dfdbce9b765c26599aa350287d6b218d05dc0797bde8f2ad0ac63fcdd18a811b

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29-09-2022 18:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RobloxPlayerLauncher (1).exe
Size

5.4MB
MD5

ab239093b6ec030b98a7dd3ef43ab07c
SHA1

249c0cc5d4bafbb440f40fb2d4ac450a57115873
SHA256

dfdbce9b765c26599aa350287d6b218d05dc0797bde8f2ad0ac63fcdd18a811b
SHA512

57e1a8538ca2dd4041908eef3a5cb099fcf87a2018ffa37457e7c302a8e780586a000a0f9a28778dbe6a7a075293eb11ffc18fd0da29963fddd0b5d45c391ce7
SSDEEP

98304:yL8XpCsgHtJQi9UWvGf8YTewg8nwQHlSpXqxCJirVRo1vJn:yLmpEHvUWvovewgmtlSEUJim

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 20 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\_MEI27362\python39.dll	upx
C:\Users\Admin\AppData\Local\Temp\_MEI27362\python39.dll	upx
C:\Users\Admin\AppData\Local\Temp\_MEI27362\_ctypes.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI27362\_ctypes.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI27362\libffi-7.dll	upx
C:\Users\Admin\AppData\Local\Temp\_MEI27362\libffi-7.dll	upx
C:\Users\Admin\AppData\Local\Temp\_MEI27362\_bz2.pyd	upx
behavioral2/memory/4264-145-0x00007FFFEF670000-0x00007FFFEFAF9000-memory.dmp	upx
behavioral2/memory/4264-146-0x00007FF802B20000-0x00007FF802B46000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\_MEI27362\_bz2.pyd	upx
behavioral2/memory/4264-149-0x00007FF803590000-0x00007FF80359F000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\_MEI27362\_lzma.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI27362\_lzma.pyd	upx
behavioral2/memory/4264-153-0x00007FF8029A0000-0x00007FF8029BC000-memory.dmp	upx
behavioral2/memory/4264-154-0x00007FFFFE0A0000-0x00007FFFFE0CE000-memory.dmp	upx
behavioral2/memory/4264-156-0x00007FFFEF670000-0x00007FFFEFAF9000-memory.dmp	upx
behavioral2/memory/4264-157-0x00007FF8029A0000-0x00007FF8029BC000-memory.dmp	upx
behavioral2/memory/4264-158-0x00007FF803590000-0x00007FF80359F000-memory.dmp	upx
behavioral2/memory/4264-159-0x00007FF802B20000-0x00007FF802B46000-memory.dmp	upx
behavioral2/memory/4264-160-0x00007FFFFE0A0000-0x00007FFFFE0CE000-memory.dmp	upx

Loads dropped DLL 7 IoCs

Processes:

RobloxPlayerLauncher (1).exe

pid	process
4264	RobloxPlayerLauncher (1).exe
4264	RobloxPlayerLauncher (1).exe
4264	RobloxPlayerLauncher (1).exe
4264	RobloxPlayerLauncher (1).exe
4264	RobloxPlayerLauncher (1).exe
4264	RobloxPlayerLauncher (1).exe
4264	RobloxPlayerLauncher (1).exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exechrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description ioc process

Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

Processes:

msedge.exechrome.exemsedge.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exemsedge.exechrome.exe

pid	process
3084	msedge.exe
3084	msedge.exe
2956	chrome.exe
2956	chrome.exe
4296	msedge.exe
4296	msedge.exe
2152	chrome.exe
2152	chrome.exe
5576	chrome.exe
5576	chrome.exe
5760	chrome.exe
5760	chrome.exe
5984	chrome.exe
5984	chrome.exe
6044	chrome.exe
6044	chrome.exe
5144	chrome.exe
5144	chrome.exe
5528	msedge.exe
5528	msedge.exe
5528	msedge.exe
5528	msedge.exe
1340	chrome.exe
1340	chrome.exe
1340	chrome.exe
1340	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exechrome.exe

pid process

4296 msedge.exe
4296 msedge.exe
2152 chrome.exe
2152 chrome.exe
2152 chrome.exe
2152 chrome.exe
2152 chrome.exe

Suspicious use of FindShellTrayWindow 44 IoCs

Processes:

msedge.exechrome.exe

pid	process
4296	msedge.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
4296	msedge.exe

Suspicious use of SendNotifyMessage 40 IoCs

Processes:

chrome.exe

pid	process
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

RobloxPlayerLauncher (1).exeRobloxPlayerLauncher (1).execmd.exemsedge.exechrome.exe

description	pid	process	target process
PID 2736 wrote to memory of 4264	2736	RobloxPlayerLauncher (1).exe	RobloxPlayerLauncher (1).exe
PID 2736 wrote to memory of 4264	2736	RobloxPlayerLauncher (1).exe	RobloxPlayerLauncher (1).exe
PID 4264 wrote to memory of 4972	4264	RobloxPlayerLauncher (1).exe	cmd.exe
PID 4264 wrote to memory of 4972	4264	RobloxPlayerLauncher (1).exe	cmd.exe
PID 4264 wrote to memory of 4880	4264	RobloxPlayerLauncher (1).exe	cmd.exe
PID 4264 wrote to memory of 4880	4264	RobloxPlayerLauncher (1).exe	cmd.exe
PID 4880 wrote to memory of 4296	4880	cmd.exe	msedge.exe
PID 4880 wrote to memory of 4296	4880	cmd.exe	msedge.exe
PID 4296 wrote to memory of 1960	4296	msedge.exe	msedge.exe
PID 4296 wrote to memory of 1960	4296	msedge.exe	msedge.exe
PID 4296 wrote to memory of 4900	4296	msedge.exe	msedge.exe
PID 4296 wrote to memory of 4900	4296	msedge.exe	msedge.exe
PID 4296 wrote to memory of 4900	4296	msedge.exe	msedge.exe
PID 4296 wrote to memory of 4900	4296	msedge.exe	msedge.exe
PID 4296 wrote to memory of 4900	4296	msedge.exe	msedge.exe
PID 4296 wrote to memory of 4900	4296	msedge.exe	msedge.exe
PID 4296 wrote to memory of 4900	4296	msedge.exe	msedge.exe
PID 4296 wrote to memory of 4900	4296	msedge.exe	msedge.exe
PID 4296 wrote to memory of 4900	4296	msedge.exe	msedge.exe
PID 4296 wrote to memory of 4900	4296	msedge.exe	msedge.exe
PID 4296 wrote to memory of 4900	4296	msedge.exe	msedge.exe
PID 4296 wrote to memory of 4900	4296	msedge.exe	msedge.exe
PID 4296 wrote to memory of 4900	4296	msedge.exe	msedge.exe
PID 4296 wrote to memory of 4900	4296	msedge.exe	msedge.exe
PID 4296 wrote to memory of 4900	4296	msedge.exe	msedge.exe
PID 4296 wrote to memory of 4900	4296	msedge.exe	msedge.exe
PID 4296 wrote to memory of 4900	4296	msedge.exe	msedge.exe
PID 4296 wrote to memory of 4900	4296	msedge.exe	msedge.exe
PID 4296 wrote to memory of 4900	4296	msedge.exe	msedge.exe
PID 4296 wrote to memory of 4900	4296	msedge.exe	msedge.exe
PID 4296 wrote to memory of 4900	4296	msedge.exe	msedge.exe
PID 4296 wrote to memory of 4900	4296	msedge.exe	msedge.exe
PID 4296 wrote to memory of 4900	4296	msedge.exe	msedge.exe
PID 4296 wrote to memory of 4900	4296	msedge.exe	msedge.exe
PID 4296 wrote to memory of 4900	4296	msedge.exe	msedge.exe
PID 4296 wrote to memory of 4900	4296	msedge.exe	msedge.exe
PID 4296 wrote to memory of 4900	4296	msedge.exe	msedge.exe
PID 4296 wrote to memory of 4900	4296	msedge.exe	msedge.exe
PID 4296 wrote to memory of 4900	4296	msedge.exe	msedge.exe
PID 4296 wrote to memory of 4900	4296	msedge.exe	msedge.exe
PID 4296 wrote to memory of 4900	4296	msedge.exe	msedge.exe
PID 4296 wrote to memory of 4900	4296	msedge.exe	msedge.exe
PID 4296 wrote to memory of 4900	4296	msedge.exe	msedge.exe
PID 4296 wrote to memory of 4900	4296	msedge.exe	msedge.exe
PID 4296 wrote to memory of 4900	4296	msedge.exe	msedge.exe
PID 4296 wrote to memory of 4900	4296	msedge.exe	msedge.exe
PID 4296 wrote to memory of 4900	4296	msedge.exe	msedge.exe
PID 4296 wrote to memory of 4900	4296	msedge.exe	msedge.exe
PID 4296 wrote to memory of 4900	4296	msedge.exe	msedge.exe
PID 4296 wrote to memory of 4900	4296	msedge.exe	msedge.exe
PID 4296 wrote to memory of 3084	4296	msedge.exe	msedge.exe
PID 4296 wrote to memory of 3084	4296	msedge.exe	msedge.exe
PID 2152 wrote to memory of 4464	2152	chrome.exe	chrome.exe
PID 2152 wrote to memory of 4464	2152	chrome.exe	chrome.exe
PID 4296 wrote to memory of 3780	4296	msedge.exe	msedge.exe
PID 4296 wrote to memory of 3780	4296	msedge.exe	msedge.exe
PID 4296 wrote to memory of 3780	4296	msedge.exe	msedge.exe
PID 4296 wrote to memory of 3780	4296	msedge.exe	msedge.exe
PID 4296 wrote to memory of 3780	4296	msedge.exe	msedge.exe
PID 4296 wrote to memory of 3780	4296	msedge.exe	msedge.exe
PID 4296 wrote to memory of 3780	4296	msedge.exe	msedge.exe
PID 4296 wrote to memory of 3780	4296	msedge.exe	msedge.exe
PID 4296 wrote to memory of 3780	4296	msedge.exe	msedge.exe
PID 4296 wrote to memory of 3780	4296	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\RobloxPlayerLauncher (1).exe
"C:\Users\Admin\AppData\Local\Temp\RobloxPlayerLauncher (1).exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2736

C:\Users\Admin\AppData\Local\Temp\RobloxPlayerLauncher (1).exe
"C:\Users\Admin\AppData\Local\Temp\RobloxPlayerLauncher (1).exe"
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4264

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:4972

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start https://github.com/lolmanurfunny/Roblox-Launcher-minus-the-app
3⤵
- Suspicious use of WriteProcessMemory
PID:4880

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/lolmanurfunny/Roblox-Launcher-minus-the-app
4⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4296

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf4,0xf8,0xfc,0xd0,0x100,0x7fffeef346f8,0x7fffeef34708,0x7fffeef34718
5⤵
PID:1960

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,11559433561460459075,7149376890972883864,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
5⤵
PID:4900

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,11559433561460459075,7149376890972883864,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:3084

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,11559433561460459075,7149376890972883864,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3124 /prefetch:8
5⤵
PID:3780

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11559433561460459075,7149376890972883864,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3784 /prefetch:1
5⤵
PID:2664

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11559433561460459075,7149376890972883864,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3792 /prefetch:1
5⤵
PID:3624

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2100,11559433561460459075,7149376890972883864,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5160 /prefetch:8
5⤵
PID:4272

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,11559433561460459075,7149376890972883864,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2336 /prefetch:2
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:5528

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:400

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2152

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffeca74f50,0x7fffeca74f60,0x7fffeca74f70
2⤵
PID:4464

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1668,1734044905925204442,2172666491269183516,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1700 /prefetch:2
2⤵
PID:1360

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1668,1734044905925204442,2172666491269183516,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2052 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2956

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1668,1734044905925204442,2172666491269183516,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2280 /prefetch:8
2⤵
PID:4048

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1668,1734044905925204442,2172666491269183516,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2976 /prefetch:1
2⤵
PID:3220

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1668,1734044905925204442,2172666491269183516,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3124 /prefetch:1
2⤵
PID:4644

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1668,1734044905925204442,2172666491269183516,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3748 /prefetch:1
2⤵
PID:4036

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,1734044905925204442,2172666491269183516,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4512 /prefetch:8
2⤵
PID:2244

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,1734044905925204442,2172666491269183516,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3780 /prefetch:8
2⤵
PID:4692

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,1734044905925204442,2172666491269183516,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4508 /prefetch:8
2⤵
PID:5140

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1668,1734044905925204442,2172666491269183516,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4792 /prefetch:1
2⤵
PID:5460

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1668,1734044905925204442,2172666491269183516,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4604 /prefetch:8
2⤵
PID:5540

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1668,1734044905925204442,2172666491269183516,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3124 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5576

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,1734044905925204442,2172666491269183516,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5220 /prefetch:8
2⤵
PID:5592

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1668,1734044905925204442,2172666491269183516,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2980 /prefetch:8
2⤵
PID:5652

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,1734044905925204442,2172666491269183516,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5352 /prefetch:8
2⤵
PID:5684

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1668,1734044905925204442,2172666491269183516,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3312 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5760

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1668,1734044905925204442,2172666491269183516,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
2⤵
PID:5868

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1668,1734044905925204442,2172666491269183516,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3420 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5984

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1668,1734044905925204442,2172666491269183516,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3760 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:6044

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,1734044905925204442,2172666491269183516,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2636 /prefetch:8
2⤵
PID:6136

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1668,1734044905925204442,2172666491269183516,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1172 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5144

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1668,1734044905925204442,2172666491269183516,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3412 /prefetch:8
2⤵
PID:1436

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1668,1734044905925204442,2172666491269183516,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=920 /prefetch:8
2⤵
PID:2800

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1668,1734044905925204442,2172666491269183516,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2616 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1340

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2384

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Query Registry

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI27362\VCRUNTIME140.dll
Filesize
94KB

MD5
a87575e7cf8967e481241f13940ee4f7

SHA1
879098b8a353a39e16c79e6479195d43ce98629e

SHA256
ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e

SHA512
e112f267ae4c9a592d0dd2a19b50187eb13e25f23ded74c2e6ccde458bcdaee99f4e3e0a00baf0e3362167ae7b7fe4f96ecbcd265cc584c1c3a4d1ac316e92f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI27362\VCRUNTIME140.dll
Filesize
94KB

MD5
a87575e7cf8967e481241f13940ee4f7

SHA1
879098b8a353a39e16c79e6479195d43ce98629e

SHA256
ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e

SHA512
e112f267ae4c9a592d0dd2a19b50187eb13e25f23ded74c2e6ccde458bcdaee99f4e3e0a00baf0e3362167ae7b7fe4f96ecbcd265cc584c1c3a4d1ac316e92f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI27362\_bz2.pyd
Filesize
46KB

MD5
e0dffe7800eb7c39ab216a04997440a8

SHA1
549b3e22271e453a46dfcbd55c93c8a44b6eaf7d

SHA256
1dc0fd2305cb3340d415f2a2cc6d751edb620f507a5c76eaf1fe648f5e16ee7b

SHA512
e28c50c0b6049d2a7c415e4c942772068cb4ce9040d6a7481191b442b6d34e78703e8d773003f085bc7a1e48e1abc3a647d29ed2d25afcf696938357bfbb13e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI27362\_bz2.pyd
Filesize
46KB

MD5
e0dffe7800eb7c39ab216a04997440a8

SHA1
549b3e22271e453a46dfcbd55c93c8a44b6eaf7d

SHA256
1dc0fd2305cb3340d415f2a2cc6d751edb620f507a5c76eaf1fe648f5e16ee7b

SHA512
e28c50c0b6049d2a7c415e4c942772068cb4ce9040d6a7481191b442b6d34e78703e8d773003f085bc7a1e48e1abc3a647d29ed2d25afcf696938357bfbb13e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI27362\_ctypes.pyd
Filesize
56KB

MD5
6b45796e29a2483e0bf39bc9c1155f10

SHA1
cd47a9422766e98a764e1e46f6c0ad362e9add15

SHA256
fddb6d46055e6c5d2477ed2c0244848248ff9379226043089df9110433e523d5

SHA512
7a62a6db644fe5e277c3e96a1baa332361e5ee9c781fdb32cbdb7308a99a26d6ab065233b1d48fe5eb4dcd480f45168b1d3d41f337a640b5c3e2cd858e3fb7e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI27362\_ctypes.pyd
Filesize
56KB

MD5
6b45796e29a2483e0bf39bc9c1155f10

SHA1
cd47a9422766e98a764e1e46f6c0ad362e9add15

SHA256
fddb6d46055e6c5d2477ed2c0244848248ff9379226043089df9110433e523d5

SHA512
7a62a6db644fe5e277c3e96a1baa332361e5ee9c781fdb32cbdb7308a99a26d6ab065233b1d48fe5eb4dcd480f45168b1d3d41f337a640b5c3e2cd858e3fb7e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI27362\_lzma.pyd
Filesize
84KB

MD5
0ca789cfa7c7b9c522865996ac33c49a

SHA1
27c2dc4738f6fd0a30c5583a969af7fe118fc7e3

SHA256
0e18abd6858ac4f730a80334867b23ebc77e2d608d0172b85512e01346c18304

SHA512
7b91e08a0f1776d1cb936d746f40fc0a12b06d17cbfff5a7ddf94e180cc844af148d3e517cd5fac93648e02c926e8209c7e5822f8157c12a58c2018b3e414805

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI27362\_lzma.pyd
Filesize
84KB

MD5
0ca789cfa7c7b9c522865996ac33c49a

SHA1
27c2dc4738f6fd0a30c5583a969af7fe118fc7e3

SHA256
0e18abd6858ac4f730a80334867b23ebc77e2d608d0172b85512e01346c18304

SHA512
7b91e08a0f1776d1cb936d746f40fc0a12b06d17cbfff5a7ddf94e180cc844af148d3e517cd5fac93648e02c926e8209c7e5822f8157c12a58c2018b3e414805

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI27362\base_library.zip
Filesize
1014KB

MD5
951e822c259f7260cc470b1664ab0652

SHA1
e1de6b4d1909b424368668c3758e11447d33b339

SHA256
76bc8a91d00f028754ee07efb30f896ea0f8afaeaeb0d40fc4e52fd0b0994abc

SHA512
30c01e02c7f0eea4a2913f9d74ffda83874ead3c17702e29738139dc2f397abbed737ddc059b3a1f9a08abf6ba5208be97762925bd0a890e4aaee8113e9f791a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI27362\libffi-7.dll
Filesize
23KB

MD5
b5150b41ca910f212a1dd236832eb472

SHA1
a17809732c562524b185953ffe60dfa91ba3ce7d

SHA256
1a106569ac0ad3152f3816ff361aa227371d0d85425b357632776ac48d92ea8a

SHA512
9e82b0caa3d72bb4a7ad7d66ebfb10edb778749e89280bca67c766e72dc794e99aab2bc2980d64282a384699929ce6cc996462a73584898d2df67a57bff2a9c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI27362\libffi-7.dll
Filesize
23KB

MD5
b5150b41ca910f212a1dd236832eb472

SHA1
a17809732c562524b185953ffe60dfa91ba3ce7d

SHA256
1a106569ac0ad3152f3816ff361aa227371d0d85425b357632776ac48d92ea8a

SHA512
9e82b0caa3d72bb4a7ad7d66ebfb10edb778749e89280bca67c766e72dc794e99aab2bc2980d64282a384699929ce6cc996462a73584898d2df67a57bff2a9c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI27362\python39.dll
Filesize
1.4MB

MD5
267b57b92c42e03fb0b755cce98cb305

SHA1
b8ff299e6837a2cbbe28dc6facdc7de7650be842

SHA256
47502cbf3a458e94c4f9e2b7c00bf9a8af3a063e256bee1fc0f67e0a3017ed30

SHA512
c66723b2054cee070e7951475c11978701f680fd462d49dc7a069c654833855f5edf91e8d56390c120a6ba0f4650fe687a851525493f7bba13fa979c8c3eaaa6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI27362\python39.dll
Filesize
1.4MB

MD5
267b57b92c42e03fb0b755cce98cb305

SHA1
b8ff299e6837a2cbbe28dc6facdc7de7650be842

SHA256
47502cbf3a458e94c4f9e2b7c00bf9a8af3a063e256bee1fc0f67e0a3017ed30

SHA512
c66723b2054cee070e7951475c11978701f680fd462d49dc7a069c654833855f5edf91e8d56390c120a6ba0f4650fe687a851525493f7bba13fa979c8c3eaaa6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI27362\ucrtbase.dll
Filesize
986KB

MD5
0c8809225ba552acbc2c5f6d4eb182a9

SHA1
8b30a9b49f55e422ad947a71a94c0a1fdc062ead

SHA256
8903d3c8c23aff0558d43180c7151f84c6acf81a0dc4b6b1d8282d9d948a2fac

SHA512
7683af9f7bfe50c97acae9e998fb104082735dcc8d4e974e71c987c5160e53265d82d6f86235c42ddedc61533daadf727a9322473f1dac3ed2cd30f4cd8ee0e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI27362\ucrtbase.dll
Filesize
986KB

MD5
0c8809225ba552acbc2c5f6d4eb182a9

SHA1
8b30a9b49f55e422ad947a71a94c0a1fdc062ead

SHA256
8903d3c8c23aff0558d43180c7151f84c6acf81a0dc4b6b1d8282d9d948a2fac

SHA512
7683af9f7bfe50c97acae9e998fb104082735dcc8d4e974e71c987c5160e53265d82d6f86235c42ddedc61533daadf727a9322473f1dac3ed2cd30f4cd8ee0e5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Microsoft Edge.lnk
Filesize
2KB

MD5
24bb79bd08dc559af57c3d396bbb9339

SHA1
5138f09d70a32028144967032acb2e94d0ac4a75

SHA256
956a831f940b135aab986844fdf9f45efee1e214e91326dfede075299c554183

SHA512
4e279e0c58ce98f9bfb3cc153ee41bcd121dbf2045206bc3b57fa881db15ad63d5793d14fa6f3e8fad814b7a21711d38377e041ba5c8ef9c1071bba006491de8

Download Submit
\??\pipe\LOCAL\crashpad_4296_ODLCXAZMEZDSBDEH
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\pipe\crashpad_2152_RBFHZREYVOUCPRAJ
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1960-161-0x0000000000000000-mapping.dmp

Download
memory/2664-170-0x0000000000000000-mapping.dmp

Download
memory/3084-164-0x0000000000000000-mapping.dmp

Download
memory/3624-172-0x0000000000000000-mapping.dmp

Download
memory/3780-167-0x0000000000000000-mapping.dmp

Download
memory/4264-157-0x00007FF8029A0000-0x00007FF8029BC000-memory.dmp

Filesize
112KB

Download
memory/4264-153-0x00007FF8029A0000-0x00007FF8029BC000-memory.dmp

Filesize
112KB

Download
memory/4264-158-0x00007FF803590000-0x00007FF80359F000-memory.dmp

Filesize
60KB

Download
memory/4264-159-0x00007FF802B20000-0x00007FF802B46000-memory.dmp

Filesize
152KB

Download
memory/4264-160-0x00007FFFFE0A0000-0x00007FFFFE0CE000-memory.dmp

Filesize
184KB

Download
memory/4264-156-0x00007FFFEF670000-0x00007FFFEFAF9000-memory.dmp

Filesize
4.5MB

Download
memory/4264-132-0x0000000000000000-mapping.dmp

Download
memory/4264-149-0x00007FF803590000-0x00007FF80359F000-memory.dmp

Filesize
60KB

Download
memory/4264-146-0x00007FF802B20000-0x00007FF802B46000-memory.dmp

Filesize
152KB

Download
memory/4264-145-0x00007FFFEF670000-0x00007FFFEFAF9000-memory.dmp

Filesize
4.5MB

Download
memory/4264-154-0x00007FFFFE0A0000-0x00007FFFFE0CE000-memory.dmp

Filesize
184KB

Download
memory/4272-174-0x0000000000000000-mapping.dmp

Download
memory/4296-155-0x0000000000000000-mapping.dmp

Download
memory/4880-152-0x0000000000000000-mapping.dmp

Download
memory/4900-163-0x0000000000000000-mapping.dmp

Download
memory/4972-151-0x0000000000000000-mapping.dmp

Download
memory/5528-177-0x0000000000000000-mapping.dmp

Download