Analysis
- user interaction
yes - max time kernel
149s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
30/10/2026, 09:28
General
- Target Xeno-v1.3.65.exe
- Size 84.7MB
- Sample261030-lfc4xaa16w
- SHA256 829c1e8861cadb5835fe968b98d06254254e6a4120250d9f5cf612d3f152c7a1
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 7 IoCs
- Loads dropped DLL 25 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 9 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops file in Program Files directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 3 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 9 IoCs
- Modifies registry class 4 IoCs
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 43 IoCs
- Suspicious use of SendNotifyMessage 37 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.65.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.65.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3KyUqhCJZ5zlHiOQfYR15XZ3zaE\Xeno-v1.3.65.exeC:\Users\Admin\AppData\Local\Temp\3KyUqhCJZ5zlHiOQfYR15XZ3zaE\Xeno-v1.3.65.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3KyUqhCJZ5zlHiOQfYR15XZ3zaE\Xeno-v1.3.65.exe"C:\Users\Admin\AppData\Local\Temp\3KyUqhCJZ5zlHiOQfYR15XZ3zaE\Xeno-v1.3.65.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Xeno" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1664 --field-trial-handle=1668,i,1675427199884748971,2536359271322625033,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:23⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/xe-no3⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c0,0x2c4,0x2c8,0x2bc,0x358,0x7ffada3cc188,0x7ffada3cc194,0x7ffada3cc1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1788,i,6213170554869308284,14909808877656385341,524288 --field-trial-handle=2512,i,2981768007213854510,16973268306814525249,262144 --variations-seed-version --mojo-platform-channel-handle=2540 /prefetch:34⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,17188591688474092890,7925711331419268288,262144 --field-trial-handle=2512,i,2981768007213854510,16973268306814525249,262144 --variations-seed-version --mojo-platform-channel-handle=2500 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2280,i,194959861271722336,853130996194544242,524288 --field-trial-handle=2512,i,2981768007213854510,16973268306814525249,262144 --variations-seed-version --mojo-platform-channel-handle=2556 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,11517296587825419698,11865010753485265704,2097152 --field-trial-handle=2512,i,2981768007213854510,16973268306814525249,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,1004990291159564096,5570279004426849428,2097152 --field-trial-handle=2512,i,2981768007213854510,16973268306814525249,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4932,i,2093781567489306137,2882665897863030310,2097152 --field-trial-handle=2512,i,2981768007213854510,16973268306814525249,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5584,i,7393343345963460130,3340625048699563842,524288 --field-trial-handle=2512,i,2981768007213854510,16973268306814525249,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,806195273032004361,7870503599269597382,524288 --field-trial-handle=2512,i,2981768007213854510,16973268306814525249,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:84⤵
- Modifies registry class
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,15495724362707178281,8056499038824702804,524288 --field-trial-handle=2512,i,2981768007213854510,16973268306814525249,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5672,i,6487466029822388623,9375103506823906960,524288 --field-trial-handle=2512,i,2981768007213854510,16973268306814525249,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6212,i,13054669600783131720,16626929776422858408,524288 --field-trial-handle=2512,i,2981768007213854510,16973268306814525249,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6212,i,13054669600783131720,16626929776422858408,524288 --field-trial-handle=2512,i,2981768007213854510,16973268306814525249,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=120,i,17234814656272421220,3916080012999736768,524288 --field-trial-handle=2512,i,2981768007213854510,16973268306814525249,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5356,i,6786022791124668261,7407361292559178554,524288 --field-trial-handle=2512,i,2981768007213854510,16973268306814525249,262144 --variations-seed-version --mojo-platform-channel-handle=7216 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7316,i,7142784633955689672,17553251808249855924,524288 --field-trial-handle=2512,i,2981768007213854510,16973268306814525249,262144 --variations-seed-version --mojo-platform-channel-handle=7192 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7224,i,10739523523630727988,17879240301248509464,524288 --field-trial-handle=2512,i,2981768007213854510,16973268306814525249,262144 --variations-seed-version --mojo-platform-channel-handle=120 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,14943608924048116175,11228552409031559680,524288 --field-trial-handle=2512,i,2981768007213854510,16973268306814525249,262144 --variations-seed-version --mojo-platform-channel-handle=7216 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7232,i,5199676604052013698,3290507514869274402,2097152 --field-trial-handle=2512,i,2981768007213854510,16973268306814525249,262144 --variations-seed-version --mojo-platform-channel-handle=7060 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window4⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffada3cc188,0x7ffada3cc194,0x7ffada3cc1a05⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1924,i,1053551308134050905,8443412186596336577,524288 --field-trial-handle=2336,i,8507311097868296804,5830943819333467856,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:35⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1732,i,15845176507229081257,17109523145842742193,262144 --field-trial-handle=2336,i,8507311097868296804,5830943819333467856,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:25⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2436,i,13018540304826494850,10208397624456882658,524288 --field-trial-handle=2336,i,8507311097868296804,5830943819333467856,262144 --variations-seed-version --mojo-platform-channel-handle=2464 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4344,i,14504329293076214651,4466172411250298660,524288 --field-trial-handle=2336,i,8507311097868296804,5830943819333467856,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4344,i,14504329293076214651,4466172411250298660,524288 --field-trial-handle=2336,i,8507311097868296804,5830943819333467856,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4496,i,14241240278599056595,14600745623680862258,524288 --field-trial-handle=2336,i,8507311097868296804,5830943819333467856,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4700,i,16350539402961423179,3732544209941493393,524288 --field-trial-handle=2336,i,8507311097868296804,5830943819333467856,262144 --variations-seed-version --mojo-platform-channel-handle=4776 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4728,i,7523297994114306479,4898724777909317198,524288 --field-trial-handle=2336,i,8507311097868296804,5830943819333467856,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4272,i,3069323801840277915,17934627865281287410,524288 --field-trial-handle=2336,i,8507311097868296804,5830943819333467856,262144 --variations-seed-version --mojo-platform-channel-handle=4856 /prefetch:85⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\3KyUqhCJZ5zlHiOQfYR15XZ3zaE\Xeno-v1.3.65.exe"C:\Users\Admin\AppData\Local\Temp\3KyUqhCJZ5zlHiOQfYR15XZ3zaE\Xeno-v1.3.65.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Xeno" --mojo-platform-channel-handle=1500 --field-trial-handle=1668,i,1675427199884748971,2536359271322625033,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:83⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
-
-
C:\Users\Admin\AppData\Local\Temp\3KyUqhCJZ5zlHiOQfYR15XZ3zaE\Xeno-v1.3.65.exe"C:\Users\Admin\AppData\Local\Temp\3KyUqhCJZ5zlHiOQfYR15XZ3zaE\Xeno-v1.3.65.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Xeno" --app-user-model-id=Xeno --app-path="C:\Users\Admin\AppData\Local\Temp\3KyUqhCJZ5zlHiOQfYR15XZ3zaE\resources\app.asar" --enable-sandbox --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2500 --field-trial-handle=1668,i,1675427199884748971,2536359271322625033,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:13⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\3KyUqhCJZ5zlHiOQfYR15XZ3zaE\Xeno-v1.3.65.exe"C:\Users\Admin\AppData\Local\Temp\3KyUqhCJZ5zlHiOQfYR15XZ3zaE\Xeno-v1.3.65.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Xeno" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=3376 --field-trial-handle=1668,i,1675427199884748971,2536359271322625033,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:23⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\3KyUqhCJZ5zlHiOQfYR15XZ3zaE\Xeno-v1.3.65.exe"C:\Users\Admin\AppData\Local\Temp\3KyUqhCJZ5zlHiOQfYR15XZ3zaE\Xeno-v1.3.65.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --user-data-dir="C:\Users\Admin\AppData\Roaming\Xeno" --mojo-platform-channel-handle=3836 --field-trial-handle=1668,i,1675427199884748971,2536359271322625033,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:83⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.xeno.now/3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\3KyUqhCJZ5zlHiOQfYR15XZ3zaE\Xeno-v1.3.65.exe"C:\Users\Admin\AppData\Local\Temp\3KyUqhCJZ5zlHiOQfYR15XZ3zaE\Xeno-v1.3.65.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\Xeno" --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2704 --field-trial-handle=1668,i,1675427199884748971,2536359271322625033,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:23⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffadd25c728,0x7ffadd25c734,0x7ffadd25c7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2136,i,18018065097821958198,12241519119919632148,524288 --field-trial-handle=1840,i,8753067190112271757,3856215205928832069,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2156 /prefetch:32⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1704,i,12263902047998790860,1599141466374996414,262144 --field-trial-handle=1840,i,8753067190112271757,3856215205928832069,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1836 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2420,i,1781836367015250214,14841654799181225812,524288 --field-trial-handle=1840,i,8753067190112271757,3856215205928832069,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2392 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3284,i,10153746410437037474,1261506680482904710,2097152 --field-trial-handle=1840,i,8753067190112271757,3856215205928832069,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3296 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3300,i,7332392426325735420,17097672200213438522,2097152 --field-trial-handle=1840,i,8753067190112271757,3856215205928832069,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2924 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4472,i,11357538316109611709,2919538052586280658,2097152 --field-trial-handle=1840,i,8753067190112271757,3856215205928832069,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4492 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4768,i,15051003892521547312,293795121576819870,2097152 --field-trial-handle=1840,i,8753067190112271757,3856215205928832069,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4784 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5576,i,5301824517010800388,12313082975581563200,524288 --field-trial-handle=1840,i,8753067190112271757,3856215205928832069,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5200 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5588,i,10615124945732902177,1869568714863717420,2097152 --field-trial-handle=1840,i,8753067190112271757,3856215205928832069,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5608 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3344,i,10210308228468947864,4909762564232265805,524288 --field-trial-handle=1840,i,8753067190112271757,3856215205928832069,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3484 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3332,i,18248062549901038410,6578904804101835905,524288 --field-trial-handle=1840,i,8753067190112271757,3856215205928832069,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3512 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3456,i,7759321059114423526,14955102317152607181,524288 --field-trial-handle=1840,i,8753067190112271757,3856215205928832069,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4660 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=4608,i,10051261749900760795,5222218080937869724,2097152 --field-trial-handle=1840,i,8753067190112271757,3856215205928832069,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3464 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5968,i,6545718198378648014,10202448274456104030,524288 --field-trial-handle=1840,i,8753067190112271757,3856215205928832069,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3292 /prefetch:82⤵
- Modifies registry class
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=6156,i,10914841377899179163,17642425556044294007,524288 --field-trial-handle=1840,i,8753067190112271757,3856215205928832069,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3280 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6044,i,15637718794134504874,11355691068397564550,2097152 --field-trial-handle=1840,i,8753067190112271757,3856215205928832069,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6016 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
LICENSE
verified_contents.json
239d88da-812c-4323-8ffd-29c01768039e.tmp
77d227a0-0400-4571-b473-420e21bc8ff2.tmp
9b55c535-42af-4e9c-9e63-340a1a54e699.tmp
settings.dat
5793817a-9738-4b11-b8ee-aa9ee35a458e.tmp
f_000007
f_00002b
temp-index
3a0941b6-7a1a-48ba-94b3-7eeca2e6bdac.tmp
c4d59fac-4013-46bb-8189-7ec2d8d9b2e2.tmp
temp-index
the-real-index
temp-index
b108a2cf-b58f-45ac-bfc0-b2ba2d606008.tmp
dedbad72-3b96-47c0-81e9-72a401085974.tmp
efedf8ae-5122-47b8-aa73-036b477804d7.tmp
f1b53c35-1ce7-40d6-a918-90a9372d6539.tmp
b374bb2f-3746-46a3-878e-68aa3b2240ee.tmp
0bb3c1f5-3ff2-430c-8f55-868b1fe9e5c8.tmp
25131178-56a5-4d81-a71f-b458a2c0f6aa.tmp
5fa89381-270d-475f-8226-c790ce5de7c9.tmp
9177124f-0b80-4466-9a1f-9196194830f5.tmp
settings.dat
settings.dat
settings.dat
settings.dat
settings.dat
223c029c-21fd-419c-a105-949b995621f6.tmp
4116c319-5ef3-4804-ac34-c2af1f49680a.tmp
f_00006d
temp-index
temp-index
the-real-index
8f94e102-10ce-456e-8230-8e5aefe7b832.tmp
dasherSettingSchema.json
3be7f994-9a4d-4536-8d23-c090cf3d9901.tmp
c2a56b30-203a-4dbf-a5b5-310344b4da50.tmp
e25228fb-5b69-45ad-9896-3ff97f8ecb8b.tmp
fd60d409-16d1-489e-9a8c-d07e18ccc6c3.tmp
index
index.txt
index.txt.tmp
index.txt.tmp
sync_diagnostic.log
bd903c16-d11a-4c37-aea5-1cf3c186d6d5.tmp
d27e0151-bea6-40aa-a7fc-26bd528e0ef6.tmp
da46bdb3-2202-4edf-ad08-a0bbf73e1516.tmp
e4de8de7-6b9d-4226-af0b-386a91fe752f.tmp
f7daf322-b7b5-4d11-8d5a-37b46de82e98.tmp
fa5c8370-173f-4665-b710-6aaebc780202.tmp
keys.json
manifest.json
c4f17eca-5c99-47b1-876b-fbc2d4a7ebef.tmp
ce2535cb-8360-4333-9b09-1c27689a4ed6.tmp
ed2cae09-6784-4ab0-b940-95ef70ea68a9.tmp
3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
d318891c-7ef8-44f5-986e-c8423f8a6c93.tmp
5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
30219ee2-e744-4e98-9c2b-7d272a02a68a.tmp
LICENSE.electron.txt
LICENSES.chromium.html
chrome_200_percent.pak
ffmpeg.dll
icudtl.dat
libEGL.dll
libGLESv2.dll
af.pak
am.pak
ar.pak
bg.pak
bn.pak
ca.pak
cs.pak
da.pak
de.pak
el.pak
en-GB.pak
en-US.pak
es-419.pak
es.pak
et.pak
fa.pak
fi.pak
fil.pak
fr.pak
gu.pak
he.pak
hi.pak
hr.pak
hu.pak
id.pak
it.pak
ja.pak
kn.pak
ko.pak
lt.pak
lv.pak
ml.pak
mr.pak
ms.pak
nb.pak
nl.pak
pl.pak
pt-BR.pak
pt-PT.pak
ro.pak
ru.pak
sk.pak
sl.pak
sr.pak
sv.pak
sw.pak
ta.pak
te.pak
th.pak
tr.pak
uk.pak
ur.pak
vi.pak
zh-CN.pak
zh-TW.pak
resources.pak
binding.gyp
addon.obj
vcpkg.applocal.log
win_delay_load_hook.obj
xeno.node.recipe
CL.command.1.tlog
CL.read.1.tlog
CL.write.1.tlog
Cl.items.tlog
link.command.1.tlog
link.read.1.tlog
link.secondary.1.tlog
link.write.1.tlog
xeno.lastbuildstate
xeno.iobj
xeno.ipdb
xeno.node
config.gypi
xeno.vcxproj
xeno.vcxproj.filters
package.json
elevate.exe
Failed.png
Xeno.dll
Xeno.ico
api-ms-win-crt-convert-l1-1-0.dll
api-ms-win-crt-environment-l1-1-0.dll
api-ms-win-crt-filesystem-l1-1-0.dll
api-ms-win-crt-heap-l1-1-0.dll
api-ms-win-crt-locale-l1-1-0.dll
api-ms-win-crt-math-l1-1-0.dll
api-ms-win-crt-runtime-l1-1-0.dll
api-ms-win-crt-stdio-l1-1-0.dll
api-ms-win-crt-string-l1-1-0.dll
api-ms-win-crt-utility-l1-1-0.dll
concrt140.dll
index.html
libcrypto-3-x64.dll
libcurl.dll
libssl-3-x64.dll
msvcp140.dll
msvcp140_1.dll
msvcrt.dll
notification.mp3
ucrtbase.dll
vcruntime140.dll
vcruntime140_1.dll
zlib1.dll
snapshot_blob.bin
v8_context_snapshot.bin
vk_swiftshader.dll
vk_swiftshader_icd.json
vulkan-1.dll
chrome_100_percent.pak
d3dcompiler_47.dll
StdUtils.dll
System.dll
nsis7z.dll
messages.json
XENO_CACHE.bin
default.dic
temp-index
index
data_0
data_1
data_2
data_3
CURRENT
3321da71-5031-4b11-93e6-f3ea263db1e8.tmp
374cbba9-321c-4112-9200-3752bee01836.tmp
Network Persistent State
TransportSecurity
memory/2772-932-0x00007FFAF7910000-0x00007FFAF7911000-memory.dmp
memory/2772-931-0x00007FFAF80C0000-0x00007FFAF80C1000-memory.dmp
memory/3388-1678-0x000002473D4C0000-0x000002473D661000-memory.dmp
memory/3388-1032-0x00007FFAF7F10000-0x00007FFAF7F11000-memory.dmp
memory/3516-2991-0x000001D47AA80000-0x000001D47AA81000-memory.dmp
memory/3516-2984-0x000001D47AA80000-0x000001D47AA81000-memory.dmp
memory/3516-2983-0x000001D47AA80000-0x000001D47AA81000-memory.dmp
memory/3516-2982-0x000001D47AA80000-0x000001D47AA81000-memory.dmp
memory/3516-2988-0x000001D47AA80000-0x000001D47AA81000-memory.dmp
memory/3516-2990-0x000001D47AA80000-0x000001D47AA81000-memory.dmp
memory/3516-2989-0x000001D47AA80000-0x000001D47AA81000-memory.dmp
memory/3516-2992-0x000001D47AA80000-0x000001D47AA81000-memory.dmp
memory/3516-2993-0x000001D47AA80000-0x000001D47AA81000-memory.dmp
memory/3516-2994-0x000001D47AA80000-0x000001D47AA81000-memory.dmp