Analysis
-
max time kernel
451s -
max time network
453s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
13-02-2023 19:01
Static task
static1
URLScan task
urlscan1
Malware Config
Signatures
-
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 5 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
KrnlUI.exeCefSharp.BrowserSubprocess.exeRobloxPlayerLauncher.exekrnl_beta.exeCefSharp.BrowserSubprocess.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation KrnlUI.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation CefSharp.BrowserSubprocess.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation RobloxPlayerLauncher.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation krnl_beta.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation CefSharp.BrowserSubprocess.exe -
Executes dropped EXE 11 IoCs
Processes:
krnl_beta.exe7za.exe7za.exeKrnlUI.exeCefSharp.BrowserSubprocess.exeCefSharp.BrowserSubprocess.exeCefSharp.BrowserSubprocess.exeCefSharp.BrowserSubprocess.exeCefSharp.BrowserSubprocess.exeRobloxPlayerLauncher.exeRobloxPlayerLauncher.exepid process 1960 krnl_beta.exe 2180 7za.exe 768 7za.exe 3616 KrnlUI.exe 1580 CefSharp.BrowserSubprocess.exe 3464 CefSharp.BrowserSubprocess.exe 1748 CefSharp.BrowserSubprocess.exe 1484 CefSharp.BrowserSubprocess.exe 4164 CefSharp.BrowserSubprocess.exe 2272 RobloxPlayerLauncher.exe 3936 RobloxPlayerLauncher.exe -
Loads dropped DLL 53 IoCs
Processes:
krnl_beta.exeKrnlUI.exeCefSharp.BrowserSubprocess.exeCefSharp.BrowserSubprocess.exeCefSharp.BrowserSubprocess.exeCefSharp.BrowserSubprocess.exeCefSharp.BrowserSubprocess.exepid process 1960 krnl_beta.exe 1960 krnl_beta.exe 3616 KrnlUI.exe 3616 KrnlUI.exe 3616 KrnlUI.exe 3616 KrnlUI.exe 3616 KrnlUI.exe 3616 KrnlUI.exe 3616 KrnlUI.exe 3616 KrnlUI.exe 3616 KrnlUI.exe 3616 KrnlUI.exe 3616 KrnlUI.exe 1580 CefSharp.BrowserSubprocess.exe 1580 CefSharp.BrowserSubprocess.exe 1580 CefSharp.BrowserSubprocess.exe 1580 CefSharp.BrowserSubprocess.exe 1580 CefSharp.BrowserSubprocess.exe 1580 CefSharp.BrowserSubprocess.exe 1580 CefSharp.BrowserSubprocess.exe 1580 CefSharp.BrowserSubprocess.exe 1580 CefSharp.BrowserSubprocess.exe 1580 CefSharp.BrowserSubprocess.exe 1580 CefSharp.BrowserSubprocess.exe 1580 CefSharp.BrowserSubprocess.exe 3464 CefSharp.BrowserSubprocess.exe 3464 CefSharp.BrowserSubprocess.exe 3464 CefSharp.BrowserSubprocess.exe 3464 CefSharp.BrowserSubprocess.exe 3464 CefSharp.BrowserSubprocess.exe 3464 CefSharp.BrowserSubprocess.exe 3464 CefSharp.BrowserSubprocess.exe 1748 CefSharp.BrowserSubprocess.exe 1748 CefSharp.BrowserSubprocess.exe 1748 CefSharp.BrowserSubprocess.exe 1748 CefSharp.BrowserSubprocess.exe 1748 CefSharp.BrowserSubprocess.exe 1484 CefSharp.BrowserSubprocess.exe 1484 CefSharp.BrowserSubprocess.exe 1484 CefSharp.BrowserSubprocess.exe 1484 CefSharp.BrowserSubprocess.exe 1484 CefSharp.BrowserSubprocess.exe 1484 CefSharp.BrowserSubprocess.exe 1484 CefSharp.BrowserSubprocess.exe 1748 CefSharp.BrowserSubprocess.exe 1748 CefSharp.BrowserSubprocess.exe 4164 CefSharp.BrowserSubprocess.exe 4164 CefSharp.BrowserSubprocess.exe 4164 CefSharp.BrowserSubprocess.exe 4164 CefSharp.BrowserSubprocess.exe 4164 CefSharp.BrowserSubprocess.exe 4164 CefSharp.BrowserSubprocess.exe 4164 CefSharp.BrowserSubprocess.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
RobloxPlayerLauncher.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RobloxPlayerLauncher.exe -
Drops file in Program Files directory 64 IoCs
Processes:
RobloxPlayerLauncher.exedescription ioc process File created C:\Program Files (x86)\Roblox\Versions\version-b467400c8f8e4097\ExtraContent\LuaPackages\PurchasePromptDeps.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-b467400c8f8e4097\ExtraContent\LuaPackages\Packages\_Index\ReactRobloxProxy\ReactRoblox_rc16.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-b467400c8f8e4097\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\FriendsLanding\FriendsLanding\Friends\getCorrectUserPresence.test.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-b467400c8f8e4097\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\Http\Http\Requests\GamesMultigetPlaceDetails.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-b467400c8f8e4097\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\PYMKCarousel\PYMKCarousel\Components\PYMKCarouselUserTile\PYMKCarouselUserContextualInfo.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-b467400c8f8e4097\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\UnitTestHelpers\AvatarPolicies.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-b467400c8f8e4097\ExtraContent\LuaPackages\Packages\_Index\ExperienceChat-09990ed6-a147b962\ExperienceChat\BubbleChat\BubbleChatList\BubbleChatList.story.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-b467400c8f8e4097\ExtraContent\LuaPackages\Packages\_Index\roblox_networking-chat\networking-chat\networkRequests\createSendGameLinkMessage.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-b467400c8f8e4097\ExtraContent\LuaPackages\Packages\_Index\RoduxGames-c69837d6-1b7ccfde\RoduxGames\Models\ProductModel.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-b467400c8f8e4097\ExtraContent\LuaPackages\Packages\_Index\SocialLibraries\SocialLibraries\Components\Cells\ConversationCell.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-b467400c8f8e4097\ExtraContent\LuaPackages\Packages\_Index\TestEZ\TestEZ\ExpectationContext.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-b467400c8f8e4097\content\sounds\ouch.ogg RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-b467400c8f8e4097\content\textures\AnimationEditor\FaceCaptureUI\ReRecordButton.png RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-b467400c8f8e4097\ExtraContent\LuaPackages\Packages\_Index\GraphQL\GraphQL\error\__tests__\formatError.spec.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-b467400c8f8e4097\ExtraContent\LuaPackages\Packages\_Index\LuaProfileDeps\Promise.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-b467400c8f8e4097\ExtraContent\LuaPackages\Packages\_Index\ZenObservable\ZenObservable\init.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-b467400c8f8e4097\ExtraContent\textures\ui\LuaChat\graphic\gr-indicator-online@3x.png RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-b467400c8f8e4097\content\textures\TerrainTools\mtrl_brick_2022.png RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-b467400c8f8e4097\ExtraContent\LuaPackages\AppTempCommon\LuaApp\Thunks\ApiFetchUsersThumbnail.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-b467400c8f8e4097\ExtraContent\LuaPackages\Packages\_Index\Dash\Dash\compose.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-b467400c8f8e4097\ExtraContent\LuaPackages\Packages\_Index\Shared-07417f27-17.0.1-rc.17\lock.toml RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-b467400c8f8e4097\ExtraContent\LuaPackages\Packages\_Index\SocialLibraries\SocialLibraries\__tests__\UnitTestHelpers\mountStyledFrame.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-b467400c8f8e4097\ExtraContent\LuaPackages\Packages\_Index\UIBlox\UIBlox\Core\Style\Validator\validateSelectionCursorInfo.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-b467400c8f8e4097\content\textures\Debugger\Breakpoints\invalid_logpoint@1x.png RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-b467400c8f8e4097\ExtraContent\LuaPackages\Packages\_Index\DomTestingLibrary\DomTestingLibrary\__tests__\config.spec.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-b467400c8f8e4097\ExtraContent\LuaPackages\Packages\_Index\JestUtil-edcba0e9-3.2.1\JestUtil\globsToMatcher.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-b467400c8f8e4097\ExtraContent\LuaPackages\Packages\_Index\llama\llama\Dictionary\every.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-b467400c8f8e4097\ExtraContent\LuaPackages\Packages\_Index\ReactReconciler-9c8468d8-8a7220fd\ReactReconciler\ReactFiberComponentStack.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-b467400c8f8e4097\ExtraContent\LuaPackages\Packages\_Index\UIBlox\UIBlox\App\ImageSet\ImageAtlas\img_set_2x_17.png RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-b467400c8f8e4097\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\MessageBus\MessageBus\.robloxrc RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-b467400c8f8e4097\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\ProfileQRCode\ProfileQRCode\Components\ProfileQRCodeTopBar\ProfileQRCodeTopBar.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-b467400c8f8e4097\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\QRCodeDisplay\Dev\SocialTestHelpers.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-b467400c8f8e4097\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\SharedFlags\SharedFlags\GetFFlagEnableUnifiedWebViews.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-b467400c8f8e4097\ExtraContent\LuaPackages\Packages\_Index\LuauPolyfill-2fca3173-0.3.4\LuauPolyfill\Number\.robloxrc RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-b467400c8f8e4097\ExtraContent\LuaPackages\Packages\_Index\ReactReconciler-a406e214-4230f473\LuauPolyfill.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-b467400c8f8e4097\ExtraContent\LuaPackages\Packages\_Index\RoduxFriends-24c5c11f-f6df649b\RoduxFriends\Selectors\init.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-b467400c8f8e4097\ExtraContent\LuaPackages\Packages\_Index\Shared-a406e214-4230f473\Shared\init.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-b467400c8f8e4097\ExtraContent\LuaPackages\Packages\_Index\SocialLibraries\SocialLibraries\Analytics\Navigation\BtnValues.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-b467400c8f8e4097\ExtraContent\LuaPackages\Packages\_Index\UIBlox\UIBlox\Core\Config\Config.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-b467400c8f8e4097\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\FriendsLanding\FriendsLanding\Enums\LocalizedKeys.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-b467400c8f8e4097\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\UserSearchTestSuite\UserSearchTestSuite\jest.config.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-b467400c8f8e4097\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\VirtualEvents\VirtualEvents\Components\SelectableTextLabel.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-b467400c8f8e4097\content\textures\AnimationEditor\button_control_lastframe.png RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-b467400c8f8e4097\ExtraContent\LuaPackages\Packages\_Index\UIBlox\UIBlox\App\Style\Fonts\init.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-b467400c8f8e4097\content\textures\LayeredClothingEditor\Default_Preview_Clothing.png RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-b467400c8f8e4097\ExtraContent\LuaPackages\Packages\_Index\RoduxFriends-aa874f8b-86a611f7\t.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-b467400c8f8e4097\ExtraContent\LuaPackages\Packages\_Index\TestUtils-edcba0e9-2.4.1\lock.toml RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-b467400c8f8e4097\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\SetAlias\SetAlias\Components\SetAliasModal\SetAliasModalContainer.test.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-b467400c8f8e4097\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\VirtualEvents\VirtualEvents\Hooks\useExperienceDetails.test.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-b467400c8f8e4097\content\textures\TerrainTools\icon_shape_cube.png RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-b467400c8f8e4097\ExtraContent\LuaPackages\Packages\_Index\VirtualizedList\VirtualizedList\Lists\ViewabilityHelper.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-b467400c8f8e4097\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\RoactUtils\RoactUtils\Hooks\useProperty.spec.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-b467400c8f8e4097\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\VirtualEvents\VirtualEvents\Components\EventsPage.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-b467400c8f8e4097\content\textures\AvatarToolsShared\RoundedBorderLeft.png RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-b467400c8f8e4097\ExtraContent\LuaPackages\Packages\_Index\DomTestingLibrary\DomTestingLibrary\config-default-ignore.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-b467400c8f8e4097\ExtraContent\LuaPackages\Packages\_Index\ExperienceChat-09990ed6-a147b962\ExperienceChat\mountClientApp\helpers\setUpConfigurationObjects.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-b467400c8f8e4097\ExtraContent\LuaPackages\Packages\_Index\ExperienceChat-31a10f32-ced4713c\ExperienceChat\listenToDispatch.spec.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-b467400c8f8e4097\ExtraContent\LuaPackages\Packages\_Index\ExperienceChat-31a10f32-ced4713c\ExperienceChat\Actions\ChatPrivacySettingsReceived.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-b467400c8f8e4097\ExtraContent\LuaPackages\Packages\_Index\GraphQL\GraphQL\execution\__tests__\lists.spec.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-b467400c8f8e4097\ExtraContent\LuaPackages\Packages\_Index\GraphQL\GraphQL\__testUtils__\__tests__\inspectStr.spec.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-b467400c8f8e4097\ExtraContent\LuaPackages\Packages\_Index\NetworkingAccountInformation\lock.toml RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-b467400c8f8e4097\ExtraContent\LuaPackages\Packages\_Index\PremiumUpsellDeps\PremiumUpsellDeps\init.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-b467400c8f8e4097\ExtraContent\LuaPackages\Packages\_Index\roblox_lua-roact-policy-provider\lua-roact-policy-provider\connect.spec.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-b467400c8f8e4097\ExtraContent\LuaPackages\Packages\_Index\roblox_rodux\rodux\Signal.spec.lua RobloxPlayerLauncher.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates system info in registry 2 TTPs 9 IoCs
Processes:
chrome.exechrome.exechrome.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Processes:
iexplore.exeRobloxPlayerLauncher.exeIEXPLORE.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c063481ae63fd901 iexplore.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{6FA4ADCA-C29D-4020-A2FE-B365E8426431} RobloxPlayerLauncher.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{6FA4ADCA-C29D-4020-A2FE-B365E8426431}\Policy = "3" RobloxPlayerLauncher.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0" RobloxPlayerLauncher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8FC8C625-8F4D-4706-9CE0-BA51441D6BAE}\AppName = "RobloxPlayerBeta.exe" RobloxPlayerLauncher.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8FC8C625-8F4D-4706-9CE0-BA51441D6BAE}\Policy = "3" RobloxPlayerLauncher.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0" RobloxPlayerLauncher.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "372908267" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31014886" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c00000002000000030000000083ffff0083ffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{6FA4ADCA-C29D-4020-A2FE-B365E8426431}\AppPath = "C:\\Program Files (x86)\\Roblox\\Versions\\version-b467400c8f8e4097\\" RobloxPlayerLauncher.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{6FA4ADCA-C29D-4020-A2FE-B365E8426431}\AppName = "RobloxPlayerLauncher.exe" RobloxPlayerLauncher.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0" RobloxPlayerLauncher.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "406335553" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000634fcc717ecc4e408e5594f518f511c500000000020000000000106600000001000020000000b7c330fd6627e2bd066e4aeb7bea57a620705f78c0133ca47a33b3dd98387ea0000000000e800000000200002000000050b57e9bee887b4315ee15e7fe35767d60459db3dfa1e7d6adb338a0291cffe8200000005787f69d6638ff7c4f1979b8ef16f39452ce990a9e16342d783eea13579c31ef4000000092b13ef3f7ff552ea37cbe8dcac98a2da8f245c0b6f59bfcc9bf9324d933ec2d3c26e8545469872bb3ab52340475833dad8f01b50981ac14cae3259aa4779c16 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000634fcc717ecc4e408e5594f518f511c5000000000200000000001066000000010000200000000fd6f9aae0f4488839ace0361d9e1ea1215a722f146ed73d3b7977664b65208b000000000e8000000002000020000000871410fee45439397d41d29082481a1038cad5a44559a2e10da1d5542a5a03c12000000067e0a1b0aa771f2d3963998640af8b16dd6c294df3163802efa7900010a126dd400000000299ee3d2ef0cb12e52b34c17fbd4bbf652f36fd8fed52f7c8c7de17b706c55950cb031ec60b12281f0c8f5cb411a2d80561be5d9fd08ff1c48d4ce23c1c3f2b iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31014886" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox RobloxPlayerLauncher.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player RobloxPlayerLauncher.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8FC8C625-8F4D-4706-9CE0-BA51441D6BAE}\AppPath = "C:\\Program Files (x86)\\Roblox\\Versions\\version-b467400c8f8e4097\\" RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player RobloxPlayerLauncher.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{411C9E20-ABD9-11ED-AECB-F6DE28FD18F9} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "372908267" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31014886" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0f02a1ae63fd901 iexplore.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8FC8C625-8F4D-4706-9CE0-BA51441D6BAE} RobloxPlayerLauncher.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0" RobloxPlayerLauncher.exe -
Modifies registry class 36 IoCs
Processes:
RobloxPlayerLauncher.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\roblox-player\shell\open\command RobloxPlayerLauncher.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\roblox-player\shell\open RobloxPlayerLauncher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\ = "URL: Roblox Protocol" RobloxPlayerLauncher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\URL Protocol RobloxPlayerLauncher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-b467400c8f8e4097\\RobloxPlayerLauncher.exe\" %1" RobloxPlayerLauncher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-b467400c8f8e4097\\RobloxPlayerLauncher.exe\" %1" RobloxPlayerLauncher.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\roblox-player\DefaultIcon RobloxPlayerLauncher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\URL Protocol RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell RobloxPlayerLauncher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\URL Protocol RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell RobloxPlayerLauncher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-b467400c8f8e4097\\RobloxPlayerLauncher.exe" RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command RobloxPlayerLauncher.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\roblox-player\URL Protocol RobloxPlayerLauncher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\RobloxStudioLauncherBeta.exe\" %1" RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox RobloxPlayerLauncher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\ = "URL: Roblox Protocol" RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command RobloxPlayerLauncher.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\roblox-player\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-b467400c8f8e4097\\RobloxPlayerLauncher.exe\" %1" RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon RobloxPlayerLauncher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\RobloxStudioLauncherBeta.exe" RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open RobloxPlayerLauncher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\ = "URL: Roblox Protocol" RobloxPlayerLauncher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-b467400c8f8e4097\\RobloxPlayerLauncher.exe" RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell RobloxPlayerLauncher.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\roblox-player RobloxPlayerLauncher.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\roblox-player\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-b467400c8f8e4097\\RobloxPlayerLauncher.exe" RobloxPlayerLauncher.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\roblox-player\shell RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open RobloxPlayerLauncher.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\roblox-player\ = "URL: Roblox Protocol" RobloxPlayerLauncher.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
chrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exeCefSharp.BrowserSubprocess.exeKrnlUI.exeCefSharp.BrowserSubprocess.exeCefSharp.BrowserSubprocess.exechrome.exeCefSharp.BrowserSubprocess.exechrome.exeCefSharp.BrowserSubprocess.exechrome.exechrome.exechrome.exeRobloxPlayerLauncher.exechrome.exechrome.exechrome.exechrome.exepid process 4576 chrome.exe 4576 chrome.exe 4148 chrome.exe 4148 chrome.exe 1192 chrome.exe 1192 chrome.exe 5088 chrome.exe 5088 chrome.exe 4472 chrome.exe 4472 chrome.exe 4308 chrome.exe 4308 chrome.exe 2404 chrome.exe 2404 chrome.exe 1580 CefSharp.BrowserSubprocess.exe 1580 CefSharp.BrowserSubprocess.exe 3616 KrnlUI.exe 3616 KrnlUI.exe 3464 CefSharp.BrowserSubprocess.exe 3464 CefSharp.BrowserSubprocess.exe 1484 CefSharp.BrowserSubprocess.exe 1484 CefSharp.BrowserSubprocess.exe 4936 chrome.exe 4936 chrome.exe 1748 CefSharp.BrowserSubprocess.exe 1748 CefSharp.BrowserSubprocess.exe 3404 chrome.exe 3404 chrome.exe 3404 chrome.exe 3404 chrome.exe 4164 CefSharp.BrowserSubprocess.exe 4164 CefSharp.BrowserSubprocess.exe 3616 KrnlUI.exe 3616 KrnlUI.exe 2424 chrome.exe 2424 chrome.exe 4816 chrome.exe 4816 chrome.exe 2736 chrome.exe 2736 chrome.exe 2272 RobloxPlayerLauncher.exe 2272 RobloxPlayerLauncher.exe 1652 chrome.exe 1652 chrome.exe 4248 chrome.exe 4248 chrome.exe 2936 chrome.exe 2936 chrome.exe 2364 chrome.exe 2364 chrome.exe 2272 RobloxPlayerLauncher.exe 2272 RobloxPlayerLauncher.exe 2272 RobloxPlayerLauncher.exe 2272 RobloxPlayerLauncher.exe 2272 RobloxPlayerLauncher.exe 2272 RobloxPlayerLauncher.exe 2272 RobloxPlayerLauncher.exe 2272 RobloxPlayerLauncher.exe 2272 RobloxPlayerLauncher.exe 2272 RobloxPlayerLauncher.exe 2272 RobloxPlayerLauncher.exe 2272 RobloxPlayerLauncher.exe 2272 RobloxPlayerLauncher.exe 2272 RobloxPlayerLauncher.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 38 IoCs
Processes:
chrome.exechrome.exechrome.exepid process 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4248 chrome.exe 4248 chrome.exe 4248 chrome.exe 4248 chrome.exe 4880 chrome.exe 4880 chrome.exe 4880 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
krnl_beta.exe7za.exe7za.exeCefSharp.BrowserSubprocess.exeKrnlUI.exeCefSharp.BrowserSubprocess.exeCefSharp.BrowserSubprocess.exeCefSharp.BrowserSubprocess.exedescription pid process Token: SeDebugPrivilege 1960 krnl_beta.exe Token: SeRestorePrivilege 2180 7za.exe Token: 35 2180 7za.exe Token: SeSecurityPrivilege 2180 7za.exe Token: SeSecurityPrivilege 2180 7za.exe Token: SeRestorePrivilege 768 7za.exe Token: 35 768 7za.exe Token: SeSecurityPrivilege 768 7za.exe Token: SeSecurityPrivilege 768 7za.exe Token: SeDebugPrivilege 1580 CefSharp.BrowserSubprocess.exe Token: SeDebugPrivilege 3616 KrnlUI.exe Token: SeShutdownPrivilege 3616 KrnlUI.exe Token: SeCreatePagefilePrivilege 3616 KrnlUI.exe Token: SeDebugPrivilege 3464 CefSharp.BrowserSubprocess.exe Token: SeDebugPrivilege 1484 CefSharp.BrowserSubprocess.exe Token: SeShutdownPrivilege 3616 KrnlUI.exe Token: SeCreatePagefilePrivilege 3616 KrnlUI.exe Token: SeDebugPrivilege 1748 CefSharp.BrowserSubprocess.exe Token: SeShutdownPrivilege 3616 KrnlUI.exe Token: SeCreatePagefilePrivilege 3616 KrnlUI.exe Token: SeShutdownPrivilege 3616 KrnlUI.exe Token: SeCreatePagefilePrivilege 3616 KrnlUI.exe Token: SeShutdownPrivilege 3616 KrnlUI.exe Token: SeCreatePagefilePrivilege 3616 KrnlUI.exe Token: SeShutdownPrivilege 3616 KrnlUI.exe Token: SeCreatePagefilePrivilege 3616 KrnlUI.exe Token: SeShutdownPrivilege 3616 KrnlUI.exe Token: SeCreatePagefilePrivilege 3616 KrnlUI.exe Token: SeShutdownPrivilege 3616 KrnlUI.exe Token: SeCreatePagefilePrivilege 3616 KrnlUI.exe Token: SeShutdownPrivilege 3616 KrnlUI.exe Token: SeCreatePagefilePrivilege 3616 KrnlUI.exe Token: SeShutdownPrivilege 3616 KrnlUI.exe Token: SeCreatePagefilePrivilege 3616 KrnlUI.exe Token: SeShutdownPrivilege 3616 KrnlUI.exe Token: SeCreatePagefilePrivilege 3616 KrnlUI.exe Token: SeShutdownPrivilege 3616 KrnlUI.exe Token: SeCreatePagefilePrivilege 3616 KrnlUI.exe Token: SeShutdownPrivilege 3616 KrnlUI.exe Token: SeCreatePagefilePrivilege 3616 KrnlUI.exe Token: SeShutdownPrivilege 3616 KrnlUI.exe Token: SeCreatePagefilePrivilege 3616 KrnlUI.exe Token: SeShutdownPrivilege 3616 KrnlUI.exe Token: SeCreatePagefilePrivilege 3616 KrnlUI.exe Token: SeShutdownPrivilege 3616 KrnlUI.exe Token: SeCreatePagefilePrivilege 3616 KrnlUI.exe Token: SeShutdownPrivilege 3616 KrnlUI.exe Token: SeCreatePagefilePrivilege 3616 KrnlUI.exe Token: SeShutdownPrivilege 3616 KrnlUI.exe Token: SeCreatePagefilePrivilege 3616 KrnlUI.exe Token: SeShutdownPrivilege 3616 KrnlUI.exe Token: SeCreatePagefilePrivilege 3616 KrnlUI.exe Token: SeShutdownPrivilege 3616 KrnlUI.exe Token: SeCreatePagefilePrivilege 3616 KrnlUI.exe Token: SeShutdownPrivilege 3616 KrnlUI.exe Token: SeCreatePagefilePrivilege 3616 KrnlUI.exe Token: SeShutdownPrivilege 3616 KrnlUI.exe Token: SeCreatePagefilePrivilege 3616 KrnlUI.exe Token: SeShutdownPrivilege 3616 KrnlUI.exe Token: SeCreatePagefilePrivilege 3616 KrnlUI.exe Token: SeShutdownPrivilege 3616 KrnlUI.exe Token: SeCreatePagefilePrivilege 3616 KrnlUI.exe Token: SeShutdownPrivilege 3616 KrnlUI.exe Token: SeCreatePagefilePrivilege 3616 KrnlUI.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
iexplore.exechrome.exeKrnlUI.exechrome.exepid process 4924 iexplore.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 3616 KrnlUI.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4248 chrome.exe 4248 chrome.exe 4248 chrome.exe 4248 chrome.exe 4248 chrome.exe 4248 chrome.exe 4248 chrome.exe 4248 chrome.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
chrome.exechrome.exechrome.exepid process 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4148 chrome.exe 4248 chrome.exe 4248 chrome.exe 4248 chrome.exe 4248 chrome.exe 4248 chrome.exe 4248 chrome.exe 4248 chrome.exe 4248 chrome.exe 4248 chrome.exe 4248 chrome.exe 4248 chrome.exe 4248 chrome.exe 4248 chrome.exe 4248 chrome.exe 4248 chrome.exe 4248 chrome.exe 4248 chrome.exe 4248 chrome.exe 4248 chrome.exe 4248 chrome.exe 4248 chrome.exe 4248 chrome.exe 4248 chrome.exe 4248 chrome.exe 4880 chrome.exe 4880 chrome.exe 4880 chrome.exe 4880 chrome.exe 4880 chrome.exe 4880 chrome.exe 4880 chrome.exe 4880 chrome.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 4924 iexplore.exe 4924 iexplore.exe 1032 IEXPLORE.EXE 1032 IEXPLORE.EXE 1032 IEXPLORE.EXE 1032 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
iexplore.exechrome.exedescription pid process target process PID 4924 wrote to memory of 1032 4924 iexplore.exe IEXPLORE.EXE PID 4924 wrote to memory of 1032 4924 iexplore.exe IEXPLORE.EXE PID 4924 wrote to memory of 1032 4924 iexplore.exe IEXPLORE.EXE PID 4148 wrote to memory of 4760 4148 chrome.exe chrome.exe PID 4148 wrote to memory of 4760 4148 chrome.exe chrome.exe PID 4148 wrote to memory of 3952 4148 chrome.exe chrome.exe PID 4148 wrote to memory of 3952 4148 chrome.exe chrome.exe PID 4148 wrote to memory of 3952 4148 chrome.exe chrome.exe PID 4148 wrote to memory of 3952 4148 chrome.exe chrome.exe PID 4148 wrote to memory of 3952 4148 chrome.exe chrome.exe PID 4148 wrote to memory of 3952 4148 chrome.exe chrome.exe PID 4148 wrote to memory of 3952 4148 chrome.exe chrome.exe PID 4148 wrote to memory of 3952 4148 chrome.exe chrome.exe PID 4148 wrote to memory of 3952 4148 chrome.exe chrome.exe PID 4148 wrote to memory of 3952 4148 chrome.exe chrome.exe PID 4148 wrote to memory of 3952 4148 chrome.exe chrome.exe PID 4148 wrote to memory of 3952 4148 chrome.exe chrome.exe PID 4148 wrote to memory of 3952 4148 chrome.exe chrome.exe PID 4148 wrote to memory of 3952 4148 chrome.exe chrome.exe PID 4148 wrote to memory of 3952 4148 chrome.exe chrome.exe PID 4148 wrote to memory of 3952 4148 chrome.exe chrome.exe PID 4148 wrote to memory of 3952 4148 chrome.exe chrome.exe PID 4148 wrote to memory of 3952 4148 chrome.exe chrome.exe PID 4148 wrote to memory of 3952 4148 chrome.exe chrome.exe PID 4148 wrote to memory of 3952 4148 chrome.exe chrome.exe PID 4148 wrote to memory of 3952 4148 chrome.exe chrome.exe PID 4148 wrote to memory of 3952 4148 chrome.exe chrome.exe PID 4148 wrote to memory of 3952 4148 chrome.exe chrome.exe PID 4148 wrote to memory of 3952 4148 chrome.exe chrome.exe PID 4148 wrote to memory of 3952 4148 chrome.exe chrome.exe PID 4148 wrote to memory of 3952 4148 chrome.exe chrome.exe PID 4148 wrote to memory of 3952 4148 chrome.exe chrome.exe PID 4148 wrote to memory of 3952 4148 chrome.exe chrome.exe PID 4148 wrote to memory of 3952 4148 chrome.exe chrome.exe PID 4148 wrote to memory of 3952 4148 chrome.exe chrome.exe PID 4148 wrote to memory of 3952 4148 chrome.exe chrome.exe PID 4148 wrote to memory of 3952 4148 chrome.exe chrome.exe PID 4148 wrote to memory of 3952 4148 chrome.exe chrome.exe PID 4148 wrote to memory of 3952 4148 chrome.exe chrome.exe PID 4148 wrote to memory of 3952 4148 chrome.exe chrome.exe PID 4148 wrote to memory of 3952 4148 chrome.exe chrome.exe PID 4148 wrote to memory of 3952 4148 chrome.exe chrome.exe PID 4148 wrote to memory of 3952 4148 chrome.exe chrome.exe PID 4148 wrote to memory of 3952 4148 chrome.exe chrome.exe PID 4148 wrote to memory of 3952 4148 chrome.exe chrome.exe PID 4148 wrote to memory of 4576 4148 chrome.exe chrome.exe PID 4148 wrote to memory of 4576 4148 chrome.exe chrome.exe PID 4148 wrote to memory of 2304 4148 chrome.exe chrome.exe PID 4148 wrote to memory of 2304 4148 chrome.exe chrome.exe PID 4148 wrote to memory of 2304 4148 chrome.exe chrome.exe PID 4148 wrote to memory of 2304 4148 chrome.exe chrome.exe PID 4148 wrote to memory of 2304 4148 chrome.exe chrome.exe PID 4148 wrote to memory of 2304 4148 chrome.exe chrome.exe PID 4148 wrote to memory of 2304 4148 chrome.exe chrome.exe PID 4148 wrote to memory of 2304 4148 chrome.exe chrome.exe PID 4148 wrote to memory of 2304 4148 chrome.exe chrome.exe PID 4148 wrote to memory of 2304 4148 chrome.exe chrome.exe PID 4148 wrote to memory of 2304 4148 chrome.exe chrome.exe PID 4148 wrote to memory of 2304 4148 chrome.exe chrome.exe PID 4148 wrote to memory of 2304 4148 chrome.exe chrome.exe PID 4148 wrote to memory of 2304 4148 chrome.exe chrome.exe PID 4148 wrote to memory of 2304 4148 chrome.exe chrome.exe PID 4148 wrote to memory of 2304 4148 chrome.exe chrome.exe PID 4148 wrote to memory of 2304 4148 chrome.exe chrome.exe
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://krnl.place/1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4924 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x100,0x104,0x108,0xd8,0x10c,0x7ff8ec044f50,0x7ff8ec044f60,0x7ff8ec044f702⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1632,3316330169999714248,4909083564017342167,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1644 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1632,3316330169999714248,4909083564017342167,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2024 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1632,3316330169999714248,4909083564017342167,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2312 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,3316330169999714248,4909083564017342167,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2964 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,3316330169999714248,4909083564017342167,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3148 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,3316330169999714248,4909083564017342167,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3732 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,3316330169999714248,4909083564017342167,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4392 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,3316330169999714248,4909083564017342167,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4388 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,3316330169999714248,4909083564017342167,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4656 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,3316330169999714248,4909083564017342167,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,3316330169999714248,4909083564017342167,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3020 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,3316330169999714248,4909083564017342167,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5192 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,3316330169999714248,4909083564017342167,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4480 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,3316330169999714248,4909083564017342167,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4492 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,3316330169999714248,4909083564017342167,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4776 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,3316330169999714248,4909083564017342167,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4640 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,3316330169999714248,4909083564017342167,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4800 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,3316330169999714248,4909083564017342167,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1632,3316330169999714248,4909083564017342167,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4612 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1632,3316330169999714248,4909083564017342167,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5600 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1632,3316330169999714248,4909083564017342167,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5820 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1632,3316330169999714248,4909083564017342167,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4612 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1632,3316330169999714248,4909083564017342167,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5884 /prefetch:82⤵
-
C:\Users\Admin\Downloads\krnl_beta.exe"C:\Users\Admin\Downloads\krnl_beta.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\Krnl\Data\7za.exe"C:\Users\Admin\AppData\Roaming\Krnl\Data\7za.exe" x "C:\Users\Admin\AppData\Roaming\Krnl\krnl.7z" -o"C:\Users\Admin\AppData\Roaming\Krnl" -aoa -bsp13⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\Krnl\Data\7za.exe"C:\Users\Admin\AppData\Roaming\Krnl\Data\7za.exe" x "C:\Users\Admin\AppData\Roaming\Krnl\Data\Community.7z" -o"C:\Users\Admin\AppData\Roaming\Krnl\Community" -aoa -bsp13⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\Krnl\KrnlUI.exe"C:\Users\Admin\AppData\Roaming\Krnl\KrnlUI.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Roaming\Krnl\bin\CefSharp.BrowserSubprocess.exe"C:\Users\Admin\AppData\Roaming\Krnl\bin\CefSharp.BrowserSubprocess.exe" --type=gpu-process --no-sandbox --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --cefsharpexitsub --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --log-file="C:\Users\Admin\AppData\Roaming\Krnl\debug.log" --mojo-platform-channel-handle=2240 --field-trial-handle=2264,i,17929874529614349769,14721846158356404758,131072 --disable-features=CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:2 --host-process-id=36164⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\Krnl\bin\CefSharp.BrowserSubprocess.exe"C:\Users\Admin\AppData\Roaming\Krnl\bin\CefSharp.BrowserSubprocess.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --cefsharpexitsub --log-file="C:\Users\Admin\AppData\Roaming\Krnl\debug.log" --mojo-platform-channel-handle=2720 --field-trial-handle=2264,i,17929874529614349769,14721846158356404758,131072 --disable-features=CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 --host-process-id=36164⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\Krnl\bin\CefSharp.BrowserSubprocess.exe"C:\Users\Admin\AppData\Roaming\Krnl\bin\CefSharp.BrowserSubprocess.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --cefsharpexitsub --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Krnl\debug.log" --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=3200 --field-trial-handle=2264,i,17929874529614349769,14721846158356404758,131072 --disable-features=CalculateNativeWinOcclusion,WinUseBrowserSpellChecker --host-process-id=3616 /prefetch:14⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\Krnl\bin\CefSharp.BrowserSubprocess.exe"C:\Users\Admin\AppData\Roaming\Krnl\bin\CefSharp.BrowserSubprocess.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --cefsharpexitsub --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Krnl\debug.log" --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --mojo-platform-channel-handle=3208 --field-trial-handle=2264,i,17929874529614349769,14721846158356404758,131072 --disable-features=CalculateNativeWinOcclusion,WinUseBrowserSpellChecker --host-process-id=3616 /prefetch:14⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\Krnl\bin\CefSharp.BrowserSubprocess.exe"C:\Users\Admin\AppData\Roaming\Krnl\bin\CefSharp.BrowserSubprocess.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --no-sandbox --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --cefsharpexitsub --log-file="C:\Users\Admin\AppData\Roaming\Krnl\debug.log" --mojo-platform-channel-handle=2192 --field-trial-handle=2264,i,17929874529614349769,14721846158356404758,131072 --disable-features=CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 --host-process-id=36164⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,3316330169999714248,4909083564017342167,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4804 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,3316330169999714248,4909083564017342167,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4636 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,3316330169999714248,4909083564017342167,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3712 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,3316330169999714248,4909083564017342167,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2720 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,3316330169999714248,4909083564017342167,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2564 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1632,3316330169999714248,4909083564017342167,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1112 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,3316330169999714248,4909083564017342167,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4752 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,3316330169999714248,4909083564017342167,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1572 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,3316330169999714248,4909083564017342167,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2100 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,3316330169999714248,4909083564017342167,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,3316330169999714248,4909083564017342167,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3856 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,3316330169999714248,4909083564017342167,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6064 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,3316330169999714248,4909083564017342167,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4636 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,3316330169999714248,4909083564017342167,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4436 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,3316330169999714248,4909083564017342167,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4480 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,3316330169999714248,4909083564017342167,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6040 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,3316330169999714248,4909083564017342167,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6248 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,3316330169999714248,4909083564017342167,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6284 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,3316330169999714248,4909083564017342167,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6272 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,3316330169999714248,4909083564017342167,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6260 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,3316330169999714248,4909083564017342167,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6308 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,3316330169999714248,4909083564017342167,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6628 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,3316330169999714248,4909083564017342167,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6384 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,3316330169999714248,4909083564017342167,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2624 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,3316330169999714248,4909083564017342167,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6324 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,3316330169999714248,4909083564017342167,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6404 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,3316330169999714248,4909083564017342167,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6420 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,3316330169999714248,4909083564017342167,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3240 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,3316330169999714248,4909083564017342167,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6580 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,3316330169999714248,4909083564017342167,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6288 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,3316330169999714248,4909083564017342167,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6364 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,3316330169999714248,4909083564017342167,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5320 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,3316330169999714248,4909083564017342167,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6432 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,3316330169999714248,4909083564017342167,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,3316330169999714248,4909083564017342167,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4556 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,3316330169999714248,4909083564017342167,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,3316330169999714248,4909083564017342167,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=61 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6044 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,3316330169999714248,4909083564017342167,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=62 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6528 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,3316330169999714248,4909083564017342167,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=63 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6812 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,3316330169999714248,4909083564017342167,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=64 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,3316330169999714248,4909083564017342167,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=65 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2764 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,3316330169999714248,4909083564017342167,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=66 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6176 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,3316330169999714248,4909083564017342167,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=67 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2916 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,3316330169999714248,4909083564017342167,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=68 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6808 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,3316330169999714248,4909083564017342167,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=69 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6736 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,3316330169999714248,4909083564017342167,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=70 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4344 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,3316330169999714248,4909083564017342167,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=71 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6460 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,3316330169999714248,4909083564017342167,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=73 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,3316330169999714248,4909083564017342167,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=72 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,3316330169999714248,4909083564017342167,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4420 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,3316330169999714248,4909083564017342167,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6916 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,3316330169999714248,4909083564017342167,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1588 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,3316330169999714248,4909083564017342167,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6492 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,3316330169999714248,4909083564017342167,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5424 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,3316330169999714248,4909083564017342167,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1576 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,3316330169999714248,4909083564017342167,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6804 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,3316330169999714248,4909083564017342167,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6032 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,3316330169999714248,4909083564017342167,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=82 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3712 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,3316330169999714248,4909083564017342167,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=83 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3852 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,3316330169999714248,4909083564017342167,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=84 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3732 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,3316330169999714248,4909083564017342167,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=85 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6940 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,3316330169999714248,4909083564017342167,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=86 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6900 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,3316330169999714248,4909083564017342167,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5596 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,3316330169999714248,4909083564017342167,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6676 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,3316330169999714248,4909083564017342167,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2700 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,3316330169999714248,4909083564017342167,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=90 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6240 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1632,3316330169999714248,4909083564017342167,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2716 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1632,3316330169999714248,4909083564017342167,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5596 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1632,3316330169999714248,4909083564017342167,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6740 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1632,3316330169999714248,4909083564017342167,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6340 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1632,3316330169999714248,4909083564017342167,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6084 /prefetch:82⤵
-
C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe"C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\Downloads\RobloxPlayerLauncher.exeC:\Users\Admin\Downloads\RobloxPlayerLauncher.exe --crashpad --no-rate-limit --database=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --metrics-dir=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --url=https://upload.crashes.rbxinfra.com/post --annotation=RobloxChannel=production --annotation=RobloxGitHash=c95ea2540b0643ea2f00709f2b1f054489a0526a --annotation=UploadAttachmentKiloByteLimit=100 --annotation=UploadPercentage=100 --annotation=format=minidump --annotation=token=a2440b0bfdada85f34d79b43839f2b49ea6bba474bd7d126e844bc119271a1c3 --initial-client-data=0x798,0x79c,0x7a0,0x6b8,0x7c0,0x462368,0x462378,0x4623883⤵
- Executes dropped EXE
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,3316330169999714248,4909083564017342167,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2652 /prefetch:82⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8ec044f50,0x7ff8ec044f60,0x7ff8ec044f702⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8ec044f50,0x7ff8ec044f60,0x7ff8ec044f702⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1624,2731301032935554679,14547711496476103334,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1656 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1624,2731301032935554679,14547711496476103334,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1840 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1624,2731301032935554679,14547711496476103334,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2200 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,2731301032935554679,14547711496476103334,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2752 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,2731301032935554679,14547711496476103334,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2736 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,2731301032935554679,14547711496476103334,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3744 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1624,2731301032935554679,14547711496476103334,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4536 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1624,2731301032935554679,14547711496476103334,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4872 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1624,2731301032935554679,14547711496476103334,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4736 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1624,2731301032935554679,14547711496476103334,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4696 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1624,2731301032935554679,14547711496476103334,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4824 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,2731301032935554679,14547711496476103334,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4784 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1624,2731301032935554679,14547711496476103334,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5268 /prefetch:82⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x108,0x10c,0x110,0xd8,0x114,0x7ff8ec044f50,0x7ff8ec044f60,0x7ff8ec044f702⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1612,1342862424045770480,10605818835688588748,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1624 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1612,1342862424045770480,10605818835688588748,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1264 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1612,1342862424045770480,10605818835688588748,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2604 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1612,1342862424045770480,10605818835688588748,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2596 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1612,1342862424045770480,10605818835688588748,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2688 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1612,1342862424045770480,10605818835688588748,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3692 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1612,1342862424045770480,10605818835688588748,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4580 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1612,1342862424045770480,10605818835688588748,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4728 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1612,1342862424045770480,10605818835688588748,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4884 /prefetch:82⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751Filesize
717B
MD5ec8ff3b1ded0246437b1472c69dd1811
SHA1d813e874c2524e3a7da6c466c67854ad16800326
SHA256e634c2d1ed20e0638c95597adf4c9d392ebab932d3353f18af1e4421f4bb9cab
SHA512e967b804cbf2d6da30a532cbc62557d09bd236807790040c6bee5584a482dc09d724fc1d9ac0de6aa5b4e8b1fff72c8ab3206222cc2c95a91035754ac1257552
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
471B
MD53e472b0f5a701aa836fb601ca75b32f6
SHA136058caf014a2a437db05da767e8992cf44fd7ab
SHA2568b96d03923483c423948faac348c850ec54cd35621836d1612259b825f6498ea
SHA5125885c94f81236f2aedb5c30fffa128550eb5b52e609ef5ae2bc5a21b50500cc08652bdcc4eb037137ca703b7c9b18e47965d33906f8b3b7b028347681b7470fa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9F5534FD3F92393CF86B4D5118A9A6EBFilesize
503B
MD578446491607aa7d96d2f3d937096ad2c
SHA1e195398b4c2e45d6ba6e5f59e6f0a4c9516e2799
SHA256e3670d87d4c02b9c27854bc9f99db347c0956eeee7a7cf4144a771f03ae6522c
SHA51255eb99205204d12552690115e309cf3a64dd54e503cbe35f2cc090aae0e7dd09b0aea7a94b7f0cb133914099f3dd72ac546404e61a6b1c5dcfb4715eabb1b5db
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CBAE37D12775E7EDD5EF76C19ABC59A3Filesize
503B
MD5ff90a1f420939f507ef7974e428faef1
SHA19ccf425d1a7f167c8146270666b6551f42bd690f
SHA25681e3f0064718ca9c2e8484c85bb7c21b8c7a390c568dc3f171d609759ec16ed1
SHA512e1b2942d4eb30ee92cbe6deeb60e76f23bfd8c497a71fa3c6bc717a2c7a63a1b8547f6ec741eac746ba8565448d3064a855a4b0a40d05796544e66fdbd95af19
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751Filesize
192B
MD5d1efdab5bd856ef4e745b0e092a0eb0d
SHA1f09b29aad3b2c407fa60e5d9057efe56ef7a36d2
SHA256d8954c8abd64ce08dd45ad4f7466577e75e5218d7b89d3ec9e2f981b255c5fea
SHA51288a5c751e8ef167807fa546e00e3510be7bf514c0dda846c4e42d5eb7cf07e3eb788cb31961eb9b25b61e039636147027055f57a07c3ac8b260dd3290d1416ca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
434B
MD574e33289cd37bd3d7363a9547408622b
SHA155ddb6bb218895433a8e5c51e5939a788e0f5608
SHA256504b870414578cbaeda24f5bebd09342720ae674640a39e246c7580667ed897b
SHA512f63077274d453e301f93328dc39af781ea502387452c9749b1d3997fdab3891c4117c1ca05bd8129f165cb7baac733dc69ed30d3de5707ba1cbefe11e6ec31ed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9F5534FD3F92393CF86B4D5118A9A6EBFilesize
552B
MD5704bbb764228bacbda4b2c90492a26a4
SHA131f1731583b3c6034a598cc4ffa3050bd96a7c02
SHA2562b9c361a425369cbd719cc29c4a55f390be73e897f98cc6458680d8efda4fe80
SHA512c06dd24bfc9d120a8fede263606443dd2e6668031fabf170770aa8bc85492c4cfa29055c0704bdc4fc049755ce3cad5a9435826c92ce7eae435f72a5924d9513
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CBAE37D12775E7EDD5EF76C19ABC59A3Filesize
556B
MD525ac4a7651b5f402215863132122e329
SHA106721a7342d2bde9e5e640c15ddbf2ebe7a40a0d
SHA256ee955b1b6fbc8b1f03c4043b0380b3f3ad83565b823c499c52e9b46633bd2c5e
SHA5128abd5f975aa256652826332910927e5950c8dc45a46ce9d295c40405fe7cfe988b258e04df8ab8a3f4053a24cd45a21a7d8a394b39c868dc4af1a7f2a9946e74
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\CachesMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Users\Admin\AppData\Roaming\Krnl\Data\7z.NET.dllFilesize
15KB
MD5982475050787051658abd42e890a2469
SHA1d955e35355e33a9837d00e78c824f6e5792b47f3
SHA2564e193ccda4ef7ec7fc1bc12d7abba225a9af5b4612aa0b67a02324b9da8b268c
SHA512c97b40c82499759e8a11b581004252be618f967153b5a9ce425f9a385746f3a1bdc467686023f36ed11212ea23e1c6b03b4df32cc5dd2a8c4b1d4ab23541c1f6
-
C:\Users\Admin\AppData\Roaming\Krnl\Data\7z.NET.dllFilesize
15KB
MD5982475050787051658abd42e890a2469
SHA1d955e35355e33a9837d00e78c824f6e5792b47f3
SHA2564e193ccda4ef7ec7fc1bc12d7abba225a9af5b4612aa0b67a02324b9da8b268c
SHA512c97b40c82499759e8a11b581004252be618f967153b5a9ce425f9a385746f3a1bdc467686023f36ed11212ea23e1c6b03b4df32cc5dd2a8c4b1d4ab23541c1f6
-
C:\Users\Admin\AppData\Roaming\Krnl\Data\7za.exeFilesize
628KB
MD5ec79cabd55a14379e4d676bb17d9e3df
SHA115626d505da35bfdb33aea5c8f7831f616cabdba
SHA25644a55f5d9c31d0990de47b9893e0c927478930cef06fbe2d1f520a6d6cba587d
SHA51200bbb601a685cbfb3c51c1da9f3b77c2b318c79e87d88a31c0e215288101753679e1586b170ccc9c2cb0b5ce05c2090c0737a1e4a616ad1d9658392066196d47
-
C:\Users\Admin\AppData\Roaming\Krnl\Data\7za.exeFilesize
628KB
MD5ec79cabd55a14379e4d676bb17d9e3df
SHA115626d505da35bfdb33aea5c8f7831f616cabdba
SHA25644a55f5d9c31d0990de47b9893e0c927478930cef06fbe2d1f520a6d6cba587d
SHA51200bbb601a685cbfb3c51c1da9f3b77c2b318c79e87d88a31c0e215288101753679e1586b170ccc9c2cb0b5ce05c2090c0737a1e4a616ad1d9658392066196d47
-
C:\Users\Admin\AppData\Roaming\Krnl\Data\7za.exeFilesize
628KB
MD5ec79cabd55a14379e4d676bb17d9e3df
SHA115626d505da35bfdb33aea5c8f7831f616cabdba
SHA25644a55f5d9c31d0990de47b9893e0c927478930cef06fbe2d1f520a6d6cba587d
SHA51200bbb601a685cbfb3c51c1da9f3b77c2b318c79e87d88a31c0e215288101753679e1586b170ccc9c2cb0b5ce05c2090c0737a1e4a616ad1d9658392066196d47
-
C:\Users\Admin\AppData\Roaming\Krnl\Data\Community.7zFilesize
2.2MB
MD5e7e69e3bb82e50d10e17fceb8851f1e3
SHA1ac38d2c834b5ef30feb0b23272ee289779caf14c
SHA2561f70e675fd69fa7d0efe44a2a6cbade8350ebb1cb3a9a18ff824cfd680b35ddd
SHA512ba44f453d75ac413f404b89c5dfd1acbdf95aae10beb65599e7e52ecec7eb3ea82b95a6947fcda38e2cb878eb197714be3f3e3d93d5fc09e83ebb952117ded44
-
C:\Users\Admin\AppData\Roaming\Krnl\KrnlUI.exeFilesize
1.1MB
MD539ed86952a1e7926924a18802c0b75e4
SHA1e7ad2a51e62fe68b1a82b17bcde347ab38c09ca3
SHA256b84ceb86e9a8eba4d168f2cc6c9010c93779641e595f900aafe8cfef6165c126
SHA512fe7b93af9bb2621148154389e6c7e1dca54c426df88fd09eab9b33763584a4eee837995d29f7dc1550acc4643c05f03a28b5a25e7019d7a4ceb70c238ae33bad
-
C:\Users\Admin\AppData\Roaming\Krnl\KrnlUI.exeFilesize
1.1MB
MD539ed86952a1e7926924a18802c0b75e4
SHA1e7ad2a51e62fe68b1a82b17bcde347ab38c09ca3
SHA256b84ceb86e9a8eba4d168f2cc6c9010c93779641e595f900aafe8cfef6165c126
SHA512fe7b93af9bb2621148154389e6c7e1dca54c426df88fd09eab9b33763584a4eee837995d29f7dc1550acc4643c05f03a28b5a25e7019d7a4ceb70c238ae33bad
-
C:\Users\Admin\AppData\Roaming\Krnl\KrnlUI.exe.configFilesize
438B
MD5909df77c711b4133a8f8560483ec2bb3
SHA18df8505ec0a0dd670b4044c641e772f6ded485a1
SHA256c49ed8da5765f33cc854cf13ee0c33ed65d4eba6843c24d05e321e3b40f4a68c
SHA5120547bae72cd75ad753ddd95c12b7a42b8b3285a3384925cf738c4cc6835c6dd21d16a6206662c4a723fcf348da7e62db3585564782c7daad49b765b43accb28d
-
C:\Users\Admin\AppData\Roaming\Krnl\bin\CefSharp.Core.Runtime.dllFilesize
1.3MB
MD5a7fd4a62e39e518d26c93c72a2574123
SHA1d466eb6792cc8a22237d34e49b29b1fef88a9256
SHA2568145075e6bee962eb6b160cf13fa16d907be16a1155291e7016b69a5ccaeef85
SHA51296b8e9f1f40111009b4dd2c404545f1272f2ff04e888839ae9e8cda9f88ebfa47862e64d88f772616f9687aac8888bc805f79f17c205d168a9a306e3f70d5576
-
C:\Users\Admin\AppData\Roaming\Krnl\bin\CefSharp.Core.Runtime.dllFilesize
1.3MB
MD5a7fd4a62e39e518d26c93c72a2574123
SHA1d466eb6792cc8a22237d34e49b29b1fef88a9256
SHA2568145075e6bee962eb6b160cf13fa16d907be16a1155291e7016b69a5ccaeef85
SHA51296b8e9f1f40111009b4dd2c404545f1272f2ff04e888839ae9e8cda9f88ebfa47862e64d88f772616f9687aac8888bc805f79f17c205d168a9a306e3f70d5576
-
C:\Users\Admin\AppData\Roaming\Krnl\bin\CefSharp.Core.Runtime.dllFilesize
1.3MB
MD5a7fd4a62e39e518d26c93c72a2574123
SHA1d466eb6792cc8a22237d34e49b29b1fef88a9256
SHA2568145075e6bee962eb6b160cf13fa16d907be16a1155291e7016b69a5ccaeef85
SHA51296b8e9f1f40111009b4dd2c404545f1272f2ff04e888839ae9e8cda9f88ebfa47862e64d88f772616f9687aac8888bc805f79f17c205d168a9a306e3f70d5576
-
C:\Users\Admin\AppData\Roaming\Krnl\bin\CefSharp.Core.Runtime.dllFilesize
1.3MB
MD5a7fd4a62e39e518d26c93c72a2574123
SHA1d466eb6792cc8a22237d34e49b29b1fef88a9256
SHA2568145075e6bee962eb6b160cf13fa16d907be16a1155291e7016b69a5ccaeef85
SHA51296b8e9f1f40111009b4dd2c404545f1272f2ff04e888839ae9e8cda9f88ebfa47862e64d88f772616f9687aac8888bc805f79f17c205d168a9a306e3f70d5576
-
C:\Users\Admin\AppData\Roaming\Krnl\bin\CefSharp.Core.dllFilesize
36KB
MD5100f91507881f85a3b482d3e1644d037
SHA14319e1f626318997693e06c6a217fbf2acdf77b2
SHA2567f9338f537a469e71dd3c269137bc0e5a11f769edfda8a1891319c0139a1b550
SHA512993b92a1f28b1cbd37b2d7fb646ee04473eb81de02017b66e7ec2efa2a83b4ff35bee44aaa643c0ed531d42fc4638081a73b50caa530f29eff6bbeb252ea46e1
-
C:\Users\Admin\AppData\Roaming\Krnl\bin\CefSharp.Core.dllFilesize
36KB
MD5100f91507881f85a3b482d3e1644d037
SHA14319e1f626318997693e06c6a217fbf2acdf77b2
SHA2567f9338f537a469e71dd3c269137bc0e5a11f769edfda8a1891319c0139a1b550
SHA512993b92a1f28b1cbd37b2d7fb646ee04473eb81de02017b66e7ec2efa2a83b4ff35bee44aaa643c0ed531d42fc4638081a73b50caa530f29eff6bbeb252ea46e1
-
C:\Users\Admin\AppData\Roaming\Krnl\bin\CefSharp.Core.dllFilesize
36KB
MD5100f91507881f85a3b482d3e1644d037
SHA14319e1f626318997693e06c6a217fbf2acdf77b2
SHA2567f9338f537a469e71dd3c269137bc0e5a11f769edfda8a1891319c0139a1b550
SHA512993b92a1f28b1cbd37b2d7fb646ee04473eb81de02017b66e7ec2efa2a83b4ff35bee44aaa643c0ed531d42fc4638081a73b50caa530f29eff6bbeb252ea46e1
-
C:\Users\Admin\AppData\Roaming\Krnl\bin\CefSharp.Wpf.dllFilesize
100KB
MD56a9e3555a11850420e0e1d7cbaa0ada4
SHA117597a85caf29df6556fef012dd1fe5205ef2cb2
SHA256a39b72613843a4e1b40761fa83c2b7c87941e461c32d091655c42d9cbfa59fac
SHA51241d1f5c6e38a02a232f8cf3afcf44e7bc8c83ac5616849a78560a3e064e7b220d272f37507c2d5d939b1a0aff5884f3f930759d1b39d11c3cedcc0f2d962ae6d
-
C:\Users\Admin\AppData\Roaming\Krnl\bin\CefSharp.Wpf.dllFilesize
100KB
MD56a9e3555a11850420e0e1d7cbaa0ada4
SHA117597a85caf29df6556fef012dd1fe5205ef2cb2
SHA256a39b72613843a4e1b40761fa83c2b7c87941e461c32d091655c42d9cbfa59fac
SHA51241d1f5c6e38a02a232f8cf3afcf44e7bc8c83ac5616849a78560a3e064e7b220d272f37507c2d5d939b1a0aff5884f3f930759d1b39d11c3cedcc0f2d962ae6d
-
C:\Users\Admin\AppData\Roaming\Krnl\bin\CefSharp.Wpf.dllFilesize
100KB
MD56a9e3555a11850420e0e1d7cbaa0ada4
SHA117597a85caf29df6556fef012dd1fe5205ef2cb2
SHA256a39b72613843a4e1b40761fa83c2b7c87941e461c32d091655c42d9cbfa59fac
SHA51241d1f5c6e38a02a232f8cf3afcf44e7bc8c83ac5616849a78560a3e064e7b220d272f37507c2d5d939b1a0aff5884f3f930759d1b39d11c3cedcc0f2d962ae6d
-
C:\Users\Admin\AppData\Roaming\Krnl\bin\CefSharp.dllFilesize
1017KB
MD5f371f39e9346dca0bfdb7d638b44895d
SHA1742f950afc94fd6e0501f9678ba210883fd5b25c
SHA2563a7bf88d5376a46cab4d6be0169a6dc98361f9485d178c20faa162380d165327
SHA512753b400c80be841910227c5eff53dbf607b5c6fcdd05e53cfaf487529c54955bf32ea4d939927a7be1a602fc6e306c20e25850d36690b36d22948c0a7bf2d4a7
-
C:\Users\Admin\AppData\Roaming\Krnl\bin\CefSharp.dllFilesize
1017KB
MD5f371f39e9346dca0bfdb7d638b44895d
SHA1742f950afc94fd6e0501f9678ba210883fd5b25c
SHA2563a7bf88d5376a46cab4d6be0169a6dc98361f9485d178c20faa162380d165327
SHA512753b400c80be841910227c5eff53dbf607b5c6fcdd05e53cfaf487529c54955bf32ea4d939927a7be1a602fc6e306c20e25850d36690b36d22948c0a7bf2d4a7
-
C:\Users\Admin\AppData\Roaming\Krnl\bin\CefSharp.dllFilesize
1017KB
MD5f371f39e9346dca0bfdb7d638b44895d
SHA1742f950afc94fd6e0501f9678ba210883fd5b25c
SHA2563a7bf88d5376a46cab4d6be0169a6dc98361f9485d178c20faa162380d165327
SHA512753b400c80be841910227c5eff53dbf607b5c6fcdd05e53cfaf487529c54955bf32ea4d939927a7be1a602fc6e306c20e25850d36690b36d22948c0a7bf2d4a7
-
C:\Users\Admin\AppData\Roaming\Krnl\bin\chrome_elf.dllFilesize
965KB
MD51b2a029f73fe1554d9801ec7b7e1ecfe
SHA101f487f96a5528e28ca8ca75da60a58072025358
SHA256d4800601b82371914f0efc45f1200ce8bb9d57c15c52b852f9f452751af61912
SHA512a32e991cbe0681aa66535a454dbc961df4be142f9983dcc48d1bafb9be938c5abbd8cc6219b0614074ab2c51e4ce410d056fced6d6ed4cfc0048bbee9cba29b1
-
C:\Users\Admin\AppData\Roaming\Krnl\bin\chrome_elf.dllFilesize
965KB
MD51b2a029f73fe1554d9801ec7b7e1ecfe
SHA101f487f96a5528e28ca8ca75da60a58072025358
SHA256d4800601b82371914f0efc45f1200ce8bb9d57c15c52b852f9f452751af61912
SHA512a32e991cbe0681aa66535a454dbc961df4be142f9983dcc48d1bafb9be938c5abbd8cc6219b0614074ab2c51e4ce410d056fced6d6ed4cfc0048bbee9cba29b1
-
C:\Users\Admin\AppData\Roaming\Krnl\bin\icudtl.datFilesize
9.8MB
MD5d866d68e4a3eae8cdbfd5fc7a9967d20
SHA142a5033597e4be36ccfa16d19890049ba0e25a56
SHA256c61704cc9cf5797bf32301a2b3312158af3fe86eadc913d937031cf594760c2d
SHA5124cc04e708b9c3d854147b097e44ff795f956b8a714ab61ddd5434119ade768eb4da4b28938a9477e4cb0d63106cce09fd1ec86f33af1c864f4ea599f8d999b97
-
C:\Users\Admin\AppData\Roaming\Krnl\bin\libcef.dllFilesize
139.0MB
MD57bc0244dba1d340e27eaca9dd8ff08e2
SHA13b6941df7c9635bce18cb5ae9275c1c51405827c
SHA25643c16856ebf80186a248fcdcce694c33cc02307005eee6724e0fd4974f954e7e
SHA5123a9acdc1b07831708c88111bfc4ac9552e24ea1df5b6c13a0c6bf7beeebe35d8509bdb9f09c84a9b0361d4501214508fd3911a9b3d97f08ca71563dd7d744a0a
-
C:\Users\Admin\AppData\Roaming\Krnl\bin\libcef.dllFilesize
139.0MB
MD57bc0244dba1d340e27eaca9dd8ff08e2
SHA13b6941df7c9635bce18cb5ae9275c1c51405827c
SHA25643c16856ebf80186a248fcdcce694c33cc02307005eee6724e0fd4974f954e7e
SHA5123a9acdc1b07831708c88111bfc4ac9552e24ea1df5b6c13a0c6bf7beeebe35d8509bdb9f09c84a9b0361d4501214508fd3911a9b3d97f08ca71563dd7d744a0a
-
C:\Users\Admin\AppData\Roaming\Krnl\bin\locales\en-US.pakFilesize
296KB
MD599b4fdf70abc76d31e44186e09a053a6
SHA1fb4192460341de2a04127f1e7fdf5c41b12ca392
SHA25687dc8b512fdb79d381db0577961967ac2968a902f4914b6fd3bb59ef84a149fa
SHA512d84b2c0a1fb32515e45bfb922f14a7134ddf01c62ec1405f2d5c7e54a8b4993e943333e3a69905856215a51b3df64f2547128bd0094b70280bb105b4444f32da
-
C:\Users\Admin\AppData\Roaming\Krnl\krnl.7zFilesize
71.1MB
MD5cb244bb2cbed782853d39042fd705b4b
SHA1f9a69f8f2b87134579ca8c50b91a67bd596553fe
SHA256d45f3cc6274717014136b6515c250a966f86cd3ecd3dc2c66b3c4c234831e015
SHA5123d189aba28e8dd59e1e293ad8e962f38518ca11b8aa88b364e06f5ebcbc2626e9963594aa76a59971efbb5a34f6a99e23a1f090def1661abae95ebdd758bf73d
-
C:\Users\Admin\Downloads\krnl_beta.exeFilesize
1.8MB
MD53701dc535fb395d6a1fb557a3aeec5e9
SHA1ef517659229ddc6ecfc02481c3953ac9322dae35
SHA256ec6df713446a8dd5efb376fbb7b444ed7e09f5cdd98c0494999b64af2e2d5537
SHA51220dc14387138f913034bd2c265156dca1f36c128c040a99d6904fe6f1830d2f98afb3dcf0553817adb66e480be7d0fb0d7df58f0feb9b007a5a6bab648b081a2
-
C:\Users\Admin\Downloads\krnl_beta.exeFilesize
1.8MB
MD53701dc535fb395d6a1fb557a3aeec5e9
SHA1ef517659229ddc6ecfc02481c3953ac9322dae35
SHA256ec6df713446a8dd5efb376fbb7b444ed7e09f5cdd98c0494999b64af2e2d5537
SHA51220dc14387138f913034bd2c265156dca1f36c128c040a99d6904fe6f1830d2f98afb3dcf0553817adb66e480be7d0fb0d7df58f0feb9b007a5a6bab648b081a2
-
\??\pipe\crashpad_4148_BAUFYWFTKTSDMKMMMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/768-156-0x0000000000000000-mapping.dmp
-
memory/1484-197-0x0000000005811000-0x0000000005816000-memory.dmpFilesize
20KB
-
memory/1484-194-0x0000000005811000-0x0000000005816000-memory.dmpFilesize
20KB
-
memory/1484-193-0x0000000000000000-mapping.dmp
-
memory/1580-187-0x00000000000B0000-0x00000000000B8000-memory.dmpFilesize
32KB
-
memory/1580-186-0x0000000000000000-mapping.dmp
-
memory/1580-188-0x0000000004B71000-0x0000000004B76000-memory.dmpFilesize
20KB
-
memory/1748-195-0x0000000005751000-0x0000000005756000-memory.dmpFilesize
20KB
-
memory/1748-191-0x0000000000000000-mapping.dmp
-
memory/1960-141-0x0000000000000000-mapping.dmp
-
memory/1960-151-0x0000000008F40000-0x0000000008F4A000-memory.dmpFilesize
40KB
-
memory/1960-145-0x00000000087B0000-0x00000000087B8000-memory.dmpFilesize
32KB
-
memory/1960-146-0x0000000008D70000-0x0000000008DA8000-memory.dmpFilesize
224KB
-
memory/1960-147-0x0000000008D50000-0x0000000008D5E000-memory.dmpFilesize
56KB
-
memory/1960-144-0x0000000000D60000-0x0000000000F3A000-memory.dmpFilesize
1.9MB
-
memory/2180-152-0x0000000000000000-mapping.dmp
-
memory/2272-201-0x0000000000000000-mapping.dmp
-
memory/3464-189-0x0000000000000000-mapping.dmp
-
memory/3464-192-0x00000000058C1000-0x00000000058C6000-memory.dmpFilesize
20KB
-
memory/3616-171-0x0000000005BE0000-0x0000000005CE4000-memory.dmpFilesize
1.0MB
-
memory/3616-167-0x00000000054D0000-0x00000000054F0000-memory.dmpFilesize
128KB
-
memory/3616-190-0x0000000005545000-0x000000000554F000-memory.dmpFilesize
40KB
-
memory/3616-163-0x0000000000A20000-0x0000000000B3E000-memory.dmpFilesize
1.1MB
-
memory/3616-196-0x0000000005545000-0x000000000554F000-memory.dmpFilesize
40KB
-
memory/3616-160-0x0000000000000000-mapping.dmp
-
memory/3616-200-0x0000000001140000-0x000000000114A000-memory.dmpFilesize
40KB
-
memory/3616-175-0x0000000005BD0000-0x0000000005BE0000-memory.dmpFilesize
64KB
-
memory/3936-202-0x0000000000000000-mapping.dmp
-
memory/4164-198-0x0000000000000000-mapping.dmp
-
memory/4164-199-0x0000000005CD1000-0x0000000005CD6000-memory.dmpFilesize
20KB