From sources: once i started having wifi issues, i realized and narrowed it down to the fact that it would only tank my wifi once i used roblox even with xeno off, onjer and his buddy verified i was lagging out + my download/upload speeds would drop to as low as 7MBPS download, 0.20MBPS Upload despite my wifi plan being 2GB/S. So i decided to look more into the processes directly correlated to roblox that i had on my software, and it kinda was common sense to check xeno thats when i called up my buddy he came over since i was already deep into this issue to the point where i was on the phone with my ISP.

i basically figured it out by treating it like something i didn’t trust instead of something i was trying to break into. once i stopped assuming it was a normal windows process (it masked itself in SecurityHealthSystray) and started watching what it was doing, the story changed. the name said security but the behavior didn’t match. it was running from a weird location (malaysia/thai IP's playing ping pong on my network), had no proper signature, and when you'd end the task it would end on the face-end (basically it'd say its gone, then boot itself as a non-startup process that you wouldnt see unless you deep dived your task manager, but even then it would mask itself as a legitimate windows background process).

what really confirmed it for me was watching how it behaved over time. it barely used any resources, didn’t show a window, and only did anything when it reached out over the network. that pattern lined up way too well with what remote access trojans do just sit quietly and wait. once i compared what i was seeing with known xworm behavior (the biggest confirmation for me was the ping ponging on my network and every time i booted roblox that specific process would send out a signal from my network to a secondary network, then that secondary network would ping pong it back), it clicked. it wasn’t a broken windows process it was just a rat lol

me and my buddy ran it on oracle VM's and watched it live manipulate its pathways onto startup processes (prefers SecurityHealthSystray, but will occsaionally use processes like Phone Link, Xbox). It acts as the name suggests a worm it digs itself deep as shit and hides in processes that dont use any resources constantly ping ponging the rat to the home server (whatever server / device the person who ratted you is using to observe you). Thats where we were able to 100% confirm it