Analysis
- max time kernel
777s - max time network
756s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
01/10/2024, 17:23
General
- Target http://torproject.org
- Sample241001-vx7vaa1flp
Score
8/10
Malware Config
Signatures
- Downloads MZ/PE file
- Event Triggered Execution: Image File Execution Options Injection 1 TTPs 4 IoCs
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 31 IoCs
- Loads dropped DLL 35 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Checks system information in the registry 2 TTPs 20 IoCs
System information is often read in order to detect sandboxing environments.
- Suspicious use of NtCreateThreadExHideFromDebugger 4 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
- Drops file in Program Files directory 64 IoCs
- Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 18 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 5 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Checks processor information in registry 2 TTPs 22 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 5 IoCs
- Modifies Internet Explorer settings 1 TTPs 6 IoCs
- Modifies data under HKEY_USERS 64 IoCs
- Modifies registry class 64 IoCs
- NTFS ADS 1 IoCs
- Suspicious behavior: EnumeratesProcesses 26 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 60 IoCs
- Suspicious use of SetWindowsHookEx 23 IoCs
- Suspicious use of UnmapMainImage 4 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://torproject.org1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fffacb7cc40,0x7fffacb7cc4c,0x7fffacb7cc582⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1908,i,3753276085182568832,31262499802668228,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1904 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2024,i,3753276085182568832,31262499802668228,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2112 /prefetch:32⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2252,i,3753276085182568832,31262499802668228,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2532 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3052,i,3753276085182568832,31262499802668228,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3092 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3080,i,3753276085182568832,31262499802668228,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3116 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4556,i,3753276085182568832,31262499802668228,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4576 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3332,i,3753276085182568832,31262499802668228,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3328 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=4940,i,3753276085182568832,31262499802668228,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4904 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=3676,i,3753276085182568832,31262499802668228,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4352 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=4420,i,3753276085182568832,31262499802668228,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4380 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=4944,i,3753276085182568832,31262499802668228,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4904 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=5032,i,3753276085182568832,31262499802668228,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5200 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=5564,i,3753276085182568832,31262499802668228,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5468 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=5364,i,3753276085182568832,31262499802668228,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3420 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5836,i,3753276085182568832,31262499802668228,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5388 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5796,i,3753276085182568832,31262499802668228,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5132 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=6016,i,3753276085182568832,31262499802668228,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5656 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=5300,i,3753276085182568832,31262499802668228,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5188 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5200,i,3753276085182568832,31262499802668228,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4844 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=4836,i,3753276085182568832,31262499802668228,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5520 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --field-trial-handle=3328,i,3753276085182568832,31262499802668228,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5508 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- Checks processor information in registry
- NTFS ADS
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2012 -parentBuildID 20240401114208 -prefsHandle 1940 -prefMapHandle 1932 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d7e51299-015e-4e3d-8f40-e2fdfe57bab4} 756 "\\.\pipe\gecko-crash-server-pipe.756" gpu3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2424 -parentBuildID 20240401114208 -prefsHandle 2416 -prefMapHandle 2404 -prefsLen 23716 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {132b68a7-74ae-4f04-ba39-07f16e8067ad} 756 "\\.\pipe\gecko-crash-server-pipe.756" socket3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3092 -childID 1 -isForBrowser -prefsHandle 3096 -prefMapHandle 2988 -prefsLen 23857 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4a3bac9f-d3d8-4b2d-9b1d-9fba7627e2a2} 756 "\\.\pipe\gecko-crash-server-pipe.756" tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4224 -childID 2 -isForBrowser -prefsHandle 4216 -prefMapHandle 4212 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {93dcbc85-6bc6-447a-8e1f-6a12fd170ca3} 756 "\\.\pipe\gecko-crash-server-pipe.756" tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4772 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4804 -prefMapHandle 4800 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {af3e8583-d562-4e0f-8cbd-5ee465cf7d4f} 756 "\\.\pipe\gecko-crash-server-pipe.756" utility3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5296 -childID 3 -isForBrowser -prefsHandle 5292 -prefMapHandle 5288 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d0012764-6b17-47a8-ba58-ede4d98f63a6} 756 "\\.\pipe\gecko-crash-server-pipe.756" tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5524 -childID 4 -isForBrowser -prefsHandle 5444 -prefMapHandle 5452 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d519425b-131f-4f07-832b-ad12f575083c} 756 "\\.\pipe\gecko-crash-server-pipe.756" tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5644 -childID 5 -isForBrowser -prefsHandle 5720 -prefMapHandle 5716 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b83435ab-43e0-478f-aba4-2c8c9eef91c3} 756 "\\.\pipe\gecko-crash-server-pipe.756" tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5164 -childID 6 -isForBrowser -prefsHandle 6040 -prefMapHandle 5972 -prefsLen 27211 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {260f28ba-8943-4ca3-b73f-9e7d16dd503c} 756 "\\.\pipe\gecko-crash-server-pipe.756" tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3476 -parentBuildID 20240401114208 -prefsHandle 3492 -prefMapHandle 4384 -prefsLen 30582 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d50be42d-4644-45aa-8620-98131adb93f6} 756 "\\.\pipe\gecko-crash-server-pipe.756" rdd3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1636 -parentBuildID 20240401114208 -sandboxingKind 1 -prefsHandle 4596 -prefMapHandle 6336 -prefsLen 30582 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8959cc2c-df93-4d7d-b53e-2af7a345b569} 756 "\\.\pipe\gecko-crash-server-pipe.756" utility3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6916 -childID 7 -isForBrowser -prefsHandle 6904 -prefMapHandle 6900 -prefsLen 28048 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e035ddec-429e-4912-857b-5b3be95f303c} 756 "\\.\pipe\gecko-crash-server-pipe.756" tab3⤵
-
-
C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"3⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Roblox\Versions\version-b591875ddfbc4294\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exeMicrosoftEdgeWebview2Setup.exe /silent /install4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Microsoft\Temp\EUE9D6.tmp\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\Temp\EUE9D6.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"5⤵
- Event Triggered Execution: Image File Execution Options Injection
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc6⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver6⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NUMwM0NFMjQtM0JENC00ODc2LTg0QkYtNUUwM0E2OTZCREE3fSIgdXNlcmlkPSJ7OTIxRDVFMkYtRjhBMi00OUU2LTg2RUYtQkZGREU5QUFCNTFFfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9InsxNEY2NTM3MS03QjFDLTQ5QzQtQUY3OS1FMzFEMjFCODI3NUJ9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7cjQ1MnQxK2syVGdxL0hYemp2Rk5CUmhvcEJXUjlzYmpYeHFlVURIOXVYMD0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE0Ny4zNyIgbmV4dHZlcnNpb249IjEuMy4xNzEuMzkiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9Ijg5MTg0MzYzNjMiIGluc3RhbGxfdGltZV9tcz0iNTQyIi8-PC9hcHA-PC9yZXF1ZXN0Pg6⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{5C03CE24-3BD4-4876-84BF-5E03A696BDA7}" /silent6⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Program Files (x86)\Roblox\Versions\version-b591875ddfbc4294\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-b591875ddfbc4294\RobloxPlayerBeta.exe" -app -isInstallerLaunch -clientLaunchTimeEpochMs 04⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
-
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5328 -childID 8 -isForBrowser -prefsHandle 5352 -prefMapHandle 5340 -prefsLen 28332 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4850526a-edb3-4032-aca0-2f024ab1c14c} 756 "\\.\pipe\gecko-crash-server-pipe.756" tab3⤵
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NUMwM0NFMjQtM0JENC00ODc2LTg0QkYtNUUwM0E2OTZCREE3fSIgdXNlcmlkPSJ7OTIxRDVFMkYtRjhBMi00OUU2LTg2RUYtQkZGREU5QUFCNTFFfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntDQUNGNTlFRS0xMTU1LTREMDYtODk5Qi1DOTk3NkMyRTUzNkN9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7cjQ1MnQxK2syVGdxL0hYemp2Rk5CUmhvcEJXUjlzYmpYeHFlVURIOXVYMD0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTIzLjAuNjMxMi4xMjMiIG5leHR2ZXJzaW9uPSIxMjMuMC42MzEyLjEyMyIgbGFuZz0iZW4iIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjUiIHN5c3RlbV91cHRpbWVfdGlja3M9Ijg5MjMyMTYzNTciLz48L2FwcD48L3JlcXVlc3Q-2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{C7BCF537-F63C-4351-8B98-6259A14ACF83}\MicrosoftEdge_X64_129.0.2792.65.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{C7BCF537-F63C-4351-8B98-6259A14ACF83}\MicrosoftEdge_X64_129.0.2792.65.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level2⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{C7BCF537-F63C-4351-8B98-6259A14ACF83}\EDGEMITMP_114A0.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{C7BCF537-F63C-4351-8B98-6259A14ACF83}\EDGEMITMP_114A0.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{C7BCF537-F63C-4351-8B98-6259A14ACF83}\MicrosoftEdge_X64_129.0.2792.65.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level3⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{C7BCF537-F63C-4351-8B98-6259A14ACF83}\EDGEMITMP_114A0.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{C7BCF537-F63C-4351-8B98-6259A14ACF83}\EDGEMITMP_114A0.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=129.0.6668.71 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{C7BCF537-F63C-4351-8B98-6259A14ACF83}\EDGEMITMP_114A0.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=129.0.2792.65 --initial-client-data=0x22c,0x230,0x234,0x208,0x238,0x7ff6ab0f76f0,0x7ff6ab0f76fc,0x7ff6ab0f77084⤵
- Executes dropped EXE
-
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NUMwM0NFMjQtM0JENC00ODc2LTg0QkYtNUUwM0E2OTZCREE3fSIgdXNlcmlkPSJ7OTIxRDVFMkYtRjhBMi00OUU2LTg2RUYtQkZGREU5QUFCNTFFfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntBRkQ1RjUzMi0wNDA3LTQzNTktQTRBOS02QzhCNUMzMzRENEV9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7VlBRb1AxRitmcTE1d1J6aDFrUEw0UE1wV2g4T1JNQjVpenZyT0MvY2hqUT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjMwMTcyMjYtRkUyQS00Mjk1LThCREYtMDBDM0E5QTdFNEM1fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMTI5LjAuMjc5Mi42NSIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNvbnNlbnQ9ZmFsc2UiIGluc3RhbGxhZ2U9Ii0xIiBpbnN0YWxsZGF0ZT0iLTEiPjx1cGRhdGVjaGVjay8-PGV2ZW50IGV2ZW50dHlwZT0iOSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iODkzMzE0NjU0NSIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9Ijg5MzMxNzY0MDkiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI5MTE5NDM2MzUzIiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuZi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy9mZjA5YWIxOC02N2U3LTQ5ZjMtOTMwOS0xMTAxMWZlMjFhMjI_UDE9MTcyODQwODYyNyZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1WMmkzNUpJOXhySTRYWGlrdjZhRiUyYkZnJTJmcGNYdkx6bGNkUFolMmJ1RnFtZkhNajB4eGJHTzVxWmc3eDRuaEJtNDZWMWhTUDdTZVg5eGxOWkNZZWZyME96dyUzZCUzZCIgc2VydmVyX2lwX2hpbnQ9IiIgY2RuX2NpZD0iLTEiIGNkbl9jY2M9IiIgY2RuX21zZWRnZV9yZWY9IiIgY2RuX2F6dXJlX3JlZl9vcmlnaW5fc2hpZWxkPSIiIGNkbl9jYWNoZT0iIiBjZG5fcDNwPSIiIGRvd25sb2FkZWQ9IjE3Mzk0Mjg0MCIgdG90YWw9IjE3Mzk0Mjg0MCIgZG93bmxvYWRfdGltZV9tcz0iMTIwMTciLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI5MTE5NDk2NDUxIiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iOTEzNDMyNjYwMyIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjE5Njc1NyIgc3lzdGVtX3VwdGltZV90aWNrcz0iOTc0MDAwNjU4MCIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgdXBkYXRlX2NoZWNrX3RpbWVfbXM9IjU2NiIgZG93bmxvYWRfdGltZV9tcz0iMTg2MjkiIGRvd25sb2FkZWQ9IjE3Mzk0Mjg0MCIgdG90YWw9IjE3Mzk0Mjg0MCIgcGFja2FnZV9jYWNoZV9yZXN1bHQ9IjAiIGluc3RhbGxfdGltZV9tcz0iNjA1NjUiLz48L2FwcD48L3JlcXVlc3Q-2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Program Files (x86)\Roblox\Versions\version-b591875ddfbc4294\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-b591875ddfbc4294\RobloxPlayerBeta.exe" roblox-player:1+launchmode:play+gameinfo:cj3X93ruy_W1_A_MgQsFAR6ash_NXitAUEHHTCW2m_NOFI3mYoT8DSOZ4p6jAMCJTFgLN-b7n7Tztw7e8oQsIYdevbA51M44be0B3STS2PQz0ND6ihDKbEBzy6kDdkKdN38QX-oBeaivNbe2zdmlcwNbMV8Pqy50aMcqUiUadKtZAQw0UVrv5fyqh2dVqQVJjCnfGpRDwri4GORYBH49_ueT24V5hrxr5v7D420716U+launchtime:1727803800078+placelauncherurl:https%3A%2F%2Fwww.roblox.com%2FGame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D1727803617475009%26placeId%3D10449761463%26isPlayTogetherGame%3Dfalse%26joinAttemptId%3Dd57be06b-9b3e-4c2f-b426-3b1940314d81%26joinAttemptOrigin%3DPlayButton+browsertrackerid:1727803617475009+robloxLocale:en_us+gameLocale:en_us+channel:+LaunchExp:InApp1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
-
C:\Program Files (x86)\Roblox\Versions\version-b591875ddfbc4294\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-b591875ddfbc4294\RobloxPlayerBeta.exe" roblox-player:1+launchmode:play+gameinfo:KSpyo5-w3A6pnPyaxWHJUZmoPNGF8LDTRskcyYwBXOzQB2iTwrABnAbvzOOMABRWa70hcgIj_MpeJDyA3t7d21bHVEv6ZlM8mEcC5qOcJa-m575JTG4ZnvIqz8YktMqW55_rwEXB1suxzkkKnmYqxqXdyQyKIrRaIuKDlYEdYs26TiSyqpKh2f_MPwTJQACxlsugE1IE0FGLgkKfN-t0TmT_XzAaK1R60Q-DoMoFDus+launchtime:1727803800078+placelauncherurl:https%3A%2F%2Fwww.roblox.com%2FGame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D1727803617475009%26placeId%3D10449761463%26isPlayTogetherGame%3Dfalse%26joinAttemptId%3Dd57be06b-9b3e-4c2f-b426-3b1940314d81%26joinAttemptOrigin%3DPlayButton+browsertrackerid:1727803617475009+robloxLocale:en_us+gameLocale:en_us+channel:+LaunchExp:InApp1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
-
C:\Program Files (x86)\Roblox\Versions\version-b591875ddfbc4294\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-b591875ddfbc4294\RobloxPlayerBeta.exe" roblox-player:1+launchmode:play+gameinfo:RhnmhHb14kvJn8ZtPi1Fl2a3R1uPdSb2EBzyjvW4S2r3rEabNDVdnN3jHdisUoYiDhNVaEji9BctOYoS30a2HR3TnubYkuUqhXG_5rO61La6d8_xf4lHcwuELIWaqC1hsL_iwgtUjEevzoAKnFv359Ga4K1aNekGKyeRB_N7ka62VFrVAkj6cQos-FcGUfUlE6YtYF3SKEJmNKayROH3cSsEtUxagIdegHRtyMw-EDw+launchtime:1727803984021+placelauncherurl:https%3A%2F%2Fwww.roblox.com%2FGame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D1727803617475009%26placeId%3D10449761463%26isPlayTogetherGame%3Dfalse%26joinAttemptId%3De150f2d1-1f0f-4e1a-b82b-166842315964%26joinAttemptOrigin%3DPlayButton+browsertrackerid:1727803617475009+robloxLocale:en_us+gameLocale:en_us+channel:+LaunchExp:InApp1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{801236A0-DFAF-419D-8820-CB1E39224F88}\MicrosoftEdgeUpdateSetup_X86_1.3.195.19.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{801236A0-DFAF-419D-8820-CB1E39224F88}\MicrosoftEdgeUpdateSetup_X86_1.3.195.19.exe" /update /sessionid "{57929E9C-651E-40C1-99D3-7D9FC0D08DC4}"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Microsoft\Temp\EUFF98.tmp\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\Temp\EUFF98.tmp\MicrosoftEdgeUpdate.exe" /update /sessionid "{57929E9C-651E-40C1-99D3-7D9FC0D08DC4}"3⤵
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.19\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.19\MicrosoftEdgeUpdateComRegisterShell64.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.19\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.19\MicrosoftEdgeUpdateComRegisterShell64.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.19\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.19\MicrosoftEdgeUpdateComRegisterShell64.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMTkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NTc5MjlFOUMtNjUxRS00MEMxLTk5RDMtN0Q5RkMwRDA4REM0fSIgdXNlcmlkPSJ7OTIxRDVFMkYtRjhBMi00OUU2LTg2RUYtQkZGREU5QUFCNTFFfSIgaW5zdGFsbHNvdXJjZT0ic2VsZnVwZGF0ZSIgcmVxdWVzdGlkPSJ7NEJGRTg5MUItNjIzQy00N0JFLUI2Q0YtQTE0MzJEM0Q4QzE4fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O3I0NTJ0MStrMlRncS9IWHpqdkZOQlJob3BCV1I5c2JqWHhxZVVESDl1WDA9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0ie0YzQzRGRTAwLUVGRDUtNDAzQi05NTY5LTM5OEEyMEYxQkE0QX0iIHZlcnNpb249IjEuMy4xNzEuMzkiIG5leHR2ZXJzaW9uPSIxLjMuMTk1LjE5IiBsYW5nPSIiIGJyYW5kPSJJTkJYIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMCIgaW5zdGFsbGRhdGV0aW1lPSIxNzI3ODAzODI0Ij48ZXZlbnQgZXZlbnR0eXBlPSIzIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMjI1MTk4MTc1MSIvPjwvYXBwPjwvcmVxdWVzdD44⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
-
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NTc5MjlFOUMtNjUxRS00MEMxLTk5RDMtN0Q5RkMwRDA4REM0fSIgdXNlcmlkPSJ7OTIxRDVFMkYtRjhBMi00OUU2LTg2RUYtQkZGREU5QUFCNTFFfSIgaW5zdGFsbHNvdXJjZT0ic2NoZWR1bGVyIiByZXF1ZXN0aWQ9IntGMDVGNEU0QS04NjRBLTQwOTYtQkRFRi03NTQ4MDQxRUM3QjB9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7cjQ1MnQxK2syVGdxL0hYemp2Rk5CUmhvcEJXUjlzYmpYeHFlVURIOXVYMD0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE3MS4zOSIgbmV4dHZlcnNpb249IjEuMy4xOTUuMTkiIGxhbmc9IiIgYnJhbmQ9IklOQlgiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIwIj48dXBkYXRlY2hlY2svPjxldmVudCBldmVudHR5cGU9IjEyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMTkyODI5ODM1MyIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEzIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMTkyODMzODMxNCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjE0IiBldmVudHJlc3VsdD0iMCIgZXJyb3Jjb2RlPSItMjE0NzAyMzgzOCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTIyMzQzODI1MjAiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIGRvd25sb2FkZXI9ImRvIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuYi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy9mNjYxMjQ3Mi0zNzQ3LTRmYmMtYTBhNS02ODM4OWE2YjY3M2U_UDE9MTcyODQwODkyNyZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1WYW1LMTk2N3VvaWhxQWFocDJ3M3pMQTN3UXE3cWJxcVNYWVN3YkdIR3ZseFZNQ1ZEZ2tVa3Q0YmduamtqOFI3YjRGeXY2TUdaRGVyZDJMZzdvYzBDZyUzZCUzZCIgc2VydmVyX2lwX2hpbnQ9IiIgY2RuX2NpZD0iLTEiIGNkbl9jY2M9IiIgY2RuX21zZWRnZV9yZWY9IiIgY2RuX2F6dXJlX3JlZl9vcmlnaW5fc2hpZWxkPSIiIGNkbl9jYWNoZT0iIiBjZG5fcDNwPSIiIGRvd25sb2FkZWQ9IjAiIHRvdGFsPSIwIiBkb3dubG9hZF90aW1lX21zPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTQiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjEyMjM0MzgyNTIwIiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuYi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy9mNjYxMjQ3Mi0zNzQ3LTRmYmMtYTBhNS02ODM4OWE2YjY3M2U_UDE9MTcyODQwODkyNyZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1WYW1LMTk2N3VvaWhxQWFocDJ3M3pMQTN3UXE3cWJxcVNYWVN3YkdIR3ZseFZNQ1ZEZ2tVa3Q0YmduamtqOFI3YjRGeXY2TUdaRGVyZDJMZzdvYzBDZyUzZCUzZCIgc2VydmVyX2lwX2hpbnQ9IiIgY2RuX2NpZD0iLTEiIGNkbl9jY2M9IiIgY2RuX21zZWRnZV9yZWY9IiIgY2RuX2F6dXJlX3JlZl9vcmlnaW5fc2hpZWxkPSIiIGNkbl9jYWNoZT0iIiBjZG5fcDNwPSIiIGRvd25sb2FkZWQ9IjE2MzQ4ODgiIHRvdGFsPSIxNjM0ODg4IiBkb3dubG9hZF90aW1lX21zPSIyNjM3NSIvPjxldmVudCBldmVudHR5cGU9IjE0IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMjIzNDM4MjUyMCIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjE1IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMjIzOTUyOTAyMSIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxwaW5nIHI9IjYwIiByZD0iNjQyMyIgcGluZ19mcmVzaG5lc3M9IntDRTA5RUVBNC0zRjY4LTREOTctOEM2NS04ODQ4RjJCRDc3MjB9Ii8-PC9hcHA-PGFwcCBhcHBpZD0iezU2RUIxOEY4LUIwMDgtNENCRC1CNkQyLThDOTdGRTdFOTA2Mn0iIHZlcnNpb249IjkyLjAuOTAyLjY3IiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSJJTkJYIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNvbnNlbnQ9ZmFsc2UiIGxhc3RfbGF1bmNoX3RpbWU9IjEzMzY3MDc5ODQ2NDgyNzc5MCI-PHVwZGF0ZWNoZWNrLz48cGluZyBhY3RpdmU9IjEiIGE9Ii0xIiByPSI2MCIgYWQ9Ii0xIiByZD0iNjQyMyIgcGluZ19mcmVzaG5lc3M9IntEOThDRThFQy01RkI1LTQ5Q0MtQjY0Qi1BREJBQTg2QjM2NkJ9Ii8-PC9hcHA-PGFwcCBhcHBpZD0ie0YzMDE3MjI2LUZFMkEtNDI5NS04QkRGLTAwQzNBOUE3RTRDNX0iIHZlcnNpb249IjEyOS4wLjI3OTIuNjUiIG5leHR2ZXJzaW9uPSIiIGxhbmc9IiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIwIiBpbnN0YWxsZGF0ZT0iNjQ4MiI-PHVwZGF0ZWNoZWNrLz48cGluZyByPSItMSIgcmQ9Ii0xIiBwaW5nX2ZyZXNobmVzcz0ie0Y5M0I0NzdFLTcyNzUtNDcyRi04RTM2LUQzMTVFNEVDOTY3Mn0iLz48L2FwcD48L3JlcXVlc3Q-2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1956 -parentBuildID 20240401114208 -prefsHandle 1872 -prefMapHandle 1860 -prefsLen 24856 -prefMapSize 245077 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d61042b6-8713-4653-820b-6222848b235e} 4588 "\\.\pipe\gecko-crash-server-pipe.4588" gpu3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2312 -parentBuildID 20240401114208 -prefsHandle 2292 -prefMapHandle 2288 -prefsLen 24856 -prefMapSize 245077 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8b9d6651-b6da-43c1-9d4d-7aea243516d0} 4588 "\\.\pipe\gecko-crash-server-pipe.4588" socket3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3084 -childID 1 -isForBrowser -prefsHandle 3076 -prefMapHandle 3068 -prefsLen 25355 -prefMapSize 245077 -jsInitHandle 1228 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ffbbfd14-c372-4bda-ac1e-b861e8c5bf53} 4588 "\\.\pipe\gecko-crash-server-pipe.4588" tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3716 -childID 2 -isForBrowser -prefsHandle 3640 -prefMapHandle 3636 -prefsLen 30588 -prefMapSize 245077 -jsInitHandle 1228 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {028862f6-d3f8-4009-87f2-34717c3ee889} 4588 "\\.\pipe\gecko-crash-server-pipe.4588" tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4340 -childID 3 -isForBrowser -prefsHandle 4328 -prefMapHandle 4320 -prefsLen 27920 -prefMapSize 245077 -jsInitHandle 1228 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b680b725-f380-4635-81c5-ff6fc80e35f0} 4588 "\\.\pipe\gecko-crash-server-pipe.4588" tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5092 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 5084 -prefMapHandle 5080 -prefsLen 30642 -prefMapSize 245077 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b165b704-9b1d-45be-adb8-3e5476742cb7} 4588 "\\.\pipe\gecko-crash-server-pipe.4588" utility3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5348 -childID 4 -isForBrowser -prefsHandle 5340 -prefMapHandle 5316 -prefsLen 27974 -prefMapSize 245077 -jsInitHandle 1228 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5a63e6f3-6759-45d9-8883-378883034c85} 4588 "\\.\pipe\gecko-crash-server-pipe.4588" tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5504 -childID 5 -isForBrowser -prefsHandle 5512 -prefMapHandle 5516 -prefsLen 27974 -prefMapSize 245077 -jsInitHandle 1228 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {07941cae-c4ad-4426-977b-5c925d36057f} 4588 "\\.\pipe\gecko-crash-server-pipe.4588" tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5716 -childID 6 -isForBrowser -prefsHandle 5796 -prefMapHandle 5792 -prefsLen 27974 -prefMapSize 245077 -jsInitHandle 1228 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a749435a-5a23-4956-b92b-220fa2384000} 4588 "\\.\pipe\gecko-crash-server-pipe.4588" tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4336 -childID 7 -isForBrowser -prefsHandle 6048 -prefMapHandle 6044 -prefsLen 27974 -prefMapSize 245077 -jsInitHandle 1228 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c691fd77-1af7-429a-a39e-9fb715ea2ee5} 4588 "\\.\pipe\gecko-crash-server-pipe.4588" tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5484 -childID 8 -isForBrowser -prefsHandle 5340 -prefMapHandle 6120 -prefsLen 27974 -prefMapSize 245077 -jsInitHandle 1228 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {64949871-e797-48a3-9d61-43cf52e67dfe} 4588 "\\.\pipe\gecko-crash-server-pipe.4588" tab3⤵
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Privilege Escalation
Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Defense Evasion
Modify Registry
1Subvert Trust Controls
1SIP and Trust Provider Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
setup.exe
MicrosoftEdgeUpdateSetup_X86_1.3.195.19.exe
EdgeUpdate.dat
MicrosoftEdgeComRegisterShellARM64.exe
MicrosoftEdgeUpdate.exe
MicrosoftEdgeUpdateComRegisterShell64.exe
MicrosoftEdgeUpdateCore.exe
NOTICE.TXT
msedgeupdate.dll
msedgeupdateres_af.dll
msedgeupdateres_am.dll
msedgeupdateres_ar.dll
msedgeupdateres_as.dll
msedgeupdateres_az.dll
msedgeupdateres_bg.dll
msedgeupdateres_bn-IN.dll
msedgeupdateres_bn.dll
msedgeupdateres_bs.dll
msedgeupdateres_ca-Es-VALENCIA.dll
msedgeupdateres_ca.dll
msedgeupdateres_cs.dll
msedgeupdateres_cy.dll
msedgeupdateres_da.dll
msedgeupdateres_de.dll
msedgeupdateres_el.dll
msedgeupdateres_en-GB.dll
msedgeupdateres_en.dll
msedgeupdateres_es-419.dll
msedgeupdateres_es.dll
msedgeupdateres_et.dll
msedgeupdateres_eu.dll
msedgeupdateres_fa.dll
msedgeupdateres_fi.dll
msedgeupdateres_fil.dll
msedgeupdateres_fr-CA.dll
msedgeupdateres_fr.dll
msedgeupdateres_ga.dll
RobloxStudioInstaller.exe
MicrosoftEdgeWebview2Setup.exe
settings.dat
MicrosoftEdgeUpdate.log
BrowsingTopicsState
f_000027
temp-index
the-real-index
the-real-index
the-real-index
data_1
History
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Web Data
Local State
Local State
Local State
Local State
activity-stream.discovery_stream.json
00D6B0E5958DF4AF0968A15074BC03A1DC892F30
016913BA7B05A679F9EFA5825600235441746744
03C1F3F4F222DC5120E566E4BA9C62B01E06D091
04F92C88D33901EEA1AAD9FE100FE11942519486
050DB43D78BBC79DCD9ADCBAE96500FE04597F1B
05100C8AF21A928E2920217153928769DDB7F8AD
05EB7F6F7BD0BA633716511CCCAD442933622565
068A3A96EC032C22A349BAE52497641E92DA7515
06B2D42CB93368C4D4D97B3CD5EB9374FDDF7752
07FA863FA14461482E37ACC5215560354870582A
1AB33D663B69F4F748A08F27D06DE9DC07B327E9
1C839D66DEAFDA9CE07655EBA808CF615F66555F
1FE0B57A685DFEB6ACA8D69D99ED4804714DB95D
21C8CD9938527219612CA24A77FD201A5B81B078
298291000E9E051277F312693BC07DB3712635F7
2B61971F12CF060DC441BEA2850BCD7F96F1A804
2D8B1A13BF4DE864309FD52B7BF93789A675C733
2E2D8A13C9AD336EB00270C6BBF1843E326C5882
311B843A109C64834DE101DDA55B857486A6B0C8
36BCFA23A4D04A528CE70EF12214E3995E132134
37AAE6F2172EBB8F25AAB227C7FE49403DC4BEA7
3880E07D7216EA6B15D621AA35EA5FA1D0B4B5A0
3896912459F64B9A13CCCD354A2DFBAFC4C1D661
3955CD93FFC8BA5F29E3D5DA6400592EB90053B7
3B9C0557257282CD5F41471F9C2DA8856005FB8A
3CD97724EBF47B50AE59221DC942CCA5EE96ED82
459EB2C057D3A6940F667A61E9B3F27E91315574
4C11E373FD9A73A5E61FCB5291518B290C3C15DF
4D01340C85764E13C0E60E2C62CCB49A6D574812
4E3562C55341939E493011A1EC297C2A4CAF51DB
50A53A469E94FDF78A991C985E66686B6CC9299A
5530DA1BB01649473DC5DDDC6BA5EA28D635596F
55E5E6FB4DA0D621CA2B27FEAF7A867987DF935E
563152B025C0071A4502D05BBB1DC8D01774ACBC
5D8FDF6A6DF739443A5E8DA378B47AA260645E7E
6128A90FB718F76505A88D30EA769DD161A51BDF
6383DC9DB88039BF5A66FA8D61060FFBC424C523
654B47743CE7C3F27A37B225DCE5D885AC5881B3
6B995C7CA46FC5BA0EFF9F15DA86A8CAE4C276DF
72EDAEEF94FF7EF4868AF706BF853B8B43564282
739025F062E977A263D0043D9E01EE529DEBBEB9
73CA817BB3D004E0BE60DF2D5A29826C81C0EFBD
7F2AC10C254324DB13A43073F42F4B22ED50003A
8379020E8E292C5ADAE031B60B29B6B63472FD81
8AEA98E6A5C3843656F9A7384B0CE6A407863C71
8BD25BADB9DB6CC6016A3D6596645CC78E76A928
903E00CC0EDD76D57ACCBDEC95CE0B3E8C2B9C11
90810C5D7579CC4A2411949C3DEC2653A8D018CB
939FA5E2BE4B34B7BB95DD85C5ACBE72410F47B9
96A0D2F1C4ECD10450EA183542E05ADB3BBB4257
96CFB6C60F6AD3958CED13B271F49EA828A11337
9C29916B899C579DE3BA8409A772D155B031D381
9EDDE97788CACC56ABA00198C652A4D069AD3A56
A010627ADB95654204C32312D1B03C7B74BDB7AB
A6191CBEB8D5732B61FC9F9A0156702BD0955447
AC5B4849CAB26A6FF5E0D69715FFD2D5203EA01F
B5D9B00549A67C5E8FDA11F8BBFCECEDD00925E6
B893D56D1F82A20D2F23D3734F1220547F72F891
BAFDDE617A8EDA829976871BD14D04FF5894C364
BB9D15CB3835A7362B987DC310B1D177306BE789
BE2D3D60C4D6C94AEDAA7868122CCB76EF5AA608
C20E036239CAF315DF30D2CDAAC4F746820BB89D
C5AB48463E6F61FBBEEB079726C45131FD223F4E
CE9427DFAE14BFB3F2CAB7541316CEA7917D3BC8
CFBD8C231D7FFCB5CCA354F8BB793277A96DA560
D088C90E1D577CEADCA2AD46DAAA7DC02250939E
D1F852896F5C52204F9C5B5F29F7C57365248D0F
DA784CCDD74E697C1B9356166222C06487BCEA54
DE7D7B883741BA04A35F2B5F56DD0DD64B88099A
DF8438B5C265F1562FE022BFB3BA5C636E4B98AA
E0F388085FB5A8BDBB2A40970D57F8075D06F7F2
E5607FBB87A2DD13F75CB818E83D5B853439AC72
EB7FC83A937E0927C23C877A8AA8D80CB3DFE669
F060C2FA2F1C65DBA3E8DD1E22BAA7760F2549F4
F18CB48C0E207EEFF19C3710CA8433EC5E623A4A
F1B03DDB567CC1872795B677722429A09240B179
F1B5681EF833A243E3EC96758FAF4261671554B2
F27E0CDCD1C7E6F6CED7F2BE71ED722173C6CCAB
F56347BF2186A4A0B010C3EBAFF9B6EB6C40C8CD
FFFE77BB2A3A1B950B75A654649A67BDDB5E42B4
sXPXZqvgRT+UaE4rgloTOS7vEcQ4dYQ_ZtLNjVIk5iQ=.ico
webext.sc.lz4
3fb493bf3ab76f597b24810fd5e185e5
tmpaddon
tmpaddon-1
6824f4a902c78fbd.customDestinations-ms
6824f4a902c78fbd.customDestinations-ms
98NALT1PCHIPEJNL25R7.temp
AlternateServices.bin
AlternateServices.bin
AlternateServices.bin
SiteSecurityServiceState.bin
broadcast-listeners.json
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
13c246dd-8bd4-4f8b-ba90-13b22b15f491
6d275f4a-0f8a-4116-a6a9-e80bb07d258b
756e6a85-9ca5-4d60-a850-a4e8304c1431
dfb72d21-c363-4c19-a9f5-988ab077011a
ef91711d-5349-49ed-ac80-6da2c1acb7dd
fad46d68-6c96-4028-8b6c-9e0443558d3b
fc0ad45f-e847-46bb-8e41-3fec838bb467
gmpopenh264.dll
gmpopenh264.info
manifest.json
widevinecdm.dll
prefs-1.js
prefs-1.js
prefs-1.js
prefs.js
prefs.js
sessionCheckpoints.json
sessionCheckpoints.json
recovery.baklz4
recovery.baklz4
recovery.baklz4
recovery.baklz4
recovery.baklz4
recovery.baklz4
recovery.baklz4
recovery.baklz4
recovery.baklz4
recovery.baklz4
recovery.baklz4
recovery.baklz4
recovery.baklz4
recovery.baklz4
recovery.baklz4
3140325527hBbDa.sqlite
usage
3870112724rsegmnoittet-es.sqlite
RobloxPlayerInstaller.PD_9EaOU.exe.part
memory/2068-4180-0x00007FFFB9AE0000-0x00007FFFB9B10000-memory.dmp
memory/2068-4193-0x00007FFFBA440000-0x00007FFFBA450000-memory.dmp
memory/2068-4192-0x00007FFFBA440000-0x00007FFFBA450000-memory.dmp
memory/2068-4190-0x00007FFFBACF0000-0x00007FFFBACFE000-memory.dmp
memory/2068-4189-0x00007FFFBACF0000-0x00007FFFBACFE000-memory.dmp
memory/2068-4188-0x00007FFFBACF0000-0x00007FFFBACFE000-memory.dmp
memory/2068-4187-0x00007FFFBACF0000-0x00007FFFBACFE000-memory.dmp
memory/2068-4186-0x00007FFFBAC40000-0x00007FFFBAC50000-memory.dmp
memory/2068-4185-0x00007FFFBAC40000-0x00007FFFBAC50000-memory.dmp
memory/2068-4182-0x00007FFFB9AE0000-0x00007FFFB9B10000-memory.dmp
memory/2068-4181-0x00007FFFB9AE0000-0x00007FFFB9B10000-memory.dmp
memory/2068-4194-0x00007FFFBA460000-0x00007FFFBA46B000-memory.dmp
memory/2068-4179-0x00007FFFB9970000-0x00007FFFB9980000-memory.dmp
memory/2068-4178-0x00007FFFB9970000-0x00007FFFB9980000-memory.dmp
memory/2068-4177-0x00007FFFB9860000-0x00007FFFB9870000-memory.dmp
memory/2068-4176-0x00007FFFB9860000-0x00007FFFB9870000-memory.dmp
memory/2068-4172-0x00007FFFBBCC0000-0x00007FFFBBCD0000-memory.dmp
memory/2068-4171-0x00007FFFBBCC0000-0x00007FFFBBCD0000-memory.dmp
memory/2068-4170-0x00007FFFBBCA0000-0x00007FFFBBCB0000-memory.dmp
memory/2068-4169-0x00007FFFBBCA0000-0x00007FFFBBCB0000-memory.dmp
memory/2068-4168-0x00007FFFBBC10000-0x00007FFFBBC20000-memory.dmp
memory/2068-4167-0x00007FFFBBC10000-0x00007FFFBBC20000-memory.dmp
memory/2068-4162-0x00007FFFBC030000-0x00007FFFBC060000-memory.dmp
memory/2068-4163-0x00007FFFBC030000-0x00007FFFBC060000-memory.dmp
memory/2068-4160-0x00007FFFBBFE0000-0x00007FFFBBFF0000-memory.dmp
memory/2068-4159-0x00007FFFBBFE0000-0x00007FFFBBFF0000-memory.dmp
memory/2068-4158-0x00007FFFBBED0000-0x00007FFFBBEE0000-memory.dmp
memory/2068-4157-0x00007FFFBBED0000-0x00007FFFBBEE0000-memory.dmp
memory/2068-4195-0x00007FFFBA460000-0x00007FFFBA46B000-memory.dmp
memory/2068-4196-0x00007FFFBA460000-0x00007FFFBA46B000-memory.dmp
memory/2068-4197-0x00007FFFBA460000-0x00007FFFBA46B000-memory.dmp
memory/2068-4198-0x00007FFFBA460000-0x00007FFFBA46B000-memory.dmp
memory/2068-4199-0x00007FFFB9DC0000-0x00007FFFB9DD0000-memory.dmp
memory/2068-4200-0x00007FFFB9DC0000-0x00007FFFB9DD0000-memory.dmp
memory/2068-4201-0x00007FFFB9EC0000-0x00007FFFB9ED0000-memory.dmp
memory/2068-4202-0x00007FFFB9EC0000-0x00007FFFB9ED0000-memory.dmp
memory/2068-4203-0x00007FFFB9EF0000-0x00007FFFB9F16000-memory.dmp
memory/2068-4191-0x00007FFFBACF0000-0x00007FFFBACFE000-memory.dmp
memory/2068-4183-0x00007FFFB9AE0000-0x00007FFFB9B10000-memory.dmp
memory/2068-4184-0x00007FFFB9AE0000-0x00007FFFB9B10000-memory.dmp
memory/2068-4173-0x00007FFFBBCC0000-0x00007FFFBBCD0000-memory.dmp
memory/2068-4174-0x00007FFFBBCC0000-0x00007FFFBBCD0000-memory.dmp
memory/2068-4175-0x00007FFFBBCC0000-0x00007FFFBBCD0000-memory.dmp
memory/2068-4165-0x00007FFFBC030000-0x00007FFFBC060000-memory.dmp
memory/2068-4166-0x00007FFFBC0C0000-0x00007FFFBC0C5000-memory.dmp
memory/2068-4164-0x00007FFFBC030000-0x00007FFFBC060000-memory.dmp
memory/2068-4161-0x00007FFFBC030000-0x00007FFFBC060000-memory.dmp
memory/4860-4152-0x0000000000B10000-0x0000000000B45000-memory.dmp
memory/4860-4087-0x0000000074100000-0x0000000074310000-memory.dmp
memory/4860-4006-0x0000000000B10000-0x0000000000B45000-memory.dmp
memory/4860-4007-0x0000000074100000-0x0000000074310000-memory.dmp