Analysis
- user interaction
yes - max time kernel
1050s - max time network
1055s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
12/08/2026, 22:23
General
- Target Xeno-v1.3.60/Xeno.exe
- Size 164KB
- Sample260812-2a8xdstyfz
- SHA256 ae6fc5ba07dc314423a518f93b8ad69a5730df780669fd3b40283c32b24a56fc
Score
8/10
Malware Config
Signatures
- Downloads MZ/PE file 4 IoCs
- Executes dropped EXE 34 IoCs
- Loads dropped DLL 56 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 3 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of NtSetInformationThreadHideFromDebugger 21 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
- System Location Discovery: System Language Discovery 1 TTPs 19 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 4 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 18 IoCs
- Modifies Internet Explorer settings 1 TTPs 18 IoCs
- Modifies data under HKEY_USERS 29 IoCs
- Modifies registry class 64 IoCs
- Suspicious behavior: EnumeratesProcesses 43 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 60 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 35 IoCs
- Suspicious use of SetWindowsHookEx 64 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.60\Xeno.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.60\Xeno.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.NETCore.App&framework_version=9.0.0&arch=x64&rid=win-x64&os=win10&gui=true2⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffa974dc188,0x7ffa974dc194,0x7ffa974dc1a03⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,7265895537571571802,6051962805835893310,262144 --field-trial-handle=2268,i,13604506211650960358,7377368307481449950,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1904,i,5707802586665279794,4828413791814976159,524288 --field-trial-handle=2268,i,13604506211650960358,7377368307481449950,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:113⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2564,i,202731305679445457,16446950375095248879,524288 --field-trial-handle=2268,i,13604506211650960358,7377368307481449950,262144 --variations-seed-version --mojo-platform-channel-handle=3088 /prefetch:133⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3584,i,9006160554106972446,15927787984051286517,2097152 --field-trial-handle=2268,i,13604506211650960358,7377368307481449950,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3668,i,165662326652733924,2074542339364732987,2097152 --field-trial-handle=2268,i,13604506211650960358,7377368307481449950,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4224,i,12601285911532395627,5779783947002041463,2097152 --field-trial-handle=2268,i,13604506211650960358,7377368307481449950,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4248,i,1393322229938480067,10480052638954559666,2097152 --field-trial-handle=2268,i,13604506211650960358,7377368307481449950,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:93⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5312,i,16903853654563865538,13013244660654041762,524288 --field-trial-handle=2268,i,13604506211650960358,7377368307481449950,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3744,i,10160767058494211009,11632215749685385149,524288 --field-trial-handle=2268,i,13604506211650960358,7377368307481449950,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3768,i,1445266306824344667,10011492275295276742,524288 --field-trial-handle=2268,i,13604506211650960358,7377368307481449950,262144 --variations-seed-version --mojo-platform-channel-handle=3724 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6044,i,14347101355465194498,4164905786634858686,524288 --field-trial-handle=2268,i,13604506211650960358,7377368307481449950,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6044,i,14347101355465194498,4164905786634858686,524288 --field-trial-handle=2268,i,13604506211650960358,7377368307481449950,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6252,i,4983643411708352013,12780457573901272768,524288 --field-trial-handle=2268,i,13604506211650960358,7377368307481449950,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6296,i,3186394633830824630,6805507026311799902,2097152 --field-trial-handle=2268,i,13604506211650960358,7377368307481449950,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6564,i,14968749379148679084,13081694795355891513,524288 --field-trial-handle=2268,i,13604506211650960358,7377368307481449950,262144 --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4520,i,13315006122446142103,3934217539240488173,524288 --field-trial-handle=2268,i,13604506211650960358,7377368307481449950,262144 --variations-seed-version --mojo-platform-channel-handle=6644 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6336,i,14003392738116422293,11629610457806947637,524288 --field-trial-handle=2268,i,13604506211650960358,7377368307481449950,262144 --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4952,i,18223922747264875730,12976958331570415738,524288 --field-trial-handle=2268,i,13604506211650960358,7377368307481449950,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6240,i,6326633699666548887,6452511767044436993,2097152 --field-trial-handle=2268,i,13604506211650960358,7377368307481449950,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7028,i,13163872109466720584,12664563182385240457,524288 --field-trial-handle=2268,i,13604506211650960358,7377368307481449950,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6572,i,17508338612184394447,6670945232320859923,524288 --field-trial-handle=2268,i,13604506211650960358,7377368307481449950,262144 --variations-seed-version --mojo-platform-channel-handle=7092 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6644,i,7045720396003528266,13362696271088105279,524288 --field-trial-handle=2268,i,13604506211650960358,7377368307481449950,262144 --variations-seed-version --mojo-platform-channel-handle=7140 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3520,i,9292296047891972008,10366298166834719931,524288 --field-trial-handle=2268,i,13604506211650960358,7377368307481449950,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5520,i,12942127419658948605,2750990370419119098,524288 --field-trial-handle=2268,i,13604506211650960358,7377368307481449950,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3604,i,3535740883149105228,1519166848528935102,524288 --field-trial-handle=2268,i,13604506211650960358,7377368307481449950,262144 --variations-seed-version --mojo-platform-channel-handle=2556 /prefetch:143⤵
-
-
C:\Users\Admin\Downloads\windowsdesktop-runtime-9.0.19-win-x64.exe"C:\Users\Admin\Downloads\windowsdesktop-runtime-9.0.19-win-x64.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{662FE6C2-9289-4D62-8A9B-1A872BB4CFA7}\.cr\windowsdesktop-runtime-9.0.19-win-x64.exe"C:\Windows\Temp\{662FE6C2-9289-4D62-8A9B-1A872BB4CFA7}\.cr\windowsdesktop-runtime-9.0.19-win-x64.exe" -burn.clean.room="C:\Users\Admin\Downloads\windowsdesktop-runtime-9.0.19-win-x64.exe" -burn.filehandle.attached=808 -burn.filehandle.self=8124⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
C:\Windows\Temp\{E6273507-610D-4A33-A467-F4D7D1A3379E}\.be\windowsdesktop-runtime-9.0.19-win-x64.exe"C:\Windows\Temp\{E6273507-610D-4A33-A467-F4D7D1A3379E}\.be\windowsdesktop-runtime-9.0.19-win-x64.exe" -q -burn.elevated BurnPipe.{166FCFBD-2BC3-4BE1-BD46-F9F39A16D104} {6171CFD1-12A9-4A65-A1B7-469A0CB6A943} 55485⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
-
-
C:\Users\Admin\Downloads\windowsdesktop-runtime-9.0.19-win-x64.exe"C:\Users\Admin\Downloads\windowsdesktop-runtime-9.0.19-win-x64.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{9E48EB51-77F6-4ABB-8457-3D496076DF31}\.cr\windowsdesktop-runtime-9.0.19-win-x64.exe"C:\Windows\Temp\{9E48EB51-77F6-4ABB-8457-3D496076DF31}\.cr\windowsdesktop-runtime-9.0.19-win-x64.exe" -burn.clean.room="C:\Users\Admin\Downloads\windowsdesktop-runtime-9.0.19-win-x64.exe" -burn.filehandle.attached=768 -burn.filehandle.self=7724⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{B0D2F48F-82E5-4A01-A3C0-A02FB5A0E3E1}\.be\windowsdesktop-runtime-9.0.19-win-x64.exe"C:\Windows\Temp\{B0D2F48F-82E5-4A01-A3C0-A02FB5A0E3E1}\.be\windowsdesktop-runtime-9.0.19-win-x64.exe" -q -burn.elevated BurnPipe.{72467C8A-F9AB-41FE-92D0-1D46D1AA12F6} {FC6CCA63-B321-4BAB-8F86-BF21651BF4A3} 31565⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window3⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffa974dc188,0x7ffa974dc194,0x7ffa974dc1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1584,i,6343701881525477774,13809622374082148008,262144 --field-trial-handle=2304,i,5440145006147583404,4467273455851987953,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1836,i,1175282820406544018,5908102031507713404,524288 --field-trial-handle=2304,i,5440145006147583404,4467273455851987953,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2456,i,8029928478246073258,13925892391777059365,524288 --field-trial-handle=2304,i,5440145006147583404,4467273455851987953,262144 --variations-seed-version --mojo-platform-channel-handle=2992 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4448,i,16824519469461385461,6722995024400016967,524288 --field-trial-handle=2304,i,5440145006147583404,4467273455851987953,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4448,i,16824519469461385461,6722995024400016967,524288 --field-trial-handle=2304,i,5440145006147583404,4467273455851987953,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5136,i,1418070371400682357,11763810388364794328,2097152 --field-trial-handle=2304,i,5440145006147583404,4467273455851987953,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=5144,i,2978820053643252467,5357931502887389458,2097152 --field-trial-handle=2304,i,5440145006147583404,4467273455851987953,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5736,i,6477730124792055884,15960520025308065318,524288 --field-trial-handle=2304,i,5440145006147583404,4467273455851987953,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5740,i,7255250247016757788,7427763025420301679,524288 --field-trial-handle=2304,i,5440145006147583404,4467273455851987953,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6684,i,13293724370822316675,15486764903239688580,524288 --field-trial-handle=2304,i,5440145006147583404,4467273455851987953,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6784,i,2748264917800217152,785640055875099123,2097152 --field-trial-handle=2304,i,5440145006147583404,4467273455851987953,262144 --variations-seed-version --mojo-platform-channel-handle=6672 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6860,i,9647152383026419842,251785886354393169,2097152 --field-trial-handle=2304,i,5440145006147583404,4467273455851987953,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=7004,i,10141823610016437029,14839643118564260654,2097152 --field-trial-handle=2304,i,5440145006147583404,4467273455851987953,262144 --variations-seed-version --mojo-platform-channel-handle=6720 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6672,i,16521074917335842619,3836662332957327001,524288 --field-trial-handle=2304,i,5440145006147583404,4467273455851987953,262144 --variations-seed-version --mojo-platform-channel-handle=6692 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=600,i,4751977701974063863,18425963460489891543,524288 --field-trial-handle=2304,i,5440145006147583404,4467273455851987953,262144 --variations-seed-version --mojo-platform-channel-handle=7108 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5648,i,7408098371037856516,13980871113479421736,524288 --field-trial-handle=2304,i,5440145006147583404,4467273455851987953,262144 --variations-seed-version --mojo-platform-channel-handle=6848 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=7160,i,11797080958525753797,18259641639706772626,2097152 --field-trial-handle=2304,i,5440145006147583404,4467273455851987953,262144 --variations-seed-version --mojo-platform-channel-handle=7184 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3640,i,5999573790644021141,8525334611035692726,524288 --field-trial-handle=2304,i,5440145006147583404,4467273455851987953,262144 --variations-seed-version --mojo-platform-channel-handle=7344 /prefetch:124⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6808,i,10765172584503605302,17749473925270472039,524288 --field-trial-handle=2304,i,5440145006147583404,4467273455851987953,262144 --variations-seed-version --mojo-platform-channel-handle=6948 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window4⤵
- Loads dropped DLL
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2e4,0x7ffa974dc188,0x7ffa974dc194,0x7ffa974dc1a05⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1876,i,18427952393534630951,8673475244646967309,524288 --field-trial-handle=2324,i,7005057218103415817,6870927466385221335,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:115⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1680,i,7184139511415174857,20580753452575428,262144 --field-trial-handle=2324,i,7005057218103415817,6870927466385221335,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:25⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2480,i,6673351511416736946,3486683919266935004,524288 --field-trial-handle=2324,i,7005057218103415817,6870927466385221335,262144 --variations-seed-version --mojo-platform-channel-handle=3060 /prefetch:135⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4452,i,666070932481533615,16531206644369066359,524288 --field-trial-handle=2324,i,7005057218103415817,6870927466385221335,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4452,i,666070932481533615,16531206644369066359,524288 --field-trial-handle=2324,i,7005057218103415817,6870927466385221335,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4936,i,16208726220675114074,7963962227319839874,2097152 --field-trial-handle=2324,i,7005057218103415817,6870927466385221335,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5296,i,11810005770967141455,9295149731947569819,524288 --field-trial-handle=2324,i,7005057218103415817,6870927466385221335,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5320,i,4325381511248092418,13107577464122921285,524288 --field-trial-handle=2324,i,7005057218103415817,6870927466385221335,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5672,i,1988933604129711783,14646497922019588073,2097152 --field-trial-handle=2324,i,7005057218103415817,6870927466385221335,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5940,i,7840398374193482528,8254898940795655667,524288 --field-trial-handle=2324,i,7005057218103415817,6870927466385221335,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5992,i,12933305783085765424,4541516319481357530,524288 --field-trial-handle=2324,i,7005057218103415817,6870927466385221335,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5944,i,13990763500658140657,11323209076252667508,524288 --field-trial-handle=2324,i,7005057218103415817,6870927466385221335,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3336,i,13153200152062783034,9923798683381938413,524288 --field-trial-handle=2324,i,7005057218103415817,6870927466385221335,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5492,i,11706979918163214629,10401204641402537922,524288 --field-trial-handle=2324,i,7005057218103415817,6870927466385221335,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=804,i,17968751568130298027,334493168450752827,262144 --field-trial-handle=2324,i,7005057218103415817,6870927466385221335,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:105⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5296,i,6497715838812482210,7777281072133150609,524288 --field-trial-handle=2324,i,7005057218103415817,6870927466385221335,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4832,i,2468952023447257226,15815886333577646829,524288 --field-trial-handle=2324,i,7005057218103415817,6870927466385221335,262144 --variations-seed-version --mojo-platform-channel-handle=3992 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3640,i,8677512477345536419,3036542233312837602,524288 --field-trial-handle=2324,i,7005057218103415817,6870927466385221335,262144 --variations-seed-version --mojo-platform-channel-handle=3996 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4240,i,16595603764910297436,18079417734329618153,524288 --field-trial-handle=2324,i,7005057218103415817,6870927466385221335,262144 --variations-seed-version --mojo-platform-channel-handle=3096 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3824,i,2778325001184487480,3543594186548116157,524288 --field-trial-handle=2324,i,7005057218103415817,6870927466385221335,262144 --variations-seed-version --mojo-platform-channel-handle=3828 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1096,i,9590842447111642692,2301349270924000899,524288 --field-trial-handle=2324,i,7005057218103415817,6870927466385221335,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3680,i,11572160947321591272,6761084443086264957,524288 --field-trial-handle=2324,i,7005057218103415817,6870927466385221335,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3632,i,6579982392733382886,16740343064085849222,524288 --field-trial-handle=2324,i,7005057218103415817,6870927466385221335,262144 --variations-seed-version --mojo-platform-channel-handle=3128 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3128,i,6060503082233083151,3930706687501249569,524288 --field-trial-handle=2324,i,7005057218103415817,6870927466385221335,262144 --variations-seed-version --mojo-platform-channel-handle=3848 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4736,i,661584543141074483,12268278283237848983,524288 --field-trial-handle=2324,i,7005057218103415817,6870927466385221335,262144 --variations-seed-version --mojo-platform-channel-handle=4744 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=4240,i,17509895280902481741,4436456172767545641,2097152 --field-trial-handle=2324,i,7005057218103415817,6870927466385221335,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3120,i,288695262158862551,14521982468239071674,524288 --field-trial-handle=2324,i,7005057218103415817,6870927466385221335,262144 --variations-seed-version --mojo-platform-channel-handle=3096 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=6324,i,6024213582860912482,16889676352342004623,2097152 --field-trial-handle=2324,i,7005057218103415817,6870927466385221335,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,366309189435404318,18086968751129995242,524288 --field-trial-handle=2324,i,7005057218103415817,6870927466385221335,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:125⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5704,i,4610765456531007466,4260591590323723402,524288 --field-trial-handle=2324,i,7005057218103415817,6870927466385221335,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6768,i,4857117135877742211,17701614039727175062,524288 --field-trial-handle=2324,i,7005057218103415817,6870927466385221335,262144 --variations-seed-version --mojo-platform-channel-handle=6756 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6956,i,15214220877218696147,4939503535219390205,524288 --field-trial-handle=2324,i,7005057218103415817,6870927466385221335,262144 --variations-seed-version --mojo-platform-channel-handle=7156 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6800,i,9791448619004763183,16214660122017090608,524288 --field-trial-handle=2324,i,7005057218103415817,6870927466385221335,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4040,i,16718075385116524404,8031338415977581308,524288 --field-trial-handle=2324,i,7005057218103415817,6870927466385221335,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4040,i,3733288336065706874,1263921142163165530,524288 --field-trial-handle=2324,i,7005057218103415817,6870927466385221335,262144 --variations-seed-version --mojo-platform-channel-handle=7004 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3928,i,9494245755204068343,11799083652142837652,524288 --field-trial-handle=2324,i,7005057218103415817,6870927466385221335,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6184,i,7952467523568843830,16507296089988347977,524288 --field-trial-handle=2324,i,7005057218103415817,6870927466385221335,262144 --variations-seed-version --mojo-platform-channel-handle=7112 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,15759993048906320615,5360669113220682466,524288 --field-trial-handle=2324,i,7005057218103415817,6870927466385221335,262144 --variations-seed-version --mojo-platform-channel-handle=4040 /prefetch:145⤵
-
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 1795CD5D7F500405BA9A0D761256790B2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding E4B25F7C14EFFB881EB79428C96AA4A22⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding EEBEF1EAF535B7345859B999464545502⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 28332D27BDF61EB9CDB370F5B0F994E02⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 78D0BD1F8140FA206AD546281438DF942⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding B976539E3E1B5824F5E423C65B01B0932⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding FD15628FE73D39104B9F45B37D6CFB8F2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 787C293DC84B1886315304D6E948B6A42⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\ProgramData\Package Cache\{7a013c32-dd46-48f5-81b1-2576c92468db}\windowsdesktop-runtime-9.0.19-win-x64.exe"C:\ProgramData\Package Cache\{7a013c32-dd46-48f5-81b1-2576c92468db}\windowsdesktop-runtime-9.0.19-win-x64.exe" /burn.runonce1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Package Cache\{7a013c32-dd46-48f5-81b1-2576c92468db}\windowsdesktop-runtime-9.0.19-win-x64.exe"C:\ProgramData\Package Cache\{7a013c32-dd46-48f5-81b1-2576c92468db}\windowsdesktop-runtime-9.0.19-win-x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_9.0.19_(x64)_20260812232700.log"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Package Cache\{7a013c32-dd46-48f5-81b1-2576c92468db}\windowsdesktop-runtime-9.0.19-win-x64.exe"C:\ProgramData\Package Cache\{7a013c32-dd46-48f5-81b1-2576c92468db}\windowsdesktop-runtime-9.0.19-win-x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{7a013c32-dd46-48f5-81b1-2576c92468db}\windowsdesktop-runtime-9.0.19-win-x64.exe" -burn.filehandle.attached=564 -burn.filehandle.self=584 /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_9.0.19_(x64)_20260812232700.log"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffa9160c728,0x7ffa9160c734,0x7ffa9160c7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1948,i,18221745877719550829,9348032895774565111,524288 --field-trial-handle=1848,i,16558634954198056327,14696604947283314164,262144 --variations-seed-version --mojo-platform-channel-handle=2032 /prefetch:112⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1640,i,11579590365753096835,14738551797565334316,262144 --field-trial-handle=1848,i,16558634954198056327,14696604947283314164,262144 --variations-seed-version --mojo-platform-channel-handle=1844 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2344,i,12534269580808728223,5578908398467111702,524288 --field-trial-handle=1848,i,16558634954198056327,14696604947283314164,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:132⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3256,i,11663536908269081371,412850666960446489,2097152 --field-trial-handle=1848,i,16558634954198056327,14696604947283314164,262144 --variations-seed-version --mojo-platform-channel-handle=3328 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3348,i,4740551765915702656,3902886117692598466,2097152 --field-trial-handle=1848,i,16558634954198056327,14696604947283314164,262144 --variations-seed-version --mojo-platform-channel-handle=3360 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4748,i,13473438402218315527,14960233213628348540,2097152 --field-trial-handle=1848,i,16558634954198056327,14696604947283314164,262144 --variations-seed-version --mojo-platform-channel-handle=4708 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4696,i,3774276745225454737,8259760371718926637,524288 --field-trial-handle=1848,i,16558634954198056327,14696604947283314164,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5432,i,3809952282044711045,3412602457721785688,524288 --field-trial-handle=1848,i,16558634954198056327,14696604947283314164,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5524,i,10141132010327273305,13225633531743130780,2097152 --field-trial-handle=1848,i,16558634954198056327,14696604947283314164,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5544,i,864504200555395160,5798707229194539546,2097152 --field-trial-handle=1848,i,16558634954198056327,14696604947283314164,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5624,i,939651763807234569,9708099488195261707,2097152 --field-trial-handle=1848,i,16558634954198056327,14696604947283314164,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6012,i,7262217278208973795,10087757894543633760,2097152 --field-trial-handle=1848,i,16558634954198056327,14696604947283314164,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6136,i,17866675987485230834,14875607217524734038,2097152 --field-trial-handle=1848,i,16558634954198056327,14696604947283314164,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5720,i,10730037710887945988,12781551411167335951,2097152 --field-trial-handle=1848,i,16558634954198056327,14696604947283314164,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6388,i,2685578741983751248,229416351226549857,2097152 --field-trial-handle=1848,i,16558634954198056327,14696604947283314164,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6340,i,6665589732431192534,1401386659791408129,2097152 --field-trial-handle=1848,i,16558634954198056327,14696604947283314164,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6492,i,8376851092159046857,2584969485086252981,524288 --field-trial-handle=1848,i,16558634954198056327,14696604947283314164,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5948,i,6670765704677803083,4671524827427874964,524288 --field-trial-handle=1848,i,16558634954198056327,14696604947283314164,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5580,i,13363200466834503610,4102727436333641700,524288 --field-trial-handle=1848,i,16558634954198056327,14696604947283314164,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5704,i,17399884619738887669,6547419727770701398,2097152 --field-trial-handle=1848,i,16558634954198056327,14696604947283314164,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:92⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6336,i,10867070232004291524,7207344258557769391,2097152 --field-trial-handle=1848,i,16558634954198056327,14696604947283314164,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5656,i,13001243282790331797,11687294235825967755,2097152 --field-trial-handle=1848,i,16558634954198056327,14696604947283314164,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=5932,i,8270540982099174139,9742165757987654971,2097152 --field-trial-handle=1848,i,16558634954198056327,14696604947283314164,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=3684,i,1914529990413383670,8049909465504941574,2097152 --field-trial-handle=1848,i,16558634954198056327,14696604947283314164,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5568,i,2076206884807761795,1650674307511685760,524288 --field-trial-handle=1848,i,16558634954198056327,14696604947283314164,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5556,i,17297744772888800297,13334558410688405339,524288 --field-trial-handle=1848,i,16558634954198056327,14696604947283314164,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5792,i,18124975317470193578,5486542946921306482,524288 --field-trial-handle=1848,i,16558634954198056327,14696604947283314164,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=4708,i,7150405983871923063,17006704372680988646,2097152 --field-trial-handle=1848,i,16558634954198056327,14696604947283314164,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=6584,i,12601020100497330957,13277996803918256657,2097152 --field-trial-handle=1848,i,16558634954198056327,14696604947283314164,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=6576,i,5672022325009269634,2470625862980220346,2097152 --field-trial-handle=1848,i,16558634954198056327,14696604947283314164,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=3348,i,56257133254197682,7719972592743371094,2097152 --field-trial-handle=1848,i,16558634954198056327,14696604947283314164,262144 --variations-seed-version --mojo-platform-channel-handle=4596 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=3544,i,14319713577400123732,1501108616861708202,2097152 --field-trial-handle=1848,i,16558634954198056327,14696604947283314164,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=6332,i,7464270430409940961,3491751569785941193,2097152 --field-trial-handle=1848,i,16558634954198056327,14696604947283314164,262144 --variations-seed-version --mojo-platform-channel-handle=6784 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=4840,i,11169326955832983155,13623976879844748620,2097152 --field-trial-handle=1848,i,16558634954198056327,14696604947283314164,262144 --variations-seed-version --mojo-platform-channel-handle=6764 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=5544,i,6410485911297901207,17799290966622800709,2097152 --field-trial-handle=1848,i,16558634954198056327,14696604947283314164,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=6308,i,7078180332536215961,4792833185061362812,524288 --field-trial-handle=1848,i,16558634954198056327,14696604947283314164,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:122⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=6992,i,4792091107393756034,7699230576667753764,2097152 --field-trial-handle=1848,i,16558634954198056327,14696604947283314164,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --metrics-shmem-handle=4556,i,3214996485441692566,17101367125120798010,2097152 --field-trial-handle=1848,i,16558634954198056327,14696604947283314164,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --metrics-shmem-handle=3612,i,6970613988827225652,3913581627582501096,2097152 --field-trial-handle=1848,i,16558634954198056327,14696604947283314164,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7292,i,2073065241681218247,8463371415347704400,524288 --field-trial-handle=1848,i,16558634954198056327,14696604947283314164,262144 --variations-seed-version --mojo-platform-channel-handle=7296 /prefetch:142⤵
- Modifies registry class
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --metrics-shmem-handle=7084,i,4208338935295588979,7317936340120969965,2097152 --field-trial-handle=1848,i,16558634954198056327,14696604947283314164,262144 --variations-seed-version --mojo-platform-channel-handle=7680 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --metrics-shmem-handle=7620,i,4468190253189490593,11142542589864880791,2097152 --field-trial-handle=1848,i,16558634954198056327,14696604947283314164,262144 --variations-seed-version --mojo-platform-channel-handle=7616 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1196,i,7828937113458646406,130112237097963471,262144 --field-trial-handle=1848,i,16558634954198056327,14696604947283314164,262144 --variations-seed-version --mojo-platform-channel-handle=7848 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --metrics-shmem-handle=8024,i,5882381204036314563,16277392299392817762,2097152 --field-trial-handle=1848,i,16558634954198056327,14696604947283314164,262144 --variations-seed-version --mojo-platform-channel-handle=8020 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=7624,i,13582974067009610203,7875515611522322455,524288 --field-trial-handle=1848,i,16558634954198056327,14696604947283314164,262144 --variations-seed-version --mojo-platform-channel-handle=7788 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --metrics-shmem-handle=7964,i,15194652983359508194,7529041975661243401,2097152 --field-trial-handle=1848,i,16558634954198056327,14696604947283314164,262144 --variations-seed-version --mojo-platform-channel-handle=4576 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --metrics-shmem-handle=7980,i,1832525425242639362,1626019057180272432,2097152 --field-trial-handle=1848,i,16558634954198056327,14696604947283314164,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --metrics-shmem-handle=4588,i,17673403556300375282,9652339261555021584,2097152 --field-trial-handle=1848,i,16558634954198056327,14696604947283314164,262144 --variations-seed-version --mojo-platform-channel-handle=7832 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --metrics-shmem-handle=7712,i,7724942788125914366,17047554784074250644,2097152 --field-trial-handle=1848,i,16558634954198056327,14696604947283314164,262144 --variations-seed-version --mojo-platform-channel-handle=7588 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --metrics-shmem-handle=7520,i,10230416336361440409,12981673654527682571,2097152 --field-trial-handle=1848,i,16558634954198056327,14696604947283314164,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --metrics-shmem-handle=7616,i,14385899008326803948,11421803332040189277,2097152 --field-trial-handle=1848,i,16558634954198056327,14696604947283314164,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --metrics-shmem-handle=7544,i,13716589396368856975,4929552124984562180,2097152 --field-trial-handle=1848,i,16558634954198056327,14696604947283314164,262144 --variations-seed-version --mojo-platform-channel-handle=8152 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --metrics-shmem-handle=6824,i,14061043836241471157,8502436973497719257,2097152 --field-trial-handle=1848,i,16558634954198056327,14696604947283314164,262144 --variations-seed-version --mojo-platform-channel-handle=7376 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --metrics-shmem-handle=7664,i,13725527965184210246,6597288754651733423,2097152 --field-trial-handle=1848,i,16558634954198056327,14696604947283314164,262144 --variations-seed-version --mojo-platform-channel-handle=7572 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5932,i,17108585997786974863,14234006737192993498,524288 --field-trial-handle=1848,i,16558634954198056327,14696604947283314164,262144 --variations-seed-version --mojo-platform-channel-handle=7644 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7556,i,2736583562190566060,1396784741332466308,524288 --field-trial-handle=1848,i,16558634954198056327,14696604947283314164,262144 --variations-seed-version --mojo-platform-channel-handle=7528 /prefetch:142⤵
-
-
C:\Users\Admin\Downloads\RobloxPlayerInstaller-R7CGG9GRFR.exe"C:\Users\Admin\Downloads\RobloxPlayerInstaller-R7CGG9GRFR.exe"2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\RobloxPlayerBeta.exe" -personalizedToken R7CGG9GRFR --deeplink https://www.roblox.com/games/95082159892680/1-Speed-Keyboard-Escape-Candy-Chocolate --webBtid 1786573723557003 --downloadSource installer --authenticationTicket YkFEjjmO9zVSR4CvFMoGYnR-GyC7NDCbe4s0fwro3p3_3bJGmuIefOaCZRxHzJNUbo9fr4YQdUXzX1y6vjz2zCRn4PENrtNvRfEOPSMBixDlg65y_GOlVFVsKOf6mqrakF7LVDMOtBd-5qtoz_NIJWceSyQ9cjWo6EF0kgQxmzDTnCuCpwDJeyd9py8V2pSPWkSqy60eEQ4aDReTH6sbUXdWkXY40sXnOWtj8NwW8RYx1BiMSVvMiroBMaLgSOw7PhY-NFNbU-zjh6g2IzPAjXf8YqswHHhrpoPX6QCu_ZKWmxskqdyjmPwx1YYLg3qeue_FLiIPnlTnrAMm8GnJLWHZpIY2xybJ1MIcEkTjem47VKWQ2ATVR-SlhiWSQZrnrR6781GcAdIiZxcvNNlJGa_Jh-1fy2WngHEkTMxmvWbD7hLUHPAXS2goGjXfhEGnZFXCJBDAqyY_k2i-X0spIjLHh4DMS1Qnl8dJsQO_nWx_h-OtjrTO9yQIqYVlZZGKDQz-UI5ZSdVhkPcWCPqR4PPKH1EvcsGtxk7LA9ZQ8T4 -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 50523⤵
- Executes dropped EXE
-
-
C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\RobloxPlayerBeta.exe" -personalizedToken R7CGG9GRFR --deeplink https://www.roblox.com/games/95082159892680/1-Speed-Keyboard-Escape-Candy-Chocolate --webBtid 1786573723557003 --downloadSource installer --authenticationTicket YkFEjjmO9zVSR4CvFMoGYnR-GyC7NDCbe4s0fwro3p3_3bJGmuIefOaCZRxHzJNUbo9fr4YQdUXzX1y6vjz2zCRn4PENrtNvRfEOPSMBixDlg65y_GOlVFVsKOf6mqrakF7LVDMOtBd-5qtoz_NIJWceSyQ9cjWo6EF0kgQxmzDTnCuCpwDJeyd9py8V2pSPWkSqy60eEQ4aDReTH6sbUXdWkXY40sXnOWtj8NwW8RYx1BiMSVvMiroBMaLgSOw7PhY-NFNbU-zjh6g2IzPAjXf8YqswHHhrpoPX6QCu_ZKWmxskqdyjmPwx1YYLg3qeue_FLiIPnlTnrAMm8GnJLWHZpIY2xybJ1MIcEkTjem47VKWQ2ATVR-SlhiWSQZrnrR6781GcAdIiZxcvNNlJGa_Jh-1fy2WngHEkTMxmvWbD7hLUHPAXS2goGjXfhEGnZFXCJBDAqyY_k2i-X0spIjLHh4DMS1Qnl8dJsQO_nWx_h-OtjrTO9yQIqYVlZZGKDQz-UI5ZSdVhkPcWCPqR4PPKH1EvcsGtxk7LA9ZQ8T4 -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 50523⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Users\Admin\Downloads\Xeno-v1.3.60.exe"C:\Users\Admin\Downloads\Xeno-v1.3.60.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\3HX07FOBiyOg71948xsiFB0hHSJ\Xeno-v1.3.60.exeC:\Users\Admin\AppData\Local\Temp\3HX07FOBiyOg71948xsiFB0hHSJ\Xeno-v1.3.60.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\3HX07FOBiyOg71948xsiFB0hHSJ\Xeno-v1.3.60.exe"C:\Users\Admin\AppData\Local\Temp\3HX07FOBiyOg71948xsiFB0hHSJ\Xeno-v1.3.60.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Xeno" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1648 --field-trial-handle=1652,i,7218404715458385114,17562479226400781233,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:24⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\3HX07FOBiyOg71948xsiFB0hHSJ\Xeno-v1.3.60.exe"C:\Users\Admin\AppData\Local\Temp\3HX07FOBiyOg71948xsiFB0hHSJ\Xeno-v1.3.60.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Xeno" --mojo-platform-channel-handle=2220 --field-trial-handle=1652,i,7218404715458385114,17562479226400781233,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:84⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\3HX07FOBiyOg71948xsiFB0hHSJ\Xeno-v1.3.60.exe"C:\Users\Admin\AppData\Local\Temp\3HX07FOBiyOg71948xsiFB0hHSJ\Xeno-v1.3.60.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Xeno" --app-user-model-id=Xeno --app-path="C:\Users\Admin\AppData\Local\Temp\3HX07FOBiyOg71948xsiFB0hHSJ\resources\app.asar" --enable-sandbox --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2440 --field-trial-handle=1652,i,7218404715458385114,17562479226400781233,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:14⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\3HX07FOBiyOg71948xsiFB0hHSJ\Xeno-v1.3.60.exe"C:\Users\Admin\AppData\Local\Temp\3HX07FOBiyOg71948xsiFB0hHSJ\Xeno-v1.3.60.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Xeno" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=3088 --field-trial-handle=1652,i,7218404715458385114,17562479226400781233,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:24⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/xe-no4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\3HX07FOBiyOg71948xsiFB0hHSJ\Xeno-v1.3.60.exe"C:\Users\Admin\AppData\Local\Temp\3HX07FOBiyOg71948xsiFB0hHSJ\Xeno-v1.3.60.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --user-data-dir="C:\Users\Admin\AppData\Roaming\Xeno" --mojo-platform-channel-handle=2064 --field-trial-handle=1652,i,7218404715458385114,17562479226400781233,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:84⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\3HX07FOBiyOg71948xsiFB0hHSJ\Xeno-v1.3.60.exe"C:\Users\Admin\AppData\Local\Temp\3HX07FOBiyOg71948xsiFB0hHSJ\Xeno-v1.3.60.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --user-data-dir="C:\Users\Admin\AppData\Roaming\Xeno" --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=988 --field-trial-handle=1652,i,7218404715458385114,17562479226400781233,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:24⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
-
-
-
C:\Users\Admin\Downloads\RobloxPlayerInstaller-R7CGG9GRFR.exe"C:\Users\Admin\Downloads\RobloxPlayerInstaller-R7CGG9GRFR.exe"2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 80683⤵
- Executes dropped EXE
-
-
C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 80683⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --metrics-shmem-handle=5716,i,2881961693407513260,583742409253099126,2097152 --field-trial-handle=1848,i,16558634954198056327,14696604947283314164,262144 --variations-seed-version --mojo-platform-channel-handle=7196 /prefetch:12⤵
-
-
C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\RobloxPlayerBeta.exe" roblox-player:1+launchmode:play+gameinfo:nijDz2JTurs-BtGFX8bp01vuLRklbYWB5IuiDQUdp217oLRBdrvhFS5Iw0eixl4get3wdvvCcw_PJNvzNyC3-p7QoAP37QLEZKrI1MMuve99xjFDWrERMtgb3NkGarBjJnXFpZHvwKnP1jQdt6tHCjxJbXxyNmtVT3BT1OE22g0bDfA6rFLDBZVFkr1LU6YVlohcRXoXnhOtYVhSV8PPwP4R0bFXf3bAtwYAqTW3a3CJRFqUCQe3rIz2eOi9tZc8x-3f601mVGiQgXaA-N5R2z1xUFOlfmnlEZILaK3nSnsfWP5J6JkrhIJFcNafLGKbv0q6J3cTv89PzT2P1OXu2LRixOnUIFvtOupqJV6B8xZLcHhZuiDXJMIXsTqa0YO77CUvK4AMoFynsgXNX6EDo6D4nYb3R4s55wGb8FjfcNScuTo8ZdcIzD39IZv61IKNouNG-EjHBWwESdtg6bxu_2NndR5bC6YdYXcUq7hTPlqvL1Voa6OS0QqwfcP_MQXK_MehxpR0hXm5jwdWRFZWRJ45wTeI6yqtickE_1IgHoI+launchtime:1786574112094+placelauncherurl:https%3A%2F%2Fwww.roblox.com%2FGame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D1786573723557003%26placeId%3D95082159892680%26isPlayTogetherGame%3Dfalse%26referredByPlayerId%3D0%26joinAttemptId%3Db8173979-72cb-49e7-8a00-8416016c5a53%26joinAttemptOrigin%3DPlayButton+browsertrackerid:1786573723557003+robloxLocale:en_us+gameLocale:en_us+LaunchExp:InApp2⤵
- Executes dropped EXE
-
-
C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\RobloxPlayerBeta.exe" roblox-player:1+launchmode:play+gameinfo:nijDz2JTurs-BtGFX8bp01vuLRklbYWB5IuiDQUdp217oLRBdrvhFS5Iw0eixl4get3wdvvCcw_PJNvzNyC3-p7QoAP37QLEZKrI1MMuve99xjFDWrERMtgb3NkGarBjJnXFpZHvwKnP1jQdt6tHCjxJbXxyNmtVT3BT1OE22g0bDfA6rFLDBZVFkr1LU6YVlohcRXoXnhOtYVhSV8PPwP4R0bFXf3bAtwYAqTW3a3CJRFqUCQe3rIz2eOi9tZc8x-3f601mVGiQgXaA-N5R2z1xUFOlfmnlEZILaK3nSnsfWP5J6JkrhIJFcNafLGKbv0q6J3cTv89PzT2P1OXu2LRixOnUIFvtOupqJV6B8xZLcHhZuiDXJMIXsTqa0YO77CUvK4AMoFynsgXNX6EDo6D4nYb3R4s55wGb8FjfcNScuTo8ZdcIzD39IZv61IKNouNG-EjHBWwESdtg6bxu_2NndR5bC6YdYXcUq7hTPlqvL1Voa6OS0QqwfcP_MQXK_MehxpR0hXm5jwdWRFZWRJ45wTeI6yqtickE_1IgHoI+launchtime:1786574112094+placelauncherurl:https%3A%2F%2Fwww.roblox.com%2FGame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D1786573723557003%26placeId%3D95082159892680%26isPlayTogetherGame%3Dfalse%26referredByPlayerId%3D0%26joinAttemptId%3Db8173979-72cb-49e7-8a00-8416016c5a53%26joinAttemptOrigin%3DPlayButton+browsertrackerid:1786573723557003+robloxLocale:en_us+gameLocale:en_us+LaunchExp:InApp2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --metrics-shmem-handle=7908,i,15761668986109119886,1256678996095184372,2097152 --field-trial-handle=1848,i,16558634954198056327,14696604947283314164,262144 --variations-seed-version --mojo-platform-channel-handle=4064 /prefetch:12⤵
-
-
C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\RobloxPlayerBeta.exe" roblox-player:1+launchmode:play+gameinfo:3z6gsxr_WZ5lnYrKV0Nq9FdgxxPQPkwp-GLlzc1hgt3dpzboXJOb8_X2JEWTu8yeTfTCJ1PKF63ZzOmbwe6y9G78McBHFtze8Ly1XAimegi1zwv0_nFQ_gDVN1o1nT2DYT9Nb4XqdHmSw3Hq5uwkhskDun8vrahGfyYVF6v0grzTe8GkE3e4mL2EZvoBmk7guyIA3mV-0ki2txnlNmcs8CBLk7HWyOyrN-IysJ5RpkOe-qnZK0DrISNLxUBgXRXhQujg58gxMR8mnKwNPhbuU15SNgzi0BHpG2Eiieg3l8PqKYSR50QTOh4Yo_vpTmt7Ba295CCjAd4ESsWsajmy-g_EvJxffHWJ97Vn0AdOB7JZnpt5tgAz_kd-xZ4HTgzDXOuuIg-gG5yK1ag45v4PjPC2szNHjwYl44rP3bERzaxXTIte3s6ST3-UjK4PcFyYj1DAvc7aLZIlC61a91qfhY0WKn-91Q0lgeUXPMm7EkRjytTVfZD_hBIzuwTFgBn6xbopAgxGDwhl2bM_9OByQVq0jsCd7CO7pERvNHynWqU+launchtime:1786574153457+placelauncherurl:https%3A%2F%2Fwww.roblox.com%2FGame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D1786573723557003%26placeId%3D95082159892680%26isPlayTogetherGame%3Dfalse%26referredByPlayerId%3D0%26joinAttemptId%3D2fde1492-7b35-4dca-a332-5f703ddcb8dd%26joinAttemptOrigin%3DPlayButton+browsertrackerid:1786573723557003+robloxLocale:en_us+gameLocale:en_us+LaunchExp:InApp2⤵
- Executes dropped EXE
-
-
C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\RobloxPlayerBeta.exe" roblox-player:1+launchmode:play+gameinfo:3z6gsxr_WZ5lnYrKV0Nq9FdgxxPQPkwp-GLlzc1hgt3dpzboXJOb8_X2JEWTu8yeTfTCJ1PKF63ZzOmbwe6y9G78McBHFtze8Ly1XAimegi1zwv0_nFQ_gDVN1o1nT2DYT9Nb4XqdHmSw3Hq5uwkhskDun8vrahGfyYVF6v0grzTe8GkE3e4mL2EZvoBmk7guyIA3mV-0ki2txnlNmcs8CBLk7HWyOyrN-IysJ5RpkOe-qnZK0DrISNLxUBgXRXhQujg58gxMR8mnKwNPhbuU15SNgzi0BHpG2Eiieg3l8PqKYSR50QTOh4Yo_vpTmt7Ba295CCjAd4ESsWsajmy-g_EvJxffHWJ97Vn0AdOB7JZnpt5tgAz_kd-xZ4HTgzDXOuuIg-gG5yK1ag45v4PjPC2szNHjwYl44rP3bERzaxXTIte3s6ST3-UjK4PcFyYj1DAvc7aLZIlC61a91qfhY0WKn-91Q0lgeUXPMm7EkRjytTVfZD_hBIzuwTFgBn6xbopAgxGDwhl2bM_9OByQVq0jsCd7CO7pERvNHynWqU+launchtime:1786574153457+placelauncherurl:https%3A%2F%2Fwww.roblox.com%2FGame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D1786573723557003%26placeId%3D95082159892680%26isPlayTogetherGame%3Dfalse%26referredByPlayerId%3D0%26joinAttemptId%3D2fde1492-7b35-4dca-a332-5f703ddcb8dd%26joinAttemptOrigin%3DPlayButton+browsertrackerid:1786573723557003+robloxLocale:en_us+gameLocale:en_us+LaunchExp:InApp2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4488,i,7261098100812671640,17618299244836633239,524288 --field-trial-handle=1848,i,16558634954198056327,14696604947283314164,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:142⤵
-
-
C:\Users\Admin\Downloads\RobloxPlayerInstaller-3KBQ4QCVDQ.exe"C:\Users\Admin\Downloads\RobloxPlayerInstaller-3KBQ4QCVDQ.exe"2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\RobloxPlayerBeta.exe" -personalizedToken 3KBQ4QCVDQ --deeplink https://www.roblox.com/games/95082159892680/1-Speed-Keyboard-Escape-Candy-Chocolate --webBtid 1786573723557003 --downloadSource installer --authenticationTicket 10_0LFS9IOOgiaR2AvgkJLgJ_YZefb29TYg5K15KrgjPB7tCV0UEcFwsmSoQko3jgk82dUEKlUUSiJYSsX5cat0vH86XVThbKtpjUy2v3YDmNVzwghW4QGgXB1FvtbgPpu0sAz0nOuZvkGog3zc-OOGij9OtJu17CC-RSpLsAPS4uhlIwLssq_4N_d9eXGa_VCVE7JVPvXD0Vu9ectyUBcMff-CfswJN4ZzrZIf3wlN6dlvrotNH-NZx97-fdDE1i8malYCOpa9YlYOMmilfijOPowFPpH6Gut2q1mB3CsPOokJJEvhHzPFkksD6PK-SrJM6Gi2H_XqZOVgRW80uocgneQBzT7zR3NjqkMbc6vvNXJpgG84vm8Sn6iUIdgKDrYmPN3vl1qj-K1NnnDOnsBVd_CrBEwQYAQfwp6Z1apookypbQiB1pkOruJxlrucx2NuOKDEZ4uSpHK0ly8KXFsRQpMi5WapMo2-V-80rn_atyWRgEaDD1QLdPj0pTJZi8khJN0tEMSI2nTHiAMkn-Czg2bUKljZxvKZOjt81vZY -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 19363⤵
- Executes dropped EXE
-
-
C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\RobloxPlayerBeta.exe" -personalizedToken 3KBQ4QCVDQ --deeplink https://www.roblox.com/games/95082159892680/1-Speed-Keyboard-Escape-Candy-Chocolate --webBtid 1786573723557003 --downloadSource installer --authenticationTicket 10_0LFS9IOOgiaR2AvgkJLgJ_YZefb29TYg5K15KrgjPB7tCV0UEcFwsmSoQko3jgk82dUEKlUUSiJYSsX5cat0vH86XVThbKtpjUy2v3YDmNVzwghW4QGgXB1FvtbgPpu0sAz0nOuZvkGog3zc-OOGij9OtJu17CC-RSpLsAPS4uhlIwLssq_4N_d9eXGa_VCVE7JVPvXD0Vu9ectyUBcMff-CfswJN4ZzrZIf3wlN6dlvrotNH-NZx97-fdDE1i8malYCOpa9YlYOMmilfijOPowFPpH6Gut2q1mB3CsPOokJJEvhHzPFkksD6PK-SrJM6Gi2H_XqZOVgRW80uocgneQBzT7zR3NjqkMbc6vvNXJpgG84vm8Sn6iUIdgKDrYmPN3vl1qj-K1NnnDOnsBVd_CrBEwQYAQfwp6Z1apookypbQiB1pkOruJxlrucx2NuOKDEZ4uSpHK0ly8KXFsRQpMi5WapMo2-V-80rn_atyWRgEaDD1QLdPj0pTJZi8khJN0tEMSI2nTHiAMkn-Czg2bUKljZxvKZOjt81vZY -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 19363⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --metrics-shmem-handle=3588,i,17480191232154537138,4867375236271178613,2097152 --field-trial-handle=1848,i,16558634954198056327,14696604947283314164,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:12⤵
-
-
C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\RobloxPlayerBeta.exe" roblox-player:1+launchmode:play+gameinfo:bF9Ws34OGjc-H5b4j8LsVtVWw-45CpovRHg4ByNiGNQMPiu_rtSA6qMsyfMKBdrNPQ53ij9TYfl1CyO5zcOHpil0qIsBw_eVWXyoHXah24mG2C2frfxBpIQHspH9Vw7lEFQAQMgBJOOO_OO8eUaNxzZ9kZQDp4dnbeLe79P5gjfDvTwkZPjO97BIgdEAAnodtqcx8bkrJVgm5ga07peuWOwDMGSlrbKr70JSFjsCqYqyW3FGG3y5j_-N-f6i9xHsrvE6jrBzNX53QBYzEOi3-TVc8KZFTMcsdppUIxg8tl6LkwHO-UBotbYJQY5o9eEITmo-fKRrC3fVCm_LSpskTC1TNDO32bICOMXSK--ireE7ujvJDHzq9Zt6n60Rr64jG9OJlWL-4bHwW_Zt2jrZcf8qCo1c5CIhZzCDWqzrRjEgMtz6XovrSHBKQqNxlSS91rIfmCnFa47ELghTrc5xWALyWDbXDdPFUnyBhOY8JfZJX8FtcIRimL0GUmyDPrMthFnIUQDcLSsTSGj1hxCqgy_6JAbLCBzOIldH4voo4F4+launchtime:1786574211910+placelauncherurl:https%3A%2F%2Fwww.roblox.com%2FGame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D1786573723557003%26placeId%3D95082159892680%26isPlayTogetherGame%3Dfalse%26referredByPlayerId%3D0%26joinAttemptId%3D751d708c-49b0-43c1-874e-766cbd22d351%26joinAttemptOrigin%3DPlayButton+browsertrackerid:1786573723557003+robloxLocale:en_us+gameLocale:en_us+LaunchExp:InApp2⤵
- Executes dropped EXE
-
-
C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\RobloxPlayerBeta.exe" roblox-player:1+launchmode:play+gameinfo:bF9Ws34OGjc-H5b4j8LsVtVWw-45CpovRHg4ByNiGNQMPiu_rtSA6qMsyfMKBdrNPQ53ij9TYfl1CyO5zcOHpil0qIsBw_eVWXyoHXah24mG2C2frfxBpIQHspH9Vw7lEFQAQMgBJOOO_OO8eUaNxzZ9kZQDp4dnbeLe79P5gjfDvTwkZPjO97BIgdEAAnodtqcx8bkrJVgm5ga07peuWOwDMGSlrbKr70JSFjsCqYqyW3FGG3y5j_-N-f6i9xHsrvE6jrBzNX53QBYzEOi3-TVc8KZFTMcsdppUIxg8tl6LkwHO-UBotbYJQY5o9eEITmo-fKRrC3fVCm_LSpskTC1TNDO32bICOMXSK--ireE7ujvJDHzq9Zt6n60Rr64jG9OJlWL-4bHwW_Zt2jrZcf8qCo1c5CIhZzCDWqzrRjEgMtz6XovrSHBKQqNxlSS91rIfmCnFa47ELghTrc5xWALyWDbXDdPFUnyBhOY8JfZJX8FtcIRimL0GUmyDPrMthFnIUQDcLSsTSGj1hxCqgy_6JAbLCBzOIldH4voo4F4+launchtime:1786574211910+placelauncherurl:https%3A%2F%2Fwww.roblox.com%2FGame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D1786573723557003%26placeId%3D95082159892680%26isPlayTogetherGame%3Dfalse%26referredByPlayerId%3D0%26joinAttemptId%3D751d708c-49b0-43c1-874e-766cbd22d351%26joinAttemptOrigin%3DPlayButton+browsertrackerid:1786573723557003+robloxLocale:en_us+gameLocale:en_us+LaunchExp:InApp2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
- Modifies data under HKEY_USERS
-
C:\Windows\system32\magnify.exe"C:\Windows\system32\magnify.exe"1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{60A90A2F-858D-42AF-8929-82BE9D99E8A1}1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵
-
C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
-
C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Accessibility Features
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Accessibility Features
1Replay Monitor
Loading Replay Monitor...
Downloads
e5b3529.rbs
e5b352e.rbs
e5b3533.rbs
e5b353a.rbs
e5b353e.rbs
e5b3541.rbs
e5b3544.rbs
e5b3547.rbs
RobloxStudioInstaller.exe
ThirdPartyNotices.txt
state.rsm
f_000004
f_000023
f_000187
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
messages.json
craw_background.js
CURRENT
MANIFEST-000001
000003.log
LOG
MANIFEST-000001
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
TransportSecurity
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
the-real-index
the-real-index
the-real-index
the-real-index~RFe5c838f.TMP
data_0
data_2
data_3
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
settings.dat
settings.dat
settings.dat
settings.dat
settings.dat
settings.dat
LOG.old
LOG.old
LOG.old
f_0000d6
f_0000d8
f_0000db
temp-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index~RFe5a136a.TMP
data_1
SiteList-Enterprise.json
Edge Profile.ico
Favicons
History
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Sdch Dictionaries
TransportSecurity
TransportSecurity
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
the-real-index
the-real-index~RFe5c9b5d.TMP
the-real-index
the-real-index
the-real-index
the-real-index~RFe5b7e93.TMP
the-real-index
the-real-index
index.txt
index.txt
index.txt
index.txt
index.txt
index.txt~RFe616570.TMP
LOG
the-real-index
the-real-index~RFe5bd56d.TMP
LOG
000003.log
LOG
sync_diagnostic.log
bbfce05f-0bbe-4698-8a91-6f2d5c4f7068.tmp
fc5163f1-b464-486d-967d-7c84ce33fb8a.tmp
OperationConfig
Last Version
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
campaign_history
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter~RFe5bec31.TMP
data_1
Variations
3be2a8fd-50dc-42b6-87f8-39a80a667326.tmp
a8825c7b-ef09-4caf-b084-4a08157d95b8.tmp
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
b50c6942-e1a0-4557-b425-7cf2639bc331.tmp
metadata.json~RFe59eae3.TMP
cacert.pem
Microsoft_Windows_Desktop_Runtime_-_9.0.19_(x64)_20260812232700_000_dotnet_runtime_9.0.19_win_x64.msi.log
a68bc4fa-86b0-4316-b0b8-5ab5e4d945e5.tmp
LICENSE.electron.txt
LICENSES.chromium.html
chrome_100_percent.pak
chrome_200_percent.pak
d3dcompiler_47.dll
ffmpeg.dll
icudtl.dat
libEGL.dll
libGLESv2.dll
af.pak
am.pak
ar.pak
bg.pak
bn.pak
ca.pak
cs.pak
da.pak
de.pak
el.pak
en-GB.pak
en-US.pak
es-419.pak
es.pak
et.pak
fa.pak
fi.pak
fil.pak
fr.pak
gu.pak
he.pak
hi.pak
hr.pak
hu.pak
id.pak
it.pak
ja.pak
kn.pak
ko.pak
lt.pak
lv.pak
ml.pak
mr.pak
ms.pak
nb.pak
nl.pak
pl.pak
pt-BR.pak
pt-PT.pak
ro.pak
ru.pak
sk.pak
sl.pak
sr.pak
sv.pak
sw.pak
ta.pak
te.pak
th.pak
tr.pak
uk.pak
ur.pak
vi.pak
zh-CN.pak
zh-TW.pak
resources.pak
binding.gyp
addon.obj
vcpkg.applocal.log
win_delay_load_hook.obj
xeno.node.recipe
CL.command.1.tlog
CL.read.1.tlog
CL.write.1.tlog
Cl.items.tlog
link.command.1.tlog
link.read.1.tlog
link.secondary.1.tlog
link.write.1.tlog
xeno.lastbuildstate
xeno.iobj
xeno.ipdb
xeno.node
config.gypi
xeno.vcxproj
xeno.vcxproj.filters
package.json
elevate.exe
Failed.png
Xeno.dll
Xeno.ico
api-ms-win-crt-convert-l1-1-0.dll
api-ms-win-crt-environment-l1-1-0.dll
api-ms-win-crt-filesystem-l1-1-0.dll
api-ms-win-crt-heap-l1-1-0.dll
api-ms-win-crt-locale-l1-1-0.dll
api-ms-win-crt-math-l1-1-0.dll
api-ms-win-crt-runtime-l1-1-0.dll
api-ms-win-crt-stdio-l1-1-0.dll
api-ms-win-crt-string-l1-1-0.dll
api-ms-win-crt-utility-l1-1-0.dll
concrt140.dll
index.html
libcrypto-3-x64.dll
libcurl.dll
libssl-3-x64.dll
msvcp140.dll
msvcp140_1.dll
msvcrt.dll
notification.mp3
ucrtbase.dll
vcruntime140.dll
vcruntime140_1.dll
zlib1.dll
snapshot_blob.bin
v8_context_snapshot.bin
vk_swiftshader.dll
vk_swiftshader_icd.json
vulkan-1.dll
content_new.js
messages.json
XENO_CACHE.bin
SP_6DB57156F8324BAC90D9029FF4076425.dat
default.exc
5d696d521de238c3.customDestinations-ms
5d696d521de238c3.customDestinations-ms
5d696d521de238c3.customDestinations-ms
index
Network Persistent State
Network Persistent State
Network Persistent State
TransportSecurity
TransportSecurity
TransportSecurity~RFe61c999.TMP
RobloxPlayerInstaller-R7CGG9GRFR.exe
MSI4458.tmp
Staging
LICENSE
BootstrapperApplicationData.xml
thm.xml
windowsdesktop-runtime-9.0.19-win-x64.exe
dotnet_host_9.0.19_win_x64.msi
dotnet_hostfxr_9.0.19_win_x64.msi
dotnet_runtime_9.0.19_win_x64.msi
windowsdesktop_runtime_9.0.19_win_x64.msi
thm.wxl
bg.png
wixstdba.dll
memory/984-6770-0x00007FFAB1B80000-0x00007FFAB1B81000-memory.dmp
memory/7216-7348-0x000001A843EC0000-0x000001A843EC1000-memory.dmp
memory/7216-7347-0x000001A843EC0000-0x000001A843EC1000-memory.dmp
memory/7216-7346-0x000001A843EC0000-0x000001A843EC1000-memory.dmp
memory/7216-7345-0x000001A843EC0000-0x000001A843EC1000-memory.dmp
memory/7216-7349-0x000001A843EC0000-0x000001A843EC1000-memory.dmp
memory/7216-7340-0x000001A843EC0000-0x000001A843EC1000-memory.dmp
memory/7216-7338-0x000001A843EC0000-0x000001A843EC1000-memory.dmp
memory/7216-7344-0x000001A843EC0000-0x000001A843EC1000-memory.dmp
memory/7852-6696-0x00007FFAB2020000-0x00007FFAB2021000-memory.dmp
memory/7852-6695-0x00007FFAB1F70000-0x00007FFAB1F71000-memory.dmp