Overview

overview

8

Static

static

RobloxStud...ta.exe

windows7-x64

8

RobloxStud...ta.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    183s
  • max time network
    183s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-es
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-eslocale:es-esos:windows10-2004-x64systemwindows
  • submitted
    29/12/2022, 12:11

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    RobloxStudioLauncherBeta.exe

  • Size

    1.7MB

  • MD5

    0d3ad3e8536c7fc109a6e0d7d0f4602f

  • SHA1

    50b2854b85c719219eb90fea2b9840a679dbb951

  • SHA256

    3cb2387973d95e8f14981163e2c4c99c1276d76aecd1799817bfea0b853c7dc0

  • SHA512

    0f22959e4ca8cf3519ac7d0700daa57dcd96d847e111f1b68327fd2b136d622ebd0a1fb6449ab4bfc0acd864a57fd00faf02c0c2d05aeb900f411686638fe2aa

  • SSDEEP

    49152:4Gd7ZRerhHUnGcy3pzM83MgIUwpsRX43TRaWapvM9T3YMoPMQ3dACETfA:4GBZRerhH4y3pzM83MgIe

Score
8/10
discoveryevasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Downloads MZ/PE file
  • Executes dropped EXE 25 IoCs
  • Registers COM server for autorun 1 TTPs 33 IoCs
    persistence
  • Sets file execution options in registry 2 TTPs 2 IoCs
    persistence
  • Checks computer location settings 2 TTPs 7 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 3 IoCs
    evasiontrojan
  • Drops desktop.ini file(s) 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 16 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 43 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 8 IoCs
    evasionspywaretrojan
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\RobloxStudioLauncherBeta.exe
    "C:\Users\Admin\AppData\Local\Temp\RobloxStudioLauncherBeta.exe"
    1⤵
    • Checks computer location settings
    • Checks whether UAC is enabled
    • Modifies Internet Explorer settings
    • Suspicious use of WriteProcessMemory
    PID:4392
    • C:\Users\Admin\AppData\Local\Temp\RobloxStudioLauncherBeta.exe
      C:\Users\Admin\AppData\Local\Temp\RobloxStudioLauncherBeta.exe --crashpad --no-rate-limit --database=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --metrics-dir=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --url=https://upload.crashes.rbxinfra.com/post --annotation=RobloxChannel=production --annotation=RobloxGitHash=75e94a4b5553853bd615ec818ff02126b395c631 --annotation=UploadAttachmentKiloByteLimit=100 --annotation=UploadPercentage=0 --annotation=format=minidump --annotation=token=a2440b0bfdada85f34d79b43839f2b49ea6bba474bd7d126e844bc119271a1c3 --initial-client-data=0x7b0,0x7b4,0x7b8,0x7ac,0x7c0,0xbed440,0xbed450,0xbed460
      2⤵
        PID:2876
      • C:\Users\Admin\AppData\Local\Temp\RBX-1C62D130\RobloxStudioLauncherBeta.exe
        "C:\Users\Admin\AppData\Local\Temp\RBX-1C62D130\RobloxStudioLauncherBeta.exe"
        2⤵
        • Executes dropped EXE
        • Checks computer location settings
        • Checks whether UAC is enabled
        • Drops file in Program Files directory
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:3548
        • C:\Users\Admin\AppData\Local\Temp\RBX-1C62D130\RobloxStudioLauncherBeta.exe
          C:\Users\Admin\AppData\Local\Temp\RBX-1C62D130\RobloxStudioLauncherBeta.exe --crashpad --no-rate-limit --database=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --metrics-dir=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --url=https://upload.crashes.rbxinfra.com/post --annotation=RobloxChannel=production --annotation=RobloxGitHash=142432bbee131ec1e680ff4280b83f65c7d4b91b --annotation=UploadAttachmentKiloByteLimit=100 --annotation=UploadPercentage=0 --annotation=format=minidump --annotation=token=a2440b0bfdada85f34d79b43839f2b49ea6bba474bd7d126e844bc119271a1c3 --initial-client-data=0x714,0x718,0x71c,0x68c,0x734,0x54ea94,0x54eaa4,0x54eab4
          3⤵
          • Executes dropped EXE
          PID:4656
        • C:\Program Files (x86)\Roblox\Versions\version-d90ca73c43104cfd\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe
          MicrosoftEdgeWebview2Setup.exe /silent /install
          3⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Suspicious use of WriteProcessMemory
          PID:1644
          • C:\Program Files (x86)\Microsoft\Temp\EU94BE.tmp\MicrosoftEdgeUpdate.exe
            "C:\Program Files (x86)\Microsoft\Temp\EU94BE.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
            4⤵
            • Executes dropped EXE
            • Sets file execution options in registry
            • Checks computer location settings
            • Loads dropped DLL
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:4616
            • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
              "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Modifies registry class
              PID:4060
            • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
              "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Modifies registry class
              • Suspicious use of WriteProcessMemory
              PID:3596
              • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.163.19\MicrosoftEdgeUpdateComRegisterShell64.exe
                "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.163.19\MicrosoftEdgeUpdateComRegisterShell64.exe"
                6⤵
                • Executes dropped EXE
                • Registers COM server for autorun
                • Loads dropped DLL
                • Modifies registry class
                PID:4204
              • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.163.19\MicrosoftEdgeUpdateComRegisterShell64.exe
                "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.163.19\MicrosoftEdgeUpdateComRegisterShell64.exe"
                6⤵
                • Executes dropped EXE
                • Registers COM server for autorun
                • Loads dropped DLL
                • Modifies registry class
                PID:3060
              • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.163.19\MicrosoftEdgeUpdateComRegisterShell64.exe
                "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.163.19\MicrosoftEdgeUpdateComRegisterShell64.exe"
                6⤵
                • Executes dropped EXE
                • Registers COM server for autorun
                • Loads dropped DLL
                • Modifies registry class
                PID:4376
            • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
              "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNjMuMTkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNjMuMTkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7Njc5N0I1NzMtQzk5OS00NkJBLTlDQTUtNUM0QjJEOEE2MjQ5fSIgdXNlcmlkPSJ7MDI3MDkwMDUtQzk2NC00MkQ3LTg4RUYtMjE1RTMzMkE2MEU2fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins2MzU0MDhDMy05ODVGLTQzNEYtQjAyMS1GNDYzRjVENDFDMDd9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iMiIgcGh5c21lbW9yeT0iNCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IkRBRFkiIHByb2R1Y3RfbmFtZT0iU3RhbmRhcmQgUEMgKFEzNSArIElDSDksIDIwMDkpIi8-PGV4cCBldGFnPSImcXVvdDttNDZLNUs1ejF2dmtOTEhyNGMxeC9oQ2plN1pRTGRxS3laNU53Z3pWM0E4PSZxdW90OyIvPjxhcHAgYXBwaWQ9IntGM0M0RkUwMC1FRkQ1LTQwM0ItOTU2OS0zOThBMjBGMUJBNEF9IiB2ZXJzaW9uPSIxLjMuMTY1LjIxIiBuZXh0dmVyc2lvbj0iMS4zLjE2My4xOSIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNDc3NTQ0ODUwNCIgaW5zdGFsbF90aW1lX21zPSIxMTA2Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:4308
            • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
              "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{6797B573-C999-46BA-9CA5-5C4B2D8A6249}" /silent
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:1256
        • C:\Program Files (x86)\Roblox\Versions\version-d90ca73c43104cfd\RobloxStudioBeta.exe
          "C:\Program Files (x86)\Roblox\Versions\version-d90ca73c43104cfd\RobloxStudioBeta.exe" -startEvent www.roblox.com/robloxQTStudioStartedEvent
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks whether UAC is enabled
          • Suspicious behavior: AddClipboardFormatListener
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:64
          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\108.0.1462.54\msedgewebview2.exe
            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\108.0.1462.54\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 555, 1, 5550874" --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --mojo-named-platform-channel-pipe=64.4376.12450347901925839147
            4⤵
            • Executes dropped EXE
            • Checks computer location settings
            • Loads dropped DLL
            • Enumerates system info in registry
            • Modifies data under HKEY_USERS
            • Modifies system certificate store
            • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            • System policy modification
            PID:1392
            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\108.0.1462.54\msedgewebview2.exe
              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\108.0.1462.54\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=108.0.5359.125 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\108.0.1462.54\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=108.0.1462.54 --initial-client-data=0x100,0x104,0x108,0xdc,0x114,0x7ffb482bf2e8,0x7ffb482bf2f8,0x7ffb482bf308
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:1396
            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\108.0.1462.54\msedgewebview2.exe
              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\108.0.1462.54\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 555, 1, 5550874" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1868 --field-trial-handle=1888,i,3917526041651444487,11914877514124265714,131072 /prefetch:2
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:2536
            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\108.0.1462.54\msedgewebview2.exe
              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\108.0.1462.54\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 555, 1, 5550874" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --mojo-platform-channel-handle=2012 --field-trial-handle=1888,i,3917526041651444487,11914877514124265714,131072 /prefetch:3
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:5064
            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\108.0.1462.54\msedgewebview2.exe
              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\108.0.1462.54\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 555, 1, 5550874" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --mojo-platform-channel-handle=2272 --field-trial-handle=1888,i,3917526041651444487,11914877514124265714,131072 /prefetch:8
              5⤵
              • Executes dropped EXE
              PID:4632
            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\108.0.1462.54\msedgewebview2.exe
              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\108.0.1462.54\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 555, 1, 5550874" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --first-renderer-process --lang=es --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=2960 --field-trial-handle=1888,i,3917526041651444487,11914877514124265714,131072 /prefetch:1
              5⤵
              • Executes dropped EXE
              • Checks computer location settings
              PID:3264
            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\108.0.1462.54\msedgewebview2.exe
              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\108.0.1462.54\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 555, 1, 5550874" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-gpu-compositing --lang=es --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --mojo-platform-channel-handle=3620 --field-trial-handle=1888,i,3917526041651444487,11914877514124265714,131072 /prefetch:1
              5⤵
              • Executes dropped EXE
              • Checks computer location settings
              PID:4188
            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\108.0.1462.54\msedgewebview2.exe
              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\108.0.1462.54\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 555, 1, 5550874" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-gpu-compositing --lang=es --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --mojo-platform-channel-handle=3540 --field-trial-handle=1888,i,3917526041651444487,11914877514124265714,131072 /prefetch:1
              5⤵
              • Executes dropped EXE
              • Checks computer location settings
              PID:4856
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies data under HKEY_USERS
      • Suspicious use of WriteProcessMemory
      PID:1760
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNjMuMTkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNjMuMTkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7Njc5N0I1NzMtQzk5OS00NkJBLTlDQTUtNUM0QjJEOEE2MjQ5fSIgdXNlcmlkPSJ7MDI3MDkwMDUtQzk2NC00MkQ3LTg4RUYtMjE1RTMzMkE2MEU2fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9InswMUM4QzIxRi00MjYyLTQxM0MtOTJDQy1FM0IwQjRENDQzNTR9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iMiIgcGh5c21lbW9yeT0iNCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IkRBRFkiIHByb2R1Y3RfbmFtZT0iU3RhbmRhcmQgUEMgKFEzNSArIElDSDksIDIwMDkpIi8-PGV4cCBldGFnPSImcXVvdDtxV0pTeld3UGZkY0xSK1hHSXY2eHJaZmlZT3hoUFUyczFOV21qV2NhRlBnPSZxdW90OyIvPjxhcHAgYXBwaWQ9Ins4QTY5RDM0NS1ENTY0LTQ2M2MtQUZGMS1BNjlEOUU1MzBGOTZ9IiB2ZXJzaW9uPSI4OS4wLjQzODkuMTE0IiBuZXh0dmVyc2lvbj0iODkuMC40Mzg5LjExNCIgbGFuZz0iZW4iIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjMiIHN5c3RlbV91cHRpbWVfdGlja3M9IjQ3ODQ3Mjk1NjYiLz48L2FwcD48L3JlcXVlc3Q-
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:4456
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{AC2BF2D0-ADAA-4B8D-A089-554A09EFE0A6}\MicrosoftEdge_X64_108.0.1462.54.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{AC2BF2D0-ADAA-4B8D-A089-554A09EFE0A6}\MicrosoftEdge_X64_108.0.1462.54.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
        2⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4588
        • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{AC2BF2D0-ADAA-4B8D-A089-554A09EFE0A6}\EDGEMITMP_A4DF7.tmp\setup.exe
          "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{AC2BF2D0-ADAA-4B8D-A089-554A09EFE0A6}\EDGEMITMP_A4DF7.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{AC2BF2D0-ADAA-4B8D-A089-554A09EFE0A6}\MicrosoftEdge_X64_108.0.1462.54.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
          3⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in Program Files directory
          PID:1528
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNjMuMTkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNjMuMTkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7Njc5N0I1NzMtQzk5OS00NkJBLTlDQTUtNUM0QjJEOEE2MjQ5fSIgdXNlcmlkPSJ7MDI3MDkwMDUtQzk2NC00MkQ3LTg4RUYtMjE1RTMzMkE2MEU2fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntCREU0MTAxRC0zMDc4LTRDMTQtQTg4MS0xMzBDMkRBRUMzN0Z9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iMiIgcGh5c21lbW9yeT0iNCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IkRBRFkiIHByb2R1Y3RfbmFtZT0iU3RhbmRhcmQgUEMgKFEzNSArIElDSDksIDIwMDkpIi8-PGV4cCBldGFnPSImcXVvdDtWUFFvUDFGK2ZxMTV3UnpoMWtQTDRQTXBXaDhPUk1CNWl6dnJPQy9jaGpRPSZxdW90OyIvPjxhcHAgYXBwaWQ9IntGMzAxNzIyNi1GRTJBLTQyOTUtOEJERi0wMEMzQTlBN0U0QzV9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIxMDguMC4xNDYyLjU0IiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY29uc2VudD1mYWxzZSIgaW5zdGFsbGFnZT0iLTEiIGluc3RhbGxkYXRlPSItMSI-PHVwZGF0ZWNoZWNrLz48ZXZlbnQgZXZlbnR0eXBlPSI5IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI0Nzk3MTk5MzM0IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNDc5NzQzOTM4MCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjUyMTkzODkyNzQiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIGRvd25sb2FkZXI9ImJpdHMiIHVybD0iaHR0cDovL21zZWRnZS5mLnRsdS5kbC5kZWxpdmVyeS5tcC5taWNyb3NvZnQuY29tL2ZpbGVzdHJlYW1pbmdzZXJ2aWNlL2ZpbGVzLzE0NmQzNTQwLTcxNGItNDQxMy05MGUxLTE0MjBkMDE4ODRlND9QMT0xNjcyOTIwNzg5JmFtcDtQMj00MDQmYW1wO1AzPTImYW1wO1A0PWdxTm9rU1NBcHY1akhGczFVZ25yazVEQ3pSN05raGpQczlYQTklMmY3WVVvbzZYTTBZMlRDa0JlcSUyYkRPV2pLckJGTk00b013MmJyNDVVT295VW5PQW1NUSUzZCUzZCIgc2VydmVyX2lwX2hpbnQ9IiIgY2RuX2NpZD0iLTEiIGNkbl9jY2M9IiIgY2RuX21zZWRnZV9yZWY9IiIgY2RuX2F6dXJlX3JlZl9vcmlnaW5fc2hpZWxkPSIiIGNkbl9jYWNoZT0iIiBjZG5fcDNwPSIiIGRvd25sb2FkZWQ9IjEzODQwNjM2MCIgdG90YWw9IjEzODQwNjM2MCIgZG93bmxvYWRfdGltZV9tcz0iMzUwODQiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MjE5NTA5MDMxIiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTIzMzE4OTYyNCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjE5NjYwOCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTQzMDAyOTEyNCIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgdXBkYXRlX2NoZWNrX3RpbWVfbXM9Ijc3MyIgZG93bmxvYWRfdGltZV9tcz0iNDIxNjkiIGRvd25sb2FkZWQ9IjEzODQwNjM2MCIgdG90YWw9IjEzODQwNjM2MCIgcGFja2FnZV9jYWNoZV9yZXN1bHQ9IjAiIGluc3RhbGxfdGltZV9tcz0iMTk2NzQiLz48L2FwcD48L3JlcXVlc3Q-
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:3768
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x45c 0x2fc
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1964
    • C:\Windows\System32\GameBarPresenceWriter.exe
      "C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
      1⤵
        PID:1340
      • C:\Windows\system32\OpenWith.exe
        C:\Windows\system32\OpenWith.exe -Embedding
        1⤵
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        PID:4540
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
        1⤵
        • Drops desktop.ini file(s)
        • Checks processor information in registry
        PID:2768

      Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Program Files (x86)\Microsoft\Temp\EU94BE.tmp\EdgeUpdate.dat
              Filesize

              12KB

              MD5

              369bbc37cff290adb8963dc5e518b9b8

              SHA1

              de0ef569f7ef55032e4b18d3a03542cc2bbac191

              SHA256

              3d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3

              SHA512

              4f8ec1fd4de8d373a4973513aa95e646dfc5b1069549fafe0d125614116c902bfc04b0e6afd12554cc13ca6c53e1f258a3b14e54ac811f6b06ed50c9ac9890b1

              Download Submit

            • C:\Program Files (x86)\Microsoft\Temp\EU94BE.tmp\MicrosoftEdgeComRegisterShellARM64.exe
              Filesize

              171KB

              MD5

              442aa2e9f4d9790dc70f06ff191f3b23

              SHA1

              1b4ac8bee4f2013ab001aaae0d443ae926f1b313

              SHA256

              d0e90c0f6119b690bb7b52978de18238dfe745feb23f511527dc55478e120f34

              SHA512

              3ac5e7548278b36123379778da7eea188c9aa7514fc0f51545dc8d2f52989dea7dfee8ffca0334c766ef10ac89656fef31682ce690e56a7096512ae4c941e268

              Download Submit

            • C:\Program Files (x86)\Microsoft\Temp\EU94BE.tmp\MicrosoftEdgeUpdate.exe
              Filesize

              200KB

              MD5

              c972e3fd1b8a8b9ee149dc551360cc6c

              SHA1

              0e4010c0314af71a1d9c6b67b7a8e3d6d0d01726

              SHA256

              9d2e4a42cbcdd9315b6c86a36af632c86293940287dc26930e1c7932eb7c6cb2

              SHA512

              f8b0536876557f6d53957b8204dcbf7097f8d7cf281e9e9dde9d341da64474f460897bd03cb2f886027c8eeb400121713c476569a5a0d08bbe521b2305fb9515

              Download Submit

            • C:\Program Files (x86)\Microsoft\Temp\EU94BE.tmp\MicrosoftEdgeUpdate.exe
              Filesize

              200KB

              MD5

              c972e3fd1b8a8b9ee149dc551360cc6c

              SHA1

              0e4010c0314af71a1d9c6b67b7a8e3d6d0d01726

              SHA256

              9d2e4a42cbcdd9315b6c86a36af632c86293940287dc26930e1c7932eb7c6cb2

              SHA512

              f8b0536876557f6d53957b8204dcbf7097f8d7cf281e9e9dde9d341da64474f460897bd03cb2f886027c8eeb400121713c476569a5a0d08bbe521b2305fb9515

              Download Submit

            • C:\Program Files (x86)\Microsoft\Temp\EU94BE.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe
              Filesize

              204KB

              MD5

              614333ab86e79fdaa843716048d931e9

              SHA1

              876b32b9ccd01ea98fe63ba29fcb8e558e0f0107

              SHA256

              ef6f0216013efb64b296173ea8be412450e08675ef55a4e18b996e2f8e0629c9

              SHA512

              e84e1f662073e06742ca99aed679cc7cb236953b1c71a082e6ad365aeba18cd8c8e96bc0208981fc27460bd92da05d0a9031b787374169f543fbc0d59a1e34b0

              Download Submit

            • C:\Program Files (x86)\Microsoft\Temp\EU94BE.tmp\MicrosoftEdgeUpdateCore.exe
              Filesize

              246KB

              MD5

              8be394c11fa1a95c8551344240be1265

              SHA1

              d391e02755c0621f17783b2f43e8a8a08dfd7f94

              SHA256

              f94ba25a299d4f2253edde23d524a84f8952fda3e7d4b7bdc2ef9a6d4533ef3f

              SHA512

              59c8bccd8468f199e7cdef78c336b418c46f5bf11518a93c5bb3f366eb4fa2c7eac01842314555553ee099f15c3dc61c932da14e78fe91556222a17b57e43962

              Download Submit

            • C:\Program Files (x86)\Microsoft\Temp\EU94BE.tmp\NOTICE.TXT
              Filesize

              4KB

              MD5

              6dd5bf0743f2366a0bdd37e302783bcd

              SHA1

              e5ff6e044c40c02b1fc78304804fe1f993fed2e6

              SHA256

              91d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5

              SHA512

              f546c1dff8902a3353c0b7c10ca9f69bb77ebd276e4d5217da9e0823a0d8d506a5267773f789343d8c56b41a0ee6a97d4470a44bbd81ceaa8529e5e818f4951e

              Download Submit

            • C:\Program Files (x86)\Microsoft\Temp\EU94BE.tmp\msedgeupdate.dll
              Filesize

              2.5MB

              MD5

              f792e8e45ed8d67918daeb1068ab1a7a

              SHA1

              07b0b86553c1c44ff104a43b91154cfb87ec4fb9

              SHA256

              bf0613d345a534402f924c748ae34b3fae05f048276abd5e96c834477251af84

              SHA512

              e5828af7fd2b1d5918efdfdd5fef8721dc4d175302338bd3272441821762ce3794dbb0e0f79de66f145c107e86edd42b5f746cafc27205f8e61b493751f8fe55

              Download Submit

            • C:\Program Files (x86)\Microsoft\Temp\EU94BE.tmp\msedgeupdate.dll
              Filesize

              2.5MB

              MD5

              f792e8e45ed8d67918daeb1068ab1a7a

              SHA1

              07b0b86553c1c44ff104a43b91154cfb87ec4fb9

              SHA256

              bf0613d345a534402f924c748ae34b3fae05f048276abd5e96c834477251af84

              SHA512

              e5828af7fd2b1d5918efdfdd5fef8721dc4d175302338bd3272441821762ce3794dbb0e0f79de66f145c107e86edd42b5f746cafc27205f8e61b493751f8fe55

              Download Submit

            • C:\Program Files (x86)\Microsoft\Temp\EU94BE.tmp\msedgeupdateres_af.dll
              Filesize

              28KB

              MD5

              35b4d7c0719c36b878887b5188c5e82b

              SHA1

              7d01dac9b9116c4719ee1408cd86c1c993c4550e

              SHA256

              84cbc65aa12d77d41b65ce260fbc530541482d582e81fa840b020b95676de4fa

              SHA512

              f3bea0b0dc14b2b6b5cb660ee08a002489bbd3f4a3096596f81d281276e1bebd8f9db2c280402d702a89ef1d16efc64b1b5f87bae7cf4df204f97b752e26e712

              Download Submit

            • C:\Program Files (x86)\Microsoft\Temp\EU94BE.tmp\msedgeupdateres_am.dll
              Filesize

              24KB

              MD5

              11d4729ae9223aa700a0567776dc945a

              SHA1

              f8692a4a14265a1e9b40212ed2cb15a9b60c3ee3

              SHA256

              e0d689721db0d37d02726d11d29de763128436c4cbf24a7f1bdc2461e3d2943f

              SHA512

              be8eab2582ddd0e9a6cb1955d005ec771425f8d124a27c926b7636c85d7fd02876ad35c7092f9ecca4192b0a0fc4633a36772a862783813a2d1636132a2fa848

              Download Submit

            • C:\Program Files (x86)\Microsoft\Temp\EU94BE.tmp\msedgeupdateres_ar.dll
              Filesize

              26KB

              MD5

              f2a8c6971f00ce1301cfdc1b6425e423

              SHA1

              df2b0d2a3b81f410d366a5797e87a8cc2bbcd4fa

              SHA256

              334cfb7cd0f2418a00b715deda1e0e95b0d176bfb7fae0f23dc7e3b831f34288

              SHA512

              915efa6b258fbe663a56dec55db4f766ef3ea9a49886b1522bdbea03e2f294ebaa641d8ef62e64302a085760570e694310d6991715b3bfd639f2909790e92f49

              Download Submit

            • C:\Program Files (x86)\Microsoft\Temp\EU94BE.tmp\msedgeupdateres_as.dll
              Filesize

              28KB

              MD5

              8a11cb11d1992150a47d4766e9120d18

              SHA1

              a8c85963af68d743d46565b403935dd0d21d577c

              SHA256

              fb6a57006837daeafa2eb89336989dd9a184b2b2ed26bcca7fa4e45892045aca

              SHA512

              6f35916b2a6e4bd79c29a98bf601445d424816745b0c41bb396d7d54a05f2d28c0c82fa1373478235b1fd630c461dc94057e6459f5e15a7303470c7c67241dcc

              Download Submit

            • C:\Program Files (x86)\Microsoft\Temp\EU94BE.tmp\msedgeupdateres_az.dll
              Filesize

              29KB

              MD5

              49fba4263f3d828888a1d2ed34c8ff15

              SHA1

              44d5f059bace72db4d17c5553de8ba214c6e0121

              SHA256

              11f911d6c50a604a3fcadb84add69a5d8bb7b2c651f2d4bc7c8f581998584d6e

              SHA512

              8af90910b97c474648fac6c952dacdd954696e9b620d357521bfbf37eb6efb411b658e82cd66ff65bac88abb0d0f44048048d6b91160070deb609f5ce5479651

              Download Submit

            • C:\Program Files (x86)\Microsoft\Temp\EU94BE.tmp\msedgeupdateres_bg.dll
              Filesize

              29KB

              MD5

              7c511e1fceab3c138df27f8577017186

              SHA1

              3f2b8c02f29fbf8ec407e3f81d40d0e63c53f8c1

              SHA256

              03bbca7a9fc9ea89314affa8d63d5bd0ff5ac59a5f08622726cbbf1d8b30a47b

              SHA512

              0add1766515c3f502b4369348f2ded7099282a643f213262e35d0431b8341a6e6c69c943dc87012046084597a5b2bb48fb8751eb7b6a5c9c9ff238ac525ad1df

              Download Submit

            • C:\Program Files (x86)\Microsoft\Temp\EU94BE.tmp\msedgeupdateres_bn-IN.dll
              Filesize

              29KB

              MD5

              6f9c356243a8ccc1aa5984261e54e102

              SHA1

              0b297e99c82c0469b21f7c89ad4347cc25920fdc

              SHA256

              b630ba7deb7ab385a9051ba5dde1b2749f3184fc1bd502e9b3d8ca3e4eb8a960

              SHA512

              5bc69b603e22a3b46f6e034f01a9dec59ad1503c6e3283745a0f0d989741f3b020f3baaa9fcca246c3585d13938eb0a4a9d0895ab64ed858ecc6d6f09578ec47

              Download Submit

            • C:\Program Files (x86)\Microsoft\Temp\EU94BE.tmp\msedgeupdateres_bn.dll
              Filesize

              29KB

              MD5

              92f3e863aad93cf6ee745174d67db4f1

              SHA1

              110b982e4ee28d12ec71f6805f517418f4081e92

              SHA256

              7d355163e49f28da98cb3b58be0161ff201d40aaa33f5e70459fd13c9a0d6c3c

              SHA512

              c6e8968f5be16f66b7ec4c18d86baa3075ce685f10821638e64a5418e93e9bacab7e021355fe6cb6f2c0c67e830baa01c7b7247d77635f8b1eb3075af9960261

              Download Submit

            • C:\Program Files (x86)\Microsoft\Temp\EU94BE.tmp\msedgeupdateres_bs.dll
              Filesize

              28KB

              MD5

              266d076471495ef10c6e14f210ab7189

              SHA1

              afe7b7b18e6dcc4355cb95d737f12b8efd7fa3bb

              SHA256

              dc01802f4a31b6265971c299470a7f2547a2fe6be0c31f572d49e48fac1ebb80

              SHA512

              4b3a2c6c9c79d15b5667ad3fe93218136842f165f2f3e8c44df4b626ef6f42a54dbaed775b9afb4f933e134244c250aca6aacddc60e7c5ae7f2f10347bff8163

              Download Submit

            • C:\Program Files (x86)\Microsoft\Temp\EU94BE.tmp\msedgeupdateres_ca-Es-VALENCIA.dll
              Filesize

              29KB

              MD5

              7956262005d907a10350de95f5aeefca

              SHA1

              bd81fec8684edc7103239abb2a99e52e96252967

              SHA256

              52a07b8ce04c3e9cf13454c2dae094491832ef964ce766ff12c26f1c1c6913cf

              SHA512

              7537fd3dfb7cb04655559fc5defdb8c371427f750cff9227cf6a1d8730025b0e406597f0c917ac8f18717bc7ef5cfae40adeca6eb824f3763f065374c5b774e0

              Download Submit

            • C:\Program Files (x86)\Microsoft\Temp\EU94BE.tmp\msedgeupdateres_ca.dll
              Filesize

              30KB

              MD5

              348f46e013c2d4b1d27b9471eca8caba

              SHA1

              9f3a7140cad368f8b5e124b1357ee7c72044c5ef

              SHA256

              3e105db696197697a1fdcdbd4d79a228cae0d917de53e6097b11deefdad8e069

              SHA512

              d0bc2f2b2b2429aa0e2cd008a59005ef1548921e364f5197c82d301395353b912337917d4c6cc41b7b17283111cf47d84e11086bb988c27fc8c1dc36b3c3e033

              Download Submit

            • C:\Program Files (x86)\Microsoft\Temp\EU94BE.tmp\msedgeupdateres_cs.dll
              Filesize

              28KB

              MD5

              fdbe2255df8963da4e607c4a97655954

              SHA1

              806007e3a6623a0c04fd20343f1e64bc7af759dd

              SHA256

              18fa8069674dfa3ceb75f1985255918b326f38554e074b5b48d4f37defbd1f6b

              SHA512

              6d8bbfc52782d696eec8ce3852a503cdf3befa3f3d1b3b5a65844ea6b4377a0cb144c0e926a84b85010f4756010cd05b37385a0e5c828b8772db477492dd639c

              Download Submit

            • C:\Program Files (x86)\Microsoft\Temp\EU94BE.tmp\msedgeupdateres_cy.dll
              Filesize

              28KB

              MD5

              725103eb62cfec2d703c93c859bc42d3

              SHA1

              df8c65fed02dab29cf1eec26f3b27079d547f12f

              SHA256

              16b2bb6db18f5125472acfd13bf22699e4c6ad31e051f17a9e63cb409f779548

              SHA512

              0c6d1c0bb2743948ae407228c05917e78c2ea5b63f5629e116049117205d60718f7e1947d6e2b311ef46670569be627689b510d862340666e96e9a9d7bf829da

              Download Submit

            • C:\Program Files (x86)\Microsoft\Temp\EU94BE.tmp\msedgeupdateres_da.dll
              Filesize

              28KB

              MD5

              7416acc41647edeb05a614eaeb3aa862

              SHA1

              c1de9e98aeb7b72b6dd2718e387f1a60f1fe93ac

              SHA256

              c24dccd62abc42a3a284e4852de8ffa4322373dc71e78e4c8dbe9a03e245fff7

              SHA512

              0d8e27dab1ce275f9d012de5ba613486a70012280e3e03eb9a40a304cc82ecaec1cab8eb8b241ab00c24cfb9468c24e2f201cb08bba98c4e088ebff68b7a7483

              Download Submit

            • C:\Program Files (x86)\Microsoft\Temp\EU94BE.tmp\msedgeupdateres_de.dll
              Filesize

              30KB

              MD5

              352f4eef8e8b2d8fc50faa43193123a7

              SHA1

              ab88be2aaf057dfa72fdacf8020f5b0c95c72ba6

              SHA256

              b5c150a763593009bf1598287f62a5a09878b9f1af4e8538c3c7416f5676f5ce

              SHA512

              724bf924567feb42e87f5eaad1394175bcbabfa8fd6ad3c5c5b816cebd4f3fcb78d52422a2fa5485f7220943517f6f64969476f895938bff65c604fe0425ce2f

              Download Submit

            • C:\Program Files (x86)\Microsoft\Temp\EU94BE.tmp\msedgeupdateres_el.dll
              Filesize

              30KB

              MD5

              d164e5e7a698df0ce55e367228f6b3d0

              SHA1

              49e267110708b45b7519bbd22dddb765afb2053c

              SHA256

              f0d5609c9bcc6fe33ed5ac07d1e344db60baf3f3a5c4de9aef6a1d85e375d4e7

              SHA512

              3b5d9a4d779a2cacacad342dc620f3808a7c6dec29bf89c2ab225379cdb7ab3d03218d2d07110fb6570fd04084124a06c0b24c8d64d5b547efed7e29e018f30a

              Download Submit

            • C:\Program Files (x86)\Microsoft\Temp\EU94BE.tmp\msedgeupdateres_en-GB.dll
              Filesize

              27KB

              MD5

              fbd1b9343ed731bc2aa43d098b3478b0

              SHA1

              e835019ed04093096e8b5983cbc493181d0713c1

              SHA256

              8285648fb7e8b6325395eadc0026eac19214a9890d34e24c9af32617278c2ffd

              SHA512

              cafdff95ff71b80c6ab3ec5f27b0b2896dc8f37cf7fe1fcb0561e3a354c0531efa0e56b8b47858f681db865ec2d676f2134add132d102da3cf5c54c63cb02d17

              Download Submit

            • C:\Program Files (x86)\Microsoft\Temp\EU94BE.tmp\msedgeupdateres_en.dll
              Filesize

              27KB

              MD5

              7dedce4d230366f821a2a277c37eabcc

              SHA1

              6d31f1bb51ddfb362dfc16d51743618c4cef0d25

              SHA256

              37635486e66680a561e79fccf8ebcce73f59dcb3eb9efbab3d0f08b335f93051

              SHA512

              d4575aa31a7ce6d41d014583787fdda1f65a0a1e1543a0cc6d1deddd997e30a0f8b69ce9851f2dfcef184e819001a8b2756ae538422c79abeb7bb38a8d513508

              Download Submit

            • C:\Program Files (x86)\Microsoft\Temp\EU94BE.tmp\msedgeupdateres_es-419.dll
              Filesize

              29KB

              MD5

              5e113030475e75b2ffd990b638f29fdc

              SHA1

              0d50800f4aa7793c98024b513daffd26752f2639

              SHA256

              d30efa659aeeb23ad859dc75bf775a9f57caf0dcb762284a02f834f27e3401b0

              SHA512

              2d912e905393741a8b151e4468f8c31f383aaccb21304b58b86db4911bc0299913ceff31857e513a91f12c9c8aeb7aafdcc3fa5e4f8a2b16525a7a342ffec52e

              Download Submit

            • C:\Program Files (x86)\Microsoft\Temp\EU94BE.tmp\msedgeupdateres_es.dll
              Filesize

              28KB

              MD5

              73bc1e26270f1c56297fde131a6da616

              SHA1

              141565147720ec65a07dd40ecc06a8c31be1782b

              SHA256

              1b7bac543ca8347dc88b07045c08346215b2823b462266b86b92d11343c76038

              SHA512

              c2a6443053831379baf1b08d12d64f15d1b40deff38cc29a41952715b078a87625007e8f0f50cfcdfdfcf0ec400a31f307b66932f6c6bbc8afd500d942deb017

              Download Submit

            • C:\Program Files (x86)\Microsoft\Temp\EU94BE.tmp\msedgeupdateres_et.dll
              Filesize

              28KB

              MD5

              6c6d83736c179c24bcd2cedc3cd5e7a6

              SHA1

              e109286ac92a334b85c5cc468c8a3f9b68e08704

              SHA256

              fa69d5e3441724e4811f1a9df7bc3789f466b97b17ddc68994bb5d93d4c89211

              SHA512

              fe7ca7fe3e56af4bf26ee5633d3081d078087c21bfd45102fbb18a2e1ecbf20bb1539004482fc25afd1268de4962bec5bf2e8c52e061af53eca1e3be1bbee7a7

              Download Submit

            • C:\Program Files (x86)\Microsoft\Temp\EU94BE.tmp\msedgeupdateres_eu.dll
              Filesize

              28KB

              MD5

              52bbbf5552b1aa916202a5444072fc9e

              SHA1

              f2fde9f28619c0e0c9ba01cd12a30418048be6b1

              SHA256

              43db27940f2ebdea4c10daad3f6ea9abdaeefe2a0d73fbed3074c714e5d5d62c

              SHA512

              54c7f8b1fe27dce2aebc77dc6e45cae4cbd410cf5613db78f2af5f247596ce76c6986df9ef4ea57c2aeb0b969a2e57e7aa71a7dec3d19fa4dbd275de393e7144

              Download Submit

            • C:\Program Files (x86)\Microsoft\Temp\EU94BE.tmp\msedgeupdateres_fa.dll
              Filesize

              27KB

              MD5

              1b99b13db7d140a826f6e9710a6b7354

              SHA1

              d16720c3333e724f154a91defa91677560a12b5e

              SHA256

              264e2593041f6df6fae387f6f8c65efb8259ac595a550cdb5652e5ac1e615a67

              SHA512

              df085281afd332bbfbf0430ab89de665ef27c61fbf3a8c8eb70de05853e91ba4cc19f80c5bd1923cc4656721b1df8aaf2d0ea1d12a9c6789e43cf47d1eb55c37

              Download Submit

            • C:\Program Files (x86)\Microsoft\Temp\EU94BE.tmp\msedgeupdateres_fi.dll
              Filesize

              28KB

              MD5

              79d34447e485199c08763910b9af2d0f

              SHA1

              c3efbfd884d94fe6b3c42d547faec8c47beb1f36

              SHA256

              d28547dec09d9acea39ce521a8a1cd84d1b680861bb6605cf77124603491a55a

              SHA512

              1c1a3237e18dc7522d40e52c1e705f2d6eca7daabf8ac2a720e8016116c0728b89c2b3b44ffe8a37a690a55da8de49d7aa2961073a73a2756980a556329d6afb

              Download Submit

            • C:\Program Files (x86)\Microsoft\Temp\EU94BE.tmp\msedgeupdateres_fil.dll
              Filesize

              29KB

              MD5

              932c27932f1461b7ad464cbfd01b1503

              SHA1

              4a7e8e78ebc20ae45f309a2cf26cca01250d91f4

              SHA256

              0e5d3cf9da0ddb9e4fefba93df87c8a12ca7db541c27237e0a8c6e88d1375404

              SHA512

              65c22e8804fe9cacff4350e37caaea7692decb4139ab47a671bb83797b7a29fe1d972a054249e1d264f5d0a4d725483c0d767052b854d8bb5034a055b41609b3

              Download Submit

            • C:\Program Files (x86)\Microsoft\Temp\EU94BE.tmp\msedgeupdateres_fr-CA.dll
              Filesize

              30KB

              MD5

              61eed9a49806581f19649619c7a6ef25

              SHA1

              4060391586249ae832519ef08211137b2d6a9dd9

              SHA256

              47205c98fdca27d4490363cdae388b810a1b72b62e863e4accf0b4570f824d83

              SHA512

              9c533f4bf2a66e966e149393be5d6439569bdb0ab6d04c15aadf9d4be09e3c11c34afb5022eb2af75bf5634dc92d52f0fbe54284d80124cc4d02fef4d00481db

              Download Submit

            • C:\Program Files (x86)\Microsoft\Temp\EU94BE.tmp\msedgeupdateres_fr.dll
              Filesize

              30KB

              MD5

              db73defc487d7d9cebece6df74c70333

              SHA1

              6a8e369a575abbc571430ca91b993410320e21fd

              SHA256

              9ef2c4c66badb4c248be08c45a61c82e31212cc9bd0a6398e553e3160b8330b6

              SHA512

              d56353c783b239c76c4730b75530fe402c468e52ed6b4bb80b45ac655a5f5dd3481eead775f7c8426c83736d18eca49780d8a9ceb6e65c46c9d6fd140d02c4a7

              Download Submit

            • C:\Program Files (x86)\Microsoft\Temp\EU94BE.tmp\msedgeupdateres_ga.dll
              Filesize

              28KB

              MD5

              8b498cffe54e957da8f7f7e7039db7b1

              SHA1

              9bd457d8373d8f10d04be3fb5be8128749400ee8

              SHA256

              0831a72bd18cc79004fe025684844a143255932aa1f814a8c85da0f2e865d49f

              SHA512

              8f99d8262762f252528389249505d5a6e2523c61cfb7c525f8b90300dfc8607843a97da9cbb8b2f3e9b88799300d02fd6d2f15dd2048c99ab9a49905eccec3ff

              Download Submit

            • C:\Program Files (x86)\Microsoft\Temp\EU94BE.tmp\msedgeupdateres_gd.dll
              Filesize

              30KB

              MD5

              f432996f21274cf7ff56a3cd4b7767ef

              SHA1

              34c02edecc532cec80432268cfb3e43abf8ee032

              SHA256

              5222302c073583ba607ca962d43608a53d11ade0761df46d2fde13a66da717e0

              SHA512

              e814df7c88d467176b8e743f5520151961dc26819f79460f4afd98b6200f89e8eb1e26b52ab8535780af1fa06042a2c00428db457cdef5b8d13281ca09336530

              Download Submit

            • C:\Program Files (x86)\Microsoft\Temp\EU94BE.tmp\msedgeupdateres_gl.dll
              Filesize

              28KB

              MD5

              c4eda4695ff5c8a1034e617ac88b8481

              SHA1

              e8886d1de52444de365d4cf50fbf1611e3fd5264

              SHA256

              95ca237669b18db9a56268107c4e50c16d649fe5f0a244f418390a2ca7625d00

              SHA512

              daaedfbbcfbed111cf14ff05903398a8109bf87e403fe0f26d3072936ca5eaf2e5d5c9c6ab525dbdde4e6dc0c89a872f0962d0f33f98b931f2afdaffc158bc4b

              Download Submit

            • C:\Program Files (x86)\Microsoft\Temp\EU94BE.tmp\msedgeupdateres_gu.dll
              Filesize

              28KB

              MD5

              664fc5bc9be28bcbd3b9da17d39d5d65

              SHA1

              f4582edd46c98ef95805ae5ffa36bd6dd34cb4bc

              SHA256

              cbcb71a96267989501d722eadc64033a26ce55fbfc658f4e6270f117e6ca345f

              SHA512

              363185949a3375c7ae8fdd1cdc664cdf1ffe78ddb3bfa3acb4147d587fa7d2fb25a95304c7e4dda1baebd492bf2a87e0e547e8eca5ae3faf1570b8eb80083646

              Download Submit

            • C:\Program Files (x86)\Microsoft\Temp\EU94BE.tmp\msedgeupdateres_hi.dll
              Filesize

              28KB

              MD5

              11ac3cffb9b45b5b8bfca149ca5eb364

              SHA1

              11d8ae6bf94dc2ca86400647ce85b6127ed956a4

              SHA256

              f42b449b8cb309a3f089276e60971188e0426fef709486e6285f7c279eeb2034

              SHA512

              5674851e678865c9d47bb8d7987faeb8227213b0fd4fe190a6b19898325a2e4abe5a8162e47b5d9ac961c9cdbd0376c017e9b3b18d313762c230f80aaddf635f

              Download Submit

            • C:\Program Files (x86)\Microsoft\Temp\EU94BE.tmp\msedgeupdateres_hr.dll
              Filesize

              29KB

              MD5

              b150af37b3ba3ab3447dee9bd11a64f9

              SHA1

              af116c0f0abacefed3078b854846e25cf5da6a1c

              SHA256

              ce9101c633d23e97c02f0845310d5a9ee9e22195c33ddebf72e31b9efb811fe3

              SHA512

              de59098c308e4aef60d872792006a28cf808bac73cef3399501c3033648dac0ddc1f8f3907e7ce2bde9748c85a2ea363db4441553b2fa43f60945ee2a4f72b9b

              Download Submit

            • C:\Program Files (x86)\Microsoft\Temp\EU94BE.tmp\msedgeupdateres_hu.dll
              Filesize

              29KB

              MD5

              d0d456614a14dafaed7fdf302c5ff80e

              SHA1

              ba3717b721bf7ddb2178073f165374e1d1836e36

              SHA256

              1d0501b0df1e0c68e396fd4461c9f61a4f99d9f762a969cfb3070feaed965db8

              SHA512

              e29a38782d907d5f369ce16c0d59d4f8aeb81d951ff6e057c9234ebc7f93a1eff45c13fe28b59cf8ca33da5fcfc980cf261a8b85b425025d4459e75f89da8eb1

              Download Submit

            • C:\Program Files (x86)\Microsoft\Temp\EU94BE.tmp\msedgeupdateres_id.dll
              Filesize

              27KB

              MD5

              4112b8e604bfceecc53ba85e79af66ad

              SHA1

              8f704d5cab8e13faf44308fda2c326e6deeb8d84

              SHA256

              43555200c636ced058816a4023221c1ad0c9168558c97dff94913bb7cc5def15

              SHA512

              68bb5f720b6f401e52a1000d2de9ed75f0f028b7e62dcb369199acd87268b68b293fa14c30d3b21065e4d40d5cbb954568f7da220e99acf7a2bb150a490d211d

              Download Submit

            • C:\Program Files (x86)\Roblox\Versions\version-d90ca73c43104cfd\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe
              Filesize

              1.7MB

              MD5

              2910dcd86ae332e1ba73ad84fc1b6b24

              SHA1

              81fceae2dc125cdd3595065046dc9e32fdd603b3

              SHA256

              692be930556ff8224d255917ec27a8cf426a85113487b4d6f07bbe59f2a9c84e

              SHA512

              db08cbc566daf6ffa8dff9419b0673d526f7a27d23ea172b48819aaf9a3691fc544934caacccd0f9b2bd21fa6dbefaaa3f4a59785ef2dfb113b4aef37ce83dec

              Download Submit

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
              Filesize

              1KB

              MD5

              4f5e4c2c976648fa77bfbfdf00f9659a

              SHA1

              a2840d0143f1de65165d9b50bdcc5f46058cb7b8

              SHA256

              eb783dd10b6eb52cde4964e40089fe3c3530a5407c053cc50d8c9c09eb3b9da5

              SHA512

              2d3dac19e09806be3af770003d5cc6a081d19ff1eb18f5d0d460925547bd35f3318722af5e4db56f7408dd287059421af28c276ee9ffabebae0d404201a3d98a

              Download Submit

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
              Filesize

              471B

              MD5

              25e86fc66b65f1cc30d8242135702a7b

              SHA1

              b47f0473118b14bd4b8e00147458ccdcafd19003

              SHA256

              5db5a20cad4dbfd74872da0f94b49f9c1adcde1e516222bc65ae1cfc10974b2b

              SHA512

              7ef0da1e0db6271e8cf6631ab5cf8128d55f27a785b3eaa2e1c4a7bae143af133621690694543a2e3326e55e9b6d4bb99af62b63e9f916864848b83ce0e87935

              Download Submit

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_ADE4E4D3A3BCBCA5C39C54D362D88565
              Filesize

              471B

              MD5

              d47cfba50573f0e552b6e6d387f57b70

              SHA1

              457cb7eba451f945d21f8ade42f09635012e8131

              SHA256

              fe757b0a9e8995ed45accbe1cb3c1d83239a2fd626ca5bb256f483caf1112e3a

              SHA512

              5a868be1557dc848e47a52b8d0b6f305a85ce9197de3bc1829a97a78c956f445ca358c15b1c5898f88dea1cc77353768f4e356880f0913c41f1eb27e4012cb45

              Download Submit

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2D
              Filesize

              1KB

              MD5

              6f91f309bba6ad7f13309e628a53a658

              SHA1

              9a46ac8db866931f0c823675720bab3694fc84e7

              SHA256

              483634ae7a7e31c75ec0aa7a3312a4bb4027a4a233ec8373dad79b53d205bb96

              SHA512

              b8d77e6e3efbefc164b27ab91fae615e06b512d175c61483757f687b70e26aa6db0e34dc4269144f3daea912923b5c5094aa1cff43c56c09daf52ebb88a71b51

              Download Submit

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
              Filesize

              450B

              MD5

              68efa8df43fbcf85746c0c523bcb747a

              SHA1

              a2d88533002d2611a62cf7e56fd514da70f01ed4

              SHA256

              bb8c283a4b264a14257fd2ab6bf3487b828409536a004ae8dd55e873d121b682

              SHA512

              1e1208ea0cb1eb92aee88e2da22dc647e5dd83fbdf58e817941894cc27b5935f2962b7accbf207c6522bf43686bcdd2a9c7a57569f8e0e4dd07f8b6f2d412f69

              Download Submit

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
              Filesize

              430B

              MD5

              c2b9c3cc2fd807be246b53b7f693f446

              SHA1

              27c1028f224ea850a73a14c0014b3521168f2cd2

              SHA256

              b93065493d375b3f9692e330dc016d19f0c98eb48ff4829b391c2ccc97705832

              SHA512

              dfda4b6766cb03a24ef2a885e76d1baf9ed0eb8f04d811f0a443e5f853d2aa1d362c0252017ee0c810ae3b59898b585ad78b094e3dd37df455a5e7b123d2f21b

              Download Submit

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_ADE4E4D3A3BCBCA5C39C54D362D88565
              Filesize

              434B

              MD5

              68765a871d952b761df7b40db9e101e0

              SHA1

              e5945f4d9cea095dfbd350c5f3a679bbc0cea631

              SHA256

              b18ba8d907f1730f1e50d2916c48d64250d4f254d991d0294a2580f1f5eb3a57

              SHA512

              d49b96dc1941e9ae8a31b73dc260c805a403c15bec91be823758d7c87c6bef48f445656aec24d0ab136c7c06458d0d578c4004f4b474cc56fbcb26b913a911c6

              Download Submit

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2D
              Filesize

              458B

              MD5

              cfb6d926f0faf72bd45a2c9a69db08a4

              SHA1

              f182946b020de9be3e75629dbd93acc74c397887

              SHA256

              69ce18254600367cf4c0abfe5ec83c664e1445f174ed43439a835c2ef592582f

              SHA512

              c18b8aa83e9223529b88de750989bf1a7370f505b0e69ffe196621312fee7a08ee781ee86f84dba198372aaa4de4c18d46fd15bf3fea1974ed676a3ac699feb0

              Download Submit

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\26HZJLHZ\version-d90ca73c43104cfd-rbxPkgManifest[1].txt
              Filesize

              2KB

              MD5

              09e122cbac418978542680e764874827

              SHA1

              ea252fc792e81d7eb1dd6f0334dd2b540dde8eb9

              SHA256

              8e1f68afe20b1f656449880d844e1f62690c0b9a5cfabffe466d763d5f2049fa

              SHA512

              8992338525cf1ff206fd3da70ef2ff3a08065e12b91947046fa79f05d115891d4571af52e3fe8d41b08a9c397d10ed3db4e00cd298e01e81c6009dfabacc3b0f

              Download Submit

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\48VMALJK\PCStudioBootstrapper[1].json
              Filesize

              2KB

              MD5

              6371de694b1cfb1f7fedb444a6551e20

              SHA1

              007fb0c3b5d992cdc4c30ae5c3df8a5cd13f4a91

              SHA256

              c633206e2bc3d191a753e13d36f156385acc812cbf53426c21be1b9030f9c57f

              SHA512

              63afe8c2e6a170df6309a581eee0d3090ef8f6dc85655f57c4fdca7c5ebf297aea10670ce84265bf295c5b50cd4619740cbe7f4601b8669ab50b9bc8314c1e71

              Download Submit

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\48VMALJK\PCStudioBootstrapper[1].json
              Filesize

              2KB

              MD5

              6371de694b1cfb1f7fedb444a6551e20

              SHA1

              007fb0c3b5d992cdc4c30ae5c3df8a5cd13f4a91

              SHA256

              c633206e2bc3d191a753e13d36f156385acc812cbf53426c21be1b9030f9c57f

              SHA512

              63afe8c2e6a170df6309a581eee0d3090ef8f6dc85655f57c4fdca7c5ebf297aea10670ce84265bf295c5b50cd4619740cbe7f4601b8669ab50b9bc8314c1e71

              Download Submit

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\48VMALJK\WindowsStudio64[1].json
              Filesize

              119B

              MD5

              9d1cb3f866081103bb0818ed0486a91b

              SHA1

              79e1ec29ab144aa176ac1324099abcf567fec8ef

              SHA256

              fb1f3474787e7c58f400a2a6cdd17cc8b8f759f5088d7d140911ddf22bcdb98e

              SHA512

              6277dcc56c31f782c388c2612220b5adcd7d1e71c980732cb67fcdf481760c49120c2c54cec0ef0c7fcf36a3cc01b8da82060e2a7f5b1cab96d67cc8e6f2f677

              Download Submit

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\G3YCTSQY\PCStudioBootstrapper[1].json
              Filesize

              2KB

              MD5

              6371de694b1cfb1f7fedb444a6551e20

              SHA1

              007fb0c3b5d992cdc4c30ae5c3df8a5cd13f4a91

              SHA256

              c633206e2bc3d191a753e13d36f156385acc812cbf53426c21be1b9030f9c57f

              SHA512

              63afe8c2e6a170df6309a581eee0d3090ef8f6dc85655f57c4fdca7c5ebf297aea10670ce84265bf295c5b50cd4619740cbe7f4601b8669ab50b9bc8314c1e71

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\RBX-1C62D130\RobloxStudioLauncherBeta.exe
              Filesize

              2.0MB

              MD5

              eb1a2bc52160cfbe07fee32865f43902

              SHA1

              75fb41506d11057bfaa2d6f83f2d1fe1267286b4

              SHA256

              9be6907ffba895e95a1aaadd9e23dcea5f29e87d23e96f07ddbe3239326f0b4a

              SHA512

              19a38a95a750a0e3681e96f29b4fe7b8b0fe42f19f0261241b64f0be879575258a351c08a8fff7f60440b5ee5d391d4a33994a442aa254d5f0fae7913b87b010

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\RBX-1C62D130\RobloxStudioLauncherBeta.exe
              Filesize

              2.0MB

              MD5

              eb1a2bc52160cfbe07fee32865f43902

              SHA1

              75fb41506d11057bfaa2d6f83f2d1fe1267286b4

              SHA256

              9be6907ffba895e95a1aaadd9e23dcea5f29e87d23e96f07ddbe3239326f0b4a

              SHA512

              19a38a95a750a0e3681e96f29b4fe7b8b0fe42f19f0261241b64f0be879575258a351c08a8fff7f60440b5ee5d391d4a33994a442aa254d5f0fae7913b87b010

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\RBX-1C62D130\RobloxStudioLauncherBeta.exe
              Filesize

              2.0MB

              MD5

              eb1a2bc52160cfbe07fee32865f43902

              SHA1

              75fb41506d11057bfaa2d6f83f2d1fe1267286b4

              SHA256

              9be6907ffba895e95a1aaadd9e23dcea5f29e87d23e96f07ddbe3239326f0b4a

              SHA512

              19a38a95a750a0e3681e96f29b4fe7b8b0fe42f19f0261241b64f0be879575258a351c08a8fff7f60440b5ee5d391d4a33994a442aa254d5f0fae7913b87b010

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\crashpad_roblox\settings.dat
              Filesize

              40B

              MD5

              ddb5d653f49d88543931887980312480

              SHA1

              29dafe3f6f47e915d8ad727476c9240e4eb1d1b5

              SHA256

              90217d1ccb28309f4ad55af3368e919b0d51c5be368d084b462d6971053d2b59

              SHA512

              dcb9fad3632c91e53c6869ac3fc1670a9c98503ec28a1d39fe25ac9a6371a7e6dbbad1d036d0b8e04f3262c2f572d6c2d3e21a63b290e1429389c1e0d4da8d02

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\crashpad_roblox\settings.dat
              Filesize

              40B

              MD5

              ddb5d653f49d88543931887980312480

              SHA1

              29dafe3f6f47e915d8ad727476c9240e4eb1d1b5

              SHA256

              90217d1ccb28309f4ad55af3368e919b0d51c5be368d084b462d6971053d2b59

              SHA512

              dcb9fad3632c91e53c6869ac3fc1670a9c98503ec28a1d39fe25ac9a6371a7e6dbbad1d036d0b8e04f3262c2f572d6c2d3e21a63b290e1429389c1e0d4da8d02

              Download Submit

            • memory/64-213-0x00007FFB4B610000-0x00007FFB4BA0E000-memory.dmp

              Filesize

              4.0MB

              Download

            • memory/64-216-0x000001C8C3230000-0x000001C8C3240000-memory.dmp

              Filesize

              64KB

              Download

            • memory/64-215-0x000001C8C3230000-0x000001C8C3240000-memory.dmp

              Filesize

              64KB

              Download

            • memory/64-214-0x00007FF6C21C0000-0x00007FF6C31C0000-memory.dmp

              Filesize

              16.0MB

              Download

            • memory/64-212-0x00007FFB497B0000-0x00007FFB49CFC000-memory.dmp

              Filesize

              5.3MB

              Download