Analysis
- user interaction
yes - max time kernel
359s - max time network
360s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
14/07/2026, 03:15
General
- Target https://xeno.lat/
- Sample260714-dr1eksft9v
Score
10/10
Malware Config
Signatures
- Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
- Detect SalatStealer payload 34 IoCs
- Downloads MZ/PE file 1 IoCs
- Executes dropped EXE 25 IoCs
- Loads dropped DLL 35 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of NtSetInformationThreadHideFromDebugger 15 IoCs
- UPX packed file 39 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 9 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 5 IoCs
- Modifies Internet Explorer settings 1 TTPs 6 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 41 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 2 IoCs
- Suspicious behavior: LoadsDriver 8 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://xeno.lat/1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x268,0x26c,0x270,0x264,0x2c4,0x7ffea611c188,0x7ffea611c194,0x7ffea611c1a02⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1888,i,13148269056994689270,9520599721925859343,524288 --field-trial-handle=2580,i,10832750442162113591,5939632089338494028,262144 --variations-seed-version --mojo-platform-channel-handle=2608 /prefetch:112⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,1104891942305889656,8876377676152032658,262144 --field-trial-handle=2580,i,10832750442162113591,5939632089338494028,262144 --variations-seed-version --mojo-platform-channel-handle=2576 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2224,i,16071841826377566308,2959942816480908280,524288 --field-trial-handle=2580,i,10832750442162113591,5939632089338494028,262144 --variations-seed-version --mojo-platform-channel-handle=2740 /prefetch:132⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3612,i,4468757730656003955,17763182251038433224,2097152 --field-trial-handle=2580,i,10832750442162113591,5939632089338494028,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3608,i,2968907554502113913,3896832713781028579,2097152 --field-trial-handle=2580,i,10832750442162113591,5939632089338494028,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4284,i,13139331284278385078,4779269818631637504,2097152 --field-trial-handle=2580,i,10832750442162113591,5939632089338494028,262144 --variations-seed-version --mojo-platform-channel-handle=4840 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4228,i,14378244860643337338,1123519791050800313,2097152 --field-trial-handle=2580,i,10832750442162113591,5939632089338494028,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:92⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3796,i,4985350228365543545,7480188398541495857,2097152 --field-trial-handle=2580,i,10832750442162113591,5939632089338494028,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5376,i,3900754137641788503,5869688134860286141,2097152 --field-trial-handle=2580,i,10832750442162113591,5939632089338494028,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5656,i,14893132298188315889,15236082099617781454,524288 --field-trial-handle=2580,i,10832750442162113591,5939632089338494028,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5616,i,7237358461033182516,13854547295221262666,524288 --field-trial-handle=2580,i,10832750442162113591,5939632089338494028,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6100,i,1634933980038525037,10333155853191695771,524288 --field-trial-handle=2580,i,10832750442162113591,5939632089338494028,262144 --variations-seed-version --mojo-platform-channel-handle=6740 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6100,i,1634933980038525037,10333155853191695771,524288 --field-trial-handle=2580,i,10832750442162113591,5939632089338494028,262144 --variations-seed-version --mojo-platform-channel-handle=6740 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7108,i,13802741518457103159,972478548434318393,524288 --field-trial-handle=2580,i,10832750442162113591,5939632089338494028,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=7064,i,3481489202051930137,16400220366968475381,2097152 --field-trial-handle=2580,i,10832750442162113591,5939632089338494028,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4856,i,14256246873073108838,14177052582685504994,524288 --field-trial-handle=2580,i,10832750442162113591,5939632089338494028,262144 --variations-seed-version --mojo-platform-channel-handle=6852 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6876,i,513057584639969784,16776366110962661372,524288 --field-trial-handle=2580,i,10832750442162113591,5939632089338494028,262144 --variations-seed-version --mojo-platform-channel-handle=6704 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7520,i,8726610932072221565,9136714275754679320,524288 --field-trial-handle=2580,i,10832750442162113591,5939632089338494028,262144 --variations-seed-version --mojo-platform-channel-handle=7556 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6712,i,5531162519334854720,12948308441638222596,524288 --field-trial-handle=2580,i,10832750442162113591,5939632089338494028,262144 --variations-seed-version --mojo-platform-channel-handle=7332 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,8133740534602280544,2105191611232018738,524288 --field-trial-handle=2580,i,10832750442162113591,5939632089338494028,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6240,i,9102248187025894953,8594874990423486861,2097152 --field-trial-handle=2580,i,10832750442162113591,5939632089338494028,262144 --variations-seed-version --mojo-platform-channel-handle=3804 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=5580,i,14210887735238655773,15565398813253375300,2097152 --field-trial-handle=2580,i,10832750442162113591,5939632089338494028,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7004,i,17302465812978868242,14341172551592359507,524288 --field-trial-handle=2580,i,10832750442162113591,5939632089338494028,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:142⤵
- Modifies registry class
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5984,i,9303965811189518195,5248671140772213335,524288 --field-trial-handle=2580,i,10832750442162113591,5939632089338494028,262144 --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:122⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6240,i,3189590943163547631,1988802292701262844,2097152 --field-trial-handle=2580,i,10832750442162113591,5939632089338494028,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4800,i,8740404669883549280,6242129035959516877,262144 --field-trial-handle=2580,i,10832750442162113591,5939632089338494028,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:102⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=3664,i,1036412075732606529,15150715551412597600,2097152 --field-trial-handle=2580,i,10832750442162113591,5939632089338494028,262144 --variations-seed-version --mojo-platform-channel-handle=6596 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,9897633932818247113,12526868538269679253,524288 --field-trial-handle=2580,i,10832750442162113591,5939632089338494028,262144 --variations-seed-version --mojo-platform-channel-handle=3896 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=5816,i,2066800018195760372,16406753730885596277,2097152 --field-trial-handle=2580,i,10832750442162113591,5939632089338494028,262144 --variations-seed-version --mojo-platform-channel-handle=6912 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=3684,i,2883882820286510318,10135187386888245021,2097152 --field-trial-handle=2580,i,10832750442162113591,5939632089338494028,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=3840,i,14486834450359222393,6206679249544488724,2097152 --field-trial-handle=2580,i,10832750442162113591,5939632089338494028,262144 --variations-seed-version --mojo-platform-channel-handle=1620 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=7756,i,14540065930635046002,17924546000509963344,2097152 --field-trial-handle=2580,i,10832750442162113591,5939632089338494028,262144 --variations-seed-version --mojo-platform-channel-handle=7728 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=5816,i,8839574192360513407,1021903716976942955,2097152 --field-trial-handle=2580,i,10832750442162113591,5939632089338494028,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=7824,i,5191361748547700700,6057231835816876093,2097152 --field-trial-handle=2580,i,10832750442162113591,5939632089338494028,262144 --variations-seed-version --mojo-platform-channel-handle=7868 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=7940,i,12007559701093707819,4926111087280169556,2097152 --field-trial-handle=2580,i,10832750442162113591,5939632089338494028,262144 --variations-seed-version --mojo-platform-channel-handle=7936 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=4152,i,7873298603130500638,9140257444322906711,2097152 --field-trial-handle=2580,i,10832750442162113591,5939632089338494028,262144 --variations-seed-version --mojo-platform-channel-handle=3764 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6852,i,2224373402192146251,13471715200300047271,524288 --field-trial-handle=2580,i,10832750442162113591,5939632089338494028,262144 --variations-seed-version --mojo-platform-channel-handle=7064 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5700,i,2647752677452812637,5899619875757290961,524288 --field-trial-handle=2580,i,10832750442162113591,5939632089338494028,262144 --variations-seed-version --mojo-platform-channel-handle=2072 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6896,i,3496950067726943781,7431559256168235222,524288 --field-trial-handle=2580,i,10832750442162113591,5939632089338494028,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8160,i,7390905576977644091,1554663072674913450,524288 --field-trial-handle=2580,i,10832750442162113591,5939632089338494028,262144 --variations-seed-version --mojo-platform-channel-handle=8260 /prefetch:142⤵
-
-
C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
-
C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 61283⤵
- Executes dropped EXE
-
-
C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 61283⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6312,i,13178932315465009476,11134577421810173221,524288 --field-trial-handle=2580,i,10832750442162113591,5939632089338494028,262144 --variations-seed-version --mojo-platform-channel-handle=7108 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7984,i,6794459066477293879,2070117515285292348,524288 --field-trial-handle=2580,i,10832750442162113591,5939632089338494028,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\Downloads\Xeno-v1.3.55\Xeno-v1.3.55\Xeno-v1.3.55.exe"C:\Users\Admin\Downloads\Xeno-v1.3.55\Xeno-v1.3.55\Xeno-v1.3.55.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Xeno.exe"C:\Users\Admin\AppData\Local\Temp\Xeno.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Common Files\RuntimeBroker.exe"C:\Program Files (x86)\Common Files\RuntimeBroker.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\RuntimeBroker.exe"C:\Program Files (x86)\Microsoft\Edge\Application\RuntimeBroker.exe" -4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3EeSij4ibNYMJ2e15JqE2bvbXaU\Xeno-v1.3.55.exeC:\Users\Admin\AppData\Local\Temp\3EeSij4ibNYMJ2e15JqE2bvbXaU\Xeno-v1.3.55.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3EeSij4ibNYMJ2e15JqE2bvbXaU\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\3EeSij4ibNYMJ2e15JqE2bvbXaU\Xeno-v1.3.55.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Xeno" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1604 --field-trial-handle=1612,i,6038972252262930077,7726646868921194258,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:24⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\3EeSij4ibNYMJ2e15JqE2bvbXaU\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\3EeSij4ibNYMJ2e15JqE2bvbXaU\Xeno-v1.3.55.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Xeno" --mojo-platform-channel-handle=2136 --field-trial-handle=1612,i,6038972252262930077,7726646868921194258,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:84⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\3EeSij4ibNYMJ2e15JqE2bvbXaU\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\3EeSij4ibNYMJ2e15JqE2bvbXaU\Xeno-v1.3.55.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Xeno" --app-user-model-id=Xeno --app-path="C:\Users\Admin\AppData\Local\Temp\3EeSij4ibNYMJ2e15JqE2bvbXaU\resources\app.asar" --enable-sandbox --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2600 --field-trial-handle=1612,i,6038972252262930077,7726646868921194258,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:14⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\3EeSij4ibNYMJ2e15JqE2bvbXaU\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\3EeSij4ibNYMJ2e15JqE2bvbXaU\Xeno-v1.3.55.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Xeno" --mojo-platform-channel-handle=1728 --field-trial-handle=1612,i,6038972252262930077,7726646868921194258,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:84⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\3EeSij4ibNYMJ2e15JqE2bvbXaU\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\3EeSij4ibNYMJ2e15JqE2bvbXaU\Xeno-v1.3.55.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Xeno" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=3384 --field-trial-handle=1612,i,6038972252262930077,7726646868921194258,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:24⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/xe-no4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\3EeSij4ibNYMJ2e15JqE2bvbXaU\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\3EeSij4ibNYMJ2e15JqE2bvbXaU\Xeno-v1.3.55.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --user-data-dir="C:\Users\Admin\AppData\Roaming\Xeno" --mojo-platform-channel-handle=3692 --field-trial-handle=1612,i,6038972252262930077,7726646868921194258,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:84⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\3EeSij4ibNYMJ2e15JqE2bvbXaU\Xeno-v1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\3EeSij4ibNYMJ2e15JqE2bvbXaU\Xeno-v1.3.55.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --user-data-dir="C:\Users\Admin\AppData\Roaming\Xeno" --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2536 --field-trial-handle=1612,i,6038972252262930077,7726646868921194258,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:24⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,Control_RunDLL C:\Windows\System32\srchadmin.dll ,1⤵
-
C:\Users\Admin\AppData\Local\Adobe\SecurityHealthSystray.exe"C:\Users\Admin\AppData\Local\Adobe\SecurityHealthSystray.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Common Files\RuntimeBroker.exe"C:\Program Files (x86)\Common Files\RuntimeBroker.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
-
C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
-
C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004C8 0x00000000000004C41⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DevicesFlow -s DevicesFlowUserSvc1⤵
-
C:\Windows\System32\ShellHost.exe"C:\Windows\System32\ShellHost.exe"1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
-
C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
-
C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3Replay Monitor
Loading Replay Monitor...
Downloads
RobloxStudioInstaller.exe
settings.dat
settings.dat
LOG.old
BookmarkMergedSurfaceOrdering
f_00005e
f_00005f
f_000060
f_000061
f_000062
f_000063
f_000064
f_000066
f_00006a
f_00006b
f_00006c
f_00006d
f_00006e
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index~RFe59a6e5.TMP
SiteList-Enterprise.json
Edge Profile.ico
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Sdch Dictionaries
Sdch Dictionaries
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
Secure Preferences
the-real-index
the-real-index
the-real-index~RFe5b19dd.TMP
index
the-real-index
the-real-index~RFe5c8823.TMP
index.txt
index.txt
index.txt
index.txt
index.txt
index.txt~RFe5a7793.TMP
the-real-index
the-real-index~RFe5c6da6.TMP
sync_diagnostic.log
CURRENT
MANIFEST-000001
ba4b2a76-0a35-490c-9451-e7cd1b1e418d.tmp
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter~RFe5a8eb4.TMP
VariationsRuntimeSeedV1
VariationsSeedV1
VariationsSeedV1~RFe599aee.TMP
81664484-1a38-4c38-83e4-0ccc4abac0f8.tmp
f8283c78-690f-4038-a695-c47dc2b796f3.tmp
1457549437
Xeno.exe
LICENSE.electron.txt
LICENSES.chromium.html
chrome_100_percent.pak
chrome_200_percent.pak
d3dcompiler_47.dll
ffmpeg.dll
icudtl.dat
libEGL.dll
libGLESv2.dll
af.pak
am.pak
ar.pak
bg.pak
bn.pak
ca.pak
cs.pak
da.pak
de.pak
el.pak
en-GB.pak
en-US.pak
es-419.pak
es.pak
et.pak
fa.pak
fi.pak
fil.pak
fr.pak
gu.pak
he.pak
hi.pak
hr.pak
hu.pak
id.pak
it.pak
ja.pak
kn.pak
ko.pak
lt.pak
lv.pak
ml.pak
mr.pak
ms.pak
nb.pak
nl.pak
pl.pak
pt-BR.pak
pt-PT.pak
ro.pak
ru.pak
sk.pak
sl.pak
sr.pak
sv.pak
sw.pak
ta.pak
te.pak
th.pak
tr.pak
uk.pak
ur.pak
vi.pak
zh-CN.pak
zh-TW.pak
resources.pak
binding.gyp
addon.obj
vcpkg.applocal.log
win_delay_load_hook.obj
xeno.node.recipe
CL.command.1.tlog
CL.read.1.tlog
CL.write.1.tlog
Cl.items.tlog
link.command.1.tlog
link.read.1.tlog
link.secondary.1.tlog
link.write.1.tlog
xeno.lastbuildstate
xeno.iobj
xeno.ipdb
xeno.node
config.gypi
xeno.vcxproj
xeno.vcxproj.filters
package.json
elevate.exe
Failed.png
Xeno.dll
Xeno.ico
api-ms-win-crt-convert-l1-1-0.dll
api-ms-win-crt-environment-l1-1-0.dll
api-ms-win-crt-filesystem-l1-1-0.dll
api-ms-win-crt-heap-l1-1-0.dll
api-ms-win-crt-locale-l1-1-0.dll
api-ms-win-crt-math-l1-1-0.dll
api-ms-win-crt-runtime-l1-1-0.dll
api-ms-win-crt-stdio-l1-1-0.dll
api-ms-win-crt-string-l1-1-0.dll
api-ms-win-crt-utility-l1-1-0.dll
concrt140.dll
index.html
libcrypto-3-x64.dll
libcurl.dll
libssl-3-x64.dll
msvcp140.dll
msvcp140_1.dll
msvcrt.dll
notification.mp3
ucrtbase.dll
vcruntime140.dll
vcruntime140_1.dll
zlib1.dll
snapshot_blob.bin
v8_context_snapshot.bin
vk_swiftshader.dll
vk_swiftshader_icd.json
vulkan-1.dll
StdUtils.dll
System.dll
nsis7z.dll
XENO_CACHE.bin
default.exc
ccba5a5986c77e43.customDestinations-ms
ccba5a5986c77e43.customDestinations-ms
ccba5a5986c77e43.customDestinations-ms
ccba5a5986c77e43.customDestinations-ms
Xeno.lnk
data_0
data_1
data_2
data_3
Network Persistent State
Network Persistent State
Network Persistent State~RFe5b89be.TMP
TransportSecurity
TransportSecurity
TransportSecurity~RFe5aef82.TMP
RobloxPlayerInstaller.exe.crdownload
memory/1564-1078-0x00007FFEC6A10000-0x00007FFEC6A11000-memory.dmp
memory/4152-1281-0x0000000000450000-0x00000000010A7000-memory.dmp
memory/4152-1293-0x0000000000450000-0x00000000010A7000-memory.dmp
memory/4608-961-0x0000000000960000-0x00000000015B7000-memory.dmp
memory/4608-1165-0x0000000000960000-0x00000000015B7000-memory.dmp
memory/4608-281-0x0000000000960000-0x00000000015B7000-memory.dmp
memory/4608-593-0x0000000000960000-0x00000000015B7000-memory.dmp
memory/6028-3859-0x0000000000D70000-0x00000000019C7000-memory.dmp
memory/6340-920-0x00000231A0410000-0x00000231A0411000-memory.dmp
memory/6340-923-0x00000231A0410000-0x00000231A0411000-memory.dmp
memory/6340-913-0x00000231A0410000-0x00000231A0411000-memory.dmp
memory/6340-915-0x00000231A0410000-0x00000231A0411000-memory.dmp
memory/6340-922-0x00000231A0410000-0x00000231A0411000-memory.dmp
memory/6340-919-0x00000231A0410000-0x00000231A0411000-memory.dmp
memory/6340-921-0x00000231A0410000-0x00000231A0411000-memory.dmp
memory/6340-924-0x00000231A0410000-0x00000231A0411000-memory.dmp
memory/6360-3300-0x0000000000D70000-0x00000000019C7000-memory.dmp
memory/6360-4000-0x0000000000D70000-0x00000000019C7000-memory.dmp
memory/6360-1959-0x0000000000D70000-0x00000000019C7000-memory.dmp
memory/6360-2171-0x0000000000D70000-0x00000000019C7000-memory.dmp
memory/6360-1360-0x0000000000D70000-0x00000000019C7000-memory.dmp
memory/6360-1164-0x0000000000D70000-0x00000000019C7000-memory.dmp
memory/6360-3109-0x0000000000D70000-0x00000000019C7000-memory.dmp
memory/6360-3772-0x0000000000D70000-0x00000000019C7000-memory.dmp
memory/6360-1588-0x0000000000D70000-0x00000000019C7000-memory.dmp
memory/6360-1219-0x0000000000D70000-0x00000000019C7000-memory.dmp
memory/6360-1218-0x0000000000D70000-0x00000000019C7000-memory.dmp
memory/6360-3802-0x0000000000D70000-0x00000000019C7000-memory.dmp
memory/6360-1271-0x0000000000D70000-0x00000000019C7000-memory.dmp
memory/6360-4025-0x0000000000D70000-0x00000000019C7000-memory.dmp
memory/6360-1387-0x0000000000D70000-0x00000000019C7000-memory.dmp
memory/6360-1925-0x0000000000D70000-0x00000000019C7000-memory.dmp
memory/6360-3987-0x0000000000D70000-0x00000000019C7000-memory.dmp
memory/6360-3976-0x0000000000D70000-0x00000000019C7000-memory.dmp
memory/6360-3956-0x0000000000D70000-0x00000000019C7000-memory.dmp
memory/6360-3933-0x0000000000D70000-0x00000000019C7000-memory.dmp
memory/6360-3614-0x0000000000D70000-0x00000000019C7000-memory.dmp
memory/6360-2660-0x0000000000D70000-0x00000000019C7000-memory.dmp
memory/6360-3914-0x0000000000D70000-0x00000000019C7000-memory.dmp
memory/6360-3904-0x0000000000D70000-0x00000000019C7000-memory.dmp
memory/6360-3893-0x0000000000D70000-0x00000000019C7000-memory.dmp
memory/6360-3857-0x0000000000D70000-0x00000000019C7000-memory.dmp
memory/6360-3648-0x0000000000D70000-0x00000000019C7000-memory.dmp
memory/6360-3835-0x0000000000D70000-0x00000000019C7000-memory.dmp
memory/6360-3740-0x0000000000D70000-0x00000000019C7000-memory.dmp
memory/6716-1005-0x00007FFEC7080000-0x00007FFEC7081000-memory.dmp
memory/6716-1006-0x00007FFEC68E0000-0x00007FFEC68E1000-memory.dmp
memory/7088-1370-0x00000000072B0000-0x00000000072CA000-memory.dmp
memory/7088-1368-0x0000000007190000-0x0000000007233000-memory.dmp
memory/7088-1291-0x0000000005F90000-0x0000000005FDC000-memory.dmp
memory/7088-1363-0x0000000070CC0000-0x0000000070D0C000-memory.dmp
memory/7088-1278-0x00000000026B0000-0x00000000026E6000-memory.dmp
memory/7088-1376-0x0000000008590000-0x0000000008B4A000-memory.dmp
memory/7088-1362-0x0000000007120000-0x0000000007156000-memory.dmp
memory/7088-1290-0x0000000005EF0000-0x0000000005F0E000-memory.dmp
memory/7088-1288-0x0000000005A00000-0x0000000005D5B000-memory.dmp
memory/7088-1364-0x0000000070E50000-0x00000000711AB000-memory.dmp
memory/7088-1367-0x0000000007100000-0x0000000007120000-memory.dmp
memory/7088-1280-0x00000000052D0000-0x000000000591A000-memory.dmp
memory/7088-1285-0x0000000005990000-0x00000000059F6000-memory.dmp
memory/7088-1369-0x00000000078F0000-0x0000000007F6C000-memory.dmp
memory/7088-1284-0x0000000005920000-0x0000000005986000-memory.dmp
memory/7088-1371-0x0000000007310000-0x000000000731A000-memory.dmp
memory/7088-1283-0x00000000051F0000-0x0000000005212000-memory.dmp
memory/7088-1372-0x0000000007510000-0x00000000075A6000-memory.dmp
memory/7088-1374-0x0000000007FA0000-0x0000000007FC2000-memory.dmp
memory/8064-3856-0x00000000003B0000-0x0000000001007000-memory.dmp
memory/8064-3854-0x00000000003B0000-0x0000000001007000-memory.dmp