Overview

overview

7

Static

static

1

RobloxPlay...1).exe

windows10-1703-x64

7

RobloxPlay...1).exe

windows10-2004-x64

7

Analysis

  • max time kernel
    913s
  • max time network
    864s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/02/2024, 14:16

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    RobloxPlayerLauncher (1).exe
  • Size 5.0MB
  • Sample240214-rla5dsch41
  • SHA256 987f45a5fa22b34fe09422b4e8fb844c4dfedae522d1ff35b833fbd0ae850d80
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
adwarediscoveryevasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Downloads MZ/PE file
  • Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Modifies Installed Components in the registry 2 TTPs 7 IoCs
    persistence
  • Sets file execution options in registry 2 TTPs 4 IoCs
    persistence
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops file in System32 directory 1 IoCs
  • Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 42 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks system information in the registry 2 TTPs 26 IoCs

    System information is often read in order to detect sandboxing environments.

  • Drops file in Program Files directory 64 IoCs
  • Executes dropped EXE 39 IoCs
  • Loads dropped DLL 39 IoCs
  • Registers COM server for autorun 1 TTPs 64 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 32 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 48 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 4 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\RobloxPlayerLauncher (1).exe
    "C:\Users\Admin\AppData\Local\Temp\RobloxPlayerLauncher (1).exe"
    1⤵
    • Checks whether UAC is enabled
    • Checks computer location settings
    • Drops file in Program Files directory
    • Modifies Internet Explorer settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2024
    • C:\Users\Admin\AppData\Local\Temp\RobloxPlayerLauncher (1).exe
      "C:\Users\Admin\AppData\Local\Temp\RobloxPlayerLauncher (1).exe" --crashpad --no-rate-limit --database=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --metrics-dir=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --url=https://uploads.backtrace.rbx.com/post --annotation=RobloxChannel=production --annotation=RobloxGitHash=7a7d97104819f6db4e65764a0d3ae64f8171bc6e --annotation=UploadAttachmentKiloByteLimit=100 --annotation=UploadPercentage=100 --annotation=format=minidump --annotation=token=a2440b0bfdada85f34d79b43839f2b49ea6bba474bd7d126e844bc119271a1c3 --initial-client-data=0x760,0x758,0x75c,0x764,0x6a4,0xd2e2c0,0xd2e2d0,0xd2e2e0
      2⤵
        PID:5104
      • C:\Program Files (x86)\Roblox\Versions\version-f2b5c592c03b4183\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe
        MicrosoftEdgeWebview2Setup.exe /silent /install
        2⤵
        • Drops file in Program Files directory
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4756
        • C:\Program Files (x86)\Microsoft\Temp\EU6A8C.tmp\MicrosoftEdgeUpdate.exe
          "C:\Program Files (x86)\Microsoft\Temp\EU6A8C.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
          3⤵
          • Sets file execution options in registry
          • Checks computer location settings
          • Checks system information in the registry
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3624
          • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
            "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Modifies registry class
            PID:1332
          • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
            "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Modifies registry class
            • Suspicious use of WriteProcessMemory
            PID:4544
            • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
              "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Registers COM server for autorun
              • Modifies registry class
              PID:2860
            • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
              "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Registers COM server for autorun
              • Modifies registry class
              PID:2400
            • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
              "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Registers COM server for autorun
              • Modifies registry class
              PID:4172
          • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
            "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7OEYyNTA4OTEtNzI3Qy00NzhFLUFGMUItNkIzOTkyNEJDQkUyfSIgdXNlcmlkPSJ7RDgxOTY5OTktMzU1Qy00MDA2LUFBRjQtQjQ5Q0I3MkRBRjRCfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins3MUQyMTY2Ny00QUE5LTRCNkYtOUFCOS1EQjY0ODZCM0M3OER9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iREFEWSIgcHJvZHVjdF9uYW1lPSJTdGFuZGFyZCBQQyAoUTM1ICsgSUNIOSwgMjAwOSkiLz48ZXhwIGV0YWc9IiZxdW90O3I0NTJ0MStrMlRncS9IWHpqdkZOQlJob3BCV1I5c2JqWHhxZVVESDl1WDA9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0ie0YzQzRGRTAwLUVGRDUtNDAzQi05NTY5LTM5OEEyMEYxQkE0QX0iIHZlcnNpb249IjEuMy4xODEuNSIgbmV4dHZlcnNpb249IjEuMy4xNzEuMzkiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjU0MTkwNzAyMDciIGluc3RhbGxfdGltZV9tcz0iMjYxMSIvPjwvYXBwPjwvcmVxdWVzdD4
            4⤵
            • Checks system information in the registry
            • Executes dropped EXE
            • Loads dropped DLL
            PID:4644
          • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
            "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{8F250891-727C-478E-AF1B-6B39924BCBE2}" /silent
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:1832
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
      1⤵
      • Checks system information in the registry
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies data under HKEY_USERS
      • Suspicious use of WriteProcessMemory
      PID:1468
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7OEYyNTA4OTEtNzI3Qy00NzhFLUFGMUItNkIzOTkyNEJDQkUyfSIgdXNlcmlkPSJ7RDgxOTY5OTktMzU1Qy00MDA2LUFBRjQtQjQ5Q0I3MkRBRjRCfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins1MUIxNzBCNy1EMkQ3LTQxODUtOTBENi1DRjEwQzVCMkYxRUJ9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iREFEWSIgcHJvZHVjdF9uYW1lPSJTdGFuZGFyZCBQQyAoUTM1ICsgSUNIOSwgMjAwOSkiLz48ZXhwIGV0YWc9IiZxdW90O3FXSlN6V3dQZmRjTFIrWEdJdjZ4clpmaVlPeGhQVTJzMU5XbWpXY2FGUGc9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEwNi4wLjUyNDkuMTE5IiBuZXh0dmVyc2lvbj0iMTA2LjAuNTI0OS4xMTkiIGxhbmc9ImVuIiBicmFuZD0iR0dMUyIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSI1IiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1NDMzMzkyMjc3Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
        2⤵
        • Checks system information in the registry
        • Executes dropped EXE
        • Loads dropped DLL
        PID:5012
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{20734458-5334-4160-902A-6CC8BA5D44E3}\MicrosoftEdge_X64_121.0.2277.112.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{20734458-5334-4160-902A-6CC8BA5D44E3}\MicrosoftEdge_X64_121.0.2277.112.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
        2⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4904
        • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{20734458-5334-4160-902A-6CC8BA5D44E3}\EDGEMITMP_F79DF.tmp\setup.exe
          "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{20734458-5334-4160-902A-6CC8BA5D44E3}\EDGEMITMP_F79DF.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{20734458-5334-4160-902A-6CC8BA5D44E3}\MicrosoftEdge_X64_121.0.2277.112.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
          3⤵
          • Drops file in Program Files directory
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:3888
          • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{20734458-5334-4160-902A-6CC8BA5D44E3}\EDGEMITMP_F79DF.tmp\setup.exe
            "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{20734458-5334-4160-902A-6CC8BA5D44E3}\EDGEMITMP_F79DF.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=121.0.6167.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{20734458-5334-4160-902A-6CC8BA5D44E3}\EDGEMITMP_F79DF.tmp\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=121.0.2277.112 --initial-client-data=0x228,0x22c,0x230,0x204,0x234,0x7ff7814d1d88,0x7ff7814d1d94,0x7ff7814d1da0
            4⤵
            • Executes dropped EXE
            PID:3364
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7OEYyNTA4OTEtNzI3Qy00NzhFLUFGMUItNkIzOTkyNEJDQkUyfSIgdXNlcmlkPSJ7RDgxOTY5OTktMzU1Qy00MDA2LUFBRjQtQjQ5Q0I3MkRBRjRCfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins2Qzg0Rjk3MS1CQ0Q3LTQzOTEtOTZBQi1DMUZDNjg1ODYyM0R9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iREFEWSIgcHJvZHVjdF9uYW1lPSJTdGFuZGFyZCBQQyAoUTM1ICsgSUNIOSwgMjAwOSkiLz48ZXhwIGV0YWc9IiZxdW90O1ZQUW9QMUYrZnExNXdSemgxa1BMNFBNcFdoOE9STUI1aXp2ck9DL2NoalE9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0ie0YzMDE3MjI2LUZFMkEtNDI5NS04QkRGLTAwQzNBOUE3RTRDNX0iIHZlcnNpb249IiIgbmV4dHZlcnNpb249IjEyMS4wLjIyNzcuMTEyIiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY29uc2VudD1mYWxzZSIgaW5zdGFsbGFnZT0iLTEiIGluc3RhbGxkYXRlPSItMSI-PHVwZGF0ZWNoZWNrLz48ZXZlbnQgZXZlbnR0eXBlPSI5IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1NDQ4NzcxOTMzIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTQ0ODk0MTAwOSIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjU3NDY0MTI4MDkiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIGRvd25sb2FkZXI9ImJpdHMiIHVybD0iaHR0cDovL21zZWRnZS5mLnRsdS5kbC5kZWxpdmVyeS5tcC5taWNyb3NvZnQuY29tL2ZpbGVzdHJlYW1pbmdzZXJ2aWNlL2ZpbGVzLzMzZTUzZDQ5LTE4YjYtNDQwNy04ZjU3LWZmNTg5MzMwN2MzZD9QMT0xNzA4NTI1MDc5JmFtcDtQMj00MDQmYW1wO1AzPTImYW1wO1A0PWVSVjlVRlBMTE1GOG1EakhKeEJSYndjZktScWVuTGZJUXo2R1FuM3h4JTJmNE43ZUdwVHhhU3VRWkgzZzNqZDZlVWxDYiUyYmp2MXp3ZDg1dks0MWkyR2hvZyUzZCUzZCIgc2VydmVyX2lwX2hpbnQ9IiIgY2RuX2NpZD0iLTEiIGNkbl9jY2M9IiIgY2RuX21zZWRnZV9yZWY9IiIgY2RuX2F6dXJlX3JlZl9vcmlnaW5fc2hpZWxkPSIiIGNkbl9jYWNoZT0iIiBjZG5fcDNwPSIiIGRvd25sb2FkZWQ9IjE3NDg3ODc4NCIgdG90YWw9IjE3NDg3ODc4NCIgZG93bmxvYWRfdGltZV9tcz0iMTgzNzgiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1NzQ3MDcwMzQ3IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTc3MTQ3MDEzNCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjE5Njc1NyIgc3lzdGVtX3VwdGltZV90aWNrcz0iNjQyNTU0MjA4MSIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgdXBkYXRlX2NoZWNrX3RpbWVfbXM9Ijc5MSIgZG93bmxvYWRfdGltZV9tcz0iMjk3OTYiIGRvd25sb2FkZWQ9IjE3NDg3ODc4NCIgdG90YWw9IjE3NDg3ODc4NCIgcGFja2FnZV9jYWNoZV9yZXN1bHQ9IjAiIGluc3RhbGxfdGltZV9tcz0iNjUzNzYiLz48L2FwcD48L3JlcXVlc3Q-
        2⤵
        • Checks system information in the registry
        • Executes dropped EXE
        • Loads dropped DLL
        PID:1724
    • C:\Program Files (x86)\Roblox\Versions\version-f2b5c592c03b4183\RobloxPlayerBeta.exe
      "C:\Program Files (x86)\Roblox\Versions\version-f2b5c592c03b4183\RobloxPlayerBeta.exe" --app
      1⤵
      • Suspicious use of NtCreateThreadExHideFromDebugger
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of UnmapMainImage
      PID:5024
    • C:\Program Files (x86)\Roblox\Versions\version-f2b5c592c03b4183\RobloxPlayerBeta.exe
      "C:\Program Files (x86)\Roblox\Versions\version-f2b5c592c03b4183\RobloxPlayerBeta.exe" --app
      1⤵
      • Suspicious use of NtCreateThreadExHideFromDebugger
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of UnmapMainImage
      PID:1876
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler
      1⤵
      • Checks system information in the registry
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3732
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
      1⤵
      • Checks system information in the registry
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1040
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{0EF5CCF5-4389-46D8-ABDD-BC378B9BF13E}\MicrosoftEdgeUpdateSetup_X86_1.3.183.29.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{0EF5CCF5-4389-46D8-ABDD-BC378B9BF13E}\MicrosoftEdgeUpdateSetup_X86_1.3.183.29.exe" /update /sessionid "{EA3E3BA1-ED3C-4DB3-9A4A-89891F3EE272}"
        2⤵
        • Drops file in Program Files directory
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4684
        • C:\Program Files (x86)\Microsoft\Temp\EU9B34.tmp\MicrosoftEdgeUpdate.exe
          "C:\Program Files (x86)\Microsoft\Temp\EU9B34.tmp\MicrosoftEdgeUpdate.exe" /update /sessionid "{EA3E3BA1-ED3C-4DB3-9A4A-89891F3EE272}"
          3⤵
          • Sets file execution options in registry
          • Checks system information in the registry
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:460
          • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
            "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Modifies registry class
            PID:1280
          • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
            "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Modifies registry class
            • Suspicious use of WriteProcessMemory
            PID:1736
            • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.183.29\MicrosoftEdgeUpdateComRegisterShell64.exe
              "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.183.29\MicrosoftEdgeUpdateComRegisterShell64.exe"
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Registers COM server for autorun
              • Modifies registry class
              PID:3708
            • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.183.29\MicrosoftEdgeUpdateComRegisterShell64.exe
              "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.183.29\MicrosoftEdgeUpdateComRegisterShell64.exe"
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Registers COM server for autorun
              • Modifies registry class
              PID:4108
            • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.183.29\MicrosoftEdgeUpdateComRegisterShell64.exe
              "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.183.29\MicrosoftEdgeUpdateComRegisterShell64.exe"
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Registers COM server for autorun
              • Modifies registry class
              PID:2256
          • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
            "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODMuMjkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RUEzRTNCQTEtRUQzQy00REIzLTlBNEEtODk4OTFGM0VFMjcyfSIgdXNlcmlkPSJ7RDgxOTY5OTktMzU1Qy00MDA2LUFBRjQtQjQ5Q0I3MkRBRjRCfSIgaW5zdGFsbHNvdXJjZT0ic2VsZnVwZGF0ZSIgcmVxdWVzdGlkPSJ7OEREMzMyRTAtOTk2MC00NEI4LUJBNDktRjc3NzUxMkVCODIwfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIG9zX3JlZ2lvbl9uYW1lPSJVUyIgb3NfcmVnaW9uX25hdGlvbj0iMjQ0IiBvc19yZWdpb25fZG1hPSIwIiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSJEQURZIiBwcm9kdWN0X25hbWU9IlN0YW5kYXJkIFBDIChRMzUgKyBJQ0g5LCAyMDA5KSIvPjxleHAgZXRhZz0iJnF1b3Q7cVdKU3pXd1BmZGNMUitYR0l2NnhyWmZpWU94aFBVMnMxTldtaldjYUZQZz0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE3MS4zOSIgbmV4dHZlcnNpb249IjEuMy4xODMuMjkiIGxhbmc9IiIgYnJhbmQ9IklOQlgiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIwIiBpbnN0YWxsZGF0ZXRpbWU9IjE3MDc5MjAyNzMiPjxldmVudCBldmVudHR5cGU9IjMiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9Ijk0MDM4NzIzMDIiLz48L2FwcD48L3JlcXVlc3Q-
            4⤵
            • Checks system information in the registry
            • Executes dropped EXE
            • Loads dropped DLL
            PID:5008
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RUEzRTNCQTEtRUQzQy00REIzLTlBNEEtODk4OTFGM0VFMjcyfSIgdXNlcmlkPSJ7RDgxOTY5OTktMzU1Qy00MDA2LUFBRjQtQjQ5Q0I3MkRBRjRCfSIgaW5zdGFsbHNvdXJjZT0ic2NoZWR1bGVyIiByZXF1ZXN0aWQ9InsyODhFMjQ0OS03NkZDLTRCQ0YtOTQyNS1DOUY3MzE0OTdERkV9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iREFEWSIgcHJvZHVjdF9uYW1lPSJTdGFuZGFyZCBQQyAoUTM1ICsgSUNIOSwgMjAwOSkiLz48ZXhwIGV0YWc9IiZxdW90O3FXSlN6V3dQZmRjTFIrWEdJdjZ4clpmaVlPeGhQVTJzMU5XbWpXY2FGUGc9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0ie0YzQzRGRTAwLUVGRDUtNDAzQi05NTY5LTM5OEEyMEYxQkE0QX0iIHZlcnNpb249IjEuMy4xNzEuMzkiIG5leHR2ZXJzaW9uPSIxLjMuMTgzLjI5IiBsYW5nPSIiIGJyYW5kPSJJTkJYIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMCI-PHVwZGF0ZWNoZWNrLz48ZXZlbnQgZXZlbnR0eXBlPSIxMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iODY2NTE0MjMwMiIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEzIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI4NjY1MzYyNTM4IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTQiIGV2ZW50cmVzdWx0PSIwIiBlcnJvcmNvZGU9Ii0yMTQ3MDIzODM4IiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI5MzUwMjgyMjQ1IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJkbyIgdXJsPSJodHRwOi8vbXNlZGdlLmIudGx1LmRsLmRlbGl2ZXJ5Lm1wLm1pY3Jvc29mdC5jb20vZmlsZXN0cmVhbWluZ3NlcnZpY2UvZmlsZXMvODE0Yjg0OGItYTRlNC00OGY3LTlkYzAtYjE4YjU3ZjZjOWYzP1AxPTE3MDg1MjU0MDAmYW1wO1AyPTQwNCZhbXA7UDM9MiZhbXA7UDQ9YmpKMFBWNkl1N281Z05tTEtkVERPaDJUWk1rVjFkUFc2WHdOJTJmY1FCS082NE1RbkJjJTJieGhqWlMxeXdYQkhvTTklMmJtMVlRckF0UHpUZlhjYjZPa2ZNRkElM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIwIiB0b3RhbD0iMCIgZG93bmxvYWRfdGltZV9tcz0iMTgwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTQiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjkzNTAzNjIzMzciIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIGRvd25sb2FkZXI9ImJpdHMiIHVybD0iaHR0cDovL21zZWRnZS5iLnRsdS5kbC5kZWxpdmVyeS5tcC5taWNyb3NvZnQuY29tL2ZpbGVzdHJlYW1pbmdzZXJ2aWNlL2ZpbGVzLzgxNGI4NDhiLWE0ZTQtNDhmNy05ZGMwLWIxOGI1N2Y2YzlmMz9QMT0xNzA4NTI1NDAwJmFtcDtQMj00MDQmYW1wO1AzPTImYW1wO1A0PWJqSjBQVjZJdTdvNWdObUxLZFRET2gyVFpNa1YxZFBXNlh3TiUyZmNRQktPNjRNUW5CYyUyYnhoalpTMXl3WEJIb005JTJibTFZUXJBdFB6VGZYY2I2T2tmTUZBJTNkJTNkIiBzZXJ2ZXJfaXBfaGludD0iIiBjZG5fY2lkPSItMSIgY2RuX2NjYz0iIiBjZG5fbXNlZGdlX3JlZj0iIiBjZG5fYXp1cmVfcmVmX29yaWdpbl9zaGllbGQ9IiIgY2RuX2NhY2hlPSIiIGNkbl9wM3A9IiIgZG93bmxvYWRlZD0iMTYxNjQ1NiIgdG90YWw9IjE2MTY0NTYiIGRvd25sb2FkX3RpbWVfbXM9IjYzNDcxIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTQiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjkzNTA0MTIxMDUiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iOTM1NTc4MjI1MiIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxwaW5nIHI9IjYxIiByZD0iNjE5MiIgcGluZ19mcmVzaG5lc3M9IntBMUFFRTU2Ri00OEM5LTQzQjQtODZDOS1DNjQ0NDVEOThFM0V9Ii8-PC9hcHA-PGFwcCBhcHBpZD0iezU2RUIxOEY4LUIwMDgtNENCRC1CNkQyLThDOTdGRTdFOTA2Mn0iIHZlcnNpb249IjkyLjAuOTAyLjY3IiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSJJTkJYIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNvbnNlbnQ9ZmFsc2UiIGxhc3RfbGF1bmNoX3RpbWU9IjEzMzQ3MTEyNjc2MzA1MzY1MCI-PHVwZGF0ZWNoZWNrLz48cGluZyBhY3RpdmU9IjEiIGE9Ii0xIiByPSI2MSIgYWQ9Ii0xIiByZD0iNjE5MiIgcGluZ19mcmVzaG5lc3M9IntBOUU0NUUyRS1BODAwLTRDQkMtQTREQi1DMjA0RTg1NzU1MTd9Ii8-PC9hcHA-PGFwcCBhcHBpZD0ie0YzMDE3MjI2LUZFMkEtNDI5NS04QkRGLTAwQzNBOUE3RTRDNX0iIHZlcnNpb249IjEyMS4wLjIyNzcuMTEyIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMCIgaW5zdGFsbGRhdGU9IjYyNTEiPjx1cGRhdGVjaGVjay8-PHBpbmcgcj0iLTEiIHJkPSItMSIgcGluZ19mcmVzaG5lc3M9IntDQURCNUFEMC05NDY5LTQ1RDgtOUU1Ni03NEYyMzI3MjU2QkZ9Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
        2⤵
        • Checks system information in the registry
        • Executes dropped EXE
        • Loads dropped DLL
        PID:1400
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
      1⤵
        PID:4352
      • C:\Windows\System32\svchost.exe
        C:\Windows\System32\svchost.exe -k UnistackSvcGroup
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4248
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3480
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
        1⤵
        • Checks system information in the registry
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1060
        • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
          "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODMuMjkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MURDNTYwNEMtRUQ4OS00QjE0LUIwMzYtNjI1NjBDMEIwOTBDfSIgdXNlcmlkPSJ7RDgxOTY5OTktMzU1Qy00MDA2LUFBRjQtQjQ5Q0I3MkRBRjRCfSIgaW5zdGFsbHNvdXJjZT0idW5rbm93biIgcmVxdWVzdGlkPSJ7MUY5MzYxRTItNjdEQS00QzU2LTk5MzctNjI0NTUwNUEzNjg1fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIG9zX3JlZ2lvbl9uYW1lPSJVUyIgb3NfcmVnaW9uX25hdGlvbj0iMjQ0IiBvc19yZWdpb25fZG1hPSIwIiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSJEQURZIiBwcm9kdWN0X25hbWU9IlN0YW5kYXJkIFBDIChRMzUgKyBJQ0g5LCAyMDA5KSIvPjxleHAgZXRhZz0iJnF1b3Q7cVdKU3pXd1BmZGNMUitYR0l2NnhyWmZpWU94aFBVMnMxTldtaldjYUZQZz0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTA2LjAuNTI0OS4xMTkiIG5leHR2ZXJzaW9uPSIiIGxhbmc9ImVuIiBicmFuZD0iR0dMUyIgY2xpZW50PSIiIGluc3RhbGxhZ2U9IjYxIiBpbnN0YWxsZGF0ZXRpbWU9IjE3MDI2MzQwMDAiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM0NzEzNDcxMzYwMDY2MzQiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSI1MjkiIHN5c3RlbV91cHRpbWVfdGlja3M9IjEyODMzNDcyNjQ4Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
          2⤵
          • Checks system information in the registry
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2284
        • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{5BCE0C52-99E1-43A6-81EA-CBB4ADF571FD}\MicrosoftEdge_X64_121.0.2277.112.exe
          "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{5BCE0C52-99E1-43A6-81EA-CBB4ADF571FD}\MicrosoftEdge_X64_121.0.2277.112.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
          2⤵
          • Executes dropped EXE
          PID:2668
          • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{5BCE0C52-99E1-43A6-81EA-CBB4ADF571FD}\EDGEMITMP_50A73.tmp\setup.exe
            "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{5BCE0C52-99E1-43A6-81EA-CBB4ADF571FD}\EDGEMITMP_50A73.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{5BCE0C52-99E1-43A6-81EA-CBB4ADF571FD}\MicrosoftEdge_X64_121.0.2277.112.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
            3⤵
            • Adds Run key to start application
            • Installs/modifies Browser Helper Object
            • Modifies Installed Components in the registry
            • Drops file in Program Files directory
            • Executes dropped EXE
            • Registers COM server for autorun
            • Modifies Internet Explorer settings
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            • System policy modification
            PID:4228
            • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{5BCE0C52-99E1-43A6-81EA-CBB4ADF571FD}\EDGEMITMP_50A73.tmp\setup.exe
              "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{5BCE0C52-99E1-43A6-81EA-CBB4ADF571FD}\EDGEMITMP_50A73.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=121.0.6167.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{5BCE0C52-99E1-43A6-81EA-CBB4ADF571FD}\EDGEMITMP_50A73.tmp\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=121.0.2277.112 --initial-client-data=0x230,0x234,0x238,0x20c,0x23c,0x7ff6db1a1d88,0x7ff6db1a1d94,0x7ff6db1a1da0
              4⤵
              • Drops file in Program Files directory
              • Executes dropped EXE
              PID:2972
            • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{5BCE0C52-99E1-43A6-81EA-CBB4ADF571FD}\EDGEMITMP_50A73.tmp\setup.exe
              "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{5BCE0C52-99E1-43A6-81EA-CBB4ADF571FD}\EDGEMITMP_50A73.tmp\setup.exe" --msedge --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1
              4⤵
              • Drops file in System32 directory
              • Executes dropped EXE
              • Modifies data under HKEY_USERS
              PID:4536
              • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{5BCE0C52-99E1-43A6-81EA-CBB4ADF571FD}\EDGEMITMP_50A73.tmp\setup.exe
                "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{5BCE0C52-99E1-43A6-81EA-CBB4ADF571FD}\EDGEMITMP_50A73.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=121.0.6167.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{5BCE0C52-99E1-43A6-81EA-CBB4ADF571FD}\EDGEMITMP_50A73.tmp\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=121.0.2277.112 --initial-client-data=0x258,0x25c,0x260,0x13c,0x264,0x7ff6db1a1d88,0x7ff6db1a1d94,0x7ff6db1a1da0
                5⤵
                • Executes dropped EXE
                PID:2320
            • C:\Program Files (x86)\Microsoft\Edge\Application\121.0.2277.112\Installer\setup.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\121.0.2277.112\Installer\setup.exe" --msedge --channel=stable --register-package-identity --verbose-logging --system-level
              4⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              PID:1936
              • C:\Program Files (x86)\Microsoft\Edge\Application\121.0.2277.112\Installer\setup.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\121.0.2277.112\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=121.0.6167.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\121.0.2277.112\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=121.0.2277.112 --initial-client-data=0x230,0x234,0x238,0x20c,0x23c,0x7ff7d54d1d88,0x7ff7d54d1d94,0x7ff7d54d1da0
                5⤵
                • Executes dropped EXE
                PID:416
        • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
          "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODMuMjkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MURDNTYwNEMtRUQ4OS00QjE0LUIwMzYtNjI1NjBDMEIwOTBDfSIgdXNlcmlkPSJ7RDgxOTY5OTktMzU1Qy00MDA2LUFBRjQtQjQ5Q0I3MkRBRjRCfSIgaW5zdGFsbHNvdXJjZT0ic2NoZWR1bGVyIiByZXF1ZXN0aWQ9IntEMUU3RjdDRS1CQjZFLTRCRDktQUU2Ni00RjNBODVFMTdGQzF9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgb3NfcmVnaW9uX25hbWU9IlVTIiBvc19yZWdpb25fbmF0aW9uPSIyNDQiIG9zX3JlZ2lvbl9kbWE9IjAiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IkRBRFkiIHByb2R1Y3RfbmFtZT0iU3RhbmRhcmQgUEMgKFEzNSArIElDSDksIDIwMDkpIi8-PGV4cCBldGFnPSImcXVvdDtWUFFvUDFGK2ZxMTV3UnpoMWtQTDRQTXBXaDhPUk1CNWl6dnJPQy9jaGpRPSZxdW90OyIvPjxhcHAgYXBwaWQ9IntGM0M0RkUwMC1FRkQ1LTQwM0ItOTU2OS0zOThBMjBGMUJBNEF9IiB2ZXJzaW9uPSIxLjMuMTgzLjI5IiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSJJTkJYIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMCIgY29ob3J0PSJycmZAMC41MyI-PHVwZGF0ZWNoZWNrLz48cGluZyByZD0iNjI1MyIgcGluZ19mcmVzaG5lc3M9IntEQUFDMjQ2My05NzZCLTQ1RjAtQkUyMC05MjE5QzlGMkZDRjN9Ii8-PC9hcHA-PGFwcCBhcHBpZD0iezU2RUIxOEY4LUIwMDgtNENCRC1CNkQyLThDOTdGRTdFOTA2Mn0iIHZlcnNpb249IjkyLjAuOTAyLjY3IiBuZXh0dmVyc2lvbj0iMTIxLjAuMjI3Ny4xMTIiIGxhbmc9IiIgYnJhbmQ9IklOQlgiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY29uc2VudD1mYWxzZSIgaXNfcGlubmVkX3N5c3RlbT0idHJ1ZSIgbGFzdF9sYXVuY2hfY291bnQ9IjEiIGxhc3RfbGF1bmNoX3RpbWU9IjEzMzQ3MTEyNjc2MzA1MzY1MCI-PHVwZGF0ZWNoZWNrLz48ZXZlbnQgZXZlbnR0eXBlPSIxMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTI4NTYxNzI1NDUiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxMyIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTI4NTcyNDMwMDgiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNCIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTI5MTgzMDI0ODIiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTI5Mzk4NDE4OTgiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIzIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIxOTY3NTciIHN5c3RlbV91cHRpbWVfdGlja3M9IjEzMzQ4NzYyMjE4IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiB1cGRhdGVfY2hlY2tfdGltZV9tcz0iMTEyNCIgZG93bmxvYWRlZD0iMTc0ODc4Nzg0IiB0b3RhbD0iMTc0ODc4Nzg0IiBwYWNrYWdlX2NhY2hlX3Jlc3VsdD0iMiIgaW5zdGFsbF90aW1lX21zPSI0MDg4NiIvPjxwaW5nIGFjdGl2ZT0iMCIgcmQ9IjYyNTMiIHBpbmdfZnJlc2huZXNzPSJ7RkIxNkI3RUQtNTEzRC00MEE0LUI5MEUtODVFNDk1M0ExM0NCfSIvPjwvYXBwPjxhcHAgYXBwaWQ9IntGMzAxNzIyNi1GRTJBLTQyOTUtOEJERi0wMEMzQTlBN0U0QzV9IiB2ZXJzaW9uPSIxMjEuMC4yMjc3LjExMiIgbmV4dHZlcnNpb249IiIgbGFuZz0iIiBicmFuZD0iR0dMUyIgY2xpZW50PSIiIGluc3RhbGxhZ2U9IjAiIGluc3RhbGxkYXRlPSI2MjUxIiBjb2hvcnQ9InJyZkAwLjA4Ij48dXBkYXRlY2hlY2svPjxwaW5nIHJkPSI2MjUzIiBwaW5nX2ZyZXNobmVzcz0iezAxRjkyNDA5LTlGNDctNDJGNC05MUJCLTYzMjMxQTlENENENX0iLz48L2FwcD48L3JlcXVlc3Q-
          2⤵
          • Checks system information in the registry
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2428

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            setup.exe
            • Path C:\Program Files (x86)\Microsoft\EdgeCore\121.0.2277.112\Installer\setup.exe
            • Size 2.3MB
            • SHA256 e75d230ca8114bb8d8c74e5b8884466dc4a43276011bea50ccbbe4c96f94a8f2
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            MicrosoftEdge_X64_121.0.2277.112.exe
            • Path C:\Program Files (x86)\Microsoft\EdgeUpdate\Download\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\121.0.2277.112\MicrosoftEdge_X64_121.0.2277.112.exe
            • Size 3.5MB
            • SHA256 1896817f3f62da56c36fb9778def3c924929a33e20a64bab3dd6cc1e8a7bd039
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            MicrosoftEdgeUpdateSetup_X86_1.3.183.29.exe
            • Path C:\Program Files (x86)\Microsoft\EdgeUpdate\Download\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\1.3.183.29\MicrosoftEdgeUpdateSetup_X86_1.3.183.29.exe
            • Size 1.5MB
            • SHA256 611730ce9e8cb3b7fd31a9e064308175eae4c173b46a84529ee43b4f22c21455
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            SETUP.EX_
            • Path C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{5BCE0C52-99E1-43A6-81EA-CBB4ADF571FD}\EDGEMITMP_50A73.tmp\SETUP.EX_
            • Size 2.7MB
            • SHA256 a1058eaabc0b3be7ddae80286fa0f74eb06c640e7d9c0227b0e5664e5b1f10b9
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            EdgeUpdate.dat
            • Path C:\Program Files (x86)\Microsoft\Temp\EU6A8C.tmp\EdgeUpdate.dat
            • Size 12KB
            • SHA256 3d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            MicrosoftEdgeComRegisterShellARM64.exe
            • Path C:\Program Files (x86)\Microsoft\Temp\EU6A8C.tmp\MicrosoftEdgeComRegisterShellARM64.exe
            • Size 179KB
            • SHA256 35a14bd84e74dd6d8e2683470243fb1bb9071178d9283b12ebbfb405c8cd4aa9
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            MicrosoftEdgeUpdate.exe
            • Path C:\Program Files (x86)\Microsoft\Temp\EU6A8C.tmp\MicrosoftEdgeUpdate.exe
            • Size 201KB
            • SHA256 87c6f7d9b58f136aeb33c96dbfe3702083ec519aafca39be66778a9c27a68718
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            MicrosoftEdgeUpdateComRegisterShell64.exe
            • Path C:\Program Files (x86)\Microsoft\Temp\EU6A8C.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe
            • Size 212KB
            • SHA256 4d01f5531f93ab2af9e92c4f998a145c94f36688c3793845d528c8675697e112
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            MicrosoftEdgeUpdateCore.exe
            • Path C:\Program Files (x86)\Microsoft\Temp\EU6A8C.tmp\MicrosoftEdgeUpdateCore.exe
            • Size 257KB
            • SHA256 9f79fe09f57002ca07ae0b2a196e8cc002d2be6d5540ee857217e99b33fa4bb2
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            NOTICE.TXT
            • Path C:\Program Files (x86)\Microsoft\Temp\EU6A8C.tmp\NOTICE.TXT
            • Size 4KB
            • SHA256 91d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            msedgeupdate.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EU6A8C.tmp\msedgeupdate.dll
            • Size 2.0MB
            • SHA256 d80c512d99765586e02323a2e18694965eafb903e9bc13f0e0b4265f86b21a19
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            msedgeupdateres_af.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EU6A8C.tmp\msedgeupdateres_af.dll
            • Size 28KB
            • SHA256 a881788359b2a7d90ac70a76c45938fb337c2064487dcb8be00b9c311d10c24c
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            msedgeupdateres_am.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EU6A8C.tmp\msedgeupdateres_am.dll
            • Size 24KB
            • SHA256 986b0654a8b5f7b23478463ff051bffe1e9bbdeb48744e4aa1bd3d89a7520717
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            msedgeupdateres_ar.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EU6A8C.tmp\msedgeupdateres_ar.dll
            • Size 26KB
            • SHA256 e2cc8017bc24e73048c7ee68d3787ed63c3898eec61299a9ca1bab8aeaa8da01
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            msedgeupdateres_as.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EU6A8C.tmp\msedgeupdateres_as.dll
            • Size 28KB
            • SHA256 3b82de846ad028544013383e3c9fb570d2a09abf2c854e8a4d641bd7fc3b3766
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            msedgeupdateres_az.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EU6A8C.tmp\msedgeupdateres_az.dll
            • Size 29KB
            • SHA256 5ab96e4e6e065dbce3b643c6be2c668f5570984ead1a8b3578bbd2056fbad4e9
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            msedgeupdateres_bg.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EU6A8C.tmp\msedgeupdateres_bg.dll
            • Size 29KB
            • SHA256 a12df15afac4eb2695626d7a8a2888bdf54c8db671043b0677180f746d8ad105
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            msedgeupdateres_bn-IN.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EU6A8C.tmp\msedgeupdateres_bn-IN.dll
            • Size 29KB
            • SHA256 5b01fe11016610d5606f815281c970c86025732fc597b99c031a018626cd9f3c
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            msedgeupdateres_bn.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EU6A8C.tmp\msedgeupdateres_bn.dll
            • Size 29KB
            • SHA256 e32f77ed3067d7735d10f80e5a0aa0c50c993b59b82dc834f2583c314e28fa98
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            msedgeupdateres_bs.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EU6A8C.tmp\msedgeupdateres_bs.dll
            • Size 28KB
            • SHA256 99b1b7e25fbc2c64489c0607cef0ae5ff720ab529e11093ed9860d953adeba04
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            msedgeupdateres_ca-Es-VALENCIA.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EU6A8C.tmp\msedgeupdateres_ca-Es-VALENCIA.dll
            • Size 29KB
            • SHA256 2726c48a468f8f6debc2d9a6a0706b640b2852c885e603e6b2dec638756160df
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            msedgeupdateres_ca.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EU6A8C.tmp\msedgeupdateres_ca.dll
            • Size 30KB
            • SHA256 8dbd55ed532073874f4fe006ef456e31642317145bd18ddc30f681ce9e0c8e07
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            msedgeupdateres_cs.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EU6A8C.tmp\msedgeupdateres_cs.dll
            • Size 28KB
            • SHA256 e0f0026ddcbeafc6c991da6ba7c52927d050f928dba4a7153552efcea893a35b
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            msedgeupdateres_cy.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EU6A8C.tmp\msedgeupdateres_cy.dll
            • Size 28KB
            • SHA256 252b6f9bf5a9cb59ad1c072e289cc9695c0040b363d4bfbcc9618a12df77d18e
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            msedgeupdateres_da.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EU6A8C.tmp\msedgeupdateres_da.dll
            • Size 28KB
            • SHA256 fd98159338d1f3b03814af31440d37d15ab183c1a230e6261fbb90e402f85d5f
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            msedgeupdateres_de.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EU6A8C.tmp\msedgeupdateres_de.dll
            • Size 30KB
            • SHA256 061a7cdaff9867ddb0bd3de2c0760d6919d8d2ca7c7f889ec2d32265d7e7a75c
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            msedgeupdateres_el.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EU6A8C.tmp\msedgeupdateres_el.dll
            • Size 30KB
            • SHA256 223d2db0bc2cc82bda04a0a2cd2b7f6cb589e2fa5c0471a2d5eb04d2ffcfcfa0
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            msedgeupdateres_en-GB.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EU6A8C.tmp\msedgeupdateres_en-GB.dll
            • Size 27KB
            • SHA256 fd90699e7f29b6028a2e8e6f3ae82d26cdc6942bd39c4f07b221d87c5dbbfe1e
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            msedgeupdateres_en.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EU6A8C.tmp\msedgeupdateres_en.dll
            • Size 27KB
            • SHA256 9afbbe2a591250b80499f0bf02715f02dbcd5a80088e129b1f670f1a3167a011
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            msedgeupdateres_es-419.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EU6A8C.tmp\msedgeupdateres_es-419.dll
            • Size 29KB
            • SHA256 55a69ce2d6fc4109d16172ba6d9edb59dbadbc8af6746cc71dc4045aa549022d
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            msedgeupdateres_es.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EU6A8C.tmp\msedgeupdateres_es.dll
            • Size 28KB
            • SHA256 e652159a75cbab76217ecbb4340020f277175838b316b32cf71e18d83da4a819
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            msedgeupdateres_et.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EU6A8C.tmp\msedgeupdateres_et.dll
            • Size 28KB
            • SHA256 f0a4cfd96c85f2d98a3c9ecfadd41c0c139fdb20470c8004f4c112dd3d69e085
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            msedgeupdateres_eu.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EU6A8C.tmp\msedgeupdateres_eu.dll
            • Size 28KB
            • SHA256 e5615c838a71b533b26d308509954907bcc0eb4032cdbaa3db621eede5e6bfa4
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            msedgeupdateres_fa.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EU6A8C.tmp\msedgeupdateres_fa.dll
            • Size 27KB
            • SHA256 c66c4024847d353e9985eb9b2f060b2d84f12cc77fb6479df5ffc55dbda97e59
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            msedgeupdateres_fi.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EU6A8C.tmp\msedgeupdateres_fi.dll
            • Size 28KB
            • SHA256 acf42b90190110ccf30bcfb2626dd999a14e42a72a3983928cba98d44f0a72e2
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            msedgeupdateres_fil.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EU6A8C.tmp\msedgeupdateres_fil.dll
            • Size 29KB
            • SHA256 e622823096fc656f63d5a7bbdf3744745ef389c92ec1b804d3b874578e18c89d
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            msedgeupdateres_fr-CA.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EU6A8C.tmp\msedgeupdateres_fr-CA.dll
            • Size 30KB
            • SHA256 445051ef15c6c872bed6d904169793837e41029a8578eaf81d78a4641ef53511
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            msedgeupdateres_fr.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EU6A8C.tmp\msedgeupdateres_fr.dll
            • Size 30KB
            • SHA256 a9b72fcb3bdb5e021b8d23b2de0caeca80ddc50420088b988a5b7503f2d7c961
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            msedgeupdateres_ga.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EU6A8C.tmp\msedgeupdateres_ga.dll
            • Size 28KB
            • SHA256 abc9822ee193c9a98a21202648a48ecd69b0cb19ff31c9bbf0c79dab5f9609b0
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            msedgeupdateres_gd.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EU6A8C.tmp\msedgeupdateres_gd.dll
            • Size 30KB
            • SHA256 e3acc61d06942408369c85365ac0d731c5f3c9bc26e3f1e3bb24226d0879ad9c
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            msedgeupdateres_gl.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EU6A8C.tmp\msedgeupdateres_gl.dll
            • Size 28KB
            • SHA256 e4eb716f1041160fd323b0f229b88851e153025d5d79f49b7d6ecb7eb2442c57
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            msedgeupdateres_gu.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EU6A8C.tmp\msedgeupdateres_gu.dll
            • Size 28KB
            • SHA256 838ccd8243caa1a5d9e72eb1179ac8ae59d2acb453ed86be01e0722a8e917150
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            msedgeupdateres_hi.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EU6A8C.tmp\msedgeupdateres_hi.dll
            • Size 28KB
            • SHA256 024c5eae16e45abe2237c2a5d868563550ac596f1f7d777e25234c17d9461dd9
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            msedgeupdateres_hr.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EU6A8C.tmp\msedgeupdateres_hr.dll
            • Size 29KB
            • SHA256 65915ad11b9457d145795a1e8d151f898ec2dcb8b136967e6592884699867eb0
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            msedgeupdateres_hu.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EU6A8C.tmp\msedgeupdateres_hu.dll
            • Size 29KB
            • SHA256 b16755fdbcc796ef4eb937759fe2c3518c694f5d186970d55a5a5e5d906cb791
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            msedgeupdateres_id.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EU6A8C.tmp\msedgeupdateres_id.dll
            • Size 27KB
            • SHA256 192585d7f4a8a0cd95e338863c14233cdd8150f9f6f7dd8a405da0670110ee95
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            msedgeupdateres_is.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EU6A8C.tmp\msedgeupdateres_is.dll
            • Size 28KB
            • SHA256 a3a2947064267d17474c168d3189b0d372e36e53bf0efb9c228d314fc802d98e
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            msedgeupdateres_it.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EU6A8C.tmp\msedgeupdateres_it.dll
            • Size 30KB
            • SHA256 abe2360a585b6671ec3a69d14077b43ae8f9e92b6077b80a147dfe36792bb1b7
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            msedgeupdateres_iw.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EU6A8C.tmp\msedgeupdateres_iw.dll
            • Size 25KB
            • SHA256 fd5ba39c8b319c6ba2febf896c6947a0a7bae6aa0b4957bd124d55589f41849d
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            msedgeupdateres_ja.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EU6A8C.tmp\msedgeupdateres_ja.dll
            • Size 24KB
            • SHA256 5f4234e2b965656e3d6e127660f52e370dc133632d451ef04975f3b70194b2ed
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            msedgeupdateres_ka.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EU6A8C.tmp\msedgeupdateres_ka.dll
            • Size 29KB
            • SHA256 4449ee24c676e34fea4d151b3a752e8d0e7c82f419884e80da60d4d4c1b0f8cb
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            msedgeupdateres_kk.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EU6A8C.tmp\msedgeupdateres_kk.dll
            • Size 28KB
            • SHA256 fdd6bffdb9eca4542975f3afe3ac68feac190b8963f0a7244b4b8fa6382381d1
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            msedgeupdateres_km.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EU6A8C.tmp\msedgeupdateres_km.dll
            • Size 27KB
            • SHA256 6fd21b94f62ee7474b3c3029590ddf06936105508f9bf3509620c42dc37486c3
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            msedgeupdateres_kn.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EU6A8C.tmp\msedgeupdateres_kn.dll
            • Size 29KB
            • SHA256 ef749f70e71424d7f548d5c12283be70a6d6c59cffb1c8101b74f37ecacb64af
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            msedgeupdateres_ko.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EU6A8C.tmp\msedgeupdateres_ko.dll
            • Size 23KB
            • SHA256 baa9fae4fb8939e0b5fe0c7f393ab1ca40b52534f37bf2158a9a36331a221e75
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            msedgeupdateres_kok.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EU6A8C.tmp\msedgeupdateres_kok.dll
            • Size 28KB
            • SHA256 5b9509a1ae34d89c89c8e657742495037d28cd03e1cd48aef4dfaa7aeebe29f0
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            msedgeupdateres_lb.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EU6A8C.tmp\msedgeupdateres_lb.dll
            • Size 30KB
            • SHA256 c3fb0cae3dc5cdd86518d60f998c3adec1c0c5804a74ffbb9a346a73d598af07
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            msedgeupdateres_lo.dll
            • Path C:\Program Files (x86)\Microsoft\Temp\EU6A8C.tmp\msedgeupdateres_lo.dll
            • Size 27KB
            • SHA256 aecab1eb46075d1a1432b3e14537f860a2ded49a13ca82f17fac44b40ad2da51
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            RobloxStudioLauncherBeta.exe
            • Path C:\Program Files (x86)\Roblox\Versions\RobloxStudioLauncherBeta.exe
            • Size 4.5MB
            • SHA256 666b6d5a3bb465a98828bf74a55c814e10b57f4e2b0fd1598aaf0171fccd4de0
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            RobloxPlayerInstaller.exe
            • Path C:\Program Files (x86)\Roblox\Versions\version-f2b5c592c03b4183\RobloxPlayerInstaller.exe
            • Size 4.6MB
            • SHA256 0ce04e62cac2b43c7b86e9c82f5aa895e19ca9f5654c9baee7992ecea4fe2ef9
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            MicrosoftEdgeWebview2Setup.exe
            • Path C:\Program Files (x86)\Roblox\Versions\version-f2b5c592c03b4183\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe
            • Size 1.5MB
            • SHA256 921d51979f3416ca19dca13a057f6fd3b09d8741f3576cad444eb95af87ebe08
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            settings.dat
            • Path C:\Program Files\MsEdgeCrashpad\settings.dat
            • Size 280B
            • SHA256 7d7bcf793f0234f0cec7cb14361e9c03a07aa11b1efcc695939bb92e359bd2d2
            • MD5 SHA1 SHA512
            Submit Download

            MicrosoftEdgeUpdate.log
            • Path C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log
            • Size 116KB
            • SHA256 8c5ea6b7640388647bb381eb3baaf4e66abed1317fa255fb615155878b2cfdbe
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            97d5071b4251a88c685a53051e1ae986
            • Path C:\ProgramData\Roblox\Downloads\roblox-player\97d5071b4251a88c685a53051e1ae986
            • Size 5.0MB
            • SHA256 987f45a5fa22b34fe09422b4e8fb844c4dfedae522d1ff35b833fbd0ae850d80
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            07CEF2F654E3ED6050FFC9B6EB844250_BACC6CD2B29F18349081C9FD2343833B
            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_BACC6CD2B29F18349081C9FD2343833B
            • Size 2KB
            • SHA256 75913d8ed495a6b1ca581fca196d33c944c02f29524f9e165dc1706f591cd0b1
            • MD5 SHA1 SHA512
            Submit Download

            72BA427A91F50409B9EAC87F2B59B951_2033B9334DC92599122A3B9136FA3F05
            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\72BA427A91F50409B9EAC87F2B59B951_2033B9334DC92599122A3B9136FA3F05
            • Size 472B
            • SHA256 266e6eb43f802fa71ced05243336fac6654e14277a385914e1fb64d1c41d183d
            • MD5 SHA1 SHA512
            Submit Download

            B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
            • Size 1KB
            • SHA256 f5c23e602447d92258aeb105fd7376e1aa199aee951c807d4cb6d345477afb21
            • MD5 SHA1 SHA512
            Submit Download

            07CEF2F654E3ED6050FFC9B6EB844250_BACC6CD2B29F18349081C9FD2343833B
            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_BACC6CD2B29F18349081C9FD2343833B
            • Size 488B
            • SHA256 840805339f2f8be5fd899165c4b4ece9e47dac6c5ab266820b7890bf95c52978
            • MD5 SHA1 SHA512
            Submit Download

            72BA427A91F50409B9EAC87F2B59B951_2033B9334DC92599122A3B9136FA3F05
            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\72BA427A91F50409B9EAC87F2B59B951_2033B9334DC92599122A3B9136FA3F05
            • Size 492B
            • SHA256 5823c77b533c78c2dcb1fd30ff9c026b1f02bf8bc11b66b17aaa0f6a1f733f4a
            • MD5 SHA1 SHA512
            Submit Download

            B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
            • Size 482B
            • SHA256 070e034b42d144bd3fe87df59580e0e88d4f1d52c61134cb25df0293c86c5364
            • MD5 SHA1 SHA512
            Submit Download

            BatchIncrement[1].json
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\WHUIQOC9\BatchIncrement[1].json
            • Size 163B
            • SHA256 b4a55cfd050f4a62b1c4831ca0ab6ffadde1fe1c3f583917eade12f8c6726f61
            • MD5 SHA1 SHA512
            Submit Download

            PCClientBootstrapper[1].json
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\Z0UNWU5J\PCClientBootstrapper[1].json
            • Size 5KB
            • SHA256 dd4f79c322253d96fa22e77d742b21d2f67b4855915e5ca8b0761ecfcf4d613f
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            memory/1876-557-0x00007FFEDB8E0000-0x00007FFEDB8E1000-memory.dmp
            Download

            memory/5024-458-0x0000016CB77A0000-0x0000016CB77A1000-memory.dmp
            Download

            memory/5024-459-0x00007FFEDB8F0000-0x00007FFEDB900000-memory.dmp
            Download

            memory/5024-463-0x00007FFEDBA50000-0x00007FFEDBA80000-memory.dmp
            Download

            memory/5024-464-0x00007FFEDBA50000-0x00007FFEDBA80000-memory.dmp
            Download

            memory/5024-467-0x00007FFEDBA50000-0x00007FFEDBA80000-memory.dmp
            Download

            memory/5024-465-0x00007FFEDBA50000-0x00007FFEDBA80000-memory.dmp
            Download

            memory/5024-466-0x00007FFEDBA50000-0x00007FFEDBA80000-memory.dmp
            Download

            memory/5024-468-0x00007FFEDBAE0000-0x00007FFEDBAE5000-memory.dmp
            Download

            memory/5024-470-0x00007FFEDAB70000-0x00007FFEDAB80000-memory.dmp
            Download

            memory/5024-469-0x00007FFEDAB70000-0x00007FFEDAB80000-memory.dmp
            Download

            memory/5024-471-0x00007FFEDAC00000-0x00007FFEDAC10000-memory.dmp
            Download

            memory/5024-472-0x00007FFEDAC00000-0x00007FFEDAC10000-memory.dmp
            Download

            memory/5024-473-0x00007FFEDAC20000-0x00007FFEDAC30000-memory.dmp
            Download

            memory/5024-474-0x00007FFEDAC20000-0x00007FFEDAC30000-memory.dmp
            Download

            memory/5024-475-0x00007FFEDAC20000-0x00007FFEDAC30000-memory.dmp
            Download

            memory/5024-477-0x00007FFEDAC20000-0x00007FFEDAC30000-memory.dmp
            Download

            memory/5024-476-0x00007FFEDAC20000-0x00007FFEDAC30000-memory.dmp
            Download

            memory/5024-478-0x00007FFED9460000-0x00007FFED9470000-memory.dmp
            Download

            memory/5024-479-0x00007FFED9460000-0x00007FFED9470000-memory.dmp
            Download

            memory/5024-480-0x00007FFED9570000-0x00007FFED9580000-memory.dmp
            Download

            memory/5024-481-0x00007FFEDB8E0000-0x00007FFEDB8E1000-memory.dmp
            Download

            memory/5024-482-0x00007FFED9570000-0x00007FFED9580000-memory.dmp
            Download

            memory/5024-483-0x00007FFED96E0000-0x00007FFED9710000-memory.dmp
            Download

            memory/5024-484-0x00007FFED96E0000-0x00007FFED9710000-memory.dmp
            Download

            memory/5024-485-0x00007FFED96E0000-0x00007FFED9710000-memory.dmp
            Download

            memory/5024-486-0x00007FFED96E0000-0x00007FFED9710000-memory.dmp
            Download

            memory/5024-487-0x00007FFED96E0000-0x00007FFED9710000-memory.dmp
            Download

            memory/5024-489-0x00007FFEDAD80000-0x00007FFEDAD90000-memory.dmp
            Download

            memory/5024-488-0x00007FFEDAD80000-0x00007FFEDAD90000-memory.dmp
            Download

            memory/5024-491-0x00007FFEDAE30000-0x00007FFEDAE3E000-memory.dmp
            Download

            memory/5024-490-0x00007FFEDAE30000-0x00007FFEDAE3E000-memory.dmp
            Download

            memory/5024-492-0x00007FFEDAE30000-0x00007FFEDAE3E000-memory.dmp
            Download

            memory/5024-494-0x00007FFEDAE30000-0x00007FFEDAE3E000-memory.dmp
            Download

            memory/5024-493-0x00007FFEDAE30000-0x00007FFEDAE3E000-memory.dmp
            Download

            memory/5024-495-0x00007FFEDB700000-0x00007FFEDB710000-memory.dmp
            Download

            memory/5024-496-0x00007FFEDB700000-0x00007FFEDB710000-memory.dmp
            Download

            memory/5024-497-0x00007FFEDB720000-0x00007FFEDB72B000-memory.dmp
            Download

            memory/5024-498-0x00007FFEDB720000-0x00007FFEDB72B000-memory.dmp
            Download

            memory/5024-499-0x00007FFEDB720000-0x00007FFEDB72B000-memory.dmp
            Download

            memory/5024-500-0x00007FFEDB720000-0x00007FFEDB72B000-memory.dmp
            Download

            memory/5024-501-0x00007FFEDB720000-0x00007FFEDB72B000-memory.dmp
            Download

            memory/5024-502-0x00007FFED91F0000-0x00007FFED9200000-memory.dmp
            Download

            memory/5024-503-0x00007FFED91F0000-0x00007FFED9200000-memory.dmp
            Download

            memory/5024-504-0x00007FFED92F0000-0x00007FFED9300000-memory.dmp
            Download

            memory/5024-505-0x00007FFED92F0000-0x00007FFED9300000-memory.dmp
            Download

            memory/5024-506-0x00007FFED9320000-0x00007FFED9346000-memory.dmp
            Download

            memory/5024-507-0x00007FFED9320000-0x00007FFED9346000-memory.dmp
            Download

            memory/5024-508-0x00007FFED9320000-0x00007FFED9346000-memory.dmp
            Download

            memory/5024-509-0x00007FFED9320000-0x00007FFED9346000-memory.dmp
            Download

            memory/5024-510-0x00007FFED9320000-0x00007FFED9346000-memory.dmp
            Download

            memory/5024-514-0x00007FFED97E0000-0x00007FFED9807000-memory.dmp
            Download

            memory/5024-513-0x00007FFED97E0000-0x00007FFED9807000-memory.dmp
            Download

            memory/5024-512-0x00007FFED97E0000-0x00007FFED9807000-memory.dmp
            Download

            memory/5024-511-0x00007FFED97E0000-0x00007FFED9807000-memory.dmp
            Download

            memory/5024-515-0x00007FFED97E0000-0x00007FFED9807000-memory.dmp
            Download

            memory/5024-517-0x00007FFED97E0000-0x00007FFED9807000-memory.dmp
            Download

            memory/5024-516-0x00007FFED97E0000-0x00007FFED9807000-memory.dmp
            Download

            memory/5024-518-0x00007FFED9110000-0x00007FFED9132000-memory.dmp
            Download

            memory/5024-523-0x00007FFEDB870000-0x00007FFEDB871000-memory.dmp
            Download

            memory/5024-522-0x00007FFED9110000-0x00007FFED9132000-memory.dmp
            Download

            memory/5024-521-0x00007FFED9110000-0x00007FFED9132000-memory.dmp
            Download

            memory/5024-520-0x00007FFED9110000-0x00007FFED9132000-memory.dmp
            Download

            memory/5024-519-0x00007FFED9110000-0x00007FFED9132000-memory.dmp
            Download

            memory/5024-546-0x0000016CB77A0000-0x0000016CB77A1000-memory.dmp
            Download

            memory/5024-462-0x00007FFEDBA00000-0x00007FFEDBA10000-memory.dmp
            Download

            memory/5024-461-0x00007FFEDBA00000-0x00007FFEDBA10000-memory.dmp
            Download

            memory/5024-460-0x00007FFEDB8F0000-0x00007FFEDB900000-memory.dmp
            Download