSize 270975 -jsInitHandle 3592 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2464 -initialChannelId {59bfbb31-de00-4aa7-9358-21bfee9dc861} -parentPid 2880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 1020 -prefsLen 40317 -prefMapHandle 1028 -prefMapSize 270975 -ipcHandle 7036 -initialChannelId {43ce1ec6-9328-4515-a3fa-504a8767b20f} -parentPid 2880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 utility3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 2 -prefsHandle 18180 -prefsLen 40317 -prefMapHandle 16556 -prefMapSize 270975 -ipcHandle 5364 -initialChannelId {27b061c5-4ae9-48ea-81e1-0b0e49ca0a1f} -parentPid 2880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2880" -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 utility3⤵
- Checks processor information in registry
-
-
C:\Users\Admin\Downloads\RobloxPlayerInstaller-FYGK2H98MC.exe"C:\Users\Admin\Downloads\RobloxPlayerInstaller-FYGK2H98MC.exe"3⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Roblox\Versions\version-390ba09e7e944154\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-390ba09e7e944154\RobloxPlayerBeta.exe" -personalizedToken FYGK2H98MC --deeplink https://www.roblox.com/games/17625359962/RIVALS -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 10684⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\Downloads\Xeno-v1.3.30.exe"C:\Users\Admin\Downloads\Xeno-v1.3.30.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\3BowJzYWnq4atYoGlpgllfnOauG\Xeno-v1.3.30.exeC:\Users\Admin\AppData\Local\Temp\3BowJzYWnq4atYoGlpgllfnOauG\Xeno-v1.3.30.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\3BowJzYWnq4atYoGlpgllfnOauG\Xeno-v1.3.30.exe"C:\Users\Admin\AppData\Local\Temp\3BowJzYWnq4atYoGlpgllfnOauG\Xeno-v1.3.30.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Xeno" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1628 --field-trial-handle=1632,i,2844096632579906098,17739117383578535500,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:23⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\3BowJzYWnq4atYoGlpgllfnOauG\Xeno-v1.3.30.exe"C:\Users\Admin\AppData\Local\Temp\3BowJzYWnq4atYoGlpgllfnOauG\Xeno-v1.3.30.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Xeno" --mojo-platform-channel-handle=1812 --field-trial-handle=1632,i,2844096632579906098,17739117383578535500,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:83⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\3BowJzYWnq4atYoGlpgllfnOauG\Xeno-v1.3.30.exe"C:\Users\Admin\AppData\Local\Temp\3BowJzYWnq4atYoGlpgllfnOauG\Xeno-v1.3.30.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Xeno" --app-user-model-id=Xeno --app-path="C:\Users\Admin\AppData\Local\Temp\3BowJzYWnq4atYoGlpgllfnOauG\resources\app.asar" --enable-sandbox --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2472 --field-trial-handle=1632,i,2844096632579906098,17739117383578535500,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:13⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\3BowJzYWnq4atYoGlpgllfnOauG\Xeno-v1.3.30.exe"C:\Users\Admin\AppData\Local\Temp\3BowJzYWnq4atYoGlpgllfnOauG\Xeno-v1.3.30.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Xeno" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=3208 --field-trial-handle=1632,i,2844096632579906098,17739117383578535500,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:23⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/xe-no3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2dc,0x2e0,0x2e4,0x2d8,0x340,0x7ffe92b2c188,0x7ffe92b2c194,0x7ffe92b2c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1616,i,3734237322139844778,15744054539660227005,524288 --field-trial-handle=2420,i,3220950151442871355,3787344583496948998,262144 --variations-seed-version --mojo-platform-channel-handle=2448 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1488,i,14047271340831765219,2787964199757189781,262144 --field-trial-handle=2420,i,3220950151442871355,3787344583496948998,262144 --variations-seed-version --mojo-platform-channel-handle=2416 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2116,i,8356477616156761265,11435739307460311899,524288 --field-trial-handle=2420,i,3220950151442871355,3787344583496948998,262144 --variations-seed-version --mojo-platform-channel-handle=2960 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,4203635831224105837,533995260025932048,2097152 --field-trial-handle=2420,i,3220950151442871355,3787344583496948998,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,441262507696572246,18033193271073938533,2097152 --field-trial-handle=2420,i,3220950151442871355,3787344583496948998,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4860,i,12435924992689472084,1120225858713171552,2097152 --field-trial-handle=2420,i,3220950151442871355,3787344583496948998,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3924,i,1658556365453846509,17136302604996465485,524288 --field-trial-handle=2420,i,3220950151442871355,3787344583496948998,262144 --variations-seed-version --mojo-platform-channel-handle=3900 /prefetch:144⤵
- Modifies registry class
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3952,i,17081624518924342194,4142688261676698404,524288 --field-trial-handle=2420,i,3220950151442871355,3787344583496948998,262144 --variations-seed-version --mojo-platform-channel-handle=3936 /prefetch:124⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window4⤵
- Loads dropped DLL
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2c0,0x7ffe92b2c188,0x7ffe92b2c194,0x7ffe92b2c1a05⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1820,i,17119175324479184064,18350833944798459662,524288 --field-trial-handle=2156,i,8696087223178710771,5598338699679855607,262144 --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:115⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,3298045855942475926,5056244044093642434,262144 --field-trial-handle=2156,i,8696087223178710771,5598338699679855607,262144 --variations-seed-version --mojo-platform-channel-handle=2152 /prefetch:25⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2444,i,17081979685922758284,10781958885011077296,524288 --field-trial-handle=2156,i,8696087223178710771,5598338699679855607,262144 --variations-seed-version --mojo-platform-channel-handle=2972 /prefetch:135⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4452,i,3672218022850701296,7595799186248621867,524288 --field-trial-handle=2156,i,8696087223178710771,5598338699679855607,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4452,i,3672218022850701296,7595799186248621867,524288 --field-trial-handle=2156,i,8696087223178710771,5598338699679855607,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4496,i,4375959292341971942,7780153599539116058,524288 --field-trial-handle=2156,i,8696087223178710771,5598338699679855607,262144 --variations-seed-version --mojo-platform-channel-handle=4552 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4556,i,8358891109328415183,9359790008749128020,524288 --field-trial-handle=2156,i,8696087223178710771,5598338699679855607,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4560,i,7377112685792155555,15616786778488669727,524288 --field-trial-handle=2156,i,8696087223178710771,5598338699679855607,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4300,i,14565686814140805934,5763824750607308388,524288 --field-trial-handle=2156,i,8696087223178710771,5598338699679855607,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4900,i,9281879068988202589,8232861083433715572,524288 --field-trial-handle=2156,i,8696087223178710771,5598338699679855607,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4588,i,1060891270412612071,10736112749652575419,262144 --field-trial-handle=2156,i,8696087223178710771,5598338699679855607,262144 --variations-seed-version --mojo-platform-channel-handle=4580 /prefetch:105⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,13488846838670992024,16639645100863555070,524288 --field-trial-handle=2156,i,8696087223178710771,5598338699679855607,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2388,i,8410327776101882867,10549347587957116371,524288 --field-trial-handle=2156,i,8696087223178710771,5598338699679855607,262144 --variations-seed-version --mojo-platform-channel-handle=4116 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=568,i,15807395397225197997,15801457656781019025,524288 --field-trial-handle=2156,i,8696087223178710771,5598338699679855607,262144 --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,18262360428634418167,7567013585037633070,524288 --field-trial-handle=2156,i,8696087223178710771,5598338699679855607,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3804,i,16793772683192525615,16516093483382946932,524288 --field-trial-handle=2156,i,8696087223178710771,5598338699679855607,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3404,i,4057347094773098111,4258678339174532998,524288 --field-trial-handle=2156,i,8696087223178710771,5598338699679855607,262144 --variations-seed-version --mojo-platform-channel-handle=4552 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2968,i,4919194075807488474,11675512831841631791,524288 --field-trial-handle=2156,i,8696087223178710771,5598338699679855607,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1032,i,12652979968609672868,2079316846496565987,524288 --field-trial-handle=2156,i,8696087223178710771,5598338699679855607,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4580,i,3598015687088609938,17037563646224435690,524288 --field-trial-handle=2156,i,8696087223178710771,5598338699679855607,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:145⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\3BowJzYWnq4atYoGlpgllfnOauG\Xeno-v1.3.30.exe"C:\Users\Admin\AppData\Local\Temp\3BowJzYWnq4atYoGlpgllfnOauG\Xeno-v1.3.30.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --user-data-dir="C:\Users\Admin\AppData\Roaming\Xeno" --mojo-platform-channel-handle=2092 --field-trial-handle=1632,i,2844096632579906098,17739117383578535500,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:83⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\3BowJzYWnq4atYoGlpgllfnOauG\Xeno-v1.3.30.exe"C:\Users\Admin\AppData\Local\Temp\3BowJzYWnq4atYoGlpgllfnOauG\Xeno-v1.3.30.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --user-data-dir="C:\Users\Admin\AppData\Roaming\Xeno" --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2268 --field-trial-handle=1632,i,2844096632579906098,17739117383578535500,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:23⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM RobloxPlayerBeta.exe /T"3⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM RobloxPlayerBeta.exe /T4⤵
- Kills process with taskkill
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Program Files (x86)\Roblox\Versions\version-390ba09e7e944154\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-390ba09e7e944154\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Roblox\Versions\version-390ba09e7e944154\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-390ba09e7e944154\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Roblox\Versions\version-390ba09e7e944154\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-390ba09e7e944154\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Roblox\Versions\version-390ba09e7e944154\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-390ba09e7e944154\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Roblox\Versions\version-390ba09e7e944154\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-390ba09e7e944154\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Roblox\Versions\version-390ba09e7e944154\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-390ba09e7e944154\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Roblox\Versions\version-390ba09e7e944154\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-390ba09e7e944154\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Roblox\Versions\version-390ba09e7e944154\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-390ba09e7e944154\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,Control_RunDLL C:\Windows\System32\srchadmin.dll ,1⤵
-
C:\Program Files (x86)\Roblox\Versions\version-390ba09e7e944154\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-390ba09e7e944154\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Roblox\Versions\version-390ba09e7e944154\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-390ba09e7e944154\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Roblox\Versions\version-390ba09e7e944154\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-390ba09e7e944154\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v16
Defense Evasion
Modify Registry
1Subvert Trust Controls
1SIP and Trust Provider Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
RobloxStudioInstaller.exe
settings.dat
settings.dat
settings.dat
MANIFEST-000001
BookmarkMergedSurfaceOrdering
BrowsingTopicsState
the-real-index
the-real-index~RFe5993e9.TMP
SiteList-Enterprise.json
Network Persistent State
Network Persistent State
Sdch Dictionaries
b43c3de1-8286-496a-af4f-c785e0d5acf2.tmp
Preferences
Secure Preferences
index.txt
index.txt
index.txt~RFe598478.TMP
sync_diagnostic.log
domain_actions.dll
data.txt
Local State
Local State
Local State
Local State
Local State
Local State
crs.pb
ct_config.pb
kp_pinslist.pb
typosquatting_list.pb
ranked_dicts
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
activity-stream.contile.json.tmp
activity-stream.discovery_stream.json
activity-stream.weather_feed.json
13536
0735811DDE6F57D2AA021B2A341BC0E332C0B4B2
076A136CD5E11E7313455A5F6B7208F391A6C1D7
08A7112056C89ECBC76F71F42902CE0461BDF0B2
0C64269308788402B119523DDA6091233D849F01
0EF03E0612D1FD01C3C73EA012275A4A33B1A6BB
0F4D9D4BD0F6A1A94CEB508665FFC423AFAFC84D
12B6A63C42231A8B7523CB3367B2010735B33470
2C01BCA79FBEB1C8C347A88C8A08E8DEDA78EBEA
2D194AA9162E0A04BE779C422A355439267D09E6
2E5766286441F6A99F910D20FC5A96583683CC9A
3955CD93FFC8BA5F29E3D5DA6400592EB90053B7
3F706C6AC364ED66480D17DC2543B347319C396B
3FDB7C91AD4C21CCB65A910388EA2C626D2C800E
451C9D9BE07CB43F47981FB3A8A42E2F4629E607
46C93675C65F0EA46E6FC9A9BF4CD753A0BA547E
47A29A6D61BC565DCBB6309E640C081DECDD793A
4C11E373FD9A73A5E61FCB5291518B290C3C15DF
4E6529BB0ABC2D7F34AAEE3837C868CD4F3D5C8A
641F460609D24F35B8EC045517585FC5FCDFCF7A
67C3E923F3E1ACE04FEA426D8EF2D5F614AA57E1
6905930F8805501966A20243FDC4CC27F243D8A6
6D89348819C8881868053197CA0754F36784BF5F
6E1FC477C4B6676D8A03FC74425C75D4721DF89C
8840D618F7EC438C14A252860B2434030ECE74E8
8BBB0C2F4F032ED45D0E28C00B9101432A62B1E9
8BC39D2A5BF7FBE2E168A924EB888041ACD3EFE5
93ED7C2BEA86CFA8B7D4FB541E0C6C843E815FA7
9D6B3DBE980A0DB6BDC7844ADC6A0E11E9A8491E
A118551DC66F1758842FBBC9B8144D52E6BA0806
A42CC84CCE2D01EE76132212E89B3401925C9ED8
AD7D7CF1268E3DCBED8F10558CC8299D4F2C331E
AD7EF37C139E64EC5BF193DA03EC6127C2B9E5A5
BB95D0607349D05725D5FE01D4FB300E319072AD
BE87830EE3AF5AD6213BDBB31B11321662C83E8C
C20E036239CAF315DF30D2CDAAC4F746820BB89D
CD1C116DEEE8F4F97C1806976E10E7E2B349E486
CD1C116DEEE8F4F97C1806976E10E7E2B349E486
D02A973010DC0E0156EE63E307B608831E8C06F0
D0F48A0632B6C451791F4257697E861961F06A6F
D6F0689BC90011C26A86B6A2F1E5268D7827C217
D9CD66862671AF5ABF45FE2E3D1B09C21BDF69EE
E20514793C2897F204D46B62CBCE6C3A9E810BE8
E473D920361435DF4BBBF194E406FE372015579A
E4E6EF4A8C0104A5EBA4DA2862920DB5ED8D7A09
E5E64E52DFEC73AAA46B59FA1856DF0913CAC1B9
E756804C5443A278EB090919524816E5DE07647B
E9A3EFE3FC6FB463576CD912603080D7BB2D20B2
EF5BC0CDE2442B05693A3669552988FF163FB863
F4A505B75613C1851E65B0A59D4A706B41D9714D
FE876268AB06E025E620EF35B04F7DBA8E156A29
FFCBC0EAD7DEFE44E4F2E4CBB4AC018D7E6CF992
FFCC66A38E2666C7056588C00E1A11A8E934C00A
scriptCache-child.bin
scriptCache.bin
startupCache.8.little
urlCache.bin
webext.sc.lz4
icudtl.dat
xeno.node
v8_context_snapshot.bin
7efa1a6f-73f1-48ec-85b9-97d01acea5a6.zip
LICENSE.electron.txt
LICENSES.chromium.html
chrome_100_percent.pak
chrome_200_percent.pak
d3dcompiler_47.dll
ffmpeg.dll
libEGL.dll
libGLESv2.dll
af.pak
am.pak
ar.pak
bg.pak
bn.pak
ca.pak
cs.pak
da.pak
de.pak
el.pak
en-GB.pak
en-US.pak
es-419.pak
es.pak
et.pak
fa.pak
fi.pak
fil.pak
fr.pak
gu.pak
he.pak
hi.pak
hr.pak
hu.pak
id.pak
it.pak
ja.pak
kn.pak
ko.pak
lt.pak
lv.pak
ml.pak
mr.pak
ms.pak
nb.pak
nl.pak
pl.pak
pt-BR.pak
pt-PT.pak
ro.pak
ru.pak
sk.pak
sl.pak
sr.pak
sv.pak
sw.pak
ta.pak
te.pak
th.pak
tr.pak
uk.pak
ur.pak
vi.pak
zh-CN.pak
zh-TW.pak
resources.pak
binding.gyp
addon.obj
vcpkg.applocal.log
win_delay_load_hook.obj
xeno.node.recipe
CL.command.1.tlog
CL.read.1.tlog
CL.write.1.tlog
Cl.items.tlog
link.command.1.tlog
link.read.1.tlog
link.secondary.1.tlog
link.write.1.tlog
xeno.lastbuildstate
xeno.iobj
xeno.ipdb
config.gypi
xeno.vcxproj
xeno.vcxproj.filters
package.json
elevate.exe
Failed.png
Xeno.dll
Xeno.ico
api-ms-win-crt-convert-l1-1-0.dll
api-ms-win-crt-environment-l1-1-0.dll
api-ms-win-crt-filesystem-l1-1-0.dll
api-ms-win-crt-heap-l1-1-0.dll
api-ms-win-crt-locale-l1-1-0.dll
api-ms-win-crt-math-l1-1-0.dll
api-ms-win-crt-runtime-l1-1-0.dll
api-ms-win-crt-stdio-l1-1-0.dll
api-ms-win-crt-string-l1-1-0.dll
api-ms-win-crt-utility-l1-1-0.dll
concrt140.dll
index.html
libcrypto-3-x64.dll
libcurl.dll
libssl-3-x64.dll
msvcp140.dll
msvcp140_1.dll
msvcrt.dll
notification.mp3
ucrtbase.dll
vcruntime140.dll
vcruntime140_1.dll
zlib1.dll
snapshot_blob.bin
vk_swiftshader.dll
vk_swiftshader_icd.json
vulkan-1.dll
StdUtils.dll
System.dll
nsis7z.dll
tmpaddon
tmpaddon
XENO_CACHE.bin
default.dic
6824f4a902c78fbd.customDestinations-ms
6824f4a902c78fbd.customDestinations-ms
AlternateServices.bin
AlternateServices.bin
AlternateServices.bin
AlternateServices.bin
AlternateServices.bin
SiteSecurityServiceState.bin
SiteSecurityServiceState.bin
addonStartup.json.lz4
bounce-tracking-protection.sqlite
cert9.db
compatibility.ini
content-prefs.sqlite
cookies.sqlite
store.json.mozlz4
data.safe.bin
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
events
events
events
events
pageload
0d7ed4b1-7ce0-4916-b236-44834a452462
39d2b2db-a4c6-446d-b559-cc62e9a8a610
bd1f3a7b-b54f-4ece-a3dc-4560d27869a4
bef3d7e0-756b-4df9-b6ff-cc6e1df0520b
c4c69f4b-e8ab-4654-8753-01515ce8b066
cd33943d-55eb-464b-b427-26a24222a2aa
d65b0ab4-74ed-4062-a570-82121e610bba
d85557ef-180f-445f-aae3-394b90d5c185
d8a2fd5e-8269-4971-aed2-34a825442b7f
e432f4e4-8f40-4a95-af49-a2489f12475a
ea371926-4ba6-4768-ad2f-7e29fd53e29a
domain_to_categories.sqlite
extension-preferences.json
extensions.json
favicons.sqlite
gmpopenh264.dll
gmpopenh264.info
manifest.json
widevinecdm.dll
permissions.sqlite
places.sqlite
places.sqlite
prefs-1.js
prefs-1.js
prefs-1.js
prefs-1.js
prefs-1.js
prefs-1.js
prefs.js
prefs.js
prefs.js
protections.sqlite
sessionCheckpoints.json
sessionCheckpoints.json
sessionCheckpoints.json.tmp
sessionCheckpoints.json.tmp
sessionCheckpoints.json.tmp
recovery.baklz4
recovery.baklz4
recovery.baklz4
recovery.baklz4
recovery.baklz4
recovery.jsonlz4
sessionstore.jsonlz4
storage.sqlite
.metadata-v2
usage
2091240663xb-da-rdki-ra.sqlite
3140325527hBbDa.sqlite-wal
3140325527hBbDa.sqlite-wal
usage
usage
usage
1657114595AmcateirvtiSty.sqlite
3870112724rsegmnoittet-es.sqlite
3870112724rsegmnoittet-es.sqlite
xulstore.json
f_000012
data_0
data_1
data_2
data_3
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State~RFe5a9193.TMP
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity~RFe5d209a.TMP
CURRENT
MANIFEST-000001
RobloxPlayerInstaller-FYGK2H98MC.exe:Zone.Identifier
RobloxPlayerInstaller-FYGK2H98MC.r6tPJyba.exe.part
Xeno-v1.3.30.exe:Zone.Identifier
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
keys.json
manifest.json
manifest.json
memory/1044-3708-0x0000000000B10000-0x0000000000C22000-memory.dmp
memory/1068-10618-0x0000000000DF0000-0x0000000000F02000-memory.dmp
memory/1068-10666-0x0000000000DF0000-0x0000000000F02000-memory.dmp
memory/1068-10529-0x0000000000AC0000-0x0000000000ADA000-memory.dmp
memory/1068-10530-0x0000000000DF0000-0x0000000000F02000-memory.dmp
memory/3296-1672-0x0000000000A00000-0x0000000000B12000-memory.dmp
memory/3296-2622-0x0000000000A00000-0x0000000000B12000-memory.dmp
memory/3548-10895-0x00000000024D0000-0x0000000002AD2000-memory.dmp
memory/4004-3795-0x00007FFEBE6C0000-0x00007FFEBE6C1000-memory.dmp
memory/5536-3732-0x00007FFEBD430000-0x00007FFEBD431000-memory.dmp
memory/5536-3731-0x00007FFEBD980000-0x00007FFEBD981000-memory.dmp
memory/6380-4927-0x0000016776C30000-0x0000016776C31000-memory.dmp
memory/6380-4924-0x0000016776C30000-0x0000016776C31000-memory.dmp
memory/6380-4925-0x0000016776C30000-0x0000016776C31000-memory.dmp
memory/6380-4928-0x0000016776C30000-0x0000016776C31000-memory.dmp
memory/6380-4929-0x0000016776C30000-0x0000016776C31000-memory.dmp
memory/6380-4926-0x0000016776C30000-0x0000016776C31000-memory.dmp
memory/6380-4930-0x0000016776C30000-0x0000016776C31000-memory.dmp
memory/6380-4918-0x0000016776C30000-0x0000016776C31000-memory.dmp
memory/6380-4920-0x0000016776C30000-0x0000016776C31000-memory.dmp
memory/6380-4919-0x0000016776C30000-0x0000016776C31000-memory.dmp