Analysis
- user interaction
yes - max time kernel
819s - max time network
818s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
29/04/2026, 02:48
General
- Target ExLoader_Installer (3).exe
- Size 22.2MB
- Sample260429-datwgaby9n
- SHA256 59d78963e8f56b25b95c18d5c672789ddb62ee0e186eda49250cef99edad78b9
Score
8/10
Malware Config
Signatures
- Downloads MZ/PE file 2 IoCs
- Executes dropped EXE 18 IoCs
- Loads dropped DLL 33 IoCs
- Checks for any installed AV software in registry 1 TTPs 4 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 2 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service 6 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtSetInformationThreadHideFromDebugger 33 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 64 IoCs
- Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 2 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 3 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 13 IoCs
- Modifies Internet Explorer settings 1 TTPs 12 IoCs
- Modifies data under HKEY_USERS 3 IoCs
- Modifies registry class 64 IoCs
- NTFS ADS 3 IoCs
- Suspicious behavior: EnumeratesProcesses 30 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 20 IoCs
- Suspicious use of SetWindowsHookEx 9 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ExLoader_Installer (3).exe"C:\Users\Admin\AppData\Local\Temp\ExLoader_Installer (3).exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\ExLoader_Installer.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\ExLoader_Installer.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -command "$WshShell = New-Object -comObject WScript.Shell $Shortcut = $WshShell.CreateShortcut(\"c:\users\admin\desktop\ExLoader.lnk\") $Shortcut.TargetPath = \"C:\Program Files\ExLoader\ExLoader.exe\" $Shortcut.Save()"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Program Files\ExLoader\ExLoader.exe"C:\Program Files\ExLoader\ExLoader.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\ExLoader\complexdangerous.exe"C:\Program Files\ExLoader\complexdangerous.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffec72ac728,0x7ffec72ac734,0x7ffec72ac7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1944,i,840161137484005826,5999165770493043786,524288 --field-trial-handle=2068,i,5850718514924459147,4110329557188233795,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2096 /prefetch:112⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1584,i,7194243556654732394,13264888472138990640,262144 --field-trial-handle=2068,i,5850718514924459147,4110329557188233795,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1820 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2372,i,9472045663901342683,5671118096151048413,524288 --field-trial-handle=2068,i,5850718514924459147,4110329557188233795,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2384 /prefetch:132⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3220,i,18193301662534899281,17290064346645268912,2097152 --field-trial-handle=2068,i,5850718514924459147,4110329557188233795,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3452 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3224,i,101669134711256031,6733192428585802315,2097152 --field-trial-handle=2068,i,5850718514924459147,4110329557188233795,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3488 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4196,i,3157880706921812339,43911347875957707,2097152 --field-trial-handle=2068,i,5850718514924459147,4110329557188233795,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4212 /prefetch:92⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4616,i,10224842982172433991,2684869287987563754,2097152 --field-trial-handle=2068,i,5850718514924459147,4110329557188233795,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4632 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5420,i,4969264106260238311,5204819708314610555,524288 --field-trial-handle=2068,i,5850718514924459147,4110329557188233795,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5364 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5688,i,6678789644408777256,4147679328590812629,2097152 --field-trial-handle=2068,i,5850718514924459147,4110329557188233795,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5364 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5796,i,16365131618707485538,6838115587269286961,2097152 --field-trial-handle=2068,i,5850718514924459147,4110329557188233795,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5768 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3628,i,12955410795856028663,1665995819475740019,524288 --field-trial-handle=2068,i,5850718514924459147,4110329557188233795,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3548 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3452,i,1205712361886500195,3005312476471646818,524288 --field-trial-handle=2068,i,5850718514924459147,4110329557188233795,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3532 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3524,i,1583022973898297503,12713807304007077982,524288 --field-trial-handle=2068,i,5850718514924459147,4110329557188233795,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5784 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5808,i,14377314414559694376,9614184266104624215,524288 --field-trial-handle=2068,i,5850718514924459147,4110329557188233795,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4788 /prefetch:142⤵
- Modifies registry class
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=4236,i,14465554468978763399,9674813379277955648,524288 --field-trial-handle=2068,i,5850718514924459147,4110329557188233795,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4460 /prefetch:122⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5488,i,17174419089711519197,6905794609679462012,262144 --field-trial-handle=2068,i,5850718514924459147,4110329557188233795,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5824 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=6072,i,4393090913694391464,12639301163438692877,524288 --field-trial-handle=2068,i,5850718514924459147,4110329557188233795,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6076 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=1504,i,16947230422464847591,18284867032449231254,2097152 --field-trial-handle=2068,i,5850718514924459147,4110329557188233795,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3480 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6312,i,442831531763604362,9661012295377863742,524288 --field-trial-handle=2068,i,5850718514924459147,4110329557188233795,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6272 /prefetch:142⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
-
-
C:\Users\Admin\Downloads\RobloxPlayerInstaller-DHRD87XHQB.exe"C:\Users\Admin\Downloads\RobloxPlayerInstaller-DHRD87XHQB.exe"2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Roblox\Versions\version-390ba09e7e944154\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-390ba09e7e944154\RobloxPlayerBeta.exe" -personalizedToken DHRD87XHQB --deeplink https://www.roblox.com/games/2753915549/Blox-Fruits -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 52483⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6928,i,14930748839797442365,3933782688961945947,2097152 --field-trial-handle=2068,i,5850718514924459147,4110329557188233795,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6856 /prefetch:12⤵
-
-
C:\Program Files (x86)\Roblox\Versions\version-390ba09e7e944154\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-390ba09e7e944154\RobloxPlayerBeta.exe" roblox-player:1+launchmode:play+gameinfo:T4ITc5AOg_bKTgJRWxesd9zrEkUgZib-n_RoFDyrBFmanxtaR1A-k7coorgSWtLnYKVDektzU9jIdxVBGwHkWHjLUWfeyixTIUzJ5LD2ipg-RWsv8vQKifa9GAMXAK04lxEUSBuwrnQaEhpc4nLFe3NqRNg0lclqhoeZ_Es0i3KyA5FbOI2sjAIwdWJrVNhJ8Ae37VX7dB8thUOd3vVBxbp96Q7EQrv9XdkZy4X9skEY6qvtGwd6gf6LvHYJrXQU16xiZPSh2PiJJOoQgNi7t9W7YVssgabwEL_RZGlQMaYfNaycpo-xrPul-Z1_qcZpqYtMrBk5Br3O5xIdKXUHgj_iPyTzCNN7hC-J3dXTe6-bhE4eftKLAmCYKiNDpXlDzy94Pt1Zuao0VbTJjkvD-nsHhDj-TGhos9ww2hFeCdothkrzcsY-jqcWzSkC1B0oKjzucZOgABwZcH8dUBJxzCJMi-uS7GLB1bp3vOz_fPVkuVZARTzwMJlX5BRIdCmwD7EQKyvT0NXm2_hOMWTcHHWrmIjHRMBGpF_3CUJZP3A+launchtime:1777431585068+placelauncherurl:https%3A%2F%2Fwww.roblox.com%2FGame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D1777431063448001%26placeId%3D2753915549%26isPlayTogetherGame%3Dfalse%26referredByPlayerId%3D0%26joinAttemptId%3D477a9a5a-374a-4df1-8e77-ecf03f22d78e%26joinAttemptOrigin%3DPlayButton+browsertrackerid:1777431063448001+robloxLocale:en_us+gameLocale:en_us+channel:+LaunchExp:InApp2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\Downloads\RobloxPlayerInstaller-DHRD87XHQB.exe"C:\Users\Admin\Downloads\RobloxPlayerInstaller-DHRD87XHQB.exe"2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Roblox\Versions\version-390ba09e7e944154\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-390ba09e7e944154\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 49123⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=3492,i,12331848781581157318,4424787134274892345,2097152 --field-trial-handle=2068,i,5850718514924459147,4110329557188233795,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4760 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=5740,i,15623793569207497554,12746851257478372270,2097152 --field-trial-handle=2068,i,5850718514924459147,4110329557188233795,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5696 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=5720,i,10835444411019698410,1336157645818391830,2097152 --field-trial-handle=2068,i,5850718514924459147,4110329557188233795,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5364 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=5628,i,10140512137993952755,5976621652045130681,2097152 --field-trial-handle=2068,i,5850718514924459147,4110329557188233795,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4328 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=7316,i,15978726366127932824,2494478191394960926,2097152 --field-trial-handle=2068,i,5850718514924459147,4110329557188233795,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=7280 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=7496,i,1406625133999581598,14495134808889059093,2097152 --field-trial-handle=2068,i,5850718514924459147,4110329557188233795,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=7476 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6864,i,4543933893775734920,3370531049269826877,524288 --field-trial-handle=2068,i,5850718514924459147,4110329557188233795,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=7248 /prefetch:142⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
-
-
C:\Users\Admin\Downloads\Bloxstrap-v2.10.0.exe"C:\Users\Admin\Downloads\Bloxstrap-v2.10.0.exe"2⤵
- Executes dropped EXE
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Bloxstrap\Updates\Bloxstrap-v2.11.3.exe"C:\Users\Admin\AppData\Local\Temp\Bloxstrap\Updates\Bloxstrap-v2.11.3.exe" -upgrade -player3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/bloxstraplabs/bloxstrap/wiki/Release-notes-for-Bloxstrap-v2.11.24⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2e0,0x2b8,0x7ffebd07c188,0x7ffebd07c194,0x7ffebd07c1a05⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1636,i,14552577352353073747,17755786960384449290,524288 --field-trial-handle=2060,i,10236938310515814576,3443398564955740214,262144 --variations-seed-version --mojo-platform-channel-handle=2124 /prefetch:115⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1508,i,9758566976095333575,10253848846033153752,262144 --field-trial-handle=2060,i,10236938310515814576,3443398564955740214,262144 --variations-seed-version --mojo-platform-channel-handle=2056 /prefetch:25⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2480,i,13111723363702954905,3391110385973782889,524288 --field-trial-handle=2060,i,10236938310515814576,3443398564955740214,262144 --variations-seed-version --mojo-platform-channel-handle=2636 /prefetch:135⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3416,i,15476159999637881937,15744762966796350263,2097152 --field-trial-handle=2060,i,10236938310515814576,3443398564955740214,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3424,i,15988725001498195897,16699928697451855922,2097152 --field-trial-handle=2060,i,10236938310515814576,3443398564955740214,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4964,i,12490777537240901426,6966132407290948705,524288 --field-trial-handle=2060,i,10236938310515814576,3443398564955740214,262144 --variations-seed-version --mojo-platform-channel-handle=4948 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4960,i,11532788454394324931,4653254119539925883,524288 --field-trial-handle=2060,i,10236938310515814576,3443398564955740214,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,6536689926833324814,2515912968825003772,524288 --field-trial-handle=2060,i,10236938310515814576,3443398564955740214,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,6536689926833324814,2515912968825003772,524288 --field-trial-handle=2060,i,10236938310515814576,3443398564955740214,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5940,i,7511033478894369196,6091113945869481702,524288 --field-trial-handle=2060,i,10236938310515814576,3443398564955740214,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window5⤵
-
-
-
C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-390ba09e7e944154\RobloxPlayerBeta.exe"C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-390ba09e7e944154\RobloxPlayerBeta.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
-
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Roblox\Versions\version-390ba09e7e944154\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-390ba09e7e944154\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Roblox\Versions\version-390ba09e7e944154\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-390ba09e7e944154\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Roblox\Versions\version-390ba09e7e944154\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-390ba09e7e944154\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Roblox\Versions\version-390ba09e7e944154\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-390ba09e7e944154\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Roblox\Versions\version-390ba09e7e944154\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-390ba09e7e944154\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Roblox\Versions\version-390ba09e7e944154\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-390ba09e7e944154\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Roblox\Versions\version-390ba09e7e944154\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-390ba09e7e944154\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f0,0x7ffebd07c188,0x7ffebd07c194,0x7ffebd07c1a02⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1640,i,4511932491356026125,10751069585737634152,524288 --field-trial-handle=2488,i,14074315991549569163,15945772945541290481,262144 --variations-seed-version --mojo-platform-channel-handle=2516 /prefetch:112⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1512,i,18050314387556548222,8994740518315689933,262144 --field-trial-handle=2488,i,14074315991549569163,15945772945541290481,262144 --variations-seed-version --mojo-platform-channel-handle=2484 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2160,i,18015964161678069677,9977567742730694765,524288 --field-trial-handle=2488,i,14074315991549569163,15945772945541290481,262144 --variations-seed-version --mojo-platform-channel-handle=2524 /prefetch:132⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3792,i,16057362827148226146,18119465586734308396,524288 --field-trial-handle=2488,i,14074315991549569163,15945772945541290481,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3792,i,16057362827148226146,18119465586734308396,524288 --field-trial-handle=2488,i,14074315991549569163,15945772945541290481,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4508,i,6929194440332072960,390511557122221448,524288 --field-trial-handle=2488,i,14074315991549569163,15945772945541290481,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4496,i,1503254345642573112,14127413683444596770,524288 --field-trial-handle=2488,i,14074315991549569163,15945772945541290481,262144 --variations-seed-version --mojo-platform-channel-handle=4784 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4444,i,4789711650134990820,15466832362618771862,524288 --field-trial-handle=2488,i,14074315991549569163,15945772945541290481,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4848,i,6812218292345804751,11297555943995691925,524288 --field-trial-handle=2488,i,14074315991549569163,15945772945541290481,262144 --variations-seed-version --mojo-platform-channel-handle=3128 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3148,i,9811966200932049516,15742009905194122931,524288 --field-trial-handle=2488,i,14074315991549569163,15945772945541290481,262144 --variations-seed-version --mojo-platform-channel-handle=3116 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Defense Evasion
Modify Registry
1Subvert Trust Controls
1SIP and Trust Provider Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
RobloxStudioInstaller.exe
ExLoader.exe
ExLoader.zip
audioplayers_windows_plugin.dll
app.so
AssetManifest.bin
background_image.frag
modification_card_image.frag
raindrops.frag
shimmer_effect.frag
winter.frag
icudtl.dat
flutter_windows.dll
permission_handler_windows_plugin.dll
url_launcher_windows_plugin.dll
cacert.pem
BookmarkMergedSurfaceOrdering
BrowsingTopicsState
f_000018
f_000019
f_00001a
f_00001b
f_000131
the-real-index
the-real-index
the-real-index
the-real-index
000004.log
000005.ldb
CURRENT
LOG
LOG
LOG
LOG.old
LOG.old
MANIFEST-000001
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
TransportSecurity
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
the-real-index
the-real-index~RFe5a34bd.TMP
the-real-index
index.txt
index.txt~RFe63cecf.TMP
Local State
Local State
Local State
Local State
Local State
settings.dat
settings.dat
settings.dat
BrowsingTopicsState
the-real-index
data_1
1870cd45-0d19-485a-be6d-687e06d90707.tmp
Network Persistent State
Network Persistent State
Sdch Dictionaries
Preferences
Secure Preferences
sync_diagnostic.log
Local State
Local State
Local State
Local State
3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
a5c29463ba57b77bf976ca59239737ca
05bb18de-3334-4412-ad4b-1c470615296f.tmp
ExLoader_Installer.exe
audioplayers_windows_plugin.dll
app.so
AssetManifest.bin
FontManifest.json
NativeAssetsManifest.json
AbominationPissed_DE.wav
AbominationPissed_EN.wav
AbominationPissed_RU.wav
Csgo_hover.wav
Csgo_press.wav
Fortnite_hover.wav
Fortnite_press.wav
Standard_hover.wav
Standard_press.wav
Steam_hover.wav
Steam_press.wav
Windows_notification.wav
CatsDay.jpg
Cyberpunk.jpg
Easter.jpg
Fallguys_v1.jpg
Fallguys_v2.jpg
FishingDay.jpg
Genshin.jpg
God%20of%20War.jpg
Halloween.jpg
Halo.jpg
IceCreamDay.jpg
JokeDay.jpg
LoveDay.jpg
Ori%20and%20the%20Blind%20Forest.jpg
SchoolDay.jpg
SpaceDay.jpg
SummerStart.jpg
TastyFoodDay.jpg
Warcraft.jpg
logo.png
ar.png
cs.png
de.png
en.png
es.png
fil.png
fr.png
hi.png
id.png
it.png
kk.png
ko.png
mn.png
pl.png
pt.png
ro.png
ru.png
tr.png
uk.png
uz.png
vi.png
zh.png
NoirPro-Bold.otf
NoirPro-Light.otf
NoirPro-Medium.otf
NoirPro-Regular.otf
NoirPro-SemiBold.otf
acrylic.png
bin.png
bios.png
box.png
brightness.png
celebrate.png
click.png
cloud.png
colors.png
complain.png
crash.png
cursor.png
debug.png
defender.png
dice.png
eac.png
engine.png
eye-off.png
flashdrive.png
flip.png
font.png
fps.png
framerate.png
fullscreen.png
fun.png
grain.png
harddrive.png
hint.png
hitbox.png
injection.png
insert.png
issue.png
log.png
logout.png
magnifier.png
mascot.png
memory.png
mods.png
monitor.png
mouse.png
offline.png
opacity.png
ping.png
platform.png
privacy.png
profanity.png
rain.webp
reply.png
rocket.png
rounding.png
shortcut.png
snow.webp
snowflake.webp
socials.png
translate.png
trash.png
updates.png
version.png
wall.png
weather.png
window_size.png
background_image.frag
modification_card_image.frag
raindrops.frag
shimmer_effect.frag
winter.frag
icudtl.dat
flutter_windows.dll
msvcp140.dll
permission_handler_windows_plugin.dll
url_launcher_windows_plugin.dll
vcruntime140.dll
vcruntime140_1.dll
__PSScriptPolicyTest_ks1vewia.usi.ps1
01ea7e9f526e177156614da305eb369b.webp
0a1d4df1c52a9bf8b0be65efc564c90c.webp
0eb49e5656ace9453048eed0256286c9.webp
10937f413f076228e4353320b29ab210.webp
13c0aa4c8798b433117c0503052b36f5.webp
178adac81c1363d482ee3422e343e5ad.webp
1cc191434b7c5a0ddfb7e8933c6ffd39.webp
1f97590d229e484c25eda2b3a7e5e2b5.webp
20d5acdd6b6aa1f32386e853341a3246.webp
26a74180f96d2f37474b3b05092c0c84.webp
35aec07e89e7693c5bcaf8d48c6c4802.webp
3623c6ff5bba27dec8ffa0959b5b6325.webp
3b013530d317ba01a051cab51260763a.webp
419f8e6105542952a2c17346d56ab703.webp
4e683bae2c2f7f2025bc221987379a74.webp
5feab1171c35b8cd9c8c180b73dade19.webp
626af0d33d4a22b0652f5a521b661e2d.webp
634a584ecc365f34e28acc8ebd09db6d.webp
66af973f87bd6cb44ff2db1e87a6b551.webp
670ec740884c596e759a072bdb383b75.webp
731a8729c158a7b043c4cb6537d7f4de.webp
816468bee988a6b92e8d0e284672d2cb.webp
8288ed517e2ed373c4b6085fe8102e2c.webp
8a82a2cf8a29e863c6197775b6c5072c.webp
8f8356bf366928c720bdfd9410e8a6d2.webp
9875c9610b069277fef546eb9ce8f871.webp
9a7d857fd557514347dbdcab5acdd884.webp
9d49e5b61c680c20e60683da2d1ad0ab.webp
a380dbb209729ae36ae39553b94c0ed5.webp
ae5e5005cc18ce5ab8ebb277d99564bc.webp
b0e7df7c1996e50d117db566d927e603.webp
b73690077eb49935afdace6d473b78ad.webp
b7ba5dcbc4de4e2148c1c79f0703f3cb.webp
bfe23e9a9d0aaaa5333cbf1da8df1bc6.webp
d842b0a6ffc8f0c686497037623fb2bf.webp
d957df5ffd7094ce8f53ed4fab03901a.webp
dd191ce20c0b448ff4f96e3faa35707d.webp
dd919fec3fdb56bf251854d5c29fc9e0.webp
de7912048910995cd25c720efe2a3696.webp
dfc86cc55e88d2e58422721cc12e186a.webp
eabb25b4a15a2e3e4a38b5ee5bd57fcd.webp
eaccd93ece9adb25ab08bdcff75296f1.webp
ee3b828fce9b888dc397204da6eef683.webp
eeaf324c921ac5b1ee4972584f7438b7.webp
default.dic
game_icons.zip
shared_preferences.json
shared_preferences.json
shared_preferences.json
shared_preferences.json
locations_v2.csv
Unconfirmed 821367.crdownload
ExLoader.lnk
memory/788-3355-0x000002B742A30000-0x000002B742A3C000-memory.dmp
memory/1868-3356-0x000002CE657B0000-0x000002CE657BC000-memory.dmp
memory/2276-491-0x000001C2437F0000-0x000001C243802000-memory.dmp
memory/2276-490-0x000001C23FC80000-0x000001C23FD2F000-memory.dmp
memory/2276-450-0x000001C23FD30000-0x000001C24104D000-memory.dmp
memory/2276-452-0x000001C23FD30000-0x000001C24104D000-memory.dmp
memory/2276-449-0x000001C23F480000-0x000001C23F481000-memory.dmp
memory/2276-451-0x000001C23FD30000-0x000001C24104D000-memory.dmp
memory/2276-453-0x000001C23F490000-0x000001C23F491000-memory.dmp
memory/2356-3219-0x00000164B4090000-0x00000164B409C000-memory.dmp
memory/2556-3354-0x000001BE863B0000-0x000001BE863BC000-memory.dmp
memory/2632-3321-0x000002300E720000-0x000002300E72C000-memory.dmp
memory/3164-3586-0x0000027159530000-0x00000271595DF000-memory.dmp
memory/3284-3188-0x000001AC29350000-0x000001AC2935C000-memory.dmp
memory/3348-3305-0x0000021BA10A0000-0x0000021BA10AC000-memory.dmp
memory/3408-6955-0x0000023B676C0000-0x0000023B6776F000-memory.dmp
memory/3408-4092-0x0000023B676C0000-0x0000023B6776F000-memory.dmp
memory/3712-1161-0x00000187E1A80000-0x00000187E1B2F000-memory.dmp
memory/3936-681-0x00000195E9BF0000-0x00000195E9C9F000-memory.dmp
memory/3936-682-0x00000195E9F50000-0x00000195E9F62000-memory.dmp
memory/3936-680-0x00000195E97A0000-0x00000195E97AC000-memory.dmp
memory/3936-667-0x00000195EA600000-0x00000195EA622000-memory.dmp
memory/3964-979-0x0000026E8BFE0000-0x0000026E8BFF2000-memory.dmp
memory/3964-978-0x0000026E88050000-0x0000026E880FF000-memory.dmp
memory/4128-3332-0x000001D70ED10000-0x000001D70ED1C000-memory.dmp
memory/4688-3357-0x000002D129480000-0x000002D12948C000-memory.dmp
memory/4912-3342-0x0000000003160000-0x00000000031C4000-memory.dmp
memory/4912-3320-0x0000000003160000-0x00000000031C4000-memory.dmp
memory/5148-3353-0x000001961BD90000-0x000001961BD9C000-memory.dmp
memory/5188-819-0x000001E0D1320000-0x000001E0D27F9000-memory.dmp
memory/5188-822-0x000001E0D0B70000-0x000001E0D0B71000-memory.dmp
memory/5188-818-0x000001E0CEA50000-0x000001E0CEA51000-memory.dmp
memory/5188-879-0x000001E0D1270000-0x000001E0D131F000-memory.dmp
memory/5188-820-0x000001E0D1320000-0x000001E0D27F9000-memory.dmp
memory/5188-880-0x000001E0D5A00000-0x000001E0D5A12000-memory.dmp
memory/5188-821-0x000001E0D1320000-0x000001E0D27F9000-memory.dmp
memory/5248-3212-0x0000000003710000-0x0000000003774000-memory.dmp
memory/5248-3148-0x0000000003710000-0x0000000003774000-memory.dmp
memory/5248-3199-0x0000000003710000-0x0000000003774000-memory.dmp
memory/5528-6906-0x000002B8F1730000-0x000002B8F173C000-memory.dmp
memory/5960-3532-0x000001FA7FDB0000-0x000001FA7FE5F000-memory.dmp
memory/5960-3544-0x000001FA7FDB0000-0x000001FA7FE5F000-memory.dmp
memory/5988-807-0x0000000002E50000-0x0000000002EFF000-memory.dmp
memory/5988-489-0x0000000002E50000-0x0000000002EFF000-memory.dmp
memory/7508-6126-0x000002595B1B0000-0x000002595B25F000-memory.dmp
memory/7784-6941-0x0000019DECD50000-0x0000019DECDFF000-memory.dmp