Analysis
- max time kernel
1062s - max time network
1077s - platform
windows11-21h2_x64 - resource
win11-20241007-en - resource tags
- submitted
11/11/2024, 18:42
General
- Target http://mbta.com
- Sample241111-xcfamstemc
Score
8/10
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Downloads MZ/PE file
- Event Triggered Execution: Image File Execution Options Injection 1 TTPs 4 IoCs
- A potential corporate email address has been identified in the URL: search-insights@1
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 64 IoCs
- Loads dropped DLL 64 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 6 IoCs
- Drops desktop.ini file(s) 1 IoCs
- Enumerates connected drives 3 TTPs 6 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Installs/modifies Browser Helper Object 2 TTPs 8 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
- Network Service Discovery 1 TTPs 3 IoCs
Attempt to gather information on host's network.
- Network Share Discovery 1 TTPs
Attempt to gather information on host network.
- Checks system information in the registry 2 TTPs 28 IoCs
System information is often read in order to detect sandboxing environments.
- Detected potential entity reuse from brand STEAM.
- Drops file in System32 directory 1 IoCs
- Suspicious use of NtCreateThreadExHideFromDebugger 4 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 64 IoCs
- Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 2 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 24 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 7 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Checks processor information in registry 2 TTPs 18 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 26 IoCs
- Modifies Internet Explorer settings 1 TTPs 40 IoCs
- Modifies data under HKEY_USERS 64 IoCs
- Modifies registry class 64 IoCs
- NTFS ADS 2 IoCs
- Suspicious behavior: AddClipboardFormatListener 4 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 3 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 45 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 36 IoCs
- Suspicious use of SetWindowsHookEx 21 IoCs
- Suspicious use of UnmapMainImage 4 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- System policy modification 1 TTPs 6 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://mbta.com1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa0860cc40,0x7ffa0860cc4c,0x7ffa0860cc582⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1888,i,6145962481184430073,16052153610893545906,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1884 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2228,i,6145962481184430073,16052153610893545906,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2224 /prefetch:32⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2104,i,6145962481184430073,16052153610893545906,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2280 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3000,i,6145962481184430073,16052153610893545906,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3028 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3016,i,6145962481184430073,16052153610893545906,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3056 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4084,i,6145962481184430073,16052153610893545906,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3508 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4552,i,6145962481184430073,16052153610893545906,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4584 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4624,i,6145962481184430073,16052153610893545906,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4636 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4788,i,6145962481184430073,16052153610893545906,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4852 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=4924,i,6145962481184430073,16052153610893545906,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3676 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=736,i,6145962481184430073,16052153610893545906,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4896 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=3472,i,6145962481184430073,16052153610893545906,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4992 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5360,i,6145962481184430073,16052153610893545906,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5388 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5392,i,6145962481184430073,16052153610893545906,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5524 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5088,i,6145962481184430073,16052153610893545906,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3468 /prefetch:82⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
-
-
C:\Users\Admin\Downloads\RobloxStudioInstaller.exe"C:\Users\Admin\Downloads\RobloxStudioInstaller.exe"2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Roblox\Versions\version-7cc6d2bdac2f4837\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exeMicrosoftEdgeWebview2Setup.exe /silent /install3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Microsoft\Temp\EU2CC3.tmp\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\Temp\EU2CC3.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"4⤵
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RTgzNDQwMDAtNjgwRS00N0MwLTlCMkItNEVBQzI3MzcxNTkxfSIgdXNlcmlkPSJ7NjkzMkI0NjQtODI2MC00RUFCLUJERjgtODVFQzBDRDcwRTk0fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntFRDJEN0NERC1EMERCLTQ5MTYtQkFBMi1CNDBEQzZFNzM2Qjd9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjIyMDAwLjQ5MyIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSIiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE0My41NyIgbmV4dHZlcnNpb249IjEuMy4xNzEuMzkiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjU3MzkwNjM1OTIiIGluc3RhbGxfdGltZV9tcz0iNjE2Ii8-PC9hcHA-PC9yZXF1ZXN0Pg5⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{E8344000-680E-47C0-9B2B-4EAC27371591}" /silent5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Program Files (x86)\Roblox\Versions\version-7cc6d2bdac2f4837\RobloxStudioBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-7cc6d2bdac2f4837\RobloxStudioBeta.exe" -startEvent www.roblox.com/robloxQTStudioStartedEvent -firstLaunch3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Enumerates connected drives
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Roblox\Versions\version-7cc6d2bdac2f4837\RobloxCrashHandler.exe"C:\Program Files (x86)\Roblox\Versions\version-7cc6d2bdac2f4837\RobloxCrashHandler.exe" --no-rate-limit --crashCounter Win-ROBLOXStudio-Crash --baseUrl https://www.roblox.com --attachment=attachment_0.649.0.6490878_20241111T184548Z_Studio_B42FE_last.log=C:\Users\Admin\AppData\Local\Roblox\logs\0.649.0.6490878_20241111T184548Z_Studio_B42FE_last.log --attachment=attachment_log_0.649.0.6490878_20241111T184548Z_Studio_B42FE_csg3.log=C:\Users\Admin\AppData\Local\Roblox\logs\log_0.649.0.6490878_20241111T184548Z_Studio_B42FE_csg3.log --attachment=attachment_log_0.649.0.6490878_20241111T184548Z_Studio_B42FE_dcd.log=C:\Users\Admin\AppData\Local\Roblox\logs\log_0.649.0.6490878_20241111T184548Z_Studio_B42FE_dcd.log --database=C:\Users\Admin\AppData\Local\Roblox\logs\crashes --metrics-dir=C:\Users\Admin\AppData\Local\Roblox\logs\crashes --url=https://upload.crashes.rbxinfra.com/post?format=minidump --annotation=AppVersion=0.649.0.6490878 --annotation=Format=minidump --annotation=HardwareModel= --annotation=HasBootstrapper=true --annotation=InstallFolder=ProgramFilesX86 --annotation=OSPlatform=Windows --annotation=RobloxChannel=production --annotation=RobloxGitHash=3891290f7ec8b14511dd09a88bb53740fbfe3768 --annotation=RobloxProduct=RobloxStudio --annotation=StudioVersion=0.649.0.6490878 --annotation=UniqueId=1413958567286727152 --annotation=UseCrashpad=True --annotation=app_arch=x86_64 --annotation=application.version=0.649.0.6490878 --annotation=host_arch=x86_64 --initial-client-data=0x5e8,0x5ec,0x5f0,0x54c,0x5dc,0x7ff6115fb2a8,0x7ff6115fb2c0,0x7ff6115fb2d84⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 649, 0, 6490878" --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --mojo-named-platform-channel-pipe=4668.5108.50820377348299819064⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- System policy modification
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=130.0.6723.117 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=130.0.2849.80 --initial-client-data=0x17c,0x180,0x184,0x158,0x190,0x7ff9ef5f4dc0,0x7ff9ef5f4dcc,0x7ff9ef5f4dd85⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe" --type=gpu-process --string-annotations=is-enterprise-managed=no --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 649, 0, 6490878" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1788,i,8816178924916554833,3304835965907721709,262144 --variations-seed-version --mojo-platform-channel-handle=1784 /prefetch:25⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations=is-enterprise-managed=no --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 649, 0, 6490878" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=2044,i,8816178924916554833,3304835965907721709,262144 --variations-seed-version --mojo-platform-channel-handle=2052 /prefetch:115⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations=is-enterprise-managed=no --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 649, 0, 6490878" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=2272,i,8816178924916554833,3304835965907721709,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:135⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe" --type=renderer --string-annotations=is-enterprise-managed=no --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 649, 0, 6490878" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --field-trial-handle=3560,i,8816178924916554833,3304835965907721709,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:15⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe" --type=renderer --string-annotations=is-enterprise-managed=no --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 649, 0, 6490878" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --field-trial-handle=3572,i,8816178924916554833,3304835965907721709,262144 --variations-seed-version --mojo-platform-channel-handle=3968 /prefetch:15⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe" --type=renderer --string-annotations=is-enterprise-managed=no --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 649, 0, 6490878" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --field-trial-handle=3584,i,8816178924916554833,3304835965907721709,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:15⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 649, 0, 6490878" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=5028,i,8816178924916554833,3304835965907721709,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:125⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 649, 0, 6490878" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=5036,i,8816178924916554833,3304835965907721709,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:145⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 649, 0, 6490878" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=5164,i,8816178924916554833,3304835965907721709,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:145⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 649, 0, 6490878" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=5348,i,8816178924916554833,3304835965907721709,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:145⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 649, 0, 6490878" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=5436,i,8816178924916554833,3304835965907721709,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:145⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 649, 0, 6490878" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=5520,i,8816178924916554833,3304835965907721709,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:145⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 649, 0, 6490878" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=4616,i,8816178924916554833,3304835965907721709,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:145⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 649, 0, 6490878" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=5596,i,8816178924916554833,3304835965907721709,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:145⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations=is-enterprise-managed=no --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 649, 0, 6490878" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=5604,i,8816178924916554833,3304835965907721709,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:105⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 649, 0, 6490878" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=2828,i,8816178924916554833,3304835965907721709,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:145⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 649, 0, 6490878" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=5492,i,8816178924916554833,3304835965907721709,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:145⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe" --type=renderer --string-annotations=is-enterprise-managed=no --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 649, 0, 6490878" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --field-trial-handle=3940,i,8816178924916554833,3304835965907721709,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:15⤵
- Executes dropped EXE
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.roblox.com/account/signupredir?ReturnUrl=https%3A%2F%2Fapis.roblox.com%2Foauth%2Fv1%2Fauthorize%3Fclient_id%3D7968549422692352298%26response_type%3Dcode%26redirect_uri%3Droblox-studio-auth%253a%252f%26scope%3Dopenid%2Bcredentials%2Bprofile%2Bage%2Broles%2Bpremium%26state%3DeyJyYW5kb21fc3RyaW5nIjoiOV93ZDFEdFhjd0prU2taRW5mVVh0cFhfTVRydkJkem1FakkxMmc2ald2QSIsInBpZCI6IjQ2NjgifQ%253d%253d%26nonce%3Did-roblox%26code_challenge%3DF6P-4U0OPjaWVy8r6BEQBuM_1t7zA8bcA81Yz20z4Jk%26code_challenge_method%3DS256%26rlt%3DexBs13Vhlz0fO4SV-5db8Y62RomG8f6YeHZjyBHXceZbFFhOASzQda-DFGiHYsCEyAq5s0cQMDVg61tEYNjaMjFfVZTD8IOlZ7AWz6zpYFkf4d4gVR0GYWybHcm6FVYd45xr-S6Jva0SrHshs15e6w4⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ff9f3a43cb8,0x7ff9f3a43cc8,0x7ff9f3a43cd85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1976,4892955465601614862,11543089276638191555,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2044 /prefetch:25⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1976,4892955465601614862,11543089276638191555,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:35⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1976,4892955465601614862,11543089276638191555,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2000 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,4892955465601614862,11543089276638191555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,4892955465601614862,11543089276638191555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3452 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,4892955465601614862,11543089276638191555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4924 /prefetch:15⤵
-
-
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5908,i,6145962481184430073,16052153610893545906,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5640 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=6032,i,6145962481184430073,16052153610893545906,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6084 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=5976,i,6145962481184430073,16052153610893545906,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6240 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=6376,i,6145962481184430073,16052153610893545906,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6416 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=6200,i,6145962481184430073,16052153610893545906,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6000 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --field-trial-handle=6064,i,6145962481184430073,16052153610893545906,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6100 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=4792,i,6145962481184430073,16052153610893545906,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5164 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --field-trial-handle=5984,i,6145962481184430073,16052153610893545906,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6444 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --field-trial-handle=6424,i,6145962481184430073,16052153610893545906,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6272 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --field-trial-handle=6556,i,6145962481184430073,16052153610893545906,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6240 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --field-trial-handle=6344,i,6145962481184430073,16052153610893545906,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5952 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-appcompat-clear --field-trial-handle=6756,i,6145962481184430073,16052153610893545906,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6664 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=6784,i,6145962481184430073,16052153610893545906,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3104 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --field-trial-handle=3064,i,6145962481184430073,16052153610893545906,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1416 /prefetch:12⤵
-
-
C:\Program Files (x86)\Roblox\Versions\version-7cc6d2bdac2f4837\RobloxStudioBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-7cc6d2bdac2f4837\RobloxStudioBeta.exe" roblox-studio:1+launchtime:1731351065923+avatar+browsertrackerid:1731350872097002+robloxLocale:en-US+gameLocale:en-US+channel:+browser:chrome+userId:+distributorType:Global+launchmode:edit+task:Default2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Enumerates connected drives
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Roblox\Versions\version-7cc6d2bdac2f4837\RobloxCrashHandler.exe"C:\Program Files (x86)\Roblox\Versions\version-7cc6d2bdac2f4837\RobloxCrashHandler.exe" --no-rate-limit --crashCounter Win-ROBLOXStudio-Crash --baseUrl https://www.roblox.com --attachment=attachment_0.649.0.6490878_20241111T185109Z_Studio_74B51_last.log=C:\Users\Admin\AppData\Local\Roblox\logs\0.649.0.6490878_20241111T185109Z_Studio_74B51_last.log --attachment=attachment_log_0.649.0.6490878_20241111T185109Z_Studio_74B51_csg3.log=C:\Users\Admin\AppData\Local\Roblox\logs\log_0.649.0.6490878_20241111T185109Z_Studio_74B51_csg3.log --attachment=attachment_log_0.649.0.6490878_20241111T185109Z_Studio_74B51_dcd.log=C:\Users\Admin\AppData\Local\Roblox\logs\log_0.649.0.6490878_20241111T185109Z_Studio_74B51_dcd.log --database=C:\Users\Admin\AppData\Local\Roblox\logs\crashes --metrics-dir=C:\Users\Admin\AppData\Local\Roblox\logs\crashes --url=https://upload.crashes.rbxinfra.com/post?format=minidump --annotation=AppVersion=0.649.0.6490878 --annotation=Format=minidump --annotation=HardwareModel= --annotation=HasBootstrapper=true --annotation=InstallFolder=ProgramFilesX86 --annotation=OSPlatform=Windows --annotation=RobloxChannel=production --annotation=RobloxGitHash=3891290f7ec8b14511dd09a88bb53740fbfe3768 --annotation=RobloxProduct=RobloxStudio --annotation=StudioVersion=0.649.0.6490878 --annotation=UniqueId=2855671347938787255 --annotation=UseCrashpad=True --annotation=app_arch=x86_64 --annotation=application.version=0.649.0.6490878 --annotation=host_arch=x86_64 --initial-client-data=0x5c4,0x5c8,0x5cc,0x52c,0x5d4,0x7ff6115fb2a8,0x7ff6115fb2c0,0x7ff6115fb2d83⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 649, 0, 6490878" --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --mojo-named-platform-channel-pipe=5932.7020.150568840102292004373⤵
- Executes dropped EXE
- Checks system information in the registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- System policy modification
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=130.0.6723.117 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=130.0.2849.80 --initial-client-data=0x164,0x168,0x16c,0x140,0x19c,0x7ff9ef5f4dc0,0x7ff9ef5f4dcc,0x7ff9ef5f4dd84⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe" --type=gpu-process --string-annotations=is-enterprise-managed=no --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 649, 0, 6490878" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1716,i,6434429329080797809,9205737776219652787,262144 --variations-seed-version --mojo-platform-channel-handle=1704 /prefetch:24⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations=is-enterprise-managed=no --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 649, 0, 6490878" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=1784,i,6434429329080797809,9205737776219652787,262144 --variations-seed-version --mojo-platform-channel-handle=1772 /prefetch:114⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations=is-enterprise-managed=no --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 649, 0, 6490878" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=2256,i,6434429329080797809,9205737776219652787,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:134⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe" --type=renderer --string-annotations=is-enterprise-managed=no --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 649, 0, 6490878" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --field-trial-handle=3536,i,6434429329080797809,9205737776219652787,262144 --variations-seed-version --mojo-platform-channel-handle=3736 /prefetch:14⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe" --type=renderer --string-annotations=is-enterprise-managed=no --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 649, 0, 6490878" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --field-trial-handle=1488,i,6434429329080797809,9205737776219652787,262144 --variations-seed-version --mojo-platform-channel-handle=4064 /prefetch:14⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe" --type=renderer --string-annotations=is-enterprise-managed=no --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 649, 0, 6490878" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --field-trial-handle=3816,i,6434429329080797809,9205737776219652787,262144 --variations-seed-version --mojo-platform-channel-handle=3852 /prefetch:14⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations=is-enterprise-managed=no --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 649, 0, 6490878" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=756,i,6434429329080797809,9205737776219652787,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:104⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe" --type=renderer --string-annotations=is-enterprise-managed=no --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 649, 0, 6490878" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --field-trial-handle=5076,i,6434429329080797809,9205737776219652787,262144 --variations-seed-version --mojo-platform-channel-handle=4856 /prefetch:14⤵
- Executes dropped EXE
-
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --field-trial-handle=6504,i,6145962481184430073,16052153610893545906,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6308 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --field-trial-handle=6092,i,6145962481184430073,16052153610893545906,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3024 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=7256,i,6145962481184430073,16052153610893545906,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=7240 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=7376,i,6145962481184430073,16052153610893545906,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=7392 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --field-trial-handle=7472,i,6145962481184430073,16052153610893545906,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=7244 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=7224,i,6145962481184430073,16052153610893545906,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=7336 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --field-trial-handle=6900,i,6145962481184430073,16052153610893545906,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6936 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --field-trial-handle=7524,i,6145962481184430073,16052153610893545906,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=7024 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --field-trial-handle=7424,i,6145962481184430073,16052153610893545906,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=7452 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=7312,i,6145962481184430073,16052153610893545906,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=7340 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=7228,i,6145962481184430073,16052153610893545906,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=8060 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3096,i,6145962481184430073,16052153610893545906,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=7964 /prefetch:82⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
-
-
C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Modifies Internet Explorer settings
-
C:\Program Files (x86)\Roblox\Versions\version-b7eebc919e96477a\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-b7eebc919e96477a\RobloxPlayerBeta.exe" -app -clientLaunchTimeEpochMs 0 -isInstallerLaunch 66643⤵
- Executes dropped EXE
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of UnmapMainImage
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --field-trial-handle=3300,i,6145962481184430073,16052153610893545906,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1424 /prefetch:12⤵
-
-
C:\Program Files (x86)\Roblox\Versions\version-b7eebc919e96477a\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-b7eebc919e96477a\RobloxPlayerBeta.exe" roblox-player:1+launchmode:play+gameinfo:vL4EWxJ7Hofa82eIaEYdFshefO3fHgD3EZ80ZCFCDPDUTF3_ivYwJKXPhn0GqgARrGONmcU9V6UNaUMv4mi8c3vZsNKmD78-2ZlTKWhZGJ9FTv3y5sQde53cSnLsgQUvT8lFOBG-vk7igPd1vCCbl1csxIN0WT4ERRh6Jv2jaOs1MSar9jh09K4d1mv-TGVZ-HHP9UMRrrXOG6WYxFSpmGztWq9kYpdD9SbL3BOuWRA+launchtime:1731351313867+placelauncherurl:https%3A%2F%2Fwww.roblox.com%2FGame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D1731350872097002%26placeId%3D3351674303%26isPlayTogetherGame%3Dfalse%26joinAttemptId%3D7948008f-d758-4fa2-860b-6a3cb4fac44e%26joinAttemptOrigin%3DPlayButton+browsertrackerid:1731350872097002+robloxLocale:en_us+gameLocale:sv_se+channel:+LaunchExp:InApp2⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of UnmapMainImage
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --field-trial-handle=7288,i,6145962481184430073,16052153610893545906,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3264 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --field-trial-handle=6400,i,6145962481184430073,16052153610893545906,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4876 /prefetch:12⤵
-
-
C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"2⤵
- Checks whether UAC is enabled
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Modifies Internet Explorer settings
-
C:\Program Files (x86)\Roblox\Versions\version-b7eebc919e96477a\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-b7eebc919e96477a\RobloxPlayerBeta.exe" -app -clientLaunchTimeEpochMs 0 -isInstallerLaunch 49523⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of UnmapMainImage
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --field-trial-handle=7268,i,6145962481184430073,16052153610893545906,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=7456 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --field-trial-handle=7340,i,6145962481184430073,16052153610893545906,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=7316 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --field-trial-handle=6540,i,6145962481184430073,16052153610893545906,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6652 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --field-trial-handle=5996,i,6145962481184430073,16052153610893545906,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=8036 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --field-trial-handle=1428,i,6145962481184430073,16052153610893545906,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=7304 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --field-trial-handle=5204,i,6145962481184430073,16052153610893545906,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6024 /prefetch:12⤵
-
-
C:\Program Files (x86)\Roblox\Versions\version-b7eebc919e96477a\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-b7eebc919e96477a\RobloxPlayerBeta.exe" roblox-player:1+launchmode:play+gameinfo:Eo0bBogQX43OeGPXjEO0BDYCD3OJtS5AXVCBvMZ4vufdxh4IgEWMGkuefQXs5G1ob0PE58szFm4naK2B7ulC4Pd3EcfCFgbEwc9nIrTm_zZ0Jjppe9YX5MyAQgBRsu4c_nFJgWuCm85M984CTh4JZ8Ts5qVFKHQsYaG-Zf46I08gxSqqBBMtzazLHo44uxNhpbs8B8kvU7A9I9HC5Zz5uZiWPyBangsnP3n3iNGKib8+launchtime:1731351505631+placelauncherurl:https%3A%2F%2Fwww.roblox.com%2FGame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D1731350872097002%26placeId%3D286090429%26isPlayTogetherGame%3Dfalse%26joinAttemptId%3D6cfed47f-05e8-4b3d-8c78-74fee714e124%26joinAttemptOrigin%3DPlayButton+browsertrackerid:1731350872097002+robloxLocale:en_us+gameLocale:sv_se+channel:+LaunchExp:InApp2⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of UnmapMainImage
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --field-trial-handle=6048,i,6145962481184430073,16052153610893545906,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=7316 /prefetch:12⤵
-
-
C:\Program Files (x86)\Roblox\Versions\version-7cc6d2bdac2f4837\RobloxStudioBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-7cc6d2bdac2f4837\RobloxStudioBeta.exe" roblox-studio:1+launchtime:1731351542414+avatar+browsertrackerid:1731350872097002+robloxLocale:en-US+gameLocale:en-US+channel:+browser:chrome+userId:7570698149+distributorType:Global+launchmode:edit+task:EditPlace+placeId:140577510208410+universeId:67867679022⤵
- Checks whether UAC is enabled
- Enumerates connected drives
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Roblox\Versions\version-7cc6d2bdac2f4837\RobloxCrashHandler.exe"C:\Program Files (x86)\Roblox\Versions\version-7cc6d2bdac2f4837\RobloxCrashHandler.exe" --no-rate-limit --crashCounter Win-ROBLOXStudio-Crash --baseUrl https://www.roblox.com --attachment=attachment_0.649.0.6490878_20241111T185902Z_Studio_09E19_last.log=C:\Users\Admin\AppData\Local\Roblox\logs\0.649.0.6490878_20241111T185902Z_Studio_09E19_last.log --attachment=attachment_log_0.649.0.6490878_20241111T185902Z_Studio_09E19_csg3.log=C:\Users\Admin\AppData\Local\Roblox\logs\log_0.649.0.6490878_20241111T185902Z_Studio_09E19_csg3.log --attachment=attachment_log_0.649.0.6490878_20241111T185902Z_Studio_09E19_dcd.log=C:\Users\Admin\AppData\Local\Roblox\logs\log_0.649.0.6490878_20241111T185902Z_Studio_09E19_dcd.log --database=C:\Users\Admin\AppData\Local\Roblox\logs\crashes --metrics-dir=C:\Users\Admin\AppData\Local\Roblox\logs\crashes --url=https://upload.crashes.rbxinfra.com/post?format=minidump --annotation=AppVersion=0.649.0.6490878 --annotation=Format=minidump --annotation=HardwareModel= --annotation=HasBootstrapper=true --annotation=InstallFolder=ProgramFilesX86 --annotation=OSPlatform=Windows --annotation=RobloxChannel=production --annotation=RobloxGitHash=3891290f7ec8b14511dd09a88bb53740fbfe3768 --annotation=RobloxProduct=RobloxStudio --annotation=StudioVersion=0.649.0.6490878 --annotation=UniqueId=898864870049821622 --annotation=UseCrashpad=True --annotation=app_arch=x86_64 --annotation=application.version=0.649.0.6490878 --annotation=host_arch=x86_64 --initial-client-data=0x5bc,0x5c0,0x5c4,0x52c,0x610,0x7ff6115fb2a8,0x7ff6115fb2c0,0x7ff6115fb2d83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" https://apis.roblox.com/oauth/v1/authorize?response_type=code&code_challenge=1iDcFW_sOUdPC3cYBTANMCX5kXXPMHHlb4p20P4Vgyg&code_challenge_method=S256&client_id=7968549422692352298&redirect_uri=roblox-studio-auth%3A%2F&scope=openid+credentials+profile+age+roles+premium&nonce=id-roblox&state=eyJyYW5kb21fc3RyaW5nIjoiZE4wdWphNEd0SGlRdjJWeEtyMXM2R09neDVVQmswbm9QdEFzU3VvWHRDWSIsInBpZCI6IjUxMjQifQ%3D%3D3⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa0860cc40,0x7ffa0860cc4c,0x7ffa0860cc584⤵
-
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --field-trial-handle=3312,i,6145962481184430073,16052153610893545906,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6256 /prefetch:12⤵
-
-
C:\Program Files (x86)\Roblox\Versions\version-7cc6d2bdac2f4837\RobloxStudioBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-7cc6d2bdac2f4837\RobloxStudioBeta.exe" roblox-studio-auth:/?code=2lgEeTkbhN4rQyLjkY4JurXcy18BqEFeFh4q0sAtH_SMV_a7Gj3z9r4QC5nlIg_x6HCG4NqdAJIcV_NOU2GfiISq6V0BtQB0NE9amiwKh4WpZV4uYPTLq7Vh5bzZJKn12Ylm2RIFfHfF7uj7d8eV0jnv21TyzPitX88P7o0XENGyVMg6cGE1mtzsQCZfXtBKfG8KHqmyq0JHLE9sOLk6zAk-QoKHlOohV4JkKenTWHlz-yhua3PxAtFBcXcq4oxL1WIO9OUNpLPRdAyEKpKHo_ud3sMYUNhkAuJNxvX1ws_4oN7SkZh2VKKaMLvcRFoCReElOIMXAGsfsGN_Eczbo7JK-dbhD8CkdwLn-LuwIww&state=eyJyYW5kb21fc3RyaW5nIjoiZE4wdWphNEd0SGlRdjJWeEtyMXM2R09neDVVQmswbm9QdEFzU3VvWHRDWSIsInBpZCI6IjUxMjQifQ%3d%3d2⤵
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
-
C:\Program Files (x86)\Roblox\Versions\version-7cc6d2bdac2f4837\RobloxCrashHandler.exe"C:\Program Files (x86)\Roblox\Versions\version-7cc6d2bdac2f4837\RobloxCrashHandler.exe" --no-rate-limit --crashCounter Win-ROBLOXStudio-Crash --baseUrl https://www.roblox.com --attachment=attachment_0.649.0.6490878_20241111T185913Z_Studio_7EB58_last.log=C:\Users\Admin\AppData\Local\Roblox\logs\0.649.0.6490878_20241111T185913Z_Studio_7EB58_last.log --attachment=attachment_log_0.649.0.6490878_20241111T185913Z_Studio_7EB58_csg3.log=C:\Users\Admin\AppData\Local\Roblox\logs\log_0.649.0.6490878_20241111T185913Z_Studio_7EB58_csg3.log --attachment=attachment_log_0.649.0.6490878_20241111T185913Z_Studio_7EB58_dcd.log=C:\Users\Admin\AppData\Local\Roblox\logs\log_0.649.0.6490878_20241111T185913Z_Studio_7EB58_dcd.log --database=C:\Users\Admin\AppData\Local\Roblox\logs\crashes --metrics-dir=C:\Users\Admin\AppData\Local\Roblox\logs\crashes --url=https://upload.crashes.rbxinfra.com/post?format=minidump --annotation=AppVersion=0.649.0.6490878 --annotation=Format=minidump --annotation=HardwareModel= --annotation=HasBootstrapper=true --annotation=InstallFolder=ProgramFilesX86 --annotation=OSPlatform=Windows --annotation=RobloxChannel=production --annotation=RobloxGitHash=3891290f7ec8b14511dd09a88bb53740fbfe3768 --annotation=RobloxProduct=RobloxStudio --annotation=StudioVersion=0.649.0.6490878 --annotation=UniqueId=206379211836363176 --annotation=UseCrashpad=True --annotation=app_arch=x86_64 --annotation=application.version=0.649.0.6490878 --annotation=host_arch=x86_64 --initial-client-data=0x5bc,0x5c0,0x5c4,0x5b8,0x5cc,0x7ff6115fb2a8,0x7ff6115fb2c0,0x7ff6115fb2d83⤵
-
-
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RTgzNDQwMDAtNjgwRS00N0MwLTlCMkItNEVBQzI3MzcxNTkxfSIgdXNlcmlkPSJ7NjkzMkI0NjQtODI2MC00RUFCLUJERjgtODVFQzBDRDcwRTk0fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntGQ0ZBMTY1Qi01RTg2LTQxMkUtOEFDQi1BMzNEQ0YxOThENDR9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjIyMDAwLjQ5MyIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSIiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTIzLjAuNjMxMi4xMjMiIG5leHR2ZXJzaW9uPSIxMjMuMC42MzEyLjEyMyIgbGFuZz0iZW4iIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjUiIHN5c3RlbV91cHRpbWVfdGlja3M9IjU3NDM5NDM5NzciLz48L2FwcD48L3JlcXVlc3Q-2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D6F21D8D-274E-46D0-9FD4-E625CCA199BE}\MicrosoftEdge_X64_130.0.2849.80.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D6F21D8D-274E-46D0-9FD4-E625CCA199BE}\MicrosoftEdge_X64_130.0.2849.80.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level2⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D6F21D8D-274E-46D0-9FD4-E625CCA199BE}\EDGEMITMP_9F9F7.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D6F21D8D-274E-46D0-9FD4-E625CCA199BE}\EDGEMITMP_9F9F7.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D6F21D8D-274E-46D0-9FD4-E625CCA199BE}\MicrosoftEdge_X64_130.0.2849.80.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D6F21D8D-274E-46D0-9FD4-E625CCA199BE}\EDGEMITMP_9F9F7.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D6F21D8D-274E-46D0-9FD4-E625CCA199BE}\EDGEMITMP_9F9F7.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=130.0.6723.117 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D6F21D8D-274E-46D0-9FD4-E625CCA199BE}\EDGEMITMP_9F9F7.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=130.0.2849.80 --initial-client-data=0x234,0x238,0x23c,0x1d0,0x240,0x7ff716d3d730,0x7ff716d3d73c,0x7ff716d3d7484⤵
- Executes dropped EXE
- Drops file in Windows directory
-
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RTgzNDQwMDAtNjgwRS00N0MwLTlCMkItNEVBQzI3MzcxNTkxfSIgdXNlcmlkPSJ7NjkzMkI0NjQtODI2MC00RUFCLUJERjgtODVFQzBDRDcwRTk0fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntBNTYyNDkwNi1EMDk1LTRFMUYtQkRFNi0zNUMzQUQyNjUyREJ9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjIyMDAwLjQ5MyIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSImcXVvdDtWUFFvUDFGK2ZxMTV3UnpoMWtQTDRQTXBXaDhPUk1CNWl6dnJPQy9jaGpRPSZxdW90OyIvPjxhcHAgYXBwaWQ9IntGMzAxNzIyNi1GRTJBLTQyOTUtOEJERi0wMEMzQTlBN0U0QzV9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIxMzAuMC4yODQ5LjgwIiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY29uc2VudD1mYWxzZSI-PHVwZGF0ZWNoZWNrLz48ZXZlbnQgZXZlbnR0eXBlPSI5IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1NzU3MjYzNjM1IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTc1NzMwMzY5MCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjU5MTg5OTk5MTkiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIGRvd25sb2FkZXI9ImJpdHMiIHVybD0iaHR0cDovL21zZWRnZS5mLnRsdS5kbC5kZWxpdmVyeS5tcC5taWNyb3NvZnQuY29tL2ZpbGVzdHJlYW1pbmdzZXJ2aWNlL2ZpbGVzLzI3Y2I3MjlkLWZmOTQtNGQzNC1hYWU0LTMzODVmYTA5YzQ0Yz9QMT0xNzMxOTU1NDcwJmFtcDtQMj00MDQmYW1wO1AzPTImYW1wO1A0PWslMmJ6cjZPQjI3YU8zMSUyZjI3REczSXZHb25rZktlOVAzbTBobFJnUzBEQXplTG1nN3dLQjZyaE5nbElaV2NOeHBKJTJiMnF3Y2lvN1RYU2gydlVxR1VKVUF3JTNkJTNkIiBzZXJ2ZXJfaXBfaGludD0iIiBjZG5fY2lkPSItMSIgY2RuX2NjYz0iIiBjZG5fbXNlZGdlX3JlZj0iIiBjZG5fYXp1cmVfcmVmX29yaWdpbl9zaGllbGQ9IiIgY2RuX2NhY2hlPSIiIGNkbl9wM3A9IiIgZG93bmxvYWRlZD0iMTc1MDc2OTIwIiB0b3RhbD0iMTc1MDc2OTIwIiBkb3dubG9hZF90aW1lX21zPSI5ODExIi8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTkxOTA5OTgyMyIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjYiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjU5MzI3ODk2NTIiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIxOTY3NTciIHN5c3RlbV91cHRpbWVfdGlja3M9IjY1MzY1OTMzNTMiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIHVwZGF0ZV9jaGVja190aW1lX21zPSI3MzkiIGRvd25sb2FkX3RpbWVfbXM9IjE2MTc2IiBkb3dubG9hZGVkPSIxNzUwNzY5MjAiIHRvdGFsPSIxNzUwNzY5MjAiIHBhY2thZ2VfY2FjaGVfcmVzdWx0PSIwIiBpbnN0YWxsX3RpbWVfbXM9IjYwMzc4Ii8-PC9hcHA-PC9yZXF1ZXN0Pg2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\System32\GameBarPresenceWriter.exe"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer1⤵
- Network Service Discovery
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004E4 0x00000000000004EC1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc1⤵
- Executes dropped EXE
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B2632431-1ACC-4B78-9B2A-B85BA1606743}\MicrosoftEdgeUpdateSetup_X86_1.3.195.35.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B2632431-1ACC-4B78-9B2A-B85BA1606743}\MicrosoftEdgeUpdateSetup_X86_1.3.195.35.exe" /update /sessionid "{E6EB8213-6155-453B-8785-E2710378B1DC}"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Microsoft\Temp\EU6918.tmp\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\Temp\EU6918.tmp\MicrosoftEdgeUpdate.exe" /update /sessionid "{E6EB8213-6155-453B-8785-E2710378B1DC}"3⤵
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.35\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.35\MicrosoftEdgeUpdateComRegisterShell64.exe"5⤵
- Executes dropped EXE
- Modifies registry class
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.35\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.35\MicrosoftEdgeUpdateComRegisterShell64.exe"5⤵
- Executes dropped EXE
- Modifies registry class
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.35\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.35\MicrosoftEdgeUpdateComRegisterShell64.exe"5⤵
- Executes dropped EXE
- Modifies registry class
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMzUiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RTZFQjgyMTMtNjE1NS00NTNCLTg3ODUtRTI3MTAzNzhCMURDfSIgdXNlcmlkPSJ7NjkzMkI0NjQtODI2MC00RUFCLUJERjgtODVFQzBDRDcwRTk0fSIgaW5zdGFsbHNvdXJjZT0ic2VsZnVwZGF0ZSIgcmVxdWVzdGlkPSJ7RjY1MUFFODMtRjM2NC00RDUxLTg1MTAtMEFBMDQ3MjQyMjFDfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yMjAwMC40OTMiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7cjQ1MnQxK2syVGdxL0hYemp2Rk5CUmhvcEJXUjlzYmpYeHFlVURIOXVYMD0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE3MS4zOSIgbmV4dHZlcnNpb249IjEuMy4xOTUuMzUiIGxhbmc9IiIgYnJhbmQ9IklOQlgiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIwIiBpbnN0YWxsZGF0ZXRpbWU9IjE3MzEzNTA2NjYiPjxldmVudCBldmVudHR5cGU9IjMiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjkxNzEyMTMxOTUiLz48L2FwcD48L3JlcXVlc3Q-4⤵
- Executes dropped EXE
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
-
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RTZFQjgyMTMtNjE1NS00NTNCLTg3ODUtRTI3MTAzNzhCMURDfSIgdXNlcmlkPSJ7NjkzMkI0NjQtODI2MC00RUFCLUJERjgtODVFQzBDRDcwRTk0fSIgaW5zdGFsbHNvdXJjZT0ic2NoZWR1bGVyIiByZXF1ZXN0aWQ9IntGMThDOTAwRi01QzVELTQ2NkYtOTk1Mi1DQkY1RkFDNDYzMDd9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjIyMDAwLjQ5MyIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSImcXVvdDtyNDUydDErazJUZ3EvSFh6anZGTkJSaG9wQldSOXNialh4cWVVREg5dVgwPSZxdW90OyIvPjxhcHAgYXBwaWQ9IntGM0M0RkUwMC1FRkQ1LTQwM0ItOTU2OS0zOThBMjBGMUJBNEF9IiB2ZXJzaW9uPSIxLjMuMTcxLjM5IiBuZXh0dmVyc2lvbj0iMS4zLjE5NS4zNSIgbGFuZz0iIiBicmFuZD0iSU5CWCIgY2xpZW50PSIiIGluc3RhbGxhZ2U9IjAiPjx1cGRhdGVjaGVjay8-PGV2ZW50IGV2ZW50dHlwZT0iMTIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjkxNDg0MjMzMTEiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxMyIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iOTE0ODQ2MzExNCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjE0IiBldmVudHJlc3VsdD0iMCIgZXJyb3Jjb2RlPSItMjE0NzAyMzgzOCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iOTE1NDA1MzI4MSIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgZG93bmxvYWRlcj0iZG8iIHVybD0iaHR0cDovL21zZWRnZS5iLnRsdS5kbC5kZWxpdmVyeS5tcC5taWNyb3NvZnQuY29tL2ZpbGVzdHJlYW1pbmdzZXJ2aWNlL2ZpbGVzLzY4ZDU3N2EwLTFmNGEtNDM0Zi1iZGNlLTE0OGVkYzFlNGE0MD9QMT0xNzMxOTU1ODA5JmFtcDtQMj00MDQmYW1wO1AzPTImYW1wO1A0PWxQZkolMmZTd1lQJTJiOXprY3lzQUNWY1ZFY3d6OGVvcWJMZEZxb3MlMmZLV3ozVnclMmZyeXhrcnNNaWxoRTkyTVElMmJtZnQ5MUVEbVl2SWZmWUxFS2FjanZFbUg4dyUzZCUzZCIgc2VydmVyX2lwX2hpbnQ9IiIgY2RuX2NpZD0iLTEiIGNkbl9jY2M9IiIgY2RuX21zZWRnZV9yZWY9IiIgY2RuX2F6dXJlX3JlZl9vcmlnaW5fc2hpZWxkPSIiIGNkbl9jYWNoZT0iIiBjZG5fcDNwPSIiIGRvd25sb2FkZWQ9IjAiIHRvdGFsPSIwIiBkb3dubG9hZF90aW1lX21zPSIyIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTQiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjkxNTQwNzM0NzkiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIGRvd25sb2FkZXI9ImJpdHMiIHVybD0iaHR0cDovL21zZWRnZS5iLnRsdS5kbC5kZWxpdmVyeS5tcC5taWNyb3NvZnQuY29tL2ZpbGVzdHJlYW1pbmdzZXJ2aWNlL2ZpbGVzLzY4ZDU3N2EwLTFmNGEtNDM0Zi1iZGNlLTE0OGVkYzFlNGE0MD9QMT0xNzMxOTU1ODA5JmFtcDtQMj00MDQmYW1wO1AzPTImYW1wO1A0PWxQZkolMmZTd1lQJTJiOXprY3lzQUNWY1ZFY3d6OGVvcWJMZEZxb3MlMmZLV3ozVnclMmZyeXhrcnNNaWxoRTkyTVElMmJtZnQ5MUVEbVl2SWZmWUxFS2FjanZFbUg4dyUzZCUzZCIgc2VydmVyX2lwX2hpbnQ9IiIgY2RuX2NpZD0iLTEiIGNkbl9jY2M9IiIgY2RuX21zZWRnZV9yZWY9IiIgY2RuX2F6dXJlX3JlZl9vcmlnaW5fc2hpZWxkPSIiIGNkbl9jYWNoZT0iIiBjZG5fcDNwPSIiIGRvd25sb2FkZWQ9IjE2MzU5MjAiIHRvdGFsPSIxNjM1OTIwIiBkb3dubG9hZF90aW1lX21zPSI0ODYiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNCIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iOTE1NDA4MzM2MiIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjE1IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI5MTU5MjUzMDg3IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PHBpbmcgcj0iLTEiIHJkPSItMSIvPjwvYXBwPjxhcHAgYXBwaWQ9Ins1NkVCMThGOC1CMDA4LTRDQkQtQjZEMi04Qzk3RkU3RTkwNjJ9IiB2ZXJzaW9uPSI5MC4wLjgxOC42NiIgbmV4dHZlcnNpb249IiIgbGFuZz0iIiBicmFuZD0iSU5CWCIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJjb25zZW50PWZhbHNlIiBsYXN0X2xhdW5jaF90aW1lPSIxMzM3NTgyNDQ1NDU5MjUwNzAiPjx1cGRhdGVjaGVjay8-PHBpbmcgYWN0aXZlPSIxIiBhPSItMSIgcj0iLTEiIGFkPSItMSIgcmQ9Ii0xIi8-PC9hcHA-PGFwcCBhcHBpZD0ie0YzMDE3MjI2LUZFMkEtNDI5NS04QkRGLTAwQzNBOUE3RTRDNX0iIHZlcnNpb249IjEzMC4wLjI4NDkuODAiIG5leHR2ZXJzaW9uPSIiIGxhbmc9IiIgYnJhbmQ9IklOQlgiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY29uc2VudD1mYWxzZSIgdXBkYXRlX2NvdW50PSIxIiBsYXN0X2xhdW5jaF90aW1lPSIxMzM3NTgyNDM1MzM4MTU5ODAiPjx1cGRhdGVjaGVjay8-PHBpbmcgYWN0aXZlPSIxIiBhPSItMSIgcj0iLTEiIGFkPSItMSIgcmQ9Ii0xIiBwaW5nX2ZyZXNobmVzcz0ie0JCMDc2MEJELThBRDctNDJDRS1BOTIwLTY4QTUzQzBFRjdDMH0iLz48L2FwcD48L3JlcXVlc3Q-2⤵
- Executes dropped EXE
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Checks processor information in registry
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Checks processor information in registry
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Checks processor information in registry
-
C:\Windows\System32\GameBarPresenceWriter.exe"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer1⤵
- Network Service Discovery
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Checks processor information in registry
-
C:\Windows\System32\CredentialUIBroker.exe"C:\Windows\System32\CredentialUIBroker.exe" NonAppContainerFailedMip -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\CredentialUIBroker.exe"C:\Windows\System32\CredentialUIBroker.exe" NonAppContainerFailedMip -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\CredentialUIBroker.exe"C:\Windows\System32\CredentialUIBroker.exe" NonAppContainerFailedMip -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Checks processor information in registry
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Checks processor information in registry
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc1⤵
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMzUiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7N0I4RTYzQ0QtMzkxRS00RjZDLUE4RDQtQ0Q2NEU3MkZDQjY3fSIgdXNlcmlkPSJ7NjkzMkI0NjQtODI2MC00RUFCLUJERjgtODVFQzBDRDcwRTk0fSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7OENENEVGRDItOUZERC00QUU5LUE0ODUtOTgxRkZDMkY3RTg3fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yMjAwMC40OTMiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7bGhWaTEyUWNrNlNsMHVVMU9CNlkxNTI5YlI2YnNleTQrY3U3ZEh4czZjaz0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTIzLjAuNjMxMi4xMjMiIG5leHR2ZXJzaW9uPSIiIGxhbmc9ImVuIiBicmFuZD0iR0dMUyIgY2xpZW50PSIiIGluc3RhbGxhZ2U9IjM1IiBpbnN0YWxsZGF0ZXRpbWU9IjE3MjgzMDI4ODUiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM3Mjc3NTY3NzE5NDAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMjUwMDA0MjUyNCIvPjwvYXBwPjwvcmVxdWVzdD42⤵
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ED717D4C-9463-4C4C-8BFE-DA1534561BA5}\MicrosoftEdge_X64_130.0.2849.80.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ED717D4C-9463-4C4C-8BFE-DA1534561BA5}\MicrosoftEdge_X64_130.0.2849.80.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable2⤵
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ED717D4C-9463-4C4C-8BFE-DA1534561BA5}\EDGEMITMP_B522A.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ED717D4C-9463-4C4C-8BFE-DA1534561BA5}\EDGEMITMP_B522A.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ED717D4C-9463-4C4C-8BFE-DA1534561BA5}\MicrosoftEdge_X64_130.0.2849.80.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable3⤵
- Boot or Logon Autostart Execution: Active Setup
- Installs/modifies Browser Helper Object
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- System policy modification
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ED717D4C-9463-4C4C-8BFE-DA1534561BA5}\EDGEMITMP_B522A.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ED717D4C-9463-4C4C-8BFE-DA1534561BA5}\EDGEMITMP_B522A.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=130.0.6723.117 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ED717D4C-9463-4C4C-8BFE-DA1534561BA5}\EDGEMITMP_B522A.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=130.0.2849.80 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x7ff7d8fad730,0x7ff7d8fad73c,0x7ff7d8fad7484⤵
- Drops file in Windows directory
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ED717D4C-9463-4C4C-8BFE-DA1534561BA5}\EDGEMITMP_B522A.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ED717D4C-9463-4C4C-8BFE-DA1534561BA5}\EDGEMITMP_B522A.tmp\setup.exe" --msedge --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=14⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ED717D4C-9463-4C4C-8BFE-DA1534561BA5}\EDGEMITMP_B522A.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ED717D4C-9463-4C4C-8BFE-DA1534561BA5}\EDGEMITMP_B522A.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=130.0.6723.117 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ED717D4C-9463-4C4C-8BFE-DA1534561BA5}\EDGEMITMP_B522A.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=130.0.2849.80 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff7d8fad730,0x7ff7d8fad73c,0x7ff7d8fad7485⤵
- Drops file in Windows directory
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe" --msedge --channel=stable --remove-deprecated-packages --verbose-logging --system-level4⤵
- Drops file in Windows directory
-
C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=130.0.6723.117 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=130.0.2849.80 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x7ff73cb8d730,0x7ff73cb8d73c,0x7ff73cb8d7485⤵
- Drops file in Windows directory
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe" --msedge --channel=stable --update-game-assist-package --verbose-logging --system-level4⤵
- Drops file in Windows directory
-
C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=130.0.6723.117 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=130.0.2849.80 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x7ff73cb8d730,0x7ff73cb8d73c,0x7ff73cb8d7485⤵
- Drops file in Windows directory
-
-
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMzUiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7N0I4RTYzQ0QtMzkxRS00RjZDLUE4RDQtQ0Q2NEU3MkZDQjY3fSIgdXNlcmlkPSJ7NjkzMkI0NjQtODI2MC00RUFCLUJERjgtODVFQzBDRDcwRTk0fSIgaW5zdGFsbHNvdXJjZT0ic2NoZWR1bGVyIiByZXF1ZXN0aWQ9IntENzE1RjZGMi00MDdFLTQzQ0MtOUM3MC04OENCNDEzRjE4MjB9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjIyMDAwLjQ5MyIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSImcXVvdDtWUFFvUDFGK2ZxMTV3UnpoMWtQTDRQTXBXaDhPUk1CNWl6dnJPQy9jaGpRPSZxdW90OyIvPjxhcHAgYXBwaWQ9IntGM0M0RkUwMC1FRkQ1LTQwM0ItOTU2OS0zOThBMjBGMUJBNEF9IiB2ZXJzaW9uPSIxLjMuMTk1LjM1IiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSJJTkJYIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9IklzT25JbnRlcnZhbENvbW1hbmRzQWxsb3dlZD0lNUIlMjItdGFyZ2V0X2RldiUyMC1taW5fYnJvd3Nlcl92ZXJzaW9uX2NhbmFyeV9kZXYlMjAxMzEuMC4yODcxLjAlMjIlNUQiIGluc3RhbGxhZ2U9IjAiIGNvaG9ydD0icnJmQDAuOTEiPjx1cGRhdGVjaGVjay8-PHBpbmcgcmQ9IjY1MjQiIHBpbmdfZnJlc2huZXNzPSJ7QzIyNzYwMjEtMTcxRi00NTA4LThCNTYtMDU3NjA4OTBFRkUxfSIvPjwvYXBwPjxhcHAgYXBwaWQ9Ins1NkVCMThGOC1CMDA4LTRDQkQtQjZEMi04Qzk3RkU3RTkwNjJ9IiB2ZXJzaW9uPSI5MC4wLjgxOC42NiIgbmV4dHZlcnNpb249IjEzMC4wLjI4NDkuODAiIGxhbmc9IiIgYnJhbmQ9IklOQlgiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY29uc2VudD1mYWxzZSIgaXNfcGlubmVkX3N5c3RlbT0idHJ1ZSIgbGFzdF9sYXVuY2hfY291bnQ9IjEiIGxhc3RfbGF1bmNoX3RpbWU9IjEzMzc1ODI0NDU0NTkyNTA3MCI-PHVwZGF0ZWNoZWNrLz48ZXZlbnQgZXZlbnR0eXBlPSIxMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTI1MDkwNDI0NzciIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxMyIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTI1MDkwOTIzOTIiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNCIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTI1Mzc5NzI3NDEiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTI1NTI2MDI1MTkiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIzIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIxOTY3NTciIHN5c3RlbV91cHRpbWVfdGlja3M9IjEzMDkyMDgyMzgxIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiB1cGRhdGVfY2hlY2tfdGltZV9tcz0iMzk0IiBkb3dubG9hZGVkPSIxNzUwNzY5MjAiIHRvdGFsPSIxNzUwNzY5MjAiIHBhY2thZ2VfY2FjaGVfcmVzdWx0PSIyIiBpbnN0YWxsX3RpbWVfbXM9IjUzOTMzIi8-PHBpbmcgYWN0aXZlPSIwIiByZD0iNjUyNCIgcGluZ19mcmVzaG5lc3M9IntFMTEwM0QzQy02RURCLTQyOEYtQUQ2OC1EODczMkYxMTY0RUZ9Ii8-PC9hcHA-PGFwcCBhcHBpZD0ie0YzMDE3MjI2LUZFMkEtNDI5NS04QkRGLTAwQzNBOUE3RTRDNX0iIHZlcnNpb249IjEzMC4wLjI4NDkuODAiIG5leHR2ZXJzaW9uPSIiIGxhbmc9IiIgYnJhbmQ9IklOQlgiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY29uc2VudD1mYWxzZSIgY29ob3J0PSJycmZAMC43NiIgdXBkYXRlX2NvdW50PSIxIiBsYXN0X2xhdW5jaF9jb3VudD0iMSIgbGFzdF9sYXVuY2hfdGltZT0iMTMzNzU4MjQ2NzYzNjAzMzEwIj48dXBkYXRlY2hlY2svPjxwaW5nIGFjdGl2ZT0iMSIgYWQ9IjY1MjQiIHJkPSI2NTI0IiBwaW5nX2ZyZXNobmVzcz0ie0Y2QzJENTQ5LTE1RTMtNEYyOC1CODU3LTk1OTI1Q0EyRjk4NX0iLz48L2FwcD48L3JlcXVlc3Q-2⤵
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\BackgroundTransferHost.exe"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.131⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\CredentialUIBroker.exe"C:\Windows\System32\CredentialUIBroker.exe" NonAppContainerFailedMip -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\CredentialUIBroker.exe"C:\Windows\System32\CredentialUIBroker.exe" NonAppContainerFailedMip -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\GameBarPresenceWriter.exe"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer1⤵
- Network Service Discovery
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k GraphicsPerfSvcGroup -s GraphicsPerfSvc1⤵
- Checks processor information in registry
- Modifies data under HKEY_USERS
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Checks processor information in registry
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Active Setup
1Browser Extensions
1Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Defense Evasion
Modify Registry
4Subvert Trust Controls
1SIP and Trust Provider Hijacking
1Discovery
Browser Information Discovery
1Network Service Discovery
1Network Share Discovery
1Peripheral Device Discovery
1Query Registry
6System Information Discovery
6System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
setup.exe
MicrosoftEdgeUpdateSetup_X86_1.3.195.35.exe
SETUP.EX_
EdgeUpdate.dat
MicrosoftEdgeComRegisterShellARM64.exe
MicrosoftEdgeUpdate.exe
MicrosoftEdgeUpdateComRegisterShell64.exe
MicrosoftEdgeUpdateCore.exe
NOTICE.TXT
msedgeupdate.dll
msedgeupdateres_af.dll
msedgeupdateres_am.dll
msedgeupdateres_ar.dll
msedgeupdateres_as.dll
msedgeupdateres_az.dll
msedgeupdateres_bg.dll
msedgeupdateres_bn-IN.dll
msedgeupdateres_bn.dll
msedgeupdateres_bs.dll
msedgeupdateres_ca-Es-VALENCIA.dll
msedgeupdateres_ca.dll
msedgeupdateres_cs.dll
msedgeupdateres_cy.dll
msedgeupdateres_da.dll
msedgeupdateres_de.dll
msedgeupdateres_el.dll
msedgeupdateres_en-GB.dll
msedgeupdateres_en.dll
msedgeupdateres_es-419.dll
msedgeupdateres_es.dll
msedgeupdateres_et.dll
msedgeupdateres_eu.dll
msedgeupdateres_fa.dll
msedgeupdateres_fi.dll
msedgeupdateres_fil.dll
msedgeupdateres_fr-CA.dll
msedgeupdateres_fr.dll
msedgeupdateres_ga.dll
msedgeupdateres_gd.dll
msedgeupdateres_gl.dll
msedgeupdateres_gu.dll
msedgeupdateres_hi.dll
msedgeupdateres_hr.dll
msedgeupdateres_hu.dll
msedgeupdateres_id.dll
msedgeupdateres_is.dll
msedgeupdateres_it.dll
MicrosoftEdgeWebview2Setup.exe
MicrosoftEdgeUpdate.log
F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
BrowsingTopicsState
f_00001d
f_00001f
f_00002f
f_000033
f_000034
f_000035
f_000036
f_000043
f_000049
f_000069
f_000094
f_000096
f_000097
f_000098
f_00009a
f_00009b
f_00009c
f_00009d
f_00009e
f_00009f
f_0000a0
f_0000a2
f_0000a3
f_0000a4
f_0000a5
f_0000a7
f_0000a8
f_0000a9
f_0000ab
f_0000ac
f_0000ad
f_0000af
f_0000cb
f_0000cf
f_0000d4
f_0000d7
f_0000d8
f_0000d9
f_0000da
f_0000db
f_0000dc
f_0000dd
f_0000de
f_0000df
f_0000e0
f_0000e1
f_0000e2
f_0000e3
f_0000e4
f_0000e5
f_0000e6
f_0000e7
f_0000e8
f_0000e9
f_0000ea
f_0000eb
f_0000ec
f_0000ed
f_0000ee
f_0000ef
f_0000f0
f_0000f1
f_0000f2
f_0000f3
f_0000f4
f_0000f5
f_0000f6
f_0000f7
f_0000f8
f_0000f9
f_0000fa
f_0000fb
f_0000fc
f_0000fd
f_0000fe
f_0000ff
f_000100
f_000101
f_000102
f_000103
f_000104
f_000105
f_000106
f_000107
f_000108
f_000109
f_00010a
f_00010b
f_00010c
f_00010d
f_00010e
f_00010f
f_000110
f_000111
f_000112
f_000113
f_000114
f_000115
f_000116
f_000117
f_000118
f_000119
f_00011a
f_00011b
f_00011c
f_00011d
f_00011e
f_00011f
f_000120
f_000121
f_000122
f_000123
f_000124
f_000125
f_000126
f_000127
f_000128
f_000129
f_00012a
f_00012b
f_00012c
f_00012d
f_00012e
f_00012f
f_000130
f_000131
f_000132
f_000133
f_000134
f_000135
f_000136
f_000137
f_000138
f_000139
f_00013a
f_00013b
f_00013c
f_00013d
f_00013e
f_00013f
f_000140
f_000141
f_000142
f_000143
f_000144
f_000145
f_000146
f_000147
f_000148
f_000149
f_00014a
f_00014b
f_00014c
f_00014d
f_00014e
f_00014f
f_000150
f_000151
f_000152
f_000153
f_000154
f_000155
f_000156
f_000157
f_00017a
f_00017b
f_00017c
f_00017d
f_00017e
f_00017f
f_0001b9
f_0001ba
f_0001bb
f_0001bc
f_0001bd
ef573254f07aabf4_0
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
LOG.old
LOG.old
LOG.old
LOG.old
LOG.old
LOG.old
LOG.old
LOG.old
LOG.old
LOG.old~RFe605eed.TMP
MANIFEST-000001
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
index
index.txt
index.txt
index.txt~RFe59b78e.TMP
index.txt
index.txt
index.txt
index.txt~RFe6508b6.TMP
d05310eb-a787-49c2-8cfc-bf47453b8fae.tmp
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
settings.dat
settings.dat
the-real-index
Network Persistent State
Preferences
Preferences
Local State
52ba83b7-723b-4dbb-a000-0a3ae5b31c9f.down_data
settings.json
settings.json
settings.json
7f3632afdee7118812dd116069729b41
da5705f4ae30d837139cb7380d941e1b
ec1fb8fb5fcc548b7650d7d21cdfd290
protocols.json
crl-set
settings.dat
settings.dat
settings.dat
settings.dat
the-real-index
the-real-index
the-real-index
the-real-index
000001.dbtmp
39c0057a-90a3-4038-b714-fce5b676d4af.tmp
638a3890-5500-4821-85d9-3174c470ed22.tmp
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State~RFe5b99ac.TMP
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity~RFe5ad8be.TMP
Preferences
Preferences
Preferences
Preferences
Preferences~RFe5ae272.TMP
MANIFEST-000001
data_2
data_0
data_1
data_3
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State~RFe5a835a.TMP
crs.pb
ct_config.pb
kp_pinslist.pb
Ruleset Data
Filtering Rules
LICENSE
keys.json
settings.dat
02a141e619879922ad85c8f11f102c3b
0407c8d6df198f6864381d3e595ae971
05e6fbe7faeaf27e476e2247265bd7e2
06bf3774b39be975c53ba2193da7f90d
09f04b99b82b262e105a232e97395311
0af1ae578b1c58a0e785712d31028c1e
0b39eb4053e10b7ff21430e80432eed8
0d8b0fd3715ff57ba968ae5740d39a12
16f7441682caf62a1789b9d3e75ec170
175af5595dfe9780b5b7b10ecb943336
1a1d7a8fb35b007494a82bd5304ba1e9
1cb6044427da36923148711b8796b750
1daaef2a5ce0ea927443fd099437bb55
1f571bce12b3689efa5586c78436d68a
234369d070cc483f7122fd415837b73a
23f316746f014ce443f0b0adb0d9d90d
251c7269a8dc64cf406e8c2d5f5cc688
252921e7f19d826cf6778747e86132fd
28c39719e7218d9c2d686d4daccb1b72
2d5ee01099db60480061c57d9831c261
2d9ec8179f810e33787b4e1b0f3bbf6b
2da892c80dea8811c616fe5e0e6c010e
31e8a63e8fa08c8135be1c5384c3e0a2
32c38bb4f4a560d621ab93aeb6ca5d7a
388a60aa5e51ff44455d359825078031
38b0d496d6e95d4a4e1f049ecb71b4d1
3ca8206460663e9e944ccfb414623b40
3e2504bf31b5aa0ab48a8ae5f1dc5f1e
4130cf898fa8b448f1568bfb61305e94
477a618fe08d138e560e0c8eab9f3583
4dd9b09ac0d9a7bb380a273db7cac4ac
5105c207d9317b50c40470887ccfd3aa
5477b96b8c7694aaab08397c539323cd
571e70bdfa73e0cdaa28fdbd2ca19ddd
584bbf8c27b2f156742be22b280cc8d6
5a479665357e877c36a8bc4ebab8ac84
5b794cd8b1447c984ba301aa73a6625d
5c288ffb1fe759d2618c218fa0d2bee8
5c36700f9b5f405f69b210d702f6087c
6016ecbc34dba99ac1cbaf759459fd0a
6105c4318cc0c25a63a6c9b8db84bc28
6443205f8638cd85aaa1caed016b8ac4
68119f28ce3eca78171a6a8c8822e1bd
697aeac1e8e025f05cf4b76086fb70df
6c536340229d1bb052a390124806163e
6d1b0fd2905f7655bf0108dd4e655991
6e62dea9b6f892b37a40251f84c9e0e3
706b550a2be783fb6e220ca8181485e5
7209cd4fd5e4a48a4cabe7e3498368ec
73b0a5d180fa4202c3e9365c3d577fd4
74f7241d43fd3efbef367cddf2de0712
77b3cd784a40d8349719b23b5c0e414b
77fad0fb4662c6b81630ee443153aceb
784c44b6eefe1d95c3354165e933fe91
78e2b6ce1224c7617a6a8c90174aa783
7948b73360f27446739cb67376a2d7bf
7d3e7885dd7eff8f46aa497f3b5c8750
7deb7c677f433c0b6c649020e88fe58a
7df53404f56c9f1787b277ba9d17049b
83eeeca932186715a9107df83747a179
848d350916ab0af9758cff8167a2aea2
852240b4203e72d7bfa66fcea2e589eb
8550d05ebb82e2c3691bc35b7c166899
8aad44a486e1e94cb992a6a0e230f735
8ead55fcc97d21deacf012df5c33fdff
8fbe2ad68bce1f4933b291c365e04e75
90d821a0b7efe2541659a0ff6b31b88b
92ca8d0a36e9ce06a1c3537675677ffb
98c582bbf5493f077bd8f59567067f24
993f844b48dbb84a0eece0b1d1aad326
9fd0b17a3402934b24f3b349c8d753a2
RBX2A6B40C1FE964331BE262991BD13925A
RBX8C8F6207B2384DD3A734656F9F4B2D7E
RBX9E454E91B3CC45A78C15368424369805
RBXA0585AE0C27E4F5BAB008BF332410729
RBXAA372547F7EA4062BC1995C95BF14DC3
RBXAEC29B7E79F7448397ADDA3A71A5360A
RBXD773D4ACA3B64FC898576C49FA885865
a116d80baa851750ec02ad98f6a28052
a1489d1b06ae2d917aae075e6fa9b8f7
aa3db4232d83f97f5e078c526e25a6e2
afa231f024ffddec5f9d2963d20c450b
b39250833fce2d9f0655b124db089d4e
b597c88ce139f36dee5c4afd7d80a2c1
b80d47fd48f8d137ca2aca87e1d00059
bbd52b35df5f543d23b7f35ae9e845be
bc27c501541df155b6fb12496e5bac70
bc70073e6562a1a0cb99b092be4629f8
bc86756c9d8f409a887054cf26a854b3
be241f3cbd5449b0c30c651c4834e3da
be58ec8ab04ff195247b1536cdfb3d44
bf3b9c8a9b12ad25725f66292461bd58
c677a51b0924e108a9b1485dbdf883da
cb8a45c1430998ec1304e4c79176816a
d132016b6bd0b89da2690c24749f6ff7
d27efcc314894472628caf798daafe01
d4f8d4ffe8696350702fd146346140ac
d8b4554062d011287069393d07af8706
ddf87599e247a0d5c1929a577f29e11f
e0fce80600a43748c6cbc0ac23f6cfa2
e385854d0ae9ba50e28a7a5629fa28be
e4317e6c6a87bdf6f00c6c80866345fc
e526d6628fea4b1243fbb953bdf85ac9
e5ba3b6fc7c95f933bacb9db38c93e80
e665da7061b12f952145852fc21ef7ec
e6b482665e130d2c6c4c2f7990354e75
ec9a7853aa53bb67f2099830ce97922a
ecc495a0b2b0470e25d688a9077fd977
f1c2eede7a115f0fd9ddcfae03372516
f40c00885cbd0588eebf8bd59a345579
f4630d357307ba679c2b47f47b123533
f469136d50a09240f313e4f48b35b40a
f9cfb35c8f272d46d504f99d9c00054a
fcbcf8ab7914469e06c8fa6ee80f2201
fcece68795e396ad03d6e2608d740126
fcf8e7398be5b1007fef514afffffa6c
ffa95342e97b344c5317005fd2f4e332
default.dic
5d696d521de238c3.customDestinations-ms
5d696d521de238c3.customDestinations-ms
RobloxStudioInstaller.exe:Zone.Identifier
Unconfirmed 995142.crdownload
desktop.ini
settings.dat
manifest.json
manifest.json
hyph-as.hyb
hyph-hi.hyb
hyph-nb.hyb
manifest.json
adblock_snippet.js
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
memory/1732-5313-0x000001B4CDF90000-0x000001B4CDF91000-memory.dmp
memory/1732-5310-0x000001B4CDF90000-0x000001B4CDF91000-memory.dmp
memory/1732-5311-0x000001B4CDF90000-0x000001B4CDF91000-memory.dmp
memory/1732-5308-0x000001B4CDF90000-0x000001B4CDF91000-memory.dmp
memory/1732-5307-0x000001B4CDF90000-0x000001B4CDF91000-memory.dmp
memory/1732-5312-0x000001B4CDF90000-0x000001B4CDF91000-memory.dmp
memory/1732-5306-0x000001B4CDF90000-0x000001B4CDF91000-memory.dmp
memory/2020-1231-0x00007FFA170F0000-0x00007FFA170F1000-memory.dmp
memory/4092-644-0x0000000000580000-0x00000000005B5000-memory.dmp
memory/4092-645-0x0000000073C20000-0x0000000073E30000-memory.dmp
memory/4092-1094-0x0000000000580000-0x00000000005B5000-memory.dmp
memory/4092-706-0x0000000073C20000-0x0000000073E30000-memory.dmp
memory/4668-1100-0x00007FF9F15C0000-0x00007FF9F19C2000-memory.dmp
memory/4668-1102-0x00007FF9F15C0000-0x00007FF9F19C2000-memory.dmp
memory/4668-1103-0x00007FF608100000-0x00007FF609100000-memory.dmp
memory/4668-1322-0x000001E9C4810000-0x000001E9C4C10000-memory.dmp
memory/4668-1099-0x00007FF9F2640000-0x00007FF9F2B8C000-memory.dmp
memory/4936-2980-0x000001FB602B0000-0x000001FB602B1000-memory.dmp
memory/4936-2976-0x000001FB602B0000-0x000001FB602B1000-memory.dmp
memory/4936-2969-0x000001FB602B0000-0x000001FB602B1000-memory.dmp
memory/4936-2968-0x000001FB602B0000-0x000001FB602B1000-memory.dmp
memory/4936-2970-0x000001FB602B0000-0x000001FB602B1000-memory.dmp
memory/4936-2979-0x000001FB602B0000-0x000001FB602B1000-memory.dmp
memory/4936-2978-0x000001FB602B0000-0x000001FB602B1000-memory.dmp
memory/4936-2974-0x000001FB602B0000-0x000001FB602B1000-memory.dmp
memory/4936-2977-0x000001FB602B0000-0x000001FB602B1000-memory.dmp
memory/4936-2975-0x000001FB602B0000-0x000001FB602B1000-memory.dmp
memory/5460-4695-0x0000020AA1680000-0x0000020AA1E5A000-memory.dmp
memory/5560-1274-0x00007FFA170F0000-0x00007FFA170F1000-memory.dmp
memory/5932-4301-0x00007FF9F26D0000-0x00007FF9F2C1C000-memory.dmp
memory/5932-4302-0x00007FF9F1540000-0x00007FF9F1942000-memory.dmp
memory/6028-4313-0x000001B105740000-0x000001B105F1A000-memory.dmp
memory/6296-4633-0x000001C94E290000-0x000001C94EA6A000-memory.dmp
memory/6296-4623-0x000001C94E290000-0x000001C94EA6A000-memory.dmp
memory/6456-3987-0x0000022AF45A0000-0x0000022AF4D7A000-memory.dmp
memory/6456-3988-0x0000022AF45A0000-0x0000022AF4D7A000-memory.dmp
memory/6588-2785-0x0000024D2E400000-0x0000024D2EBDA000-memory.dmp
memory/6588-2941-0x0000024D2E400000-0x0000024D2EBDA000-memory.dmp
memory/6680-4869-0x0000020A54090000-0x0000020A5486A000-memory.dmp
memory/6680-4888-0x0000020A54090000-0x0000020A5486A000-memory.dmp
memory/6692-3498-0x0000000000F30000-0x0000000000F65000-memory.dmp
memory/6884-4073-0x000001C4A97D0000-0x000001C4A9FAA000-memory.dmp
memory/6884-4072-0x000001C4A97D0000-0x000001C4A9FAA000-memory.dmp