Analysis
- user interaction
yes - max time kernel
163s - max time network
165s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
16/07/2026, 21:47
General
- Target https://cdn.discordapp.com/attachments/1523985046095007805/1524186001289904128/ETA_External.exe?ex=6a5a0914&is=6a58b794&hm=91d6c8b35df23b68ea29d1c26b3c52651540be4a6cc5a32f8527a40f756ad768&
- Sample260716-1ndsqsas21
Score
8/10
Malware Config
Signatures
- Downloads MZ/PE file 2 IoCs
- Executes dropped EXE 7 IoCs
- Loads dropped DLL 3 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs
- Drops file in Program Files directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 5 IoCs
- Modifies Internet Explorer settings 1 TTPs 6 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 35 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 3 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs
- Suspicious use of FindShellTrayWindow 51 IoCs
- Suspicious use of SendNotifyMessage 32 IoCs
- Suspicious use of SetWindowsHookEx 5 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1523985046095007805/1524186001289904128/ETA_External.exe?ex=6a5a0914&is=6a58b794&hm=91d6c8b35df23b68ea29d1c26b3c52651540be4a6cc5a32f8527a40f756ad768&1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x24c,0x7ffa34f9c188,0x7ffa34f9c194,0x7ffa34f9c1a02⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1964,i,9698572394208202162,6349091566160231928,524288 --field-trial-handle=2788,i,7423787398602001071,1351095941862166344,262144 --variations-seed-version --mojo-platform-channel-handle=2812 /prefetch:32⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1756,i,1264995584885635016,16555677016291975532,262144 --field-trial-handle=2788,i,7423787398602001071,1351095941862166344,262144 --variations-seed-version --mojo-platform-channel-handle=2664 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2392,i,2783467134233719916,9697833425919732503,524288 --field-trial-handle=2788,i,7423787398602001071,1351095941862166344,262144 --variations-seed-version --mojo-platform-channel-handle=2820 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,5448354689296400953,466741241109887496,2097152 --field-trial-handle=2788,i,7423787398602001071,1351095941862166344,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,16562608392754061841,7151074278453240398,2097152 --field-trial-handle=2788,i,7423787398602001071,1351095941862166344,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4076,i,6158610005122010579,2588700023670276865,2097152 --field-trial-handle=2788,i,7423787398602001071,1351095941862166344,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4092,i,1583531130768080506,4096129895208398790,2097152 --field-trial-handle=2788,i,7423787398602001071,1351095941862166344,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5032,i,1296697067747544118,12590422398891866719,524288 --field-trial-handle=2788,i,7423787398602001071,1351095941862166344,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5040,i,8106396956634056123,2931702087824580806,524288 --field-trial-handle=2788,i,7423787398602001071,1351095941862166344,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5616,i,8071212212340988962,3788970339573484980,524288 --field-trial-handle=2788,i,7423787398602001071,1351095941862166344,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5668,i,11796696228816245533,15503486731898458525,2097152 --field-trial-handle=2788,i,7423787398602001071,1351095941862166344,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5988,i,558206289228211328,1966090088283342750,524288 --field-trial-handle=2788,i,7423787398602001071,1351095941862166344,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6176,i,16344243291745090094,241963188745813542,524288 --field-trial-handle=2788,i,7423787398602001071,1351095941862166344,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6560,i,5002090227705954991,15030745264824832612,524288 --field-trial-handle=2788,i,7423787398602001071,1351095941862166344,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6560,i,5002090227705954991,15030745264824832612,524288 --field-trial-handle=2788,i,7423787398602001071,1351095941862166344,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:82⤵
-
-
C:\Users\Admin\Downloads\ETA External.exe"C:\Users\Admin\Downloads\ETA External.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\Downloads\ETA External.exe"C:\Users\Admin\Downloads\ETA External.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\Downloads\ETA External.exe"C:\Users\Admin\Downloads\ETA External.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6568,i,13651862298585865732,10172470887297516506,2097152 --field-trial-handle=2788,i,7423787398602001071,1351095941862166344,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4244,i,9405240129115719738,10535333675850920132,524288 --field-trial-handle=2788,i,7423787398602001071,1351095941862166344,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=4272,i,3793562963915589649,1232279531369423543,2097152 --field-trial-handle=2788,i,7423787398602001071,1351095941862166344,262144 --variations-seed-version --mojo-platform-channel-handle=4140 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7340,i,696997083954996811,696998091133483042,2097152 --field-trial-handle=2788,i,7423787398602001071,1351095941862166344,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7432,i,2229029388463413551,4929007314092389373,2097152 --field-trial-handle=2788,i,7423787398602001071,1351095941862166344,262144 --variations-seed-version --mojo-platform-channel-handle=7156 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=8092,i,6209038950748032392,5651007524485153829,2097152 --field-trial-handle=2788,i,7423787398602001071,1351095941862166344,262144 --variations-seed-version --mojo-platform-channel-handle=7968 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7860,i,13300601905317247443,5228236556892179606,524288 --field-trial-handle=2788,i,7423787398602001071,1351095941862166344,262144 --variations-seed-version --mojo-platform-channel-handle=7888 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7864,i,11880555310570666367,5822592939050293828,524288 --field-trial-handle=2788,i,7423787398602001071,1351095941862166344,262144 --variations-seed-version --mojo-platform-channel-handle=7852 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7856,i,9855664957476172067,7789690772922070731,524288 --field-trial-handle=2788,i,7423787398602001071,1351095941862166344,262144 --variations-seed-version --mojo-platform-channel-handle=7784 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7500,i,9989832872831499727,4663646443200669370,524288 --field-trial-handle=2788,i,7423787398602001071,1351095941862166344,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:82⤵
- Modifies registry class
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7488,i,13805521909250117154,12309321133756456876,524288 --field-trial-handle=2788,i,7423787398602001071,1351095941862166344,262144 --variations-seed-version --mojo-platform-channel-handle=7576 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3672,i,9679215049167506321,703365084404118753,524288 --field-trial-handle=2788,i,7423787398602001071,1351095941862166344,262144 --variations-seed-version --mojo-platform-channel-handle=7976 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=8436,i,15993125561141181188,13392259981068160656,2097152 --field-trial-handle=2788,i,7423787398602001071,1351095941862166344,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=7440,i,1378319755165035892,3507106306359373940,2097152 --field-trial-handle=2788,i,7423787398602001071,1351095941862166344,262144 --variations-seed-version --mojo-platform-channel-handle=8160 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7940,i,16560808247483608488,6403507024116809592,524288 --field-trial-handle=2788,i,7423787398602001071,1351095941862166344,262144 --variations-seed-version --mojo-platform-channel-handle=7816 /prefetch:82⤵
-
-
C:\Users\Admin\Downloads\RobloxPlayerInstaller-FC984YBTBV.exe"C:\Users\Admin\Downloads\RobloxPlayerInstaller-FC984YBTBV.exe"2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
-
C:\Program Files (x86)\Roblox\Versions\version-ddf02245bdbb428c\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-ddf02245bdbb428c\RobloxPlayerBeta.exe" -personalizedToken FC984YBTBV --deeplink https://www.roblox.com/games/142823291/Murder-Mystery-2 -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 17843⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6692,i,13820845258468312957,248961301331867016,262144 --field-trial-handle=2788,i,7423787398602001071,1351095941862166344,262144 --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=8316,i,11928776957795633378,9694824937306041692,2097152 --field-trial-handle=2788,i,7423787398602001071,1351095941862166344,262144 --variations-seed-version --mojo-platform-channel-handle=8460 /prefetch:12⤵
-
-
C:\Program Files (x86)\Roblox\Versions\version-ddf02245bdbb428c\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-ddf02245bdbb428c\RobloxPlayerBeta.exe" roblox-player:1+launchmode:play+gameinfo:ZWNilNd_PJ_gvrlGfi2nDxnid1VBsPndNlcfPZQPQ_45kDCJJwxY6NZfyGEdRX1i0UY5tUqMgw4wrQtI67eWwT0JPCDK1E3LNRuFUruY2vFInN07CVyaN6WMzjFskDKMFxAma3WV-kJPuogebEom6EBEHLBAbcmbE1bVjSb1tQZJm3KkiOxWr9ZHV_VhH6NAJQHn0_uFsYinpcuSO-do3cjO0j_D5EyU0PcbSyJZFLhQpsujebSpNYsJ9vg7cNasVW9L2YNkBD9dLmy4yfdbN5D1AOYZjl7TFh8Zv7stpHqe_CRMiaGd-4fBtGx36Jaf8wBdwsilhP46ulFLAu_3O6Bq2ofNKPzae40XQA_HcInONr2jcsFpiH-8LaS28gufKWcdgXNC3ImbKRDpalm9Q2mBXID66RE4bTzLw9fSOPx-E707P6YtNQ_iWS02n513jzIph3AMqO8XW0A_q-G0oCcIc05neizBivMqTeNfiaN0Uq4N6KvzevSBPR2oxd_QGtFJ2rE8kTOlDTuQhayoBM9gK6248JyfUuPma6Ok2eJoad5xfT1s7kPt37A2YIZo+launchtime:1784238598276+placelauncherurl:https%3A%2F%2Fwww.roblox.com%2FGame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D1784238476704003%26placeId%3D142823291%26isPlayTogetherGame%3Dfalse%26referredByPlayerId%3D0%26joinAttemptId%3De5a4541b-fea1-4e8a-b67f-221b17afe059%26joinAttemptOrigin%3DPlayButton+browsertrackerid:1784238476704003+robloxLocale:en_us+gameLocale:en_us+channel:zharmonytexturestreamingintegration2-desk+LaunchExp:InApp2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Roblox\Versions\version-ddf02245bdbb428c\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-ddf02245bdbb428c\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
RobloxStudioInstaller.exe
RobloxPlayerBeta.dll
8B2B9A00839EED1DFDCCC3BFC2F5DF12
9F7F3574DF70693C3FCF5AE97E4A7DC9
B46811C17859FFB409CF0E904A4AA8F8
8B2B9A00839EED1DFDCCC3BFC2F5DF12
8B2B9A00839EED1DFDCCC3BFC2F5DF12
9F7F3574DF70693C3FCF5AE97E4A7DC9
9F7F3574DF70693C3FCF5AE97E4A7DC9
B46811C17859FFB409CF0E904A4AA8F8
blocklist
settings.dat
settings.dat
BookmarkMergedSurfaceOrdering
f_0000d8
f_0000d9
f_0000e0
f_0001eb
the-real-index
the-real-index~RFe598812.TMP
SiteList-Enterprise.json
Edge Profile.ico
000001.dbtmp
MANIFEST-000001
000004.log
000005.ldb
LOG
MANIFEST-000001
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Sdch Dictionaries~RFe58b949.TMP
Preferences
Preferences
Preferences
Preferences
Secure Preferences
the-real-index
the-real-index~RFe592f15.TMP
the-real-index
the-real-index
the-real-index
the-real-index~RFe58602c.TMP
the-real-index
the-real-index
index.txt
index.txt
the-real-index
the-real-index~RFe58b66a.TMP
sync_diagnostic.log
3ec14003-a996-493d-a12d-0aa22f01e266.tmp
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter~RFe590323.TMP
b4e30b88-a839-47e7-bed5-c13fde9dd0fc.tmp
5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
ETA External.exe
RobloxPlayerInstaller-FC984YBTBV.exe