Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1049s -
max time network
1038s -
platform
windows11-21h2_x64 -
resource
win11-20240221-en -
resource tags
arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system -
submitted
11/04/2024, 14:02
Static task
static1
Behavioral task
behavioral1
Sample
Screenshot 2024-04-08 10.21.54 AM.png
Resource
win11-20240221-en
General
-
Target
Screenshot 2024-04-08 10.21.54 AM.png
-
Size
269KB
-
MD5
e44424c25c66e41ea4bc7b1875e3cb78
-
SHA1
56aaec61789f65979ed9b33c1ec183c5caaa45ba
-
SHA256
a56812eeb43616199bd1831c97484c2dda8d04fad571193ff2bac06ffb96a0c4
-
SHA512
9070473302645e1b61cd5cca285ad0592f9300d8e425243a61b563ca09badeaab81164cc71ab228d360f3ead67a9e1402cbf34b14ab9bbe78be8a1c3323b9a80
-
SSDEEP
6144:TUIBT0ZpmaxGd8u+a1RU5YvpDPE56N1zqsR0VY:4I90ZpmaxYt+yU5YvpDMMzR/
Malware Config
Signatures
-
Downloads MZ/PE file
-
Sets file execution options in registry 2 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe -
Executes dropped EXE 57 IoCs
pid Process 2244 RobloxPlayerInstaller (1).exe 4788 MicrosoftEdgeWebview2Setup.exe 3088 MicrosoftEdgeUpdate.exe 1340 MicrosoftEdgeUpdate.exe 4036 MicrosoftEdgeUpdate.exe 3372 MicrosoftEdgeUpdateComRegisterShell64.exe 1188 MicrosoftEdgeUpdateComRegisterShell64.exe 3108 MicrosoftEdgeUpdateComRegisterShell64.exe 1716 MicrosoftEdgeUpdate.exe 3696 MicrosoftEdgeUpdate.exe 1336 MicrosoftEdgeUpdate.exe 1436 MicrosoftEdgeUpdate.exe 1428 MicrosoftEdge_X64_123.0.2420.81.exe 2240 setup.exe 1624 setup.exe 2084 RobloxStudioInstaller.exe 2716 RobloxStudioInstaller.exe 4280 MicrosoftEdgeWebview2Setup.exe 2828 MicrosoftEdgeUpdate.exe 1560 MicrosoftEdgeUpdate.exe 4144 MicrosoftEdgeUpdate.exe 2268 MicrosoftEdgeUpdate.exe 4820 MicrosoftEdgeUpdate.exe 720 MicrosoftEdgeUpdate.exe 2864 RobloxPlayerBeta.exe 3524 MicrosoftEdge_X64_123.0.2420.81.exe 780 setup.exe 1256 setup.exe 2384 MicrosoftEdgeUpdateSetup_X86_1.3.185.29.exe 4200 MicrosoftEdgeUpdate.exe 2680 MicrosoftEdgeUpdate.exe 2352 RobloxStudioBeta.exe 2788 MicrosoftEdgeUpdate.exe 3456 MicrosoftEdgeUpdate.exe 236 MicrosoftEdgeUpdate.exe 4760 MicrosoftEdgeUpdateComRegisterShell64.exe 2836 MicrosoftEdgeUpdateComRegisterShell64.exe 1864 MicrosoftEdgeUpdateComRegisterShell64.exe 640 MicrosoftEdgeUpdate.exe 2784 msedgewebview2.exe 2476 msedgewebview2.exe 2144 msedgewebview2.exe 4488 msedgewebview2.exe 1592 msedgewebview2.exe 2512 msedgewebview2.exe 4508 msedgewebview2.exe 896 msedgewebview2.exe 4664 msedgewebview2.exe 3036 msedgewebview2.exe 1260 msedgewebview2.exe 1176 msedgewebview2.exe 3880 msedgewebview2.exe 3444 msedgewebview2.exe 3820 msedgewebview2.exe 3504 msedgewebview2.exe 488 msedgewebview2.exe 4576 msedgewebview2.exe -
Loads dropped DLL 64 IoCs
pid Process 3088 MicrosoftEdgeUpdate.exe 1340 MicrosoftEdgeUpdate.exe 4036 MicrosoftEdgeUpdate.exe 3372 MicrosoftEdgeUpdateComRegisterShell64.exe 4036 MicrosoftEdgeUpdate.exe 1188 MicrosoftEdgeUpdateComRegisterShell64.exe 4036 MicrosoftEdgeUpdate.exe 3108 MicrosoftEdgeUpdateComRegisterShell64.exe 4036 MicrosoftEdgeUpdate.exe 1716 MicrosoftEdgeUpdate.exe 3696 MicrosoftEdgeUpdate.exe 1336 MicrosoftEdgeUpdate.exe 1336 MicrosoftEdgeUpdate.exe 3696 MicrosoftEdgeUpdate.exe 1436 MicrosoftEdgeUpdate.exe 2828 MicrosoftEdgeUpdate.exe 1560 MicrosoftEdgeUpdate.exe 4144 MicrosoftEdgeUpdate.exe 2268 MicrosoftEdgeUpdate.exe 2268 MicrosoftEdgeUpdate.exe 4820 MicrosoftEdgeUpdate.exe 4820 MicrosoftEdgeUpdate.exe 720 MicrosoftEdgeUpdate.exe 2864 RobloxPlayerBeta.exe 4200 MicrosoftEdgeUpdate.exe 2680 MicrosoftEdgeUpdate.exe 2352 RobloxStudioBeta.exe 2352 RobloxStudioBeta.exe 2352 RobloxStudioBeta.exe 2352 RobloxStudioBeta.exe 2352 RobloxStudioBeta.exe 2352 RobloxStudioBeta.exe 2352 RobloxStudioBeta.exe 2352 RobloxStudioBeta.exe 2352 RobloxStudioBeta.exe 2352 RobloxStudioBeta.exe 2352 RobloxStudioBeta.exe 2352 RobloxStudioBeta.exe 2352 RobloxStudioBeta.exe 2352 RobloxStudioBeta.exe 2352 RobloxStudioBeta.exe 2352 RobloxStudioBeta.exe 2352 RobloxStudioBeta.exe 2352 RobloxStudioBeta.exe 2352 RobloxStudioBeta.exe 2352 RobloxStudioBeta.exe 2352 RobloxStudioBeta.exe 2352 RobloxStudioBeta.exe 2352 RobloxStudioBeta.exe 2788 MicrosoftEdgeUpdate.exe 2352 RobloxStudioBeta.exe 3456 MicrosoftEdgeUpdate.exe 236 MicrosoftEdgeUpdate.exe 4760 MicrosoftEdgeUpdateComRegisterShell64.exe 236 MicrosoftEdgeUpdate.exe 2836 MicrosoftEdgeUpdateComRegisterShell64.exe 236 MicrosoftEdgeUpdate.exe 1864 MicrosoftEdgeUpdateComRegisterShell64.exe 236 MicrosoftEdgeUpdate.exe 640 MicrosoftEdgeUpdate.exe 2352 RobloxStudioBeta.exe 2352 RobloxStudioBeta.exe 2352 RobloxStudioBeta.exe 2352 RobloxStudioBeta.exe -
Registers COM server for autorun 1 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.185.29\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BA4344C9-31F7-44C1-9802-7F90B352D5C5}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.185.29\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\INPROCSERVER32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.185.29\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.185.29\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BA4344C9-31F7-44C1-9802-7F90B352D5C5}\InProcServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.185.29\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BA4344C9-31F7-44C1-9802-7F90B352D5C5}\InProcServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.185.29\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BA4344C9-31F7-44C1-9802-7F90B352D5C5}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.185.29\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BA4344C9-31F7-44C1-9802-7F90B352D5C5}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.185.29\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BA4344C9-31F7-44C1-9802-7F90B352D5C5}\InProcServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BA4344C9-31F7-44C1-9802-7F90B352D5C5}\InProcServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\INPROCSERVER32 MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.185.29\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BA4344C9-31F7-44C1-9802-7F90B352D5C5}\InProcServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BA4344C9-31F7-44C1-9802-7F90B352D5C5}\InProcServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RobloxPlayerInstaller (1).exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RobloxStudioInstaller.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RobloxStudioBeta.exe -
Checks system information in the registry 2 TTPs 26 IoCs
System information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName msedgewebview2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer msedgewebview2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
pid Process 2864 RobloxPlayerBeta.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 18 IoCs
pid Process 2864 RobloxPlayerBeta.exe 2864 RobloxPlayerBeta.exe 2864 RobloxPlayerBeta.exe 2864 RobloxPlayerBeta.exe 2864 RobloxPlayerBeta.exe 2864 RobloxPlayerBeta.exe 2864 RobloxPlayerBeta.exe 2864 RobloxPlayerBeta.exe 2864 RobloxPlayerBeta.exe 2864 RobloxPlayerBeta.exe 2864 RobloxPlayerBeta.exe 2864 RobloxPlayerBeta.exe 2864 RobloxPlayerBeta.exe 2864 RobloxPlayerBeta.exe 2864 RobloxPlayerBeta.exe 2864 RobloxPlayerBeta.exe 2864 RobloxPlayerBeta.exe 2864 RobloxPlayerBeta.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Roblox\Versions\version-e2bc56a1e4374ca0\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\TenFootUiTesting\RobloxAppLocales.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2bc56a1e4374ca0\ExtraContent\textures\ui\LuaChat\graphic\[email protected] RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2bc56a1e4374ca0\content\studio_svg_textures\Shared\DraggerTools\Light\Standard\Select_P.png RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2bc56a1e4374ca0\ExtraContent\LuaPackages\Packages\_Index\RoactNavigation-067f4e4b-660967ca\RoactNavigation\BackBehavior.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2bc56a1e4374ca0\ExtraContent\LuaPackages\Packages\_Index\RoduxFriends-948a3386-02a3ea83\RoduxFriends\Selectors\getSortedByRankRecommendationIds.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2bc56a1e4374ca0\content\studio_svg_textures\Lua\AssetManager\Light\Standard\[email protected] RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2bc56a1e4374ca0\content\studio_svg_textures\Lua\Notifications\Light\Large\NotificationBell.png RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2bc56a1e4374ca0\ExtraContent\LuaPackages\Workspace\Packages\SharedFlags.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2bc56a1e4374ca0\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\GameDetail\Dev\UnitTestHelpers.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2bc56a1e4374ca0\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\GameInvite\GameDetailRodux.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2bc56a1e4374ca0\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\NetworkingVirtualEvents\Dev\HttpRequest.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2bc56a1e4374ca0\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\SocialCommonTestSuite\EditProfile.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-8950870ea20941f9\content\configs\DateTimeLocaleConfigs\ko-kr.json RobloxPlayerInstaller (1).exe File created C:\Program Files (x86)\Roblox\Versions\version-8950870ea20941f9\content\textures\ui\Keyboard\mic_icon.png RobloxPlayerInstaller (1).exe File created C:\Program Files (x86)\Roblox\Versions\version-e2bc56a1e4374ca0\ExtraContent\scripts\CoreScripts\Modules\PlayerList\Components\PresentationMobile\DropDownButton.spec.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2bc56a1e4374ca0\ExtraContent\LuaPackages\Workspace\Packages\Result.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2bc56a1e4374ca0\ExtraContent\LuaPackages\Packages\_Index\JestFakeTimers-edcba0e9-2.4.1\JestMock.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2bc56a1e4374ca0\content\studio_svg_textures\Shared\WidgetIcons\Dark\Standard\StyleEditor.png RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2bc56a1e4374ca0\ExtraContent\LuaPackages\Workspace\Packages\QRCode.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\123.0.2420.81\Locales\gu.pak setup.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2bc56a1e4374ca0\Qml\QtQuick\Controls.2\designer\images\[email protected] RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2bc56a1e4374ca0\content\textures\ManageCollaborators\closeWidget_dark.png RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2bc56a1e4374ca0\ExtraContent\scripts\CoreScripts\Modules\InspectAndBuy\Components\DetailsText.spec.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-8950870ea20941f9\content\avatar\heads\headM.mesh RobloxPlayerInstaller (1).exe File created C:\Program Files (x86)\Roblox\Versions\version-8950870ea20941f9\content\textures\AvatarEditorImages\[email protected] RobloxPlayerInstaller (1).exe File created C:\Program Files (x86)\Roblox\Versions\version-e2bc56a1e4374ca0\content\textures\StudioSharedUI\[email protected] RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2bc56a1e4374ca0\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\UserSearch\SharedFlags.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2bc56a1e4374ca0\ExtraContent\LuaPackages\Packages\_Index\GraphQL\GraphQL\language\__tests__\blockString-fuzz.spec.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2bc56a1e4374ca0\content\studio_svg_textures\Shared\Utility\Light\Standard\[email protected] RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2bc56a1e4374ca0\ExtraContent\LuaPackages\Packages\_Index\RobloxRequests\RobloxRequests\src\cookies.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2bc56a1e4374ca0\ExtraContent\LuaPackages\Packages\_Index\UIBlox\UIBlox\App\Control\Pill\Pill.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2bc56a1e4374ca0\ExtraContent\LuaPackages\Packages\_Index\RoduxDevtools\lock.toml RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2bc56a1e4374ca0\ExtraContent\LuaPackages\Packages\_Index\RoduxGames-c69837d6-ca9547e2\RoduxGames\Enums\CreatorType.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2bc56a1e4374ca0\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\OtpLogin\CentralOverlay.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2bc56a1e4374ca0\ExtraContent\scripts\CoreScripts\Modules\InGameMenu\Components\ReportPage\ReportSentDialog.spec.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2bc56a1e4374ca0\ExtraContent\scripts\CoreScripts\Modules\InGameMenu\Localization\Locales\zh-tw.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2bc56a1e4374ca0\ExtraContent\scripts\CoreScripts\Modules\PlayerList\PlayerListInitialVisibleState.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2bc56a1e4374ca0\content\studio_svg_textures\Shared\InsertableObjects\Light\Standard\MaterialService.png RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2bc56a1e4374ca0\ExtraContent\scripts\CoreScripts\Modules\PurchasePrompt\Localization\Locales\vi-vn.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2bc56a1e4374ca0\ExtraContent\LuaPackages\Packages\_Index\JestRunner\JestRunner\testWorker.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2bc56a1e4374ca0\ExtraContent\LuaPackages\Packages\_Index\RbxDesignFoundations-77b1a117-2f841688\RbxDesignFoundations\tokens\Common\Dark\Semantic.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2bc56a1e4374ca0\ExtraContent\LuaPackages\Packages\_Index\JestSnapshot-edcba0e9-2.4.1\JestDiff.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2bc56a1e4374ca0\ExtraContent\LuaPackages\Packages\_Index\RoactNavigationUpgradeFlag\lock.toml RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2bc56a1e4374ca0\ExtraContent\LuaPackages\Packages\_Index\roblox_genericpagination\genericpagination\Paginator.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2bc56a1e4374ca0\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\InvisibleMode\Rodux.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-8950870ea20941f9\content\textures\StudioToolbox\AssetPreview\vote_down.png RobloxPlayerInstaller (1).exe File created C:\Program Files (x86)\Roblox\Versions\version-8950870ea20941f9\content\textures\ui\[email protected] RobloxPlayerInstaller (1).exe File created C:\Program Files (x86)\Roblox\Versions\version-e2bc56a1e4374ca0\ExtraContent\scripts\CoreScripts\CoreScripts\ExperienceChatMain.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2bc56a1e4374ca0\ExtraContent\scripts\CoreScripts\Modules\InGameMenu\Components\FullscreenTitleBar.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2bc56a1e4374ca0\content\studio_svg_textures\Shared\Modeling\Dark\Standard\Material.png RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2bc56a1e4374ca0\ExtraContent\LuaPackages\Packages\_Index\SocialLibraries\SocialLibraries\ReleaseHelpers\init.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2bc56a1e4374ca0\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\ContactImporter\NativeUtilProtocol.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2bc56a1e4374ca0\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\GraphQLServer\SocialLuaAnalytics.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2bc56a1e4374ca0\StudioFonts\NotoSansCJK-Black.ttc RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2bc56a1e4374ca0\ExtraContent\scripts\CoreScripts\Modules\Common\EventConnection.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2bc56a1e4374ca0\content\studio_svg_textures\Shared\DraggerTools\Dark\Large\Rotate_P.png RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2bc56a1e4374ca0\ExtraContent\scripts\CoreScripts\Modules\InspectAndBuy\Thunks\GetVersionInfo.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2bc56a1e4374ca0\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\TenFootUiGlobalNav\Style.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2bc56a1e4374ca0\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\NavigationRodux\Cryo.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\123.0.2420.81\Locales\tt.pak setup.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2bc56a1e4374ca0\content\textures\ui\Emotes\Editor\TenFoot\Wheel.png RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2bc56a1e4374ca0\content\studio_svg_textures\Shared\WidgetIcons\Light\Large\[email protected] RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2bc56a1e4374ca0\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\AbuseReportMenu\Cryo.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-e2bc56a1e4374ca0\content\studio_svg_textures\Shared\Navigation\Light\Standard\[email protected] RobloxStudioInstaller.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SystemTemp\MsEdgeCrashpad\metadata setup.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_1315083661\hyph-be.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_1315083661\hyph-bn.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_1315083661\hyph-es.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_1315083661\hyph-gu.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_1315083661\hyph-kn.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_1315083661\hyph-la.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_1315083661\manifest.fingerprint msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_452648012\manifest.json msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_20519074\Part-NL msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_1862348444\kp_pinslist.pb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_1315083661\hyph-en-gb.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_1315083661\hyph-hr.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_1315083661\hyph-ta.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_1315083661\hyph-und-ethi.hyb msedgewebview2.exe File opened for modification C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat setup.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_20519074\manifest.json msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_1177635809\manifest.fingerprint msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_18823056\manifest.json msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_889102690\manifest.json msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_416691757\crl-set msedgewebview2.exe File created C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat setup.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_20519074\Filtering Rules-CA msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_20519074\Part-RU msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_20519074\manifest.fingerprint msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_1632005115\keys.json msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_1315083661\hyph-bg.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_1315083661\hyph-cy.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_1315083661\hyph-ga.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_1315083661\hyph-or.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_1315083661\hyph-pa.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_1862348444\manifest.fingerprint msedgewebview2.exe File opened for modification C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat setup.exe File opened for modification C:\Windows\SystemTemp msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_1862348444\ct_config.pb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_1315083661\_metadata\verified_contents.json msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_1177635809\metadata.pb msedgewebview2.exe File opened for modification C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat setup.exe File opened for modification C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat setup.exe File opened for modification C:\Windows\SystemTemp setup.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_20519074\LICENSE msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_1315083661\hyph-hi.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_1315083661\hyph-pt.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_1177635809\manifest.json msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_18823056\protocols.json msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_416691757\manifest.fingerprint msedgewebview2.exe File opened for modification C:\Windows\SystemTemp setup.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_20519074\adblock_snippet.js msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_20519074\Part-IT msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_1632005115\manifest.fingerprint msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_1315083661\hyph-de-1996.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_1315083661\hyph-de-ch-1901.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_1315083661\hyph-eu.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_1315083661\hyph-fr.hyb msedgewebview2.exe File opened for modification C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat setup.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_20519074\Filtering Rules-AA msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_20519074\Part-DE msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_20519074\Part-ZH msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_1315083661\hyph-mr.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_1315083661\hyph-sl.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_416691757\manifest.json msedgewebview2.exe File opened for modification C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat setup.exe File created C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat setup.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_1315083661\hyph-mn-cyrl.hyb msedgewebview2.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 11 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS RobloxStudioBeta.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer RobloxStudioBeta.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedgewebview2.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedgewebview2.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0" RobloxPlayerInstaller (1).exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0" RobloxPlayerInstaller (1).exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0" RobloxStudioInstaller.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio-auth\WarnOnOpen = "0" RobloxStudioInstaller.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio RobloxPlayerInstaller (1).exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0" RobloxPlayerInstaller (1).exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player RobloxPlayerInstaller (1).exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox RobloxPlayerInstaller (1).exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\PROTOCOLEXECUTE\ROBLOX-STUDIO RobloxStudioInstaller.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio RobloxStudioInstaller.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio-auth RobloxStudioInstaller.exe -
Modifies data under HKEY_USERS 43 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs MicrosoftEdgeUpdate.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133573177950527684" chrome.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs MicrosoftEdgeUpdate.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebSvc\CurVer MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BA4344C9-31F7-44C1-9802-7F90B352D5C5}\InProcServer32 MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}\Elevation\IconReference = "@C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.185.29\\msedgeupdate.dll,-1004" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\ = "IAppBundle" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\NumMethods\ = "9" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08D832B9-D2FD-481F-98CF-904D00DF63CC}\ProgID\ = "MicrosoftEdgeUpdate.ProcessLauncher.1.0" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\NumMethods\ = "4" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Roblox.Place\ = "Roblox Place" RobloxStudioInstaller.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\ProxyStubClsid32 MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\ProxyStubClsid32 MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26} MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\ProxyStubClsid32 MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C} MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.PolicyStatusMachine\CurVer\ = "MicrosoftEdgeUpdate.PolicyStatusMachine.1.0" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}\LocalServer32 MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5F6A18BB-6231-424B-8242-19E5BB94F8ED}\ProgID\ = "MicrosoftEdgeUpdate.CredentialDialogMachine.1.0" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}\Elevation\IconReference = "@C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\msedgeupdate.dll,-1004" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4} MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69} MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE} MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\ProxyStubClsid32\ = "{BA4344C9-31F7-44C1-9802-7F90B352D5C5}" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08D832B9-D2FD-481F-98CF-904D00DF63CC}\LocalServer32\ = "\"C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\MicrosoftEdgeUpdateOnDemand.exe\"" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\ = "IAppVersion" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\NumMethods\ = "26" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\ProxyStubClsid32 MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\ = "IPolicyStatus4" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\NumMethods\ = "26" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.185.29\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\ProxyStubClsid32 MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassMachine\CurVer\ = "MicrosoftEdgeUpdate.OnDemandCOMClassMachine.1.0" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5F6A18BB-6231-424B-8242-19E5BB94F8ED}\VersionIndependentProgID\ = "MicrosoftEdgeUpdate.CredentialDialogMachine" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\NumMethods MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF} MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CredentialDialogMachine\CLSID\ = "{5F6A18BB-6231-424B-8242-19E5BB94F8ED}" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E} MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\NumMethods\ = "4" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\ = "IGoogleUpdate3Web" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\ProxyStubClsid32\ = "{BA4344C9-31F7-44C1-9802-7F90B352D5C5}" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.PolicyStatusSvc MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\NumMethods\ = "41" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\NumMethods\ = "10" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\NumMethods MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\ = "IBrowserHttpRequest2" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}\Elevation MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C} MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\ = "IPolicyStatus2" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine.dll" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\ = "IAppBundle" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B9063E4-3882-485E-8797-F28A0240782F} MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebMachine.1.0\CLSID\ = "{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}" MicrosoftEdgeUpdate.exe -
NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe:Zone.Identifier chrome.exe File opened for modification C:\Users\Admin\Downloads\RobloxPlayerInstaller (1).exe:Zone.Identifier chrome.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2352 RobloxStudioBeta.exe -
Suspicious behavior: EnumeratesProcesses 54 IoCs
pid Process 3944 chrome.exe 3944 chrome.exe 1364 chrome.exe 1364 chrome.exe 2244 RobloxPlayerInstaller (1).exe 2244 RobloxPlayerInstaller (1).exe 3088 MicrosoftEdgeUpdate.exe 3088 MicrosoftEdgeUpdate.exe 4940 msedge.exe 4940 msedge.exe 248 msedge.exe 248 msedge.exe 2716 RobloxStudioInstaller.exe 2716 RobloxStudioInstaller.exe 3880 msedge.exe 3880 msedge.exe 4820 MicrosoftEdgeUpdate.exe 4820 MicrosoftEdgeUpdate.exe 4820 MicrosoftEdgeUpdate.exe 4820 MicrosoftEdgeUpdate.exe 3088 MicrosoftEdgeUpdate.exe 3088 MicrosoftEdgeUpdate.exe 3088 MicrosoftEdgeUpdate.exe 3088 MicrosoftEdgeUpdate.exe 2864 RobloxPlayerBeta.exe 2864 RobloxPlayerBeta.exe 1336 MicrosoftEdgeUpdate.exe 1336 MicrosoftEdgeUpdate.exe 2828 MicrosoftEdgeUpdate.exe 2828 MicrosoftEdgeUpdate.exe 2828 MicrosoftEdgeUpdate.exe 2828 MicrosoftEdgeUpdate.exe 2788 MicrosoftEdgeUpdate.exe 2788 MicrosoftEdgeUpdate.exe 2352 RobloxStudioBeta.exe 2352 RobloxStudioBeta.exe 2352 RobloxStudioBeta.exe 2352 RobloxStudioBeta.exe 2352 RobloxStudioBeta.exe 2352 RobloxStudioBeta.exe 2352 RobloxStudioBeta.exe 2352 RobloxStudioBeta.exe 2352 RobloxStudioBeta.exe 2352 RobloxStudioBeta.exe 2352 RobloxStudioBeta.exe 2352 RobloxStudioBeta.exe 2352 RobloxStudioBeta.exe 2352 RobloxStudioBeta.exe 2352 RobloxStudioBeta.exe 2352 RobloxStudioBeta.exe 2352 RobloxStudioBeta.exe 2352 RobloxStudioBeta.exe 3504 msedgewebview2.exe 3504 msedgewebview2.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2352 RobloxStudioBeta.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 31 IoCs
pid Process 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 248 msedge.exe 248 msedge.exe 248 msedge.exe 248 msedge.exe 248 msedge.exe 248 msedge.exe 248 msedge.exe 2784 msedgewebview2.exe 2784 msedgewebview2.exe 2784 msedgewebview2.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3944 chrome.exe Token: SeCreatePagefilePrivilege 3944 chrome.exe Token: SeShutdownPrivilege 3944 chrome.exe Token: SeCreatePagefilePrivilege 3944 chrome.exe Token: SeShutdownPrivilege 3944 chrome.exe Token: SeCreatePagefilePrivilege 3944 chrome.exe Token: SeShutdownPrivilege 3944 chrome.exe Token: SeCreatePagefilePrivilege 3944 chrome.exe Token: SeShutdownPrivilege 3944 chrome.exe Token: SeCreatePagefilePrivilege 3944 chrome.exe Token: SeShutdownPrivilege 3944 chrome.exe Token: SeCreatePagefilePrivilege 3944 chrome.exe Token: SeShutdownPrivilege 3944 chrome.exe Token: SeCreatePagefilePrivilege 3944 chrome.exe Token: SeShutdownPrivilege 3944 chrome.exe Token: SeCreatePagefilePrivilege 3944 chrome.exe Token: SeShutdownPrivilege 3944 chrome.exe Token: SeCreatePagefilePrivilege 3944 chrome.exe Token: SeShutdownPrivilege 3944 chrome.exe Token: SeCreatePagefilePrivilege 3944 chrome.exe Token: SeShutdownPrivilege 3944 chrome.exe Token: SeCreatePagefilePrivilege 3944 chrome.exe Token: SeShutdownPrivilege 3944 chrome.exe Token: SeCreatePagefilePrivilege 3944 chrome.exe Token: SeShutdownPrivilege 3944 chrome.exe Token: SeCreatePagefilePrivilege 3944 chrome.exe Token: SeShutdownPrivilege 3944 chrome.exe Token: SeCreatePagefilePrivilege 3944 chrome.exe Token: SeShutdownPrivilege 3944 chrome.exe Token: SeCreatePagefilePrivilege 3944 chrome.exe Token: SeShutdownPrivilege 3944 chrome.exe Token: SeCreatePagefilePrivilege 3944 chrome.exe Token: SeShutdownPrivilege 3944 chrome.exe Token: SeCreatePagefilePrivilege 3944 chrome.exe Token: SeShutdownPrivilege 3944 chrome.exe Token: SeCreatePagefilePrivilege 3944 chrome.exe Token: SeShutdownPrivilege 3944 chrome.exe Token: SeCreatePagefilePrivilege 3944 chrome.exe Token: SeShutdownPrivilege 3944 chrome.exe Token: SeCreatePagefilePrivilege 3944 chrome.exe Token: SeShutdownPrivilege 3944 chrome.exe Token: SeCreatePagefilePrivilege 3944 chrome.exe Token: SeShutdownPrivilege 3944 chrome.exe Token: SeCreatePagefilePrivilege 3944 chrome.exe Token: SeShutdownPrivilege 3944 chrome.exe Token: SeCreatePagefilePrivilege 3944 chrome.exe Token: SeShutdownPrivilege 3944 chrome.exe Token: SeCreatePagefilePrivilege 3944 chrome.exe Token: SeShutdownPrivilege 3944 chrome.exe Token: SeCreatePagefilePrivilege 3944 chrome.exe Token: SeShutdownPrivilege 3944 chrome.exe Token: SeCreatePagefilePrivilege 3944 chrome.exe Token: SeShutdownPrivilege 3944 chrome.exe Token: SeCreatePagefilePrivilege 3944 chrome.exe Token: SeShutdownPrivilege 3944 chrome.exe Token: SeCreatePagefilePrivilege 3944 chrome.exe Token: SeShutdownPrivilege 3944 chrome.exe Token: SeCreatePagefilePrivilege 3944 chrome.exe Token: SeShutdownPrivilege 3944 chrome.exe Token: SeCreatePagefilePrivilege 3944 chrome.exe Token: SeShutdownPrivilege 3944 chrome.exe Token: SeCreatePagefilePrivilege 3944 chrome.exe Token: SeShutdownPrivilege 3944 chrome.exe Token: SeCreatePagefilePrivilege 3944 chrome.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 248 msedge.exe 248 msedge.exe 248 msedge.exe 248 msedge.exe 248 msedge.exe 248 msedge.exe 248 msedge.exe 248 msedge.exe 248 msedge.exe 248 msedge.exe 248 msedge.exe 248 msedge.exe 248 msedge.exe 248 msedge.exe 248 msedge.exe 248 msedge.exe 248 msedge.exe 248 msedge.exe 248 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 248 msedge.exe 248 msedge.exe 248 msedge.exe 248 msedge.exe 248 msedge.exe 248 msedge.exe 248 msedge.exe 248 msedge.exe 248 msedge.exe 248 msedge.exe 248 msedge.exe 248 msedge.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2352 RobloxStudioBeta.exe 4380 OpenWith.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 2864 RobloxPlayerBeta.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3944 wrote to memory of 5116 3944 chrome.exe 84 PID 3944 wrote to memory of 5116 3944 chrome.exe 84 PID 3944 wrote to memory of 1276 3944 chrome.exe 86 PID 3944 wrote to memory of 1276 3944 chrome.exe 86 PID 3944 wrote to memory of 1276 3944 chrome.exe 86 PID 3944 wrote to memory of 1276 3944 chrome.exe 86 PID 3944 wrote to memory of 1276 3944 chrome.exe 86 PID 3944 wrote to memory of 1276 3944 chrome.exe 86 PID 3944 wrote to memory of 1276 3944 chrome.exe 86 PID 3944 wrote to memory of 1276 3944 chrome.exe 86 PID 3944 wrote to memory of 1276 3944 chrome.exe 86 PID 3944 wrote to memory of 1276 3944 chrome.exe 86 PID 3944 wrote to memory of 1276 3944 chrome.exe 86 PID 3944 wrote to memory of 1276 3944 chrome.exe 86 PID 3944 wrote to memory of 1276 3944 chrome.exe 86 PID 3944 wrote to memory of 1276 3944 chrome.exe 86 PID 3944 wrote to memory of 1276 3944 chrome.exe 86 PID 3944 wrote to memory of 1276 3944 chrome.exe 86 PID 3944 wrote to memory of 1276 3944 chrome.exe 86 PID 3944 wrote to memory of 1276 3944 chrome.exe 86 PID 3944 wrote to memory of 1276 3944 chrome.exe 86 PID 3944 wrote to memory of 1276 3944 chrome.exe 86 PID 3944 wrote to memory of 1276 3944 chrome.exe 86 PID 3944 wrote to memory of 1276 3944 chrome.exe 86 PID 3944 wrote to memory of 1276 3944 chrome.exe 86 PID 3944 wrote to memory of 1276 3944 chrome.exe 86 PID 3944 wrote to memory of 1276 3944 chrome.exe 86 PID 3944 wrote to memory of 1276 3944 chrome.exe 86 PID 3944 wrote to memory of 1276 3944 chrome.exe 86 PID 3944 wrote to memory of 1276 3944 chrome.exe 86 PID 3944 wrote to memory of 1276 3944 chrome.exe 86 PID 3944 wrote to memory of 1276 3944 chrome.exe 86 PID 3944 wrote to memory of 1276 3944 chrome.exe 86 PID 3944 wrote to memory of 1276 3944 chrome.exe 86 PID 3944 wrote to memory of 1276 3944 chrome.exe 86 PID 3944 wrote to memory of 1276 3944 chrome.exe 86 PID 3944 wrote to memory of 1276 3944 chrome.exe 86 PID 3944 wrote to memory of 1276 3944 chrome.exe 86 PID 3944 wrote to memory of 1276 3944 chrome.exe 86 PID 3944 wrote to memory of 1276 3944 chrome.exe 86 PID 3944 wrote to memory of 3320 3944 chrome.exe 87 PID 3944 wrote to memory of 3320 3944 chrome.exe 87 PID 3944 wrote to memory of 2980 3944 chrome.exe 88 PID 3944 wrote to memory of 2980 3944 chrome.exe 88 PID 3944 wrote to memory of 2980 3944 chrome.exe 88 PID 3944 wrote to memory of 2980 3944 chrome.exe 88 PID 3944 wrote to memory of 2980 3944 chrome.exe 88 PID 3944 wrote to memory of 2980 3944 chrome.exe 88 PID 3944 wrote to memory of 2980 3944 chrome.exe 88 PID 3944 wrote to memory of 2980 3944 chrome.exe 88 PID 3944 wrote to memory of 2980 3944 chrome.exe 88 PID 3944 wrote to memory of 2980 3944 chrome.exe 88 PID 3944 wrote to memory of 2980 3944 chrome.exe 88 PID 3944 wrote to memory of 2980 3944 chrome.exe 88 PID 3944 wrote to memory of 2980 3944 chrome.exe 88 PID 3944 wrote to memory of 2980 3944 chrome.exe 88 PID 3944 wrote to memory of 2980 3944 chrome.exe 88 PID 3944 wrote to memory of 2980 3944 chrome.exe 88 PID 3944 wrote to memory of 2980 3944 chrome.exe 88 PID 3944 wrote to memory of 2980 3944 chrome.exe 88 PID 3944 wrote to memory of 2980 3944 chrome.exe 88 PID 3944 wrote to memory of 2980 3944 chrome.exe 88 PID 3944 wrote to memory of 2980 3944 chrome.exe 88 PID 3944 wrote to memory of 2980 3944 chrome.exe 88 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection msedgewebview2.exe
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Screenshot 2024-04-08 10.21.54 AM.png"1⤵PID:4232
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3944 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffec04d9758,0x7ffec04d9768,0x7ffec04d97782⤵PID:5116
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1716 --field-trial-handle=1804,i,11052036833675201036,16481243731599741029,131072 /prefetch:22⤵PID:1276
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2108 --field-trial-handle=1804,i,11052036833675201036,16481243731599741029,131072 /prefetch:82⤵PID:3320
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2168 --field-trial-handle=1804,i,11052036833675201036,16481243731599741029,131072 /prefetch:82⤵PID:2980
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3168 --field-trial-handle=1804,i,11052036833675201036,16481243731599741029,131072 /prefetch:12⤵PID:1056
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3188 --field-trial-handle=1804,i,11052036833675201036,16481243731599741029,131072 /prefetch:12⤵PID:2540
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4536 --field-trial-handle=1804,i,11052036833675201036,16481243731599741029,131072 /prefetch:12⤵PID:2716
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4528 --field-trial-handle=1804,i,11052036833675201036,16481243731599741029,131072 /prefetch:82⤵PID:4384
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4800 --field-trial-handle=1804,i,11052036833675201036,16481243731599741029,131072 /prefetch:82⤵PID:4080
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5156 --field-trial-handle=1804,i,11052036833675201036,16481243731599741029,131072 /prefetch:82⤵PID:2208
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4528 --field-trial-handle=1804,i,11052036833675201036,16481243731599741029,131072 /prefetch:82⤵PID:2916
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5212 --field-trial-handle=1804,i,11052036833675201036,16481243731599741029,131072 /prefetch:82⤵PID:3764
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4960 --field-trial-handle=1804,i,11052036833675201036,16481243731599741029,131072 /prefetch:12⤵PID:1464
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=5296 --field-trial-handle=1804,i,11052036833675201036,16481243731599741029,131072 /prefetch:12⤵PID:3020
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=5276 --field-trial-handle=1804,i,11052036833675201036,16481243731599741029,131072 /prefetch:12⤵PID:2196
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4548 --field-trial-handle=1804,i,11052036833675201036,16481243731599741029,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1364
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=2896 --field-trial-handle=1804,i,11052036833675201036,16481243731599741029,131072 /prefetch:12⤵PID:3956
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=1036 --field-trial-handle=1804,i,11052036833675201036,16481243731599741029,131072 /prefetch:12⤵PID:1428
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=4684 --field-trial-handle=1804,i,11052036833675201036,16481243731599741029,131072 /prefetch:12⤵PID:1528
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5836 --field-trial-handle=1804,i,11052036833675201036,16481243731599741029,131072 /prefetch:82⤵PID:1632
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5620 --field-trial-handle=1804,i,11052036833675201036,16481243731599741029,131072 /prefetch:82⤵PID:2156
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5728 --field-trial-handle=1804,i,11052036833675201036,16481243731599741029,131072 /prefetch:82⤵PID:4884
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5916 --field-trial-handle=1804,i,11052036833675201036,16481243731599741029,131072 /prefetch:82⤵
- NTFS ADS
PID:2512
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4992 --field-trial-handle=1804,i,11052036833675201036,16481243731599741029,131072 /prefetch:82⤵PID:848
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5208 --field-trial-handle=1804,i,11052036833675201036,16481243731599741029,131072 /prefetch:82⤵PID:904
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4876 --field-trial-handle=1804,i,11052036833675201036,16481243731599741029,131072 /prefetch:82⤵PID:3648
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --mojo-platform-channel-handle=3668 --field-trial-handle=1804,i,11052036833675201036,16481243731599741029,131072 /prefetch:12⤵PID:868
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5168 --field-trial-handle=1804,i,11052036833675201036,16481243731599741029,131072 /prefetch:82⤵PID:3760
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5960 --field-trial-handle=1804,i,11052036833675201036,16481243731599741029,131072 /prefetch:82⤵PID:3964
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3820 --field-trial-handle=1804,i,11052036833675201036,16481243731599741029,131072 /prefetch:82⤵
- NTFS ADS
PID:3776
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5260 --field-trial-handle=1804,i,11052036833675201036,16481243731599741029,131072 /prefetch:82⤵PID:3520
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4516 --field-trial-handle=1804,i,11052036833675201036,16481243731599741029,131072 /prefetch:82⤵PID:1032
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3408 --field-trial-handle=1804,i,11052036833675201036,16481243731599741029,131072 /prefetch:82⤵PID:248
-
-
C:\Users\Admin\Downloads\RobloxPlayerInstaller (1).exe"C:\Users\Admin\Downloads\RobloxPlayerInstaller (1).exe"2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
PID:2244 -
C:\Program Files (x86)\Roblox\Versions\version-8950870ea20941f9\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exeMicrosoftEdgeWebview2Setup.exe /silent /install3⤵
- Executes dropped EXE
PID:4788 -
C:\Program Files (x86)\Microsoft\Temp\EU8BB8.tmp\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\Temp\EU8BB8.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"4⤵
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Suspicious behavior: EnumeratesProcesses
PID:3088 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:1340
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:4036 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
PID:3372
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
PID:1188
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
PID:3108
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7Qzg5RTRBMDAtMkZCQS00QzZDLTg3ODktNTZDQkU2MjRGQTIzfSIgdXNlcmlkPSJ7RDJDNzIxNzMtQjAwMi00NTMxLUE4MEQtQzAyOUU5QjlGMUJFfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins4OTM0MUUxQy1GODUxLTRGMjUtQkM1Qy0wNkE1OTY2NEMzRUN9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjIyMDAwLjQ5MyIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSJEQURZIiBwcm9kdWN0X25hbWU9IlN0YW5kYXJkIFBDIChRMzUgKyBJQ0g5LCAyMDA5KSIvPjxleHAgZXRhZz0iIi8-PGFwcCBhcHBpZD0ie0YzQzRGRTAwLUVGRDUtNDAzQi05NTY5LTM5OEEyMEYxQkE0QX0iIHZlcnNpb249IjEuMy4xNDMuNTciIG5leHR2ZXJzaW9uPSIxLjMuMTcxLjM5IiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIj48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI5MzA2OTMzMzU3IiBpbnN0YWxsX3RpbWVfbXM9IjE2NjQiLz48L2FwcD48L3JlcXVlc3Q-5⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
PID:1716
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{C89E4A00-2FBA-4C6C-8789-56CBE624FA23}" /silent5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3696
-
-
-
-
C:\Program Files (x86)\Roblox\Versions\version-8950870ea20941f9\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-8950870ea20941f9\RobloxPlayerBeta.exe" -app -isInstallerLaunch3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
PID:2864
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --mojo-platform-channel-handle=5728 --field-trial-handle=1804,i,11052036833675201036,16481243731599741029,131072 /prefetch:12⤵PID:1032
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --mojo-platform-channel-handle=4444 --field-trial-handle=1804,i,11052036833675201036,16481243731599741029,131072 /prefetch:12⤵PID:4324
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --mojo-platform-channel-handle=5900 --field-trial-handle=1804,i,11052036833675201036,16481243731599741029,131072 /prefetch:12⤵PID:2240
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --mojo-platform-channel-handle=5520 --field-trial-handle=1804,i,11052036833675201036,16481243731599741029,131072 /prefetch:12⤵PID:3724
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --mojo-platform-channel-handle=4500 --field-trial-handle=1804,i,11052036833675201036,16481243731599741029,131072 /prefetch:12⤵PID:2504
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --mojo-platform-channel-handle=5848 --field-trial-handle=1804,i,11052036833675201036,16481243731599741029,131072 /prefetch:12⤵PID:5068
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --mojo-platform-channel-handle=4344 --field-trial-handle=1804,i,11052036833675201036,16481243731599741029,131072 /prefetch:12⤵PID:3264
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --mojo-platform-channel-handle=1540 --field-trial-handle=1804,i,11052036833675201036,16481243731599741029,131072 /prefetch:12⤵PID:2236
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --mojo-platform-channel-handle=2580 --field-trial-handle=1804,i,11052036833675201036,16481243731599741029,131072 /prefetch:12⤵PID:3400
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --mojo-platform-channel-handle=6000 --field-trial-handle=1804,i,11052036833675201036,16481243731599741029,131072 /prefetch:12⤵PID:5052
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --mojo-platform-channel-handle=3388 --field-trial-handle=1804,i,11052036833675201036,16481243731599741029,131072 /prefetch:12⤵PID:2340
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5672 --field-trial-handle=1804,i,11052036833675201036,16481243731599741029,131072 /prefetch:82⤵PID:1720
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4736
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:1336 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7Qzg5RTRBMDAtMkZCQS00QzZDLTg3ODktNTZDQkU2MjRGQTIzfSIgdXNlcmlkPSJ7RDJDNzIxNzMtQjAwMi00NTMxLUE4MEQtQzAyOUU5QjlGMUJFfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins0MzM4OTIxRi1CQUEzLTQ5NDItODI5RS03NTlCMEY4OUJEOEN9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjIyMDAwLjQ5MyIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSJEQURZIiBwcm9kdWN0X25hbWU9IlN0YW5kYXJkIFBDIChRMzUgKyBJQ0g5LCAyMDA5KSIvPjxleHAgZXRhZz0iJnF1b3Q7cjQ1MnQxK2syVGdxL0hYemp2Rk5CUmhvcEJXUjlzYmpYeHFlVURIOXVYMD0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTA2LjAuNTI0OS4xMTkiIG5leHR2ZXJzaW9uPSIxMDYuMC41MjQ5LjExOSIgbGFuZz0iZW4iIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjUiIHN5c3RlbV91cHRpbWVfdGlja3M9IjkzMTUzNzM3NzkiLz48L2FwcD48L3JlcXVlc3Q-2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
PID:1436
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{5DD498DF-08A6-444D-A2F2-4A3C84D92EBA}\MicrosoftEdge_X64_123.0.2420.81.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{5DD498DF-08A6-444D-A2F2-4A3C84D92EBA}\MicrosoftEdge_X64_123.0.2420.81.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level2⤵
- Executes dropped EXE
PID:1428 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{5DD498DF-08A6-444D-A2F2-4A3C84D92EBA}\EDGEMITMP_4A5E5.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{5DD498DF-08A6-444D-A2F2-4A3C84D92EBA}\EDGEMITMP_4A5E5.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{5DD498DF-08A6-444D-A2F2-4A3C84D92EBA}\MicrosoftEdge_X64_123.0.2420.81.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
PID:2240 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{5DD498DF-08A6-444D-A2F2-4A3C84D92EBA}\EDGEMITMP_4A5E5.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{5DD498DF-08A6-444D-A2F2-4A3C84D92EBA}\EDGEMITMP_4A5E5.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=123.0.6312.106 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{5DD498DF-08A6-444D-A2F2-4A3C84D92EBA}\EDGEMITMP_4A5E5.tmp\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=123.0.2420.81 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff7a579baf8,0x7ff7a579bb04,0x7ff7a579bb104⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1624
-
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7Qzg5RTRBMDAtMkZCQS00QzZDLTg3ODktNTZDQkU2MjRGQTIzfSIgdXNlcmlkPSJ7RDJDNzIxNzMtQjAwMi00NTMxLUE4MEQtQzAyOUU5QjlGMUJFfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntGMDk0ODY5OC1ERDU3LTQzQUYtOTMxNi01QUU1MjZBRjY5OEV9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjIyMDAwLjQ5MyIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSJEQURZIiBwcm9kdWN0X25hbWU9IlN0YW5kYXJkIFBDIChRMzUgKyBJQ0g5LCAyMDA5KSIvPjxleHAgZXRhZz0iJnF1b3Q7VlBRb1AxRitmcTE1d1J6aDFrUEw0UE1wV2g4T1JNQjVpenZyT0MvY2hqUT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjMwMTcyMjYtRkUyQS00Mjk1LThCREYtMDBDM0E5QTdFNEM1fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMTIzLjAuMjQyMC44MSIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNvbnNlbnQ9ZmFsc2UiPjx1cGRhdGVjaGVjay8-PGV2ZW50IGV2ZW50dHlwZT0iOSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iOTMzMTc5MzE2NiIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjkzMzIzNjM2ODkiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI5NjYxNzcxNDM5IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuZi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy83YTBhMGJkNi1iOWM5LTRjNTYtOTY0OS1lOWU5YzIyZmJlNDM_UDE9MTcxMzQ0OTQzNCZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1taTBUJTJmZkpSOWdIbkRmd0Z4bndjWWJLbTJBOWZiUTFnWXRmcjlyQnZRbWJLcXNORXElMmZkbG5ycnNPbnlXVjFSRng4cHo1WDBIcFVuR3BTQmFmM3dwVFElM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIxNzIwODY3NDQiIHRvdGFsPSIxNzIwODY3NDQiIGRvd25sb2FkX3RpbWVfbXM9IjE4MDg2Ii8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iOTY2MjMwMzA5NiIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjYiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9Ijk2ODkzODEzNzgiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIxOTY3NTciIHN5c3RlbV91cHRpbWVfdGlja3M9IjEyNTU3NzM2NzY4IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiB1cGRhdGVfY2hlY2tfdGltZV9tcz0iOTg2IiBkb3dubG9hZF90aW1lX21zPSIzMjk1MiIgZG93bmxvYWRlZD0iMTcyMDg2NzQ0IiB0b3RhbD0iMTcyMDg2NzQ0IiBwYWNrYWdlX2NhY2hlX3Jlc3VsdD0iMCIgaW5zdGFsbF90aW1lX21zPSIyODY4MzEiLz48L2FwcD48L3JlcXVlc3Q-2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
PID:720
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{232292C0-DB27-417D-9EC1-DA5300D010A5}\MicrosoftEdge_X64_123.0.2420.81.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{232292C0-DB27-417D-9EC1-DA5300D010A5}\MicrosoftEdge_X64_123.0.2420.81.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level2⤵
- Executes dropped EXE
PID:3524 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{232292C0-DB27-417D-9EC1-DA5300D010A5}\EDGEMITMP_14C97.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{232292C0-DB27-417D-9EC1-DA5300D010A5}\EDGEMITMP_14C97.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{232292C0-DB27-417D-9EC1-DA5300D010A5}\MicrosoftEdge_X64_123.0.2420.81.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:780 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{232292C0-DB27-417D-9EC1-DA5300D010A5}\EDGEMITMP_14C97.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{232292C0-DB27-417D-9EC1-DA5300D010A5}\EDGEMITMP_14C97.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=123.0.6312.106 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{232292C0-DB27-417D-9EC1-DA5300D010A5}\EDGEMITMP_14C97.tmp\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=123.0.2420.81 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff79986baf8,0x7ff79986bb04,0x7ff79986bb104⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1256
-
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{FF87BFB5-6AA2-46E5-AE44-F7BCD763DB4A}\MicrosoftEdgeUpdateSetup_X86_1.3.185.29.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{FF87BFB5-6AA2-46E5-AE44-F7BCD763DB4A}\MicrosoftEdgeUpdateSetup_X86_1.3.185.29.exe" /update /sessionid "{D323F2B2-B91F-47D5-A9B7-DF3A6E324297}"2⤵
- Executes dropped EXE
PID:2384 -
C:\Program Files (x86)\Microsoft\Temp\EU4084.tmp\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\Temp\EU4084.tmp\MicrosoftEdgeUpdate.exe" /update /sessionid "{D323F2B2-B91F-47D5-A9B7-DF3A6E324297}"3⤵
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Suspicious behavior: EnumeratesProcesses
PID:2788 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3456
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver4⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:236 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.185.29\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.185.29\MicrosoftEdgeUpdateComRegisterShell64.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
PID:4760
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.185.29\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.185.29\MicrosoftEdgeUpdateComRegisterShell64.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
PID:2836
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.185.29\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.185.29\MicrosoftEdgeUpdateComRegisterShell64.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
PID:1864
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODUuMjkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RDMyM0YyQjItQjkxRi00N0Q1LUE5QjctREYzQTZFMzI0Mjk3fSIgdXNlcmlkPSJ7RDJDNzIxNzMtQjAwMi00NTMxLUE4MEQtQzAyOUU5QjlGMUJFfSIgaW5zdGFsbHNvdXJjZT0ic2VsZnVwZGF0ZSIgcmVxdWVzdGlkPSJ7OUEzMjczMjUtQUEwNC00QkZCLTg3NTktQzkyOTRCOTQ0N0I3fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yMjAwMC40OTMiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iREFEWSIgcHJvZHVjdF9uYW1lPSJTdGFuZGFyZCBQQyAoUTM1ICsgSUNIOSwgMjAwOSkiLz48ZXhwIGV0YWc9IiZxdW90O3I0NTJ0MStrMlRncS9IWHpqdkZOQlJob3BCV1I5c2JqWHhxZVVESDl1WDA9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0ie0YzQzRGRTAwLUVGRDUtNDAzQi05NTY5LTM5OEEyMEYxQkE0QX0iIHZlcnNpb249IjEuMy4xNzEuMzkiIG5leHR2ZXJzaW9uPSIxLjMuMTg1LjI5IiBsYW5nPSIiIGJyYW5kPSJJTkJYIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMCIgaW5zdGFsbGRhdGV0aW1lPSIxNzEyODQ0NjMwIj48ZXZlbnQgZXZlbnR0eXBlPSIzIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMzA2MDk1NzMzOCIvPjwvYXBwPjwvcmVxdWVzdD44⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
PID:640
-
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QTA3NEYxQjItQzRCMi00MTY0LTgwQzItMDlGRDAwRjVFOEY2fSIgdXNlcmlkPSJ7RDJDNzIxNzMtQjAwMi00NTMxLUE4MEQtQzAyOUU5QjlGMUJFfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9InszMDk5MTQ5Ni1CQUYxLTRDQTMtQjRFRS02OUZEOEExMDBCMEN9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjIyMDAwLjQ5MyIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSJEQURZIiBwcm9kdWN0X25hbWU9IlN0YW5kYXJkIFBDIChRMzUgKyBJQ0g5LCAyMDA5KSIvPjxleHAgZXRhZz0iJnF1b3Q7cjQ1MnQxK2syVGdxL0hYemp2Rk5CUmhvcEJXUjlzYmpYeHFlVURIOXVYMD0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjMwMTcyMjYtRkUyQS00Mjk1LThCREYtMDBDM0E5QTdFNEM1fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMTIzLjAuMjQyMC44MSIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNvbnNlbnQ9ZmFsc2UiPjx1cGRhdGVjaGVjay8-PGV2ZW50IGV2ZW50dHlwZT0iOSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTIyOTQyNTY2NjEiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI1IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMjU1Nzk5NjQ2NiIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjEyNTcxMjE2NDUxIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTI1OTE1NjY4NDIiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIxOTY3NTciIHN5c3RlbV91cHRpbWVfdGlja3M9IjEyOTk2NzA2Njc3IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiB1cGRhdGVfY2hlY2tfdGltZV9tcz0iODg1IiBkb3dubG9hZGVkPSIxNzIwODY3NDQiIHRvdGFsPSIxNzIwODY3NDQiIHBhY2thZ2VfY2FjaGVfcmVzdWx0PSIxIiBpbnN0YWxsX3RpbWVfbXM9IjQwNTA5Ii8-PC9hcHA-PC9yZXF1ZXN0Pg2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
PID:4200
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RDMyM0YyQjItQjkxRi00N0Q1LUE5QjctREYzQTZFMzI0Mjk3fSIgdXNlcmlkPSJ7RDJDNzIxNzMtQjAwMi00NTMxLUE4MEQtQzAyOUU5QjlGMUJFfSIgaW5zdGFsbHNvdXJjZT0ic2NoZWR1bGVyIiByZXF1ZXN0aWQ9InswNUI3RUY3NC0yQzg0LTQ0NEItOTQ3RS03OTYxRTk1RTk5MkN9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjIyMDAwLjQ5MyIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSJEQURZIiBwcm9kdWN0X25hbWU9IlN0YW5kYXJkIFBDIChRMzUgKyBJQ0g5LCAyMDA5KSIvPjxleHAgZXRhZz0iJnF1b3Q7cjQ1MnQxK2syVGdxL0hYemp2Rk5CUmhvcEJXUjlzYmpYeHFlVURIOXVYMD0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE3MS4zOSIgbmV4dHZlcnNpb249IjEuMy4xODUuMjkiIGxhbmc9IiIgYnJhbmQ9IklOQlgiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIwIj48dXBkYXRlY2hlY2svPjxldmVudCBldmVudHR5cGU9IjEyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMjQyODY1NjUyNiIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEzIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMjU1ODAyNjU2MSIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjE0IiBldmVudHJlc3VsdD0iMCIgZXJyb3Jjb2RlPSItMjE0NzAyMzgzOCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTI3MzE3MzYwNjgiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIGRvd25sb2FkZXI9ImRvIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuYi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy83MmVkODA4Ny1lZTk4LTQyOWMtOTMzMC1jYTNjMTkzZDQxYWY_UDE9MTcxMzQ0OTc0NCZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1nWTRoZ1dOV3hlcFZyS1ozandBNTQ3TEM5MEVnbiUyZlVGWVNVYUVQbE1PVG5BcDFnam1OSnQlMmZQSW5ZMzRCMmc1dTF4T01SYyUyYlNKUnUxQTdKWVNLc0d4ZyUzZCUzZCIgc2VydmVyX2lwX2hpbnQ9IiIgY2RuX2NpZD0iLTEiIGNkbl9jY2M9IiIgY2RuX21zZWRnZV9yZWY9IiIgY2RuX2F6dXJlX3JlZl9vcmlnaW5fc2hpZWxkPSIiIGNkbl9jYWNoZT0iIiBjZG5fcDNwPSIiIGRvd25sb2FkZWQ9IjAiIHRvdGFsPSIwIiBkb3dubG9hZF90aW1lX21zPSI0Ii8-PGV2ZW50IGV2ZW50dHlwZT0iMTQiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjEyNzMxODI2Mzg2IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuYi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy83MmVkODA4Ny1lZTk4LTQyOWMtOTMzMC1jYTNjMTkzZDQxYWY_UDE9MTcxMzQ0OTc0NCZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1nWTRoZ1dOV3hlcFZyS1ozandBNTQ3TEM5MEVnbiUyZlVGWVNVYUVQbE1PVG5BcDFnam1OSnQlMmZQSW5ZMzRCMmc1dTF4T01SYyUyYlNKUnUxQTdKWVNLc0d4ZyUzZCUzZCIgc2VydmVyX2lwX2hpbnQ9IiIgY2RuX2NpZD0iLTEiIGNkbl9jY2M9IiIgY2RuX21zZWRnZV9yZWY9IiIgY2RuX2F6dXJlX3JlZl9vcmlnaW5fc2hpZWxkPSIiIGNkbl9jYWNoZT0iIiBjZG5fcDNwPSIiIGRvd25sb2FkZWQ9IjE2MzA3OTIiIHRvdGFsPSIxNjMwNzkyIiBkb3dubG9hZF90aW1lX21zPSIxNTkxMyIvPjxldmVudCBldmVudHR5cGU9IjE0IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMjczMTg1NjYxMiIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjE1IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMjk5NjczNjY4MiIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxwaW5nIHI9Ii0xIiByZD0iLTEiLz48L2FwcD48YXBwIGFwcGlkPSJ7NTZFQjE4RjgtQjAwOC00Q0JELUI2RDItOEM5N0ZFN0U5MDYyfSIgdmVyc2lvbj0iOTAuMC44MTguNjYiIG5leHR2ZXJzaW9uPSIiIGxhbmc9IiIgYnJhbmQ9IklOQlgiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY29uc2VudD1mYWxzZSIgbGFzdF9sYXVuY2hfdGltZT0iMTMzNTczMTgzMDU4MjU1MDMwIj48dXBkYXRlY2hlY2svPjxwaW5nIGFjdGl2ZT0iMSIgYT0iLTEiIHI9Ii0xIiBhZD0iLTEiIHJkPSItMSIvPjwvYXBwPjxhcHAgYXBwaWQ9IntGMzAxNzIyNi1GRTJBLTQyOTUtOEJERi0wMEMzQTlBN0U0QzV9IiB2ZXJzaW9uPSIxMjMuMC4yNDIwLjgxIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSJJTkJYIiBjbGllbnQ9IiIgdXBkYXRlX2NvdW50PSIxIj48dXBkYXRlY2hlY2svPjxwaW5nIHI9Ii0xIiByZD0iLTEiIHBpbmdfZnJlc2huZXNzPSJ7RTM2MTJGMzItODkyMy00RUQ1LTgzNkEtMDgwQzUzRjNBMDQyfSIvPjwvYXBwPjwvcmVxdWVzdD42⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
PID:2680
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:248 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffed21f3cb8,0x7ffed21f3cc8,0x7ffed21f3cd82⤵PID:4532
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1944,8520165830867768232,11436397209986929128,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1956 /prefetch:22⤵PID:2288
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1944,8520165830867768232,11436397209986929128,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4940
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1944,8520165830867768232,11436397209986929128,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:82⤵PID:1592
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,8520165830867768232,11436397209986929128,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:12⤵PID:3820
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,8520165830867768232,11436397209986929128,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:12⤵PID:1332
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,8520165830867768232,11436397209986929128,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4552 /prefetch:12⤵PID:2208
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,8520165830867768232,11436397209986929128,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4508 /prefetch:12⤵PID:3148
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1944,8520165830867768232,11436397209986929128,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3244 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3880
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,8520165830867768232,11436397209986929128,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4524 /prefetch:12⤵PID:4916
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,8520165830867768232,11436397209986929128,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:12⤵PID:2712
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,8520165830867768232,11436397209986929128,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4596 /prefetch:12⤵PID:2320
-
-
C:\Program Files (x86)\Roblox\Versions\RobloxStudioInstaller.exe"C:\Program Files (x86)\Roblox\Versions\RobloxStudioInstaller.exe"1⤵
- Executes dropped EXE
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\Roblox\RobloxStudioInstaller_54214\RobloxStudioInstaller.exeC:\Users\Admin\AppData\Local\Temp\Roblox\RobloxStudioInstaller_54214\RobloxStudioInstaller.exe -relaunch2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2716 -
C:\Program Files (x86)\Roblox\Versions\version-e2bc56a1e4374ca0\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exeMicrosoftEdgeWebview2Setup.exe /silent /install3⤵
- Executes dropped EXE
PID:4280 -
C:\Program Files (x86)\Microsoft\Temp\EU1FA3.tmp\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\Temp\EU1FA3.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Suspicious behavior: EnumeratesProcesses
PID:2828 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /healthcheck5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1560
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QTA3NEYxQjItQzRCMi00MTY0LTgwQzItMDlGRDAwRjVFOEY2fSIgdXNlcmlkPSJ7RDJDNzIxNzMtQjAwMi00NTMxLUE4MEQtQzAyOUU5QjlGMUJFfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntDQ0QxMDAxNy0xMEE5LTQxNzYtQjk3NC0xQzkwRUQwMjRBRUJ9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjIyMDAwLjQ5MyIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSJEQURZIiBwcm9kdWN0X25hbWU9IlN0YW5kYXJkIFBDIChRMzUgKyBJQ0g5LCAyMDA5KSIvPjxleHAgZXRhZz0iJnF1b3Q7VlBRb1AxRitmcTE1d1J6aDFrUEw0UE1wV2g4T1JNQjVpenZyT0MvY2hqUT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE3MS4zOSIgbmV4dHZlcnNpb249IjEuMy4xNzEuMzkiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjEyMjgwNDI2ODU0IiBpbnN0YWxsX3RpbWVfbXM9IjE2NyIvPjwvYXBwPjwvcmVxdWVzdD45⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
PID:4144
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{A074F1B2-C4B2-4164-80C2-09FD00F5E8F6}" /silent5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2268
-
-
-
-
C:\Program Files (x86)\Roblox\Versions\version-e2bc56a1e4374ca0\RobloxStudioBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-e2bc56a1e4374ca0\RobloxStudioBeta.exe" -startEvent www.roblox.com/robloxQTStudioStartedEvent -firstLaunch3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2352 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 620, 0, 6200463" --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=2352.4944.48341263126430982854⤵
- Executes dropped EXE
- Checks system information in the registry
- Drops file in Windows directory
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- System policy modification
PID:2784 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=123.0.6312.106 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=123.0.2420.81 --initial-client-data=0x17c,0x180,0x184,0x158,0x18c,0x7ffebc2f4e48,0x7ffebc2f4e54,0x7ffebc2f4e605⤵
- Executes dropped EXE
PID:2476
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 620, 0, 6200463" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1764,i,17481653056675097135,285837558871119396,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=1760 /prefetch:25⤵
- Executes dropped EXE
PID:2144
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 620, 0, 6200463" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --field-trial-handle=1908,i,17481653056675097135,285837558871119396,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=1896 /prefetch:35⤵
- Executes dropped EXE
PID:4488
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 620, 0, 6200463" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --field-trial-handle=2056,i,17481653056675097135,285837558871119396,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=2492 /prefetch:85⤵
- Executes dropped EXE
PID:1592
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 620, 0, 6200463" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --field-trial-handle=3204,i,17481653056675097135,285837558871119396,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=3400 /prefetch:15⤵
- Executes dropped EXE
PID:2512
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 620, 0, 6200463" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --field-trial-handle=3460,i,17481653056675097135,285837558871119396,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=4056 /prefetch:15⤵
- Executes dropped EXE
PID:4508
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 620, 0, 6200463" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --field-trial-handle=4232,i,17481653056675097135,285837558871119396,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:15⤵
- Executes dropped EXE
PID:896
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 620, 0, 6200463" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --field-trial-handle=1960,i,17481653056675097135,285837558871119396,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:85⤵
- Executes dropped EXE
PID:4664
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 620, 0, 6200463" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --field-trial-handle=4668,i,17481653056675097135,285837558871119396,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=2712 /prefetch:85⤵
- Executes dropped EXE
PID:3036
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 620, 0, 6200463" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --field-trial-handle=4768,i,17481653056675097135,285837558871119396,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:85⤵
- Executes dropped EXE
PID:1260
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 620, 0, 6200463" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --field-trial-handle=4732,i,17481653056675097135,285837558871119396,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:85⤵
- Executes dropped EXE
PID:1176
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 620, 0, 6200463" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --field-trial-handle=4736,i,17481653056675097135,285837558871119396,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=4708 /prefetch:85⤵
- Executes dropped EXE
PID:3880
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 620, 0, 6200463" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --field-trial-handle=4824,i,17481653056675097135,285837558871119396,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=2716 /prefetch:85⤵
- Executes dropped EXE
PID:3444
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 620, 0, 6200463" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --field-trial-handle=4772,i,17481653056675097135,285837558871119396,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=2576 /prefetch:85⤵
- Executes dropped EXE
PID:3820
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 620, 0, 6200463" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4724,i,17481653056675097135,285837558871119396,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=4804 /prefetch:85⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3504
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 620, 0, 6200463" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --field-trial-handle=4264,i,17481653056675097135,285837558871119396,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=4040 /prefetch:85⤵
- Executes dropped EXE
PID:488
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 620, 0, 6200463" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --field-trial-handle=1000,i,17481653056675097135,285837558871119396,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=4580 /prefetch:85⤵
- Executes dropped EXE
PID:4576
-
-
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:876
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2732
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Suspicious behavior: EnumeratesProcesses
PID:4820
-
C:\Windows\System32\GameBarPresenceWriter.exe"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer1⤵PID:2804
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
PID:4380
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.8MB
MD5149e6b831dee17cc2122c64124654b5a
SHA1c4f67f0781345cfc6fdfc5670dcbecf3848afee2
SHA2563095052d066346ec2b48726ef87623f3e5e93400c6dd8b1e45a628fc0d72cf40
SHA512679966f6a48ccf9cac63c36a8f6823ed1476198b08d29368db94584b2be2ba4cb1278f4f6510a520933fd09bb83594ab544c94be4c0b05f1d8ee99443fc49085
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Download\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\123.0.2420.81\MicrosoftEdge_X64_123.0.2420.81.exe
Filesize164.1MB
MD5cf5144a59c3b26558c05a5226c4b53fe
SHA1bcf541fbd1bf0168a2d63ead5b06d8918b89b296
SHA2563a848782e612b4fd77d4910acb1a6f91b1eea3336065d4643486ff17e24970ea
SHA5122d46fdc92c09257cfafc9bdd659413d7925f405d7b78a6d9a44e353984d9fd70b7c3e9b87475eeee80f984377fdbb884055f4a4f10b7972746811326bfeb9a34
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Download\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\1.3.185.29\MicrosoftEdgeUpdateSetup_X86_1.3.185.29.exe
Filesize1.6MB
MD5b18c705b3c68cc49d9bf3649abc75c24
SHA16dc8963dea0f3185368790dee2a346301b4fa24c
SHA256c2ca3135f3cafd79bf90d4cb3118943ca17f40e0d651d1fc32b1b3d22d1412aa
SHA5127ac302c1e85c652bd897ce1af812950cd23a53c041af82fdcecb2314bbd1667bf2fc672dea40c21858e64befc9bf60190a4428f0b41c30317bb0e5ec7c00f71b
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{232292C0-DB27-417D-9EC1-DA5300D010A5}\EDGEMITMP_14C97.tmp\SETUP.EX_
Filesize2.8MB
MD5f61e28fe9fe214412bbebf01364ba4e2
SHA153226fed5ed23999e9976d3bdb58a022f615e2de
SHA256b984972efacbc451574ef9325105b47e9a50835fff1660333afcf46109c0b015
SHA5125242456b1f6b0cbe955c7e1fd341ced5c7ed1de267483ca7ab41129635c3c1daff848b562f3bb0f2ee3cd9c8ad26071c1b51b2b69e1f9c363be5abcf34dd2b02
-
Filesize
12KB
MD5369bbc37cff290adb8963dc5e518b9b8
SHA1de0ef569f7ef55032e4b18d3a03542cc2bbac191
SHA2563d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3
SHA5124f8ec1fd4de8d373a4973513aa95e646dfc5b1069549fafe0d125614116c902bfc04b0e6afd12554cc13ca6c53e1f258a3b14e54ac811f6b06ed50c9ac9890b1
-
Filesize
179KB
MD57a160c6016922713345454265807f08d
SHA1e36ee184edd449252eb2dfd3016d5b0d2edad3c6
SHA25635a14bd84e74dd6d8e2683470243fb1bb9071178d9283b12ebbfb405c8cd4aa9
SHA512c0f1d5c8455cf14f2088ede062967d6dfa7c39ca2ac9636b10ed46dfbea143f64106a4f03c285e89dd8cf4405612f1eef25a8ec4f15294ca3350053891fc3d7e
-
Filesize
201KB
MD54dc57ab56e37cd05e81f0d8aaafc5179
SHA1494a90728d7680f979b0ad87f09b5b58f16d1cd5
SHA25687c6f7d9b58f136aeb33c96dbfe3702083ec519aafca39be66778a9c27a68718
SHA512320eeed88d7facf8c1f45786951ef81708c82cb89c63a3c820ee631c52ea913e64c4e21f0039c1b277cfb710c4d81cd2191878320d00fd006dd777c727d9dc2b
-
Filesize
212KB
MD560dba9b06b56e58f5aea1a4149c743d2
SHA1a7e456acf64dd99ca30259cf45b88cf2515a69b3
SHA2564d01f5531f93ab2af9e92c4f998a145c94f36688c3793845d528c8675697e112
SHA512e98088a368d4c4468e325a1d62bee49661f597e5c1cd1fe2dabad3911b8ac07e1cc4909e7324cb4ab39f30fa32a34807685fcfba767f88884ef84ca69a0049e7
-
Filesize
257KB
MD5c044dcfa4d518df8fc9d4a161d49cece
SHA191bd4e933b22c010454fd6d3e3b042ab6e8b2149
SHA2569f79fe09f57002ca07ae0b2a196e8cc002d2be6d5540ee857217e99b33fa4bb2
SHA512f26b89085aa22ac62a28610689e81b4dfe3c38a9015ec56dfeaff02fdb6fa64e784b86a961509b52ad968400faa1ef0487f29f07a41e37239fe4c3262a11ac2c
-
Filesize
4KB
MD56dd5bf0743f2366a0bdd37e302783bcd
SHA1e5ff6e044c40c02b1fc78304804fe1f993fed2e6
SHA25691d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5
SHA512f546c1dff8902a3353c0b7c10ca9f69bb77ebd276e4d5217da9e0823a0d8d506a5267773f789343d8c56b41a0ee6a97d4470a44bbd81ceaa8529e5e818f4951e
-
Filesize
2.0MB
MD5965b3af7886e7bf6584488658c050ca2
SHA172daabdde7cd500c483d0eeecb1bd19708f8e4a5
SHA256d80c512d99765586e02323a2e18694965eafb903e9bc13f0e0b4265f86b21a19
SHA5121c57dc7b89e7f13f21eaec7736b724cd864c443a2f09829308a4f23cb03e9a5f2a1e5bcdc441301e33119767e656a95d0f9ede0e5114bf67f5dce6e55de7b0a4
-
Filesize
28KB
MD5567aec2d42d02675eb515bbd852be7db
SHA166079ae8ac619ff34e3ddb5fb0823b1790ba7b37
SHA256a881788359b2a7d90ac70a76c45938fb337c2064487dcb8be00b9c311d10c24c
SHA5123a7414e95c2927d5496f29814556d731aef19efa531fb58988079287669dfc033f3e04c8740697571df76bfecfe3b75659511783ce34682d2a2ea704dfa115b3
-
Filesize
24KB
MD5f6c1324070b6c4e2a8f8921652bfbdfa
SHA1988e6190f26e4ca8f7ea3caabb366cf1edcdcbbf
SHA256986b0654a8b5f7b23478463ff051bffe1e9bbdeb48744e4aa1bd3d89a7520717
SHA51263092cf13e8a19966181df695eb021b0a9993afe8f98b1309973ea999fdf4cd9b6ffd609968d4aa0b2cde41e872688a283fd922d8b22cb5ad06339fe18221100
-
Filesize
26KB
MD5570efe7aa117a1f98c7a682f8112cb6d
SHA1536e7c49e24e9aa068a021a8f258e3e4e69fa64f
SHA256e2cc8017bc24e73048c7ee68d3787ed63c3898eec61299a9ca1bab8aeaa8da01
SHA5125e963dd55a5739a1da19cec7277dc3d07afdb682330998fd8c33a1b5949942019521967d8b5af0752a7a8e2cf536faa7e62982501170319558ceaa21ed657ae8
-
Filesize
28KB
MD5a8d3210e34bf6f63a35590245c16bc1b
SHA1f337f2cbec05b7e20ca676d7c2b1a8d5ae8bf693
SHA2563b82de846ad028544013383e3c9fb570d2a09abf2c854e8a4d641bd7fc3b3766
SHA5126e47ffe8f7c2532e7854dcae3cbd4e6533f0238815cb6af5ea85087c51017ea284542b988f07692d0297ebab1bad80d7613bf424ff532e10b01c8e528ab1043a
-
Filesize
29KB
MD57937c407ebe21170daf0975779f1aa49
SHA14c2a40e76209abd2492dfaaf65ef24de72291346
SHA2565ab96e4e6e065dbce3b643c6be2c668f5570984ead1a8b3578bbd2056fbad4e9
SHA5128670746941660e6573732077f5ed1b630f94a825cf4ac9dbe5018772eaac1c48216334757a2aeaa561034b4d907162a370b8f0bae83b34a09457fafe165fb5d7
-
Filesize
29KB
MD58375b1b756b2a74a12def575351e6bbd
SHA1802ec096425dc1cab723d4cf2fd1a868315d3727
SHA256a12df15afac4eb2695626d7a8a2888bdf54c8db671043b0677180f746d8ad105
SHA512aec4bb94fde884db79a629abcff27fd8afb7f229d055514f51fa570fb47a85f8dfc9a54a8f69607d2bcaf82fae1ec7ffab0b246795a77a589be11fad51b24d19
-
Filesize
29KB
MD5a94cf5e8b1708a43393263a33e739edd
SHA11068868bdc271a52aaae6f749028ed3170b09cce
SHA2565b01fe11016610d5606f815281c970c86025732fc597b99c031a018626cd9f3c
SHA512920f7fed1b720afdb569aec2961bd827a6fc54b4598c0704f65da781d142b1707e5106a459f0c289e0f476b054d93c0b733806af036b68f46377dde0541af2e7
-
Filesize
29KB
MD57dc58c4e27eaf84ae9984cff2cc16235
SHA13f53499ddc487658932a8c2bcf562ba32afd3bda
SHA256e32f77ed3067d7735d10f80e5a0aa0c50c993b59b82dc834f2583c314e28fa98
SHA512bdec1300cf83ea06dfd351fe1252b850fecea08f9ef9cb1207fce40ce30742348db953107ade6cdb0612af2e774345faf03a8a6476f2f26735eb89153b4256dc
-
Filesize
28KB
MD5e338dccaa43962697db9f67e0265a3fc
SHA14c6c327efc12d21c4299df7b97bf2c45840e0d83
SHA25699b1b7e25fbc2c64489c0607cef0ae5ff720ab529e11093ed9860d953adeba04
SHA512e0c15b166892433ef31ddf6b086680c55e1a515bed89d51edbdf526fcac71fb4e8cb2fadc739ac75ae5c2d9819fc985ca873b0e9e2a2925f82e0a456210898f9
-
Filesize
29KB
MD52929e8d496d95739f207b9f59b13f925
SHA17c1c574194d9e31ca91e2a21a5c671e5e95c734c
SHA2562726c48a468f8f6debc2d9a6a0706b640b2852c885e603e6b2dec638756160df
SHA512ea459305d3c3fa7a546194f649722b76072f31e75d59da149c57ff05f4af8f38a809066054df809303937bbca917e67441da2f0e1ea37b50007c25ae99429957
-
Filesize
30KB
MD539551d8d284c108a17dc5f74a7084bb5
SHA16e43fc5cec4b4b0d44f3b45253c5e0b032e8e884
SHA2568dbd55ed532073874f4fe006ef456e31642317145bd18ddc30f681ce9e0c8e07
SHA5126fa5013a9ce62deca9fa90a98849401b6e164bbad8bef00a8a8b228427520dd584e28cba19c71e2c658692390fe29be28f0398cb6c0f9324c56290bb245d06d2
-
Filesize
28KB
MD516c84ad1222284f40968a851f541d6bb
SHA1bc26d50e15ccaed6a5fbe801943117269b3b8e6b
SHA256e0f0026ddcbeafc6c991da6ba7c52927d050f928dba4a7153552efcea893a35b
SHA512d3018619469ed25d84713bd6b6515c9a27528810765ed41741ac92caf0a3f72345c465a5bda825041df69e1264aada322b62e10c7ed20b3d1bcde82c7e146b7e
-
Filesize
28KB
MD534d991980016595b803d212dc356d765
SHA1e3a35df6488c3463c2a7adf89029e1dd8308f816
SHA256252b6f9bf5a9cb59ad1c072e289cc9695c0040b363d4bfbcc9618a12df77d18e
SHA5128a6cbcf812af37e3ead789fbec6cba9c4e1829dbeea6200f0abbdae15efd1eda38c3a2576e819d95ed2df0aafd2370480daa24a3fe6aeb8081a936d5e1f8d8ed
-
Filesize
28KB
MD5d34380d302b16eab40d5b63cfb4ed0fe
SHA11d3047119e353a55dc215666f2b7b69f0ede775b
SHA256fd98159338d1f3b03814af31440d37d15ab183c1a230e6261fbb90e402f85d5f
SHA51245ce58f4343755e392037a9c6fc301ad9392e280a72b9d4b6d328866fe26877b2988c39e05c4e7f1d5b046c0864714b897d35285e222fd668f0d71b7b10e6538
-
Filesize
30KB
MD5aab01f0d7bdc51b190f27ce58701c1da
SHA11a21aabab0875651efd974100a81cda52c462997
SHA256061a7cdaff9867ddb0bd3de2c0760d6919d8d2ca7c7f889ec2d32265d7e7a75c
SHA5125edbda45205b61ac48ea6e874411bb1031989001539650de6e424528f72ec8071bd709c037c956450bb0558ee37d026c26fdb966efceb990ed1219f135b09e6e
-
Filesize
30KB
MD5ac275b6e825c3bd87d96b52eac36c0f6
SHA129e537d81f5d997285b62cd2efea088c3284d18f
SHA256223d2db0bc2cc82bda04a0a2cd2b7f6cb589e2fa5c0471a2d5eb04d2ffcfcfa0
SHA512bba581412c4297c4daf245550a2656cdc2923f77158b171e0eacf6e933c174eac84580864813cf6d75d73d1a58e0caf46170aee3cee9d84dc468379252b16679
-
Filesize
27KB
MD54a1e3cf488e998ef4d22ac25ccc520a5
SHA1dc568a6e3c9465474ef0d761581c733b3371b1cd
SHA2569afbbe2a591250b80499f0bf02715f02dbcd5a80088e129b1f670f1a3167a011
SHA512ce3bffb6568ff2ef83ef7c89fd668f6b5972f1484ce3fbd5597dcac0eaec851d5705ed17a5280dd08cd9812d6faec58a5561217b897c9209566545db2f3e1245
-
Filesize
5.1MB
MD54f9d28edc0c431adbfcc19d8fa47702f
SHA137a6e145fec66acce633199ea7261bf5dd3d855b
SHA25617e5cfe0cd5e01c1cf679b2fb7da7f3eae6cac2481c41f355c23df375ee0b48d
SHA512bb7a5f33e2ef384347f8ffa09381aee5609a5b4997a205c972e7d431effa8c89f47e065b41f3acd86c2a395e0fdcd2fa656b57c84c3b94bb2fbde52ed2284dc3
-
C:\Program Files (x86)\Roblox\Versions\version-8950870ea20941f9\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe
Filesize1.5MB
MD5610b1b60dc8729bad759c92f82ee2804
SHA19992b7ae7a9c4e17a0a6d58ffd91b14cbb576552
SHA256921d51979f3416ca19dca13a057f6fd3b09d8741f3576cad444eb95af87ebe08
SHA5120614c4e421ccd5f4475a690ba46aac5bbb7d15caea66e2961895724e07e1ec7ee09589ca9394f6b2bcfb2160b17ac53798d3cf40fb207b6e4c6381c8f81ab6b4
-
Filesize
14KB
MD5523543a801a1ba398c8e8ba0eef9b480
SHA10f29a8cb02995b60e267544f839c1f3ccb45ea9f
SHA256377188faf8712950367435120403d436c8e179885ffde674372f271d78ef9874
SHA512464fcc7e9b052b1901c97cb8ae2d0620a55b8e20a8bbb6a21627fe905464f347b2eb97aec4a4e3017d75a23d5d70e46cb671c9a2ec69c229bc4e32624f006e39
-
Filesize
51KB
MD5588ee33c26fe83cb97ca65e3c66b2e87
SHA1842429b803132c3e7827af42fe4dc7a66e736b37
SHA256bbc4044fe46acd7ab69d8a4e3db46e7e3ca713b05fa8ecb096ebe9e133bba760
SHA5126f7500b12fc7a9f57c00711af2bc8a7c62973f9a8e37012b88a0726d06063add02077420bc280e7163302d5f3a005ac8796aee97042c40954144d84c26adbd04
-
Filesize
5KB
MD5164dbc080cecc499fa329c2d93735160
SHA19b45739f7ee3da60f80fd001b1ecfb871e6f9482
SHA2565f1cdc7eb89ee27eee5b14148b4e254c8c8802a7074f415108cded3368ba23c1
SHA5126fa9549f1347521e49aa3d2ba806a74cd2bccdce99ad0d80cb3c2eee621eac46251174e7bb28609a7f0a220241edfe0ad5c4949db9dfd1bd6db6eb59811168ca
-
Filesize
4KB
MD517dd6914fdd7b50414bd4e16c8f075db
SHA143dd8f2397fd9168b15119b1669d100a716c9584
SHA256a89373573ef8238d39af88331c8c1940ee8aee239215a3ec2fe05950c256c7e1
SHA512295b4a00be57bef04d1feb98614cb50a44fda0260773409c465cec4e2f94fe6dd0febad163e8bc9b73d97ff87013dbee1e489a5bf5a4d8c48b4f719d664965b6
-
Filesize
6KB
MD542e08de16b5116948a6ab1f8f3ea7197
SHA165fb31f80beb9cb0ae1d5eac39db1b97d5575be4
SHA256f7aabec08e28c65170e5b6cce98e305ae85499bbac0917a8d2bd2c095b9099f2
SHA512d297ac8c956ac74166e3aa00283ea86a71c5425692e465eec93cc78bf73e5f481159852b8f292c399a25149c84433d201f8c0cc5bd8681345694b7efdc25c7ff
-
Filesize
6KB
MD5174bae740500c348986fdd4998377ceb
SHA108a5e3d847c33055b2e4f3957e98182671ea8376
SHA25620a8968f7583a0fffdff8ccac9af58df5777c551d79075f7cdbcc9c10bcbf4df
SHA512bdb19b79172e56724ec5bf83c012e6e5b096703ad114571c197363475ec1342bb783cee689289fee563c8cb93d39176f59de797bb3f175b27b1ecb77b18d02be
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\CURRENT
Filesize16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG.old
Filesize387B
MD5b2fd5fec0e248fa4545ee75f2263b5fe
SHA1725db22865ad8735bf246775a73c8f6328e5f358
SHA256c34011983f23d145ccc4858c695fe7a5d773a30862c998c93aa24854160b0b36
SHA51272d762933a190619f676ba12a81a6e290e9942d7040ce16a50c902ac6ffe58494f356268139c645800f63e66798e6804996d9175b16431e52d6240bd6e0fb904
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG.old
Filesize387B
MD51e2e4885c85f24dd15174dff81278911
SHA1921c6435f5afdc97ae37cdbcc81a54132e1c4613
SHA256759b81f7bf54a0cbadfed10dfdf4922141c242c0e9ed278534d68451923bde51
SHA512e3dcf1727e34adeae7945472c639b31ccdd11f1a67b1ce8b787f515b3411ffcd287e1bda947100a20d7bd0674f2ea5597f96b8b26fca453efc4a02f344d5b032
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG.old
Filesize387B
MD5aec1e65974d15a7807b3d881fbdcda8a
SHA1714adf8add1bf2ec016cc67127b813ec1fc2c4cf
SHA256a9018372876f108a39ce890141b47e0b38c61243920f7a2831f402c67c9061b8
SHA5127e611996d547dc436a5e49d6f1dc9a6056ed28af8f781610cd227c02bca69bada5d8ee0c4ee4f2cf2eaf5170ade591643e8ac10102b4d0153df378e354224a2d
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG.old
Filesize387B
MD57d7ef82a76fbd461bcb9e9df7e2b6c34
SHA1e1dfb5235a11fb0741d33db6c12a61d1602b70e7
SHA25651c7197aff92266956ec762767325434aa7be2c394604f4665a4079c71e0b8bd
SHA512467a88cd8689f264b7616a4e786a87aefba7560506a3eb08c705310d89f53d083e75391d5e70306187f3c1861cd4617447b761b3b07fc9b0543812497d449aeb
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG.old~RFe5956d1.TMP
Filesize347B
MD5c5fbb254878f336e2ca4b10f61c0b5d7
SHA1a33b333ec1ceb1e2d3af5b52573593db883053c8
SHA2569698842279a7c393df249aed157b14d873dc25e80e3dc52ab6a0808ed5688013
SHA512f5a658d611938a98f1ce6924a783f82db75cf55d86395c3ecc16428c8b92557ebe2efc7bee465badce843a369c259bfbf8ae8e9c4277c9ba01b90a3fbeba4717
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\MANIFEST-000001
Filesize23B
MD53fd11ff447c1ee23538dc4d9724427a3
SHA11335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA256720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
SHA51210a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\5a4def15-e544-40ef-9793-bba0e67a7881.tmp
Filesize2KB
MD5fe81625bf80b09dc825f9915e2f60865
SHA1fedb9d925bb495075ac9965a31df1fd530b32dab
SHA2560254682dc9341ec4f0dfb5a9447f89952c9d5ca18de4d75c35d5357c83d99c05
SHA5120a3caae51b188c6822d9a7dd0cea40390516bcdfcabaee719e95b6cc162b59875c134a1e5a7b279bf975fd6b23fbcaf615a6705fb8d9ecc087c31239ddb5099a
-
Filesize
10KB
MD56f8a8406439fb70ed8ebc3ccbd017dd5
SHA1c893212fec025efd3e1a0c847e61b4df1b851cfb
SHA2566232296c182fd71a7a936147e14a06072a0e32abc2caf5e9020b1f0143866412
SHA5121dcaed82a79d695f2e838f310e554690d63366725acb855efb33cb9c2f20b51330c359b3ef4911542ca2de2c675cc793b05c4d5c368d7ddeee51ca4f13200225
-
Filesize
12KB
MD5d894da66eb6743c21ca5fcc9a92e98bf
SHA1eb66595eac7ef18fe1ebae253aff70d52a674de1
SHA256a2563f2f3ca0c4defe45766b9c82d397873bebe9def0174d730f22a485b5fd06
SHA512eac1e2e94c00c7b3b767b8fa2b58bf31699fdff94b83c4f2aa01d8d3945c83a8c28ab006065dd542d8b42b130730716d7885f48f131b4f7b7bd0312bb67e8ed4
-
Filesize
7KB
MD50e023e2d44082aadbbdf78b95e1bcf8f
SHA1a8adbe5db26ec42c313e2b047dc23f886e486e23
SHA256ccf6d1e60d270f498333ac1615720597f017436d95ba4e6a0a827b77f8652fa0
SHA5123adf85c184c57e446b66628d1d4a8346942fdfc63fbc1157dd4ede2048604dcf19d164f10aa9bfdb4fe0943dd96227d881f452c16a91669f10b09c73d247ca86
-
Filesize
8KB
MD53885cc3186fcb2a1040550365f22b1f3
SHA1079a2a7068e2e5b1be58891e77e562198f9bcb2b
SHA256399c47b0e550c4d4faf9bccdf3a225cd748352483d80449d62686069192f84f2
SHA5121181d0b05c1765a2fc8c3a4d844ed34534bd10098f1c419efa4af92809db4aafa787644d99628d452bfc7f6da43fccf584463d5921c8e5971a2796c26d022239
-
Filesize
9KB
MD56c318cfbc0fe506f24aacac1611f4794
SHA1b60ce95f37a82a5552835e01e2e28287d4b93f5b
SHA256c5e6672d9292525b21c44cceee6fb6b302e8420d83ecccbb2c9a1ba1eca9752f
SHA51249a6d71c9516883ca3c43ed979a17a111cf36195f0e336c25094f95458ffc72e0f30da05384cba4f00533844748c40f190ef8364842f66eef5226338e225ba5d
-
Filesize
539B
MD569182df0c8ec5eec3e6f2397cd45111b
SHA14830136ab841b4b6512cce22e587dece2340d616
SHA25645de6a77d8e87fa4332f844c66443f34a9f24e8d9233d33b0b6ec03ad8e16993
SHA51245d6a2dee247422fb64e0221b14718ccfe8ed74286ff198af02e7b7325ce7ade2f4117d2fd43bed98ce223deb70a12d88291e0455983aa2a5803493bfd8d1a0a
-
Filesize
2KB
MD5140bf4db745ef1a661f9618371e13999
SHA167fadd6c26682f0f75dd72e0d7c026bbfd0c78ff
SHA256a9d8d9682c80e7b44c87639ce2507fe35e94b676d25ffaacc29d3ecfc6efdf9c
SHA5126cf449efad884b00116b4900d39ae4bd5aebe0d12d92f9cc5c95d55f1cf1bcd3aa1c6c08a23755feb6c1a5f87d97d26dd1e89fbc3c2e48e329744920c252fe60
-
Filesize
4KB
MD53c4b3cc1b5964be8de2572e1bb856a22
SHA1dfbf61a14e21a456e117d6b808c364f2910ac974
SHA256889b7268de5b92de50a68bfeae6e2640cdc607ec014e86afb7aa806078dc7ba2
SHA512a5dfd9c6ac2d1e2566cf46d3124197cae915545be9f4301e322240c0ea3f6f42e09ce875fd66ed6739a0751236ecfe6acb1a5311bafbb0ef16717e46b630e329
-
Filesize
4KB
MD5bcfa3ea5ba9d3aebb8d63658e3295155
SHA169d53465de2f1ea56392d0d612024eab202cce71
SHA2565d8dd0e690f43e826dda0c73e3fbd1cd7dc2617ae283aba6bc6fb84d108f68e3
SHA512cadcba09f3ef16d0b1ec0f4a5fd1f4f07eac7a44b6852a0ac33949b5b5b9718280fd1d5de9d041502be0cc70e971edb4ed6498f85859c6bdcf47c25b5c40ef4e
-
Filesize
4KB
MD545a70b8d14fe41f4bba6f771a760ae7e
SHA154f4d7538b3030fa0f19c252c9246fd3621422c0
SHA25653649f3e52d99a111b6f976ef7bcfee38bc19a2f40bc77cee6229d61bb9de671
SHA5121bd37921683457a9764a655b4cbc2709f252aabe2deba0ab83457d2a6c92e258b8e102eab5a34bac18ff16b9729ec988840d0b042880a38767b58ef2c1afa155
-
Filesize
4KB
MD5e4f6e7abe0f7ee838ab2cb5865e84a7a
SHA1bf9c7209b46fa1fed2ec0cd47052a11f8ca08385
SHA25685a32883d8bdee0074df655eeddd8a7cd5e4cf7076b94a6bf27a5bd2c5b22bd6
SHA512450a8a82438348a52b83966e5602d82be71a977739b4083fe9f6a6ee3f314519195d59dbedf4fccc0e28683019fa05966880202fc4f170cf365f13d1006aa3fc
-
Filesize
5KB
MD5e6c2f01f0033bf153fa3f4d7fd96c82e
SHA1af0aab56de235bde4945cf50272915f4b783e85e
SHA256b5ce922b61d1ba5dcc9caa32d917596b7514c50eb7db831a3f59aec4f6c1ede2
SHA512173077cf0a082ec7e762481e02a5dcc23dec1ab0a1bb04341026bec4630aa165797491bcdf3e0ca2f542a025089a7cbae71b511d05ca1a1ff6a99308cea20d49
-
Filesize
5KB
MD5f7f4464b8ff69fb31bb1cd90ee3a96b6
SHA190026b75646b3ed89c2bea1459c67d9012f469eb
SHA256310e8050e2a5d03f563d2dc22bb3add18cb20bda10f6aa728a8a23572953be70
SHA512c8d5c4ad62df4f8724e77136d9e2b4208b77bf4dd3ef7057386cfb94a0d421903ee2e457d031afd787249c284243e0f1b4e5ea2783b1d043aa035104cef31e65
-
Filesize
5KB
MD570079342df471928ac4c391d13669c33
SHA133d2d604d02deb1276affdcc7b49d3e1256e100f
SHA256330b67a72bb425c487fceb84b74a69f606c488951bdf73f57d3c3802d2258672
SHA51224ae61d4b71e34941927bff9d90a2cd1cd1313e39f46bcebbb1e6141beba95831d065d65ce75cd42262d15a8ef583168e70a7d3d16a73a81ea5a767e36d5b15a
-
Filesize
5KB
MD5ce13e251c59f8c51233f39a57a99b31b
SHA1d19c6ea3465d04e13d92f0b4302dc6f39ef6bbbc
SHA2564c5eb2db4d1ad1084dfd40a27c2ebafcd90472b80434f8cca1bde2648335bf1f
SHA512832ca7d58b34a4d14f921ba56e193a0ef1111afd695b8122da42785ed71f60d36dfe450379f695576ce235a580b0350d083ffd5046920c311f207e440437f5d9
-
Filesize
5KB
MD5378dc6cce007294bc5a905ddb1ae4798
SHA13e61c7372767681f6b1bfce4e735f8d407e9ae07
SHA2563db3f63f36521c7494bba2a53717cdee46d86be69beafb24119bdcf87f6be64f
SHA51282b3e1b29f30231c21161b74211ca6376b043c1e7eb18e6cfe464da25710f32264ae0311c2f4e475050eddd46a282faa20e3adf07ede3b1720f809cc7ac27490
-
Filesize
5KB
MD54c547cb58affeeb049c71c69cf3209e0
SHA1f7766fca8256127559de136ea79744f21a33c309
SHA25601c5eee3a37985add6cb529a1ef718851b89777bfc75289fa7cc3aae003d1966
SHA51245acea1cd48a0e545b5023acd4e8ed57e8923c11a936422b4179a24a3e1d0ca571549d8fa7efde67248ee8629df8925c1bd11bbdab56ad950f940e18c605649f
-
Filesize
5KB
MD527a9e92f18f6d6ca94393b69f0f15b8f
SHA14b762cebe1dc6f2acadd380b15dd1c86ab419832
SHA256f5dd1e4d9d974db49eb735f69a2842a26005ccf579aaecaad37b8bc75612f3ad
SHA5122db69d19f4c6e5f7640fee69445f03366954cc3ca49ca7666f712a699ca3ef1668afb90f53265607a436b7cb34ed660ea32d5b4589c36ce957ab93d7991f6cce
-
Filesize
5KB
MD53e976bc78c267aa84e7ccec6326cc69f
SHA1347ad541df0f9dfd7620d0017083d1ef9ad1b66a
SHA25688c3b19606ed91e571d4e3e99daf8654ee31b35505a4c30ad85201f4b1a60bfa
SHA512269be41136e663df4cd933353dfcab95e7c5bcd850f7b327cfc818bf495514e8e07feb5aaa4d62c3debb09acf697cbfffc5bd7fbd81019643eff1e470040218e
-
Filesize
5KB
MD5b1803b7c86c927dcdf2df47f7dfd1da5
SHA183c895df55df8f5339244f587d77672add26296d
SHA2568ff2291860206573da087953191e7dedd1e9fecd4f07d6c557bda2ce66f8552a
SHA5125ef58428cb355354a848b660a56aca8a4c2ad8330a726de554313da83714d3e972efee460d19f9f6133e3ca534f32d0993c1d576b6acbce956fc458cb8bef18f
-
Filesize
5KB
MD5c6f2e8cf4ea1adc6a1b1c74705771910
SHA1d3b83e635f8c9c4d1f80863b387dc92597e89377
SHA25695759103c795739d124dea490d825ffa2f017b4eb217cdc24bb09da692bfd27f
SHA51220ec779038c9c76c2ca31eb48f54ce0376157f72ba94a0b22947e79b1e7160cb6b5bd46a96d9311b33016da44ddd565ed12ab0af4d4e8bc165df77cc9224ad65
-
Filesize
5KB
MD55032181bb1264d29f57f115fccc72d95
SHA1122389c3619b6decbf1f26c7fce62c4542d94a17
SHA256d25d894d75d24693184455a4e7b7255c6f28ea3f2144973aabf2efaa5f94b18c
SHA512447473f8ca5133b7464f60950e6866618e528a714fb95c602abf979102ae4b4cc9caacae4a20754ab82e00b57a0f3cdc87a207bb3848af3144ddb475bb1beced
-
Filesize
5KB
MD5459043bd24dabbf24a2e40a12519ce7e
SHA10d66113692a7f9833ad9e79668e8a447dc8ba9db
SHA2566d4e71c4834e23cc22c214c1aa99510c3c34afa20a137f85aedbc4d41187cb01
SHA512aea1b29f87768e73439ed0a708aa3e4ba2a695704a3b3656b1446c81e20e542da318dcc0a42eeb3f6838814a37c019a5c9d728a2e0366e86b2a63a39bcea516e
-
Filesize
5KB
MD509772a6b3946d42e55e30ba266331622
SHA103bdce9b031a2b86d10e9eba777a4d90f8a3dfb7
SHA256695c5b111ae9f1378d8899911c534ac3f2f42d72e853851d2cd3165f8bd646a1
SHA512a4bbe04fdacdff3e0b1db2778b1971d108fe5710479f5ae58d12a2208d7c7e07700b3f0e00f3a9d4798bf480ca009f776bf42c8a98e680aa6c12347dbf2d9fe5
-
Filesize
5KB
MD53a60d0c801c4967bb1c9b7bbcd46419a
SHA18e8bed6342525132d1488563446f2fdde2e2b844
SHA2567db1af213298da366e0a9e7a9ef948e8090557d3c124815f812a4194681bf587
SHA51211d05198b9de9bf077e48a7e7808ff3a3092d93adc772683f024624d8e8f86e820a2092e68e7a1267212f300d6e51656ed04c92f751786abbc451c0a6c3db5e2
-
Filesize
5KB
MD50c89e3ad2b26d2629dec176ea66187c4
SHA1d63f12fb8b59c8b60d54a4eb5fa66d57acdbd1d5
SHA256a1bb70515a3e68dfcc56e6fcfd5875f97c79c8725f2e2f93bf64cdf7ea427ca6
SHA5127c78a63aca41c90f5f20e60949c4110324b7abcfdeb2a73ec31e08c450915c16c6dafd19c9951603d3249429ab4f83f619bf9d569ca4778c4e309fff587f855a
-
Filesize
5KB
MD516ecd1bd36340c4563d382605b71cb16
SHA1de9f147f0ca25b16bee4f0fce048fe3204a73550
SHA256735e7dfb42a3cc70d4f6e69e649bcc78cfe0395ad287f6b3255548e0be65ef6c
SHA5124ba2338c2b01ae536473250f1d363114a0f8092fdc82acb61a8e43a4a88c156edd70f3636ec55f9da0ea696b6931ad83183d20c6a64f1480186e313a5b9d41a6
-
Filesize
6KB
MD589515e0c6ba69f62e3ea397efbb350ee
SHA1aca6b82b9c5330b949b8d0a7155bfcc0fcaddefb
SHA256950e04ff4431b5fbcf055b918c5564d9d21fc9d1fc1be9de7cc3377693fba112
SHA512f14c98eed44420e27c98d008577d669751966a5224da84196cb8d1ce016958704eb45f3aa427b1bfc4d2a9a62fc5b7ffb7b637e238351cfea44e861906aec398
-
Filesize
4KB
MD5aebd77179a964261a1692e8efc2cc977
SHA175ffa3da04ec7da557b1427bff3d5c2d5e27b4d0
SHA256ca436588eb8ba530c084b902f7f76c6d624a8c5e5a8e6d09bc8089cc17fbf987
SHA512a2453749e3a58ff94f83769d180998b0dbc1bc4db3ae9738f02967a61409707f28376e344a1f4ed734932c182b75ca10173ace9be18ef5019eacc6cf81e33c00
-
Filesize
2KB
MD59a844e2a3fe687b852030be1d6ab671c
SHA154c89281b539e5ba57793f5f81f6a7b4b6e7cb31
SHA25653e6d50404c3b5ec61fc6247e17af1682383c12080dd9c5dfbe49346c51b43aa
SHA512e50305056832415371859e8a5d36269c84e6d48824c54f4f895f054a7423df06a9761c0d6ee761ff849e5fa20370137a53147030f7869493e85890eb86e98bbc
-
Filesize
4KB
MD527620f24bda46e1f11b8f78d7dee1d11
SHA1861585efee7a0f70d91db27c8d5d3074cd28d702
SHA256164e38a23fd3fc92723c4a5f14c2a36ba14f53d8c2b2b2e83de113695c1e9b09
SHA51257ed0877bc4ad27cc6d4b680eee159ed72b7254a19696ce70f85dfdb19d8ad3520333042f2a821ed814316a7e695378f219433d3067fce6f535efe41510c24d3
-
Filesize
6KB
MD53f415f528df6ca53e85728ee7cb7ff14
SHA19f311863d28a3b4d6239e6c0d3bfeda4fb8b025a
SHA25609c0b7167eb9c74892235d7c4d6bd05be7e1fdc660ed971cf5c44fa03845d39a
SHA512138533988f120dc4a830d2a130a7b3e0a4d42a34bf6892b785a506d84d3eb23a481c8e743c675969b3f26f389bf1527e6f7515f5436d6d3de295f9ff00da799c
-
Filesize
5KB
MD58a0bbdda67900a229636d312952805e4
SHA10215c9181527bb71359b9975297950a2b6d8582e
SHA2561585c146c1a848a66e7d039f5087b4c32bfa52f2472f65e01aa6f44be137662e
SHA51234d6ca661d9a22cc5735211963fcc4ac8fd57624773d0de3eed9454ec9b7ca64804fa7d2d14a2612017c88d8888cac2385780161d225fa2ca02a135c4a555212
-
Filesize
5KB
MD52b65fe65d6febfb6a343d7882e2b7b8b
SHA14b5103ddd8da0ec183eee68473832c7376033f59
SHA256108a37f7b4cc8ae91d71d64104dd481d6680e02558c160311e7a5e55ae42d6d7
SHA512d78e660c9d8e89566c8a153e5ea877a604ef83a18242d8150120a2afa58e2830e27441be7d1d8eb9a22876c40b645b02e2f124e38d7bd0022c407515d7742dc3
-
Filesize
4KB
MD57d2f3ec095fcdf5db1b8e404efeea091
SHA1fba02d9735ae54b9a02d2ea9940601e577ea8894
SHA256923c8636eb059cc7e9d9918049e1051bba94f582a01744cc8b608b1f774b37ab
SHA512db9a5f54cd367d965320677af0de2c899e176592b521266184115a4d8457b06534225fe99afdbeb53feb16177a4e0a5954418abe2c8cf5e0048bacaee3a64c1e
-
Filesize
5KB
MD59ab042d8e002c140e76d4844e272a249
SHA1b5b6ac5395b14e2f9234224f44d87b80f54dfce2
SHA25658c3cc9965e0fa017c527698139242338970b61d4d3154da4c16dc0773eab735
SHA5124091cd2269cedb4e973bec210595511fb3757fc1a9ae373ad84b08e63624d30d9326275a519fca1a770148ce448918f583bde1c9b0bb2f7315e3ac09ee33e16f
-
Filesize
4KB
MD5b7b3d34404738ace3f81746b3cee23ab
SHA1a7b113fef738485e73a698c5b866a1255d05afff
SHA256e1899375d2fb431f9b54a9b8e5edf22fa99dd3087c447435b1705cf0fd2267d7
SHA5127dfa5c138fe93c3e9947c2dfbd1202ce4c91d383cb5c73992b4f3bf012ec516efc406fe7783dda143ae9a75e6ff80b4fa6e03b83d4c4bc4bd429e3505684fcd2
-
Filesize
5KB
MD53bb7433ec65ae2b94345ebb6a4d89117
SHA12facfbe9cfece641e3f4542af7c03914c4b27a54
SHA2568adc202f7a8a963d452a7337cd66a88b870584811fc2acdddc253a905c7b1aa4
SHA512c61bf5b583020fe5f185bd4802c9fae95a8fcca0ea9f72fa5e74b7bfa035074f56002ef71b13aaef2738dbbf2bf12839d151bf8f7e218407fc7af956975e5215
-
Filesize
5KB
MD5cd1b92d57a634bb29fbbe4cc4f6b16b4
SHA12514a152beace28a7b9b95e5e61c912bfd94cc65
SHA256176c662e8bdbafdd6aa74ec28674e662852b3dbfa41053c11ce993eab9ed8247
SHA512156cbca837dae5c7754c91f4fb2dca3481c9f20cc2a9b89c9bbdaac134d375ba55ed704a41e07e32ce971fbebf51810c3c30934eb3fdc37b69c0192c7587f364
-
Filesize
5KB
MD5658180d9252e5e7cd5c6b0e580054dbf
SHA148508586e8bc098beb2981ae94f83309140e021d
SHA256ec8a52c34e6f3f403b2855a7982aaca24c09cd64e11fc46c9e0e3c06761e654e
SHA5128a3ba344862d2e4adbe1c4df5309483ad2ee82bd4e11e30dbace19579afa9257f1b8930b5eec9e8387d7cd0935c131e9796c5fa203022cff103f95bf95d957fa
-
Filesize
5KB
MD556c5503c230ee5779ee638798fccb355
SHA17df54bc167363987e3b8b5589bccb5fb4f6687f0
SHA256ce169e07873cb442061e1ee6c10f09dd92c9e5a7d7ca6d325338164c5c0d6a78
SHA512388a149b2033af2f66af802aba71baf9b9ae8765b693c59e137f4900acf261818ed58dc9d144f26fb025671a4e908245bca207cfbbba1e7d7133123d90ded2a8
-
Filesize
5KB
MD58a584339e3b9023eba5c3dccc7d78c14
SHA1d1b6227d06dc30da33ac2123bba4fecab80ced6a
SHA256049da3aac6940c5c28ee30efa15c44b3b76e7f81d1c15c789c4802f0cd6e03e2
SHA512902557b6d8487c56c661627251dc16f7a82d15d40114e6bcd8c2532d6bd7b914c3334d2491d504a9d355a971554124f86ec5b07c624e2093c29b43836ec91cf1
-
Filesize
7KB
MD52b6939ce4fe2378d86c830b7a25060c8
SHA1ff49d921202551cc313425136a57519965919092
SHA256ec6ac13b0accb79e3d445fbce483175f46b3e2cdadd91e6baada545a17a5f447
SHA5128d3c2316fc1fafb2d337bdd0767b99bd7ad12cb4d5fb3718cae2328fe3ffe67276ffa7418d2cbf2981b806ff274351c60cbb4f2b87589eb194d2410c09d83c71
-
Filesize
7KB
MD53619c9c4f13a847b35797effb33efdad
SHA1d5d65784322bb7f77d23aec08dcb040777490b6a
SHA25682bb61b31750f8a0c4edf5fafa657a9ef78fe8e87b4a7ac659f2cc5c328807a6
SHA512c31433663cc7cba4e5d60c4e390eecd075ecc35e64de2813b0faebd9ef088c27e5ec698d23ddc09daf1bacad36d7b1f6e95eb7df2c0f412fbe8461db04a798e6
-
Filesize
7KB
MD5a2a1ee56eb68334e83463aa512c0db3c
SHA180cbe28a3ef42e27611a26e15fd0bce130b0e78c
SHA25634cf2df78a7e9009ec301a6f9706618a0a7227de8845c48989add27d0e322da4
SHA5123716630f9d938afb323cd507941cbf3178ee4a628664242c16581d4e26b6cd3cc4c21619301f2f0eeb96ec1636f79bb2a0c2bbdb312c56fcb44733b8de13b3ad
-
Filesize
8KB
MD501f7485f34fda13f05d81fea9da24b31
SHA1b576530721ac354d44a031852a1e038517b532c6
SHA2564253a92a6c77bbeafc7bfd9fb015395312f1b5464bf060d43f28afc03a440d6f
SHA5127ad27d54c33721788e49a90ff78054ab7dac95a07f0960ba20c93862ddb2be8131a7d352f9e87f760537e034fdc154699f3fd233cf56bbcb400a6e87eaa29bd2
-
Filesize
7KB
MD56acc715d21e0a43bacf49b15749f1527
SHA1f6f7556ba93e3e5e41c49f02a60d2aa2c1834d54
SHA2566ba8a9547070093764205e42941110787728a2781cfb099a1d991f45d4b07cab
SHA512e26e9f0df93eec8f76f7e84ad58dde2ef1b93f61b5c5f92e82ff8a32183cad751f0b9b044223497192719ff6186118eacb54879bac2b53455336f9ccbc7fec09
-
Filesize
6KB
MD5bd3291c6aad493d8f5ecc219078acca7
SHA1f2471fa79a3081a8a0412c529f1a7d3babd13698
SHA25683be197ce15b42f0e11122c5ddb849b7598533cb84e8a5e3581cfcd92e6f0461
SHA512634cb06082123b191104c42abbc7a6368ba16cafcaf7fd1c31ad6ebebe7ad8a36e42a19d7b146a508be086110548e713d8f9ccca921983b2729ad592d2237631
-
Filesize
15KB
MD5e0b80f266cea7b3671969337f7e10cc4
SHA167630261d883d7f2eae7163eb9cd3a3d72e54236
SHA256ba552fead7ba46832363fad294d6e7e99301bba8d08db25b048df8f6b8ff1605
SHA5129de4e11610bb5002d2802127848214c464e2f6452906625ab0cbe59fdf1740d029ed66b8796175167f6a22e935815c9c10d4e3be573a7300d50c51c80ca336e4
-
Filesize
263KB
MD5c193045765c8074b3c19bbf90e3ecbac
SHA1aa9e84d77b335d89753bafabd13a56f0aff6de8a
SHA2560e83dc64b7cbbc1feb57a1e9ba9fd7da101230907e3a79c91b17d7e4861ba0c6
SHA512163909ac451cd0f5f69e48d07a5540e2d294b373f34ceacb9720bbb0f07bf5cf5cc6d0d68a21d0bbb99f370b94e469d5c749b3ab910bb0b3c1434a81deb4ee7c
-
Filesize
263KB
MD53c89a79c7b7935b1d418104a0659ae86
SHA1aef784979d5bc6b95239e3b85a1d1741cbc751e9
SHA2560bbdd26200f9f463a9a1eee44c2319bfeaeaf264d53529caaed976ddb64edba5
SHA512afba79e8dd69f09fe48c59c06238c55f14fa9058780a0ef9ed090a9748256a4281cb591c1534dca9b89bf96c44a2eb41f845ef674df1612d9693a27a9ab49471
-
Filesize
263KB
MD583eab3549271eddc85f5acd33ce0204c
SHA15912afc46d4de4ad313aed5ce2b14f377b6966a8
SHA256bbbf57fc3862d525f1e4d2e4338532c99ab65f4dde2c1e9cf488b8a131725147
SHA512eefbc4246becb1fa8fd4b81a4b3e57423d7c76e137c522c58b236fa6fe35a3511c47eedb44b7eacf84c777e511f16043d4682c8cf1c19c717f9845d2f8f5cfe5
-
Filesize
109KB
MD50f970f82997806af38a1c01367fff210
SHA1b423178eccc6a59d8a2988c5282a3e34239a6efc
SHA2565f27f4c58026b89cba73ed5e0b86d70601167e419377a78e3994e9bf9b54a826
SHA512d590eb21d38027321be12973d124f39abba5310720fa50f166ad65c41395c6ca6aea571b5fa27652af4e439a2d20871966d7a615ea56cee95822ceaffa053667
-
Filesize
92KB
MD57e701595204f5ddf5a82d77776867660
SHA161d7ca423a4536417aa2591924d44c3d4c251ec9
SHA256f828871c33e9dfd72a3acb6b69757108d5480b8e24c54b5f1d92f6e9f9d57b61
SHA512a1090fbe78dea74e2ed7c092abc103ea758f75f08e9d9c34a9ae019dd3699c52e9a71fd594993d18a6ac4a7651ad2a4114e52979a35741915bd14dd8d738ebc4
-
Filesize
104KB
MD52ca84ae49ba65d0b304f1080149b3948
SHA18376c454d39319dce7fe31822cde6400b95d2337
SHA256e62dee3628ab9324313eec949fe9944692312db8829e6b53b7cda1cd9f274bad
SHA51271099ece84273aa25a23b71dac6519a374703b40f83a57d79d053b3839ced76e2c9cad743d6028f61273d4478af3c1c2b12db308d12e822de0e279a7deea7076
-
Filesize
109KB
MD5bb9ceda425f262c81d0b7d8c72ded957
SHA166bacb41b3fd93edaa1bfdc59859ee44dbdb3595
SHA256e01ae2bdfbb70d5ae99470bfa8c67f7ebb309d45fc4fa6c7416d28c925bbc196
SHA512d72726a0fef3e4e6ad310ad3c782ba06ff8164f4037c23ba5c843dc5cc738d01b5fc4a182c28ee8c3b8a91c2854c1a52baecb7871affd3c43282ca2b4f420d8a
-
Filesize
88KB
MD59274f975b8a3ab0b8c8da32fd6e23dbb
SHA16c33327f90044a4119250274f197f9636d093a08
SHA256f2a1a80e887b14d3508a734e3eee99bd5d8109c0c626982989339d65d6b9c1a7
SHA5125583879532902ebe012c4d93ec207b980d1838dc323968b40571b1734b675ce2e563d89103c982b6baf06db40f26aacb1991b7a6b4d8c09a7c5a4592e19745c9
-
Filesize
264KB
MD5bc8b02aa24a1a2a1d9b1b90bf08f65aa
SHA1fd1d28da5fb043289e1f2a406ede07b41523ab8d
SHA2565abc3c363102a84fc055aae6d85ebb2dc4a5b355df76e805382d5a30e007ad2c
SHA5123b7ef43fcb4a321edc346d01f578d260ecf79e64e698e34382a2766ba7b03de17380d5ff2f0abeef48f55043fb392989bac9c8a1796c4323d527e8748fbe7993
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
Filesize
152B
MD588e9aaca62aa2aed293699f139d7e7e1
SHA109d9ccfbdff9680366291d5d1bc311b0b56a05e9
SHA25627dcdb1cddab5d56ac53cff93489038de93f61b5504f8595b1eb2d3124bbc12c
SHA512d90dabe34504dde422f5f6dec87851af8f4849f521759a768dfa0a38f50827b099dfde256d8f8467460c289bdb168358b2678772b8b49418c23b882ba21d4793
-
Filesize
152B
MD5341f6b71eb8fcb1e52a749a673b2819c
SHA16c81b6acb3ce5f64180cb58a6aae927b882f4109
SHA25657934852f04cef38bb4acbe4407f707f137fada0c36bab71b2cdfd58cc030a29
SHA51257ecaa087bc5626752f89501c635a2da8404dbda89260895910a9cc31203e15095eba2e1ce9eee1481f02a43d0df77b75cb9b0d77a3bc3b894fdd1cf0f6ce6f9
-
Filesize
5KB
MD5e937ee8cd746b9dd5919f2fc322a2938
SHA1e9d973dc72a0c923320d26fc7b8e4864ff577ff4
SHA2564a6b94ffed83013af2bcd217d3dcd003c6282fcb52eccf787878b033aeb99acf
SHA5121682721cbfcc842a40fafb325ad11b85ea95466d26eb1e75e7a179ab1925faa3b8289a0b8d9085a089236f72c892fb78d2d2fffae50852b7f51aef28978d3522
-
Filesize
5KB
MD508efc8f3a3006e6fced9e2a828d5e4b7
SHA1e2b5786be2446a77d43e944789790a8557975eb6
SHA25682eb1200cb4a1c9951f49207db8f97cb751aa24230c1b1be24264d95fb345576
SHA512a7f806e38a6ba064f483c9d73929295f1144fd4367f798ac39e3cbefe7c397fadb6fb0a661a2bd6f56ceb8e63e39dc6a3f5d8a06306e2745f34b6493a5af9859
-
Filesize
5KB
MD50029e3490f8c13570a73efc9fa62501a
SHA13d05ba0f3732e7d6145e7cd4a9d7c867cf642541
SHA256f2c3d32e09e959111d301c00bbd6b01318192a2d8b46d0f383b7f99835fe0f6d
SHA512644c50db37e502e711050a12a1d3ee7765a7ab6fdda5af235c74c23e3dde523f2f59956355b7cd338ecf80b60537fc2e267b2ea5052e4653c07778924eea1962
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
10KB
MD5a64aff9f5bc3c67419384316c70604e3
SHA1b544f63faed42732f6f183cfea8289ebc2426e3b
SHA2563a9b670ef0a7e235c9ffda10d87cd3231273e91472b563acb4eb2f769cef2788
SHA5129636763c62fed5f77bc2281a18d734bf6d90a2b74bafed428067353a2bbb3c5c4effc0794b7c02a6007830ebc4456b3d7af1c1a649d1b815367bc7770bceac63
-
Filesize
11KB
MD5cfb10af12198ba9ca9dbd1142b16bf1a
SHA1165c16790bbbe7a440754b44c6d0f73d801aefd6
SHA2568e308d6dd79289a029f0cb32d454d44dd7c7a1e67214e3793a4707608331ca4d
SHA5125e163f3f8051fee99bd261dfe68e426b3ae69c02c918f6f7da25683c0ddedf204d7ded12541839977ca832da70f3c745c6cc11d48cb42ed487b9f055fb47d531
-
Filesize
5.6MB
MD5f3b8e82c20c4bb3f94a2d7bcd2a82cd1
SHA189618596be7cb90317eaaf2d09b05d522d008260
SHA2567de6a5a45227b0f21ac7dd50af250e37f20b8bf2d6f4aa53a7f643d77515bd07
SHA51282f15e37366efd29879add4f50cedbdc27d4eb885e190dd54c8e89787b51d59ccc21473f431292da679c7e8aa7cf2d0ce7219e1503d59a0f356e078f9feece55
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\AutoLaunchProtocolsComponent\1.0.0.8\protocols.json
Filesize3KB
MD56bbb18bb210b0af189f5d76a65f7ad80
SHA187b804075e78af64293611a637504273fadfe718
SHA25601594d510a1bbc016897ec89402553eca423dfdc8b82bafbc5653bf0c976f57c
SHA5124788edcfa3911c3bb2be8fc447166c330e8ac389f74e8c44e13238ead2fa45c8538aee325bd0d1cc40d91ad47dea1aa94a92148a62983144fdecff2130ee120d
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\CertificateRevocation\6498.2023.8.1\crl-set
Filesize21KB
MD5d246e8dc614619ad838c649e09969503
SHA170b7cf937136e17d8cf325b7212f58cba5975b53
SHA2569dd9fba7c78050b841643e8d12e58ba9cca9084c98039f1ebff13245655652e1
SHA512736933316ee05520e7839db46da466ef94e5624ba61b414452b818b47d18dcd80d3404b750269da04912dde8f23118f6dfc9752c7bdf1afc5e07016d9c055fdb
-
Filesize
280B
MD57a72cf2bbdda7afcca73b738f41bdbc5
SHA1a81fb8c42d64e0100fef5dae0bbdf2edb9e0a21d
SHA256b31ff3dc10dc033093a321f2b45cbcbcf1b423237710e77bdfe1cb03f3426183
SHA512b6abe05190432befe523bf97bbd8b9d833decde675847213b0d6dba4a52cc6cc9cc3e66ea7dbcf6a43c4cb87b964a9f98e72ca7343a06298b309c79d81ee2e1b
-
Filesize
8KB
MD5cf89d16bb9107c631daabf0c0ee58efb
SHA13ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA256d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
SHA5128cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
-
Filesize
8KB
MD541876349cb12d6db992f1309f22df3f0
SHA15cf26b3420fc0302cd0a71e8d029739b8765be27
SHA256e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
SHA512e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Filesize2KB
MD5cf0490c2e3f1b70fa507047c0c3c1633
SHA18bdf8464c9544dadd29f053c4e2d4a253798bece
SHA25676ccb2054274189a478ec848b387b4b35b585ea0b7c7363994727ac6b0ceb05e
SHA51258a25f09f376fd053a4ae8aadf942d8b89f83f41b39cacfa947eab6008ccb6ffcc560f51db4f5a8e25add31187fddd3d23cc1a92c2b9601086568fe49cecd1af
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe64d293.TMP
Filesize48B
MD5173877d6cb966d36a98e0b2b1508cfb2
SHA1dcf97186c2a2f34d30064827a3da3bb02d855aaf
SHA256ecb41d60422d410dec5b2b917815691c135883bbe2599dea5a142bafedc8e6ad
SHA51211070186198fa8b84619837f87d7e240eb1d4a3b24e2f5e64807da1d940a3792891c6494cc937fee5e6347d1fc2398fdae7d67f336a7e93c2731c15db30ae8e6
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\Network Persistent State
Filesize2KB
MD54efad66870e69131714c86ab9006d136
SHA170d62e9d1f1dbdc3fdb22cb7725534efdb11ceec
SHA2565dd75613c9cdac4ab11253e6ab04a761c222188ee2b6275d0ad26b37e654b661
SHA5126f5b421f9723a108c145c5812b92ed715578fd56f061fb150770eca8684d7e538ba247dfc8ae1b453265fbc592c276c7fdae07415629885bea674f1f686aecc9
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\Network Persistent State
Filesize2KB
MD5f1b477654ab2eace86d39fb52a4f3b08
SHA1672fa6bdf59424f5980be1298edc4f90b3c85cb5
SHA2560dc8ea0f0c2986e35ecf585e78f276bedd159a7139ad5b9ffe698b1b5d949364
SHA512697d015e869e3876c6f22ba33be6418dd34b960ef3cee9004ea9c0813a99a0a7e61db1372b1aa2fe360f6d41fdce8f06737feb5bcc11a5db7831a0919419b71e
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\Network Persistent State
Filesize2KB
MD53bc059b2c3f0d6899f128f94a283c58a
SHA1f16ac8c58ada8bdc69ebe7419fb4477d15a912a5
SHA2565ef1e3bc931697715549f700dc18370812d4f935f74213c6edb6b42dd5d117d8
SHA5125f5b54f8bf08ab140afc9be50cb92b796b8d80a17eae666c01d716044cde08a8fa894e5acee6f3484e16d001b513b5eeacb2d72bd06224be90fd7973696913a9
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\Network Persistent State~RFe658f99.TMP
Filesize59B
MD52800881c775077e1c4b6e06bf4676de4
SHA12873631068c8b3b9495638c865915be822442c8b
SHA256226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
SHA512e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\SCT Auditing Pending Reports
Filesize2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\TransportSecurity
Filesize1KB
MD5e4df878533279efc8dffcab9601af279
SHA109d170b3f87374b38621ecf7fcd36b414846e742
SHA25672c39d37a19e84bee7876f095526c9565e99178ffa08071c06cf972342e35521
SHA512545e8ca3fd94994953646c3297cfaa645c5e7ba695ab15ea2fbb81126090c822dd7db2dca019d26a388de2c047e5a298db1a2ea7789d0c9893cceead94ce04b0
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\TransportSecurity
Filesize1KB
MD5b37d6c01ca0ee68cde9e88d5dd7a3ec6
SHA1abba820b16625b5838dc3bbac9011965aaa8810d
SHA2569f9ed609b168a5742f8d56f357d54cb229dd6193bd4186ee40d91ae9c2e4fff7
SHA512ec63b08fe0bc9dd716784739b00b60d4b9da38bdbbdaa89c893eb116f01be7cf1d4f54e473f6ef180bb4fc54a9556ec1ab561064a7ee31a3c202cbfe75d7652a
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\TransportSecurity
Filesize1KB
MD5a85563eb02a9962eab6fcbdc014e19fe
SHA1b391dfbefd2e54571fb58e2f77ff40e84c9998fe
SHA2565e05db50f06e51060b468b6bb93b7706967e18504227d018ecbd22666371d14f
SHA5124d4d962e2f16994996fd549623143a64b74972dad1aaa527257709eb41ca0fe0577ce9472ff5e08f6d56467ce62ebe64ead13f8a35a3ed2abcd64d307b92805f
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\TransportSecurity~RFe64cf95.TMP
Filesize1KB
MD579f7314280617a6b9b60db7206a90f72
SHA1b14b873c703977057f6937827c576e9c2c90cabf
SHA256e7a04d301a5a0ccc3ec027ce41b71e5e61ef60c69c8d067964c0d603bbce4596
SHA512b6f80e4d00572d2c2a7bfb3acf60b82224bbce130058bccde6902dd517ff4668ad8a593ae76362838e83eda78eabb2ee782bfe3feb583c8ac872faaafe77936a
-
Filesize
6KB
MD5dbc0f16719a3bd6cb775a9ccd08d21eb
SHA114a780d34efc2aa38122291a40b7582d0f04f304
SHA2563487e731b8e2c7ce535ee55619fea78bb66bd25e8638313aff4946c70000fd18
SHA512a0a55f8b31dbdc05c7b05ba88240b2ff972fe436ab5c95d06e43e9c685d0446662f13805c1d5ccb118670c77e34a474cef8089644ef92f1545dfaa27b8854122
-
Filesize
6KB
MD5291350a52b7fe122581d058d70a4bba0
SHA1230b745d99316e9f3731f5f58a9ea0c01f90d984
SHA2560a2aac652bebd291cb361469c47bd72762fba411536e0e7b6edbb699aec02de5
SHA512973f95a3dfdb51bcfe65dbe781f1cb2bf1383ccc28e4a3b6e4f41a0f80198a63eb64bc1a442d2bbc5f1b88f0f82298544c008ca6c1430e8a446c152656aba09c
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Preferences~RFe64c276.TMP
Filesize6KB
MD57d4349cde4ef6768015f8e9f651bed3c
SHA13d591ab8c64c0889a17aa45fb8ab14cd5389fbee
SHA2568a8fbb8a474f8b72b14728d4f7882ccd3041c154b540a91828137a96a3352fe3
SHA512242d5f32919c1cbe2d4117966c9f1897b44a8ecd00159a1b506830ad4f8a68b7198fd8b96bdfec321d9c75a909a7b9d2aeacb0de53acba276efeaa96b69a3fc5
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
Filesize41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
Filesize
8KB
MD50962291d6d367570bee5454721c17e11
SHA159d10a893ef321a706a9255176761366115bedcb
SHA256ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
SHA512f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
-
Filesize
3KB
MD57c99c23d8e961265c5f97f188bf79867
SHA1c8892a92d0f32de0b826dc8b2b0cbc46dfebe062
SHA2567d8ddee2044951666ada6f343969113880a761dee2f7d747436dcfa88a1f699f
SHA512bfd4a6f72069e8e43af789637f9ad7ee0f2b8da1ad264241fe9a354e15e11efc205cc09ef33b65e95965d8397591469bbe4e26d198c83f83ef53860c6b92854e
-
Filesize
3KB
MD5707a833e34c2aedbe6b202d9164b81f6
SHA135de7f6367addc3c7222bb263906dc4b9a3fbf29
SHA25641fb4aa7e63f3e1536e617335bd1ae63802d0f1401b4411bea29402d896a64e8
SHA5128782e3c461407f0b23e251c9d027ad575c3e821dc838a5b9f48e2487e743cf34419950a9bd4b4586ec5b2ece82d2d3e8ae7a5b6d0870f6c0766fafb645893242
-
Filesize
16KB
MD563d17ff3d8380e4a5c678eea80c70928
SHA1d995f27bae414c17f5b11f67f83d8d15b9599d15
SHA25617a6a5dcb9735535428620c2bcb7cfe6b4fd3cd5dfa574ded6b390ae73ab61af
SHA512fcd2461c910057172fdbd74dd1ab3a597e0aa24da02b2e6850b8f64c0961ae50aafa1f31e6cc3abb514a39240465ef935c8141791b8bf42748871da336e1d555
-
Filesize
2KB
MD5308fb5ec15fe02728f9b2ef39eb7b343
SHA10886fd166f9136827574bd6be5eba467343bf184
SHA256640e32aabf9f9fdf465c58beea96411a95ead36467c7a756c37f077be65676df
SHA51295d6e4b6edd362edf6599aa10ec03ececc3e74cacb940fe61965afe503d2d0ee21e5639fcf67c90b00881d1e578490b9c410aa5812acae2b68e0c6cad494c2b7
-
Filesize
1KB
MD55d4393cb7134a14b74220dde2dac1afd
SHA17176e74d750a02e2151286b79ac33805e8beb54b
SHA2564bc9ab1fb244709d3b165d176742b153ff884692b63178240631f909669a85b7
SHA512d32fb6ceab6ebf3538937f8a6aa29cf24418102ff677d6d8fbdf3288caaec515a691f3960046b7e86ec7368c63a5c2963dd9568c0f643bf3079a62e4e104fa31
-
Filesize
287KB
MD55418f0d0f7d15ca9fbe5da74453722f5
SHA13ca9d7ae11a35a6c47d590b301602583add40e10
SHA256251ad4f7aedd823ee97077e9764592188657aa831cd0948990fb549fd3e593e3
SHA5124206c7c04eda629a2af109e35e48986e80fc16a2285ae3afc2e92f6a29651d7a06d1dc3d49f618fd33965f91e6cccc8b0dcbc34b4613eedabc7fbafc18783b7a
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\PKIMetadata\11.0.0.0\ct_config.pb
Filesize7KB
MD5f86abfc2651f24867cf9aee405d95a07
SHA151531932b533a36a6ab41700f625f33ae7296825
SHA25670c4568dcbf75e36879c75b068e67a2de7653cb5eff6c12697c3bbfead81d85a
SHA512351a0a4e5b2b4800ef535d4ca1a9ebd65027543608df883a303a32ce37e110206da2555cd37853711bdf049e6a9df17005e6520ea0daadbe6d0fb08bd51b7020
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Subresource Filter\Unindexed Rules\10.34.0.52\Filtering Rules
Filesize1.8MB
MD5a97ea939d1b6d363d1a41c4ab55b9ecb
SHA13669e6477eddf2521e874269769b69b042620332
SHA25697115a369f33b66a7ffcfb3d67c935c1e7a24fc723bb8380ad01971c447cfa9f
SHA512399cb37e5790effcd4d62b9b09f706c4fb19eb2ab220f1089698f1e1c6f1efdd2f55d9f4c6d58ddbcc64d7a7cf689ab0dbbfae52ce96d5baa53c43775e018279
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Subresource Filter\Unindexed Rules\10.34.0.52\LICENSE
Filesize24KB
MD5aad9405766b20014ab3beb08b99536de
SHA1486a379bdfeecdc99ed3f4617f35ae65babe9d47
SHA256ed0f972d56566a96fb2f128a7b58091dfbf32dc365b975bc9318c9701677f44d
SHA512bd9bf257306fdaff3f1e3e1fccb1f0d6a3181d436035124bd4953679d1af2cd5b4cc053b0e2ef17745ae44ae919cd8fd9663fbc0cd9ed36607e9b2472c206852
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\TpcdMetadata\2024.4.4.1\metadata.pb
Filesize28KB
MD55cc69a73238667029ca40bd0b411ed98
SHA10f3d737817f94011ce2683eab387aeaecad0b157
SHA256263ce0a058d198e904f83a337b92b2e0f49f37e87a48f2a39de0017b6a850611
SHA512f42fc0f12adb12d391eb8610427ffd5abdcfbca6e8eb1a9af8b01914190d4aecca0003f17ed3920408bb64118ed8822a36a99890f151625d3ec2dc01e74a9a6f
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\TrustTokenKeyCommitments\2024.3.25.1\keys.json
Filesize6KB
MD5af8fcadd95b5f42bdb56962938f7d078
SHA12713e1da42c96163d18f84ee662b8b61a1e56d35
SHA256142c07267a3e13f64862d83748ff110704354d3facc3b60743602fc47e651ab3
SHA512a45d792cb98509a1ec7e87e8371f6dd16b7c12b167f62ab68af43f7f3c3d2e5f5890a9556826dc80565adc2db20f7f06eeb3f12cef797ed2d1b132bd6c304d28
-
Filesize
26B
MD5fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1d59fc84cdd5217c6cf74785703655f78da6b582b
SHA256eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
SHA512aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98
-
Filesize
5.2MB
MD59fb66ffa1e1f4dedfd16eb3a8170bafd
SHA169b5d57ddda6b97adde820b9ceaddae9c33d53bd
SHA2567953b28b736795aaa54e6cd5cb591e794e2f770c1045ca2e33af5ff19f480eaa
SHA5124b141802e7a4cb6bd4a7498d30086a9d83c62d37f2137f4910ca7d3fb7009079d4dc59b95050849cfc720210b0cb44bf588d15c08e3ba830aae19c0a27e8e6d5
-
Filesize
280B
MD518172ad93efb7cc91e6408b82c6cd0fd
SHA1d0b83fd9294ae89e55c1647b97517fa69ed1a5b8
SHA256bdcaf46eb287f3161bde116a4c932c1e03ba9919d8efd1d54c357ac09f04db1f
SHA5122f3a44c2211aa6a6c83c4ea2c12417ef9a66f2ca9fdf4238f38e1d9f6d4e3dfab5f9ef4c87d564ad1b7fc2c7138423bf0ee357f0b21bc6bda82010936f3e53b9
-
Filesize
107B
MD530a7eec36accfaa11602d1f47ae8238f
SHA1f56e424eab99c31f01fc57d377f3e2793ffa3a72
SHA2564c2c7dc8277c4f5beb11ad27e9cb00939f6d6e374c1631027a5cedc9722e09a0
SHA512aeecc515850e288988580485d6fca37c295e437c3f5001378220bc491cb7ae5d296eba283d90b51dc3811283c85b2fb417cc7e0d291170b87ae528c7adf71e2f
-
Filesize
703B
MD58961fdd3db036dd43002659a4e4a7365
SHA17b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA256c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
SHA512531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
-
Filesize
687B
MD50807cf29fc4c5d7d87c1689eb2e0baaa
SHA1d0914fb069469d47a36d339ca70164253fccf022
SHA256f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
SHA5125324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
-
Filesize
141KB
MD5677edd1a17d50f0bd11783f58725d0e7
SHA198fedc5862c78f3b03daed1ff9efbe5e31c205ee
SHA256c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
SHA512c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff
-
Filesize
179B
MD5273755bb7d5cc315c91f47cab6d88db9
SHA1c933c95cc07b91294c65016d76b5fa0fa25b323b
SHA2560e22719a850c49b3fba3f23f69c8ff785ce3dee233030ed1ad6e6563c75a9902
SHA5120e375846a5b10cc29b7846b20a5a9193ea55ff802f668336519ff275fb3d179d8d6654fe1d410764992b85a309a3e001cede2f4acdec697957eb71bdeb234bd8
-
Filesize
79B
MD5b2ac91ca2bec034d1a335f9e2f574526
SHA1ae9d2be2c07bfe84fea807d18a235609ac5cae8e
SHA256dfa347c4668c5d16a7d946e9330f08d3551a89dea06e53e1cf24bcf3510ea40e
SHA512ff3dd90c1dc9b10754f54c5c54fff2a6877f00fda09f47e07ab05bcaa40a8d3e960a3654b1cad498cd233c0c09d44d686b523b882a385525b60040d708e88b44
-
Filesize
102B
MD51c539c68a00bd842136703d2cdc94235
SHA1b39f04946e7da8380fa340ddf1baa757afb37df5
SHA256bdd48d0d2e047e4816e1aa4dc248c095998cbda255b50db66b94bd7a42206aed
SHA512eaf0cc24ecfbf8adc1b216a098fa72b95aebe6fbea9206860622c54f684e08447050cc9734fcf83f3eb2e15cb263dfed636539b24c5e4ba94b2ce309d651325b
-
Filesize
134B
MD558d3ca1189df439d0538a75912496bcf
SHA199af5b6a006a6929cc08744d1b54e3623fec2f36
SHA256a946db31a6a985bdb64ea9f403294b479571ca3c22215742bdc26ea1cf123437
SHA512afd7f140e89472d4827156ec1c48da488b0d06daaa737351c7bec6bc12edfc4443460c4ac169287350934ca66fb2f883347ed8084c62caf9f883a736243194a2
-
Filesize
116B
MD5178174a0125d4ff3ed5211426f1ea113
SHA126f72c5a2f65c767c4edb04d8da62bdadc02e809
SHA25664986dfeefa8855069e799b28e5523b35c9efcf2ea152a2b03461471c218da1f
SHA512c0d1d9555f4cd7e9a4b0ee5fc1b069782638ba1680d18ba9c83f796746086b6afdf1400c80b7f586422c3a2a73e51bd04fb250e2db818ef723cb4f7a8b3b15a2
-
Filesize
113B
MD5b6911958067e8d96526537faed1bb9ef
SHA1a47b5be4fe5bc13948f891d8f92917e3a11ebb6e
SHA256341b28d49c6b736574539180dd6de17c20831995fe29e7bc986449fbc5caa648
SHA51262802f6f6481acb8b99a21631365c50a58eaf8ffdf7d9287d492a7b815c837d6a6377342e24350805fb8a01b7e67816c333ec98dcd16854894aeb7271ea39062
-
Filesize
66B
MD55bbd09242392aacbb5fac763f9e3bd4e
SHA114bb7b23b459ce30193742ed1901a17b4dcf9645
SHA25622b55f5d9b1bafb80e00c1304cf5e0d6057a304a2e8757b4f021b416f4397297
SHA512541e4c7998e91a5113f627c2c44e32b54878fe225b3b9476572f025f51f2b4ec4a44b102498adcc22b8fe388970645bacfafb6e7fc8a216df4d7bbfc8b0ff670
-
Filesize
76B
MD5ba25fcf816a017558d3434583e9746b8
SHA1be05c87f7adf6b21273a4e94b3592618b6a4a624
SHA2560d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11
SHA5123763bd77675221e323faa5502023dc677c08911a673db038e4108a2d4d71b1a6c0727a65128898bb5dfab275e399f4b7ed19ca2194a8a286e8f9171b3536546f
-
Filesize
43B
MD555cf847309615667a4165f3796268958
SHA1097d7d123cb0658c6de187e42c653ad7d5bbf527
SHA25654f5c87c918f69861d93ed21544aac7d38645d10a890fc5b903730eb16d9a877
SHA51253c71b860711561015c09c5000804f3713651ba2db57ccf434aebee07c56e5a162bdf317ce8de55926e34899812b42c994c3ce50870487bfa1803033db9452b7