2f0b8c5ea4e7923690e4c4424621c2f00cc40d3c62790a2389addc5ea8ba14a8

Processes:

NoEscape.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\winnt32.exe"	NoEscape.exe

UAC bypass 3 TTPs 1 IoCs
evasion trojan

Bypass User Account Control
T1088

Disabling Security Tools
T1089

Modify Registry
T1112

Processes:

NoEscape.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" NoEscape.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	NoEscape.exe

Disables RegEdit via registry modification 1 IoCs

evasion

Processes:

NoEscape.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	NoEscape.exe

Downloads MZ/PE file

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

RobloxPlayerLauncher.exeRobloxPlayerLauncher.exeRobloxPlayerBeta.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation	RobloxPlayerLauncher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation	RobloxPlayerLauncher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation	RobloxPlayerBeta.exe

Executes dropped EXE 9 IoCs

Processes:

krita-x64-5.1.5-setup.exekrita-x64-5.1.5-setup.exekrita.exekrita.exeRobloxPlayerLauncher.exeRobloxPlayerLauncher.exeRobloxPlayerLauncher.exeRobloxPlayerLauncher.exeRobloxPlayerBeta.exe

pid	process
4600	krita-x64-5.1.5-setup.exe
3408	krita-x64-5.1.5-setup.exe
2784	krita.exe
3144	krita.exe
3504	RobloxPlayerLauncher.exe
3776	RobloxPlayerLauncher.exe
3148	RobloxPlayerLauncher.exe
4684	RobloxPlayerLauncher.exe
3760	RobloxPlayerBeta.exe

Loads dropped DLL 64 IoCs

Processes:

krita-x64-5.1.5-setup.exekrita-x64-5.1.5-setup.exekrita.exekrita.exe

pid	process
4600	krita-x64-5.1.5-setup.exe
3408	krita-x64-5.1.5-setup.exe
4600	krita-x64-5.1.5-setup.exe
4600	krita-x64-5.1.5-setup.exe
3408	krita-x64-5.1.5-setup.exe
4600	krita-x64-5.1.5-setup.exe
2784	krita.exe
2784	krita.exe
2784	krita.exe
2784	krita.exe
2784	krita.exe
2784	krita.exe
2784	krita.exe
2784	krita.exe
2784	krita.exe
2784	krita.exe
2784	krita.exe
2784	krita.exe
2784	krita.exe
2784	krita.exe
2784	krita.exe
2784	krita.exe
2784	krita.exe
2784	krita.exe
2784	krita.exe
2784	krita.exe
2784	krita.exe
2784	krita.exe
2784	krita.exe
2784	krita.exe
2784	krita.exe
2784	krita.exe
2784	krita.exe
2784	krita.exe
2784	krita.exe
2784	krita.exe
2784	krita.exe
2784	krita.exe
2784	krita.exe
2784	krita.exe
2784	krita.exe
2784	krita.exe
2784	krita.exe
2784	krita.exe
2784	krita.exe
2784	krita.exe
2784	krita.exe
2784	krita.exe
2784	krita.exe
2784	krita.exe
2784	krita.exe
2784	krita.exe
2784	krita.exe
2784	krita.exe
3144	krita.exe
3144	krita.exe
3144	krita.exe
3144	krita.exe
3144	krita.exe
3144	krita.exe
3144	krita.exe
3144	krita.exe
3144	krita.exe
3144	krita.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Registers COM server for autorun 1 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Processes:

krita-x64-5.1.5-setup.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6806289-D605-4AFE-A778-BC584303DB9A}\InprocServer32\ThreadingModel = "Apartment"	krita-x64-5.1.5-setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C8E5509D-6F68-480C-8A41-DB64AECE94C6}\InprocServer32	krita-x64-5.1.5-setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C8E5509D-6F68-480C-8A41-DB64AECE94C6}\InprocServer32\ = "C:\\Program Files\\Krita (x64)\\shellex\\kritashellex64.dll"	krita-x64-5.1.5-setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C8E5509D-6F68-480C-8A41-DB64AECE94C6}\InprocServer32\ThreadingModel = "Apartment"	krita-x64-5.1.5-setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6806289-D605-4AFE-A778-BC584303DB9A}\InprocServer32	krita-x64-5.1.5-setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6806289-D605-4AFE-A778-BC584303DB9A}\InprocServer32\ = "C:\\Program Files\\Krita (x64)\\shellex\\kritashellex64.dll"	krita-x64-5.1.5-setup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

Processes:

RobloxPlayerLauncher.exeRobloxPlayerLauncher.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxPlayerLauncher.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxPlayerLauncher.exe

Drops desktop.ini file(s) 3 IoCs

Processes:

NoEscape.exesvchost.exe

description	ioc	process
File opened for modification	C:\Users\Public\Desktop\desktop.ini	NoEscape.exe
File opened for modification	C:\Users\Admin\Videos\Captures\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	NoEscape.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

Processes:

NoEscape.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\noescape.png"	NoEscape.exe

Drops file in Program Files directory 64 IoCs

Processes:

RobloxPlayerLauncher.exekrita-x64-5.1.5-setup.exe

description	ioc	process
File created	C:\Program Files (x86)\Roblox\Versions\version-b7209bbd7dd04d17\content\textures\AnimationEditor\Button_Curve_Darkmode.png	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b7209bbd7dd04d17\ExtraContent\LuaPackages\Packages\_Index\LuaChatDeps\InfiniteScroller.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b7209bbd7dd04d17\ExtraContent\LuaPackages\Packages\_Index\UIBlox\UIBlox\Core\Bar\ThreeSectionBar.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b7209bbd7dd04d17\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\SocialReducerAdaptors\SocialReducerAdaptors\convertActions.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files\Krita (x64)\lib\site-packages\PyQt5\bindings\QtCore\qpycore_qlist.sip	krita-x64-5.1.5-setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b7209bbd7dd04d17\content\textures\ui\InspectMenu\ico_isnt-wearing.png	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b7209bbd7dd04d17\ExtraContent\LuaPackages\Packages\_Index\ReactReconciler-9c8468d8-8a7220fd\ReactReconciler\ReactFiberContext.new.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b7209bbd7dd04d17\ExtraContent\LuaPackages\Packages\_Index\SocialLibraries\SocialLibraries\Components\ChatBubbleContainer.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b7209bbd7dd04d17\ExtraContent\LuaPackages\Packages\_Index\Utils-debf4142-0.2.0\Utils\get-arguments-with-directives.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b7209bbd7dd04d17\content\fonts\NotoSansBengaliUI-Regular.ttf	RobloxPlayerLauncher.exe
File created	C:\Program Files\Krita (x64)\share\krita\qmlthemes\default\icons\select-show.svg	krita-x64-5.1.5-setup.exe
File created	C:\Program Files\Krita (x64)\bin\locale\bs\LC_MESSAGES\kitemviews5_qt.qm	krita-x64-5.1.5-setup.exe
File created	C:\Program Files\Krita (x64)\share\krita\qmlthemes\default\icons\select-hide-black.svg	krita-x64-5.1.5-setup.exe
File created	C:\Program Files\Krita (x64)\share\krita\templates\texture\.source\Texture8k8bitsrgb.kra	krita-x64-5.1.5-setup.exe
File created	C:\Program Files\Krita (x64)\bin\QtQuick\Controls.2\Imagine\ToolSeparator.qml	krita-x64-5.1.5-setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b7209bbd7dd04d17\ExtraContent\LuaPackages\Packages\_Index\Expect-edcba0e9-3.2.1\Expect\extractExpectedAssertionsErrors.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b7209bbd7dd04d17\ExtraContent\LuaPackages\Packages\_Index\NetworkingFriends\NetworkingFriends\networkRequests\createGetExtendedFriendshipStatus.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b7209bbd7dd04d17\ExtraContent\LuaPackages\Workspace\Packages\Fetch.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files\Krita (x64)\bin\QtWinExtras\JumpListDestination.qml	krita-x64-5.1.5-setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b7209bbd7dd04d17\content\textures\ui\Settings\LeaveGame\playernumber_strokeStyle@3x.png	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b7209bbd7dd04d17\content\textures\AvatarImporter\fbximportlogo.png	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b7209bbd7dd04d17\ExtraContent\LuaPackages\Packages\_Index\ReactFocusNavigation\ReactFocusNavigation\useEventMap.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b7209bbd7dd04d17\ExtraContent\LuaPackages\Packages\_Index\ReactIs-a406e214-4230f473\Shared.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b7209bbd7dd04d17\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\RobloxAppLocales\RobloxAppLocales\Locales\uk-ua.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files\Krita (x64)\bin\QtQuick\Controls.2\Universal\DelayButton.qml	krita-x64-5.1.5-setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b7209bbd7dd04d17\ExtraContent\LuaPackages\Packages\_Index\RoduxFriends-e5bec545-6ef031c0\RoduxFriends\getDeepValue.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b7209bbd7dd04d17\ExtraContent\LuaPackages\Workspace\Packages\SocialModalsTestSuite.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b7209bbd7dd04d17\ExtraContent\LuaPackages\Packages\_Index\GraphQL\GraphQL\luaUtils\__tests__\deepEqual.spec.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files\Krita (x64)\share\krita\patterns\Stars_Sized.png	krita-x64-5.1.5-setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b7209bbd7dd04d17\content\textures\ui\Settings\Radial\Chat@2x.png	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b7209bbd7dd04d17\ExtraContent\LuaPackages\Packages\_Index\GraphQL\GraphQL\__tests__\starWarsIntrospection.spec.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files\Krita (x64)\bin\QtQuick\Controls.2\Material\Pane.qml	krita-x64-5.1.5-setup.exe
File created	C:\Program Files\Krita (x64)\bin\translations\qt_fi.qm	krita-x64-5.1.5-setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b7209bbd7dd04d17\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\ContactImporter\ContactImporter\Utils\useFetchContactImporterInfoOnce.test.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b7209bbd7dd04d17\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\PYMKCarousel\PYMKCarousel\Analytics\useUserSeenEvent.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b7209bbd7dd04d17\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\RobloxAppLocales\RobloxAppLocales\Locales\it-it.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b7209bbd7dd04d17\ExtraContent\LuaPackages\Packages\_Index\UIBlox\UIBlox\App\Loading\Enum\LoadingStrategy.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b7209bbd7dd04d17\ExtraContent\LuaPackages\Packages\_Index\NetworkingCurrentlyWearing-96003ad7-1.12.0\NetworkingCurrentlyWearing\networkRequests\createGetCurrentlyWearing.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b7209bbd7dd04d17\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\ProfileQRCode\Dash.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files\Krita (x64)\share\krita\preset_icons\tool_icons\05_05_stylus-colored-ring.png	krita-x64-5.1.5-setup.exe
File created	C:\Program Files\Krita (x64)\bin\locale\se\LC_MESSAGES\ki18n5.mo	krita-x64-5.1.5-setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b7209bbd7dd04d17\PlatformContent\pc\textures\brick\diffuse.dds	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b7209bbd7dd04d17\content\textures\ui\Controls\xboxLS@3x.png	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b7209bbd7dd04d17\ExtraContent\LuaPackages\Packages\_Index\ExperienceChat-2bd849d2-78d25f7e\ExperienceChat\Actions\VoiceParticipantRemoved.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b7209bbd7dd04d17\ExtraContent\LuaPackages\Packages\_Index\RoduxUsers-90b0d7fc-941abdeb\RoduxUsers\Reducers\Users\byUserId.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files\Krita (x64)\bin\QtQuick\Controls.2\Universal\TextArea.qml	krita-x64-5.1.5-setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b7209bbd7dd04d17\ExtraContent\LuaPackages\Packages\_Index\JestUtil-edcba0e9-3.2.1\JestUtil\isPromise.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b7209bbd7dd04d17\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\ApolloClientTesting\ApolloClientTesting\init.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b7209bbd7dd04d17\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\FriendsLanding\Localization.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b7209bbd7dd04d17\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\RobloxAppLocales\RobloxAppLocales\Locales\de-de.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files\Krita (x64)\lib\site-packages\PyQt5\bindings\QtQml\qqmlparserstatus.sip	krita-x64-5.1.5-setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b7209bbd7dd04d17\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\ContactImporter\RoactNavigation.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b7209bbd7dd04d17\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\ExternalContentSharingProtocol\ExternalContentSharingProtocol\ExternalContentSharingProtocol.spec.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b7209bbd7dd04d17\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\Style\Style\AppStyleProvider.spec.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files\Krita (x64)\bin\QtQuick\Controls.2\Drawer.qml	krita-x64-5.1.5-setup.exe
File created	C:\Program Files\Krita (x64)\bin\locale\sv\LC_MESSAGES\kwidgetsaddons5_qt.qm	krita-x64-5.1.5-setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b7209bbd7dd04d17\ExtraContent\LuaPackages\Packages\_Index\SocialLibraries\SocialLibraries\__tests__\UnitTestHelpers\findImageSet.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b7209bbd7dd04d17\ExtraContent\LuaPackages\Packages\_Index\UIBlox\RbxDesignFoundations.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b7209bbd7dd04d17\ExtraContent\LuaPackages\Packages\_Index\UIBlox\UIBlox\App\Tile\ItemTile\ItemRestrictionStatus.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b7209bbd7dd04d17\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\ContactImporter\ContactImporter\ContactsList\Components\ContactsList\ContactsListV2.test.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files\Krita (x64)\bin\locale\ga\LC_MESSAGES\kcoreaddons5_qt.qm	krita-x64-5.1.5-setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b7209bbd7dd04d17\ExtraContent\LuaPackages\Packages\_Index\IAPExperience\IAPExperience\PremiumUpsell\PremiumUpsellPrompt.spec.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b7209bbd7dd04d17\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\ContactImporter\ContactImporter\installReducer\init.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-b7209bbd7dd04d17\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\GameDetailRodux\Promise.lua	RobloxPlayerLauncher.exe

Drops file in Windows directory 2 IoCs

Processes:

NoEscape.exe

description ioc process

File created C:\Windows\winnt32.exe NoEscape.exe
File opened for modification C:\Windows\winnt32.exe NoEscape.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4940 2784 WerFault.exe krita.exe

description	ioc	process
File created	C:\Windows\winnt32.exe	NoEscape.exe
File opened for modification	C:\Windows\winnt32.exe	NoEscape.exe

pid	pid_target	process	target process
4940	2784	WerFault.exe	krita.exe

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

svchost.exesvchost.exesvchost.exesvchost.exesvchost.exe

description	ioc	process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

System Information Discovery

Processes:

chrome.exechrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies Internet Explorer settings 1 TTPs 12 IoCs

adware spyware

Modify Registry

Processes:

RobloxPlayerBeta.exeRobloxPlayerLauncher.exeRobloxPlayerLauncher.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	RobloxPlayerBeta.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio	RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox	RobloxPlayerLauncher.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0"	RobloxPlayerLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerLauncher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	RobloxPlayerLauncher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\RobloxPlayerBeta.exe = "11000"	RobloxPlayerBeta.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0"	RobloxPlayerLauncher.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	RobloxPlayerLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerLauncher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	RobloxPlayerLauncher.exe

Modifies data under HKEY_USERS 22 IoCs

Processes:

LogonUI.exechrome.exesvchost.exesvchost.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133248450393285578"	chrome.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Direct3D	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Direct3D	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Direct3D\LastTelemetryChangeStamp = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Direct3D\LastTelemetryChangeStamp = "2"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Direct3D\LastTelemetryChangeStamp = "3"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "192"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe

Modifies registry class 64 IoCs

Processes:

krita-x64-5.1.5-setup.exeRobloxPlayerLauncher.exeRobloxPlayerLauncher.exechrome.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Krita.Document\TypeOverlay = "\"C:\\Program Files\\Krita (x64)\\shellex\\krita.ico\",0"	krita-x64-5.1.5-setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Krita.GenericImage\shell\open\FriendlyAppName = "Krita"	krita-x64-5.1.5-setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.jxl	krita-x64-5.1.5-setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\roblox-player\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-b7209bbd7dd04d17\\RobloxPlayerLauncher.exe"	RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Krita.GenericImage	krita-x64-5.1.5-setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.ora\OpenWithProgIds\Krita.OpenRaster	krita-x64-5.1.5-setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6806289-D605-4AFE-A778-BC584303DB9A}\ = "Krita Thumbnail Provider"	krita-x64-5.1.5-setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C8E5509D-6F68-480C-8A41-DB64AECE94C6}\ = "Krita Property Handler"	krita-x64-5.1.5-setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.kra\shellex\{E357FCCD-A995-4576-B01F-234630154E96}	krita-x64-5.1.5-setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.avif\OpenWithProgIds\Krita.GenericImage	krita-x64-5.1.5-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\.heic\OpenWithProgIds	krita-x64-5.1.5-setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\krita.exe\SupportedTypes	krita-x64-5.1.5-setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.krz	krita-x64-5.1.5-setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Krita.Document\shell\open\FriendlyAppName = "Krita"	krita-x64-5.1.5-setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.ora\shellex\{E357FCCD-A995-4576-B01F-234630154E96}\ = "{C6806289-D605-4AFE-A778-BC584303DB9A}"	krita-x64-5.1.5-setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.krz\PerceivedType = "Image"	krita-x64-5.1.5-setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open	RobloxPlayerLauncher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\krita.exe\SupportedTypes\.heic	krita-x64-5.1.5-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\roblox-player\shell\open	RobloxPlayerLauncher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Krita.OpenRaster\shell\open\command\ = "\"C:\\Program Files\\Krita (x64)\\bin\\krita.exe\" \"%1\""	krita-x64-5.1.5-setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\krita.exe\SupportedTypes\.bmp	krita-x64-5.1.5-setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Krita.Document\PreviewDetails = "prop:System.DateModified;System.Size;System.DateCreated;System.Image.Dimensions;System.OfflineAvailability;System.OfflineStatus;System.SharedWith"	krita-x64-5.1.5-setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Krita.OpenRaster\ = "OpenRaster Image Document"	krita-x64-5.1.5-setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Krita.OpenRaster\shell	krita-x64-5.1.5-setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.krz\OpenWithProgIds	krita-x64-5.1.5-setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon	RobloxPlayerLauncher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Krita.Document\FriendlyTypeName = "Krita Image Document"	krita-x64-5.1.5-setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Krita.ArchiveDocument\shell	krita-x64-5.1.5-setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.xcf	krita-x64-5.1.5-setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.psd\OpenWithProgIds\Krita.GenericImage	krita-x64-5.1.5-setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\krita.exe\SupportedTypes\.tiff	krita-x64-5.1.5-setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.kra\shellex\{E357FCCD-A995-4576-B01F-234630154E96}\ = "{C6806289-D605-4AFE-A778-BC584303DB9A}"	krita-x64-5.1.5-setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.jxl\OpenWithProgIds	krita-x64-5.1.5-setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\krita.exe\SupportedTypes\.psd	krita-x64-5.1.5-setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\URL Protocol	RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.kpp	krita-x64-5.1.5-setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\krita.exe\SupportedTypes\.xcf	krita-x64-5.1.5-setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\RobloxStudioLauncherBeta.exe\" %1"	RobloxPlayerLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\roblox-player\shell	RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Krita.PaintopPreset\shell	krita-x64-5.1.5-setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C8E5509D-6F68-480C-8A41-DB64AECE94C6}\InprocServer32\ = "C:\\Program Files\\Krita (x64)\\shellex\\kritashellex32.dll"	krita-x64-5.1.5-setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.krz\shellex	krita-x64-5.1.5-setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open	RobloxPlayerLauncher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\krita.exe\SupportedTypes\.kra	krita-x64-5.1.5-setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\krita.exe\SupportedTypes\.exr	krita-x64-5.1.5-setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command	RobloxPlayerLauncher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\ = "URL: Roblox Protocol"	RobloxPlayerLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\roblox-player\shell\open\command	RobloxPlayerLauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\roblox-player\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-b7209bbd7dd04d17\\RobloxPlayerLauncher.exe\" %1"	RobloxPlayerLauncher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.kra\ = "Krita.Document"	krita-x64-5.1.5-setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Krita.ArchiveDocument\shell\open\command\ = "\"C:\\Program Files\\Krita (x64)\\bin\\krita.exe\" \"%1\""	krita-x64-5.1.5-setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.kra\OpenWithProgIds	krita-x64-5.1.5-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\.png\OpenWithProgIds	krita-x64-5.1.5-setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C8E5509D-6F68-480C-8A41-DB64AECE94C6}	krita-x64-5.1.5-setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Krita.ArchiveDocument\DefaultIcon\ = "\"C:\\Program Files\\Krita (x64)\\shellex\\kritafile.ico\",0"	krita-x64-5.1.5-setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Krita.GenericImage\shell\open	krita-x64-5.1.5-setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open	RobloxPlayerLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\roblox-player\DefaultIcon	RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1675742406-747946869-1029867430-1000\{05B9B865-18BF-438E-A4A1-EE070B31B85C}	chrome.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\roblox-player\DefaultIcon	RobloxPlayerLauncher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Krita.ArchiveDocument\FriendlyTypeName = "Krita Archive Image Document"	krita-x64-5.1.5-setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Krita.PaintopPreset	krita-x64-5.1.5-setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Krita.PaintopPreset\DefaultIcon\ = "\"C:\\Program Files\\Krita (x64)\\shellex\\kritafile.ico\",0"	krita-x64-5.1.5-setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Krita.GenericImage\DefaultIcon\ = "\"C:\\Program Files\\Krita (x64)\\shellex\\kritafile.ico\",0"	krita-x64-5.1.5-setup.exe

Suspicious behavior: AddClipboardFormatListener 10 IoCs

Processes:

krita.exekrita.exe

pid process

2784 krita.exe
2784 krita.exe
2784 krita.exe
3144 krita.exe
2784 krita.exe
3144 krita.exe
2784 krita.exe
3144 krita.exe
3144 krita.exe
3144 krita.exe

pid	process
2784	krita.exe
2784	krita.exe
2784	krita.exe
3144	krita.exe
2784	krita.exe
3144	krita.exe
2784	krita.exe
3144	krita.exe
3144	krita.exe
3144	krita.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

Processes:

chrome.exechrome.exeRobloxPlayerLauncher.exeRobloxPlayerBeta.exe

pid	process
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
3452	chrome.exe
3452	chrome.exe
3504	RobloxPlayerLauncher.exe
3504	RobloxPlayerLauncher.exe
3504	RobloxPlayerLauncher.exe
3504	RobloxPlayerLauncher.exe
3504	RobloxPlayerLauncher.exe
3504	RobloxPlayerLauncher.exe
3504	RobloxPlayerLauncher.exe
3504	RobloxPlayerLauncher.exe
3504	RobloxPlayerLauncher.exe
3504	RobloxPlayerLauncher.exe
3504	RobloxPlayerLauncher.exe
3504	RobloxPlayerLauncher.exe
3760	RobloxPlayerBeta.exe
3760	RobloxPlayerBeta.exe
3760	RobloxPlayerBeta.exe
3760	RobloxPlayerBeta.exe
3760	RobloxPlayerBeta.exe
3760	RobloxPlayerBeta.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

Processes:

krita-x64-5.1.5-setup.exeRobloxPlayerBeta.exeOpenWith.exe

pid process

4600 krita-x64-5.1.5-setup.exe
3760 RobloxPlayerBeta.exe
4520 OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 21 IoCs

Processes:

chrome.exe

pid	process
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exechrome.exe

description	pid	process
Token: SeShutdownPrivilege	3352	chrome.exe
Token: SeCreatePagefilePrivilege	3352	chrome.exe
Token: SeShutdownPrivilege	4152	chrome.exe
Token: SeCreatePagefilePrivilege	4152	chrome.exe
Token: SeShutdownPrivilege	3352	chrome.exe
Token: SeCreatePagefilePrivilege	3352	chrome.exe
Token: SeShutdownPrivilege	4152	chrome.exe
Token: SeCreatePagefilePrivilege	4152	chrome.exe
Token: SeShutdownPrivilege	3352	chrome.exe
Token: SeCreatePagefilePrivilege	3352	chrome.exe
Token: SeShutdownPrivilege	4152	chrome.exe
Token: SeCreatePagefilePrivilege	4152	chrome.exe
Token: SeShutdownPrivilege	4152	chrome.exe
Token: SeCreatePagefilePrivilege	4152	chrome.exe
Token: SeShutdownPrivilege	4152	chrome.exe
Token: SeCreatePagefilePrivilege	4152	chrome.exe
Token: SeShutdownPrivilege	4152	chrome.exe
Token: SeCreatePagefilePrivilege	4152	chrome.exe
Token: SeShutdownPrivilege	4152	chrome.exe
Token: SeCreatePagefilePrivilege	4152	chrome.exe
Token: SeShutdownPrivilege	4152	chrome.exe
Token: SeCreatePagefilePrivilege	4152	chrome.exe
Token: SeShutdownPrivilege	4152	chrome.exe
Token: SeCreatePagefilePrivilege	4152	chrome.exe
Token: SeShutdownPrivilege	4152	chrome.exe
Token: SeCreatePagefilePrivilege	4152	chrome.exe
Token: SeShutdownPrivilege	4152	chrome.exe
Token: SeCreatePagefilePrivilege	4152	chrome.exe
Token: SeShutdownPrivilege	4152	chrome.exe
Token: SeCreatePagefilePrivilege	4152	chrome.exe
Token: SeShutdownPrivilege	4152	chrome.exe
Token: SeCreatePagefilePrivilege	4152	chrome.exe
Token: SeShutdownPrivilege	4152	chrome.exe
Token: SeCreatePagefilePrivilege	4152	chrome.exe
Token: SeShutdownPrivilege	4152	chrome.exe
Token: SeCreatePagefilePrivilege	4152	chrome.exe
Token: SeShutdownPrivilege	4152	chrome.exe
Token: SeCreatePagefilePrivilege	4152	chrome.exe
Token: SeShutdownPrivilege	4152	chrome.exe
Token: SeCreatePagefilePrivilege	4152	chrome.exe
Token: SeShutdownPrivilege	4152	chrome.exe
Token: SeCreatePagefilePrivilege	4152	chrome.exe
Token: SeShutdownPrivilege	4152	chrome.exe
Token: SeCreatePagefilePrivilege	4152	chrome.exe
Token: SeShutdownPrivilege	4152	chrome.exe
Token: SeCreatePagefilePrivilege	4152	chrome.exe
Token: SeShutdownPrivilege	4152	chrome.exe
Token: SeCreatePagefilePrivilege	4152	chrome.exe
Token: SeShutdownPrivilege	4152	chrome.exe
Token: SeCreatePagefilePrivilege	4152	chrome.exe
Token: SeShutdownPrivilege	4152	chrome.exe
Token: SeCreatePagefilePrivilege	4152	chrome.exe
Token: SeShutdownPrivilege	4152	chrome.exe
Token: SeCreatePagefilePrivilege	4152	chrome.exe
Token: SeShutdownPrivilege	4152	chrome.exe
Token: SeCreatePagefilePrivilege	4152	chrome.exe
Token: SeShutdownPrivilege	4152	chrome.exe
Token: SeCreatePagefilePrivilege	4152	chrome.exe
Token: SeShutdownPrivilege	4152	chrome.exe
Token: SeCreatePagefilePrivilege	4152	chrome.exe
Token: SeShutdownPrivilege	4152	chrome.exe
Token: SeCreatePagefilePrivilege	4152	chrome.exe
Token: SeShutdownPrivilege	4152	chrome.exe
Token: SeCreatePagefilePrivilege	4152	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

chrome.exe

pid	process
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

chrome.exe

pid	process
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe
4152	chrome.exe

Suspicious use of SetWindowsHookEx 23 IoCs

Processes:

krita-x64-5.1.5-setup.exekrita.exekrita.exeRobloxPlayerBeta.exeOpenWith.exeLogonUI.exe

pid	process
3408	krita-x64-5.1.5-setup.exe
2784	krita.exe
2784	krita.exe
2784	krita.exe
2784	krita.exe
3144	krita.exe
2784	krita.exe
2784	krita.exe
2784	krita.exe
3144	krita.exe
3144	krita.exe
2784	krita.exe
3144	krita.exe
3144	krita.exe
2784	krita.exe
3144	krita.exe
3144	krita.exe
3144	krita.exe
3144	krita.exe
3760	RobloxPlayerBeta.exe
3760	RobloxPlayerBeta.exe
4520	OpenWith.exe
5956	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exechrome.exe

description	pid	process	target process
PID 3352 wrote to memory of 2080	3352	chrome.exe	chrome.exe
PID 3352 wrote to memory of 2080	3352	chrome.exe	chrome.exe
PID 4152 wrote to memory of 4736	4152	chrome.exe	chrome.exe
PID 4152 wrote to memory of 4736	4152	chrome.exe	chrome.exe
PID 3352 wrote to memory of 4600	3352	chrome.exe	chrome.exe
PID 3352 wrote to memory of 4600	3352	chrome.exe	chrome.exe
PID 3352 wrote to memory of 4600	3352	chrome.exe	chrome.exe
PID 3352 wrote to memory of 4600	3352	chrome.exe	chrome.exe
PID 3352 wrote to memory of 4600	3352	chrome.exe	chrome.exe
PID 3352 wrote to memory of 4600	3352	chrome.exe	chrome.exe
PID 3352 wrote to memory of 4600	3352	chrome.exe	chrome.exe
PID 3352 wrote to memory of 4600	3352	chrome.exe	chrome.exe
PID 3352 wrote to memory of 4600	3352	chrome.exe	chrome.exe
PID 3352 wrote to memory of 4600	3352	chrome.exe	chrome.exe
PID 3352 wrote to memory of 4600	3352	chrome.exe	chrome.exe
PID 3352 wrote to memory of 4600	3352	chrome.exe	chrome.exe
PID 3352 wrote to memory of 4600	3352	chrome.exe	chrome.exe
PID 3352 wrote to memory of 4600	3352	chrome.exe	chrome.exe
PID 3352 wrote to memory of 4600	3352	chrome.exe	chrome.exe
PID 3352 wrote to memory of 4600	3352	chrome.exe	chrome.exe
PID 3352 wrote to memory of 4600	3352	chrome.exe	chrome.exe
PID 3352 wrote to memory of 4600	3352	chrome.exe	chrome.exe
PID 3352 wrote to memory of 4600	3352	chrome.exe	chrome.exe
PID 3352 wrote to memory of 4600	3352	chrome.exe	chrome.exe
PID 3352 wrote to memory of 4600	3352	chrome.exe	chrome.exe
PID 3352 wrote to memory of 4600	3352	chrome.exe	chrome.exe
PID 3352 wrote to memory of 4600	3352	chrome.exe	chrome.exe
PID 3352 wrote to memory of 4600	3352	chrome.exe	chrome.exe
PID 3352 wrote to memory of 4600	3352	chrome.exe	chrome.exe
PID 3352 wrote to memory of 4600	3352	chrome.exe	chrome.exe
PID 3352 wrote to memory of 4600	3352	chrome.exe	chrome.exe
PID 3352 wrote to memory of 4600	3352	chrome.exe	chrome.exe
PID 3352 wrote to memory of 4600	3352	chrome.exe	chrome.exe
PID 3352 wrote to memory of 4600	3352	chrome.exe	chrome.exe
PID 3352 wrote to memory of 4600	3352	chrome.exe	chrome.exe
PID 3352 wrote to memory of 4600	3352	chrome.exe	chrome.exe
PID 3352 wrote to memory of 4600	3352	chrome.exe	chrome.exe
PID 3352 wrote to memory of 4600	3352	chrome.exe	chrome.exe
PID 3352 wrote to memory of 4600	3352	chrome.exe	chrome.exe
PID 3352 wrote to memory of 4600	3352	chrome.exe	chrome.exe
PID 3352 wrote to memory of 4600	3352	chrome.exe	chrome.exe
PID 3352 wrote to memory of 4600	3352	chrome.exe	chrome.exe
PID 4152 wrote to memory of 3380	4152	chrome.exe	chrome.exe
PID 4152 wrote to memory of 3380	4152	chrome.exe	chrome.exe
PID 4152 wrote to memory of 3380	4152	chrome.exe	chrome.exe
PID 4152 wrote to memory of 3380	4152	chrome.exe	chrome.exe
PID 4152 wrote to memory of 3380	4152	chrome.exe	chrome.exe
PID 4152 wrote to memory of 3380	4152	chrome.exe	chrome.exe
PID 4152 wrote to memory of 3380	4152	chrome.exe	chrome.exe
PID 4152 wrote to memory of 3380	4152	chrome.exe	chrome.exe
PID 4152 wrote to memory of 3380	4152	chrome.exe	chrome.exe
PID 4152 wrote to memory of 3380	4152	chrome.exe	chrome.exe
PID 4152 wrote to memory of 3380	4152	chrome.exe	chrome.exe
PID 4152 wrote to memory of 3380	4152	chrome.exe	chrome.exe
PID 4152 wrote to memory of 3380	4152	chrome.exe	chrome.exe
PID 4152 wrote to memory of 3380	4152	chrome.exe	chrome.exe
PID 4152 wrote to memory of 3380	4152	chrome.exe	chrome.exe
PID 4152 wrote to memory of 3380	4152	chrome.exe	chrome.exe
PID 4152 wrote to memory of 3380	4152	chrome.exe	chrome.exe
PID 4152 wrote to memory of 3380	4152	chrome.exe	chrome.exe
PID 4152 wrote to memory of 3380	4152	chrome.exe	chrome.exe
PID 4152 wrote to memory of 3380	4152	chrome.exe	chrome.exe
PID 4152 wrote to memory of 3380	4152	chrome.exe	chrome.exe
PID 4152 wrote to memory of 3380	4152	chrome.exe	chrome.exe

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\GodMode9-v2.1.1-20220322194259.zip
1⤵
PID:1904

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3352

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffd17959758,0x7ffd17959768,0x7ffd17959778
2⤵
PID:2080

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1412 --field-trial-handle=1804,i,2189855046966667697,13460228878584146337,131072 /prefetch:2
2⤵
PID:4600

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2104 --field-trial-handle=1804,i,2189855046966667697,13460228878584146337,131072 /prefetch:8
2⤵
PID:2572

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4152

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xb0,0x108,0x7ffd17959758,0x7ffd17959768,0x7ffd17959778
2⤵
PID:4736

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1788 --field-trial-handle=1812,i,8819826172351821363,16557202357826994919,131072 /prefetch:2
2⤵
PID:3380

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1812,i,8819826172351821363,16557202357826994919,131072 /prefetch:8
2⤵
PID:1492

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2248 --field-trial-handle=1812,i,8819826172351821363,16557202357826994919,131072 /prefetch:8
2⤵
PID:1504

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3156 --field-trial-handle=1812,i,8819826172351821363,16557202357826994919,131072 /prefetch:1
2⤵
PID:2640

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3284 --field-trial-handle=1812,i,8819826172351821363,16557202357826994919,131072 /prefetch:1
2⤵
PID:2392

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4500 --field-trial-handle=1812,i,8819826172351821363,16557202357826994919,131072 /prefetch:1
2⤵
PID:1984

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4712 --field-trial-handle=1812,i,8819826172351821363,16557202357826994919,131072 /prefetch:8
2⤵
PID:1664

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4828 --field-trial-handle=1812,i,8819826172351821363,16557202357826994919,131072 /prefetch:8
2⤵
PID:3800

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5020 --field-trial-handle=1812,i,8819826172351821363,16557202357826994919,131072 /prefetch:8
2⤵
PID:2228

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4580 --field-trial-handle=1812,i,8819826172351821363,16557202357826994919,131072 /prefetch:8
2⤵
PID:3992

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4724 --field-trial-handle=1812,i,8819826172351821363,16557202357826994919,131072 /prefetch:8
2⤵
PID:2620

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5156 --field-trial-handle=1812,i,8819826172351821363,16557202357826994919,131072 /prefetch:8
2⤵
PID:2308

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=5312 --field-trial-handle=1812,i,8819826172351821363,16557202357826994919,131072 /prefetch:1
2⤵
PID:4516

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=5288 --field-trial-handle=1812,i,8819826172351821363,16557202357826994919,131072 /prefetch:1
2⤵
PID:4244

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=5452 --field-trial-handle=1812,i,8819826172351821363,16557202357826994919,131072 /prefetch:1
2⤵
PID:1200

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3984 --field-trial-handle=1812,i,8819826172351821363,16557202357826994919,131072 /prefetch:8
2⤵
PID:3916

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4524 --field-trial-handle=1812,i,8819826172351821363,16557202357826994919,131072 /prefetch:8
2⤵
PID:2484

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=5348 --field-trial-handle=1812,i,8819826172351821363,16557202357826994919,131072 /prefetch:1
2⤵
PID:4676

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5464 --field-trial-handle=1812,i,8819826172351821363,16557202357826994919,131072 /prefetch:8
2⤵
PID:2528

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5864 --field-trial-handle=1812,i,8819826172351821363,16557202357826994919,131072 /prefetch:8
2⤵
PID:4340

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5600 --field-trial-handle=1812,i,8819826172351821363,16557202357826994919,131072 /prefetch:8
2⤵
PID:3792

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5112 --field-trial-handle=1812,i,8819826172351821363,16557202357826994919,131072 /prefetch:8
2⤵
PID:3144

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6160 --field-trial-handle=1812,i,8819826172351821363,16557202357826994919,131072 /prefetch:8
2⤵
PID:2520

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5528 --field-trial-handle=1812,i,8819826172351821363,16557202357826994919,131072 /prefetch:8
2⤵
PID:1676

C:\Users\Admin\Downloads\krita-x64-5.1.5-setup.exe
"C:\Users\Admin\Downloads\krita-x64-5.1.5-setup.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:4600

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5900 --field-trial-handle=1812,i,8819826172351821363,16557202357826994919,131072 /prefetch:8
2⤵
PID:2496

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4496 --field-trial-handle=1812,i,8819826172351821363,16557202357826994919,131072 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3452

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=28 --mojo-platform-channel-handle=5388 --field-trial-handle=1812,i,8819826172351821363,16557202357826994919,131072 /prefetch:1
2⤵
PID:4588

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=29 --mojo-platform-channel-handle=3352 --field-trial-handle=1812,i,8819826172351821363,16557202357826994919,131072 /prefetch:1
2⤵
PID:1916

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=30 --mojo-platform-channel-handle=3436 --field-trial-handle=1812,i,8819826172351821363,16557202357826994919,131072 /prefetch:1
2⤵
PID:4280

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=31 --mojo-platform-channel-handle=4444 --field-trial-handle=1812,i,8819826172351821363,16557202357826994919,131072 /prefetch:1
2⤵
PID:4040

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=32 --mojo-platform-channel-handle=7032 --field-trial-handle=1812,i,8819826172351821363,16557202357826994919,131072 /prefetch:1
2⤵
PID:4428

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=33 --mojo-platform-channel-handle=6448 --field-trial-handle=1812,i,8819826172351821363,16557202357826994919,131072 /prefetch:1
2⤵
PID:2540

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6864 --field-trial-handle=1812,i,8819826172351821363,16557202357826994919,131072 /prefetch:8
2⤵
PID:3800

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6636 --field-trial-handle=1812,i,8819826172351821363,16557202357826994919,131072 /prefetch:8
2⤵
PID:3676

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6660 --field-trial-handle=1812,i,8819826172351821363,16557202357826994919,131072 /prefetch:8
2⤵
PID:2128

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6904 --field-trial-handle=1812,i,8819826172351821363,16557202357826994919,131072 /prefetch:8
2⤵
PID:3248

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5352 --field-trial-handle=1812,i,8819826172351821363,16557202357826994919,131072 /prefetch:8
2⤵
PID:2156

C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe
"C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3504

C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe
C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe --crashpad --no-rate-limit --database=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --metrics-dir=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --url=https://upload.crashes.rbxinfra.com/post --annotation=RobloxChannel=production --annotation=RobloxGitHash=6867c2d3365d29f9b40f61bb5c51a4bc7df908c0 --annotation=UploadAttachmentKiloByteLimit=100 --annotation=UploadPercentage=100 --annotation=format=minidump --annotation=token=a2440b0bfdada85f34d79b43839f2b49ea6bba474bd7d126e844bc119271a1c3 --initial-client-data=0x6bc,0x6c0,0x6b8,0x6b4,0x7bc,0x102b480,0x102b490,0x102b4a0
3⤵
- Executes dropped EXE
PID:3776

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=39 --mojo-platform-channel-handle=4520 --field-trial-handle=1812,i,8819826172351821363,16557202357826994919,131072 /prefetch:1
2⤵
PID:3636

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5248 --field-trial-handle=1812,i,8819826172351821363,16557202357826994919,131072 /prefetch:8
2⤵
PID:1476

C:\Program Files (x86)\Roblox\Versions\version-b7209bbd7dd04d17\RobloxPlayerLauncher.exe
"C:\Program Files (x86)\Roblox\Versions\version-b7209bbd7dd04d17\RobloxPlayerLauncher.exe" roblox-player:1+launchmode:play+gameinfo:fSlgikz4kybbZcpWZAjaPzTufnayOY4tEdQ82dN34xlIjBUqVQs3ok5qybMcoXDo1hgb7Kq6u2CEA-tJ3LL5QXpkmYuAO5UWR2oI6qLzwQLYXRdBpseCgeYfZyjmyNUGJMmQ5D2KZnOYFyumdtQH4zOc01zW_vW5QUtpfcMMMHxdSmKP6ECIj7vNEuPrOkqRNNOXeKUbd3O4l2DVH6fwiN8ECnDG7wWYEkG2jOYAT6s+launchtime:1680371776055+placelauncherurl:https%3A%2F%2Fassetgame.roblox.com%2Fgame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D167742651695%26placeId%3D6516141723%26isPlayTogetherGame%3Dfalse%26joinAttemptId%3Df8faba6f-d3c5-4596-a81e-06c02b55f29b%26joinAttemptOrigin%3DPlayButton+browsertrackerid:167742651695+robloxLocale:en_us+gameLocale:en_us+channel:+LaunchExp:InApp
2⤵
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies Internet Explorer settings
- Modifies registry class
PID:3148

C:\Program Files (x86)\Roblox\Versions\version-b7209bbd7dd04d17\RobloxPlayerLauncher.exe
"C:\Program Files (x86)\Roblox\Versions\version-b7209bbd7dd04d17\RobloxPlayerLauncher.exe" --crashpad --no-rate-limit --database=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --metrics-dir=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --url=https://upload.crashes.rbxinfra.com/post --annotation=RobloxChannel=production --annotation=RobloxGitHash=6867c2d3365d29f9b40f61bb5c51a4bc7df908c0 --annotation=UploadAttachmentKiloByteLimit=100 --annotation=UploadPercentage=100 --annotation=format=minidump --annotation=token=a2440b0bfdada85f34d79b43839f2b49ea6bba474bd7d126e844bc119271a1c3 --initial-client-data=0x71c,0x720,0x724,0x6b4,0x72c,0xf4b480,0xf4b490,0xf4b4a0
3⤵
- Executes dropped EXE
PID:4684

C:\Program Files (x86)\Roblox\Versions\version-b7209bbd7dd04d17\RobloxPlayerBeta.exe
"C:\Program Files (x86)\Roblox\Versions\version-b7209bbd7dd04d17\RobloxPlayerBeta.exe" --app -t fSlgikz4kybbZcpWZAjaPzTufnayOY4tEdQ82dN34xlIjBUqVQs3ok5qybMcoXDo1hgb7Kq6u2CEA-tJ3LL5QXpkmYuAO5UWR2oI6qLzwQLYXRdBpseCgeYfZyjmyNUGJMmQ5D2KZnOYFyumdtQH4zOc01zW_vW5QUtpfcMMMHxdSmKP6ECIj7vNEuPrOkqRNNOXeKUbd3O4l2DVH6fwiN8ECnDG7wWYEkG2jOYAT6s -j https://assetgame.roblox.com/game/PlaceLauncher.ashx?request=RequestGame&browserTrackerId=167742651695&placeId=6516141723&isPlayTogetherGame=false&joinAttemptId=f8faba6f-d3c5-4596-a81e-06c02b55f29b&joinAttemptOrigin=PlayButton -b 167742651695 --launchtime=1680371776055 --rloc en_us --gloc en_us
3⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3760

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=41 --mojo-platform-channel-handle=1264 --field-trial-handle=1812,i,8819826172351821363,16557202357826994919,131072 /prefetch:1
2⤵
PID:9608

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=42 --mojo-platform-channel-handle=5320 --field-trial-handle=1812,i,8819826172351821363,16557202357826994919,131072 /prefetch:1
2⤵
PID:9532

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5272 --field-trial-handle=1812,i,8819826172351821363,16557202357826994919,131072 /prefetch:8
2⤵
PID:9472

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5304 --field-trial-handle=1812,i,8819826172351821363,16557202357826994919,131072 /prefetch:8
2⤵
PID:9488

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=45 --mojo-platform-channel-handle=1720 --field-trial-handle=1812,i,8819826172351821363,16557202357826994919,131072 /prefetch:1
2⤵
PID:9328

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=46 --mojo-platform-channel-handle=5224 --field-trial-handle=1812,i,8819826172351821363,16557202357826994919,131072 /prefetch:1
2⤵
PID:12604

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=47 --mojo-platform-channel-handle=5328 --field-trial-handle=1812,i,8819826172351821363,16557202357826994919,131072 /prefetch:1
2⤵
PID:10684

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=48 --mojo-platform-channel-handle=5532 --field-trial-handle=1812,i,8819826172351821363,16557202357826994919,131072 /prefetch:1
2⤵
PID:12676

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=49 --mojo-platform-channel-handle=6604 --field-trial-handle=1812,i,8819826172351821363,16557202357826994919,131072 /prefetch:1
2⤵
PID:11960

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6880 --field-trial-handle=1812,i,8819826172351821363,16557202357826994919,131072 /prefetch:8
2⤵
PID:12088

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6592 --field-trial-handle=1812,i,8819826172351821363,16557202357826994919,131072 /prefetch:8
2⤵
PID:11000

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6468 --field-trial-handle=1812,i,8819826172351821363,16557202357826994919,131072 /prefetch:8
2⤵
- Modifies registry class
PID:10792

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6496 --field-trial-handle=1812,i,8819826172351821363,16557202357826994919,131072 /prefetch:8
2⤵
PID:6172

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6996 --field-trial-handle=1812,i,8819826172351821363,16557202357826994919,131072 /prefetch:8
2⤵
PID:6344

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4692

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3916

C:\Users\Admin\Downloads\krita-x64-5.1.5-setup.exe
"C:\Users\Admin\Downloads\krita-x64-5.1.5-setup.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:3408

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:3676

C:\Windows\system32\dashost.exe
dashost.exe {93faa578-f4b1-435b-84607f2c160d403d}
2⤵
PID:1228

C:\Program Files\Krita (x64)\bin\krita.exe
"C:\Program Files\Krita (x64)\bin\krita.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2784

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2784 -s 2372
2⤵
- Program crash
PID:4940

C:\Program Files\Krita (x64)\bin\krita.exe
"C:\Program Files\Krita (x64)\bin\krita.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3144

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 408 -p 2784 -ip 2784
1⤵
PID:2916

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x460 0x45c
1⤵
PID:4724

C:\Windows\System32\GameBarPresenceWriter.exe
"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
1⤵
PID:1756

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k GraphicsPerfSvcGroup -s GraphicsPerfSvc
1⤵
- Checks processor information in registry
- Modifies data under HKEY_USERS
PID:4648

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4520

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
PID:5996

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k GraphicsPerfSvcGroup -s GraphicsPerfSvc
1⤵
- Checks processor information in registry
- Modifies data under HKEY_USERS
PID:9696

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Checks processor information in registry
PID:10024

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Checks processor information in registry
PID:9544

C:\Users\Admin\AppData\Local\Temp\Temp1_NoEscape.zip\NoEscape.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_NoEscape.zip\NoEscape.exe"
1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Disables RegEdit via registry modification
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Drops file in Windows directory
PID:6436

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3971055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:5956

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
PID:1852

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
1⤵
PID:7504

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

T1004

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Modify Registry

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

System Information Discovery