Analysis
- user interaction
yes - max time kernel
306s - max time network
314s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
09/08/2026, 01:09
General
- Target I2djgYKY.html
- Size 2KB
- Sample260809-bja4lsgb64
- SHA256 7551436b74f5578fa3586b8e01d93104b6555f10f0c78fe79017a48d0c608431
Score
8/10
Malware Config
Signatures
- Downloads MZ/PE file 4 IoCs
- Executes dropped EXE 9 IoCs
- Loads dropped DLL 6 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 3 IoCs
- Network Share Discovery 1 TTPs
Attempt to gather information on host network.
- Suspicious use of NtSetInformationThreadHideFromDebugger 15 IoCs
- Drops file in Program Files directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Embeds OpenSSL 1 IoCs
Embeds OpenSSL, may be used to circumvent TLS interception.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 10 IoCs
- Modifies Internet Explorer settings 1 TTPs 12 IoCs
- Modifies data under HKEY_USERS 3 IoCs
- Modifies registry class 64 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 23 IoCs
- Suspicious use of FindShellTrayWindow 61 IoCs
- Suspicious use of SendNotifyMessage 32 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\I2djgYKY.html1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b0,0x7ffff807c188,0x7ffff807c194,0x7ffff807c1a02⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1776,i,6211287214762038982,12753770031357527771,524288 --field-trial-handle=2340,i,7460059756307673975,954953124591313180,262144 --variations-seed-version --mojo-platform-channel-handle=2396 /prefetch:32⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1684,i,14075524241510830067,685561901255923951,262144 --field-trial-handle=2340,i,7460059756307673975,954953124591313180,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2568,i,16886217142513464088,961637215442623830,524288 --field-trial-handle=2340,i,7460059756307673975,954953124591313180,262144 --variations-seed-version --mojo-platform-channel-handle=2576 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3476,i,6975524456092694935,2999882729020297150,2097152 --field-trial-handle=2340,i,7460059756307673975,954953124591313180,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,465996312544965059,6139562878731439246,2097152 --field-trial-handle=2340,i,7460059756307673975,954953124591313180,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4296,i,11719457516766229571,17130398086441949325,2097152 --field-trial-handle=2340,i,7460059756307673975,954953124591313180,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4340,i,10453172581401852041,12749091408027875919,2097152 --field-trial-handle=2340,i,7460059756307673975,954953124591313180,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,4450115156607024500,14868158534480579255,524288 --field-trial-handle=2340,i,7460059756307673975,954953124591313180,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5164,i,15778424945637681130,14089483258960884070,524288 --field-trial-handle=2340,i,7460059756307673975,954953124591313180,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,385494177438860360,3935907370849301835,524288 --field-trial-handle=2340,i,7460059756307673975,954953124591313180,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,385494177438860360,3935907370849301835,524288 --field-trial-handle=2340,i,7460059756307673975,954953124591313180,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6224,i,8232668224328996879,15507530634630418594,2097152 --field-trial-handle=2340,i,7460059756307673975,954953124591313180,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6488,i,10541614626962860877,15138249890343807691,524288 --field-trial-handle=2340,i,7460059756307673975,954953124591313180,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4340,i,18368121354542053142,8058461292569221562,2097152 --field-trial-handle=2340,i,7460059756307673975,954953124591313180,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7128,i,9418369692430999489,8230556747702462729,524288 --field-trial-handle=2340,i,7460059756307673975,954953124591313180,262144 --variations-seed-version --mojo-platform-channel-handle=7064 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7156,i,4184865716611059943,14257039187072532014,524288 --field-trial-handle=2340,i,7460059756307673975,954953124591313180,262144 --variations-seed-version --mojo-platform-channel-handle=7116 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7104,i,3813711967849666467,4655075159732573962,524288 --field-trial-handle=2340,i,7460059756307673975,954953124591313180,262144 --variations-seed-version --mojo-platform-channel-handle=7164 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5436,i,1330882080289636867,8071719671313095866,524288 --field-trial-handle=2340,i,7460059756307673975,954953124591313180,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=5388,i,4435207162579008577,6582871755182458668,2097152 --field-trial-handle=2340,i,7460059756307673975,954953124591313180,262144 --variations-seed-version --mojo-platform-channel-handle=7096 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7056,i,12127202327658374047,12710932437506713130,2097152 --field-trial-handle=2340,i,7460059756307673975,954953124591313180,262144 --variations-seed-version --mojo-platform-channel-handle=6880 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6976,i,538673926543884193,10796351239075745709,524288 --field-trial-handle=2340,i,7460059756307673975,954953124591313180,262144 --variations-seed-version --mojo-platform-channel-handle=6992 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7240,i,14192269145830578636,16122930296399303911,524288 --field-trial-handle=2340,i,7460059756307673975,954953124591313180,262144 --variations-seed-version --mojo-platform-channel-handle=7212 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7276,i,4387834721654249998,9870064770280061337,524288 --field-trial-handle=2340,i,7460059756307673975,954953124591313180,262144 --variations-seed-version --mojo-platform-channel-handle=7572 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7068,i,6419197865286026462,10340556146069614617,2097152 --field-trial-handle=2340,i,7460059756307673975,954953124591313180,262144 --variations-seed-version --mojo-platform-channel-handle=7592 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7820,i,14941726587349291023,13637500052268700370,524288 --field-trial-handle=2340,i,7460059756307673975,954953124591313180,262144 --variations-seed-version --mojo-platform-channel-handle=7860 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8020,i,13024566096389279625,1200644658195852037,524288 --field-trial-handle=2340,i,7460059756307673975,954953124591313180,262144 --variations-seed-version --mojo-platform-channel-handle=8028 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=7908,i,17420209541197928521,3256215460425217569,2097152 --field-trial-handle=2340,i,7460059756307673975,954953124591313180,262144 --variations-seed-version --mojo-platform-channel-handle=8196 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=8200,i,8201253218667889918,661260165810792282,2097152 --field-trial-handle=2340,i,7460059756307673975,954953124591313180,262144 --variations-seed-version --mojo-platform-channel-handle=8064 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8924,i,18409637836596035299,2674322876358968262,524288 --field-trial-handle=2340,i,7460059756307673975,954953124591313180,262144 --variations-seed-version --mojo-platform-channel-handle=8832 /prefetch:82⤵
- Modifies registry class
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7528,i,1444461983373940632,13856850388932639640,262144 --field-trial-handle=2340,i,7460059756307673975,954953124591313180,262144 --variations-seed-version --mojo-platform-channel-handle=7660 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=6180,i,16740563945891147252,6994600318686934141,2097152 --field-trial-handle=2340,i,7460059756307673975,954953124591313180,262144 --variations-seed-version --mojo-platform-channel-handle=7120 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7684,i,8771532072869508830,16377910333085648006,524288 --field-trial-handle=2340,i,7460059756307673975,954953124591313180,262144 --variations-seed-version --mojo-platform-channel-handle=8028 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7684,i,8771532072869508830,16377910333085648006,524288 --field-trial-handle=2340,i,7460059756307673975,954953124591313180,262144 --variations-seed-version --mojo-platform-channel-handle=8028 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=8264,i,6045016867013801075,2821913508918220135,2097152 --field-trial-handle=2340,i,7460059756307673975,954953124591313180,262144 --variations-seed-version --mojo-platform-channel-handle=8300 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=7060,i,898086223617183831,15611002407500778312,2097152 --field-trial-handle=2340,i,7460059756307673975,954953124591313180,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:12⤵
-
-
C:\Users\Admin\Downloads\Bootstrapper_v2,3.exe"C:\Users\Admin\Downloads\Bootstrapper_v2,3.exe"2⤵
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Bootstrapper_v2,3.exe --webview-exe-version=0.1.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=6052.6104.48595661442811799313⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x178,0x17c,0x180,0x154,0x188,0x7ffff36ab078,0x7ffff36ab084,0x7ffff36ab0904⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --webview-exe-name=Bootstrapper_v2,3.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1740,i,6037919386107233120,913357541528267288,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1724 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --webview-exe-name=Bootstrapper_v2,3.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2032,i,6037919386107233120,913357541528267288,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2060 /prefetch:34⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --webview-exe-name=Bootstrapper_v2,3.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2052,i,6037919386107233120,913357541528267288,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --webview-exe-name=Bootstrapper_v2,3.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3600,i,6037919386107233120,913357541528267288,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --webview-exe-name=Bootstrapper_v2,3.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2264,i,6037919386107233120,913357541528267288,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2116 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --webview-exe-name=Bootstrapper_v2,3.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=784,i,6037919386107233120,913357541528267288,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --webview-exe-name=Bootstrapper_v2,3.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=780,i,6037919386107233120,913357541528267288,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4552 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --webview-exe-name=Bootstrapper_v2,3.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4104,i,6037919386107233120,913357541528267288,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:84⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=8028,i,9796045028135263255,16560151248339935443,2097152 --field-trial-handle=2340,i,7460059756307673975,954953124591313180,262144 --variations-seed-version --mojo-platform-channel-handle=7584 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=8020,i,10516071090638228943,13739638412822035857,2097152 --field-trial-handle=2340,i,7460059756307673975,954953124591313180,262144 --variations-seed-version --mojo-platform-channel-handle=8364 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1544,i,3058718516786003662,4920180765042585808,524288 --field-trial-handle=2340,i,7460059756307673975,954953124591313180,262144 --variations-seed-version --mojo-platform-channel-handle=1336 /prefetch:82⤵
-
-
C:\Users\Admin\Downloads\RobloxPlayerInstaller-BQBGMR8VMT.exe"C:\Users\Admin\Downloads\RobloxPlayerInstaller-BQBGMR8VMT.exe"2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 60923⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Users\Admin\Downloads\RobloxPlayerInstaller-BQBGMR8VMT.exe"C:\Users\Admin\Downloads\RobloxPlayerInstaller-BQBGMR8VMT.exe"2⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6184,i,99725794345368478,5382101157727680812,524288 --field-trial-handle=2340,i,7460059756307673975,954953124591313180,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7712,i,1096518910753273423,2657482959916610256,524288 --field-trial-handle=2340,i,7460059756307673975,954953124591313180,262144 --variations-seed-version --mojo-platform-channel-handle=7688 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5040,i,15263350148565384602,4254485045468613447,524288 --field-trial-handle=2340,i,7460059756307673975,954953124591313180,262144 --variations-seed-version --mojo-platform-channel-handle=8280 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=8628,i,18149344443056927310,10422240175605924669,2097152 --field-trial-handle=2340,i,7460059756307673975,954953124591313180,262144 --variations-seed-version --mojo-platform-channel-handle=8776 /prefetch:12⤵
-
-
C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\RobloxPlayerBeta.exe" roblox-player:1+launchmode:play+gameinfo:WwXKOD3H8CnDEevUlGdpbkbjwct_cZJNTCkipMstqnZyuOInFY72BKSdNmsKVIYn3Padf4IyNGC_-8O3-kgC3AtSUpHO0EfzscQyIomHLSP8AwPlAOKMCIDqiIvNF8JxL33IJ4HnAG3M3fnzy7Rx-VwrlSPfcox0LYxy1gah_Uu036ReqoN-52fK2l4D3gSfEukvk0Q0IP1K9IZ81WQGOAxtlPx-MGeCn3LbcpbuWapLlvS4mXymUMig9OQuam8PA2hmeJgobJN4hq2OfjglE51USj9mXr4Tzzuco1vazWQWnFFCtnTdRFRE2a0GmyoiCaJlhNufUw46Us5kI-qmOZI0DojrIIyBs39GxXefPYsQHtl4S7N4YMqGb9_P70C8LjDGGe1fgNE0h2KVTN58YD4nx1uEvUn0VwwhP1GbI93VyyeAZ_yqWbsSME2zwAuksdproBs68gcl_gcmbc7YqX6QjwmPMhx7VUyB5n1t3rIK73EcW0oDcDsSTqor3rqvv74U5grT6wIpDN9GZxcYXK9dCMXL8hIouYAt_ubfLwi9NDbBJb-IFmW7O_AG5OB1+launchtime:1786238063993+placelauncherurl:https%3A%2F%2Fwww.roblox.com%2FGame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D1786237907439001%26placeId%3D16440734455%26isPlayTogetherGame%3Dfalse%26referredByPlayerId%3D0%26joinAttemptId%3Df789948e-3929-4ace-9dff-9194421d7b06%26joinAttemptOrigin%3DPlayButton+browsertrackerid:1786237907439001+robloxLocale:en_us+gameLocale:en_us+channel:+LaunchExp:InApp2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=8448,i,15738978540495432380,12361756898919111504,2097152 --field-trial-handle=2340,i,7460059756307673975,954953124591313180,262144 --variations-seed-version --mojo-platform-channel-handle=8436 /prefetch:12⤵
-
-
C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\RobloxPlayerBeta.exe" roblox-player:1+launchmode:play+gameinfo:O8ZcS3hvSkSqrguD_3XPYlyqxIrv7O8zgl_bvJhXlNbyntgA5bmoo_V1koGIP_uyGKQ8s4GzFKYtCY0z3EIAuGsk9SvEH2WyNtjwswOPxyJps_NaM8a-Rku0-rj-r3wTmUqxV6Wl2kmddHmyUOAT-mlgyWOJdTTnEczMHRNUkV2gVv07KKnCa4fufCqLgi5hwVablra5YYhnVoOHhlUoCNNTMnN9fi5Cqjc5KgFMK89aRaJxIux9C3D7OTdP6cSCJgYDI6v2kuHD12W5yK2bprW9UrAQw6vGWUEo1kiCG-BUlOH_eNGwW_IutQr3xjSIM2k_Mq_OlglGEeAM5WcTFy-pGzVXI-WTMMYDij2ZsOERCwGxg2AcoXm-7UiU6wa4TjHlQaP5x4KFJ3b73sEYyf_mEuS2N5MSggp06nwhRH9x2b9sWqgW33hAoeJEkMZrOA3Il3bG1THfdqnOn31rr0cknUPiySHIcbt830htdPVCfaBdH9-a9D7UzV-2P2i6orwFCXmdBBhPsQMQtIC0UgdGMZw7jCjEuduqlUFn_IpzpprCqV8XJS0BABdbrENE+launchtime:1786238076173+placelauncherurl:https%3A%2F%2Fwww.roblox.com%2FGame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D1786237907439001%26placeId%3D16440734455%26isPlayTogetherGame%3Dfalse%26referredByPlayerId%3D0%26joinAttemptId%3D84928704-6bbb-4331-b35a-2b84da6aaa21%26joinAttemptOrigin%3DPlayButton+browsertrackerid:1786237907439001+robloxLocale:en_us+gameLocale:en_us+channel:+LaunchExp:InApp2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=8812,i,2149711229689890007,16356707156447396662,2097152 --field-trial-handle=2340,i,7460059756307673975,954953124591313180,262144 --variations-seed-version --mojo-platform-channel-handle=8948 /prefetch:12⤵
-
-
C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\RobloxPlayerBeta.exe" roblox-player:1+launchmode:play+gameinfo:LrIpdYdgezJ_wUloqmv3VROMu70DF8e_EelO_Z5nj8oFaq0jMqkK3d_xCLnlT4nmdcBttMzlBYLVIWP7pFwck1ihAmeQcBjCvQeobcSX-OCK17z-pW33qIcaaQxDk9BYMWwmGegasZIQ6a_vcHfMPq9xwC2XsXejxKwXRYGfjqVrRG_ZzVRnkVgrPcFeG4pRh4mLhnlyTmPORXPSI6GJBxVyksEtqoRCswgKc7qrkaGHrODWWYcTF5jHUTsM667SkhgDTezp36X1LnSyPYn-SBX2UuVLryvMddaqwC2ozdiN_fSfuOyiusMfS-mmj5sJi3ZZl4yjA2mmgO6qhKSzGJf53MAHH78Bg1uoLKuFNn0JSy7NVMfvDHruPrM4837Tso0KTLgzOdddaCe3IaAbmzqCwMoJOnEZpdJBsNi_WL7Fh-AcuISBHxDDOKYXkAYPjnIPVKriN5LT2SRvVuxG-ZMXu7GK29o1vejDJbgEsgK-GT9Yu0CikE_LsuMgjY3VpzgQdhoj415ds4zQnx3pSUUtZJCg-ZreHeYVvHi2_xlslD_4LuwblnVTWeu-Vv7v+launchtime:1786238085712+placelauncherurl:https%3A%2F%2Fwww.roblox.com%2FGame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D1786237907439001%26placeId%3D16440734455%26isPlayTogetherGame%3Dfalse%26referredByPlayerId%3D0%26joinAttemptId%3De050002b-e1cf-48bf-9990-90a2a76e5885%26joinAttemptOrigin%3DPlayButton+browsertrackerid:1786237907439001+robloxLocale:en_us+gameLocale:en_us+channel:+LaunchExp:InApp2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=8432,i,15616881116052015474,10180669503372667684,2097152 --field-trial-handle=2340,i,7460059756307673975,954953124591313180,262144 --variations-seed-version --mojo-platform-channel-handle=8288 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8580,i,5501685824739570072,14712200835524338790,524288 --field-trial-handle=2340,i,7460059756307673975,954953124591313180,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=8936,i,3068939846529080666,8721864792696945659,2097152 --field-trial-handle=2340,i,7460059756307673975,954953124591313180,262144 --variations-seed-version --mojo-platform-channel-handle=8580 /prefetch:12⤵
-
-
C:\Users\Admin\Downloads\RobloxPlayerInstaller-TX497V4Q7M.exe"C:\Users\Admin\Downloads\RobloxPlayerInstaller-TX497V4Q7M.exe"2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
-
C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\RobloxPlayerBeta.exe" -personalizedToken TX497V4Q7M --deeplink https://www.roblox.com/games/16440734455/FORTLINE --webBtid 1786237907439001 --downloadSource web_game_join --authenticationTicket 6eucy3OPssyQEKLRrp7npwp2PmG5SqUmB0ugvOKhy7ecGHl-0U62YSTX3y5ySTtp0QEcBhDoglmigdL32hCwUDWMSzZh5O291KlLSRjFiuTwp_3QveK0L7zmcDqnj7oUKaVS6fO4EnF-vlQ-Zcga7Fi_o6hxao7mogJ27CIRmSORPO-RlOKUDjKhOkir4d0YqBYUM6F7mGudeie8cIpYt9oVRozOUT1sBppkXu0aJTC44L2c2o2xGR2HQcydP95GgWtyP1UpXuyiTSQSwVCDvSe7UFipeT7nIMRCpTbk0DbdtNkafgFDCyBqWn91i-ZGgicuwkoS0nFx1UMweMh88xf_MGsaYD2I39z25JvkuYtBI67DCqv3SJVlEaax3s9P1tFMc9OT9GKVlkuh_vkBcBDbUdUj5D3DifNCYKtT3qRsGGNwGYu8eR3e6pkXZYSYxirW5TzLRhHgh7dtEgEyn-wPPSC_AOirDcF37kFCeQXd3HIejfVmveXLqDRhuN92QqdSSFSbNwdMRQmT53zFrkMcJbOZnI19vUSbb3qnkJqmA87ypodZPNej6fgMl-0k -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 60323⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7724,i,10842481550916700532,10680277642311982342,524288 --field-trial-handle=2340,i,7460059756307673975,954953124591313180,262144 --variations-seed-version --mojo-platform-channel-handle=2988 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
RobloxStudioInstaller.exe
RobloxPlayerBeta.dll
manifest.json
hyph-as.hyb
hyph-hi.hyb
hyph-nb.hyb
manifest.json
manifest.fingerprint
manifest.json
blocklist
settings.dat
settings.dat
LOG.old
BookmarkMergedSurfaceOrdering
f_00006d
f_00006e
f_00006f
f_000070
f_000071
f_000072
f_000073
f_00007d
f_00007f
f_000080
f_000081
f_000082
f_000084
f_000085
f_000088
f_000089
f_00008a
f_00008b
f_00008c
f_00008e
f_000093
f_00009a
f_00009b
f_00009c
f_0000a3
f_0000b9
f_000229
the-real-index
the-real-index
the-real-index~RFe58f5b5.TMP
SiteList-Enterprise.json
Edge Profile.ico
MANIFEST-000001
CURRENT
MANIFEST-000001
000004.log
000005.ldb
LOG
MANIFEST-000001
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
the-real-index
623cd082b6202da0_0
the-real-index
the-real-index
the-real-index
6afc2f541f484f9f_0
6afc2f541f484f9f_1
e3c5699b5189de47_0
e3c5699b5189de47_1
e6c0a08c45e55298_0
e6c0a08c45e55298_1
the-real-index
the-real-index
the-real-index~RFe585407.TMP
the-real-index
the-real-index~RFe5a45a5.TMP
index.txt
index.txt
index.txt
index.txt
f1cdccba37924bda_0
temp-index
the-real-index
the-real-index~RFe58ae5c.TMP
sync_diagnostic.log
OperationConfig
OperationConfig~RFe592a71.TMP
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter~RFe589073.TMP
8960e4e2-5e25-4c39-bbea-0488c0b7426f.tmp
5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
InstallerInfo.log
InstallerInfo.log
cacert.pem
protocols.json
crl-set
settings.dat
settings.dat
throttle_store.dat
the-real-index
the-real-index~RFe5b0ae9.TMP
data_0
data_1
data_2
data_3
Network Persistent State
Network Persistent State~RFe5ba3de.TMP
Preferences
Preferences~RFe5b14ad.TMP
Local State
Local State
Local State
Local State
Local State~RFe5a75be.TMP
default.dic
Bootstrapper_v2,3.exe
RobloxPlayerInstaller-BQBGMR8VMT.exe
DEBUG.txt
DLCTBL_FRTS.tmp
UIDEBUG.txt
UIDEBUG.txt
UIDEBUG.txt
UIDEBUG.txt
UIDEBUG.txt
SolaraV3.dll
memory/3252-3096-0x00007FF8130E0000-0x00007FF8130E1000-memory.dmp
memory/5280-3173-0x00007FF812910000-0x00007FF812911000-memory.dmp
memory/5280-3172-0x00007FF812C70000-0x00007FF812C71000-memory.dmp
memory/5664-3776-0x000001C73A0A0000-0x000001C73A0A1000-memory.dmp
memory/5664-3778-0x000001C73A0A0000-0x000001C73A0A1000-memory.dmp
memory/5664-3777-0x000001C73A0A0000-0x000001C73A0A1000-memory.dmp
memory/5664-3779-0x000001C73A0A0000-0x000001C73A0A1000-memory.dmp
memory/5664-3775-0x000001C73A0A0000-0x000001C73A0A1000-memory.dmp
memory/5664-3774-0x000001C73A0A0000-0x000001C73A0A1000-memory.dmp
memory/5664-3773-0x000001C73A0A0000-0x000001C73A0A1000-memory.dmp
memory/5664-3767-0x000001C73A0A0000-0x000001C73A0A1000-memory.dmp
memory/5664-3768-0x000001C73A0A0000-0x000001C73A0A1000-memory.dmp
memory/5664-3769-0x000001C73A0A0000-0x000001C73A0A1000-memory.dmp
memory/5688-3203-0x00007FF8130E0000-0x00007FF8130E1000-memory.dmp
memory/6052-3732-0x00007FFFEDAA0000-0x00007FFFEE8C0000-memory.dmp
memory/6052-3342-0x00007FFFEDAA0000-0x00007FFFEE8C0000-memory.dmp