Overview

overview

6

Static

static

1

RobloxPlay...er.exe

windows10-2004-x64

6

Analysis

  • max time kernel
    1801s
  • max time network
    1728s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/02/2024, 16:50

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    RobloxPlayerInstaller.exe
  • Size 4.6MB
  • Sample240202-vclfjschgm
  • SHA256 59ff1970e144aaea68c2fc942ac499bbece25579230fa22db18d9c77d5d0720d
  • MD5 SHA1 SHA512 SSDEEP
Score
6/10
adwarediscoveryevasionpersistencestealertrojan

Malware Config

Signatures

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Downloads MZ/PE file
  • Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
  • Modifies Installed Components in the registry 2 TTPs 7 IoCs
    persistence
  • Sets file execution options in registry 2 TTPs 6 IoCs
    persistence
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops file in System32 directory 1 IoCs
  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 21 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks system information in the registry 2 TTPs 34 IoCs

    System information is often read in order to detect sandboxing environments.

  • Drops file in Program Files directory 64 IoCs
  • Executes dropped EXE 49 IoCs
  • Loads dropped DLL 53 IoCs
  • Registers COM server for autorun 1 TTPs 64 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies Internet Explorer settings 1 TTPs 30 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 46 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 58 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 4 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\RobloxPlayerInstaller.exe
    "C:\Users\Admin\AppData\Local\Temp\RobloxPlayerInstaller.exe"
    1⤵
    • Checks whether UAC is enabled
    • Drops file in Program Files directory
    • Modifies Internet Explorer settings
    • Suspicious behavior: EnumeratesProcesses
    PID:3476
    • C:\Program Files (x86)\Roblox\Versions\version-17f2f3d7fcfc48f5\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe
      MicrosoftEdgeWebview2Setup.exe /silent /install
      2⤵
      • Drops file in Program Files directory
      • Executes dropped EXE
      PID:2096
      • C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\MicrosoftEdgeUpdate.exe
        "C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
        3⤵
        • Sets file execution options in registry
        • Checks computer location settings
        • Checks system information in the registry
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3588
        • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
          "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:3364
        • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
          "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Modifies registry class
          PID:4484
          • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
            "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Registers COM server for autorun
            • Modifies registry class
            PID:4072
          • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
            "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Registers COM server for autorun
            • Modifies registry class
            PID:4028
          • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
            "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Registers COM server for autorun
            • Modifies registry class
            PID:3024
        • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
          "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QUM4OEJGNzgtMjk4MS00QUMyLUE4REUtMzZENEZCNjJCRTQ2fSIgdXNlcmlkPSJ7QjVEOERCRkMtODkxNC00RTRGLTk5QzktRDI5N0NGN0IwMzQyfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins5QjU2Mjg1My0wNjI2LTRGRDUtQjJDOC1FMDRDMEY4Q0E0NTd9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iREFEWSIgcHJvZHVjdF9uYW1lPSJTdGFuZGFyZCBQQyAoUTM1ICsgSUNIOSwgMjAwOSkiLz48ZXhwIGV0YWc9IiZxdW90O3I0NTJ0MStrMlRncS9IWHpqdkZOQlJob3BCV1I5c2JqWHhxZVVESDl1WDA9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0ie0YzQzRGRTAwLUVGRDUtNDAzQi05NTY5LTM5OEEyMEYxQkE0QX0iIHZlcnNpb249IjEuMy4xODEuNSIgbmV4dHZlcnNpb249IjEuMy4xNzEuMzkiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjU1NTU1MjYxNDYiIGluc3RhbGxfdGltZV9tcz0iMjAxNiIvPjwvYXBwPjwvcmVxdWVzdD4
          4⤵
          • Checks system information in the registry
          • Executes dropped EXE
          • Loads dropped DLL
          PID:3420
        • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
          "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{AC88BF78-2981-4AC2-A8DE-36D4FB62BE46}" /silent
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2656
    • C:\Program Files (x86)\Roblox\Versions\version-17f2f3d7fcfc48f5\RobloxPlayerBeta.exe
      "C:\Program Files (x86)\Roblox\Versions\version-17f2f3d7fcfc48f5\RobloxPlayerBeta.exe" -app
      2⤵
      • Suspicious use of NtCreateThreadExHideFromDebugger
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of UnmapMainImage
      PID:1148
  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2320
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffb693e9758,0x7ffb693e9768,0x7ffb693e9778
      2⤵
        PID:1624
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1660 --field-trial-handle=1888,i,1451335077181210716,6757162930917529776,131072 /prefetch:2
        2⤵
          PID:3628
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2260 --field-trial-handle=1888,i,1451335077181210716,6757162930917529776,131072 /prefetch:8
          2⤵
            PID:4776
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1888,i,1451335077181210716,6757162930917529776,131072 /prefetch:8
            2⤵
              PID:2612
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3040 --field-trial-handle=1888,i,1451335077181210716,6757162930917529776,131072 /prefetch:1
              2⤵
                PID:1952
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3076 --field-trial-handle=1888,i,1451335077181210716,6757162930917529776,131072 /prefetch:1
                2⤵
                  PID:3672
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4596 --field-trial-handle=1888,i,1451335077181210716,6757162930917529776,131072 /prefetch:1
                  2⤵
                    PID:4304
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4852 --field-trial-handle=1888,i,1451335077181210716,6757162930917529776,131072 /prefetch:8
                    2⤵
                      PID:2588
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3872 --field-trial-handle=1888,i,1451335077181210716,6757162930917529776,131072 /prefetch:8
                      2⤵
                        PID:4280
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5392 --field-trial-handle=1888,i,1451335077181210716,6757162930917529776,131072 /prefetch:8
                        2⤵
                          PID:3760
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4996 --field-trial-handle=1888,i,1451335077181210716,6757162930917529776,131072 /prefetch:8
                          2⤵
                            PID:756
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=4908 --field-trial-handle=1888,i,1451335077181210716,6757162930917529776,131072 /prefetch:1
                            2⤵
                              PID:4988
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4984 --field-trial-handle=1888,i,1451335077181210716,6757162930917529776,131072 /prefetch:1
                              2⤵
                                PID:4420
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5724 --field-trial-handle=1888,i,1451335077181210716,6757162930917529776,131072 /prefetch:8
                                2⤵
                                  PID:1652
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5888 --field-trial-handle=1888,i,1451335077181210716,6757162930917529776,131072 /prefetch:8
                                  2⤵
                                    PID:408
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5928 --field-trial-handle=1888,i,1451335077181210716,6757162930917529776,131072 /prefetch:8
                                    2⤵
                                      PID:4408
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5468 --field-trial-handle=1888,i,1451335077181210716,6757162930917529776,131072 /prefetch:8
                                      2⤵
                                        PID:3852
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4868 --field-trial-handle=1888,i,1451335077181210716,6757162930917529776,131072 /prefetch:8
                                        2⤵
                                          PID:4460
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5980 --field-trial-handle=1888,i,1451335077181210716,6757162930917529776,131072 /prefetch:2
                                          2⤵
                                            PID:3120
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5552 --field-trial-handle=1888,i,1451335077181210716,6757162930917529776,131072 /prefetch:8
                                            2⤵
                                              PID:4356
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5684 --field-trial-handle=1888,i,1451335077181210716,6757162930917529776,131072 /prefetch:8
                                              2⤵
                                                PID:5024
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5288 --field-trial-handle=1888,i,1451335077181210716,6757162930917529776,131072 /prefetch:8
                                                2⤵
                                                  PID:1816
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1636 --field-trial-handle=1888,i,1451335077181210716,6757162930917529776,131072 /prefetch:8
                                                  2⤵
                                                    PID:4228
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5680 --field-trial-handle=1888,i,1451335077181210716,6757162930917529776,131072 /prefetch:8
                                                    2⤵
                                                      PID:4920
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5552 --field-trial-handle=1888,i,1451335077181210716,6757162930917529776,131072 /prefetch:8
                                                      2⤵
                                                        PID:4224
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=1640 --field-trial-handle=1888,i,1451335077181210716,6757162930917529776,131072 /prefetch:8
                                                        2⤵
                                                          PID:2096
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3456 --field-trial-handle=1888,i,1451335077181210716,6757162930917529776,131072 /prefetch:8
                                                          2⤵
                                                            PID:4356
                                                          • C:\Users\Admin\Downloads\WindowsXPHorrorEdition (1).exe
                                                            "C:\Users\Admin\Downloads\WindowsXPHorrorEdition (1).exe"
                                                            2⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:2508
                                                        • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                                          "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                                          1⤵
                                                            PID:4356
                                                          • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                            "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
                                                            1⤵
                                                            • Checks system information in the registry
                                                            • Executes dropped EXE
                                                            • Loads dropped DLL
                                                            • Modifies data under HKEY_USERS
                                                            PID:4708
                                                            • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                              "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QUM4OEJGNzgtMjk4MS00QUMyLUE4REUtMzZENEZCNjJCRTQ2fSIgdXNlcmlkPSJ7QjVEOERCRkMtODkxNC00RTRGLTk5QzktRDI5N0NGN0IwMzQyfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntDOUMwREIxOS01M0IxLTQwNkQtQTkwNS03QzlBMThCQUI0MEZ9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iREFEWSIgcHJvZHVjdF9uYW1lPSJTdGFuZGFyZCBQQyAoUTM1ICsgSUNIOSwgMjAwOSkiLz48ZXhwIGV0YWc9IiZxdW90O3FXSlN6V3dQZmRjTFIrWEdJdjZ4clpmaVlPeGhQVTJzMU5XbWpXY2FGUGc9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEwNi4wLjUyNDkuMTE5IiBuZXh0dmVyc2lvbj0iMTA2LjAuNTI0OS4xMTkiIGxhbmc9ImVuIiBicmFuZD0iR0dMUyIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSI1IiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1NjAyOTQ2MTE1Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
                                                              2⤵
                                                              • Checks system information in the registry
                                                              • Executes dropped EXE
                                                              • Loads dropped DLL
                                                              PID:1940
                                                            • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DC95C482-B0BD-4130-9769-02A9C114CEC2}\MicrosoftEdge_X64_121.0.2277.98.exe
                                                              "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DC95C482-B0BD-4130-9769-02A9C114CEC2}\MicrosoftEdge_X64_121.0.2277.98.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
                                                              2⤵
                                                              • Executes dropped EXE
                                                              PID:4756
                                                              • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DC95C482-B0BD-4130-9769-02A9C114CEC2}\EDGEMITMP_4F049.tmp\setup.exe
                                                                "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DC95C482-B0BD-4130-9769-02A9C114CEC2}\EDGEMITMP_4F049.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DC95C482-B0BD-4130-9769-02A9C114CEC2}\MicrosoftEdge_X64_121.0.2277.98.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
                                                                3⤵
                                                                • Drops file in Program Files directory
                                                                • Executes dropped EXE
                                                                PID:1692
                                                                • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DC95C482-B0BD-4130-9769-02A9C114CEC2}\EDGEMITMP_4F049.tmp\setup.exe
                                                                  "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DC95C482-B0BD-4130-9769-02A9C114CEC2}\EDGEMITMP_4F049.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=121.0.6167.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DC95C482-B0BD-4130-9769-02A9C114CEC2}\EDGEMITMP_4F049.tmp\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=121.0.2277.98 --initial-client-data=0x228,0x22c,0x230,0x204,0x234,0x7ff791981d88,0x7ff791981d94,0x7ff791981da0
                                                                  4⤵
                                                                  • Executes dropped EXE
                                                                  PID:4248
                                                            • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                              "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QUM4OEJGNzgtMjk4MS00QUMyLUE4REUtMzZENEZCNjJCRTQ2fSIgdXNlcmlkPSJ7QjVEOERCRkMtODkxNC00RTRGLTk5QzktRDI5N0NGN0IwMzQyfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins5RDA1NkNBMS1CNDAxLTRDMkItQjQ5My1CNjMwNTMzQkQ4Q0F9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iREFEWSIgcHJvZHVjdF9uYW1lPSJTdGFuZGFyZCBQQyAoUTM1ICsgSUNIOSwgMjAwOSkiLz48ZXhwIGV0YWc9IiZxdW90O1ZQUW9QMUYrZnExNXdSemgxa1BMNFBNcFdoOE9STUI1aXp2ck9DL2NoalE9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0ie0YzMDE3MjI2LUZFMkEtNDI5NS04QkRGLTAwQzNBOUE3RTRDNX0iIHZlcnNpb249IiIgbmV4dHZlcnNpb249IjEyMS4wLjIyNzcuOTgiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJjb25zZW50PWZhbHNlIiBpbnN0YWxsYWdlPSItMSIgaW5zdGFsbGRhdGU9Ii0xIj48dXBkYXRlY2hlY2svPjxldmVudCBldmVudHR5cGU9IjkiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjU2MTI2OTU5OTIiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI1IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1NjEyODc2NDExIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNjAxMTY3NjMxMiIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgZG93bmxvYWRlcj0iYml0cyIgdXJsPSJodHRwOi8vbXNlZGdlLmYudGx1LmRsLmRlbGl2ZXJ5Lm1wLm1pY3Jvc29mdC5jb20vZmlsZXN0cmVhbWluZ3NlcnZpY2UvZmlsZXMvYzNmZTNiOWUtOGYzMy00YzE0LWI1YTItMjQ2ZGQ1YjgyZTc5P1AxPTE3MDc0OTc2NzYmYW1wO1AyPTQwNCZhbXA7UDM9MiZhbXA7UDQ9YlpUcmdGdXJZTHdkRnBlS3R0OWdtQiUyZjFYUWpIZWFUZWhDMWs3dGFweHBGNmYwaHBKekxmS011aUZtY1dLcTJXT2JCaGpUOHk0ZHlKRSUyYmFCUGhOVHZRJTNkJTNkIiBzZXJ2ZXJfaXBfaGludD0iIiBjZG5fY2lkPSItMSIgY2RuX2NjYz0iIiBjZG5fbXNlZGdlX3JlZj0iIiBjZG5fYXp1cmVfcmVmX29yaWdpbl9zaGllbGQ9IiIgY2RuX2NhY2hlPSIiIGNkbl9wM3A9IiIgZG93bmxvYWRlZD0iMTc0ODEwMTY4IiB0b3RhbD0iMTc0ODEwMTY4IiBkb3dubG9hZF90aW1lX21zPSIyNDQyMSIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjYwMTIyMTY5MDIiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI2IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI2MDM4MTg3MTg0IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMTk2NzU3IiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI2OTYwNzk1OTkxIiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiB1cGRhdGVfY2hlY2tfdGltZV9tcz0iMzg3IiBkb3dubG9hZF90aW1lX21zPSIzOTkwNyIgZG93bmxvYWRlZD0iMTc0ODEwMTY4IiB0b3RhbD0iMTc0ODEwMTY4IiBwYWNrYWdlX2NhY2hlX3Jlc3VsdD0iMCIgaW5zdGFsbF90aW1lX21zPSI5MjI0OSIvPjwvYXBwPjwvcmVxdWVzdD4
                                                              2⤵
                                                              • Checks system information in the registry
                                                              • Executes dropped EXE
                                                              • Loads dropped DLL
                                                              PID:4700
                                                          • C:\Windows\system32\AUDIODG.EXE
                                                            C:\Windows\system32\AUDIODG.EXE 0x430 0x40c
                                                            1⤵
                                                              PID:3888
                                                            • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                              "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler
                                                              1⤵
                                                              • Checks system information in the registry
                                                              • Executes dropped EXE
                                                              • Loads dropped DLL
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              PID:3940
                                                            • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                              "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
                                                              1⤵
                                                              • Checks system information in the registry
                                                              • Executes dropped EXE
                                                              • Loads dropped DLL
                                                              • Modifies data under HKEY_USERS
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              PID:4504
                                                              • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{96A49D3C-E6E6-4B6A-A093-1961F64CDEC3}\MicrosoftEdgeUpdateSetup_X86_1.3.181.5.exe
                                                                "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{96A49D3C-E6E6-4B6A-A093-1961F64CDEC3}\MicrosoftEdgeUpdateSetup_X86_1.3.181.5.exe" /update /sessionid "{ED32D9FC-AD0D-4D40-8097-37F7B8323D5A}"
                                                                2⤵
                                                                • Drops file in Program Files directory
                                                                • Executes dropped EXE
                                                                PID:948
                                                                • C:\Program Files (x86)\Microsoft\Temp\EU3801.tmp\MicrosoftEdgeUpdate.exe
                                                                  "C:\Program Files (x86)\Microsoft\Temp\EU3801.tmp\MicrosoftEdgeUpdate.exe" /update /sessionid "{ED32D9FC-AD0D-4D40-8097-37F7B8323D5A}"
                                                                  3⤵
                                                                  • Sets file execution options in registry
                                                                  • Checks system information in the registry
                                                                  • Executes dropped EXE
                                                                  • Loads dropped DLL
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  PID:4960
                                                                  • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                    "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
                                                                    4⤵
                                                                    • Executes dropped EXE
                                                                    • Loads dropped DLL
                                                                    • Modifies registry class
                                                                    PID:4116
                                                                  • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                    "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
                                                                    4⤵
                                                                    • Executes dropped EXE
                                                                    • Loads dropped DLL
                                                                    • Modifies registry class
                                                                    PID:4200
                                                                    • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.181.5\MicrosoftEdgeUpdateComRegisterShell64.exe
                                                                      "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.181.5\MicrosoftEdgeUpdateComRegisterShell64.exe"
                                                                      5⤵
                                                                      • Executes dropped EXE
                                                                      • Loads dropped DLL
                                                                      • Registers COM server for autorun
                                                                      • Modifies registry class
                                                                      PID:436
                                                                    • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.181.5\MicrosoftEdgeUpdateComRegisterShell64.exe
                                                                      "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.181.5\MicrosoftEdgeUpdateComRegisterShell64.exe"
                                                                      5⤵
                                                                      • Executes dropped EXE
                                                                      • Loads dropped DLL
                                                                      • Registers COM server for autorun
                                                                      • Modifies registry class
                                                                      PID:4832
                                                                    • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.181.5\MicrosoftEdgeUpdateComRegisterShell64.exe
                                                                      "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.181.5\MicrosoftEdgeUpdateComRegisterShell64.exe"
                                                                      5⤵
                                                                      • Executes dropped EXE
                                                                      • Loads dropped DLL
                                                                      • Registers COM server for autorun
                                                                      • Modifies registry class
                                                                      PID:3652
                                                                  • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                    "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODEuNSIgc2hlbGxfdmVyc2lvbj0iMS4zLjE3MS4zOSIgaXNtYWNoaW5lPSIxIiBzZXNzaW9uaWQ9IntFRDMyRDlGQy1BRDBELTRENDAtODA5Ny0zN0Y3QjgzMjNENUF9IiB1c2VyaWQ9IntCNUQ4REJGQy04OTE0LTRFNEYtOTlDOS1EMjk3Q0Y3QjAzNDJ9IiBpbnN0YWxsc291cmNlPSJzZWxmdXBkYXRlIiByZXF1ZXN0aWQ9Ins5QkZDRDM3RS0xRUUzLTRBMDAtQTc0Ny0yN0U0NTA5QUI0MDV9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgb3NfcmVnaW9uX25hbWU9IlVTIiBvc19yZWdpb25fbmF0aW9uPSIyNDQiIG9zX3JlZ2lvbl9kbWE9IjAiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IkRBRFkiIHByb2R1Y3RfbmFtZT0iU3RhbmRhcmQgUEMgKFEzNSArIElDSDksIDIwMDkpIi8-PGV4cCBldGFnPSImcXVvdDtxV0pTeld3UGZkY0xSK1hHSXY2eHJaZmlZT3hoUFUyczFOV21qV2NhRlBnPSZxdW90OyIvPjxhcHAgYXBwaWQ9IntGM0M0RkUwMC1FRkQ1LTQwM0ItOTU2OS0zOThBMjBGMUJBNEF9IiB2ZXJzaW9uPSIxLjMuMTcxLjM5IiBuZXh0dmVyc2lvbj0iMS4zLjE4MS41IiBsYW5nPSIiIGJyYW5kPSJJTkJYIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMCIgaW5zdGFsbGRhdGV0aW1lPSIxNzA2ODkyODY3Ij48ZXZlbnQgZXZlbnR0eXBlPSIzIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI5NzkzNzIzMjM4Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
                                                                    4⤵
                                                                    • Checks system information in the registry
                                                                    • Executes dropped EXE
                                                                    • Loads dropped DLL
                                                                    PID:484
                                                              • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RUQzMkQ5RkMtQUQwRC00RDQwLTgwOTctMzdGN0I4MzIzRDVBfSIgdXNlcmlkPSJ7QjVEOERCRkMtODkxNC00RTRGLTk5QzktRDI5N0NGN0IwMzQyfSIgaW5zdGFsbHNvdXJjZT0ic2NoZWR1bGVyIiByZXF1ZXN0aWQ9Ins3NTNFQzJERi1FMkFDLTRBMEEtODA3QS00MjVFMjkzQTUyNER9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iREFEWSIgcHJvZHVjdF9uYW1lPSJTdGFuZGFyZCBQQyAoUTM1ICsgSUNIOSwgMjAwOSkiLz48ZXhwIGV0YWc9IiZxdW90O3FXSlN6V3dQZmRjTFIrWEdJdjZ4clpmaVlPeGhQVTJzMU5XbWpXY2FGUGc9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0ie0YzQzRGRTAwLUVGRDUtNDAzQi05NTY5LTM5OEEyMEYxQkE0QX0iIHZlcnNpb249IjEuMy4xNzEuMzkiIG5leHR2ZXJzaW9uPSIxLjMuMTgxLjUiIGxhbmc9IiIgYnJhbmQ9IklOQlgiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIwIj48dXBkYXRlY2hlY2svPjxldmVudCBldmVudHR5cGU9IjEyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI4Njg1MjUwMjk1IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTMiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9Ijg2ODUzNDg0NDgiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNCIgZXZlbnRyZXN1bHQ9IjAiIGVycm9yY29kZT0iLTIxNDcwMjM4MzgiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9Ijk3NTM0OTgwODgiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIGRvd25sb2FkZXI9ImRvIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuYi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy9hMGIxZDFjZC05M2UyLTQ1ODktYWQ5MS00MmExMzI1YzNkODg_UDE9MTcwNzQ5Nzk4MyZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1Wenc2MkVyakY0OUhrZXpmV1p3MDJRUjNWU0ZNSjJyJTJmNmdwanlUZHFkc1FiNjMwWVh0NnFKSDh0UzAxV1kwZzVCSk9laXB1NUVJVzJ6bXFzRlYlMmJ0S0ElM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIwIiB0b3RhbD0iMCIgZG93bmxvYWRfdGltZV9tcz0iOSIvPjxldmVudCBldmVudHR5cGU9IjE0IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI5NzUzNTc1NzgwIiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuYi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy9hMGIxZDFjZC05M2UyLTQ1ODktYWQ5MS00MmExMzI1YzNkODg_UDE9MTcwNzQ5Nzk4MyZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1Wenc2MkVyakY0OUhrZXpmV1p3MDJRUjNWU0ZNSjJyJTJmNmdwanlUZHFkc1FiNjMwWVh0NnFKSDh0UzAxV1kwZzVCSk9laXB1NUVJVzJ6bXFzRlYlMmJ0S0ElM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIxNjExNzQ0IiB0b3RhbD0iMTYxMTc0NCIgZG93bmxvYWRfdGltZV9tcz0iMTAyMjQ3Ii8-PGV2ZW50IGV2ZW50dHlwZT0iMTQiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9Ijk3NTM2NzY5MzkiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iOTc1OTAyOTU5NCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxwaW5nIHI9IjQ5IiByZD0iNjE5MiIgcGluZ19mcmVzaG5lc3M9IntBMUFFRTU2Ri00OEM5LTQzQjQtODZDOS1DNjQ0NDVEOThFM0V9Ii8-PC9hcHA-PGFwcCBhcHBpZD0iezU2RUIxOEY4LUIwMDgtNENCRC1CNkQyLThDOTdGRTdFOTA2Mn0iIHZlcnNpb249IjkyLjAuOTAyLjY3IiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSJJTkJYIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNvbnNlbnQ9ZmFsc2UiIGxhc3RfbGF1bmNoX3RpbWU9IjEzMzQ3MTEwMTQ0NDAxNDM4MCI-PHVwZGF0ZWNoZWNrLz48cGluZyBhY3RpdmU9IjEiIGE9Ii0xIiByPSI0OSIgYWQ9Ii0xIiByZD0iNjE5MiIgcGluZ19mcmVzaG5lc3M9IntBOUU0NUUyRS1BODAwLTRDQkMtQTREQi1DMjA0RTg1NzU1MTd9Ii8-PC9hcHA-PGFwcCBhcHBpZD0ie0YzMDE3MjI2LUZFMkEtNDI5NS04QkRGLTAwQzNBOUE3RTRDNX0iIHZlcnNpb249IjEyMS4wLjIyNzcuOTgiIG5leHR2ZXJzaW9uPSIiIGxhbmc9IiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIwIiBpbnN0YWxsZGF0ZT0iNjIzNyI-PHVwZGF0ZWNoZWNrLz48cGluZyByPSItMSIgcmQ9Ii0xIiBwaW5nX2ZyZXNobmVzcz0iezRBNTA4NzE4LTU3NDItNEQ3Qy1CQjkzLTE0MDYxRjA2Mzg1OH0iLz48L2FwcD48L3JlcXVlc3Q-
                                                                2⤵
                                                                • Checks system information in the registry
                                                                • Executes dropped EXE
                                                                • Loads dropped DLL
                                                                PID:3768
                                                            • C:\Windows\System32\rundll32.exe
                                                              C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                              1⤵
                                                                PID:2976
                                                              • C:\Users\Admin\Desktop\WindowsXPHorrorEdition (1).exe
                                                                "C:\Users\Admin\Desktop\WindowsXPHorrorEdition (1).exe"
                                                                1⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of SetWindowsHookEx
                                                                PID:2136
                                                              • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler
                                                                1⤵
                                                                • Executes dropped EXE
                                                                • Loads dropped DLL
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                PID:1848
                                                              • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
                                                                1⤵
                                                                • Checks system information in the registry
                                                                • Executes dropped EXE
                                                                • Loads dropped DLL
                                                                • Modifies data under HKEY_USERS
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                PID:3632
                                                                • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{66803E05-C3B1-44F6-A2F1-0D4385C643B7}\MicrosoftEdgeUpdateSetup_X86_1.3.183.29.exe
                                                                  "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{66803E05-C3B1-44F6-A2F1-0D4385C643B7}\MicrosoftEdgeUpdateSetup_X86_1.3.183.29.exe" /update /sessionid "{D8B1712B-BB9A-469E-8C35-48F467E5A5FF}"
                                                                  2⤵
                                                                  • Drops file in Program Files directory
                                                                  • Executes dropped EXE
                                                                  PID:4360
                                                                  • C:\Program Files (x86)\Microsoft\Temp\EUFA10.tmp\MicrosoftEdgeUpdate.exe
                                                                    "C:\Program Files (x86)\Microsoft\Temp\EUFA10.tmp\MicrosoftEdgeUpdate.exe" /update /sessionid "{D8B1712B-BB9A-469E-8C35-48F467E5A5FF}"
                                                                    3⤵
                                                                    • Sets file execution options in registry
                                                                    • Checks system information in the registry
                                                                    • Executes dropped EXE
                                                                    • Loads dropped DLL
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    PID:376
                                                                    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
                                                                      4⤵
                                                                      • Executes dropped EXE
                                                                      • Loads dropped DLL
                                                                      • Modifies registry class
                                                                      PID:4392
                                                                    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
                                                                      4⤵
                                                                      • Executes dropped EXE
                                                                      • Loads dropped DLL
                                                                      • Modifies registry class
                                                                      PID:1528
                                                                      • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.183.29\MicrosoftEdgeUpdateComRegisterShell64.exe
                                                                        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.183.29\MicrosoftEdgeUpdateComRegisterShell64.exe"
                                                                        5⤵
                                                                        • Executes dropped EXE
                                                                        • Loads dropped DLL
                                                                        • Registers COM server for autorun
                                                                        • Modifies registry class
                                                                        PID:2700
                                                                      • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.183.29\MicrosoftEdgeUpdateComRegisterShell64.exe
                                                                        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.183.29\MicrosoftEdgeUpdateComRegisterShell64.exe"
                                                                        5⤵
                                                                        • Executes dropped EXE
                                                                        • Loads dropped DLL
                                                                        • Registers COM server for autorun
                                                                        • Modifies registry class
                                                                        PID:3320
                                                                      • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.183.29\MicrosoftEdgeUpdateComRegisterShell64.exe
                                                                        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.183.29\MicrosoftEdgeUpdateComRegisterShell64.exe"
                                                                        5⤵
                                                                        • Executes dropped EXE
                                                                        • Loads dropped DLL
                                                                        • Registers COM server for autorun
                                                                        • Modifies registry class
                                                                        PID:2096
                                                                    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODMuMjkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RDhCMTcxMkItQkI5QS00NjlFLThDMzUtNDhGNDY3RTVBNUZGfSIgdXNlcmlkPSJ7QjVEOERCRkMtODkxNC00RTRGLTk5QzktRDI5N0NGN0IwMzQyfSIgaW5zdGFsbHNvdXJjZT0ic2VsZnVwZGF0ZSIgcmVxdWVzdGlkPSJ7RThDNkNGNDItNzMwNi00RjZGLTgzQTMtNTJEQTJERThFNUYyfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIG9zX3JlZ2lvbl9uYW1lPSJVUyIgb3NfcmVnaW9uX25hdGlvbj0iMjQ0IiBvc19yZWdpb25fZG1hPSIwIiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSJEQURZIiBwcm9kdWN0X25hbWU9IlN0YW5kYXJkIFBDIChRMzUgKyBJQ0g5LCAyMDA5KSIvPjxleHAgZXRhZz0iJnF1b3Q7cVdKU3pXd1BmZGNMUitYR0l2NnhyWmZpWU94aFBVMnMxTldtaldjYUZQZz0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE4MS41IiBuZXh0dmVyc2lvbj0iMS4zLjE4My4yOSIgbGFuZz0iIiBicmFuZD0iSU5CWCIgY2xpZW50PSIiIGluc3RhbGxhZ2U9IjAiIGluc3RhbGxkYXRldGltZT0iMTcwNjg5Mjg2NyI-PGV2ZW50IGV2ZW50dHlwZT0iMyIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTM1NzAyMTQ2OTkiLz48L2FwcD48L3JlcXVlc3Q-
                                                                      4⤵
                                                                      • Checks system information in the registry
                                                                      • Executes dropped EXE
                                                                      • Loads dropped DLL
                                                                      PID:984
                                                                • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODEuNSIgc2hlbGxfdmVyc2lvbj0iMS4zLjE3MS4zOSIgaXNtYWNoaW5lPSIxIiBzZXNzaW9uaWQ9IntEOEIxNzEyQi1CQjlBLTQ2OUUtOEMzNS00OEY0NjdFNUE1RkZ9IiB1c2VyaWQ9IntCNUQ4REJGQy04OTE0LTRFNEYtOTlDOS1EMjk3Q0Y3QjAzNDJ9IiBpbnN0YWxsc291cmNlPSJzY2hlZHVsZXIiIHJlcXVlc3RpZD0iezRGNUNEOEI5LTQzQzUtNDVBNi04QzFGLTdGMTQ1MkZGNDk5OH0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgbG9naWNhbF9jcHVzPSI4IiBwaHlzbWVtb3J5PSI4IiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMTkwNDEuMTI4OCIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBvc19yZWdpb25fbmFtZT0iVVMiIG9zX3JlZ2lvbl9uYXRpb249IjI0NCIgb3NfcmVnaW9uX2RtYT0iMCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iREFEWSIgcHJvZHVjdF9uYW1lPSJTdGFuZGFyZCBQQyAoUTM1ICsgSUNIOSwgMjAwOSkiLz48ZXhwIGV0YWc9IiZxdW90O3FXSlN6V3dQZmRjTFIrWEdJdjZ4clpmaVlPeGhQVTJzMU5XbWpXY2FGUGc9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0ie0YzQzRGRTAwLUVGRDUtNDAzQi05NTY5LTM5OEEyMEYxQkE0QX0iIHZlcnNpb249IjEuMy4xODEuNSIgbmV4dHZlcnNpb249IjEuMy4xODMuMjkiIGxhbmc9IiIgYnJhbmQ9IklOQlgiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIwIj48dXBkYXRlY2hlY2svPjxldmVudCBldmVudHR5cGU9IjEyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMzMwMTUyOTEwMyIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEzIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMzMwMTYzMDE1OSIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjE0IiBldmVudHJlc3VsdD0iMCIgZXJyb3Jjb2RlPSItMjE0NzAyMzgzOCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTM1Mjc1MTM3MDMiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIGRvd25sb2FkZXI9ImRvIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuYi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy84MTRiODQ4Yi1hNGU0LTQ4ZjctOWRjMC1iMThiNTdmNmM5ZjM_UDE9MTcwNzQ5ODQ0NSZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1ua3lmUUM1aUxkbzVTdXMlMmZHMURVMHF6VW5XM0xBQTM1ZjZNMzNMYUJPNUJRaGhnNndtR2xQcURqOWdHNCUyZmkzaVV4aiUyYlRaSDVJdU9aSzR3Rk95dyUyZnlRJTNkJTNkIiBzZXJ2ZXJfaXBfaGludD0iIiBjZG5fY2lkPSItMSIgY2RuX2NjYz0iIiBjZG5fbXNlZGdlX3JlZj0iIiBjZG5fYXp1cmVfcmVmX29yaWdpbl9zaGllbGQ9IiIgY2RuX2NhY2hlPSIiIGNkbl9wM3A9IiIgZG93bmxvYWRlZD0iMCIgdG90YWw9IjAiIGRvd25sb2FkX3RpbWVfbXM9IjUiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNCIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTM1Mjc2MTM0OTUiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIGRvd25sb2FkZXI9ImJpdHMiIHVybD0iaHR0cDovL21zZWRnZS5iLnRsdS5kbC5kZWxpdmVyeS5tcC5taWNyb3NvZnQuY29tL2ZpbGVzdHJlYW1pbmdzZXJ2aWNlL2ZpbGVzLzgxNGI4NDhiLWE0ZTQtNDhmNy05ZGMwLWIxOGI1N2Y2YzlmMz9QMT0xNzA3NDk4NDQ1JmFtcDtQMj00MDQmYW1wO1AzPTImYW1wO1A0PW5reWZRQzVpTGRvNVN1cyUyZkcxRFUwcXpVblczTEFBMzVmNk0zM0xhQk81QlFoaGc2d21HbFBxRGo5Z0c0JTJmaTNpVXhqJTJiVFpINUl1T1pLNHdGT3l3JTJmeVElM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIxNjE2NDU2IiB0b3RhbD0iMTYxNjQ1NiIgZG93bmxvYWRfdGltZV9tcz0iMTgwNjYiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNCIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTM1Mjc2NjA5MzkiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTM1MzMwMTA4MjciIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48cGluZyByZD0iNjI0MSIgcGluZ19mcmVzaG5lc3M9Ins0NEE2NENBQS1CNDc4LTQxODEtQTU2OS0zOTA3RjRFNkIzRDZ9Ii8-PC9hcHA-PGFwcCBhcHBpZD0iezU2RUIxOEY4LUIwMDgtNENCRC1CNkQyLThDOTdGRTdFOTA2Mn0iIHZlcnNpb249IjkyLjAuOTAyLjY3IiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSJJTkJYIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNvbnNlbnQ9ZmFsc2UiIGlzX3Bpbm5lZF9zeXN0ZW09InRydWUiIGxhc3RfbGF1bmNoX2NvdW50PSIxIiBsYXN0X2xhdW5jaF90aW1lPSIxMzM0NzExMDE0NDQwMTQzODAiPjx1cGRhdGVjaGVjay8-PHBpbmcgYWN0aXZlPSIwIiByZD0iNjI0MSIgcGluZ19mcmVzaG5lc3M9Ins3RkExRTMxMC00MjhELTQ1ODEtODU4RC02Q0Q4QjdBRkQxQzl9Ii8-PC9hcHA-PGFwcCBhcHBpZD0ie0YzMDE3MjI2LUZFMkEtNDI5NS04QkRGLTAwQzNBOUE3RTRDNX0iIHZlcnNpb249IjEyMS4wLjIyNzcuOTgiIG5leHR2ZXJzaW9uPSIiIGxhbmc9IiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIwIiBpbnN0YWxsZGF0ZT0iNjIzNyI-PHVwZGF0ZWNoZWNrLz48cGluZyByZD0iNjI0MSIgcGluZ19mcmVzaG5lc3M9InsyODI5QTZEOC1FQzFFLTRGOUQtOEM0My1GNDU5MkQ2OUY4QzJ9Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
                                                                  2⤵
                                                                  • Checks system information in the registry
                                                                  • Executes dropped EXE
                                                                  • Loads dropped DLL
                                                                  PID:5080
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.bing.com/search?q=this+is+the+shit&src=IE-SearchBox&FORM=IESR4N
                                                                1⤵
                                                                • Enumerates system info in registry
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                • Suspicious use of SendNotifyMessage
                                                                PID:1768
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffb69b646f8,0x7ffb69b64708,0x7ffb69b64718
                                                                  2⤵
                                                                    PID:5080
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,349449747944673421,12464773946051479803,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
                                                                    2⤵
                                                                      PID:4040
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,349449747944673421,12464773946051479803,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2452 /prefetch:3
                                                                      2⤵
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      PID:4772
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,349449747944673421,12464773946051479803,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2200 /prefetch:8
                                                                      2⤵
                                                                        PID:1172
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,349449747944673421,12464773946051479803,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3532 /prefetch:1
                                                                        2⤵
                                                                          PID:3532
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,349449747944673421,12464773946051479803,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3540 /prefetch:1
                                                                          2⤵
                                                                            PID:2260
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,349449747944673421,12464773946051479803,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4896 /prefetch:1
                                                                            2⤵
                                                                              PID:3644
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,349449747944673421,12464773946051479803,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3788 /prefetch:1
                                                                              2⤵
                                                                                PID:2376
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2116,349449747944673421,12464773946051479803,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5004 /prefetch:8
                                                                                2⤵
                                                                                  PID:2120
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2116,349449747944673421,12464773946051479803,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4976 /prefetch:8
                                                                                  2⤵
                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                  PID:636
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,349449747944673421,12464773946051479803,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4944 /prefetch:1
                                                                                  2⤵
                                                                                    PID:2856
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,349449747944673421,12464773946051479803,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5664 /prefetch:8
                                                                                    2⤵
                                                                                      PID:1492
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,349449747944673421,12464773946051479803,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5664 /prefetch:8
                                                                                      2⤵
                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                      PID:1604
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,349449747944673421,12464773946051479803,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1
                                                                                      2⤵
                                                                                        PID:1792
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,349449747944673421,12464773946051479803,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3924 /prefetch:1
                                                                                        2⤵
                                                                                          PID:1420
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,349449747944673421,12464773946051479803,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
                                                                                          2⤵
                                                                                            PID:1408
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,349449747944673421,12464773946051479803,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
                                                                                            2⤵
                                                                                              PID:5116
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,349449747944673421,12464773946051479803,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1820 /prefetch:2
                                                                                              2⤵
                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                              PID:1492
                                                                                          • C:\Windows\System32\CompPkgSrv.exe
                                                                                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                            1⤵
                                                                                              PID:1420
                                                                                            • C:\Windows\System32\CompPkgSrv.exe
                                                                                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                              1⤵
                                                                                                PID:4208
                                                                                              • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                                                "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler
                                                                                                1⤵
                                                                                                • Executes dropped EXE
                                                                                                • Loads dropped DLL
                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                PID:2040
                                                                                              • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                                                "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
                                                                                                1⤵
                                                                                                • Checks system information in the registry
                                                                                                • Executes dropped EXE
                                                                                                • Loads dropped DLL
                                                                                                • Modifies data under HKEY_USERS
                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                PID:4672
                                                                                                • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODMuMjkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MDNCMDA1NDMtN0VERC00Nzc1LTkzQzQtNkYyOUNDOEZGODA4fSIgdXNlcmlkPSJ7QjVEOERCRkMtODkxNC00RTRGLTk5QzktRDI5N0NGN0IwMzQyfSIgaW5zdGFsbHNvdXJjZT0idW5rbm93biIgcmVxdWVzdGlkPSJ7MDY2MDczMDEtNTBGMS00QzE1LThBQ0EtNzBERUMwNjZBOUM2fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIG9zX3JlZ2lvbl9uYW1lPSJVUyIgb3NfcmVnaW9uX25hdGlvbj0iMjQ0IiBvc19yZWdpb25fZG1hPSIwIiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSJEQURZIiBwcm9kdWN0X25hbWU9IlN0YW5kYXJkIFBDIChRMzUgKyBJQ0g5LCAyMDA5KSIvPjxleHAgZXRhZz0iJnF1b3Q7cVdKU3pXd1BmZGNMUitYR0l2NnhyWmZpWU94aFBVMnMxTldtaldjYUZQZz0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTA2LjAuNTI0OS4xMTkiIG5leHR2ZXJzaW9uPSIiIGxhbmc9ImVuIiBicmFuZD0iR0dMUyIgY2xpZW50PSIiIGluc3RhbGxhZ2U9IjQ5IiBpbnN0YWxsZGF0ZXRpbWU9IjE3MDI2MzQwMDAiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM0NzEzNDcxMzYwMDY2MzQiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSI1MjkiIHN5c3RlbV91cHRpbWVfdGlja3M9IjE2NzExNDI5MDE0Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
                                                                                                  2⤵
                                                                                                  • Checks system information in the registry
                                                                                                  • Executes dropped EXE
                                                                                                  • Loads dropped DLL
                                                                                                  PID:4508
                                                                                                • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{865801A7-E1F8-415C-85F1-500519996C86}\MicrosoftEdge_X64_121.0.2277.83.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{865801A7-E1F8-415C-85F1-500519996C86}\MicrosoftEdge_X64_121.0.2277.83.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
                                                                                                  2⤵
                                                                                                  • Executes dropped EXE
                                                                                                  PID:4604
                                                                                                  • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{865801A7-E1F8-415C-85F1-500519996C86}\EDGEMITMP_A1825.tmp\setup.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{865801A7-E1F8-415C-85F1-500519996C86}\EDGEMITMP_A1825.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{865801A7-E1F8-415C-85F1-500519996C86}\MicrosoftEdge_X64_121.0.2277.83.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
                                                                                                    3⤵
                                                                                                    • Installs/modifies Browser Helper Object
                                                                                                    • Modifies Installed Components in the registry
                                                                                                    • Drops file in Program Files directory
                                                                                                    • Executes dropped EXE
                                                                                                    • Registers COM server for autorun
                                                                                                    • Modifies Internet Explorer settings
                                                                                                    • Modifies registry class
                                                                                                    • System policy modification
                                                                                                    PID:4064
                                                                                                    • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{865801A7-E1F8-415C-85F1-500519996C86}\EDGEMITMP_A1825.tmp\setup.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{865801A7-E1F8-415C-85F1-500519996C86}\EDGEMITMP_A1825.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=121.0.6167.85 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{865801A7-E1F8-415C-85F1-500519996C86}\EDGEMITMP_A1825.tmp\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=121.0.2277.83 --initial-client-data=0x230,0x234,0x238,0x20c,0x23c,0x7ff67c483d88,0x7ff67c483d94,0x7ff67c483da0
                                                                                                      4⤵
                                                                                                      • Executes dropped EXE
                                                                                                      PID:2604
                                                                                                    • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{865801A7-E1F8-415C-85F1-500519996C86}\EDGEMITMP_A1825.tmp\setup.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{865801A7-E1F8-415C-85F1-500519996C86}\EDGEMITMP_A1825.tmp\setup.exe" --msedge --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1
                                                                                                      4⤵
                                                                                                      • Drops file in System32 directory
                                                                                                      • Executes dropped EXE
                                                                                                      PID:924
                                                                                                      • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{865801A7-E1F8-415C-85F1-500519996C86}\EDGEMITMP_A1825.tmp\setup.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{865801A7-E1F8-415C-85F1-500519996C86}\EDGEMITMP_A1825.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=121.0.6167.85 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{865801A7-E1F8-415C-85F1-500519996C86}\EDGEMITMP_A1825.tmp\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=121.0.2277.83 --initial-client-data=0x230,0x234,0x238,0x20c,0x23c,0x7ff67c483d88,0x7ff67c483d94,0x7ff67c483da0
                                                                                                        5⤵
                                                                                                        • Executes dropped EXE
                                                                                                        PID:4556
                                                                                                • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODMuMjkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MDNCMDA1NDMtN0VERC00Nzc1LTkzQzQtNkYyOUNDOEZGODA4fSIgdXNlcmlkPSJ7QjVEOERCRkMtODkxNC00RTRGLTk5QzktRDI5N0NGN0IwMzQyfSIgaW5zdGFsbHNvdXJjZT0ic2NoZWR1bGVyIiByZXF1ZXN0aWQ9IntDNzdFQkUwQi1CNTc0LTQyQzAtOEY2Ny1GMkNBQjMxMkNFMjB9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgb3NfcmVnaW9uX25hbWU9IlVTIiBvc19yZWdpb25fbmF0aW9uPSIyNDQiIG9zX3JlZ2lvbl9kbWE9IjAiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IkRBRFkiIHByb2R1Y3RfbmFtZT0iU3RhbmRhcmQgUEMgKFEzNSArIElDSDksIDIwMDkpIi8-PGV4cCBldGFnPSImcXVvdDtWUFFvUDFGK2ZxMTV3UnpoMWtQTDRQTXBXaDhPUk1CNWl6dnJPQy9jaGpRPSZxdW90OyIvPjxhcHAgYXBwaWQ9IntGM0M0RkUwMC1FRkQ1LTQwM0ItOTU2OS0zOThBMjBGMUJBNEF9IiB2ZXJzaW9uPSIxLjMuMTgzLjI5IiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSJJTkJYIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMCIgY29ob3J0PSJycmZAMC41MyI-PHVwZGF0ZWNoZWNrLz48cGluZyByZD0iNjI0MSIgcGluZ19mcmVzaG5lc3M9IntENDQxQURCRS00NTQ1LTQzMjQtODM3NS1BQjE4MTAwNkREMUN9Ii8-PC9hcHA-PGFwcCBhcHBpZD0iezU2RUIxOEY4LUIwMDgtNENCRC1CNkQyLThDOTdGRTdFOTA2Mn0iIHZlcnNpb249IjkyLjAuOTAyLjY3IiBuZXh0dmVyc2lvbj0iMTIxLjAuMjI3Ny44MyIgbGFuZz0iIiBicmFuZD0iSU5CWCIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJjb25zZW50PWZhbHNlIiBpc19waW5uZWRfc3lzdGVtPSJ0cnVlIiBsYXN0X2xhdW5jaF9jb3VudD0iMSIgbGFzdF9sYXVuY2hfdGltZT0iMTMzNTEzNjc0MDcwMzIwOTUwIj48dXBkYXRlY2hlY2svPjxldmVudCBldmVudHR5cGU9IjEyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxNjczMTQyODg0OSIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEzIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxNjczMTU4NTk2NyIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjE0IiBldmVudHJlc3VsdD0iMCIgZXJyb3Jjb2RlPSItMjE0NzAyMzgzOCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTc0NTk5ODE0MDUiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIGRvd25sb2FkZXI9ImRvIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuYi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy9lNThhYzc4YS1kNTZjLTRkYmMtYTAwMy1hMTc5NGIzOWZmOWQ_UDE9MTcwNzQ5ODc4OCZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1FRHhEeTlrQkVMNEk3YTFVRlFoTzZFMkFMZzZsczc2cXhaWFdtT3NrWmxETUgxaGxhMFduJTJmbnk2JTJmUiUyZnYwMjVhWGZYZnlVYkNGOXB0b0dURFRoJTJmMGZ3JTNkJTNkIiBzZXJ2ZXJfaXBfaGludD0iIiBjZG5fY2lkPSItMSIgY2RuX2NjYz0iIiBjZG5fbXNlZGdlX3JlZj0iIiBjZG5fYXp1cmVfcmVmX29yaWdpbl9zaGllbGQ9IiIgY2RuX2NhY2hlPSIiIGNkbl9wM3A9IiIgZG93bmxvYWRlZD0iMCIgdG90YWw9IjAiIGRvd25sb2FkX3RpbWVfbXM9IjE1Ii8-PGV2ZW50IGV2ZW50dHlwZT0iMTQiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjE3NDYwMTM3NDA3IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuYi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy9lNThhYzc4YS1kNTZjLTRkYmMtYTAwMy1hMTc5NGIzOWZmOWQ_UDE9MTcwNzQ5ODc4OCZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1FRHhEeTlrQkVMNEk3YTFVRlFoTzZFMkFMZzZsczc2cXhaWFdtT3NrWmxETUgxaGxhMFduJTJmbnk2JTJmUiUyZnYwMjVhWGZYZnlVYkNGOXB0b0dURFRoJTJmMGZ3JTNkJTNkIiBzZXJ2ZXJfaXBfaGludD0iIiBjZG5fY2lkPSItMSIgY2RuX2NjYz0iIiBjZG5fbXNlZGdlX3JlZj0iIiBjZG5fYXp1cmVfcmVmX29yaWdpbl9zaGllbGQ9IiIgY2RuX2NhY2hlPSIiIGNkbl9wM3A9IiIgZG93bmxvYWRlZD0iMTc0NjU1NTYwIiB0b3RhbD0iMTc0NjU1NTYwIiBkb3dubG9hZF90aW1lX21zPSI2Mzc4NiIvPjxldmVudCBldmVudHR5cGU9IjE0IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxNzQ2MDQ1MDEyMCIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjE1IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxNzQ4MzMyNjc3NiIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjMiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjE5Njc1NyIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTgwODQ2NzU0MzgiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIHVwZGF0ZV9jaGVja190aW1lX21zPSIxMTQwIiBkb3dubG9hZF90aW1lX21zPSI3Mjc3NyIgZG93bmxvYWRlZD0iMTc0NjU1NTYwIiB0b3RhbD0iMTc0NjU1NTYwIiBwYWNrYWdlX2NhY2hlX3Jlc3VsdD0iMCIgaW5zdGFsbF90aW1lX21zPSI2MDExOSIvPjxwaW5nIGFjdGl2ZT0iMSIgYWQ9IjYyNDEiIHJkPSI2MjQxIiBwaW5nX2ZyZXNobmVzcz0iezMxMTE5OTU3LTk4ODItNDM4QS1CNTkxLTk1NkUzMUVFRDQxN30iLz48L2FwcD48YXBwIGFwcGlkPSJ7RjMwMTcyMjYtRkUyQS00Mjk1LThCREYtMDBDM0E5QTdFNEM1fSIgdmVyc2lvbj0iMTIxLjAuMjI3Ny45OCIgbmV4dHZlcnNpb249IiIgbGFuZz0iIiBicmFuZD0iR0dMUyIgY2xpZW50PSIiIGluc3RhbGxhZ2U9IjAiIGluc3RhbGxkYXRlPSI2MjM3IiBjb2hvcnQ9InJyZkAwLjc3Ij48dXBkYXRlY2hlY2svPjxwaW5nIHJkPSI2MjQxIiBwaW5nX2ZyZXNobmVzcz0iezA3OEEzQjRFLUUwMEMtNDE0Mi1BRkE0LTdDQjY2NjcxRjUxN30iLz48L2FwcD48L3JlcXVlc3Q-
                                                                                                  2⤵
                                                                                                  • Checks system information in the registry
                                                                                                  • Executes dropped EXE
                                                                                                  • Loads dropped DLL
                                                                                                  PID:1480

                                                                                              Network

                                                                                                    MITRE ATT&CK Enterprise v15

                                                                                                    Replay Monitor

                                                                                                    Loading Replay Monitor...

                                                                                                    Downloads

                                                                                                    setup.exe
                                                                                                    • Path C:\Program Files (x86)\Microsoft\EdgeCore\121.0.2277.83\Installer\setup.exe
                                                                                                    • Size 6.6MB
                                                                                                    • SHA256 ce8cd475787bf77fcf52d0a2561873ae1c27695744a8561e0ba39dacdfb60386
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    setup.exe
                                                                                                    • Path C:\Program Files (x86)\Microsoft\EdgeCore\121.0.2277.98\Installer\setup.exe
                                                                                                    • Size 6.6MB
                                                                                                    • SHA256 96971c27360a68e42c525697e5dc97ebd9c2a2f14f50e5f3caa897ae801bd180
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    MicrosoftEdge_X64_121.0.2277.83.exe
                                                                                                    • Path C:\Program Files (x86)\Microsoft\EdgeUpdate\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\121.0.2277.83\MicrosoftEdge_X64_121.0.2277.83.exe
                                                                                                    • Size 15.9MB
                                                                                                    • SHA256 c112e84d44c71e5aa603a881a21bcc47297b184bc3a8d4ae88c36d31a001f225
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    MicrosoftEdge_X64_121.0.2277.98.exe
                                                                                                    • Path C:\Program Files (x86)\Microsoft\EdgeUpdate\Download\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\121.0.2277.98\MicrosoftEdge_X64_121.0.2277.98.exe
                                                                                                    • Size 23.6MB
                                                                                                    • SHA256 9edacee0686146a71ba95dfc7f328149b893c09d2add49b698b572e1a76dae24
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    MicrosoftEdgeUpdateSetup_X86_1.3.181.5.exe
                                                                                                    • Path C:\Program Files (x86)\Microsoft\EdgeUpdate\Download\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\1.3.181.5\MicrosoftEdgeUpdateSetup_X86_1.3.181.5.exe
                                                                                                    • Size 1.5MB
                                                                                                    • SHA256 2450a90417ec5205709d79cc2ba5bb0401b49af95dcf8d6e1786e0d72da53754
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    MicrosoftEdgeUpdateSetup_X86_1.3.183.29.exe
                                                                                                    • Path C:\Program Files (x86)\Microsoft\EdgeUpdate\Download\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\1.3.183.29\MicrosoftEdgeUpdateSetup_X86_1.3.183.29.exe
                                                                                                    • Size 1.5MB
                                                                                                    • SHA256 611730ce9e8cb3b7fd31a9e064308175eae4c173b46a84529ee43b4f22c21455
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    EdgeUpdate.dat
                                                                                                    • Path C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\EdgeUpdate.dat
                                                                                                    • Size 12KB
                                                                                                    • SHA256 3d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    MicrosoftEdgeComRegisterShellARM64.exe
                                                                                                    • Path C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\MicrosoftEdgeComRegisterShellARM64.exe
                                                                                                    • Size 179KB
                                                                                                    • SHA256 35a14bd84e74dd6d8e2683470243fb1bb9071178d9283b12ebbfb405c8cd4aa9
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    MicrosoftEdgeUpdate.exe
                                                                                                    • Path C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\MicrosoftEdgeUpdate.exe
                                                                                                    • Size 201KB
                                                                                                    • SHA256 87c6f7d9b58f136aeb33c96dbfe3702083ec519aafca39be66778a9c27a68718
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    MicrosoftEdgeUpdateComRegisterShell64.exe
                                                                                                    • Path C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe
                                                                                                    • Size 212KB
                                                                                                    • SHA256 4d01f5531f93ab2af9e92c4f998a145c94f36688c3793845d528c8675697e112
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    MicrosoftEdgeUpdateCore.exe
                                                                                                    • Path C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\MicrosoftEdgeUpdateCore.exe
                                                                                                    • Size 257KB
                                                                                                    • SHA256 9f79fe09f57002ca07ae0b2a196e8cc002d2be6d5540ee857217e99b33fa4bb2
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    NOTICE.TXT
                                                                                                    • Path C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\NOTICE.TXT
                                                                                                    • Size 4KB
                                                                                                    • SHA256 91d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    msedgeupdate.dll
                                                                                                    • Path C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\msedgeupdate.dll
                                                                                                    • Size 2.0MB
                                                                                                    • SHA256 d80c512d99765586e02323a2e18694965eafb903e9bc13f0e0b4265f86b21a19
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    msedgeupdateres_af.dll
                                                                                                    • Path C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\msedgeupdateres_af.dll
                                                                                                    • Size 28KB
                                                                                                    • SHA256 a881788359b2a7d90ac70a76c45938fb337c2064487dcb8be00b9c311d10c24c
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    msedgeupdateres_am.dll
                                                                                                    • Path C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\msedgeupdateres_am.dll
                                                                                                    • Size 24KB
                                                                                                    • SHA256 986b0654a8b5f7b23478463ff051bffe1e9bbdeb48744e4aa1bd3d89a7520717
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    msedgeupdateres_ar.dll
                                                                                                    • Path C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\msedgeupdateres_ar.dll
                                                                                                    • Size 26KB
                                                                                                    • SHA256 e2cc8017bc24e73048c7ee68d3787ed63c3898eec61299a9ca1bab8aeaa8da01
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    msedgeupdateres_as.dll
                                                                                                    • Path C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\msedgeupdateres_as.dll
                                                                                                    • Size 28KB
                                                                                                    • SHA256 3b82de846ad028544013383e3c9fb570d2a09abf2c854e8a4d641bd7fc3b3766
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    msedgeupdateres_az.dll
                                                                                                    • Path C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\msedgeupdateres_az.dll
                                                                                                    • Size 29KB
                                                                                                    • SHA256 5ab96e4e6e065dbce3b643c6be2c668f5570984ead1a8b3578bbd2056fbad4e9
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    msedgeupdateres_bg.dll
                                                                                                    • Path C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\msedgeupdateres_bg.dll
                                                                                                    • Size 29KB
                                                                                                    • SHA256 a12df15afac4eb2695626d7a8a2888bdf54c8db671043b0677180f746d8ad105
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    msedgeupdateres_bn-IN.dll
                                                                                                    • Path C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\msedgeupdateres_bn-IN.dll
                                                                                                    • Size 29KB
                                                                                                    • SHA256 5b01fe11016610d5606f815281c970c86025732fc597b99c031a018626cd9f3c
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    msedgeupdateres_bn.dll
                                                                                                    • Path C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\msedgeupdateres_bn.dll
                                                                                                    • Size 29KB
                                                                                                    • SHA256 e32f77ed3067d7735d10f80e5a0aa0c50c993b59b82dc834f2583c314e28fa98
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    msedgeupdateres_bs.dll
                                                                                                    • Path C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\msedgeupdateres_bs.dll
                                                                                                    • Size 28KB
                                                                                                    • SHA256 99b1b7e25fbc2c64489c0607cef0ae5ff720ab529e11093ed9860d953adeba04
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    msedgeupdateres_ca-Es-VALENCIA.dll
                                                                                                    • Path C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\msedgeupdateres_ca-Es-VALENCIA.dll
                                                                                                    • Size 29KB
                                                                                                    • SHA256 2726c48a468f8f6debc2d9a6a0706b640b2852c885e603e6b2dec638756160df
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    msedgeupdateres_ca.dll
                                                                                                    • Path C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\msedgeupdateres_ca.dll
                                                                                                    • Size 30KB
                                                                                                    • SHA256 8dbd55ed532073874f4fe006ef456e31642317145bd18ddc30f681ce9e0c8e07
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    msedgeupdateres_cs.dll
                                                                                                    • Path C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\msedgeupdateres_cs.dll
                                                                                                    • Size 28KB
                                                                                                    • SHA256 e0f0026ddcbeafc6c991da6ba7c52927d050f928dba4a7153552efcea893a35b
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    msedgeupdateres_cy.dll
                                                                                                    • Path C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\msedgeupdateres_cy.dll
                                                                                                    • Size 28KB
                                                                                                    • SHA256 252b6f9bf5a9cb59ad1c072e289cc9695c0040b363d4bfbcc9618a12df77d18e
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    msedgeupdateres_da.dll
                                                                                                    • Path C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\msedgeupdateres_da.dll
                                                                                                    • Size 28KB
                                                                                                    • SHA256 fd98159338d1f3b03814af31440d37d15ab183c1a230e6261fbb90e402f85d5f
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    msedgeupdateres_de.dll
                                                                                                    • Path C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\msedgeupdateres_de.dll
                                                                                                    • Size 30KB
                                                                                                    • SHA256 061a7cdaff9867ddb0bd3de2c0760d6919d8d2ca7c7f889ec2d32265d7e7a75c
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    msedgeupdateres_el.dll
                                                                                                    • Path C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\msedgeupdateres_el.dll
                                                                                                    • Size 30KB
                                                                                                    • SHA256 223d2db0bc2cc82bda04a0a2cd2b7f6cb589e2fa5c0471a2d5eb04d2ffcfcfa0
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    msedgeupdateres_en-GB.dll
                                                                                                    • Path C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\msedgeupdateres_en-GB.dll
                                                                                                    • Size 27KB
                                                                                                    • SHA256 fd90699e7f29b6028a2e8e6f3ae82d26cdc6942bd39c4f07b221d87c5dbbfe1e
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    msedgeupdateres_en.dll
                                                                                                    • Path C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\msedgeupdateres_en.dll
                                                                                                    • Size 27KB
                                                                                                    • SHA256 9afbbe2a591250b80499f0bf02715f02dbcd5a80088e129b1f670f1a3167a011
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    msedgeupdateres_es-419.dll
                                                                                                    • Path C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\msedgeupdateres_es-419.dll
                                                                                                    • Size 29KB
                                                                                                    • SHA256 55a69ce2d6fc4109d16172ba6d9edb59dbadbc8af6746cc71dc4045aa549022d
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    msedgeupdateres_es.dll
                                                                                                    • Path C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\msedgeupdateres_es.dll
                                                                                                    • Size 28KB
                                                                                                    • SHA256 e652159a75cbab76217ecbb4340020f277175838b316b32cf71e18d83da4a819
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    msedgeupdateres_et.dll
                                                                                                    • Path C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\msedgeupdateres_et.dll
                                                                                                    • Size 28KB
                                                                                                    • SHA256 f0a4cfd96c85f2d98a3c9ecfadd41c0c139fdb20470c8004f4c112dd3d69e085
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    msedgeupdateres_eu.dll
                                                                                                    • Path C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\msedgeupdateres_eu.dll
                                                                                                    • Size 28KB
                                                                                                    • SHA256 e5615c838a71b533b26d308509954907bcc0eb4032cdbaa3db621eede5e6bfa4
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    msedgeupdateres_fa.dll
                                                                                                    • Path C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\msedgeupdateres_fa.dll
                                                                                                    • Size 27KB
                                                                                                    • SHA256 c66c4024847d353e9985eb9b2f060b2d84f12cc77fb6479df5ffc55dbda97e59
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    msedgeupdateres_fi.dll
                                                                                                    • Path C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\msedgeupdateres_fi.dll
                                                                                                    • Size 28KB
                                                                                                    • SHA256 acf42b90190110ccf30bcfb2626dd999a14e42a72a3983928cba98d44f0a72e2
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    msedgeupdateres_fil.dll
                                                                                                    • Path C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\msedgeupdateres_fil.dll
                                                                                                    • Size 29KB
                                                                                                    • SHA256 e622823096fc656f63d5a7bbdf3744745ef389c92ec1b804d3b874578e18c89d
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    msedgeupdateres_fr-CA.dll
                                                                                                    • Path C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\msedgeupdateres_fr-CA.dll
                                                                                                    • Size 30KB
                                                                                                    • SHA256 445051ef15c6c872bed6d904169793837e41029a8578eaf81d78a4641ef53511
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    msedgeupdateres_fr.dll
                                                                                                    • Path C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\msedgeupdateres_fr.dll
                                                                                                    • Size 30KB
                                                                                                    • SHA256 a9b72fcb3bdb5e021b8d23b2de0caeca80ddc50420088b988a5b7503f2d7c961
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    msedgeupdateres_ga.dll
                                                                                                    • Path C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\msedgeupdateres_ga.dll
                                                                                                    • Size 28KB
                                                                                                    • SHA256 abc9822ee193c9a98a21202648a48ecd69b0cb19ff31c9bbf0c79dab5f9609b0
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    msedgeupdateres_gd.dll
                                                                                                    • Path C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\msedgeupdateres_gd.dll
                                                                                                    • Size 30KB
                                                                                                    • SHA256 e3acc61d06942408369c85365ac0d731c5f3c9bc26e3f1e3bb24226d0879ad9c
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    msedgeupdateres_gl.dll
                                                                                                    • Path C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\msedgeupdateres_gl.dll
                                                                                                    • Size 28KB
                                                                                                    • SHA256 e4eb716f1041160fd323b0f229b88851e153025d5d79f49b7d6ecb7eb2442c57
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    msedgeupdateres_gu.dll
                                                                                                    • Path C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\msedgeupdateres_gu.dll
                                                                                                    • Size 28KB
                                                                                                    • SHA256 838ccd8243caa1a5d9e72eb1179ac8ae59d2acb453ed86be01e0722a8e917150
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    msedgeupdateres_hi.dll
                                                                                                    • Path C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\msedgeupdateres_hi.dll
                                                                                                    • Size 28KB
                                                                                                    • SHA256 024c5eae16e45abe2237c2a5d868563550ac596f1f7d777e25234c17d9461dd9
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    msedgeupdateres_hr.dll
                                                                                                    • Path C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\msedgeupdateres_hr.dll
                                                                                                    • Size 29KB
                                                                                                    • SHA256 65915ad11b9457d145795a1e8d151f898ec2dcb8b136967e6592884699867eb0
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    msedgeupdateres_hu.dll
                                                                                                    • Path C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\msedgeupdateres_hu.dll
                                                                                                    • Size 29KB
                                                                                                    • SHA256 b16755fdbcc796ef4eb937759fe2c3518c694f5d186970d55a5a5e5d906cb791
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    msedgeupdateres_id.dll
                                                                                                    • Path C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\msedgeupdateres_id.dll
                                                                                                    • Size 27KB
                                                                                                    • SHA256 192585d7f4a8a0cd95e338863c14233cdd8150f9f6f7dd8a405da0670110ee95
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    msedgeupdateres_is.dll
                                                                                                    • Path C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\msedgeupdateres_is.dll
                                                                                                    • Size 28KB
                                                                                                    • SHA256 a3a2947064267d17474c168d3189b0d372e36e53bf0efb9c228d314fc802d98e
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    msedgeupdateres_it.dll
                                                                                                    • Path C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\msedgeupdateres_it.dll
                                                                                                    • Size 30KB
                                                                                                    • SHA256 abe2360a585b6671ec3a69d14077b43ae8f9e92b6077b80a147dfe36792bb1b7
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    msedgeupdateres_iw.dll
                                                                                                    • Path C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\msedgeupdateres_iw.dll
                                                                                                    • Size 25KB
                                                                                                    • SHA256 fd5ba39c8b319c6ba2febf896c6947a0a7bae6aa0b4957bd124d55589f41849d
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    msedgeupdateres_ja.dll
                                                                                                    • Path C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\msedgeupdateres_ja.dll
                                                                                                    • Size 24KB
                                                                                                    • SHA256 5f4234e2b965656e3d6e127660f52e370dc133632d451ef04975f3b70194b2ed
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    msedgeupdateres_ka.dll
                                                                                                    • Path C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\msedgeupdateres_ka.dll
                                                                                                    • Size 29KB
                                                                                                    • SHA256 4449ee24c676e34fea4d151b3a752e8d0e7c82f419884e80da60d4d4c1b0f8cb
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    msedgeupdateres_kk.dll
                                                                                                    • Path C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\msedgeupdateres_kk.dll
                                                                                                    • Size 28KB
                                                                                                    • SHA256 fdd6bffdb9eca4542975f3afe3ac68feac190b8963f0a7244b4b8fa6382381d1
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    msedgeupdateres_km.dll
                                                                                                    • Path C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\msedgeupdateres_km.dll
                                                                                                    • Size 27KB
                                                                                                    • SHA256 6fd21b94f62ee7474b3c3029590ddf06936105508f9bf3509620c42dc37486c3
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    msedgeupdateres_kn.dll
                                                                                                    • Path C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\msedgeupdateres_kn.dll
                                                                                                    • Size 29KB
                                                                                                    • SHA256 ef749f70e71424d7f548d5c12283be70a6d6c59cffb1c8101b74f37ecacb64af
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    msedgeupdateres_ko.dll
                                                                                                    • Path C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\msedgeupdateres_ko.dll
                                                                                                    • Size 23KB
                                                                                                    • SHA256 baa9fae4fb8939e0b5fe0c7f393ab1ca40b52534f37bf2158a9a36331a221e75
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    msedgeupdateres_kok.dll
                                                                                                    • Path C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\msedgeupdateres_kok.dll
                                                                                                    • Size 28KB
                                                                                                    • SHA256 5b9509a1ae34d89c89c8e657742495037d28cd03e1cd48aef4dfaa7aeebe29f0
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    RobloxStudioInstaller.exe
                                                                                                    • Path C:\Program Files (x86)\Roblox\Versions\RobloxStudioInstaller.exe
                                                                                                    • Size 1.2MB
                                                                                                    • SHA256 fbd2b0372e228bbbfbee33ae88b181230a7f23a48cdad978c2f2089395eab66d
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    MicrosoftEdgeWebview2Setup.exe
                                                                                                    • Path C:\Program Files (x86)\Roblox\Versions\version-17f2f3d7fcfc48f5\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe
                                                                                                    • Size 1.5MB
                                                                                                    • SHA256 921d51979f3416ca19dca13a057f6fd3b09d8741f3576cad444eb95af87ebe08
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    settings.dat
                                                                                                    • Path C:\Program Files\MsEdgeCrashpad\settings.dat
                                                                                                    • Size 280B
                                                                                                    • SHA256 5b0feadb50f44719f52e2d40dcd9e75584f510283b74f2dc7282f9ab560bc9f5
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    MicrosoftEdgeUpdate.log
                                                                                                    • Path C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log
                                                                                                    • Size 114KB
                                                                                                    • SHA256 b40d4890526fd97e24bd67c83b452d579299eaa97f42fe25bf67a68ce867325a
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    the-real-index
                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                    • Size 2KB
                                                                                                    • SHA256 7e6ba9dc06aaae3810bbf2358d941102041955485a842b58f9b3590a66c08fdd
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    Network Persistent State
                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                    • Size 3KB
                                                                                                    • SHA256 9d9bc210da9b1ebdac84af7f7886c139020593724ce649701d3dff8da468d748
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    Network Persistent State
                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                    • Size 1KB
                                                                                                    • SHA256 3d46a195b8e8a67d1431e39631d7cbbb19a53c59cffa2ec6e91919fc6268f853
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    Network Persistent State
                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                    • Size 3KB
                                                                                                    • SHA256 e90e1b793607557bbda34b227f7495f057174183a505863fd334cb3b4fde537a
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    Network Persistent State
                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                    • Size 2KB
                                                                                                    • SHA256 c0ff00a2b24a3cc43a225f82192b63ebbd2f1489f1a99cff1eb58063c4587a27
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    Network Persistent State
                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                    • Size 2KB
                                                                                                    • SHA256 2fc5dadabefea11e362b3ecd1c461e71fb257a85a95be8585a6cffebf7fcf21d
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    TransportSecurity
                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                                    • Size 1KB
                                                                                                    • SHA256 d5a70b70f4645d169101378ab045808bfde8168cffb1a277b93e92c3b60a7880
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    TransportSecurity
                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                                    • Size 1KB
                                                                                                    • SHA256 817bcc7f220a1b56436ceff1a91aedb76ad3b491007f496723ee5fbf2d26ec06
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    TransportSecurity
                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                                    • Size 1KB
                                                                                                    • SHA256 fa9ba7eea1c519cbf9169a25c966b89bfea226a099c581667a455738966528c9
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    TransportSecurity
                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                                    • Size 369B
                                                                                                    • SHA256 135f5ee897c10ec7ed1d485f89686f0954179be94eaeb706f24f3d57880411df
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    TransportSecurity
                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                                    • Size 369B
                                                                                                    • SHA256 6c6c1d8ff375d90c54ba9a4c5b782fe0634079835ade0b7b5ee3d7ff4f080201
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    TransportSecurity
                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                                    • Size 872B
                                                                                                    • SHA256 75567383126676a259afbd12aa6a181d857c75dad850485304ee5ebb3ce9dd04
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    TransportSecurity
                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                                    • Size 1KB
                                                                                                    • SHA256 446bf9b9e8653bb7cc52263a0f43cd39301fee0775a65589b77f350b33618478
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    TransportSecurity
                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                                    • Size 1KB
                                                                                                    • SHA256 68e5da9cc001a3e4c7840813c530e9950929c827882e1386089e065a6e2526e8
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    TransportSecurity
                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                                    • Size 1KB
                                                                                                    • SHA256 3adcdfd1b70cc927788e990289e03bdd9baf70ad07d8679ac51eb9735bc13a1a
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    Preferences
                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                    • Size 6KB
                                                                                                    • SHA256 56660e57736d172e02a8ebae8623854634a2d00d6553b1ade96d3807e661125a
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    Preferences
                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                    • Size 5KB
                                                                                                    • SHA256 c97fe75f89f0219d735cc90e9db8a45b8172f85a1bcaa9bd067391ec04cb7370
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    Preferences
                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                    • Size 5KB
                                                                                                    • SHA256 a3034624834385dde58522b0d4caf268f86c89e7487823de3b5a0a23c8132b50
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    Preferences
                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                    • Size 6KB
                                                                                                    • SHA256 6d052a340366ffde9a76b63071ce64420f464e8feb158c285fd0fba28d25b67d
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    Preferences
                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                    • Size 6KB
                                                                                                    • SHA256 369633914a08ade981ca271e24e2eed57a142410be55cbe8d54972b8aa9761ba
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    Preferences
                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                    • Size 6KB
                                                                                                    • SHA256 4765702c3f31d1ae7677a950a7d385b52e3f05f807ee02f361e39428bdb5c3dd
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    0
                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\blob_storage\a865a8e3-2e89-43ad-acd3-3569dd102e12\0
                                                                                                    • Size 2.1MB
                                                                                                    • SHA256 9ec1ca4cb3c10b458a6a34247732185045fe1698b964d64c8a41681e6c13cdda
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    Local State
                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                    • Size 232KB
                                                                                                    • SHA256 8afdd904097e10d6a78fc531b17a359120ae6dfcc74663187a172d8dce06de81
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    Module Info Cache
                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
                                                                                                    • Size 110KB
                                                                                                    • SHA256 3f0e9767fc392c4265e26011a7342c7f64f38b3a93bb8476a3c8ba2bffbb1461
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    Module Info Cache
                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
                                                                                                    • Size 103KB
                                                                                                    • SHA256 96d0205d1831f3c73f9fa894c538a680b2f6c0d9698f51ce47fc2dd3f18fc61f
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    Module Info Cache~RFe5a2126.TMP
                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe5a2126.TMP
                                                                                                    • Size 98KB
                                                                                                    • SHA256 ace689c6844cc73a279c5886763954902e58c77dd1a0116d64c40b36129a470a
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    persisted_first_party_sets.json
                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
                                                                                                    • Size 2B
                                                                                                    • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    settings.dat
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                    • Size 152B
                                                                                                    • SHA256 7af7b56e2f0a84ae008785726f3404eb9001baa4b5531d0d618c6bdcb05a3a7a
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    the-real-index
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                    • Size 1KB
                                                                                                    • SHA256 15314353ac4dac985945ccab704f65c9ed400bcc18082fbf561605bd7401e69e
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    Network Persistent State
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                                                                    • Size 467B
                                                                                                    • SHA256 9f8ec32dc6e9598a1a64bb28ea815e8034aafbec70f37f766793873fbbe74a57
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    Network Persistent State
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                                                                    • Size 111B
                                                                                                    • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    Preferences
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                    • Size 5KB
                                                                                                    • SHA256 7c2a67706ea38bfd3a4d33459535d247573ee98bb65e8056bcf49aba6c705497
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    Preferences
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                    • Size 5KB
                                                                                                    • SHA256 7800412fc9099d77f000d854563fd8378fb02c7690adb740067b8997c5e820fd
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    Secure Preferences
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                                    • Size 24KB
                                                                                                    • SHA256 cf5d26bc399d0200a32080741e12f77d784a3117e6d58e07106e913f257aa46c
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    TransportSecurity
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                    • Size 538B
                                                                                                    • SHA256 7690ca836c972cba1897a9703c8f8ff0bc7e376df3f50ea647b8f458b02dbe49
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    TransportSecurity~RFe677acf.TMP
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe677acf.TMP
                                                                                                    • Size 370B
                                                                                                    • SHA256 9ed77e470a110a59bbebfa19b35371bf85d560beecf36e6d4c7b29a3e956bba5
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    CURRENT
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                                                                                    • Size 16B
                                                                                                    • SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    Local State
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                    • Size 10KB
                                                                                                    • SHA256 1bfb914038871f87ad3a79eb282c9821190ead3050584a1565da3d4bb52ef43d
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    Local State
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                    • Size 10KB
                                                                                                    • SHA256 506dbc71416acb5a3af99d2f33aaa789d0d2c70b6b009671b5af3428b0dbfcf6
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    c7fa889009fed8c8f48a9dfedcd339d0
                                                                                                    • Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\c7fa889009fed8c8f48a9dfedcd339d0
                                                                                                    • Size 14KB
                                                                                                    • SHA256 782d04148c026f66ff3a9f073ecf345d95f059552c7cb182f9e9fe9a04a1ee9f
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    Unconfirmed 567696.crdownload
                                                                                                    • Path C:\Users\Admin\Downloads\Unconfirmed 567696.crdownload
                                                                                                    • Size 3.8MB
                                                                                                    • SHA256 0f573abe2c483848f19dfba46c0872b067e4bde7c9abf11a71d9df0ecfdcf6c8
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    memory/1148-780-0x00007FFB87D20000-0x00007FFB87D30000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1148-833-0x00007FFB85A70000-0x00007FFB85A97000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1148-799-0x00007FFB85440000-0x00007FFB85450000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1148-801-0x00007FFB855B0000-0x00007FFB855E0000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1148-802-0x00007FFB855B0000-0x00007FFB855E0000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1148-803-0x00007FFB855B0000-0x00007FFB855E0000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1148-804-0x00007FFB855B0000-0x00007FFB855E0000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1148-805-0x00007FFB855B0000-0x00007FFB855E0000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1148-806-0x00007FFB877D0000-0x00007FFB877E0000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1148-807-0x00007FFB877D0000-0x00007FFB877E0000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1148-808-0x00007FFB87880000-0x00007FFB8788E000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1148-809-0x00007FFB87880000-0x00007FFB8788E000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1148-810-0x00007FFB87880000-0x00007FFB8788E000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1148-811-0x00007FFB87880000-0x00007FFB8788E000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1148-812-0x00007FFB87880000-0x00007FFB8788E000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1148-813-0x00007FFB86480000-0x00007FFB86490000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1148-814-0x00007FFB86480000-0x00007FFB86490000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1148-815-0x00007FFB864A0000-0x00007FFB864AB000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1148-816-0x00007FFB864A0000-0x00007FFB864AB000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1148-817-0x00007FFB864A0000-0x00007FFB864AB000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1148-819-0x00007FFB864A0000-0x00007FFB864AB000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1148-818-0x00007FFB864A0000-0x00007FFB864AB000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1148-820-0x00007FFB85700000-0x00007FFB85710000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1148-821-0x00007FFB85700000-0x00007FFB85710000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1148-822-0x00007FFB85800000-0x00007FFB85810000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1148-823-0x00007FFB85800000-0x00007FFB85810000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1148-824-0x00007FFB85830000-0x00007FFB85856000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1148-825-0x00007FFB85830000-0x00007FFB85856000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1148-826-0x00007FFB85830000-0x00007FFB85856000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1148-827-0x00007FFB85830000-0x00007FFB85856000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1148-828-0x00007FFB85830000-0x00007FFB85856000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1148-829-0x00007FFB85A70000-0x00007FFB85A97000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1148-830-0x00007FFB85A70000-0x00007FFB85A97000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1148-831-0x00007FFB85A70000-0x00007FFB85A97000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1148-832-0x00007FFB85A70000-0x00007FFB85A97000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1148-797-0x00007FFB85330000-0x00007FFB85340000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1148-834-0x00007FFB85A70000-0x00007FFB85A97000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1148-835-0x00007FFB85A70000-0x00007FFB85A97000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1148-836-0x00007FFB85C30000-0x00007FFB85C52000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1148-837-0x00007FFB85C30000-0x00007FFB85C52000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1148-838-0x00007FFB85C30000-0x00007FFB85C52000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1148-839-0x00007FFB85C30000-0x00007FFB85C52000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1148-840-0x00007FFB85C30000-0x00007FFB85C52000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1148-841-0x00007FFB87B90000-0x00007FFB87B91000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1148-867-0x00000128D1410000-0x00000128D1411000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1148-800-0x00007FFB85440000-0x00007FFB85450000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1148-798-0x00007FFB85330000-0x00007FFB85340000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1148-796-0x00007FFB85E70000-0x00007FFB85E80000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1148-795-0x00007FFB85E70000-0x00007FFB85E80000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1148-794-0x00007FFB85E70000-0x00007FFB85E80000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1148-793-0x00007FFB85E70000-0x00007FFB85E80000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1148-792-0x00007FFB85E70000-0x00007FFB85E80000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1148-791-0x00007FFB85E50000-0x00007FFB85E60000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1148-790-0x00007FFB85E50000-0x00007FFB85E60000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1148-789-0x00007FFB85DC0000-0x00007FFB85DD0000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1148-788-0x00007FFB85DC0000-0x00007FFB85DD0000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1148-784-0x00007FFB87D70000-0x00007FFB87DA0000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1148-786-0x00007FFB87D70000-0x00007FFB87DA0000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1148-787-0x00007FFB87E00000-0x00007FFB87E05000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1148-785-0x00007FFB87D70000-0x00007FFB87DA0000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1148-783-0x00007FFB87D70000-0x00007FFB87DA0000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1148-782-0x00007FFB87D70000-0x00007FFB87DA0000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1148-781-0x00007FFB87D20000-0x00007FFB87D30000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1148-779-0x00007FFB87C10000-0x00007FFB87C20000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1148-778-0x00007FFB87C10000-0x00007FFB87C20000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1148-775-0x00000128D1410000-0x00000128D1411000-memory.dmp
                                                                                                    Download

                                                                                                    memory/2136-1122-0x0000000005410000-0x0000000005411000-memory.dmp
                                                                                                    Download

                                                                                                    memory/2136-1125-0x0000000005410000-0x0000000005411000-memory.dmp
                                                                                                    Download

                                                                                                    memory/2508-906-0x0000000005550000-0x0000000005551000-memory.dmp
                                                                                                    Download

                                                                                                    memory/2508-949-0x0000000005550000-0x0000000005551000-memory.dmp
                                                                                                    Download