Analysis
-
max time kernel
2700s -
max time network
2611s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
24-04-2024 18:02
Static task
static1
General
-
Target
RobloxStudioInstaller.exe
-
Size
5.2MB
-
MD5
9a5054a082e2d341025a7cfab14be01e
-
SHA1
6f880fa9008dfbd65ceed2022744b94d9c42231f
-
SHA256
324961104eeb40c40e6bd00278affe755c82d77189606280fffd37852db54c3f
-
SHA512
cf24a5a3b79894b93b041b2b5e71f494cbdff4cc524267b81b46c86ca5b001e3bc9a57b724f46d0bdd3ecb0fb3ccf0168db978e5928422df7023f736548c15b7
-
SSDEEP
98304:76vQ2fQxgxb9C+Qe+NsGnTQ6ILVpgiIIefOpmFCFnf0kiih/5ul7:iQ24Sb9j+N0jgTXClfNrg7
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
BGAUpdate.exesetup.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\!BCILauncher = "\"C:\\Windows\\Temp\\MUBSTemp\\BCILauncher.EXE\" bgaupmi=72D790EBBAB346A5A4428CF4E1BD540F" BGAUpdate.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\msedge_resetsb_{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062} = "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --no-startup-window --reset-startup-boost-last-used" setup.exe -
Processes:
RobloxStudioInstaller.exeRobloxStudioBeta.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RobloxStudioInstaller.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RobloxStudioBeta.exe -
Downloads MZ/PE file
-
Drops desktop.ini file(s) 1 IoCs
Processes:
svchost.exedescription ioc process File opened for modification C:\Users\Admin\Videos\Captures\desktop.ini svchost.exe -
Installs/modifies Browser Helper Object 2 TTPs 8 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
setup.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\NoExplorer = "1" setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\ setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\ setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\ = "IEToEdge BHO" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\ = "IEToEdge BHO" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\NoExplorer = "1" setup.exe -
Modifies Installed Components in the registry 2 TTPs 7 IoCs
Processes:
setup.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}\IsInstalled = "1" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}\Version = "43,0,0,0" setup.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components setup.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE} setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}\ = "Microsoft Edge" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}\StubPath = "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\124.0.2478.51\\Installer\\setup.exe\" --configure-user-settings --verbose-logging --system-level --msedge --channel=stable" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}\Localized Name = "Microsoft Edge" setup.exe -
Sets file execution options in registry 2 TTPs 4 IoCs
Processes:
MicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0" MicrosoftEdgeUpdate.exe -
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
msedgewebview2.exemsedgewebview2.exemsedgewebview2.exeMicrosoftEdgeUpdate.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Control Panel\International\Geo\Nation msedgewebview2.exe Key value queried \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Control Panel\International\Geo\Nation msedgewebview2.exe Key value queried \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Control Panel\International\Geo\Nation msedgewebview2.exe Key value queried \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Control Panel\International\Geo\Nation MicrosoftEdgeUpdate.exe -
Drops file in System32 directory 1 IoCs
Processes:
setup.exedescription ioc process File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Microsoft Edge.lnk setup.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks system information in the registry 2 TTPs 32 IoCs
System information is often read in order to detect sandboxing environments.
Processes:
MicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exemsedgewebview2.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exedescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer msedgewebview2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName msedgewebview2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe -
Drops file in Program Files directory 64 IoCs
Processes:
RobloxStudioInstaller.exeMicrosoftEdgeUpdateSetup_X86_1.3.185.29.exesetup.exedescription ioc process File created C:\Program Files (x86)\Roblox\Versions\version-1870963560174427\content\studio_svg_textures\Shared\Alerts\Light\Standard\Information.png RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-1870963560174427\ExtraContent\scripts\CoreScripts\Modules\PurchasePrompt\Test\UnitTestContainer.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-1870963560174427\ExtraContent\LuaPackages\Packages\_Index\UIBlox\UIBlox\Core\Spatial\SurfaceGuiWithAdornee.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-1870963560174427\Qml\QtQuick\Controls.2\Universal\SwitchDelegate.qml RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-1870963560174427\content\studio_svg_textures\Lua\Tutorials\Light\Standard\Close@2x.png RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-1870963560174427\ExtraContent\scripts\CoreScripts\Modules\Server\ClientChat\BubbleChat\BubbleChat.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-1870963560174427\ExtraContent\LuaPackages\Packages\_Index\ApolloClient\ApolloClient\jsutils\invariant.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-1870963560174427\ExtraContent\LuaPackages\Packages\_Index\SocialLibraries\SocialLibraries\RoactPaginator\init.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Microsoft\Temp\EU9221.tmp\MicrosoftEdgeComRegisterShellARM64.exe MicrosoftEdgeUpdateSetup_X86_1.3.185.29.exe File created C:\Program Files (x86)\Roblox\Versions\version-1870963560174427\content\textures\StudioUIEditor\valueBoxRoundedRectangle.png RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-1870963560174427\ExtraContent\scripts\CoreScripts\Modules\VoiceChat\Components\VoiceIndicatorFunc.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-1870963560174427\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\UserLib\Cryo.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-1870963560174427\content\studio_svg_textures\Shared\Alerts\Dark\Standard\Information@2x.png RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-1870963560174427\ExtraContent\scripts\CoreScripts\Modules\ContactList\Components\ContactListHeader.story.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-1870963560174427\ExtraContent\textures\ui\Controls\DesignSystem\ButtonR3@3x.png RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-1870963560174427\Qml\QtQuick\Controls.2\designer\RadioDelegateSpecifics.qml RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-1870963560174427\ExtraContent\LuaPackages\Packages\_Index\roblox_t\t\ts.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-1870963560174427\content\qt_translations\qtquickcontrols_ko.qm RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-1870963560174427\content\studio_svg_textures\Lua\StyleEditor\Light\Standard\StyleSheetTheme@2x.png RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-1870963560174427\content\studio_svg_textures\Shared\InsertableObjects\Dark\Standard\TaskScheduler@2x.png RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-1870963560174427\content\studio_svg_textures\Shared\InsertableObjects\Light\Large\TextLabel.png RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-1870963560174427\ExtraContent\scripts\CoreScripts\Modules\InGameMenu\Components\GameSettingsPage\VersionReporter.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-1870963560174427\ExtraContent\scripts\CoreScripts\Modules\TrustAndSafety\Components\ReportSentDialog.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-1870963560174427\ExtraContent\LuaPackages\Packages\_Index\GraphQL\GraphQL\jsutils\promiseReduce.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-1870963560174427\content\textures\ui\RoundedRect8px.png RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-1870963560174427\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\PeekView\ArgCheck.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-1870963560174427\ExtraContent\LuaPackages\Packages\_Index\LuauPolyfill-12e911c4-0c4b13ff\LuauPolyfill\Number\MAX_SAFE_INTEGER.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-1870963560174427\content\textures\PluginManagement\unchecked.png RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-1870963560174427\content\textures\RoactStudioWidgets\slider_bar_background_dark.png RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-1870963560174427\content\textures\AnimationEditor\ic-checkbox-off.png RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-1870963560174427\ExtraContent\scripts\CoreScripts\Modules\TrustAndSafety\Utility\AbuseReportBuilder.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-1870963560174427\ExtraContent\LuaPackages\Packages\_Index\LuauPolyfill-2fca3173-0.3.4\LuauPolyfill\String\init.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-1870963560174427\ExtraContent\LuaPackages\Packages\_Index\RoduxUsers-d30ce745-a73d2f11\RoduxUsers\Actions\init.lua RobloxStudioInstaller.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\124.0.2478.51\vulkan-1.dll setup.exe File created C:\Program Files (x86)\Roblox\Versions\version-1870963560174427\content\studio_svg_textures\Shared\InsertableObjects\Light\Standard\Accessory@3x.png RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-1870963560174427\content\studio_svg_textures\Lua\StyleEditor\Dark\Standard\StyleSheetDescendant@2x.png RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-1870963560174427\ExtraContent\textures\ui\LuaChat\icons\ic-group.png RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-1870963560174427\ExtraContent\scripts\CoreScripts\Modules\Stats\DecoratedValueLabel.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-1870963560174427\ExtraContent\LuaPackages\Packages\_Index\PrettyFormat-edcba0e9-2.4.1\PrettyFormat\plugins\ReactElement.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-1870963560174427\content\studio_svg_textures\Lua\Notifications\Dark\Large\PlayArrowFilledEmphasis@3x.png RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-1870963560174427\content\textures\ui\Settings\Slider\SelectedBarRight@2x.png RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-1870963560174427\ExtraContent\scripts\CoreScripts\Modules\AvatarEditorPrompts\GetConformedHumanoidDescription.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-1870963560174427\ExtraContent\scripts\CoreScripts\Modules\TestHelpers\MockVRService.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\124.0.2478.51\vk_swiftshader_icd.json setup.exe File created C:\Program Files (x86)\Roblox\Versions\version-1870963560174427\content\textures\StudioToolbox\AssetPreview\magnifier_ph.png RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-1870963560174427\ExtraContent\LuaPackages\Packages\_Index\2D-Collision-Matchers\2D-Collision-Matchers\insideBelow.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-1870963560174427\ExtraContent\scripts\CoreScripts\CoreScripts\ScreenshotHud.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-1870963560174427\ExtraContent\scripts\CoreScripts\Modules\InGameMenu\Localization\LocalizationContext.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-1870963560174427\ExtraContent\LuaPackages\Packages\_Index\NetworkingContacts-96003ad7-1.15.0\Util.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-1870963560174427\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\DiscoveryPackagesTestSuite\GameDetail.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-1870963560174427\content\studio_svg_textures\Shared\InsertableObjects\Dark\Standard\EchoSoundEffect@3x.png RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-1870963560174427\content\studio_svg_textures\Shared\InsertableObjects\Light\Standard\GameSettings@2x.png RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-1870963560174427\ExtraContent\textures\ui\Controls\DesignSystem\ButtonL1@2x.png RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-1870963560174427\content\studio_svg_textures\Shared\InsertableObjects\Dark\Standard\VoiceChannel@2x.png RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-1870963560174427\content\studio_svg_textures\Shared\InsertableObjects\Dark\Standard\PluginGuiService@2x.png RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-1870963560174427\ExtraContent\textures\ui\LuaApp\icons\GameDetails\social\Discord_large@2x.png RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-1870963560174427\ExtraContent\scripts\CoreScripts\Modules\AvatarEditorPrompts\Thunks\OpenDeleteOutfitPrompt.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-1870963560174427\ExtraContent\LuaPackages\Packages\_Index\GraphQL\GraphQL\type\init.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-1870963560174427\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\UnitTestHelpers\AvatarPolicies.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-1870963560174427\content\studio_svg_textures\Lua\TerrainEditor\Dark\Large\Sculpt.png RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-1870963560174427\content\studio_svg_textures\Shared\InsertableObjects\Light\Large\TextBox.png RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-1870963560174427\content\studio_svg_textures\Shared\InsertableObjects\Light\Standard\Decal@2x.png RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-1870963560174427\content\studio_svg_textures\Shared\InsertableObjects\Light\Standard\LineHandleAdornment.png RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-1870963560174427\ExtraContent\textures\ui\LuaChatV2\actions_notificationOff@3x.png RobloxStudioInstaller.exe -
Executes dropped EXE 50 IoCs
Processes:
MicrosoftEdgeWebview2Setup.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdge_X64_124.0.2478.51.exesetup.exesetup.exeMicrosoftEdgeUpdate.exeRobloxStudioBeta.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeBGAUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdateSetup_X86_1.3.185.29.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdge_X64_124.0.2478.51.exesetup.exesetup.exesetup.exesetup.exesetup.exesetup.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exepid process 4312 MicrosoftEdgeWebview2Setup.exe 3568 MicrosoftEdgeUpdate.exe 2188 MicrosoftEdgeUpdate.exe 3376 MicrosoftEdgeUpdate.exe 972 MicrosoftEdgeUpdateComRegisterShell64.exe 2296 MicrosoftEdgeUpdateComRegisterShell64.exe 3496 MicrosoftEdgeUpdateComRegisterShell64.exe 2972 MicrosoftEdgeUpdate.exe 3368 MicrosoftEdgeUpdate.exe 3612 MicrosoftEdgeUpdate.exe 1220 MicrosoftEdgeUpdate.exe 1756 MicrosoftEdge_X64_124.0.2478.51.exe 1360 setup.exe 4556 setup.exe 5932 MicrosoftEdgeUpdate.exe 6020 RobloxStudioBeta.exe 3976 msedgewebview2.exe 4648 msedgewebview2.exe 5848 msedgewebview2.exe 5208 msedgewebview2.exe 5212 msedgewebview2.exe 5500 msedgewebview2.exe 1196 msedgewebview2.exe 4984 msedgewebview2.exe 3612 MicrosoftEdgeUpdate.exe 2228 MicrosoftEdgeUpdate.exe 4580 BGAUpdate.exe 5200 MicrosoftEdgeUpdate.exe 4940 MicrosoftEdgeUpdate.exe 5660 MicrosoftEdgeUpdate.exe 3948 MicrosoftEdgeUpdateSetup_X86_1.3.185.29.exe 2072 MicrosoftEdgeUpdate.exe 4788 MicrosoftEdgeUpdate.exe 2196 MicrosoftEdgeUpdate.exe 5464 MicrosoftEdgeUpdateComRegisterShell64.exe 4692 MicrosoftEdgeUpdateComRegisterShell64.exe 4272 MicrosoftEdgeUpdateComRegisterShell64.exe 2584 MicrosoftEdgeUpdate.exe 6024 MicrosoftEdgeUpdate.exe 5340 MicrosoftEdgeUpdate.exe 5644 MicrosoftEdgeUpdate.exe 3816 MicrosoftEdge_X64_124.0.2478.51.exe 3144 setup.exe 3136 setup.exe 5704 setup.exe 1816 setup.exe 5848 setup.exe 5736 setup.exe 5640 MicrosoftEdgeUpdate.exe 592 MicrosoftEdgeUpdate.exe -
Loads dropped DLL 64 IoCs
Processes:
MicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeRobloxStudioBeta.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exepid process 3568 MicrosoftEdgeUpdate.exe 2188 MicrosoftEdgeUpdate.exe 3376 MicrosoftEdgeUpdate.exe 972 MicrosoftEdgeUpdateComRegisterShell64.exe 3376 MicrosoftEdgeUpdate.exe 2296 MicrosoftEdgeUpdateComRegisterShell64.exe 3376 MicrosoftEdgeUpdate.exe 3496 MicrosoftEdgeUpdateComRegisterShell64.exe 3376 MicrosoftEdgeUpdate.exe 2972 MicrosoftEdgeUpdate.exe 3368 MicrosoftEdgeUpdate.exe 3612 MicrosoftEdgeUpdate.exe 3612 MicrosoftEdgeUpdate.exe 3368 MicrosoftEdgeUpdate.exe 1220 MicrosoftEdgeUpdate.exe 5932 MicrosoftEdgeUpdate.exe 6020 RobloxStudioBeta.exe 6020 RobloxStudioBeta.exe 6020 RobloxStudioBeta.exe 6020 RobloxStudioBeta.exe 6020 RobloxStudioBeta.exe 6020 RobloxStudioBeta.exe 6020 RobloxStudioBeta.exe 6020 RobloxStudioBeta.exe 6020 RobloxStudioBeta.exe 6020 RobloxStudioBeta.exe 6020 RobloxStudioBeta.exe 6020 RobloxStudioBeta.exe 6020 RobloxStudioBeta.exe 6020 RobloxStudioBeta.exe 6020 RobloxStudioBeta.exe 6020 RobloxStudioBeta.exe 6020 RobloxStudioBeta.exe 6020 RobloxStudioBeta.exe 6020 RobloxStudioBeta.exe 6020 RobloxStudioBeta.exe 6020 RobloxStudioBeta.exe 6020 RobloxStudioBeta.exe 6020 RobloxStudioBeta.exe 6020 RobloxStudioBeta.exe 3976 msedgewebview2.exe 4648 msedgewebview2.exe 3976 msedgewebview2.exe 3976 msedgewebview2.exe 3976 msedgewebview2.exe 5208 msedgewebview2.exe 5208 msedgewebview2.exe 5848 msedgewebview2.exe 5212 msedgewebview2.exe 5848 msedgewebview2.exe 5212 msedgewebview2.exe 5848 msedgewebview2.exe 5848 msedgewebview2.exe 5848 msedgewebview2.exe 5848 msedgewebview2.exe 5500 msedgewebview2.exe 1196 msedgewebview2.exe 1196 msedgewebview2.exe 1196 msedgewebview2.exe 4984 msedgewebview2.exe 4984 msedgewebview2.exe 4984 msedgewebview2.exe 3976 msedgewebview2.exe 6020 RobloxStudioBeta.exe -
Registers COM server for autorun 1 TTPs 64 IoCs
Processes:
MicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exesetup.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\INPROCSERVER32 MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\INPROCSERVER32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.185.29\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3A84F9C2-6164-485C-A7D9-4B27F8AC009E}\InProcServer32 setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.185.29\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.185.29\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3A84F9C2-6164-485C-A7D9-4B27F8AC009E}\InProcServer32\ThreadingModel = "Apartment" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B54934CD-71A6-4698-BDC2-AFEA5B86504C}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\124.0.2478.51\\EBWebView\\x64\\EmbeddedBrowserWebView.dll" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BA4344C9-31F7-44C1-9802-7F90B352D5C5}\InProcServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\InprocServer32\ThreadingModel = "Apartment" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{628ACE20-B77A-456F-A88D-547DB6CEEDD5}\LocalServer32\ServerExecutable = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\124.0.2478.51\\notification_helper.exe" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B54934CD-71A6-4698-BDC2-AFEA5B86504C}\InprocServer32\ThreadingModel = "Apartment" setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.185.29\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BA4344C9-31F7-44C1-9802-7F90B352D5C5}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.185.29\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BA4344C9-31F7-44C1-9802-7F90B352D5C5}\InProcServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.185.29\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BA4344C9-31F7-44C1-9802-7F90B352D5C5}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.185.29\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BA4344C9-31F7-44C1-9802-7F90B352D5C5}\InProcServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BA4344C9-31F7-44C1-9802-7F90B352D5C5}\InProcServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\InprocServer32\ setup.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{4A749F25-A9E2-4CBE-9859-CF7B15255E14}\LocalServer32 setup.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{628ACE20-B77A-456F-A88D-547DB6CEEDD5}\LocalServer32\ = "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\124.0.2478.51\\notification_helper.exe\"" setup.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{B54934CD-71A6-4698-BDC2-AFEA5B86504C}\InprocServer32 setup.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\INPROCSERVER32 MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32 MicrosoftEdgeUpdateComRegisterShell64.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
svchost.exesvchost.exesvchost.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString svchost.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString svchost.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 svchost.exe -
Enumerates system info in registry 2 TTPs 11 IoCs
Processes:
chrome.exeRobloxStudioBeta.exemsedgewebview2.exechrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer RobloxStudioBeta.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS RobloxStudioBeta.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedgewebview2.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Processes:
setup.exewwahost.exeRobloxStudioInstaller.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute setup.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EdgeIntegration\AdapterLocations setup.exe Key created \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Internet Explorer\GPU wwahost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\EnterpriseMode\MSEdgePath = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\AppName = "ie_to_edge_stub.exe" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\AppPath = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\124.0.2478.51\\BHO" setup.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Main setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\AppName = "ie_to_edge_stub.exe" setup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\EdgeIntegration\AdapterLocations\C:\Program Files (x86)\Microsoft\Edge\Application = "1" setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio RobloxStudioInstaller.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29} setup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\Policy = "3" setup.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ProtocolExecute\microsoft-edge setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio-auth RobloxStudioInstaller.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Main\EnterpriseMode setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights setup.exe Key created \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Software\Microsoft\Internet Explorer\GPU wwahost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\ = "IEToEdge Handler" setup.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\microsoft-edge setup.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EdgeIntegration setup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio-auth\WarnOnOpen = "0" RobloxStudioInstaller.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\Policy = "3" setup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0" RobloxStudioInstaller.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\AppPath = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\124.0.2478.51\\BHO" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\ = "IEToEdge Handler" setup.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ProtocolExecute setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29} setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy setup.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
MicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exechrome.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exesvchost.exechrome.exesetup.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed MicrosoftEdgeUpdate.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133584554796286640" chrome.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Direct3D svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs MicrosoftEdgeUpdate.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\InstallerPinned = "0" setup.exe -
Modifies registry class 64 IoCs
Processes:
MicrosoftEdgeUpdate.exesetup.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exewwahost.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\NumMethods\ = "5" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\image/svg+xml setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EA92A799-267E-4DF5-A6ED-6A7E0684BB8A}\VersionIndependentProgID\ = "MicrosoftEdgeUpdate.Update3WebSvc" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9} MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{69E11C9D-4974-41A2-B067-9F26953CF52A}\InprocHandler32\ThreadingModel = "Both" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\ = "IGoogleUpdateCore" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\Software\Classes\.html\OpenWithProgids setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\ = "IAppWeb" MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\INPROCSERVER32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{60355531-5BFD-45AB-942C-7912628752C7} MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\ProxyStubClsid32\ = "{BA4344C9-31F7-44C1-9802-7F90B352D5C5}" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF} MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\VersionIndependentProgID\ setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A6B716CB-028B-404D-B72C-50E153DD68DA}\ProgID MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\ = "IGoogleUpdate" MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08D832B9-D2FD-481F-98CF-904D00DF63CC} MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\MicrosoftEdgeUpdate.exe\AppID = "{A6B716CB-028B-404D-B72C-50E153DD68DA}" MicrosoftEdgeUpdate.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB} MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftofficehub_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:" wwahost.exe Key created \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftofficehub_8wekyb3d8bbwe\Internet Explorer\EdpDomStorage wwahost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.PolicyStatusMachineFallback\ = "Google Update Policy Status Class" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497} MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftofficehub_8wekyb3d8bbwe\Internet Explorer\DOMStorage\www.office.com wwahost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E} MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ThreadingModel = "Both" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\ProxyStubClsid32 MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1E8B1A6-32CE-443C-8E2E-EBA90C481353} MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08D832B9-D2FD-481F-98CF-904D00DF63CC}\VersionIndependentProgID\ = "MicrosoftEdgeUpdate.ProcessLauncher" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgePDF\Application\ApplicationName = "Microsoft Edge" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}\NumMethods\ = "4" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\ = "IProgressWndEvents" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69} MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\ProxyStubClsid32\ = "{BA4344C9-31F7-44C1-9802-7F90B352D5C5}" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (int) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftofficehub_8wekyb3d8bbwe\Internet Settings\Cache\History\CacheLimit = "1" wwahost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69} MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}\ = "IProcessLauncher" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\Software\Classes\MSEdgePDF\Application setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgePDF\Application\AppUserModelId = "MSEdge" setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF} MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\NumMethods\ = "8" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9} MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\NumMethods\ = "10" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\NumMethods\ = "8" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\ = "IBrowserHttpRequest2" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\NumMethods MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\ProxyStubClsid32\ = "{BA4344C9-31F7-44C1-9802-7F90B352D5C5}" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\NumMethods\ = "12" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Set value (int) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftofficehub_8wekyb3d8bbwe\Internet Explorer\DOMStorage\office.com\ = "0" wwahost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\ProxyStubClsid32 MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\ = "IApp2" MicrosoftEdgeUpdateComRegisterShell64.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
RobloxStudioBeta.exepid process 6020 RobloxStudioBeta.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
RobloxStudioInstaller.exeMicrosoftEdgeUpdate.exechrome.exeRobloxStudioBeta.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exechrome.exechrome.exeMicrosoftEdgeUpdate.exesetup.exeLocalBridge.exepid process 4572 RobloxStudioInstaller.exe 4572 RobloxStudioInstaller.exe 3568 MicrosoftEdgeUpdate.exe 3568 MicrosoftEdgeUpdate.exe 4304 chrome.exe 4304 chrome.exe 3568 MicrosoftEdgeUpdate.exe 3568 MicrosoftEdgeUpdate.exe 3568 MicrosoftEdgeUpdate.exe 3568 MicrosoftEdgeUpdate.exe 6020 RobloxStudioBeta.exe 6020 RobloxStudioBeta.exe 6020 RobloxStudioBeta.exe 6020 RobloxStudioBeta.exe 6020 RobloxStudioBeta.exe 6020 RobloxStudioBeta.exe 6020 RobloxStudioBeta.exe 6020 RobloxStudioBeta.exe 6020 RobloxStudioBeta.exe 6020 RobloxStudioBeta.exe 6020 RobloxStudioBeta.exe 6020 RobloxStudioBeta.exe 6020 RobloxStudioBeta.exe 6020 RobloxStudioBeta.exe 6020 RobloxStudioBeta.exe 6020 RobloxStudioBeta.exe 6020 RobloxStudioBeta.exe 6020 RobloxStudioBeta.exe 6020 RobloxStudioBeta.exe 6020 RobloxStudioBeta.exe 6020 RobloxStudioBeta.exe 6020 RobloxStudioBeta.exe 6020 RobloxStudioBeta.exe 6020 RobloxStudioBeta.exe 6020 RobloxStudioBeta.exe 6020 RobloxStudioBeta.exe 6020 RobloxStudioBeta.exe 6020 RobloxStudioBeta.exe 6020 RobloxStudioBeta.exe 6020 RobloxStudioBeta.exe 3612 MicrosoftEdgeUpdate.exe 3612 MicrosoftEdgeUpdate.exe 3612 MicrosoftEdgeUpdate.exe 3612 MicrosoftEdgeUpdate.exe 4940 MicrosoftEdgeUpdate.exe 4940 MicrosoftEdgeUpdate.exe 2072 MicrosoftEdgeUpdate.exe 2072 MicrosoftEdgeUpdate.exe 6020 RobloxStudioBeta.exe 6020 RobloxStudioBeta.exe 5816 chrome.exe 5816 chrome.exe 5816 chrome.exe 5816 chrome.exe 3900 chrome.exe 3900 chrome.exe 6024 MicrosoftEdgeUpdate.exe 6024 MicrosoftEdgeUpdate.exe 6024 MicrosoftEdgeUpdate.exe 6024 MicrosoftEdgeUpdate.exe 5848 setup.exe 5848 setup.exe 656 LocalBridge.exe 656 LocalBridge.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
Processes:
RobloxStudioBeta.exeOpenWith.exepid process 6020 RobloxStudioBeta.exe 5816 OpenWith.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
Processes:
chrome.exemsedgewebview2.exechrome.exepid process 4304 chrome.exe 4304 chrome.exe 4304 chrome.exe 4304 chrome.exe 3976 msedgewebview2.exe 3976 msedgewebview2.exe 3976 msedgewebview2.exe 5816 chrome.exe 5816 chrome.exe 5816 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
MicrosoftEdgeUpdate.exechrome.exedescription pid process Token: SeDebugPrivilege 3568 MicrosoftEdgeUpdate.exe Token: SeShutdownPrivilege 4304 chrome.exe Token: SeCreatePagefilePrivilege 4304 chrome.exe Token: SeShutdownPrivilege 4304 chrome.exe Token: SeCreatePagefilePrivilege 4304 chrome.exe Token: SeShutdownPrivilege 4304 chrome.exe Token: SeCreatePagefilePrivilege 4304 chrome.exe Token: SeShutdownPrivilege 4304 chrome.exe Token: SeCreatePagefilePrivilege 4304 chrome.exe Token: SeShutdownPrivilege 4304 chrome.exe Token: SeCreatePagefilePrivilege 4304 chrome.exe Token: SeShutdownPrivilege 4304 chrome.exe Token: SeCreatePagefilePrivilege 4304 chrome.exe Token: SeShutdownPrivilege 4304 chrome.exe Token: SeCreatePagefilePrivilege 4304 chrome.exe Token: SeShutdownPrivilege 4304 chrome.exe Token: SeCreatePagefilePrivilege 4304 chrome.exe Token: SeShutdownPrivilege 4304 chrome.exe Token: SeCreatePagefilePrivilege 4304 chrome.exe Token: SeShutdownPrivilege 4304 chrome.exe Token: SeCreatePagefilePrivilege 4304 chrome.exe Token: SeShutdownPrivilege 4304 chrome.exe Token: SeCreatePagefilePrivilege 4304 chrome.exe Token: SeShutdownPrivilege 4304 chrome.exe Token: SeCreatePagefilePrivilege 4304 chrome.exe Token: SeShutdownPrivilege 4304 chrome.exe Token: SeCreatePagefilePrivilege 4304 chrome.exe Token: SeShutdownPrivilege 4304 chrome.exe Token: SeCreatePagefilePrivilege 4304 chrome.exe Token: SeShutdownPrivilege 4304 chrome.exe Token: SeCreatePagefilePrivilege 4304 chrome.exe Token: SeShutdownPrivilege 4304 chrome.exe Token: SeCreatePagefilePrivilege 4304 chrome.exe Token: SeShutdownPrivilege 4304 chrome.exe Token: SeCreatePagefilePrivilege 4304 chrome.exe Token: SeShutdownPrivilege 4304 chrome.exe Token: SeCreatePagefilePrivilege 4304 chrome.exe Token: SeShutdownPrivilege 4304 chrome.exe Token: SeCreatePagefilePrivilege 4304 chrome.exe Token: SeShutdownPrivilege 4304 chrome.exe Token: SeCreatePagefilePrivilege 4304 chrome.exe Token: SeShutdownPrivilege 4304 chrome.exe Token: SeCreatePagefilePrivilege 4304 chrome.exe Token: SeShutdownPrivilege 4304 chrome.exe Token: SeCreatePagefilePrivilege 4304 chrome.exe Token: SeShutdownPrivilege 4304 chrome.exe Token: SeCreatePagefilePrivilege 4304 chrome.exe Token: SeShutdownPrivilege 4304 chrome.exe Token: SeCreatePagefilePrivilege 4304 chrome.exe Token: SeShutdownPrivilege 4304 chrome.exe Token: SeCreatePagefilePrivilege 4304 chrome.exe Token: SeShutdownPrivilege 4304 chrome.exe Token: SeCreatePagefilePrivilege 4304 chrome.exe Token: SeShutdownPrivilege 4304 chrome.exe Token: SeCreatePagefilePrivilege 4304 chrome.exe Token: SeShutdownPrivilege 4304 chrome.exe Token: SeCreatePagefilePrivilege 4304 chrome.exe Token: SeShutdownPrivilege 4304 chrome.exe Token: SeCreatePagefilePrivilege 4304 chrome.exe Token: SeShutdownPrivilege 4304 chrome.exe Token: SeCreatePagefilePrivilege 4304 chrome.exe Token: SeShutdownPrivilege 4304 chrome.exe Token: SeCreatePagefilePrivilege 4304 chrome.exe Token: SeShutdownPrivilege 4304 chrome.exe -
Suspicious use of FindShellTrayWindow 55 IoCs
Processes:
chrome.exeRobloxStudioBeta.exechrome.exepid process 4304 chrome.exe 4304 chrome.exe 4304 chrome.exe 4304 chrome.exe 4304 chrome.exe 4304 chrome.exe 4304 chrome.exe 4304 chrome.exe 4304 chrome.exe 4304 chrome.exe 4304 chrome.exe 4304 chrome.exe 4304 chrome.exe 4304 chrome.exe 4304 chrome.exe 4304 chrome.exe 4304 chrome.exe 4304 chrome.exe 4304 chrome.exe 4304 chrome.exe 4304 chrome.exe 4304 chrome.exe 4304 chrome.exe 4304 chrome.exe 4304 chrome.exe 4304 chrome.exe 4304 chrome.exe 6020 RobloxStudioBeta.exe 6020 RobloxStudioBeta.exe 5816 chrome.exe 5816 chrome.exe 5816 chrome.exe 5816 chrome.exe 5816 chrome.exe 5816 chrome.exe 5816 chrome.exe 5816 chrome.exe 5816 chrome.exe 5816 chrome.exe 5816 chrome.exe 5816 chrome.exe 5816 chrome.exe 5816 chrome.exe 5816 chrome.exe 5816 chrome.exe 5816 chrome.exe 5816 chrome.exe 5816 chrome.exe 5816 chrome.exe 5816 chrome.exe 5816 chrome.exe 5816 chrome.exe 5816 chrome.exe 5816 chrome.exe 5816 chrome.exe -
Suspicious use of SendNotifyMessage 48 IoCs
Processes:
chrome.exechrome.exepid process 4304 chrome.exe 4304 chrome.exe 4304 chrome.exe 4304 chrome.exe 4304 chrome.exe 4304 chrome.exe 4304 chrome.exe 4304 chrome.exe 4304 chrome.exe 4304 chrome.exe 4304 chrome.exe 4304 chrome.exe 4304 chrome.exe 4304 chrome.exe 4304 chrome.exe 4304 chrome.exe 4304 chrome.exe 4304 chrome.exe 4304 chrome.exe 4304 chrome.exe 4304 chrome.exe 4304 chrome.exe 4304 chrome.exe 4304 chrome.exe 5816 chrome.exe 5816 chrome.exe 5816 chrome.exe 5816 chrome.exe 5816 chrome.exe 5816 chrome.exe 5816 chrome.exe 5816 chrome.exe 5816 chrome.exe 5816 chrome.exe 5816 chrome.exe 5816 chrome.exe 5816 chrome.exe 5816 chrome.exe 5816 chrome.exe 5816 chrome.exe 5816 chrome.exe 5816 chrome.exe 5816 chrome.exe 5816 chrome.exe 5816 chrome.exe 5816 chrome.exe 5816 chrome.exe 5816 chrome.exe -
Suspicious use of SetWindowsHookEx 37 IoCs
Processes:
RobloxStudioBeta.exeOpenWith.exewwahost.exepid process 6020 RobloxStudioBeta.exe 5816 OpenWith.exe 6020 RobloxStudioBeta.exe 6020 RobloxStudioBeta.exe 6020 RobloxStudioBeta.exe 6020 RobloxStudioBeta.exe 6020 RobloxStudioBeta.exe 6020 RobloxStudioBeta.exe 6020 RobloxStudioBeta.exe 6020 RobloxStudioBeta.exe 6020 RobloxStudioBeta.exe 6020 RobloxStudioBeta.exe 6020 RobloxStudioBeta.exe 6020 RobloxStudioBeta.exe 6020 RobloxStudioBeta.exe 6020 RobloxStudioBeta.exe 6020 RobloxStudioBeta.exe 6020 RobloxStudioBeta.exe 6020 RobloxStudioBeta.exe 6020 RobloxStudioBeta.exe 6020 RobloxStudioBeta.exe 6020 RobloxStudioBeta.exe 6020 RobloxStudioBeta.exe 6020 RobloxStudioBeta.exe 6020 RobloxStudioBeta.exe 6020 RobloxStudioBeta.exe 6020 RobloxStudioBeta.exe 6020 RobloxStudioBeta.exe 6020 RobloxStudioBeta.exe 6020 RobloxStudioBeta.exe 6020 RobloxStudioBeta.exe 6020 RobloxStudioBeta.exe 6020 RobloxStudioBeta.exe 6020 RobloxStudioBeta.exe 6020 RobloxStudioBeta.exe 6020 RobloxStudioBeta.exe 2084 wwahost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
RobloxStudioInstaller.exeMicrosoftEdgeWebview2Setup.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exechrome.exedescription pid process target process PID 4572 wrote to memory of 4312 4572 RobloxStudioInstaller.exe MicrosoftEdgeWebview2Setup.exe PID 4572 wrote to memory of 4312 4572 RobloxStudioInstaller.exe MicrosoftEdgeWebview2Setup.exe PID 4572 wrote to memory of 4312 4572 RobloxStudioInstaller.exe MicrosoftEdgeWebview2Setup.exe PID 4312 wrote to memory of 3568 4312 MicrosoftEdgeWebview2Setup.exe MicrosoftEdgeUpdate.exe PID 4312 wrote to memory of 3568 4312 MicrosoftEdgeWebview2Setup.exe MicrosoftEdgeUpdate.exe PID 4312 wrote to memory of 3568 4312 MicrosoftEdgeWebview2Setup.exe MicrosoftEdgeUpdate.exe PID 3568 wrote to memory of 2188 3568 MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe PID 3568 wrote to memory of 2188 3568 MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe PID 3568 wrote to memory of 2188 3568 MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe PID 3568 wrote to memory of 3376 3568 MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe PID 3568 wrote to memory of 3376 3568 MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe PID 3568 wrote to memory of 3376 3568 MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe PID 3376 wrote to memory of 972 3376 MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdateComRegisterShell64.exe PID 3376 wrote to memory of 972 3376 MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdateComRegisterShell64.exe PID 3376 wrote to memory of 2296 3376 MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdateComRegisterShell64.exe PID 3376 wrote to memory of 2296 3376 MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdateComRegisterShell64.exe PID 3376 wrote to memory of 3496 3376 MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdateComRegisterShell64.exe PID 3376 wrote to memory of 3496 3376 MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdateComRegisterShell64.exe PID 3568 wrote to memory of 2972 3568 MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe PID 3568 wrote to memory of 2972 3568 MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe PID 3568 wrote to memory of 2972 3568 MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe PID 3568 wrote to memory of 3368 3568 MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe PID 3568 wrote to memory of 3368 3568 MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe PID 3568 wrote to memory of 3368 3568 MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe PID 3612 wrote to memory of 1220 3612 MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe PID 3612 wrote to memory of 1220 3612 MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe PID 3612 wrote to memory of 1220 3612 MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe PID 4304 wrote to memory of 4244 4304 chrome.exe chrome.exe PID 4304 wrote to memory of 4244 4304 chrome.exe chrome.exe PID 4304 wrote to memory of 3208 4304 chrome.exe chrome.exe PID 4304 wrote to memory of 3208 4304 chrome.exe chrome.exe PID 4304 wrote to memory of 3208 4304 chrome.exe chrome.exe PID 4304 wrote to memory of 3208 4304 chrome.exe chrome.exe PID 4304 wrote to memory of 3208 4304 chrome.exe chrome.exe PID 4304 wrote to memory of 3208 4304 chrome.exe chrome.exe PID 4304 wrote to memory of 3208 4304 chrome.exe chrome.exe PID 4304 wrote to memory of 3208 4304 chrome.exe chrome.exe PID 4304 wrote to memory of 3208 4304 chrome.exe chrome.exe PID 4304 wrote to memory of 3208 4304 chrome.exe chrome.exe PID 4304 wrote to memory of 3208 4304 chrome.exe chrome.exe PID 4304 wrote to memory of 3208 4304 chrome.exe chrome.exe PID 4304 wrote to memory of 3208 4304 chrome.exe chrome.exe PID 4304 wrote to memory of 3208 4304 chrome.exe chrome.exe PID 4304 wrote to memory of 3208 4304 chrome.exe chrome.exe PID 4304 wrote to memory of 3208 4304 chrome.exe chrome.exe PID 4304 wrote to memory of 3208 4304 chrome.exe chrome.exe PID 4304 wrote to memory of 3208 4304 chrome.exe chrome.exe PID 4304 wrote to memory of 3208 4304 chrome.exe chrome.exe PID 4304 wrote to memory of 3208 4304 chrome.exe chrome.exe PID 4304 wrote to memory of 3208 4304 chrome.exe chrome.exe PID 4304 wrote to memory of 3208 4304 chrome.exe chrome.exe PID 4304 wrote to memory of 3208 4304 chrome.exe chrome.exe PID 4304 wrote to memory of 3208 4304 chrome.exe chrome.exe PID 4304 wrote to memory of 3208 4304 chrome.exe chrome.exe PID 4304 wrote to memory of 3208 4304 chrome.exe chrome.exe PID 4304 wrote to memory of 3208 4304 chrome.exe chrome.exe PID 4304 wrote to memory of 3208 4304 chrome.exe chrome.exe PID 4304 wrote to memory of 3208 4304 chrome.exe chrome.exe PID 4304 wrote to memory of 3208 4304 chrome.exe chrome.exe PID 4304 wrote to memory of 3208 4304 chrome.exe chrome.exe PID 4304 wrote to memory of 4628 4304 chrome.exe chrome.exe PID 4304 wrote to memory of 4628 4304 chrome.exe chrome.exe PID 4304 wrote to memory of 3448 4304 chrome.exe chrome.exe PID 4304 wrote to memory of 3448 4304 chrome.exe chrome.exe -
System policy modification 1 TTPs 5 IoCs
Processes:
msedgewebview2.exesetup.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection msedgewebview2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\ setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C} = "1" setup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\RobloxStudioInstaller.exe"C:\Users\Admin\AppData\Local\Temp\RobloxStudioInstaller.exe"1⤵
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Roblox\Versions\version-1870963560174427\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exeMicrosoftEdgeWebview2Setup.exe /silent /install2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Temp\EU3C39.tmp\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\Temp\EU3C39.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"3⤵
- Sets file execution options in registry
- Checks computer location settings
- Checks system information in the registry
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc4⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver4⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QzE0QkMxRDctQ0QyQS00QUI5LTlCNTYtQTY4QkJCQjQwMzhDfSIgdXNlcmlkPSJ7RDFEMUVEODktNUIwOC00NzlELUE2QjEtMUU5M0IzQkI3M0I2fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins4RDAzREMwRC1BM0YyLTQzMEQtQkZENy1EMzJCNDNCM0UxMDl9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7KzBqVW1ZZUt0WkFGNUMzZzIycEJCNUYwUnlkdGYxU0g3Ym53c25vVStmaz0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE4NS4yOSIgbmV4dHZlcnNpb249IjEuMy4xNzEuMzkiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjUxOTcxNzA2MTQiIGluc3RhbGxfdGltZV9tcz0iNTU4Ii8-PC9hcHA-PC9yZXF1ZXN0Pg4⤵
- Checks system information in the registry
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{C14BC1D7-CD2A-4AB9-9B56-A68BBBB4038C}" /silent4⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files (x86)\Roblox\Versions\version-1870963560174427\RobloxStudioBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-1870963560174427\RobloxStudioBeta.exe" -startEvent www.roblox.com/robloxQTStudioStartedEvent -firstLaunch2⤵
- Checks whether UAC is enabled
- Executes dropped EXE
- Loads dropped DLL
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\124.0.2478.51\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\124.0.2478.51\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 621, 0, 6210527" --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=6020.4748.57030747427040027963⤵
- Checks computer location settings
- Checks system information in the registry
- Executes dropped EXE
- Loads dropped DLL
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- System policy modification
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\124.0.2478.51\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\124.0.2478.51\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=124.0.6367.61 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\124.0.2478.51\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=124.0.2478.51 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ff9ea63ceb8,0x7ff9ea63cec4,0x7ff9ea63ced04⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\124.0.2478.51\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\124.0.2478.51\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 621, 0, 6210527" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1756,i,16413889262180404554,12396802166595262027,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=1748 /prefetch:24⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\124.0.2478.51\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\124.0.2478.51\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 621, 0, 6210527" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --field-trial-handle=1816,i,16413889262180404554,12396802166595262027,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=2968 /prefetch:34⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\124.0.2478.51\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\124.0.2478.51\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 621, 0, 6210527" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --field-trial-handle=2100,i,16413889262180404554,12396802166595262027,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=3084 /prefetch:84⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\124.0.2478.51\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\124.0.2478.51\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 621, 0, 6210527" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --field-trial-handle=3456,i,16413889262180404554,12396802166595262027,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:14⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\124.0.2478.51\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\124.0.2478.51\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 621, 0, 6210527" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --field-trial-handle=3148,i,16413889262180404554,12396802166595262027,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=4064 /prefetch:14⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\124.0.2478.51\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\124.0.2478.51\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 621, 0, 6210527" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --field-trial-handle=3688,i,16413889262180404554,12396802166595262027,262144 --enable-features=MojoIpcz --variations-seed-version --mojo-platform-channel-handle=3720 /prefetch:14⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc1⤵
- Checks system information in the registry
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QzE0QkMxRDctQ0QyQS00QUI5LTlCNTYtQTY4QkJCQjQwMzhDfSIgdXNlcmlkPSJ7RDFEMUVEODktNUIwOC00NzlELUE2QjEtMUU5M0IzQkI3M0I2fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntBRDU1Njg1QS0xRTEzLTRFMUYtQjMyNi00QjkwOTFGRTkyRDB9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7KzBqVW1ZZUt0WkFGNUMzZzIycEJCNUYwUnlkdGYxU0g3Ym53c25vVStmaz0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTEwLjAuNTQ4MS4xMDQiIG5leHR2ZXJzaW9uPSIxMTAuMC41NDgxLjEwNCIgbGFuZz0iZW4iIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjUiIHN5c3RlbV91cHRpbWVfdGlja3M9IjUyMDI2MTA1NjQiLz48L2FwcD48L3JlcXVlc3Q-2⤵
- Checks system information in the registry
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{AFAB6D36-AA7E-4A0C-AE5F-A4D85EA3A40C}\MicrosoftEdge_X64_124.0.2478.51.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{AFAB6D36-AA7E-4A0C-AE5F-A4D85EA3A40C}\MicrosoftEdge_X64_124.0.2478.51.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level2⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{AFAB6D36-AA7E-4A0C-AE5F-A4D85EA3A40C}\EDGEMITMP_7B4F3.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{AFAB6D36-AA7E-4A0C-AE5F-A4D85EA3A40C}\EDGEMITMP_7B4F3.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{AFAB6D36-AA7E-4A0C-AE5F-A4D85EA3A40C}\MicrosoftEdge_X64_124.0.2478.51.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level3⤵
- Drops file in Program Files directory
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{AFAB6D36-AA7E-4A0C-AE5F-A4D85EA3A40C}\EDGEMITMP_7B4F3.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{AFAB6D36-AA7E-4A0C-AE5F-A4D85EA3A40C}\EDGEMITMP_7B4F3.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=124.0.6367.61 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{AFAB6D36-AA7E-4A0C-AE5F-A4D85EA3A40C}\EDGEMITMP_7B4F3.tmp\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=124.0.2478.51 --initial-client-data=0x22c,0x230,0x234,0x208,0x238,0x7ff6b4e478c0,0x7ff6b4e478cc,0x7ff6b4e478d84⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QzE0QkMxRDctQ0QyQS00QUI5LTlCNTYtQTY4QkJCQjQwMzhDfSIgdXNlcmlkPSJ7RDFEMUVEODktNUIwOC00NzlELUE2QjEtMUU5M0IzQkI3M0I2fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9InszOTE2MEREMS1CRDEzLTQwQjYtODdDNi1BQTk2ODRCNEI3Rjh9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7cjQ1MnQxK2syVGdxL0hYemp2Rk5CUmhvcEJXUjlzYmpYeHFlVURIOXVYMD0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjMwMTcyMjYtRkUyQS00Mjk1LThCREYtMDBDM0E5QTdFNEM1fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMTI0LjAuMjQ3OC41MSIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNvbnNlbnQ9ZmFsc2UiIGluc3RhbGxhZ2U9Ii0xIiBpbnN0YWxsZGF0ZT0iLTEiPjx1cGRhdGVjaGVjay8-PGV2ZW50IGV2ZW50dHlwZT0iOSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTIzNDQ3MDYwMiIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjUyMzQ1NDA2MjIiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1NTA5MzkwNzA4IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuZi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy9lZGZiNjUxZi1hNjZkLTRkNDMtYTUzZS0zN2M3OGVlYTlhMTY_UDE9MTcxNDU4NjY1OSZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1aOXdsYmtpQ0pMRjAxS1VXNmFTWGV4eXVZcCUyYkpUVldRTmtZbGdhdW11SmZtUmtSNEhycXJyVzRvakZhSHhPWFBrQmhwJTJmaEhGa1dCVzFPY1hxWnM5Q0ElM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIxNzI2ODI4MDgiIHRvdGFsPSIxNzI2ODI4MDgiIGRvd25sb2FkX3RpbWVfbXM9IjIxMDUyIi8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTUwOTQ3MDg4NiIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjYiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjU1MjQ3NjA2MjYiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIxOTY3NTciIHN5c3RlbV91cHRpbWVfdGlja3M9IjU5ODcwOTIxNjUiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIHVwZGF0ZV9jaGVja190aW1lX21zPSIxMzA0IiBkb3dubG9hZF90aW1lX21zPSIyNzQ4NyIgZG93bmxvYWRlZD0iMTcyNjgyODA4IiB0b3RhbD0iMTcyNjgyODA4IiBwYWNrYWdlX2NhY2hlX3Jlc3VsdD0iMCIgaW5zdGFsbF90aW1lX21zPSI0NjIzMiIvPjwvYXBwPjwvcmVxdWVzdD42⤵
- Checks system information in the registry
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff9ee8dab58,0x7ff9ee8dab68,0x7ff9ee8dab782⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1740 --field-trial-handle=1700,i,8474514340882252895,9930174776322468807,131072 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 --field-trial-handle=1700,i,8474514340882252895,9930174776322468807,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2236 --field-trial-handle=1700,i,8474514340882252895,9930174776322468807,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3096 --field-trial-handle=1700,i,8474514340882252895,9930174776322468807,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3116 --field-trial-handle=1700,i,8474514340882252895,9930174776322468807,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3088 --field-trial-handle=1700,i,8474514340882252895,9930174776322468807,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4452 --field-trial-handle=1700,i,8474514340882252895,9930174776322468807,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4604 --field-trial-handle=1700,i,8474514340882252895,9930174776322468807,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4796 --field-trial-handle=1700,i,8474514340882252895,9930174776322468807,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4596 --field-trial-handle=1700,i,8474514340882252895,9930174776322468807,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4560 --field-trial-handle=1700,i,8474514340882252895,9930174776322468807,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4988 --field-trial-handle=1700,i,8474514340882252895,9930174776322468807,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3312 --field-trial-handle=1700,i,8474514340882252895,9930174776322468807,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4776 --field-trial-handle=1700,i,8474514340882252895,9930174776322468807,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3464 --field-trial-handle=1700,i,8474514340882252895,9930174776322468807,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=1892 --field-trial-handle=1700,i,8474514340882252895,9930174776322468807,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x2f4 0x3fc1⤵
-
C:\Windows\System32\GameBarPresenceWriter.exe"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k GraphicsPerfSvcGroup -s GraphicsPerfSvc1⤵
- Checks processor information in registry
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler1⤵
- Checks system information in the registry
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc1⤵
- Checks system information in the registry
- Executes dropped EXE
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D8D07E96-7F8A-46E0-B75F-B318EC795719}\BGAUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D8D07E96-7F8A-46E0-B75F-B318EC795719}\BGAUpdate.exe" --edgeupdate-client --system-level2⤵
- Adds Run key to start application
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RTVDRDkzMUQtNzczQy00NjNCLUFEOTQtMzc5QURCNjkwMjQ0fSIgdXNlcmlkPSJ7RDFEMUVEODktNUIwOC00NzlELUE2QjEtMUU5M0IzQkI3M0I2fSIgaW5zdGFsbHNvdXJjZT0ic2NoZWR1bGVyIiByZXF1ZXN0aWQ9InswNDcyMzUyOC0yQTZFLTRDQzgtQTFERC05NEQ5MzQxREI3QzJ9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7cjQ1MnQxK2syVGdxL0hYemp2Rk5CUmhvcEJXUjlzYmpYeHFlVURIOXVYMD0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7MUZBQjhDRkUtOTg2MC00MTVDLUE2Q0EtQUE3RDEyMDIxOTQwfSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMi4wLjAuMzQiIGxhbmc9IiIgYnJhbmQ9IkVVRkkiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY29uc2VudD1mYWxzZSIgaW5zdGFsbGFnZT0iLTEiIGluc3RhbGxkYXRlPSItMSI-PHVwZGF0ZWNoZWNrLz48ZXZlbnQgZXZlbnR0eXBlPSI5IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI4MjM4OTA1NjY4IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iODIzODk2NTY3NiIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIwIiBlcnJvcmNvZGU9Ii0yMTQ3MDIzODM4IiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI4MzMzMTAwNDg1IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJkbyIgdXJsPSJodHRwOi8vbXNlZGdlLmIudGx1LmRsLmRlbGl2ZXJ5Lm1wLm1pY3Jvc29mdC5jb20vZmlsZXN0cmVhbWluZ3NlcnZpY2UvZmlsZXMvNWYxOTU2MTItMzg0YS00OGVhLTg0MDgtYjRlZGU5ZGM1NmJiP1AxPTE3MTQ1ODY5NTkmYW1wO1AyPTQwNCZhbXA7UDM9MiZhbXA7UDQ9TEUwY09KWENMaTduTlllY0o3MkZWdzZidE5TWVBNUVBIMUtMejJhMDlQM3BSJTJmSVVGMnpwMk9OVGdiNnRBVUwlMmZ5U0Z1JTJmejZlczhBN1k3OU9xZXR1aFElM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIwIiB0b3RhbD0iMCIgZG93bmxvYWRfdGltZV9tcz0iMjciLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMCIgZXJyb3Jjb2RlPSItMjE0NTM4NjM4NSIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iODMzMzExMDQ4NSIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgZG93bmxvYWRlcj0iYml0cyIgdXJsPSJodHRwOi8vbXNlZGdlLmIudGx1LmRsLmRlbGl2ZXJ5Lm1wLm1pY3Jvc29mdC5jb20vZmlsZXN0cmVhbWluZ3NlcnZpY2UvZmlsZXMvNWYxOTU2MTItMzg0YS00OGVhLTg0MDgtYjRlZGU5ZGM1NmJiP1AxPTE3MTQ1ODY5NTkmYW1wO1AyPTQwNCZhbXA7UDM9MiZhbXA7UDQ9TEUwY09KWENMaTduTlllY0o3MkZWdzZidE5TWVBNUVBIMUtMejJhMDlQM3BSJTJmSVVGMnpwMk9OVGdiNnRBVUwlMmZ5U0Z1JTJmejZlczhBN1k3OU9xZXR1aFElM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIwIiB0b3RhbD0iLTEiIGRvd25sb2FkX3RpbWVfbXM9IjY2Ii8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iODMzMzEyMDQ3OSIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgZG93bmxvYWRlcj0id2luaHR0cCIgdXJsPSJodHRwOi8vbXNlZGdlLmIudGx1LmRsLmRlbGl2ZXJ5Lm1wLm1pY3Jvc29mdC5jb20vZmlsZXN0cmVhbWluZ3NlcnZpY2UvZmlsZXMvNWYxOTU2MTItMzg0YS00OGVhLTg0MDgtYjRlZGU5ZGM1NmJiP1AxPTE3MTQ1ODY5NTkmYW1wO1AyPTQwNCZhbXA7UDM9MiZhbXA7UDQ9TEUwY09KWENMaTduTlllY0o3MkZWdzZidE5TWVBNUVBIMUtMejJhMDlQM3BSJTJmSVVGMnpwMk9OVGdiNnRBVUwlMmZ5U0Z1JTJmejZlczhBN1k3OU9xZXR1aFElM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIxMDQuOTEuNzEuMTQ2IiBjZG5fY2lkPSIyIiBjZG5fY2NjPSJHQiIgY2RuX21zZWRnZV9yZWY9IiIgY2RuX2F6dXJlX3JlZl9vcmlnaW5fc2hpZWxkPSIiIGNkbl9jYWNoZT0iIiBjZG5fcDNwPSIiIGRvd25sb2FkZWQ9IjE4MDQ0NDQ4IiB0b3RhbD0iMTgwNDQ0NDgiIGRvd25sb2FkX3RpbWVfbXM9IjM0MjEiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI4MzMzMTUwNDQ4IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iODMzOTYyMDQ2NyIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjgzNTQ0NzUwMjUiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIHVwZGF0ZV9jaGVja190aW1lX21zPSI5MDYiIGRvd25sb2FkX3RpbWVfbXM9IjkzNDQiIGRvd25sb2FkZWQ9IjE4MDQ0NDQ4IiB0b3RhbD0iMTgwNDQ0NDgiIHBhY2thZ2VfY2FjaGVfcmVzdWx0PSIwIiBpbnN0YWxsX3RpbWVfbXM9IjE0ODQiLz48L2FwcD48L3JlcXVlc3Q-2⤵
- Checks system information in the registry
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc1⤵
- Checks system information in the registry
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{24DCF75E-972C-4845-ACC4-1C172D8B9583}\MicrosoftEdgeUpdateSetup_X86_1.3.185.29.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{24DCF75E-972C-4845-ACC4-1C172D8B9583}\MicrosoftEdgeUpdateSetup_X86_1.3.185.29.exe" /update /sessionid "{949A2181-22D0-4468-AE17-E6B5B5EBF3F4}"2⤵
- Drops file in Program Files directory
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Temp\EU9221.tmp\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\Temp\EU9221.tmp\MicrosoftEdgeUpdate.exe" /update /sessionid "{949A2181-22D0-4468-AE17-E6B5B5EBF3F4}"3⤵
- Sets file execution options in registry
- Checks system information in the registry
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc4⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver4⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.185.29\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.185.29\MicrosoftEdgeUpdateComRegisterShell64.exe"5⤵
- Executes dropped EXE
- Registers COM server for autorun
- Modifies registry class
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.185.29\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.185.29\MicrosoftEdgeUpdateComRegisterShell64.exe"5⤵
- Executes dropped EXE
- Registers COM server for autorun
- Modifies registry class
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.185.29\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.185.29\MicrosoftEdgeUpdateComRegisterShell64.exe"5⤵
- Executes dropped EXE
- Registers COM server for autorun
- Modifies registry class
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODUuMjkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7OTQ5QTIxODEtMjJEMC00NDY4LUFFMTctRTZCNUI1RUJGM0Y0fSIgdXNlcmlkPSJ7RDFEMUVEODktNUIwOC00NzlELUE2QjEtMUU5M0IzQkI3M0I2fSIgaW5zdGFsbHNvdXJjZT0ic2VsZnVwZGF0ZSIgcmVxdWVzdGlkPSJ7QjIwN0ZCRDAtMDI4Ny00QjIzLTlFMUItNzdFMjY0MjM1MTBDfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O3I0NTJ0MStrMlRncS9IWHpqdkZOQlJob3BCV1I5c2JqWHhxZVVESDl1WDA9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0ie0YzQzRGRTAwLUVGRDUtNDAzQi05NTY5LTM5OEEyMEYxQkE0QX0iIHZlcnNpb249IjEuMy4xNzEuMzkiIG5leHR2ZXJzaW9uPSIxLjMuMTg1LjI5IiBsYW5nPSIiIGJyYW5kPSJJTkJYIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMTIiIGluc3RhbGxkYXRldGltZT0iMTcxMjkyMTUwOCI-PGV2ZW50IGV2ZW50dHlwZT0iMyIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iOTk0MDM5MzQ4MSIvPjwvYXBwPjwvcmVxdWVzdD44⤵
- Checks system information in the registry
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7OTQ5QTIxODEtMjJEMC00NDY4LUFFMTctRTZCNUI1RUJGM0Y0fSIgdXNlcmlkPSJ7RDFEMUVEODktNUIwOC00NzlELUE2QjEtMUU5M0IzQkI3M0I2fSIgaW5zdGFsbHNvdXJjZT0ic2NoZWR1bGVyIiByZXF1ZXN0aWQ9IntEQkYzMUZEQS1BQUFDLTQyRUYtOUU5NC1GMDY1MEFCRTQ1Q0Z9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7cjQ1MnQxK2syVGdxL0hYemp2Rk5CUmhvcEJXUjlzYmpYeHFlVURIOXVYMD0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE3MS4zOSIgbmV4dHZlcnNpb249IjEuMy4xODUuMjkiIGxhbmc9IiIgYnJhbmQ9IklOQlgiIGNsaWVudD0iIiBleHBlcmltZW50cz0iSXNPbkludGVydmFsQ29tbWFuZHNBbGxvd2VkPS10YXJnZXRfZGV2O1Byb2R1Y3RzVG9SZWdpc3Rlcj0lN0IxRkFCOENGRS05ODYwLTQxNUMtQTZDQS1BQTdEMTIwMjE5NDAlN0QiIGluc3RhbGxhZ2U9IjEyIj48dXBkYXRlY2hlY2svPjxldmVudCBldmVudHR5cGU9IjEyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI4NTUwMjY2OTQ0IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTMiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9Ijg1NTA2MTY4NzUiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNCIgZXZlbnRyZXN1bHQ9IjAiIGVycm9yY29kZT0iLTIxNDcwMjM4MzgiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9Ijg2NTE4MDIwNzgiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIGRvd25sb2FkZXI9ImRvIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuYi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy83MmVkODA4Ny1lZTk4LTQyOWMtOTMzMC1jYTNjMTkzZDQxYWY_UDE9MTcxNDU4Njk5MSZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1FQWUxQXNJMUs4SDc1M3VPbTFVMko4RDVBclRPY3clMmJrN0M2eDl1bXNWNiUyZkI5NVpDb0ZIUFJDY1FrZlVDVUx0QUU0UkpraEwlMmZTaldqb1Jla3dJaCUyYlNBJTNkJTNkIiBzZXJ2ZXJfaXBfaGludD0iIiBjZG5fY2lkPSItMSIgY2RuX2NjYz0iIiBjZG5fbXNlZGdlX3JlZj0iIiBjZG5fYXp1cmVfcmVmX29yaWdpbl9zaGllbGQ9IiIgY2RuX2NhY2hlPSIiIGNkbl9wM3A9IiIgZG93bmxvYWRlZD0iMCIgdG90YWw9IjAiIGRvd25sb2FkX3RpbWVfbXM9IjQiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNCIgZXZlbnRyZXN1bHQ9IjAiIGVycm9yY29kZT0iLTIxNDUzODYzODUiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9Ijg2NTE4MjIxMDQiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIGRvd25sb2FkZXI9ImJpdHMiIHVybD0iaHR0cDovL21zZWRnZS5iLnRsdS5kbC5kZWxpdmVyeS5tcC5taWNyb3NvZnQuY29tL2ZpbGVzdHJlYW1pbmdzZXJ2aWNlL2ZpbGVzLzcyZWQ4MDg3LWVlOTgtNDI5Yy05MzMwLWNhM2MxOTNkNDFhZj9QMT0xNzE0NTg2OTkxJmFtcDtQMj00MDQmYW1wO1AzPTImYW1wO1A0PUVBZTFBc0kxSzhINzUzdU9tMVUySjhENUFyVE9jdyUyYms3QzZ4OXVtc1Y2JTJmQjk1WkNvRkhQUkNjUWtmVUNVTHRBRTRSSmtoTCUyZlNqV2pvUmVrd0loJTJiU0ElM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIwIiB0b3RhbD0iLTEiIGRvd25sb2FkX3RpbWVfbXM9IjY2Ii8-PGV2ZW50IGV2ZW50dHlwZT0iMTQiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9Ijg2NTE4MzIwOTYiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIGRvd25sb2FkZXI9Indpbmh0dHAiIHVybD0iaHR0cDovL21zZWRnZS5iLnRsdS5kbC5kZWxpdmVyeS5tcC5taWNyb3NvZnQuY29tL2ZpbGVzdHJlYW1pbmdzZXJ2aWNlL2ZpbGVzLzcyZWQ4MDg3LWVlOTgtNDI5Yy05MzMwLWNhM2MxOTNkNDFhZj9QMT0xNzE0NTg2OTkxJmFtcDtQMj00MDQmYW1wO1AzPTImYW1wO1A0PUVBZTFBc0kxSzhINzUzdU9tMVUySjhENUFyVE9jdyUyYms3QzZ4OXVtc1Y2JTJmQjk1WkNvRkhQUkNjUWtmVUNVTHRBRTRSSmtoTCUyZlNqV2pvUmVrd0loJTJiU0ElM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIxOTkuMjMyLjIxMC4xNzIiIGNkbl9jaWQ9IjMiIGNkbl9jY2M9IkdCIiBjZG5fbXNlZGdlX3JlZj0iUmVmIEE6IDYwQ0E4NTQ3Mjc3NDQ2NTM4MUVENzU3NTU1NEVBQjM5IFJlZiBCOiBMT04wNEVER0UwOTEwIFJlZiBDOiAyMDI0LTA0LTAxVDE3OjUzOjIwWiIgY2RuX2F6dXJlX3JlZl9vcmlnaW5fc2hpZWxkPSJSZWYgQTogQ0M0M0U2OUFDOTEyNEIzRDlDMDc3NDFBODlGRkI0Q0IgUmVmIEI6IEFNUzIzMTAyMTAxNDAwNSBSZWYgQzogMjAyNC0wNC0wMVQxNzo1MzoyMFoiIGNkbl9jYWNoZT0iSElULCBISVQiIGNkbl9wM3A9IiIgZG93bmxvYWRlZD0iMTYzMDc5MiIgdG90YWw9IjE2MzA3OTIiIGRvd25sb2FkX3RpbWVfbXM9Ijk4MjkiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNCIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iODY1MTg1MjE0NyIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjE1IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI4NjU3MDg3NzA4IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PHBpbmcgcj0iMTIiIHJkPSI2MzExIiBwaW5nX2ZyZXNobmVzcz0ie0QzMTdFMDdDLUY0OUQtNDMxQy1CRUM2LTU1NDI2N0Q5NzNDRH0iLz48L2FwcD48YXBwIGFwcGlkPSJ7NTZFQjE4RjgtQjAwOC00Q0JELUI2RDItOEM5N0ZFN0U5MDYyfSIgdmVyc2lvbj0iOTIuMC45MDIuNjciIG5leHR2ZXJzaW9uPSIiIGxhbmc9IiIgYnJhbmQ9IklOQlgiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY29uc2VudD1mYWxzZSIgaW5zdGFsbGFnZT0iMTIiIGxhc3RfbGF1bmNoX3RpbWU9IjEzMzU3Mzk4ODg4Mjk4Njc5MCI-PHVwZGF0ZWNoZWNrLz48cGluZyBhY3RpdmU9IjEiIGE9IjEyIiByPSIxMiIgYWQ9IjYzMTEiIHJkPSI2MzExIiBwaW5nX2ZyZXNobmVzcz0ie0I2QzYzOEJFLTIzRDItNEU3OC1BQzlFLTRDQjU3NTQ5QTZFMH0iLz48L2FwcD48YXBwIGFwcGlkPSJ7RjMwMTcyMjYtRkUyQS00Mjk1LThCREYtMDBDM0E5QTdFNEM1fSIgdmVyc2lvbj0iMTI0LjAuMjQ3OC41MSIgbmV4dHZlcnNpb249IiIgbGFuZz0iIiBicmFuZD0iR0dMUyIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJjb25zZW50PWZhbHNlIiBpbnN0YWxsYWdlPSIwIiBpbnN0YWxsZGF0ZT0iNjMyMSIgbGFzdF9sYXVuY2hfdGltZT0iMTMzNTg0NTU1NDA2NDA4MTIwIj48dXBkYXRlY2hlY2svPjxwaW5nIGFjdGl2ZT0iMSIgYT0iLTEiIHI9Ii0xIiBhZD0iLTEiIHJkPSItMSIgcGluZ19mcmVzaG5lc3M9InszMDg0OENFRS05MUQ3LTREQTUtQUQyMS1BMjkzRjFCNDg0Qzh9Ii8-PC9hcHA-PC9yZXF1ZXN0Pg2⤵
- Checks system information in the registry
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Checks processor information in registry
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9ee8dab58,0x7ff9ee8dab68,0x7ff9ee8dab782⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1808 --field-trial-handle=1832,i,9911187317367619843,14950366573723469994,131072 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=1832,i,9911187317367619843,14950366573723469994,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1400 --field-trial-handle=1832,i,9911187317367619843,14950366573723469994,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3000 --field-trial-handle=1832,i,9911187317367619843,14950366573723469994,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3260 --field-trial-handle=1832,i,9911187317367619843,14950366573723469994,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4172 --field-trial-handle=1832,i,9911187317367619843,14950366573723469994,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4384 --field-trial-handle=1832,i,9911187317367619843,14950366573723469994,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4556 --field-trial-handle=1832,i,9911187317367619843,14950366573723469994,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4740 --field-trial-handle=1832,i,9911187317367619843,14950366573723469994,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4440 --field-trial-handle=1832,i,9911187317367619843,14950366573723469994,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4896 --field-trial-handle=1832,i,9911187317367619843,14950366573723469994,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4700 --field-trial-handle=1832,i,9911187317367619843,14950366573723469994,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4088 --field-trial-handle=1832,i,9911187317367619843,14950366573723469994,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4436 --field-trial-handle=1832,i,9911187317367619843,14950366573723469994,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2468 --field-trial-handle=1832,i,9911187317367619843,14950366573723469994,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc1⤵
- Checks system information in the registry
- Executes dropped EXE
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODUuMjkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7Q0ZBRDJEMTctQjhDMi00ODUzLUI3NDMtMjZCMDJGODAxQ0YyfSIgdXNlcmlkPSJ7RDFEMUVEODktNUIwOC00NzlELUE2QjEtMUU5M0IzQkI3M0I2fSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7MDBEQUUzNEItM0ZEMS00RkRBLUE1MDItMERCNUY0RkUyRUM5fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0R4T2JqSEdhK25SYTJhdEMzd28rSUVwQzc4K1pZZUFVYmtYcERDMmNqN1U9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjExMC4wLjU0ODEuMTA0IiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIxMiIgaW5zdGFsbGRhdGV0aW1lPSIxNzEyOTIyNDYyIiBvb2JlX2luc3RhbGxfdGltZT0iMTMzNTczOTUxMDgwMDAwMDAwIj48ZXZlbnQgZXZlbnR0eXBlPSIzMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMjExNDMyNCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTI0ODI2OTMzMzkiLz48L2FwcD48L3JlcXVlc3Q-2⤵
- Checks system information in the registry
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B34CBCF6-F243-45C6-99A2-D8FFEF502754}\MicrosoftEdge_X64_124.0.2478.51.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B34CBCF6-F243-45C6-99A2-D8FFEF502754}\MicrosoftEdge_X64_124.0.2478.51.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable2⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B34CBCF6-F243-45C6-99A2-D8FFEF502754}\EDGEMITMP_F3A1F.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B34CBCF6-F243-45C6-99A2-D8FFEF502754}\EDGEMITMP_F3A1F.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B34CBCF6-F243-45C6-99A2-D8FFEF502754}\MicrosoftEdge_X64_124.0.2478.51.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable3⤵
- Adds Run key to start application
- Installs/modifies Browser Helper Object
- Modifies Installed Components in the registry
- Executes dropped EXE
- Registers COM server for autorun
- Modifies Internet Explorer settings
- Modifies registry class
- System policy modification
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B34CBCF6-F243-45C6-99A2-D8FFEF502754}\EDGEMITMP_F3A1F.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B34CBCF6-F243-45C6-99A2-D8FFEF502754}\EDGEMITMP_F3A1F.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=124.0.6367.61 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B34CBCF6-F243-45C6-99A2-D8FFEF502754}\EDGEMITMP_F3A1F.tmp\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=124.0.2478.51 --initial-client-data=0x27c,0x280,0x284,0x258,0x288,0x7ff6f4df78c0,0x7ff6f4df78cc,0x7ff6f4df78d84⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B34CBCF6-F243-45C6-99A2-D8FFEF502754}\EDGEMITMP_F3A1F.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B34CBCF6-F243-45C6-99A2-D8FFEF502754}\EDGEMITMP_F3A1F.tmp\setup.exe" --msedge --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=14⤵
- Drops file in System32 directory
- Executes dropped EXE
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B34CBCF6-F243-45C6-99A2-D8FFEF502754}\EDGEMITMP_F3A1F.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B34CBCF6-F243-45C6-99A2-D8FFEF502754}\EDGEMITMP_F3A1F.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=124.0.6367.61 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B34CBCF6-F243-45C6-99A2-D8FFEF502754}\EDGEMITMP_F3A1F.tmp\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=124.0.2478.51 --initial-client-data=0x234,0x238,0x23c,0x210,0x240,0x7ff6f4df78c0,0x7ff6f4df78cc,0x7ff6f4df78d85⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.51\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.51\Installer\setup.exe" --msedge --channel=stable --register-package-identity --verbose-logging --system-level4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.51\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.51\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=124.0.6367.61 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.51\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=124.0.2478.51 --initial-client-data=0x234,0x238,0x23c,0x210,0x240,0x7ff6ed7a78c0,0x7ff6ed7a78cc,0x7ff6ed7a78d85⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODUuMjkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7Q0ZBRDJEMTctQjhDMi00ODUzLUI3NDMtMjZCMDJGODAxQ0YyfSIgdXNlcmlkPSJ7RDFEMUVEODktNUIwOC00NzlELUE2QjEtMUU5M0IzQkI3M0I2fSIgaW5zdGFsbHNvdXJjZT0ic2NoZWR1bGVyIiByZXF1ZXN0aWQ9Ins0ODkyN0JGQi01QzMzLTQ3NjUtODcyMi1FMzNEMEUyNkE0MkR9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7VlBRb1AxRitmcTE1d1J6aDFrUEw0UE1wV2g4T1JNQjVpenZyT0MvY2hqUT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE4NS4yOSIgbmV4dHZlcnNpb249IiIgbGFuZz0iIiBicmFuZD0iSU5CWCIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJJc09uSW50ZXJ2YWxDb21tYW5kc0FsbG93ZWQ9LXRhcmdldF9kZXY7UHJvZHVjdHNUb1JlZ2lzdGVyPSU3QjFGQUI4Q0ZFLTk4NjAtNDE1Qy1BNkNBLUFBN0QxMjAyMTk0MCU3RCIgaW5zdGFsbGFnZT0iMTIiIGNvaG9ydD0icnJmQDAuMDkiPjx1cGRhdGVjaGVjay8-PHBpbmcgcmQ9IjYzMjMiIHBpbmdfZnJlc2huZXNzPSJ7REU1OUM5MTUtMTg5MS00RjlDLTg1RTQtNkE2NTdBOThBNTU1fSIvPjwvYXBwPjxhcHAgYXBwaWQ9Ins1NkVCMThGOC1CMDA4LTRDQkQtQjZEMi04Qzk3RkU3RTkwNjJ9IiB2ZXJzaW9uPSI5Mi4wLjkwMi42NyIgbmV4dHZlcnNpb249IjEyNC4wLjI0NzguNTEiIGxhbmc9IiIgYnJhbmQ9IklOQlgiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY29uc2VudD1mYWxzZSIgaW5zdGFsbGFnZT0iMTIiIGlzX3Bpbm5lZF9zeXN0ZW09InRydWUiIGxhc3RfbGF1bmNoX2NvdW50PSIxIiBsYXN0X2xhdW5jaF90aW1lPSIxMzM1NzM5ODg4ODI5ODY3OTAiPjx1cGRhdGVjaGVjay8-PGV2ZW50IGV2ZW50dHlwZT0iMTIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjEyNDk0MzQ4NjQ2IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTMiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjEyNDk0NTA4NTc5IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTQiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjEyNTIxMjg1NDYxIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjEyNTM1MzUwOTYzIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMyIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMTk2NzU3IiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMjkwNDI1NDE1NSIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgdXBkYXRlX2NoZWNrX3RpbWVfbXM9IjQ4NCIgZG93bmxvYWRlZD0iMTcyNjgyODA4IiB0b3RhbD0iMTcyNjgyODA4IiBwYWNrYWdlX2NhY2hlX3Jlc3VsdD0iMiIgaW5zdGFsbF90aW1lX21zPSIzNjg5MCIvPjxwaW5nIGFjdGl2ZT0iMCIgcmQ9IjYzMjMiIHBpbmdfZnJlc2huZXNzPSJ7NTNBMDQ4QTMtNDBDMS00Mjg5LThEQTgtMDA4NTk4MzdDQkNEfSIvPjwvYXBwPjxhcHAgYXBwaWQ9IntGMzAxNzIyNi1GRTJBLTQyOTUtOEJERi0wMEMzQTlBN0U0QzV9IiB2ZXJzaW9uPSIxMjQuMC4yNDc4LjUxIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNvbnNlbnQ9ZmFsc2UiIGluc3RhbGxhZ2U9IjAiIGluc3RhbGxkYXRlPSI2MzIxIiBjb2hvcnQ9InJyZkAwLjI1IiBsYXN0X2xhdW5jaF9jb3VudD0iMSIgbGFzdF9sYXVuY2hfdGltZT0iMTMzNTg0NTU1NDA2NDA4MTIwIj48dXBkYXRlY2hlY2svPjxwaW5nIGFjdGl2ZT0iMCIgcmQ9IjYzMjMiIHBpbmdfZnJlc2huZXNzPSJ7RTM2NkFBOTktNTRCNi00M0JCLTkwRkYtNzBCNjNFMkE1ODQ3fSIvPjwvYXBwPjwvcmVxdWVzdD42⤵
- Checks system information in the registry
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k AppReadiness -p -s AppReadiness1⤵
-
C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe"C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe" /InvokerPRAID: Microsoft.MicrosoftOfficeHub prelaunch1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\wwahost.exe"C:\Windows\system32\wwahost.exe" -ServerName:Microsoft.MicrosoftOfficeHub.wwa1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /c1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Microsoft\EdgeCore\124.0.2478.51\Installer\setup.exeFilesize
6.8MB
MD526ef24e23b9ae5aaaa204a4b6901a6c9
SHA1d852dce2672850096d43ed7a9e30ca72f44eaf73
SHA256073aec6b50085f135e8e9903806cf817950cb09b686e106d7cf9edbe6296b8d3
SHA512a538ea6a04be7928e9533149b681d7371c6ad7274ff87207b3004ee4a436d64c5b96668e3bc91b30227dff8d5a2b30b81c50af7db99a413077f18c008d021822
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Download\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\124.0.2478.51\MicrosoftEdge_X64_124.0.2478.51.exeFilesize
164.7MB
MD58f229750e00f388f5de3e974c351efa4
SHA1568c2bca689fbf870a965cb4867a76a2f5549fdd
SHA25692f8f1114c969dde4b8819de90c6b0662e9183c733e1378a64375fe4051382a4
SHA51209d00746c57f3928eecee36db144385b0013e307289a007a0983388ec3a45364edfbe4ded94f39d8c083a2c27d8ffbfe608e822441dfbf728cad880629a0407b
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B34CBCF6-F243-45C6-99A2-D8FFEF502754}\EDGEMITMP_F3A1F.tmp\SETUP.EX_Filesize
2.7MB
MD5c11f635a9b793b9c12756b92219c81c8
SHA1107299e08c2a5cfe28d3b1aec4f81372efa28add
SHA25696adbf941978ff1af2df8c7bc44faefa09ce1cfc57c640ad66c58358e86913d6
SHA512281c7119817b3cc808d4f9d787a261e9dd8f0fbee7911f6ed349f5189528b3a244cb60d65f3df630445b0cd326849a67b533b07dd4fe675d6031e66141e3ce49
-
C:\Program Files (x86)\Microsoft\Temp\EU3C39.tmp\EdgeUpdate.datFilesize
12KB
MD5369bbc37cff290adb8963dc5e518b9b8
SHA1de0ef569f7ef55032e4b18d3a03542cc2bbac191
SHA2563d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3
SHA5124f8ec1fd4de8d373a4973513aa95e646dfc5b1069549fafe0d125614116c902bfc04b0e6afd12554cc13ca6c53e1f258a3b14e54ac811f6b06ed50c9ac9890b1
-
C:\Program Files (x86)\Microsoft\Temp\EU3C39.tmp\MicrosoftEdgeComRegisterShellARM64.exeFilesize
179KB
MD57a160c6016922713345454265807f08d
SHA1e36ee184edd449252eb2dfd3016d5b0d2edad3c6
SHA25635a14bd84e74dd6d8e2683470243fb1bb9071178d9283b12ebbfb405c8cd4aa9
SHA512c0f1d5c8455cf14f2088ede062967d6dfa7c39ca2ac9636b10ed46dfbea143f64106a4f03c285e89dd8cf4405612f1eef25a8ec4f15294ca3350053891fc3d7e
-
C:\Program Files (x86)\Microsoft\Temp\EU3C39.tmp\MicrosoftEdgeUpdate.exeFilesize
201KB
MD54dc57ab56e37cd05e81f0d8aaafc5179
SHA1494a90728d7680f979b0ad87f09b5b58f16d1cd5
SHA25687c6f7d9b58f136aeb33c96dbfe3702083ec519aafca39be66778a9c27a68718
SHA512320eeed88d7facf8c1f45786951ef81708c82cb89c63a3c820ee631c52ea913e64c4e21f0039c1b277cfb710c4d81cd2191878320d00fd006dd777c727d9dc2b
-
C:\Program Files (x86)\Microsoft\Temp\EU3C39.tmp\MicrosoftEdgeUpdateComRegisterShell64.exeFilesize
212KB
MD560dba9b06b56e58f5aea1a4149c743d2
SHA1a7e456acf64dd99ca30259cf45b88cf2515a69b3
SHA2564d01f5531f93ab2af9e92c4f998a145c94f36688c3793845d528c8675697e112
SHA512e98088a368d4c4468e325a1d62bee49661f597e5c1cd1fe2dabad3911b8ac07e1cc4909e7324cb4ab39f30fa32a34807685fcfba767f88884ef84ca69a0049e7
-
C:\Program Files (x86)\Microsoft\Temp\EU3C39.tmp\MicrosoftEdgeUpdateCore.exeFilesize
257KB
MD5c044dcfa4d518df8fc9d4a161d49cece
SHA191bd4e933b22c010454fd6d3e3b042ab6e8b2149
SHA2569f79fe09f57002ca07ae0b2a196e8cc002d2be6d5540ee857217e99b33fa4bb2
SHA512f26b89085aa22ac62a28610689e81b4dfe3c38a9015ec56dfeaff02fdb6fa64e784b86a961509b52ad968400faa1ef0487f29f07a41e37239fe4c3262a11ac2c
-
C:\Program Files (x86)\Microsoft\Temp\EU3C39.tmp\NOTICE.TXTFilesize
4KB
MD56dd5bf0743f2366a0bdd37e302783bcd
SHA1e5ff6e044c40c02b1fc78304804fe1f993fed2e6
SHA25691d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5
SHA512f546c1dff8902a3353c0b7c10ca9f69bb77ebd276e4d5217da9e0823a0d8d506a5267773f789343d8c56b41a0ee6a97d4470a44bbd81ceaa8529e5e818f4951e
-
C:\Program Files (x86)\Microsoft\Temp\EU3C39.tmp\msedgeupdate.dllFilesize
2.0MB
MD5965b3af7886e7bf6584488658c050ca2
SHA172daabdde7cd500c483d0eeecb1bd19708f8e4a5
SHA256d80c512d99765586e02323a2e18694965eafb903e9bc13f0e0b4265f86b21a19
SHA5121c57dc7b89e7f13f21eaec7736b724cd864c443a2f09829308a4f23cb03e9a5f2a1e5bcdc441301e33119767e656a95d0f9ede0e5114bf67f5dce6e55de7b0a4
-
C:\Program Files (x86)\Microsoft\Temp\EU3C39.tmp\msedgeupdateres_af.dllFilesize
28KB
MD5567aec2d42d02675eb515bbd852be7db
SHA166079ae8ac619ff34e3ddb5fb0823b1790ba7b37
SHA256a881788359b2a7d90ac70a76c45938fb337c2064487dcb8be00b9c311d10c24c
SHA5123a7414e95c2927d5496f29814556d731aef19efa531fb58988079287669dfc033f3e04c8740697571df76bfecfe3b75659511783ce34682d2a2ea704dfa115b3
-
C:\Program Files (x86)\Microsoft\Temp\EU3C39.tmp\msedgeupdateres_am.dllFilesize
24KB
MD5f6c1324070b6c4e2a8f8921652bfbdfa
SHA1988e6190f26e4ca8f7ea3caabb366cf1edcdcbbf
SHA256986b0654a8b5f7b23478463ff051bffe1e9bbdeb48744e4aa1bd3d89a7520717
SHA51263092cf13e8a19966181df695eb021b0a9993afe8f98b1309973ea999fdf4cd9b6ffd609968d4aa0b2cde41e872688a283fd922d8b22cb5ad06339fe18221100
-
C:\Program Files (x86)\Microsoft\Temp\EU3C39.tmp\msedgeupdateres_ar.dllFilesize
26KB
MD5570efe7aa117a1f98c7a682f8112cb6d
SHA1536e7c49e24e9aa068a021a8f258e3e4e69fa64f
SHA256e2cc8017bc24e73048c7ee68d3787ed63c3898eec61299a9ca1bab8aeaa8da01
SHA5125e963dd55a5739a1da19cec7277dc3d07afdb682330998fd8c33a1b5949942019521967d8b5af0752a7a8e2cf536faa7e62982501170319558ceaa21ed657ae8
-
C:\Program Files (x86)\Microsoft\Temp\EU3C39.tmp\msedgeupdateres_as.dllFilesize
28KB
MD5a8d3210e34bf6f63a35590245c16bc1b
SHA1f337f2cbec05b7e20ca676d7c2b1a8d5ae8bf693
SHA2563b82de846ad028544013383e3c9fb570d2a09abf2c854e8a4d641bd7fc3b3766
SHA5126e47ffe8f7c2532e7854dcae3cbd4e6533f0238815cb6af5ea85087c51017ea284542b988f07692d0297ebab1bad80d7613bf424ff532e10b01c8e528ab1043a
-
C:\Program Files (x86)\Microsoft\Temp\EU3C39.tmp\msedgeupdateres_az.dllFilesize
29KB
MD57937c407ebe21170daf0975779f1aa49
SHA14c2a40e76209abd2492dfaaf65ef24de72291346
SHA2565ab96e4e6e065dbce3b643c6be2c668f5570984ead1a8b3578bbd2056fbad4e9
SHA5128670746941660e6573732077f5ed1b630f94a825cf4ac9dbe5018772eaac1c48216334757a2aeaa561034b4d907162a370b8f0bae83b34a09457fafe165fb5d7
-
C:\Program Files (x86)\Microsoft\Temp\EU3C39.tmp\msedgeupdateres_bg.dllFilesize
29KB
MD58375b1b756b2a74a12def575351e6bbd
SHA1802ec096425dc1cab723d4cf2fd1a868315d3727
SHA256a12df15afac4eb2695626d7a8a2888bdf54c8db671043b0677180f746d8ad105
SHA512aec4bb94fde884db79a629abcff27fd8afb7f229d055514f51fa570fb47a85f8dfc9a54a8f69607d2bcaf82fae1ec7ffab0b246795a77a589be11fad51b24d19
-
C:\Program Files (x86)\Microsoft\Temp\EU3C39.tmp\msedgeupdateres_bn-IN.dllFilesize
29KB
MD5a94cf5e8b1708a43393263a33e739edd
SHA11068868bdc271a52aaae6f749028ed3170b09cce
SHA2565b01fe11016610d5606f815281c970c86025732fc597b99c031a018626cd9f3c
SHA512920f7fed1b720afdb569aec2961bd827a6fc54b4598c0704f65da781d142b1707e5106a459f0c289e0f476b054d93c0b733806af036b68f46377dde0541af2e7
-
C:\Program Files (x86)\Microsoft\Temp\EU3C39.tmp\msedgeupdateres_bn.dllFilesize
29KB
MD57dc58c4e27eaf84ae9984cff2cc16235
SHA13f53499ddc487658932a8c2bcf562ba32afd3bda
SHA256e32f77ed3067d7735d10f80e5a0aa0c50c993b59b82dc834f2583c314e28fa98
SHA512bdec1300cf83ea06dfd351fe1252b850fecea08f9ef9cb1207fce40ce30742348db953107ade6cdb0612af2e774345faf03a8a6476f2f26735eb89153b4256dc
-
C:\Program Files (x86)\Microsoft\Temp\EU3C39.tmp\msedgeupdateres_bs.dllFilesize
28KB
MD5e338dccaa43962697db9f67e0265a3fc
SHA14c6c327efc12d21c4299df7b97bf2c45840e0d83
SHA25699b1b7e25fbc2c64489c0607cef0ae5ff720ab529e11093ed9860d953adeba04
SHA512e0c15b166892433ef31ddf6b086680c55e1a515bed89d51edbdf526fcac71fb4e8cb2fadc739ac75ae5c2d9819fc985ca873b0e9e2a2925f82e0a456210898f9
-
C:\Program Files (x86)\Microsoft\Temp\EU3C39.tmp\msedgeupdateres_ca-Es-VALENCIA.dllFilesize
29KB
MD52929e8d496d95739f207b9f59b13f925
SHA17c1c574194d9e31ca91e2a21a5c671e5e95c734c
SHA2562726c48a468f8f6debc2d9a6a0706b640b2852c885e603e6b2dec638756160df
SHA512ea459305d3c3fa7a546194f649722b76072f31e75d59da149c57ff05f4af8f38a809066054df809303937bbca917e67441da2f0e1ea37b50007c25ae99429957
-
C:\Program Files (x86)\Microsoft\Temp\EU3C39.tmp\msedgeupdateres_ca.dllFilesize
30KB
MD539551d8d284c108a17dc5f74a7084bb5
SHA16e43fc5cec4b4b0d44f3b45253c5e0b032e8e884
SHA2568dbd55ed532073874f4fe006ef456e31642317145bd18ddc30f681ce9e0c8e07
SHA5126fa5013a9ce62deca9fa90a98849401b6e164bbad8bef00a8a8b228427520dd584e28cba19c71e2c658692390fe29be28f0398cb6c0f9324c56290bb245d06d2
-
C:\Program Files (x86)\Microsoft\Temp\EU3C39.tmp\msedgeupdateres_cs.dllFilesize
28KB
MD516c84ad1222284f40968a851f541d6bb
SHA1bc26d50e15ccaed6a5fbe801943117269b3b8e6b
SHA256e0f0026ddcbeafc6c991da6ba7c52927d050f928dba4a7153552efcea893a35b
SHA512d3018619469ed25d84713bd6b6515c9a27528810765ed41741ac92caf0a3f72345c465a5bda825041df69e1264aada322b62e10c7ed20b3d1bcde82c7e146b7e
-
C:\Program Files (x86)\Microsoft\Temp\EU3C39.tmp\msedgeupdateres_cy.dllFilesize
28KB
MD534d991980016595b803d212dc356d765
SHA1e3a35df6488c3463c2a7adf89029e1dd8308f816
SHA256252b6f9bf5a9cb59ad1c072e289cc9695c0040b363d4bfbcc9618a12df77d18e
SHA5128a6cbcf812af37e3ead789fbec6cba9c4e1829dbeea6200f0abbdae15efd1eda38c3a2576e819d95ed2df0aafd2370480daa24a3fe6aeb8081a936d5e1f8d8ed
-
C:\Program Files (x86)\Microsoft\Temp\EU3C39.tmp\msedgeupdateres_da.dllFilesize
28KB
MD5d34380d302b16eab40d5b63cfb4ed0fe
SHA11d3047119e353a55dc215666f2b7b69f0ede775b
SHA256fd98159338d1f3b03814af31440d37d15ab183c1a230e6261fbb90e402f85d5f
SHA51245ce58f4343755e392037a9c6fc301ad9392e280a72b9d4b6d328866fe26877b2988c39e05c4e7f1d5b046c0864714b897d35285e222fd668f0d71b7b10e6538
-
C:\Program Files (x86)\Microsoft\Temp\EU3C39.tmp\msedgeupdateres_de.dllFilesize
30KB
MD5aab01f0d7bdc51b190f27ce58701c1da
SHA11a21aabab0875651efd974100a81cda52c462997
SHA256061a7cdaff9867ddb0bd3de2c0760d6919d8d2ca7c7f889ec2d32265d7e7a75c
SHA5125edbda45205b61ac48ea6e874411bb1031989001539650de6e424528f72ec8071bd709c037c956450bb0558ee37d026c26fdb966efceb990ed1219f135b09e6e
-
C:\Program Files (x86)\Microsoft\Temp\EU3C39.tmp\msedgeupdateres_el.dllFilesize
30KB
MD5ac275b6e825c3bd87d96b52eac36c0f6
SHA129e537d81f5d997285b62cd2efea088c3284d18f
SHA256223d2db0bc2cc82bda04a0a2cd2b7f6cb589e2fa5c0471a2d5eb04d2ffcfcfa0
SHA512bba581412c4297c4daf245550a2656cdc2923f77158b171e0eacf6e933c174eac84580864813cf6d75d73d1a58e0caf46170aee3cee9d84dc468379252b16679
-
C:\Program Files (x86)\Microsoft\Temp\EU3C39.tmp\msedgeupdateres_en-GB.dllFilesize
27KB
MD5d749e093f263244d276b6ffcf4ef4b42
SHA169f024c769632cdbb019943552bac5281d4cbe05
SHA256fd90699e7f29b6028a2e8e6f3ae82d26cdc6942bd39c4f07b221d87c5dbbfe1e
SHA51248d51b006ce0cd903154fa03d17e76591db739c4bfb64243725d21d4aa17db57a852077be00b9a51815d09664d18f9e6ad61d9bc41b3d013ed24aaec8f477ad9
-
C:\Program Files (x86)\Microsoft\Temp\EU3C39.tmp\msedgeupdateres_en.dllFilesize
27KB
MD54a1e3cf488e998ef4d22ac25ccc520a5
SHA1dc568a6e3c9465474ef0d761581c733b3371b1cd
SHA2569afbbe2a591250b80499f0bf02715f02dbcd5a80088e129b1f670f1a3167a011
SHA512ce3bffb6568ff2ef83ef7c89fd668f6b5972f1484ce3fbd5597dcac0eaec851d5705ed17a5280dd08cd9812d6faec58a5561217b897c9209566545db2f3e1245
-
C:\Program Files (x86)\Microsoft\Temp\EU3C39.tmp\msedgeupdateres_es-419.dllFilesize
29KB
MD528fefc59008ef0325682a0611f8dba70
SHA1f528803c731c11d8d92c5660cb4125c26bb75265
SHA25655a69ce2d6fc4109d16172ba6d9edb59dbadbc8af6746cc71dc4045aa549022d
SHA5122ec71244303beac7d5ce0905001fe5b0fb996ad1d1c35e63eecd4d9b87751f0633a281554b3f0aa02ee44b8ceaad85a671ef6c34589055797912324e48cc23ed
-
C:\Program Files (x86)\Microsoft\Temp\EU3C39.tmp\msedgeupdateres_es.dllFilesize
28KB
MD59db7f66f9dc417ebba021bc45af5d34b
SHA16815318b05019f521d65f6046cf340ad88e40971
SHA256e652159a75cbab76217ecbb4340020f277175838b316b32cf71e18d83da4a819
SHA512943d8fc0d308c5ccd5ab068fc10e799b92465a22841ce700c636e7ae1c12995d99c0a93ab85c1ae27fefce869eabadbeafee0f2f5f010ad3b35fa4f748b54952
-
C:\Program Files (x86)\Microsoft\Temp\EU3C39.tmp\msedgeupdateres_et.dllFilesize
28KB
MD5b78cba3088ecdc571412955742ea560b
SHA1bc04cf9014cec5b9f240235b5ff0f29dbdb22926
SHA256f0a4cfd96c85f2d98a3c9ecfadd41c0c139fdb20470c8004f4c112dd3d69e085
SHA51204c8ab8e62017df63e411a49fb6218c341672f348cb9950b1f0d2b2a48016036f395b4568da70989f038e8e28efea65ddd284dfd490e93b6731d9e3e0e0813cf
-
C:\Program Files (x86)\Microsoft\Temp\EU3C39.tmp\msedgeupdateres_eu.dllFilesize
28KB
MD5a7e1f4f482522a647311735699bec186
SHA13b4b4b6e6a5e0c1981c62b6b33a0ca78f82b7bbd
SHA256e5615c838a71b533b26d308509954907bcc0eb4032cdbaa3db621eede5e6bfa4
SHA51222131600bbac8d9c2dab358e244ec85315a1aaebfc0fb62aaa1493c418c8832c3a6fbf24a6f8cf4704fdc4bc10a66c88839a719116b4a3d85264b7ad93c54d57
-
C:\Program Files (x86)\Microsoft\Temp\EU3C39.tmp\msedgeupdateres_fa.dllFilesize
27KB
MD5cbe3454843ce2f36201460e316af1404
SHA10883394c28cb60be8276cb690496318fcabea424
SHA256c66c4024847d353e9985eb9b2f060b2d84f12cc77fb6479df5ffc55dbda97e59
SHA512f39e660f3bfab288871d3ec40135c16d31c6eb1a84136e065b54ff306f6f8016a788c713d4d8e46ad62e459f9073d2307a6ed650919b2dd00577bbfd04e5bd73
-
C:\Program Files (x86)\Microsoft\Temp\EU3C39.tmp\msedgeupdateres_fi.dllFilesize
28KB
MD5d45f2d476ed78fa3e30f16e11c1c61ea
SHA18c8c5d5f77cd8764c4ca0c389daee89e658dfd5e
SHA256acf42b90190110ccf30bcfb2626dd999a14e42a72a3983928cba98d44f0a72e2
SHA5122a876e0313a03e75b837d43e9c5bb10fcec385fbb0638faa984ee4bb68b485b04d14c59cd4ed561aaa7f746975e459954e276e73fc3f5f4605ae7f333ce85f1b
-
C:\Program Files (x86)\Microsoft\Temp\EU3C39.tmp\msedgeupdateres_fil.dllFilesize
29KB
MD57c66526dc65de144f3444556c3dba7b8
SHA16721a1f45ac779e82eecc9a584bcf4bcee365940
SHA256e622823096fc656f63d5a7bbdf3744745ef389c92ec1b804d3b874578e18c89d
SHA512dbc803c593ae0b18fd989fdc5e9e6aee8f16b893ae8d17e9d88436e2cd8cae23d06e32e4c8a8bf67fc5311b6f2a184c4e6795fed6d15b3d766ef5affc8923e2f
-
C:\Program Files (x86)\Microsoft\Temp\EU3C39.tmp\msedgeupdateres_fr-CA.dllFilesize
30KB
MD5b534e068001e8729faf212ad3c0da16c
SHA1999fa33c5ea856d305cc359c18ea8e994a83f7a9
SHA256445051ef15c6c872bed6d904169793837e41029a8578eaf81d78a4641ef53511
SHA512e937d2e0f43ade3f4a5e9cdeb6dd8c8ad8b5b50a7b6b779bda727a4fe1ced93abd06720395cc69a274ce3b0f7c6b65e1eba1ecf069db64edb80d007fbb4eedbb
-
C:\Program Files (x86)\Microsoft\Temp\EU3C39.tmp\msedgeupdateres_fr.dllFilesize
30KB
MD564c47a66830992f0bdfd05036a290498
SHA188b1b8faa511ee9f4a0e944a0289db48a8680640
SHA256a9b72fcb3bdb5e021b8d23b2de0caeca80ddc50420088b988a5b7503f2d7c961
SHA512426546310c12aeb80d56e6b40973a5f4dffef72e14d1ac79e3f267e4df2a0022b89e08bba8ab2ffa24f90b0c035a009bed3066201e30fe961d84ed854e48f9c5
-
C:\Program Files (x86)\Microsoft\Temp\EU3C39.tmp\msedgeupdateres_ga.dllFilesize
28KB
MD53b8a5301c4cf21b439953c97bd3c441c
SHA18a7b48bb3d75279de5f5eb88b5a83437c9a2014a
SHA256abc9822ee193c9a98a21202648a48ecd69b0cb19ff31c9bbf0c79dab5f9609b0
SHA512068166cfdf879caf4e54fe43c5265a692fcaf6a9dcbf151335fd054bbec06260bc5ed489de6d46ca3fc0044bc61fa1468fea85373c6c66349620618ee869383a
-
C:\Program Files (x86)\Microsoft\Temp\EU3C39.tmp\msedgeupdateres_gd.dllFilesize
30KB
MD5c90f33303c5bd706776e90c12aefabee
SHA11965550fe34b68ea37a24c8708eef1a0d561fb11
SHA256e3acc61d06942408369c85365ac0d731c5f3c9bc26e3f1e3bb24226d0879ad9c
SHA512b0c1a9d7df57d68e5daf527703f0b6154a2ef72af1a3933bda2804408f6684b5b09b822522193243fd0756f80f13d3ab0647c90d2bed1a57b4a9fea933b0aa9a
-
C:\Program Files (x86)\Microsoft\Temp\EU3C39.tmp\msedgeupdateres_gl.dllFilesize
28KB
MD584a1cea9a31be831155aa1e12518e446
SHA1670f4edd4dc8df97af8925f56241375757afb3da
SHA256e4eb716f1041160fd323b0f229b88851e153025d5d79f49b7d6ecb7eb2442c57
SHA5125f1318119102fcee1c828565737ce914493ff86e2a18a94f5ff2b6b394d584ace75c37258d589cce1d5afd8e37d617168a7d7372cfd68dd6a2afcd4577a0bc51
-
C:\Program Files (x86)\Microsoft\Temp\EU3C39.tmp\msedgeupdateres_gu.dllFilesize
28KB
MD5f9646357cf6ce93d7ba9cfb3fa362928
SHA1a072cc350ea8ea6d8a01af335691057132b04025
SHA256838ccd8243caa1a5d9e72eb1179ac8ae59d2acb453ed86be01e0722a8e917150
SHA512654c4a5200f20411c56c59dbb30a63bfe2da27781c081e2049b31f0371a31d679e3c9378c7eb9cf0fb9166a3f0fba33a58c3268193119b06f91bebe164a82528
-
C:\Program Files (x86)\Microsoft\Temp\EU3C39.tmp\msedgeupdateres_hi.dllFilesize
28KB
MD534cbaeb5ec7984362a3dabe5c14a08ec
SHA1d88ec7ac1997b7355e81226444ec4740b69670d7
SHA256024c5eae16e45abe2237c2a5d868563550ac596f1f7d777e25234c17d9461dd9
SHA512008c8443a3e93c4643a9e8735a1c59c24ba2f7a789606a86da54c921c34cbc0cb11c88594544d8509a8e71b6a287c043b1ffe2d39b90af53b4cde3847d891ba8
-
C:\Program Files (x86)\Microsoft\Temp\EU3C39.tmp\msedgeupdateres_hr.dllFilesize
29KB
MD50b475965c311203bf3a592be2f5d5e00
SHA1b5ff1957c0903a93737666dee0920b1043ddaf70
SHA25665915ad11b9457d145795a1e8d151f898ec2dcb8b136967e6592884699867eb0
SHA512bec513125f272c24477b9ddbaa5706d1e1bb958babac46829b28df99fa1dd82f3f1e3c7066dc2fe3e59118c536675a22fc2128de916ca4c478950b9992372007
-
C:\Program Files (x86)\Microsoft\Temp\EU3C39.tmp\msedgeupdateres_hu.dllFilesize
29KB
MD5f4976c580ba37fc9079693ebf5234fea
SHA17326d2aa8f6109084728323d44a7fb975fc1ed3f
SHA256b16755fdbcc796ef4eb937759fe2c3518c694f5d186970d55a5a5e5d906cb791
SHA512e43636d8c947e981258e649712ad43f37c1aab01916539b93c082959fb5c6764c9c44979650092202839e812e6f252c6c3eaf66d3d195c1efd39c74c81ad1981
-
C:\Program Files (x86)\Microsoft\Temp\EU3C39.tmp\msedgeupdateres_id.dllFilesize
27KB
MD503d4c35b188204f62fc1c46320e80802
SHA107efb737c8b072f71b3892b807df8c895b20868c
SHA256192585d7f4a8a0cd95e338863c14233cdd8150f9f6f7dd8a405da0670110ee95
SHA5127e67ea953ea58ff43e049ce519ae077eec631325604896479526627d688f2fa3bfc855a55ac23a76b1c9ef8cd75274265b8238423b95a2437be7250db0db31b1
-
C:\Program Files (x86)\Microsoft\Temp\EU3C39.tmp\msedgeupdateres_is.dllFilesize
28KB
MD55664c7a059ceb096d4cdaae6e2b96b8f
SHA1bf0095cd7470bf4d7c9566ba0fd3b75c8b9e57ec
SHA256a3a2947064267d17474c168d3189b0d372e36e53bf0efb9c228d314fc802d98e
SHA512015dcb17b297a0aaad41c7b0b2199187e435855fd3977d16402be774622cc4f6b55d04ba9159a89e26e350c5602928c76dd9386be3974437b41888a0cfdddfa8
-
C:\Program Files (x86)\Microsoft\Temp\EU3C39.tmp\msedgeupdateres_it.dllFilesize
30KB
MD5497ca0a8950ae5c8c31c46eb91819f58
SHA101e7e61c04de64d2df73322c22208a87d6331fc8
SHA256abe2360a585b6671ec3a69d14077b43ae8f9e92b6077b80a147dfe36792bb1b7
SHA512070398af980f193ff90b4afaecb3822534ef3171eca7228bce395af11ca38364bc47cab7df1e71187ef291f90978bdc37a8611d2992b1800cd1de6aa7fda09d9
-
C:\Program Files (x86)\Microsoft\Temp\EU3C39.tmp\msedgeupdateres_iw.dllFilesize
25KB
MD545e971cdc476b8ea951613dbd96e8943
SHA18d87b4edfce31dfa4eebdcc319268e81c1e01356
SHA256fd5ba39c8b319c6ba2febf896c6947a0a7bae6aa0b4957bd124d55589f41849d
SHA512f1c9fccf742fa450be249dbbf7e551a426c050ae4af3d2e909f9750068a2bdc801f618eb77a6a82d13421d27949c9f2a9681a44bcb410ccdeec66b24a70f6a9a
-
C:\Program Files (x86)\Microsoft\Temp\EU3C39.tmp\msedgeupdateres_ja.dllFilesize
24KB
MD5b507a146eb5de3b02271106218223b93
SHA10f1faddb06d775bcabbe8c7d83840505e094b8d6
SHA2565f4234e2b965656e3d6e127660f52e370dc133632d451ef04975f3b70194b2ed
SHA51254864e9130b91b6fd68b1947968c446f45a582f22714716bfd70b6dc814841fffe939bc2f573a257ec8c62b4ff939643211fb29cabc0c45b78a6cc70eaa3752c
-
C:\Program Files (x86)\Microsoft\Temp\EU3C39.tmp\msedgeupdateres_ka.dllFilesize
29KB
MD53bc0d9dd2119a72a1dc705d794dc6507
SHA15c3947e9783b90805d4d3a305dd2d0f2b2e03461
SHA2564449ee24c676e34fea4d151b3a752e8d0e7c82f419884e80da60d4d4c1b0f8cb
SHA5128df01ad484bf2924892129c59317f3da4f79611be2ca29e208114e5ed2cb96a63f753511dc4fe97e281417366246f2fb576cc6ef2618a67803ae7ac01be7b067
-
C:\Program Files (x86)\Microsoft\Temp\EU3C39.tmp\msedgeupdateres_kk.dllFilesize
28KB
MD5bcb1c5f3ef6c633e35603eade528c0f2
SHA184fac96d72341dc8238a0aa2b98eb7631b1eaf4e
SHA256fdd6bffdb9eca4542975f3afe3ac68feac190b8963f0a7244b4b8fa6382381d1
SHA512ecd79ddd9f3e6db1d0471132c453c324ab55bdead21de77392f418281bc8a2dd43e9009912896ffa3d55d4d3ef17b0aa847a084369b619eb04a2d2313641d520
-
C:\Program Files (x86)\Microsoft\Temp\EU3C39.tmp\msedgeupdateres_km.dllFilesize
27KB
MD52ea1200fdfb4fcc368cea7d0cdc32bc2
SHA14acb60908e6e974c9fa0f19be94cb295494ee989
SHA2566fd21b94f62ee7474b3c3029590ddf06936105508f9bf3509620c42dc37486c3
SHA512e63b80a5929200c85c7a30a3054bd51eee2f27e603501f105073868690906f4619a27a52e58c90ac2ab5d5c34a4739dfdd2a511574afeb7d0118de88c5544f42
-
C:\Program Files (x86)\Microsoft\Temp\EU3C39.tmp\msedgeupdateres_kn.dllFilesize
29KB
MD560dfe673999d07f1a52716c57ba425a8
SHA1019ce650320f90914e83010f77347351ec9958ab
SHA256ef749f70e71424d7f548d5c12283be70a6d6c59cffb1c8101b74f37ecacb64af
SHA51246bfe77a49f14293988863a8e4dd0543202b954b670940d9ad5dc6d2b46e46104d8d6206be08a941f7e02b8ff3e2e2366b7b795d02352cff18971f8d0df5fcdc
-
C:\Program Files (x86)\Microsoft\Temp\EU3C39.tmp\msedgeupdateres_ko.dllFilesize
23KB
MD5cf91a1f111762d2bc01f8a002bd9544d
SHA1db2603af55b08538a41c51fc0676bc0ed041d284
SHA256baa9fae4fb8939e0b5fe0c7f393ab1ca40b52534f37bf2158a9a36331a221e75
SHA5129db864dbd194885b46f7bed9875f1e531e48f7644ce4494b8dc482c7516a6f783cd35129d2565b272dc674491a08c844a6da88bf9fa7843fcf89c96b4e0af799
-
C:\Program Files (x86)\Microsoft\Temp\EU3C39.tmp\msedgeupdateres_kok.dllFilesize
28KB
MD5ca3465347e57624ee2a5dd2299d4f4cd
SHA1551a151a8d49489c90400e18c34633aa2c2b8a4b
SHA2565b9509a1ae34d89c89c8e657742495037d28cd03e1cd48aef4dfaa7aeebe29f0
SHA512a4bdd458a7628a9f0664e1000512e056718cc924510a21704ff8c69b0b251a5a1c7f6f267d66325cadda1536aaee78440348be128d082112c71732e485ac93f3
-
C:\Program Files (x86)\Microsoft\Temp\EU3C39.tmp\msedgeupdateres_lb.dllFilesize
30KB
MD5269e84b82973e7b9ee03a5b2ef475e4d
SHA14021af3bfde8c52040ad4f9390eb29ae2a69104b
SHA256c3fb0cae3dc5cdd86518d60f998c3adec1c0c5804a74ffbb9a346a73d598af07
SHA512db716e2f6527af2dfeba4c22ff00e159d7cc0b482fc126e87b8b3d35b714bb382676066097352b6ebb87c8dfe7f6144e83100f0c9a9990b0d23c810b6c575c21
-
C:\Program Files (x86)\Microsoft\Temp\EU3C39.tmp\msedgeupdateres_lo.dllFilesize
27KB
MD5864edbc77831a64a3e3ab972291233bb
SHA1fa1f3eb3320c1b1a329cbe786abecf2a8e625cbe
SHA256aecab1eb46075d1a1432b3e14537f860a2ded49a13ca82f17fac44b40ad2da51
SHA5123d54efd01d6317fb4746b55db2c847a506f594cff055f0db84a72ede02dbe3aa03d8e65ea06c5ae365f44312a26cdbc45ad5f9a0de46d2b9c878aeeb24566b89
-
C:\Program Files (x86)\Microsoft\Temp\EU3C39.tmp\msedgeupdateres_lt.dllFilesize
27KB
MD57071c732cf3e4b3144cf07c49d8eb44f
SHA13800bf304b44d9d27ac26bed6ccc899669dc3b4f
SHA2569c75ef5c3f53c643d7bb8c5907a0cba6ca2d1d64e6bea39ce06b4ad5a20454b6
SHA512be3a0942e2af843adeb8e9b6acc7cd8adec956b761f71d8eb0a02835ee5be115ac064fda7088b0813d40ec3a24e7bb77816e9b67ef0cbdce1562c36880b15049
-
C:\Program Files (x86)\Microsoft\Temp\EU3C39.tmp\msedgeupdateres_lv.dllFilesize
28KB
MD530849a9c16061b9a46a66e8e7d42ff81
SHA12d0e86535d964acce8912c6bef3cc12346b22a6c
SHA256b8075c09d33cc6b6ff22fdb29ccc3dd319ce867f4b77a1d165f6f8d8cb4977e9
SHA512298ee10ff6cab7ff38d31e3a7826dedeab8e9ccc616eae4ca2e5ec333f42e5c6744650857031d8bf35034bd46c7c01a2646362ffbbef1f421995c73ba999ff0b
-
C:\Program Files (x86)\Microsoft\Temp\EU3C39.tmp\msedgeupdateres_mi.dllFilesize
28KB
MD51866ddadd9397dbf01c82c73496b6bff
SHA1b210a9df7d6a5e116fe7a9ff8d455b6cbfb5663b
SHA2569b4bb2ca3366a1935b4869796efc0601f94356b45e8613d28e023dd516f48d17
SHA51276fa5cade101d79d012e00904bf18692f85967ceea0ed7e81da4df65b85afc125a00127d9e06c8c59ffbfd2dcdc88488157b61922960559fa17d13dedca3ee59
-
C:\Program Files (x86)\Microsoft\Temp\EU3C39.tmp\msedgeupdateres_mk.dllFilesize
29KB
MD5064035858a1df697913f06c972461901
SHA1b6be99ae8e55207949076955389bc8fec81937fd
SHA2564850260d2cbb4b4ff3490eb90ce55a412268ad699f946b1cd686ddf9f0403bd6
SHA5129459056e919854213117b874e61b526af4ba35c3c3e195b204c5c3e59cc4dfa2b4a45c32551e1de144842844f246f5e0d025cdcc78dbf7265ba5e26e7209cd91
-
C:\Program Files (x86)\Microsoft\Temp\EU3C39.tmp\msedgeupdateres_ml.dllFilesize
30KB
MD57e90d4306c5768dfd1160ad9e2168a19
SHA14f7b17843ad226d51cfb0090235b55a29b5a674a
SHA2568ebe88477b1493733140f1fced91903276ec69c7302deed3281054b49573eb3c
SHA512f6d8b538915fa70bfb784ea7e6d4047759d8eecc822e4b76ac9666997a41901c8269a8185f29e5472bcfaa87e4b97483bd544f3fc8f656b60dca71d63b44d291
-
C:\Program Files (x86)\Microsoft\Temp\EU3C39.tmp\msedgeupdateres_mr.dllFilesize
28KB
MD5468a420700d239a0cd90b95896b0d6da
SHA1ce57e3abf57c7ae13e99546b2a5e19dec03cb9b7
SHA25624b304bd40f8e63848f8d2a1ca6ac8bc032b7a700161efad61ad445787650c87
SHA512604c4cc8132c520da70c4870514610364648ec6446afa47128ac3aa8a9157932705da93e8ed4e33d56f5191d611b26b76aeba1514e9dff1a13dd32693cfddb8b
-
C:\Program Files (x86)\Microsoft\Temp\EU3C39.tmp\msedgeupdateres_ms.dllFilesize
28KB
MD551230a1b9ab0dad791e583b7ee57afe4
SHA1957ba3e5d9b2df16ea3e099aab5b7e74d2055e46
SHA256a47fc6a9a75875e75f3415f068c357dd499e533849381b875272d5994c163670
SHA5125a3d754cefa1ab28748cb38021b5cbebd93fe513da0f4a7cbae98c0938acb10cdda939171d0842b09e97cb4c73f19272be665f767642ba1c5b25c709b5417edb
-
C:\Program Files (x86)\Roblox\Versions\version-1870963560174427\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exeFilesize
1.5MB
MD5610b1b60dc8729bad759c92f82ee2804
SHA19992b7ae7a9c4e17a0a6d58ffd91b14cbb576552
SHA256921d51979f3416ca19dca13a057f6fd3b09d8741f3576cad444eb95af87ebe08
SHA5120614c4e421ccd5f4475a690ba46aac5bbb7d15caea66e2961895724e07e1ec7ee09589ca9394f6b2bcfb2160b17ac53798d3cf40fb207b6e4c6381c8f81ab6b4
-
C:\Program Files\MsEdgeCrashpad\settings.datFilesize
280B
MD59ff1c6205dd7262222364aa043a0670a
SHA192a5144d0823c16d13f599b7d5177c3728cdad67
SHA256c0bb9ce77f005cbaad3dac7ff148d5334cf0df1b0001eaa04a209c55d306fa7c
SHA51258c9905d41e048004fc655761473f1706d3f7862220c7845eda37e930565575bd9966f169b5a7492fd2948ce79c027c8b8a6442d90c6e0c75fceef137add08fd
-
C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.logFilesize
100KB
MD5ebbcb65fc51fcdae1ab25a69bbd86134
SHA16dab129c95ec71847db48589ef94e75b3d0e48fd
SHA2561e2800ec3b91a73a6af06e326b05db2029255639c5c4afdf80c4608d7d1fde72
SHA512284a0d77d53be61a96be2dbc4ef50f121357deef0949dbfa4a73d86d858a0d33da7e590aff143032f7a924ba0250167e1b15745cc00beb893be81bd30ea84786
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.datFilesize
40B
MD5450092d409ea8bde7e3ca1247fc0de4a
SHA1f021476a1ce1a12f956b79635e5d5f36c2d2a4b9
SHA256ca89da096c19ce02a68a898f6107765e7e4f005843d72d8447098c38d18e73a7
SHA512d8d879b863ed265eded8c2af06151f3685c2345c17c568c119adc3e435be020232c731930083d3bc1f93ef1efb65670b70dc0e8c5fcc507aa972d45f016d388e
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
1KB
MD5097c376b896d17f937915ce06fd5530a
SHA1b8ee49d6c3078ebfef830543b25286c7f6533c67
SHA256e30212d3b2d354e43a2345f07fb09470c42f2a655b911d7228effe9542f3bcfc
SHA512c69784515b0541217394425868f54b2855c9a30121597d87a0c5ef569b908a233909e2199018d2c58b32a007780eea2901fddfda71758444626666dbda4a4ff0
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1Filesize
264KB
MD5870a1c7dbdfa8f00643f655ea4f133c1
SHA102fbb75a7484d264590ed3a067d2cda1c4138e05
SHA256a1985a4bfd84d47b055ce3979558efbeaf623b9da6fccdaf8d3630a178fca94d
SHA51213674b9ac7bb7a195da4b13dc1eb588b8d3db1233c463a73bb3366c824036a8f36a1b9b5c40ccae75eeed8cdc31f82e3b4f9b455d414f5d6f5e321d0ffae3f7e
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.tiktok.com_0.indexeddb.leveldb\CURRENTFilesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent StateFilesize
3KB
MD5e104cf57ceddf5fcec8a1acd2345b424
SHA1dc69e1374b5755a954c8ae8282c1217008e1bee8
SHA2562629fdf01f61733d724166249f872ef4ee33fc5376027cdd56e713c16530aba0
SHA512e56c02aa741cead38b367d5a318b3d095c6f4ac1de20a485991f00d912e00f937eef8f55aabeaf251a49843013737df8407b5146542d28ac71a25783bd0ade1a
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent StateFilesize
3KB
MD5127f2bc7379715367010271c517984b3
SHA1f45485f63395835a1f6a29a7f469b08913512593
SHA25683105d8b07122b1cf9888484acc9a4566749347289472a94e8f28e162957719b
SHA512d6d520a1cf921774df9dbbaeb7f90486936323eb29c87cd440dbdd0d43e0d877e1174360ab654846b01c33d416af6a6eac2e41f6e6f3987026f760addba25bf4
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending ReportsFilesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
690B
MD55d76e37fa10ad3b652cf6c0e4f846234
SHA16593b962e82f48cfa9907b84327e1855137723c2
SHA256a6697a71d6011a400e23209873b789fdd653ee75b8953a33db681534ba5cf41c
SHA5129ce9c2cda0f23804944ed287d6c5d9f9e0d4e751d0412c85514718b08fc81b274c25ee8305260aed00785dcb4b5ff1605c7b665baf1e4370ba3f82662580a461
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
1KB
MD5d9da216cce71d22380504c2b929fce69
SHA1084532b5cadab94b8c3a9512b8f838fcb9efcb49
SHA2561bf77162256bb760f3972c96cd1269eb43893e5a37dc4049d146b8e42de7e8c8
SHA512c4eda14d71a0de6bb80096f20bad0e7fefc04c9fec8f86b3146c109976b0346261e26789341293b55884803aa7e659d10b69b13db66c4bd113a9fa05b180250f
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
1KB
MD56c77af7a68b549981ae7188db89f3f0b
SHA1ef729bcff0b4f28e4015b74b4fd78006e8959a32
SHA256cdc547f134413275c22060bfb72a50e9f469022b46ca714bf66a33a5c1638fcb
SHA51233c56ae136d72c5e9697dd4fd4c3ae9ab8ada2435655c1233c1abec2c9d2ad1790ecb13b3a3f2d39813a8fcc895a8c83ab0a015185dddcf7913c2fbc3a1fd686
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
1KB
MD5941194dc84745ae98657bc60ec9293e5
SHA1ee6d892db0b4c5f62810e33b5d5ef5e4cb71c296
SHA2567165c728b1ff20666cf5785491d88ffee50894da849fc3a0245c99228fde4386
SHA512238530a4fe00a53dcea474c02da9c49ebe28221542dcfc911053cac0afd5f1c52c9dde766d199fdedd5d5c5a1501359a034179c01ecab8bdac677fd90eb1b4eb
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
523B
MD5b370ba25b600be467496b2c2df10ba69
SHA13de42b941dd26875045c96daba7b5bd036262954
SHA2561902e1151f033eca2b4cb5635dc7752855357ef7f86d01466334e54c66536308
SHA512a91215b183a2ff44887a3ee0382ea26cbe7201da76cab25ad93a4dc3d514158168c8a459a27aabc13bdda4a787f8ab3500d71dfcaf3f71592c277f7776d010e5
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
7KB
MD5dbfbafb1445ca407e52d18e711950dcd
SHA12507959f598669c714d75e7f48a7f6b3187edb4f
SHA25642ae5e1bc1cf062bf423e1fb6be9c22864d66bf486df7e004bf5ed4c8d601ef3
SHA51269560adcef7af09278a5799dd2674808121eee5b32df2a3d0cff2956d8af0ad105bcb6393dfb4ddf9ca6ed98355393f40aa27bb30426085b9e339be106016400
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
8KB
MD58de9fe8f4f586a5e1096a618cf096f18
SHA19d66b761a4b5009ac7f088d1d65b84c9595551cb
SHA256045cbc282da0cc468338d01c5c74f3e58d69f9b1850b724f1d8ecbc8f964c5c3
SHA5124b0a94a441046bce6beb587d5c8be22c93990c4bfb9bf2b2777c7ebd567460590c1ed9cf96d54129d00fe76ae4e32c4a3820a4a39f6a7c09fe37182686665b25
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
8KB
MD5f4bfb92eda59772727ce90490126e8fc
SHA1c377331953a810ab1524980ba888e6bf738ba746
SHA25627b803e5467bf862212ef978967ed18533b64db9c0f0d07f42efd952f0db5450
SHA5121dc2690f87a4939c9ca41206939214afa5bbd1ed9aa56de22c7e7083d77cb72c15520f57750e4d236fb2431fd30cbf893bb74b1b4bb5ac0b038e3ba9e44b7a76
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
6KB
MD5c0aac2d3272df28d1317102c7e842aa7
SHA123cdf0dcecc29829c4cb015c14ed692664b2f4f3
SHA256a1f98147db0c4b85cb8717f91f93debeef91be9e6d994bfbc8538a691dfcb57d
SHA512b78fa2f84d795f3d825dc668124932ed6187cd816287903c74667cb8d741ebd5420652318a7519c068f6614f7f0b85b2bec1388c6ee22cfd98a077f6f9aa2103
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure PreferencesFilesize
16KB
MD5f339509b2957ff497599824085a21c43
SHA15b95ee3c68bcc6a98b37e0f5409cc564e8ee61d9
SHA2566cc3ab82160d9449c66f4a173a0ff3590571d2dc4c1509deb77e6cd622e77611
SHA512264ed90fc7041d427c210d329a690c8a64a1f1e1f4c36c941ce06cf9928a3e94ec2a96661c593a7bffd7c8f03d413eeaa181b13a5962f29d48fa99a97ae3983a
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\4cc699dd486af2551d01b1a74abd5337c6e052e5\c247085e-c922-4143-b453-5084d3321f0c\index-dir\the-real-indexFilesize
72B
MD5509fa2f8d40b7e05b8e64ba3d2fee36d
SHA11ae11fef833e9c382f972738dedcbd56172e4055
SHA256324de1c3cf2867ad4d93b9d545c7e672844df4e3d106821dd0e414ce9ba05fc2
SHA51262e8f24521ff2e2841d58f9564a4242a76e84b12223aa279efcaf0523aa98c1c91ccbb757732ad198b104ffaf77a81776c98d84a24c920a5db696e06bcb395e5
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\4cc699dd486af2551d01b1a74abd5337c6e052e5\c247085e-c922-4143-b453-5084d3321f0c\index-dir\the-real-index~RFe593771.TMPFilesize
48B
MD578ce2e92e57e92b07621a377467dfa14
SHA103d9253cbd9d7b5f071dfcdef4c4b43a5f4320d6
SHA2566ba6abbf851ffaf2c0e0fd6a9ec505895b0dda487eb6a59c7b078eedf851eed8
SHA512ec3537ea435e7f8261b0e7a2439ee5b71fa596eb3721a8c541d27054624fcc666b7dd6fa7bde5149de2a424708b96a80e782f39c52f974ebe7c837808c5e3b83
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\4cc699dd486af2551d01b1a74abd5337c6e052e5\c59eb941-2af8-4f36-847d-857e5ca968ae\index-dir\the-real-indexFilesize
456B
MD5965e6a67cb49d13a8d7ff8147817d16c
SHA1daf5bf5a06101dbea1dc316f72181d03e38283a8
SHA256f6dad0116fa60605727995dc5db9950d76544395d05c2a9a3bad38b59c1ce931
SHA512606f66402f21d2f8078f186c5d5c97d4251fbf217d7d2fc2bb185e705783e1d1771bdbc24ac44c6f15357f7db4cf90ba83f0b99de84a549517d78ee4ed43ceea
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\4cc699dd486af2551d01b1a74abd5337c6e052e5\c59eb941-2af8-4f36-847d-857e5ca968ae\index-dir\the-real-index~RFe593762.TMPFilesize
48B
MD59637e35fc0e9de1cc630d11015daee6d
SHA1e135adeeea39399b55dde4439c59c3fb7db7d2ff
SHA256fa31a518618debb36141d4df7b9cd552966b8992ba1ac8760f3a4513a0666441
SHA5123296c1861fe18a3f7f731815e8e607f87524022faf66fbbcc0c86b0f53b7a07920c3cfd69a8cda0db7166d4b7c63ffdbc9076cd86bd867a4e38b24411877291d
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\4cc699dd486af2551d01b1a74abd5337c6e052e5\index.txtFilesize
197B
MD500b29fc8ab217a2b88ba1d8a0e8fc9fa
SHA19aadcabf0465102660b2cc985a1a107fb5e0922f
SHA256570058f4651cfc54369598937ce3ae063ce99891c20ec3729977d7566de52433
SHA5123006879025ca9648c19d9bd2956c6f3af3c0c4d1a0822c3841ec6a12c401dd40a2ff236331b2739987278ebf721c1d3e198405fb80ad77632fc4ad555830398a
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\4cc699dd486af2551d01b1a74abd5337c6e052e5\index.txtFilesize
194B
MD5bfc0dac8829d4446946852c1ef040c21
SHA1409616592ba37e02548cad12833dd2b76a21b617
SHA2562bc82538cfa1b47c1c8d53eca4dc4a61c53d923e95295af8062549df2c55a7c9
SHA51223941164dd4987e66496bc2fe693b5f16f94ee6de41ae0431798fa664a91d6e1daeb1059494de921f4056f17b3491d6ffeef416ca95f6b6662e28beb9f9d6f99
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\4cc699dd486af2551d01b1a74abd5337c6e052e5\index.txt~RFe590555.TMPFilesize
131B
MD5b29022d0715d4cf56bfd2b1917ef0886
SHA1ca30f21c7ebf6af20b461408d713c356159d5c71
SHA256762a639f31cdd8efd0553c70aa721abe6f1921316499932b0ac5c85a1aa2885d
SHA512a15b17bc6dbd95e8f3e83ab52fc2befed95de288f83aab3d2a02696f221a67b0985a70bc75f421484e79616cb9b7a36e8229bf986cd4855e0d2d0a23314e94e4
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-indexFilesize
264B
MD55eaaf65a2d9b9c5255b74eda2e767e45
SHA12fc8071939f51e58dc194ce58ff9bf70da6d1ba5
SHA256cca5927e0e3e61a942d3981de56b52c4cb4bde26b6888b16a2274c9e7c749d0b
SHA512eae7bcf345f8ce875e3ae0df9692f1a4d2a7580e30722346d63d4b42ae12b718f17e527005409b9ac072e505464a00993cfa2f8a7ddd639763fa7f679a6ba8d7
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe593752.TMPFilesize
48B
MD5a1093d7e07e8f4c620bc54109c875810
SHA14e7942f963bbe0e38604e5ac671f8eb858801c6b
SHA256aa948ea9aafc501c57a9d274a3728d9c814360e887f1ecb9433b0c8dab985f52
SHA51267343ca518c76958b8542acb1b37df13bd71e23ea900b18152c0f1c235080cdbca506f654e3f8e14d498f3de6db8f87d0367109332ee0ca4d22428626b0869fa
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
252KB
MD59e4b34ec3ea893528c428bd1e5248234
SHA1e0eb65a2d79fa325d6aecea4479ec846bb26253c
SHA25606b771ad010570a2735a11085fe7a7b65023cdb53e1f589ece47e3b14d5d4f66
SHA5121106751b6402768b1d1df559051378ddcd1630e0c74a4347ce0a2f3a0a7d9b358b49bad5238a74789451140f3340ca27451308f2249f4d589a07112b0d3cbd81
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
256KB
MD54c37c83382ce7e25ff5e9e507c0012b7
SHA1c3dc0c09094903dd4b955d50a5b2653377bcca40
SHA256f562c0e24d359e67cfa1127009beff7f8b02eadfdb910b5d3b0ca6e48e825f7c
SHA51230f156764c6cb937c5f727914252bd8f33de8c914317e4ee7459d3a022986a0a7c28ef8a8f52380afbf2b6e98a5b88bf88543b4cfc9862390e1cc3b3d4f09a16
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
131KB
MD50e2856b750cc305316f15c14346a9f1f
SHA1f2df3c1a2e3e24f3c3933c45988bf65c31f3c1d4
SHA25640648ba52ed5ce6bdd0ef8f7e19537a4f868d7eb13948f7edd136e8a57dff351
SHA5128621488e6b24eccaa94299427db4e708e64556904b4c68ce08bd3e2eb07308430d5d2602d981bda4909a254aa8bcf3b4cd6454f295d0166093390215a08275e0
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
131KB
MD569eadb30277c89e52d955a1b33af2205
SHA1d76724ac0cc334fbb3c96b622f19cac898d7039c
SHA256d821343ec72eae8afcc61b653843829fde1aedec7dd2a578d5db08a671fbc067
SHA512fc895a33f4c9b426cd1bc6c83cbfd2e69cc864f5df82fb94ea0a81d318cb2364202680c6906e18673bf9790a8a2650ca2cd2bcada69025d3a78e324954dcb7dd
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
254KB
MD57c2152947ca478a5190dd8d4cfe21836
SHA1bfee2a295ce0b08757bf2d372a3ff4f8250575c4
SHA256e4730e9b4054fe6e5754da5df4ebef7b73f28d4f16ef9ef41d3551734a4f651f
SHA5123c82126a5a1f9c94d70a296238a1f39d6a165211f67db978085aeb25606d86254c4c48b4f2f63bde485563f92d33c31205a2606f5d499c797f538dd6aed2d4a6
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
165KB
MD577cbc769809b1b1522946f9f26da66ed
SHA1116393a3b3dadc59693867affd9d150619ca204d
SHA256ffe94ed6410731422896cc8f5b0e9f9f33d95052bfab4be3deaf9c59d5a0bf5e
SHA5121f361f97f1ab935169090e364760d550765a98eaf8e1370f68c359439ae812cfe2bcb1037e3c4feff430c76034212168f486b0623f1a09708ac6e638b889542f
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
254KB
MD5dd11056393c7ced85c99dfae3b968fd3
SHA1bd558094bd9023d1f5d84975c0ffabd21d2815d9
SHA256ddbe722bb1503c946ca28341e372208a3873c0782f5ae47f6cdb6e5700627ae8
SHA512a2c92a9ba18e863fb47b29715c1279c87f903a95b5b36389ddfd7d5c15a2b58dbb7f54a22486a736eb816dba7cb528cb38684dbd6d3bdaf0de8cdf7b0323cf42
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info CacheFilesize
93KB
MD515e4f93336554b5298baec9dc49a054e
SHA11c00afdd43defdc2af8c379d8d4735a73c517414
SHA2562f6f23abf37873eb126a70ff2717d2a12387a0a18dae606be5cc38047d6e63b7
SHA512981aa87fa1292eac60bf80434c7d662d14550dc27efb63121eac02b91cd972c58cb4a81bbbe2a37e16d2ac862fb594ef02a28d2664fadcce00089a04405828fc
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\bfb6c5d3-ad98-4e87-a556-3d241fff2012.tmpFilesize
89KB
MD586109f9bcc291a59dd92961ba457d569
SHA1bb866beb1b67870e498e066df986eb037c2d2afe
SHA2560cc1bd7b9008cfc20e176bd1cb3e7cb7cf06e1c11f0dc2fdcc0337898180aa75
SHA5128c32bdfd750e74866290d01aa179ef88c9cb9a5f55e47a13646c1bf7b76b0ca5b1b60e7f30d130dc236b5172af047db6c60ee66a8123338c207ba682e1e542cd
-
C:\Users\Admin\AppData\Local\Roblox\5815592448\InstalledPlugins\0\settings.jsonFilesize
166B
MD5a124ac9f9f82ce9bfa4465e75bfad473
SHA1465ee8d621bdb73b9987dbe479b976e1cef6917b
SHA25697c10ff6f86f63a5fe2097b8592321a600ee8415cd1822e441c0ff138139261e
SHA5122e5205b90c7de76a8ff73163520fc36db7ced0f891209e6f2223ec5419b0a08b0aaf866d9f57ccc7f99a1209d9b94567f840374387282090f54b33f35fe367fa
-
C:\Users\Admin\AppData\Local\Roblox\5815592448\InstalledPlugins\12241164223\22227239214\Plugin.rbxmFilesize
12KB
MD5c6c4c66a421af49675a1e8cefe67b5b9
SHA1190e0d57a7f1d564fab92e7d64c7853a863c0afd
SHA25669c2c12206db99e93d80a33f9526d438f915fd642ee3013083d9880b003596d3
SHA5126400410ad1800620f208d6fd81d9a111c472a4070f3c54c4926bd3df7da4bc7a9e4a31a2b5c1dfc04a91b6537612cbc3a7550827619ed24f720049f4257d5d56
-
C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-studio\9a5054a082e2d341025a7cfab14be01eFilesize
5.2MB
MD59a5054a082e2d341025a7cfab14be01e
SHA16f880fa9008dfbd65ceed2022744b94d9c42231f
SHA256324961104eeb40c40e6bd00278affe755c82d77189606280fffd37852db54c3f
SHA512cf24a5a3b79894b93b041b2b5e71f494cbdff4cc524267b81b46c86ca5b001e3bc9a57b724f46d0bdd3ecb0fb3ccf0168db978e5928422df7023f736548c15b7
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Crashpad\settings.datFilesize
280B
MD5904066af90967d33ac16516581c4a6c4
SHA19f112fcd5036efabecca8b2fd8bafde58e258dd7
SHA25698cb956152897fcc647b19903a6c5c9cdc01fdd1a69bc34684258f8d2b5cf0ca
SHA512e24648e137a89ea20fb0aa88d9e2e4c26c5555ac4ca0d3f1e422e89c24de335842cabf6e555160574dbba2c5347110b4b07d3314683496bbbd0d254b79339d82
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Code Cache\js\indexFilesize
24B
MD554cb446f628b2ea4a5bce5769910512e
SHA1c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA256fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
SHA5128f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-indexFilesize
2KB
MD53dc61bde9589cc19f8515c0a98bafeb9
SHA1e581d4413680ca73adf0be4a959b075b4f884725
SHA256ba4c052bc1561da33e4b0de57cf3aca2cbec1da755527ed2f6aab13b70955dc7
SHA512f5b452f5f34cf42ccd012efd7b365d90a288251387d5a6b597fd0b4705983b000587d9c5538a79be4d682a40089cfc551ab6b3aa4b4426235ba2979060def25e
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe59f42a.TMPFilesize
48B
MD5707e4a66d4733984b9ccd1034b1573d2
SHA1a15cea77d72e8f819a2f49573abdcabe868ea10d
SHA2569fe293303b3a85dedc000a7806f38c35f6e36126953028b193aba3a16ae689f1
SHA512a1c0854f800e31c3ee348dd5c3051877f37c8dfb3d77938f89acb013c1114e0f034f338cee495d77f023e26b9a08ffe7e4c8ac4a74a3c48a778d9fbd708bee75
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\Network Persistent StateFilesize
59B
MD52800881c775077e1c4b6e06bf4676de4
SHA12873631068c8b3b9495638c865915be822442c8b
SHA256226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
SHA512e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\Network Persistent StateFilesize
3KB
MD55d0fdf82bfd765557d4cf7c81817da50
SHA1c50ce164c6d274dad41d34e59e0ff5afc8fbe96b
SHA2568e213109292a1e10de299a5d7400036c0477431f12b07ef5553352327a0c79f0
SHA512f73b2b5176b002e443b59481c719c03d71307ed6bf50e12501a869104025f2a00451a239edcc04d35d7e42b3685459339ccb3b884b6f78e56a473ba734489960
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\Network Persistent State~RFe5a0c84.TMPFilesize
59B
MD578bfcecb05ed1904edce3b60cb5c7e62
SHA1bf77a7461de9d41d12aa88fba056ba758793d9ce
SHA256c257f929cff0e4380bf08d9f36f310753f7b1ccb5cb2ab811b52760dd8cb9572
SHA5122420dff6eb853f5e1856cdab99561a896ea0743fcff3e04b37cb87eddf063770608a30c6ffb0319e5d353b0132c5f8135b7082488e425666b2c22b753a6a4d73
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\TransportSecurityFilesize
1KB
MD52ea41567162e732f0c64774df25e1320
SHA1885c566f704b07df086bc158ce662694ed0ada47
SHA256e5eb06197547f21e6a33d4545054331e22c14a3908997bc1fa6eed7ac27fe8c8
SHA51281873a655030367b128860ce407a8adb5b80d4ee2c44d41b7a302c7ec0d7dbc0c2ba70c6d3698f603aae1e3976d86018b5fccaca503a432805c62b482e9fca8e
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\TransportSecurityFilesize
1KB
MD518bc62b67f1866199e39f11983eb56de
SHA1899d5c0164f35abaa9dc3e8c95fe80313a96d727
SHA2565edb56ad7e2598e9764ef15db3d2d88229f2faa91c4e562d731ccbd251755181
SHA51235dd699c70ac0aa0b13242fe437dd8cdafc66e7ce2dd5694cdb1936c753ecea8c137ea2cc6c1feea82f5ec976cd88038b50411b8b6072f3de56095d237ba33a0
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\TransportSecurityFilesize
1KB
MD5eff16ed4d53f244daec3af3d173bbee0
SHA16558de4e26581e508977224c7996e0863b2c740e
SHA2568892c8ab857d7bdf1a5429d362ea8a6b2f8ec7db326a820d4ae664619ffc5e73
SHA512c59eb126e3a8fc12f3bc29f11cc4a88cc0fd63269a67b1dc786598d8a51908feef32db5a240fd9b117d227975ade0292365dc31d3f1185789eaebc12dbdb5d69
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\TransportSecurity~RFe59ec89.TMPFilesize
1KB
MD5ed7598a1385e2e45d386a91d3542d599
SHA17ce083af85b07cac6f6da9c600f635e51e5edcfb
SHA25630be739fbb11755f507e871489b600bb87369e6dbf0c5f8e3743a26cacf54754
SHA512765cc546a15bb83d126fb8eafab59168713f52f9a7d08a4c15d6477255f22d6fbb9468af878b39267dfa42b48ef1105fdb0c715a8b535ea307bce5144820c800
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\PreferencesFilesize
6KB
MD54b53a3ab3665f85d5eefd230044430c5
SHA1628a58dc84808aadeed8260859e3b650d98550d1
SHA2562c5587cc42f8cc89019f45a07859f318972496f6c1241ecd841c132ec83893f3
SHA5123a2075a1fca2be042c67599731ccb5bc5b00818a279545b250adc722ad06f5e0b18ece762b49aae66f002918dc92f464e788b68ed1ea58a421b411703ccbbba2
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\PreferencesFilesize
6KB
MD59207dbe940bbe39032b75098127a8225
SHA12614753aa47dbdf89bb3ae063994f123902d7d5e
SHA2561a5a7965410590e73aef281b73995a16d1a64e237799ba51c67d4777ee7db787
SHA51203aeeb9de3a3cae88f0d67132cd79e39b316f179e1660011da5f08855f8cede1fed659d957d7593484fa2d6e7e1d91a3958f5c35a1d02812a6daffd194d39fe0
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\PreferencesFilesize
6KB
MD57eec5e92b294722526e50997e379d229
SHA1c6c6d305667c158bca6e3d8ae1053669f6af937c
SHA2565a15fb1995acfa4910a4bae52682aee5d4a59765d7335c43ce0b86df79c7814e
SHA51281dad209326a6109178565736b6a020f7213e4d853e3e35f87c9f53fc19829cc66125e444f0207b73c1ad80e06ab658a7e8ee3d4846e2636364fb0240d244386
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Preferences~RFe59e601.TMPFilesize
6KB
MD5e725e25404dfc7ba7448cf9880e43f13
SHA14224ab5a6855c142b95c8430f86ea813a291ce88
SHA256074e669ef3f59780e326f6c939d76fa307a3c4fcc8e6a749ef5eb5ff7291383a
SHA512eb8d08199a78842e497d8557fe3e881c13cf6704e364a40140c361c6f7d3c9ab72be3ca32339ba16037316b483fbfaf1b35cc40a3bf3a784b790ddaee9551a9c
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001Filesize
41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\GrShaderCache\data_0Filesize
8KB
MD5cf89d16bb9107c631daabf0c0ee58efb
SHA13ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA256d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
SHA5128cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\GrShaderCache\data_2Filesize
8KB
MD50962291d6d367570bee5454721c17e11
SHA159d10a893ef321a706a9255176761366115bedcb
SHA256ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
SHA512f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\GrShaderCache\data_3Filesize
8KB
MD541876349cb12d6db992f1309f22df3f0
SHA15cf26b3420fc0302cd0a71e8d029739b8765be27
SHA256e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
SHA512e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Local StateFilesize
2KB
MD588e2b973563c9636517494b80781a30f
SHA146803540e3691fab5726148b3efd27a0c6afe41c
SHA256f5495eb7978fbd095b1f24f60ae957ef27b885602ca248754a20759efc89ff83
SHA512c5052c29629b88c7d1619a70f4cdebfbc452b55f33de59a4bbdacd4e54cd6b12210557df822dac44bd2134315551400c3675eac0a7868f30edf161646532f338
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Local StateFilesize
3KB
MD507efd448f2a9d653ddb599614dd41933
SHA163b57a42bbad6f960c06aef619541fbeb7ddab93
SHA256f74d3f6f6b028496aff22f7bc2ff10822ac82029100e3e3bd56b934101946288
SHA512287b4cf5f13d9ef40713bc43feff8bcb3f0198c7848ea7ce86d6c644e9b0627e7ee55b4a0a28ddac3afb613463cce68bffda88771c7ed331e38f3adedd890719
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Local StateFilesize
3KB
MD57718eac9a95fc308d0918209abd4a8eb
SHA13068098a62d1ee067a6361bebc9e24d6a2b0d4a8
SHA2563bec9b7f30677a9c4e5e06d2f3688074544fe7574b55660cac56cad8a4a51cfd
SHA512898c80a6d50535ef07068a91dce9201145b2f9be32313156d2c078ce269988655ac299742069173e9b65d4bcc5a7979854067bacea9fef14161707411e61ca80
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Local StateFilesize
16KB
MD578e6f89990467597f4cf551164176c19
SHA1bdfcd3c68d9aa5f8267f20d8a93b553b0c908870
SHA256c1e07c6d0e40bd17165d3922e9d2585c388cd4a4b964b3cc6dcf5b08bd52d297
SHA5128b2725891b6bf8f93f663c40afd66dcb31a31827a01e6ae03663f1efab59e59ccbf5ac6c626baee9642c33326565f0bc08957733fc608cb1a9cff0730eb3795f
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Local StateFilesize
16KB
MD5435746f2497d8ac38e26279bd62026e0
SHA14a03d9b95db3efc7c57db11e2ad50865cf12101a
SHA25668f953582eb75b8fc386ee14ee80da993aa883cdca4ec5bd88c0d4bccd35a6da
SHA5128121c79520a0683d3aec77fb359ce0434cc371bcce39016927a131ffee89deaa5f807ecb415c6af7a2ee0144fc1d42eccc755ce9848b6e9bd896830b81e38607
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Local State~RFe5990fb.TMPFilesize
1KB
MD5d6705b51e41e4cd0d7ab18e2a83f50ec
SHA110883c5a2e2b076fe0ff922b3cdba36797e65741
SHA2565adbc124f94196e873b1d77fc6fd45a4d5f8cbd55c9e4cadfb43f8024f15e58e
SHA5128c32229ec724c1d6cb20e868c54345e13e925dd46d54afe3ece4f139bc7e5544523b9804dd02f00c37e89b57061b71da5247ca9fab29d471a9f2225fd9a79e0d
-
C:\Users\Admin\AppData\Local\Temp\Roblox\http\01dddf5e59a6b2afd38a91704a84002fFilesize
91B
MD5c153e86c57564c7eaab8ff5b53a3529d
SHA14f9051affc423d6785c75fe09d54ae6a69fcc0fe
SHA256e531c9cc55370f983deb775785faf2517bcb7ef75117993af98e9dd7b5304aa8
SHA51200489160b7a017a289510f24e060a36de925670434af27af198964f0236a5b4f38047eafda2bd64bcc4a513507b0da766d55a4efd6ce3ecbd3cf37125cd2b7d2
-
C:\Users\Admin\AppData\Local\Temp\Roblox\http\06b3a5f887b4c0a135efee7fab9fcdd0Filesize
91B
MD58718fa1388789fe872fe8a87e1711074
SHA1584c3104ebfb97c146b90b41bfd1d7be26a4e7a0
SHA256c0c0cbfc7783966f47b5cb228f41a91a4dccb83577af9fa2acd0adf10090a497
SHA512cfa77d040cd090fdeda160fb84172756d300909597e3512b502dfa6d588f147dbc4c4533a44d585e8ffc99495e1dcd3e520798bff0e55dac9de74e7df7720a30
-
C:\Users\Admin\AppData\Local\Temp\Roblox\http\0aaf6f7317997d554f4a87946e18f4bdFilesize
91B
MD5b7fcabc842e34093c2d79eddb9b0a14b
SHA1a6ac7bc76d847debd8851693a34c9d4652770ec9
SHA256ea654e6a85aae695ed6a83519d28e14c497685a7d9a1e3113de375dfad9c0105
SHA51230bd3f1a0f400ec09fb702f60da46d66415fcfbeb38f0c4ccba33ad9ec0f31c536dfa514ab06a7f4fe96b7685195a69f9d30caca2244dda3ec8866193f2ce26c
-
C:\Users\Admin\AppData\Local\Temp\Roblox\http\0cbacc9a3c6aa07deb13db83f658936dFilesize
91B
MD5e3690a37568ee9fe7f191a17a47e2146
SHA1476c939e0ca065001820946509e36ac2842fb1fa
SHA256b8da756d34febd98745815e7ee643c49dfdf1adeece7fbdeda22487c06472f28
SHA512c7b777cb3616fbe210b58c1e2395ffb378ffb36c2fed3af8c634e7d39667b9b433386d1a284f936a1d4e10e76c7a678e97216fe801cf95a0fc3fb313fc4514a3
-
C:\Users\Admin\AppData\Local\Temp\Roblox\http\0da1eff9a99725e6873478bb53e6ad07Filesize
91B
MD520a9b87070a921eb6ca606f4b49e4ee5
SHA1500f261fd7bbcdaf2b4b2a3a6fa6f0cc69836e49
SHA2560cafb5b24a63bf21914494b4800b2ab0aaadadf01fd5413b85ba98b573b8cd61
SHA51265279869345c2add4d752e8db9b2b5d57f2f21f7441559a76a8c1dad56c8759a37bcc0741bb96164e874fa8062e89e2c200816625328126e019b377e79a973f3
-
C:\Users\Admin\AppData\Local\Temp\Roblox\http\0e72d04ad553b3d0c14270c19eab2986Filesize
91B
MD571998edfcaf6236c9cbb0100558e9e10
SHA16efcd23ccc8e4db8814e5a2e6df0db27e198ba81
SHA256eba46b16e0d6b6402fb3c4ae1ddb02615263f553b1102c0ff9c7d1b939f30754
SHA512c81c7c5c19fcd4999b9b0a7abdf044621ebd75fc6ab4058472a7e61af90f2fa021e64040e179e98ab7d31bec33ffe042d93025ea01dccfccd014fa0f72588bde
-
C:\Users\Admin\AppData\Local\Temp\Roblox\http\0f10b6865c21c904e29f52a54a31f37aFilesize
91B
MD538b25c1089062288a7a9a8876138e465
SHA1d7dc1955cdabe9a50ef4f6b345c9012e3efeb56c
SHA256e39aceee4952e730f1a101894520b046ff21156ebc79c0f8e070e87af20fdd29
SHA512198469bc9aa03de2c29b322cee7714a67b1b421a8fb0b6ade7148f54fb5ea0a37f6afe5e80f052f41815174363ca2b2dc8395534c624f0f87d2f7a0e9d773dd5
-
C:\Users\Admin\AppData\Local\Temp\Roblox\http\0fdc2dde2a6ff4379f2d1185c4ebfdf7Filesize
91B
MD53e21b2360f11990e0062115d95aad2d8
SHA19a65f14b781d767314b440c9e8d9d782f0110dd2
SHA256918c5684c30d55ce34b03d3ea3f27255be533724a9ee47ef4ff63ddb3f37e0bb
SHA51209519f714495ab6b3a42b58157b84fb50b102d3ce190bbf7104f121cb01184e0741750a0299cd84379c9a8493eb53f297b47afa20b2c061f99530d94affdc86c
-
C:\Users\Admin\AppData\Local\Temp\Roblox\http\107b997c40dc46ca2ae7c2522000e5a4Filesize
1KB
MD5ac16eed9c3a027ebbef310583ad4fa67
SHA1db8d634223d425be0893b4332e9664ec282641f1
SHA256a35088be12c26f5b9ff4d4472b5d736afa7008f38b06006652d7511085b4b5aa
SHA5129099399d5cf3a36933a0efc9ea0f6a88aa141ee7e3bda55c663df9292e324b975f02ceac8b86e34b3387844be02973baf575718ddeec0ce0296ff938169034d8
-
C:\Users\Admin\AppData\Local\Temp\Roblox\http\115864b0f296fa54b7995fef9a9cc9a8Filesize
3KB
MD5589d347cfd02fa393dd07d5e6d2812d3
SHA11022f82f2253cb03990f138faba58707abad2590
SHA256f19a5279322336616b65449c5dcc3a9644bd5d6ba07711543c22bbc105011d8c
SHA512d0ea83dfad3cfaf4136a66857600f18bf10b9c3f518b70884d10dd7717b7283e67a6f5815814a9cb55cb56d48df31dba81ea4fd2e2bf9735475ca0d898208eb0
-
C:\Users\Admin\AppData\Local\Temp\Roblox\http\12884b440050e73aea034ed650922faeFilesize
91B
MD5692cc89c1ca6a39fe4c6bcfa439903e4
SHA11a8c3548d7b0236fedb802ca3a87c66a04279f01
SHA256b5478c4399cd1539df795414ef43d81580567ae25f4c310aa7631736fbbe727a
SHA5122553d0bf3ce56c59f996754ad98bb1f2a019fa4126c76a34427d631ed9b3f06bd23c7001399a7f0b869381fb253797824385bce5ff7f806355122e6b70e1726e
-
C:\Users\Admin\AppData\Local\Temp\Roblox\http\13b79d16e4c76d6a73c49f51d08f6c1aFilesize
91B
MD51dde29a744e2c46107e4619bb00ae037
SHA100849e255c629f92c088ac0a4776630afb320c56
SHA25613904ad85be364a5d80acb2f4b231422ea9848101db317f398532e35a53374f4
SHA512379c3be06bccaf8a43567fa42ed8453f8b7994bc721f69e2696336a8c8b62fea3753a67f60614fe2dad63da943804aeab4068fc826f2ed06eae92dd82d2fe056
-
C:\Users\Admin\AppData\Local\Temp\Roblox\http\17394ba5ec63d84291129e76367f0566Filesize
1KB
MD57966deaa51bd3c1609efa96a59a0c7cf
SHA1f0669e3fda02f4b8c20debcbba601caa686eb466
SHA2562501927adb287f94dba8bd189ebff85be56cebc66fafea022fa306d1ca8737b5
SHA5123c4b23875929cafd9509c88be2521ddf4bbfb7b1201f4ea4e3371d2d6ad051b623561a9b781f56219619a54c7193b83b1c5fb76e6b1cb60110384527ac71d2d9
-
C:\Users\Admin\AppData\Local\Temp\Roblox\http\175e604b5aca76fb5b330a52c04392a7Filesize
91B
MD58b45468eca4d67b78868d05365561305
SHA11efaf5a14a11d3cd0c7fd4fbda0fdb2ceff34e54
SHA256a1bb5229b6eeadd80f8c2ffcb3e85f2dce8dd812e9f3b5d8fcbb54435643a7c1
SHA512cc0028840d81b992dc3233de01158caf24c74da98bad74c843b2719f5f98321f17ebcef662a1f33ffe8cd4dbd33f31a70c4d4163fbae1378767922348f6e7980
-
C:\Users\Admin\AppData\Local\Temp\Roblox\http\1a7b4e6a4b752a5965c1c9e501e8035bFilesize
91B
MD573f494f3b048607e7255ed520091d427
SHA192646d8ab78e09e6569ac7824d2e4c8aa1dbeee8
SHA256b3788b22d97f437b9f8d074fa732bea2b7f59a98edb63752ba529186a7770801
SHA512139f5de896caba9cebc09b005d765cf060a3490037dc60418e95f66bb4dc1d4c484e8521bb1492558090ce4dc0f0b06def2cf9dd01bbec2a9db5da0cc1132f0e
-
C:\Users\Admin\AppData\Local\Temp\Roblox\http\1b55d26883fe9a9581583eb2664291efFilesize
91B
MD5584ba0316cd0385a1d6bad9d705db953
SHA1f1bf89cc2f5e228152d6bb7e6733c87d97feb319
SHA2568556b70a68f86640086aae58ac266e4a363396c57dc996c3557c4e3af7476ebf
SHA5125a4cc553642d6cdba5c0aa9b99b7a8bb0d726a849b39fb25464bb5c2e0ee4e20e518e6a77e0c8b78c4cf9ec3ed4f44d9cb77f98c72539904eac993b208b7ef96
-
C:\Users\Admin\AppData\Local\Temp\Roblox\http\1c168b86beec4f66ade37b65a398d88dFilesize
91B
MD52c48ac5ced0e528f614dfc192d5b2e58
SHA1c398635db55da2ef4a78ec8426703dba911ad47c
SHA256b19b28190b630d79b964b40264507797faeee1f4447ae55dc480cfd78404ae4b
SHA51208bb7f53db97e46cc82534e466890f3928da1c781a45aa3b25a61cfb743a619c755d537171f58035b3721d71ab6b68b9d2cb4711b627c7794e58bab0b4a331bf
-
C:\Users\Admin\AppData\Local\Temp\Roblox\http\20e0b10c582ed4f672eaca027f53d747Filesize
1KB
MD549c9763532c61a407adce7861e1028a6
SHA145bc71267b3c78d7063da113d4647c31a20c793b
SHA256d66602eaf282db7cd4568d2231a2d9d4b20ffdc673220182137dd64738413ec0
SHA51221410ee4ebbaf843d23b44dea7ba1a5a7747cd2db535ff35f91d39413eee20113e015cb6718efe69aaad4572b7664ab79f941ffd490e2e3e6409cd6bbd62c278
-
C:\Users\Admin\AppData\Local\Temp\Roblox\http\22b19b20581c5f62166a73f4ed0991fbFilesize
91B
MD5908169b22541e44d56f5d1909909805e
SHA140f82ea8fdfd3295706176ce7ba412e753f8eeab
SHA256d52f23e90b859cc5787fcd15679a6c5ac79ea5bc9b03d5f58e6a67f57afe5bfd
SHA512b4fef403d66bc05f31fc0929d38f44ac15ff6f2d3cb02160073a9d939ba28e985fa77521e558ece1c4ffc73c720c63ff263ae14adb2ec7b19d0cdde82513efcb
-
C:\Users\Admin\AppData\Local\Temp\Roblox\http\26885e3cc7e7a909de717edf09e66772Filesize
91B
MD56e61c2bed7f3633565c4151242a39fd2
SHA1bb9e6db391f04af939de515d031ddc6bb42f12f8
SHA256fc5422d491323b111b2e072b8c0db84fa28c506d5e9d099033c711bf75e459b8
SHA5128126ca14bc31741ab57b6705da3ee06d704d146fb965e275b861a9c52b1749715b30e4c40d347a5e15e3c7a0d48ff8a2acdcc37c0033d82b0146e58555a48a73
-
C:\Users\Admin\AppData\Local\Temp\Roblox\http\2e08f0b0e949b76ee4526572a0fa02e5Filesize
91B
MD5ce9d6ca2ea8e5d55de2299f23ad98d5a
SHA1ee9e30eeb2491e1e23b32a7e86ba0607460fdb5a
SHA2566dcb6d8067ce45b9e552d195c179de1f519bfe25104326b726bbd7e22d502d3c
SHA5122db8283c9423017aa9de86e956937699ff1c7f6c766ad83e7a523da770aa7e2005b0da17b71317dd8e419c826acf76d1356d2b8f756acec24748a1b6a0551685
-
C:\Users\Admin\AppData\Local\Temp\Roblox\http\2e9e407dd3dcdd10d7bc25d07df3aaf5Filesize
91B
MD527d266bee85ef7daec1d6a6498ff5ffe
SHA1973af70f82c92511944298b7f52be2c3fdb35f2e
SHA2568cc3f6715046e92bbb8f119bd56519cc7601164bf07a03338b29e9f766fbd2b9
SHA5127aae29fbf203ba465b241763d5fc3663a0634e4fbd1ee94cdae2b128a6f1f02122a51ee121b031d1d5f209b310a6537840ee72383771f4f634f6f1e91db246f2
-
C:\Users\Admin\AppData\Local\Temp\Roblox\http\3684d47a524a87d48ca31fd90acaf0e2Filesize
1KB
MD592525893cda7edd03f531a95ee6fb918
SHA1957a6f0ed53a1a411be72cd8f7bfef952cdb1788
SHA2561c8cb2f6cc3783151cc48b66d1b15905bc44ad252c0b20664326b15db99705c0
SHA51283c406197430dd004639f829fbe38d3853d698c8eb95315ff98d827254d86a4a27e3ff938800d423c2cf621ee178195939eeb5648c1c4a3e1fc01216ff37cfcc
-
C:\Users\Admin\AppData\Local\Temp\Roblox\http\373eb9f859dfb4f553b19748d262bbb1Filesize
91B
MD5e6ac2d485aad3b98341b7d126a034c04
SHA14193eed9387a9645f6cb6323b48f31d4ae7096c7
SHA25605defb267e9ef077e09014672106fb227f7166552fbabb131ca26195fbd32b90
SHA51218ec7a42adabfd627061a45546b2499f9cd51650ee7d3d64b1c5eac1920771f093da37656ae8a07cbff974ef8f1328eb74392d87d6aca52da0d8dffbef4fc700
-
C:\Users\Admin\AppData\Local\Temp\Roblox\http\3acc8af1251b7ed321f9b36da661d9edFilesize
91B
MD5808cb55c51b6fc55fa6cdb17892dc876
SHA14487b86a3a42ff05e109800b1827c100390245c0
SHA256eed0725bdeac66a2e53e7daaa033f06c360314d751df70176a0af3f23eb08c7d
SHA5120d2e6534792e7d417a6fa8403f22397f406352a38bfe1019d87e0308d041b3e69d7defae77e2bf6b87adb3b7d59718efea7d5fad340847c681eeb293beb0f24e
-
C:\Users\Admin\AppData\Local\Temp\Roblox\http\3f62b9b52e84cea6a365aa7b834f171aFilesize
91B
MD54c2e0e5bcdee0470282515a3568a67fe
SHA1a7d48d8dbca98ace474750d48100328da465b438
SHA256485b116c1a4322902a827659a60f6263d34fb3a5837d5f9b576ca9f9aa8228da
SHA512ec46221ac2862e01c0686bbfdccaf9ef52a91e04772dd568c5b9e3cffda899cc84c1a82f4dd868eefd29d951b82e766d99860c03ea53df756261da00d8358a5c
-
C:\Users\Admin\AppData\Local\Temp\Roblox\http\401d5510cffc510adfd0ee1fe3fe9fd3Filesize
91B
MD5f368f802f6f02cf725c9532b6871b9b3
SHA1b6867bc3ec390e0851a5e982b5e41f78e9e22735
SHA2568e31bb94994f4f65823a2621f208d585423ad28c17fd718d1a7af8a190d9c772
SHA5126eec68453d8054675ddc0f1c040b3d3d009fed3b2b0353564b24200fd211edfdaf7842f54efd6225135dc8ab51b4b9f1a492edf50df95020ea4f1c9900b19217
-
C:\Users\Admin\AppData\Local\Temp\Roblox\http\442d2f76efeb50c98458cf03595d08aaFilesize
91B
MD5fd2fe348c4652df0667b2364315bcc97
SHA1bfcd719f16195df6c9bece3db899062b562cc0c8
SHA256604e2878101f94d3fa3de96f3a594b6e486e574e7bc4b6c37549a91d41ee7fef
SHA5129acb34df1948803c306228d49cb899c03f2ce6148153825dd2094d7927853cb81dd746d592672d53d81279433d3c909391380e140b08b4561d34cdc0970fb5c3
-
C:\Users\Admin\AppData\Local\Temp\Roblox\http\482b2e9ae7bababc1e4bbcfb1683fabdFilesize
91B
MD580d64c63b2af826fabd57eee1c66c412
SHA1b85b2e9c8b98bcea814763ceca36d0a367648469
SHA2563a7edf98c0dc05201d6a08e2d22012dc76ad7d49fb5dbf10979f7e4260f226a3
SHA5123940b97f7208e01152735753c1f7246a60f4a07bbdfcb29f5e63e643070013c91735be7d1af90a5cfebbd92135ab39c5ebc651ab2a448545079db2c28f2ca872
-
C:\Users\Admin\AppData\Local\Temp\Roblox\http\483372514242cfcc51747a06b910d8c0Filesize
91B
MD55e0b0c1c3de26ff1e7aa0392b32f51bf
SHA129b33c5dc5617f7e8d3e05628631088a38192b2e
SHA2568391b795140edefd0167f9e7326c232f066d63d8b2fd3129df332a8d91defe90
SHA512c56bd9636616a056c3e2c1286d65aa2066695efa62fa9fd443087e1693480d9d6c2c114795dba9906c7eea37f994204cf7657796d231e9f330f6eed58ace6e6c
-
C:\Users\Admin\AppData\Local\Temp\Roblox\http\4a6799f3e2c13aa91754396731f05de8Filesize
1KB
MD5090d8a9d2cca85494b570a34f3fad5d6
SHA153f8bc202cf11d2873a2fdab1823c96ab1bc389f
SHA256706fdce652e479d4441ae65e365832aa3d55149584a16e9240fa7840b66c49ea
SHA5128494eb954d5997aab2a5a1d95591671cf66c5b1473c4f858995145402f76cf361b36e9812b04b0a0e8a36c615e526b80e6213b32b272094231611faee95cb3de
-
C:\Users\Admin\AppData\Local\Temp\Roblox\http\4b2cb0ac24812531983e0f1c06585e59Filesize
91B
MD52bbfa8f3db8c764e33474581eb2d5f80
SHA1192c4b00ba42c8ea68808f618ade05d7c6ada3fd
SHA2569277544ab304330d7449d8ea8a296d87193ca2c120a41cd46b4dbc6be66ca7cb
SHA512951aa83965af5734957a7a5cf19dd99afce1ea9df4b14f9e4eaac87ab1530eba54735db936134b697e8ea2257905119821ef6fb2438864ba772fe47a866fd181
-
C:\Users\Admin\AppData\Local\Temp\Roblox\http\505d75fb6d7bdd29cb6df5f6fcdf676aFilesize
91B
MD542e1a5d055d9128f25d3833f4f481af1
SHA11f6fd9e9c51d4ef7b886402a54f29bed9d298733
SHA256385df7d5a9167a817b2861e83259c295b048711cb1c67460278273f8e1eb6569
SHA512a296e2a9cac0246e4d210b4906154161d0e3a7cab570800bd06582112d749d5a224fe03bc49801ceec953f3f18ebb35c2495be38d5a65ece7e81b4d3c3843dff
-
C:\Users\Admin\AppData\Local\Temp\Roblox\http\5115104c7cffafdf5607ea77a3b35088Filesize
91B
MD5b65c1a6a506a176d3979b9f8f603b899
SHA1c50bc108ca32c27c17d2bf9b3cd880cb84bada8a
SHA256d0fdeb0d693131e34fb0702794fedee4c703d8e3efaaf26a050cf8a142982c86
SHA5122126dca4251473b8f642b648d5eaa5d4bd59d87924c665513239772db2cf1c0002bbd75da6266506906bb29e63e7cebb7229fc632751e0a42c82c140fe138d48
-
C:\Users\Admin\AppData\Local\Temp\Roblox\http\55bdeab49aea2fad43aa5ff4b3161325Filesize
91B
MD5ec7935a677f887ef6f06cbb99a3fc459
SHA135249d7a74b0a47c8712df04485f2253f5f8c6bc
SHA256aa7d165359e41ac845bf60f3e57b57af29874e225254651a805b99f78ccc5667
SHA512d5920fefb217c951cfc82165d694f5f6dcec7f903e6f5146e4c9e4a64aa8316e50a4c355754bd61037de6dd559c76ad7290953501a763a1d160b4b81686fa02a
-
C:\Users\Admin\AppData\Local\Temp\Roblox\http\576c7360d7dbf5c209ea184dee932ce8Filesize
91B
MD58b87e00e15e8b22c07fe61343b921def
SHA15275488ffd82741832f38ed90f0ba311e06a8c67
SHA256e9bbf61c79723b15b5210f18154f102fc48902e154ef8feea2527b78e5941103
SHA5120aa79e6ac8b69bbfa10dd41ea6200ef2ba9c7354969a74deacbc36e5cdd79093d6f592aecf35280beef8fb51a520ad0f80a44d76e63135c1e2f5fb19bdd4ba23
-
C:\Users\Admin\AppData\Local\Temp\Roblox\http\5965db33c00199c8da043230c1beea49Filesize
91B
MD53ae9eece15951e58cb3c3333675f16bd
SHA1f68f72eb957241ed71bf15acf71d515361c70398
SHA256262a1a8b853e44e5ea0f8a61549527c9d7ad4a61c43fe03c062297251ca0ef2f
SHA512c1c4a46bae66037adce49c680b42c91f8a8f3b91fa21da308db6e0070c605f0b6a072922adb7978c11b83912faa5c82fd134d3a38ad7b34842de4c0514dadb3b
-
C:\Users\Admin\AppData\Local\Temp\Roblox\http\5d34a1f5416fdc978c6e0c7edc7d67a2Filesize
91B
MD5c76ac26f80988d0fcf03874d625b86af
SHA1b04a5e95018f8eca571daa4077e66626b9ba0de6
SHA2563dca66141315cdee30f7604013deab2fcc1dd74af93f9630fb700b7606f531ab
SHA51223ba1357212eb135ad87fcbb81bf73fcf2e189da34f08ca1cccd40d763a856e9ca8ce5514af395caeefca2b0dd3a6fe3b8d43e060c5baf5139fb357fedb90a59
-
C:\Users\Admin\AppData\Local\Temp\Roblox\http\5d90ffffdade11fca3ab6d6173b10742Filesize
91B
MD58eb0fd433af7498b61d3380f812aa9f9
SHA11c2fd03e11050b47c0b53d568292894bfa805438
SHA256a400ccf6fadb706e69adcd72036d390b579925bb0f09bdeed0c278f7db125f66
SHA512caf4f4b6269c6cb72f32b2eba515f83dbfd9c4de48d78c1c149a6b425a4c2ab8a8d5d1e02afd0c2ae7f11bedea1fadb60cd4f96a7deeb119640b48bc9d0dd6dd
-
C:\Users\Admin\AppData\Local\Temp\Roblox\http\62df5184ae1f060c81401754ada047aeFilesize
91B
MD580696c7595540638b24e76d1557af8ba
SHA18d58e475d0a3c629e5e4781eac657faf6d9ca22b
SHA2567bbb75c1d5624f35dbfc6f31ef170d3aeb92d1058ddc0784ad3f3b560412378e
SHA512951013b48cdf1d5d071f161e100359022c300c41d9d32c5f96bea7613d94cc45fa609f7a9187214333611fefd0376bcb401d77ed9cde07ba4a5cb0211ef16d95
-
C:\Users\Admin\AppData\Local\Temp\Roblox\http\663f1f1c886f56627c16a75903f1790dFilesize
91B
MD5f147bc3f9eb47aaa1954ffa1e3f9be2b
SHA1096a93e29d7b4660a78601b9486275cd42e62e1f
SHA256e0d2da55cbc1479b4e76f8c221fcc144c77d0b6799f475c94af394c0a89152f1
SHA5122d40de16f96b665c5be5fdc90cf8a90d7b4d17f63065d18e4889ce50b2b26bbd8f054f992e8d983af48c6d2a8a1a8d1dbdb0bda1a34a030da1d6211353253971
-
C:\Users\Admin\AppData\Local\Temp\Roblox\http\669e0fd9b870ab37f6a09a851bf08cacFilesize
91B
MD500b8fcb142613a6bdccf10798865a1a4
SHA1d090f6b86f41ccc21af6c7cb4ffb67754f929f06
SHA25647d7c33ffc9d7af5b929bc11bea9a237e387999211af09f7bdcf50c2c3a46d7d
SHA512d96ac3dac2dcc26ea1bae920eb042d45603c0795a07514e5122b2baa105c221f6c6eb03b54100e6cbf641689ab16efbe1d674111d41f0be14dbc18d2f16c1ebb
-
C:\Users\Admin\AppData\Local\Temp\Roblox\http\67bda4e27ae4e1833078882dea43b468Filesize
91B
MD52a7fe696e5ddf9d0300cde33ce71ba01
SHA1d8039e7693f8a20bc8ce432b00475f1d2c1414ff
SHA2564bc348b655f8e70815f530f4431adae6e3df3c3816b55dce328e427489b113d1
SHA5127091b56a7e68f3d9234d5c8bd4c74a86b15d14ae8b55a5ccbaec2cbd1d45b7ffefbf67ab3b23d9308ff00f94580d90bff89fc102afd21f1c65d01d2bc3115887
-
C:\Users\Admin\AppData\Local\Temp\Roblox\http\6b5afe9e95404a33914c1f63a97c6597Filesize
91B
MD5f59cbdb40b57b3dd26f090f54da670fc
SHA1c7c2861d028fbbfa4940de89b38d4b66892eef55
SHA2563e58bb7012fc1fe2af9367e3e783ac709c11994b62ad29f17116fa52de3d751e
SHA512193b8cfc48bdec63fa7443906a8a8f82929ee6d693b26473c19ed4467c3527eb19ac1c003eb08a4dcd1d54d4dd30d8025bb124a383f852b25aa84e40fb959a7c
-
C:\Users\Admin\AppData\Local\Temp\Roblox\http\6c223cc2708592ceefaaad9b7f086212Filesize
91B
MD5e821d8cf21054575e38066ac27292a86
SHA1ef47524fb1f4ed7e6c4b07508deeaf4894e3ded0
SHA25616e7402cc9f90651ddddb0fbfe90abaf79df4c6e6b752a1be66a7d589c96d68c
SHA512150d470266f0f0883c4b197a39148042d1695359a8428a9822e3b892ee440b976f66c215b2101d693e614758813f4d72cd629965016a89444b966d9ff378bed8
-
C:\Users\Admin\AppData\Local\Temp\Roblox\http\7008068af5755e8dd4567d7086e77f96Filesize
91B
MD5ce9ff805e9701ca92d22be7b6868f158
SHA194f73f1901a965ef647a7028b6b3027d3a1d3ddf
SHA2568e772c4a5ac43cc9092144977923684ce5734d8bdbf4cdb17077b07b52626f29
SHA5122c09540710a1a170cdbdc6442c0d8eac942ef230d3d5637ca68e1cf0db886de92c1ad1ea5f29444bd29df8841d3b4552dd05ea221dca9784d03c729cccfee8ab
-
C:\Users\Admin\AppData\Local\Temp\Roblox\http\73a672f52659c8af96d223e416bf344fFilesize
91B
MD5e36fda46e52044f12489114db7bb6c0b
SHA1e240935975d1cbf0355de4c65143f6d352e67a4a
SHA256c4b534fc13650831e16502998b70a7aa239ed62305df03bf919581385880361e
SHA5121120a2b62b02ce24b0fd4df9689eb3b0fbd7e87e19489aa7c114c2f649e31004e444f1ebd71db35eb3ae5560d5015626d3c8983769b49eb02ac648fa7b17b932
-
C:\Users\Admin\AppData\Local\Temp\Roblox\http\7410e12781af111687d84a761452861bFilesize
1KB
MD52fd5f5eb57149adadb966ed5b585b8ce
SHA1497a6d5417560e4590a96f897e767eabd1ca34a8
SHA2566ccbcc8512643a3c4e6b626af8ec79f5069fd2767d3341d119d1d0c5c5f97354
SHA51232d35cc14adc3b9ebaee965cc95aabdb2d1c8284f028634cccc104aea25d3235e53e42be5e47c79af9c9d3ee7010fa47b2aecb7f7f363410b606699a6aa95b99
-
C:\Users\Admin\AppData\Local\Temp\Roblox\http\774ad174c53c04e6b1a29c22a5f6e32eFilesize
91B
MD599bec00bfc46f3e950ee281f6c95acbb
SHA138ab6e7d03e5a58a32fa8b93cdfcf4fc1a959e48
SHA256df51d04572d489f40be555b7273f7ed2e772480f2827e3bda6213fa38c909328
SHA51204d346260c3083e318e1b7025e78693f97ab7da9511927efe02e9dad7c96755df7b3dec8bafd175c53514bef532c24846b8e9c429ab0f7942bb9adcadb2c757d
-
C:\Users\Admin\AppData\Local\Temp\Roblox\http\7d584ee3c3f8ddb15d73e85a1d57b509Filesize
91B
MD50a4045e9fb64d2dcbd23c10cdaf7e15a
SHA1691853e92e7e70cb01c3d59d2818fe532cbc7d73
SHA256b2706c409c6df3a52b98bbed202bb48dcb27d671ebfec81d179f0533daa662ab
SHA5125cf6563bdb90e54167c1c598de69051f25b9ae9577ea33e7676e6fc08448b4dd0e87724e2448ae561486429a223ddd1c91121956668a3401569892e9357b2772
-
C:\Users\Admin\AppData\Local\Temp\Roblox\http\7f266dcc2e03dc0423211cf87bc43ed7Filesize
91B
MD56e290823c054cfea6911a028759716ec
SHA1dd2d128bad8de4bcb8df6b7dc6150da3c98b4d16
SHA256378ce3d78d3e53ae9a29ee877d8b3800176fbb1a56540f95be71604c7266728f
SHA5120193d729d03c1d57d0335bd0ec26a51f52573a7919bf51a2914995b1a2c86c249c3b91c85cd44b034b4aa2c0836035eca7567b99400da3d5efb6adb7892cc268
-
C:\Users\Admin\AppData\Local\Temp\Roblox\http\7fbd99f4476023b4df0e60126b4e9df1Filesize
91B
MD5b9853f8a8c0cdb5ad9c6ce6a1780da33
SHA1815a6935dcd5f1b4e56e3ef04e3f3a65b4639abd
SHA2564ad77b08cc88b21d0c98ecbffd2380fa8b8697eb02aa6784bdf98ffa151db68f
SHA512be9cef1a18afc6453f10730a8e6da70243cf8ec781ab8c91ff218c003cae955c9beb6a5b574b72e3e2e10e39aa93fc66a7d87e5914332b3b416558747801cf15
-
C:\Users\Admin\AppData\Local\Temp\Roblox\http\80dd583d3dec79b18bdbb2fd193b8bd5Filesize
1KB
MD52992786ec79821ee805d303ea47fbe76
SHA1f59e8191ffea510fbefd03a839e838a058f68ef6
SHA256c202a8b846ce8023a7f1fec949194ae511a76b0074abbf4c2df24d47e9258bef
SHA5126405beb5adb009a418975d3ebd7cf1b9e585ddaac266e9d02435c7e5ae6b02f39cdae4f8760ecb7e23e05faa2a576de97a3479feef8cd7fcffd9c3db5acf8cb4
-
C:\Users\Admin\AppData\Local\Temp\Roblox\http\83eb563d18696561d5893be1e443a9d5Filesize
91B
MD55f0b56a7d5a77c9922ee6a3c26a74dbb
SHA11ff624b8f6b16f5336b9acba54cfc8d057529f8f
SHA256b37148a6b578086f3cdea98356e7b236e019fc7559b235812d79568fe96dce97
SHA512353436234b2a7b24b95aa19f3396a61feff732d819f840c4c692df2e08a106645a1dc06520ebf1ef80e8b59c09edd5107750a786e7476a68c9917e8bfa1fd9ef
-
C:\Users\Admin\AppData\Local\Temp\Roblox\http\841b57ffe45cd52f2db2218b438c8332Filesize
91B
MD5d7a69b4a4fc3fa59abd4a4adfcefe738
SHA103bac64e40eb7075eab1507f5f07b511e70b1951
SHA2565a25ca65aa81be24443670694c941d37f93948f9ca37a25045cbb09a41c321ba
SHA51285d0c6dd19b3396e9ebd3fc48d81444a2e452d7fe8768e5a08ff2b5cad1e5158b96c083e9eb07b0a11e02168f0e3043ac5b29d582fa80d7a02ec96b414c74e99
-
C:\Users\Admin\AppData\Local\Temp\Roblox\http\84757e79ec2d4ea81334496509b1a323Filesize
91B
MD51c289c14c895dfdf05610074041c670e
SHA175ec8d8c4bf89b0d0ba0c1a3487c11988019e975
SHA2567041f621e57bb76b41d4b329081403cc6bd5a161f8a45ef494f90942762ebbe6
SHA51204c7d00b7225f604b32a9428860bde90a0a432044878c1060b638761ab8aba20dd41b8ff98e38f98687b587818a13a7f95f32da5ca839956ae56da54dfe3b079
-
C:\Users\Admin\AppData\Local\Temp\Roblox\http\860a99b2da5ca572a6e8f80777652698Filesize
91B
MD56536470364be981b2dd53bab60b0f989
SHA150885b9bdd97b05b96446921fe8f11e0a6e8263b
SHA2560dd3bf2b615cb4f20dcf897a20eb12c495e0d51fd7281e58e8ef6f494446ebad
SHA5124ccd7c141c66bb11fa8e520ddb26716227f8ed9004bff15f80a9187127bf3dfa5d1df216daf2011760e8ac3c92a7f19d4b7c07fe53d99bb79f3d1722fd11e287
-
C:\Users\Admin\AppData\Local\Temp\Roblox\http\8aafcb2d09f23d122654917c160af836Filesize
1KB
MD543980adf2723f00c7e4e2c5c7b516e31
SHA18a3a561b6d11c7c2680c6b59f1d60bf2a0a56024
SHA2564bcb1742a9210b1f3eddd8d14519b1c413456947f3f0be061529823a85cbeb3f
SHA51271524da4c8f5311f26810a076801fd62655ef007b5836f4b11015432d820f2f0d1fa360dc36cb6fa7ce978df2c072186a00e835bcdedf52f7b2c5edb7273a699
-
C:\Users\Admin\AppData\Local\Temp\Roblox\http\8b443aeae411856e991a0da0d0544455Filesize
91B
MD5c717f32b9cf6bef326841b8802a8c908
SHA1d89e7b9ed8b535d502475dc036b7f309d6eeb8e9
SHA256496302b424d8d3f73e43e79eb6aaa14cf9dd6895b3ee27055f4cbc3f8cd88b3a
SHA51255b33aca063d7f08fc0da50501c2580934be5f2eed86238f0f667c30cf0cb798ac289059f0bab1670ddfba76a2c0618c501e3dec25fdfb0732f5fcfa93085005
-
C:\Users\Admin\AppData\Local\Temp\Roblox\http\8e15f36b2180497bcb0891bdfa9def53Filesize
91B
MD5934a11b8eaef18e6790e660f167b251b
SHA11195e4573af3ac1c966de8210b162d76f57df7e4
SHA2568a8ffcca05368fdf6f8941aa5ebf50c565c4946e660dac731827703d5d36665a
SHA5127b9ec190b7cbdaa40921a775beb6cc245f9e92b12785d0c1a9fc6285a996a809a2c80546a099fbdf5e2628404e4cedc2ab652f3e02c27012fd2fb3ea6d1ddaa1
-
C:\Users\Admin\AppData\Local\Temp\Roblox\http\8f82ee24e69866dd3748305b9db72c06Filesize
91B
MD55d98e2e6c684700e5072e39285c6d339
SHA14e6ac20c340ec562d48571d916381b932a73a7ae
SHA25654b59bd6491d18e725b30d471397b7ff53caecb7fba5a5015e47b98e26806f56
SHA512dc8e1fc18485a58312d953004b3736ca086fe3cd2b2038573789cfd52c7ce312c7838945f2b77617434e507121c8093af7b7a738ccf97f27548673f287aca1e4
-
C:\Users\Admin\AppData\Local\Temp\Roblox\http\912f5fc3f8ee84a59c48c411e53edbb1Filesize
91B
MD5c77201c032a8d835884aaef460a86426
SHA165082a70376eceba181d6a51f0398813e9e3c8dd
SHA2566d97a18d7dd1a3971760a44b5c85aef291e6338c1e926ebabca6f5fe31c675d9
SHA512c66c74ed3df2b1f39f047cb8ae6ef52275b0a3ba2e631ee78ab5af54122fd8a2fcd9dbb9a4d8a70585f50edfd16ab95e4200ec2e3599c28adb8289a8e61afa21
-
C:\Users\Admin\AppData\Local\Temp\Roblox\http\95d98e1cfee595f720d12856399cbd72Filesize
91B
MD539be6457e3ff988375205765c4660895
SHA18e946b84ba320df9c28aaa6e759e24719ec38aba
SHA2561194e8aa1e2ff45887bca03f3ddee55de61436c660e162ae343ee64e7d146da1
SHA51280f75601d5887291d0f2884945dd2ca197090431fb30dab6e6ee9ef601076950922a75f23a577dc58824a8ea7f57c48c1a742cdbc13a28215bead6b2b0b47033
-
C:\Users\Admin\AppData\Local\Temp\Roblox\http\9e7078aa1947f0c085de53d2853aa611Filesize
91B
MD539eea9cbfdf80ac363c802603d86b598
SHA116fd664538af5ad6bebf601a21145ab49907b862
SHA256fee6a63f56f8e5e16d09c669a95416ada9a313e9042cb117f55c92136a8cc4ec
SHA512af35670d2c6741221f48ef369252c10f0de7530cf80ee15a5a4f4c1bec5fe4820cf008483aeef7e17f60546f5c525d811a883d170967cebf90a3b202a1a651a2
-
C:\Users\Admin\AppData\Local\Temp\Roblox\http\RBX3C7EB56EC269469C94C25E7C63D8FCC4Filesize
91B
MD546fe622ae1ed5e04c8e870d2955b0b5b
SHA1b53f9d01b0b5eed94f7e1efa209fc6fbc95e9006
SHA2563f64186c98498258f668809710386563ba357ebe3f72afe8da26681539ba6254
SHA512bc03f8d6cbd1b1dc2a5d0c444d840dfafe51af93fc09b8393f921d5c1e26b58145280d4d51086c3ab9c4938191221c08f3636ad9f317ba718a45fe265b17f723
-
C:\Users\Admin\AppData\Local\Temp\Roblox\http\RBX571D459701664245976F17A99991FABCFilesize
91B
MD55ce3f00b7508a627fb35ed3412c85ccd
SHA14916037d0f112916fbdbb12da26b82fdd2911c75
SHA25684f0ddbc884f04885fe88a888401bf445672b178f862f041c2e98a8f3ebd0a24
SHA5123024e07b7b4b5b759402fc7c11b3354bd2e238932440525536dfebd2de140d9cbdf35131055690a713bccfabc834c1a36b7bf8dcc8ec9457753c7228f14e7b88
-
C:\Users\Admin\AppData\Local\Temp\Roblox\http\RBX5C8F2C399BF943F5BAEB302A2B92814DFilesize
91B
MD50a120dde0a292a6517aca3dcda39061c
SHA1d697018ea499c6388e403d351b66ad9110d1f982
SHA256330627f47f349e2cf48817aa076a0f65249ee28a6d32cf2efa8eb6acb75b0798
SHA5124d4162dd79fc0beb37c12a74c31ad07cb4220ad630225dfcd9fe8eae8a3ddee5b48e5fa7992ff1cc2bbb15b1d9c86f2d7d9bf545edab8affba8bfc9e097f740e
-
C:\Users\Admin\AppData\Local\Temp\Roblox\http\RBX6CDC39D9B0BD44CB931CCD0C41D6C689Filesize
91B
MD59de52d85b06da1acd48afa0d6d1d19aa
SHA16683b9c8eabeb1f315873fa6bcdfaaafa9353ad6
SHA2568b231ef4bd7d12979f583d8c1b89c66ae7e379d6557a1bb6bfeffcafc15f1a2b
SHA512f3c1210177102ad92dc8661720f12f4c6aed3a86991b59c823471464feb2eed41cc1512acc864cdace009852380701c20a694fdc0311d5a023c2b9298979c8fd
-
C:\Users\Admin\AppData\Local\Temp\Roblox\http\RBX7A2520B645BE49309EC8EB994E59EA82Filesize
91B
MD566f26a40edbb6431511c2959ac1df74e
SHA184ff4630b9b72a2f32a78a6b605a681ff2f98aa5
SHA2568781ee9a2bf0014d0fb15537b268312b4bb88dcdfd8206af7cb2b976473b68b7
SHA5122b9ad264ce308b60e7aa70ab116ac20d813792c7ff4c8528fbfdffd9c91b948d30677334d99d6ba667617a5a1d9c3a8b8797cc7a953b189b7adf020ca609dd44
-
C:\Users\Admin\AppData\Local\Temp\Roblox\http\RBXCD99275CE78E4A038D8AC972002BF471Filesize
91B
MD5b04c0dc18c7d55cd67b193981117e8e5
SHA1de1b8da5292626c82c5369243ab17e1fe87819e8
SHA2560e9e0d48cb004bf17d389dc2d43451e7c45546210703bf2c36048568477f538a
SHA512e6a2aea601a6cc021d9537fd56eaf034dbc5932f9dfeca57fa69921733af8d1c22fa4997a596f2895ca60a9a064ace6a135a8c5893381595521da9cdcfcfbef4
-
C:\Users\Admin\AppData\Local\Temp\Roblox\http\RBXFA164D1CE48E4E75B8E5A27FEAC0AC55Filesize
32KB
MD55b1f51fa0ad638b4c572d1dccb5e311a
SHA14196ecc0b91d63dfe14d2c2fa3f455f12d8ee59a
SHA256045b21ba151367d910e30703065ba1e3cc3e570cb612282f0b713fb2cf9ac478
SHA512298fd197a325f2e2279787b762c92b886a84344a415dc8a5bdfeb73c4d2140bcb5f0a18324def821338e40568ee0f3ae74a9623f494c4b4cf23862f4b0aa30a2
-
C:\Users\Admin\AppData\Local\Temp\Roblox\http\a1aac6bdbb2642f3f23fbed64d042c3fFilesize
91B
MD52c65a49f36fbe81aed88d7626a0112e3
SHA1832fc429cd021f288f5ef9531e7dad6c9c6507fc
SHA256eb8f138e67962a5c7db64722b78454da2e3c3d656ec8d72c9bec566f10a942de
SHA5124fe7c7a7e439f6b43bc13af9291994ff913fa65ab1d77f162c97b18ae505b1c46ffb2c9236b7c9010580b095526a58204bf182aa5d476e3d0a006b2ca450d181
-
C:\Users\Admin\AppData\Local\Temp\Roblox\http\a2d7d3c48874e5834b47798650015157Filesize
1KB
MD5bb32cd8a831b2b2ed3c3295916ec32e8
SHA1b31abe50d4e30d004d8be9f20567c230fffb01ce
SHA256d3d8e33db64172edbff9d2a1fc395d7f3006bb561684f85f388359f747b5fbcb
SHA512a13c203afbe9d16a379341eaf1ceb6cdc1c75ff83111ce73c30e036712b6f293fc34b9d10c8b9bb7ca170b4c416aa56274093fa5c0a229697711550a92ffbd1b
-
C:\Users\Admin\AppData\Local\Temp\Roblox\http\a42793ea3d479066a9a1bc384ea3a217Filesize
91B
MD5619230a9480f21c1d6a808235cdc287a
SHA1ab15094fafb32c9aa51a2df3e54e260e14ee3300
SHA2565aac9c5e8a564712d0c05dcc76a3c21eb2e2d29f447bf5744be9aba63e65c47a
SHA512ee5ed8f899615f469c93883e2072c94ce217ca5a591605d1aca249183d8cdf9347089f912a5ee2d2cf616fa94aff135ba2ea42ff3f0a5849bc27b83c8fe304e2
-
C:\Users\Admin\AppData\Local\Temp\Roblox\http\ab59734213814a49d3fbb72ecf1fb053Filesize
1KB
MD59f36e95a4b731e5a96ef617f26b138af
SHA1e16f131d018eb0363caff685f2b0f966860ed237
SHA2567e2ac22b82ae1ea07b1a701048c82f3dea97e3598c1acb34ad0e4d1dd72480ed
SHA512afb0dff6f3db155ecfd067b6e0f00598d420215c03785449a9e4d554e6bdad62c2a54efd079947d40557401fb76cdd7ad3079b06aba17b58d354e61002daf20f
-
C:\Users\Admin\AppData\Local\Temp\Roblox\http\ac9a0420d23fcc9947b8dd0c27f230f5Filesize
91B
MD5cf03104fcdd3395ce14edafd82e4282e
SHA10e52d8c790a39d199cd8b9e8cfb015298638d20b
SHA25674924cc318663813841ac0f630625fb073dda502aabb828b271a1a1790b3efce
SHA51273d937b526d56daea286f4673628fc60451879ae3b8104e558ecb7bd2b5d3a481555a40f50b57f9205fd0065eae0e1bfdbb8aa634248c02c7007890f863b4124
-
C:\Users\Admin\AppData\Local\Temp\Roblox\http\b0cd0725ce628c802aea646becfd46a5Filesize
91B
MD5b7c03229a5a8d6586e4532281bf1bcf6
SHA1e2cf4dcb1a5ed9ec90882b05fd92a1cb2d9b7031
SHA2562f68626defe72fe2f0f653e4f329dc40a4da28ec0b6805b7e372df74503490e4
SHA5124b33587bd1e348c0c3c90ab22556c1a1634c9c16a7986d5ca92cf409a6bc9a2d4ef6ff29f1c56fbaeea7ea42b9e6bcac980f3a13869c7321dfa94b3d4c68498b
-
C:\Users\Admin\AppData\Local\Temp\Roblox\http\b2f20103cac5461a1d3547c6e14d7587Filesize
91B
MD51b9490b907af8da1fcdcca50c8f65b90
SHA1cc193d424cf6411e6354fa24ab94a1edfd252cf4
SHA2567332f2665454eadc72aa894f2dbbe8369ed53b1462c8951d2c0f3e1f09616397
SHA512bbc0bd3e165b69997bce74bf28349edd89dc8e7509457c8a40df3de21745f3e63d0026101b4a31bcdebe0411a620168b49ec0f0431b7ed2315f92e346cf458b9
-
C:\Users\Admin\AppData\Local\Temp\Roblox\http\b36482b1edea43f2633ea464f06858abFilesize
91B
MD5d6f5e76b38b611737bea4df7021a180a
SHA1180495d2c8f89bc65cea42c5cbf343e0f3e0db47
SHA256cb53664e949e16db8ddb57ebb8146b13b785a6f57b9feaf12109670963efea8b
SHA512bda67757d47ae3e15b5278a8fdca0a73c1aaee595a27e664a936085ff742dca717b3a1981340589d0a270ea93cf3ccf05f61872fe006c33bd52dad8d61301789
-
C:\Users\Admin\AppData\Local\Temp\Roblox\http\bbd32ecc5c32b11bcd2509d541b5579dFilesize
91B
MD5fcf7972a3c5bd7a9a8239778acbeef31
SHA1ee81b0e3c6d7d6599776bc1d18c207d5264299c2
SHA2566854ba55b5f4061656e4660ceb37ef25a108dff6f96167c5b2a67e291ee9f56c
SHA51248eea8ec572bd641c02e860baa0a11c47f65f1f450ca6be43f3502dc8294d9ac6d495ba3268990a867a271a6e2753aa2d2b80bd84bdf77d99cd1c6446a4e0209
-
C:\Users\Admin\AppData\Local\Temp\Roblox\http\bf47ffa71d26056246d13827b5e2eddbFilesize
91B
MD557777c24cf1de19008f656674cb98700
SHA17df790f620333e3db934c1a64a719708a477d16a
SHA25610cd6ac4dc4ca7cf0389fa171617a305384f5ab36d59354fdbce076d959482f3
SHA512d97f17f7eb8ef64be6a7b0afd37f826a720cd02e400b0df1bd800bcc103252c5fd7b7dce8b791cbc4bbdb81dacd9a30a3e34f936ce1e0a0587b984e5dea15921
-
C:\Users\Admin\AppData\Local\Temp\Roblox\http\bfd02d1d7e7458150f21c7a398b7b975Filesize
91B
MD524a8d4fa2a803b2ecda7d89d734e74cc
SHA1e015a6a5817db75528f555cda444de712db01732
SHA25672e7afaf768fdc024a869c66b8dd87b8106ef7b9af9c9d2557b0a734ddd73d09
SHA5129c0775d5f31e259af99bea00093356aab02b89feb0e5a72fa2fa1e604708352c4a629b321c53effa107f9f9b91d64e67cea93af1206e374a0d7128c0b64cf3f1
-
C:\Users\Admin\AppData\Local\Temp\Roblox\http\c305eab53f6b86a5e13ba9708b2326cdFilesize
1KB
MD576a1079277b64e6eeb2a9ca1e4303fac
SHA163e5c16067b636f047b862d343c2bfeed8c01c46
SHA25683028f0c74cd93326c87ed86020006a3560d29ef5159d65f0fd5721ccc9a936e
SHA512bcf479a4f634578c46898eda554309ed25a941a2ead01263791f08877e4f39d07ab72da817fcc629369b041b9c30018fda9aaf6f25027fc17284cadb176f4830
-
C:\Users\Admin\AppData\Local\Temp\Roblox\http\c4c85bbd2f495af1daa7a659ee154ab1Filesize
91B
MD5836d1e8578c347f3da2dd85d5b1b172e
SHA1646350f076ee7e12e7c9c87df37a9f981311ac47
SHA2562fd2ec9b6115dedaa5ccf912d614257bb19110bfbfa802b69f8b4fa899b59618
SHA512c0d48c087ac24a3ae2822243cb38ea7e256b04223473febcbd8398540f2ac4c2dc10174451c449447bdf93683437b94d01a8384b90b6349af363142215920db5
-
C:\Users\Admin\AppData\Local\Temp\Roblox\http\ca6571aa4c67841495ef5480a6a28c0fFilesize
91B
MD5aadbc876fdbaed5d67e8d1cc8d1169f5
SHA1cd93854abde26abcd37c665dd791fce1110e32c5
SHA256b487bbbc161db2d78018cc2a85ab8805370c422fc53ba6e49319c060d5bc755c
SHA51294fcd64fdfe35c4d8861dcff8c886f1311eac3378326af2b33e172187dd3200aafa663a353870bac034792d69fbdbcfd3256db20250824849748b173a9446de3
-
C:\Users\Admin\AppData\Local\Temp\Roblox\http\ceea000e430b7c9714bd62a61ef5eb0dFilesize
91B
MD5e6bf3b994b7bd85aa47c17406d367d2b
SHA1b18be2803acd9576aaa72bb19116b09680f0cbd0
SHA25692638ea5cef2b20242923fd21757df86c8c434ff12243d480250364b8480f2fa
SHA5123e207bfe1b30c981fb533971769a4051c0c87ffbfcabc012606ec939c5b66f2bf59cefeb85c2b903856d6396584b2c96472965c11d90d6a1ac9f59b29cf3d664
-
C:\Users\Admin\AppData\Local\Temp\Roblox\http\d48b6de78e8f1a38ed5cb8e46acfd39cFilesize
91B
MD538155d74b5f3f0e7149ca6200b579e4a
SHA1471730074b4aac6ec2c985c39d11dd64cf11ae0e
SHA2561f974334de4923ac1f59bda69477337c7194bf3152590721555fe869fc204f77
SHA5127b52dbdbc3442cc71d9ac9777bc9e9f9e52738a515054097f4607f7cb8378fdd8d074cb182f097a1cf609ae67c11b37604efb54ade042ba7e8034c0040bcfccc
-
C:\Users\Admin\AppData\Local\Temp\Roblox\http\d9345821115980d266f63d57b0d4e14eFilesize
91B
MD5e1f1f6a6e94b7fe8ecf85f08fc2ee2f9
SHA119390d254f426d7a6252d87dd328e671fab553d0
SHA256a372be825aa4448fd03e28f9bd6bcb23f29aab6c98e9976d179c5a4568e66907
SHA512d609d1e979f4211462bd932cc199c7c8d6e1a78c44df95b053344bf1fe3f54256782e33a59cea00118466926fede017b7df24460add0609ed291347bbd0d998d
-
C:\Users\Admin\AppData\Local\Temp\Roblox\http\da5cb9f0b64cfdc24bb34060a3921d42Filesize
91B
MD52b2b25e4b8f29419d5a9d08ce87e01d4
SHA155c70a07ebaf2d1f5e097d00e738e0d0fd5db596
SHA256a6da4a18c91c98320eb3c2b18203969e4b05811133e382f6cae148f2789f2283
SHA512c29f9869217b0cab3dc710e43e6e5d1040ed0740c24301126d869da4500486cd979431f44f19028f32a67a4a5ac6b5ae9bd66542db417a1409e5e6dfe5d52dac
-
C:\Users\Admin\AppData\Local\Temp\Roblox\http\dbc2db25561420f4bafa8206e030d6d7Filesize
91B
MD57d1d48c415f200197c4a2b23ac4f0230
SHA17ca65155ac5e16cf0461f76352a57a6591b07269
SHA256bbd38e0698ae5df028831900812bab9e6fc2e27f5f567a84d9ae5893961eff6f
SHA512604c0aee1c7f24de198970a82c1f7424efa83893ce55bfbe3f48e69539d67d34863fad980a47414d8c69360a214366742c0680686871829ae8a66512caac4adf
-
C:\Users\Admin\AppData\Local\Temp\Roblox\http\e096625548071c24235e25e9f1796170Filesize
1KB
MD59629f94d44b19d4ebea99e11e5aa43fc
SHA18d2a8fb03dcb963f30b222ac892b727ebb392420
SHA2567b8c88be999a4b79eabbae7396cd2eb4497057a9b7e23846b3eb9a989ec4eb68
SHA512ca9d9d38a27ae524b0b56fee776d1f856fb51e5ddb1f3e6fd4dd06bb2a211fe6f6ce2e5751a434c18c9ae97bf994c122b0084e8044f4adb5fc20e4902bb0bc14
-
C:\Users\Admin\AppData\Local\Temp\Roblox\http\e1e171eb9900986c2cc70f36f61624d1Filesize
91B
MD58dbf22aeaa0b91ad469a3cce690fbe50
SHA1502b8e489d1efed1531fc35d63daa17a17b3e7cf
SHA256620f603279f1faa7aa897a81c5813536c8ec3b5f2a0e30f83a12a5bd2b6569d8
SHA512394d3dec15b3321b0f1cc5272aa45aedde062e497b2f5104bf2fb52f5523935bf25911d2a5cf490c8057f9c2368c2d5ae843f360dfa6622aac0b7b26542b082e
-
C:\Users\Admin\AppData\Local\Temp\Roblox\http\e3a604ed4f41d667e200db1f74fdf634Filesize
91B
MD5235d9aa5f3a32c13ee3da9028266399a
SHA12ff6fbec4acdc47c7829237ca5bb2f0f0f70a927
SHA256c81fe2b87d4abaae6c65e53b33ee11e360214e29a3272f40670c637ba2ea2fbd
SHA51229a1f09adc9c5807f561b1c056fceacfb4d7f140a4bb7464c93ec16ebd71eb7e43db64a17b319f5a31bcc4e8f6a83fbf69d683377d02d56616140048678e6eb9
-
C:\Users\Admin\AppData\Local\Temp\Roblox\http\e508bcc64367cf9b98fe28c4255655a9Filesize
91B
MD582b21f9bd843529c51bc0e290ca119e5
SHA1697c8e0ec246effbf2d047870b81f701756b591f
SHA256a7f86e25dfed056d6c9833e367cb58dec30c5707046b9941edb54726c78620d6
SHA5128e1ecbea17605f90660dff9c3918bf0ca7a4f661611ca0796bb875098f15d1c1e3dc595a0337162c26ff78949aa66c27f883a71c5c8077f9c29faca1c92c4889
-
C:\Users\Admin\AppData\Local\Temp\Roblox\http\e60894907471600db01872a1741a0bddFilesize
91B
MD55bc34a1c60d2a4bbe7441e8307189156
SHA1136eea02e3c374521146b9f530ad9c1151e20a37
SHA256563d0ba1f9dde1fa635ee6f29925712b5a162396d7681d8b4dae1fffabcf5626
SHA5125c542b3aa5f8036901247fee55c187958546966a9dc6b34c291af2d63fe0c3c8f92f3d87466e02e3b124f4972b1558a743e927520dc9c3fc5256ee8d066aafe6
-
C:\Users\Admin\AppData\Local\Temp\Roblox\http\e72487afb7f8c1f1682a13bfc8a601cdFilesize
91B
MD58785f67892e4e2eae44d1d2ea3f941b7
SHA10413e7f583d0fa791cb977fb70a62c31a172b272
SHA256f38a43d9a3f3ddaedcbca6c28d0a87ad11c60cb991760b0e393c3e81ac29c6b9
SHA5120b09ef058384651fdb45b272d5be1d3c0865bd99765a528df9c0a3a31b069102115962d74c139ad3fd18d621e8c9be027eaa60d7bf6f2ce4bf0ec7c3e6fe8614
-
C:\Users\Admin\AppData\Local\Temp\Roblox\http\e7565a75422dda466d956d38a09bfedbFilesize
91B
MD518a7d4d0959cd6957794a0d20427ffd7
SHA145d7ab89c988a370e4b7cb2044e31878b614af8d
SHA256fe237788222e9504c2fe7f118d5330a196deaaf1abff5e435a9a89f2cd54494e
SHA5127845ebc016329449c2415a006a1c8ad59092e68edd36c8f8977a580969f68ccd2c95aba2836fd3d69455fac554d028a3ba487861e2604ec95abb9b11de79198a
-
C:\Users\Admin\AppData\Local\Temp\Roblox\http\e81489ca248da128fe61473200c5d020Filesize
91B
MD5520ab766bca67603b739d14545224a36
SHA1f4034ed446290fc46ec6c34c2477b55d6a07476e
SHA256c7a8d3923046b6f77cedd9fe94b6dddb725568999a48265e7457c67ede70df5a
SHA512a13593c5e7f348838561d4afbd8cbb15fb413af7db59f462b0fb87727dca3393b8d1a470b18cfbae8161755f5558b84a23f7d814578882fb1c0fb51a11d0f2b1
-
C:\Users\Admin\AppData\Local\Temp\Roblox\http\e8cbea1ab2f5d389884bbab5607ed962Filesize
91B
MD586c7294c6bf03d66351f033ba51216e0
SHA1afdb05fab06a8f68c8ca48c2b967ca61ac820f2c
SHA256784181a8bed7e8711cc13dfc8d88309b90892ddeb0aa1b0bf7cd1234e1dc81e2
SHA5120731a744364cca2cda1191f65eadb63ee94d6e8832c4fbe97af6467d1d41ebf8d00cac0e968e0bd0e7822ff98e5a3a97f7369537ac26598ec933a62bcc2b85bc
-
C:\Users\Admin\AppData\Local\Temp\Roblox\http\ea0e84a76cae851893a7db152d45000eFilesize
91B
MD56efa611052863602893216dc758a3d31
SHA1cce490fbf96b26eaa505c5573c399af4d2a56181
SHA25649441ae297330797e40fc4a16ba63bfcc1b0a53349e0916a8309d451ed3f4f20
SHA512c5f05c917a2c2e591bb9dcdece7b451422c4d0059cfad131a762ba9552b34c6c8c49e12452c975daee75214a804834c57aefe58cd01cafc7a9114688d7be86c4
-
C:\Users\Admin\AppData\Local\Temp\Roblox\http\ea7443769825918ea39ca52c9e64c307Filesize
91B
MD585236de2a6128abc32b624e4f98c9255
SHA174163f6bc3f27d09b6740e7de575c9c0be7cf661
SHA256862f9770187f55f6616194fbbaa9794cc551e3231bf12f11c85c92614dd36c36
SHA512e3e3ea31134896829f16853c546bde201a76bb64ac8a0697db7f32c8e37fdaa67b8c8ee6c1fa919800f21e837d42756739f373cfb09e1b1efad56e4f9e942c8b
-
C:\Users\Admin\AppData\Local\Temp\Roblox\http\eed6be1c7bd672dc6e1b5a2a2bc3caa2Filesize
91B
MD5f85b3ee692d3401e55af9f032bdd274e
SHA13ef101d73502aceafd770eb5b1411afa7ee24f19
SHA256e61591a73b855562469788d5bfd3f604f93f8b5dcd2f945788c09e591e682dd7
SHA512e91ba6d5bd40f2e4ec03aebf54341a35d165b477c8b920d763cadfc34ae59043a73b9b612ff9bc899e063dc5d3fa67f7553d6cd47330b566236eb82652c8edf1
-
C:\Users\Admin\AppData\Local\Temp\Roblox\http\efa2380b1711d88c6882b8ba1f60fe27Filesize
91B
MD5a806748d5fedced3028c99539b69eb1d
SHA104433737132aebba25d535cad1837dc7476311c7
SHA2564a77cf3c22a1466d7e68a9166b6ba818e1fbed0fe0faf3fdb8e72a74e1292905
SHA512afbbd41c5b2cf9155009329d9d870020dad13c0dd413f2bd690ea0799d6449e6e7a01d523006a017ba2cfc77be3a9af0cadfb7f6dcb12be15a69974e4e14e39b
-
C:\Users\Admin\AppData\Local\Temp\Roblox\http\f60586eba36ac650c20e39bebfff5ea0Filesize
1KB
MD58d23339bc53966890ec191c3207842f7
SHA19442189d1f5a3975a02648c6032444575969b3cb
SHA25695e40219337e55828859eb0559fdcacc64b9aaf8ec1c99f3029b275ae8d90b7b
SHA512b951b0da56381ff11ba4e5a210235873f2371d976d0c442d3123c285248691bdb0d1f490f0d7c60487a9cf7c1b70de8ce06add58c6778a66befa3732e672f6f7
-
C:\Users\Admin\AppData\Local\Temp\Roblox\http\fbfba0470cb9c70a758bb370098c2d2fFilesize
91B
MD58e0c70d5e0a87e4061d5845179976bac
SHA1629afde7c74091ef4d90776dc283e73773ac6fa5
SHA256af8fa15ac2ccfec6cf70c80ef88483bd10bf8dcc76b49112c09a413c41c88935
SHA512fbe1cb89e687cd273f887cedd6ebb64bfb608cc281181eb58a9b9f6afba110e02b9aa55ef8200a745445c152bcdeee7258fe5a4d5e90a715190312e2cea315a7
-
C:\Users\Admin\AppData\Local\Temp\Roblox\http\fdf9a88ed413e6596260c5df960f9300Filesize
91B
MD5eadfe17cfdd1f100dfd84ea5bcda046d
SHA1996a35b9f12142f70841ebd10c85092ffd449083
SHA256d52f7030f72ccfc37f22bdd662ee5c28592a6a2f2e0ec31ae68dfa06989dfe22
SHA51263b04274bfdb93511cf07ec2aececc38963e382ddb16e2e2055beef7de8c27ae71be1f7ac4f35235cbc8858f855c96a5027cf3b0026edaab7928feca6f6f312c
-
C:\Users\Admin\AppData\Local\Temp\{49BFE23D-33E3-491E-86DD-F403BD11ED72}-MicrosoftEdgeUpdateSetup_X86_1.3.185.29.exeFilesize
1.6MB
MD5b18c705b3c68cc49d9bf3649abc75c24
SHA16dc8963dea0f3185368790dee2a346301b4fa24c
SHA256c2ca3135f3cafd79bf90d4cb3118943ca17f40e0d651d1fc32b1b3d22d1412aa
SHA5127ac302c1e85c652bd897ce1af812950cd23a53c041af82fdcecb2314bbd1667bf2fc672dea40c21858e64befc9bf60190a4428f0b41c30317bb0e5ec7c00f71b
-
C:\Users\Admin\AppData\Local\Temp\{C2E38D98-EC35-4F3B-A81B-688FF2FA3A3D}-BGAUpdate.exeFilesize
17.2MB
MD53f208f4e0dacb8661d7659d2a030f36e
SHA107fe69fd12637b63f6ae44e60fdf80e5e3e933ff
SHA256d3c12e642d4b032e2592c2ba6e0ed703a7e43fb424b7c3ab5b2e51b53d1d433b
SHA5126c8fce43d04dd7e7f5c8bf275ba01e24a76531e89cc02f4b2f23ab2086f7cf70f485c4240c5ea41bf61cb7ceee471df7e7bdc1b17dfdd54c22e4b02ff4e14740
-
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dicFilesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
C:\Users\Admin\Videos\Captures\desktop.iniFilesize
190B
MD5b0d27eaec71f1cd73b015f5ceeb15f9d
SHA162264f8b5c2f5034a1e4143df6e8c787165fbc2f
SHA25686d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
SHA5127b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c
-
memory/656-6281-0x000001943A750000-0x000001943A75A000-memory.dmpFilesize
40KB
-
memory/656-6486-0x00007FF9E5B00000-0x00007FF9E65C1000-memory.dmpFilesize
10.8MB
-
memory/656-6283-0x00007FF9E5B00000-0x00007FF9E65C1000-memory.dmpFilesize
10.8MB
-
memory/656-6290-0x0000019454C00000-0x0000019454E49000-memory.dmpFilesize
2.3MB
-
memory/656-6279-0x000001943A2A0000-0x000001943A2AE000-memory.dmpFilesize
56KB
-
memory/656-6282-0x000001943A780000-0x000001943A788000-memory.dmpFilesize
32KB
-
memory/1196-1120-0x0000022FA9F40000-0x0000022FA9FDE000-memory.dmpFilesize
632KB
-
memory/4984-1404-0x00000149C4810000-0x00000149C48AE000-memory.dmpFilesize
632KB
-
memory/4984-1296-0x00000149C4810000-0x00000149C48AE000-memory.dmpFilesize
632KB
-
memory/5212-1019-0x00007FFA0DFF0000-0x00007FFA0DFF1000-memory.dmpFilesize
4KB
-
memory/5212-1012-0x00007FFA0C600000-0x00007FFA0C601000-memory.dmpFilesize
4KB
-
memory/5500-1092-0x000001CFC0F40000-0x000001CFC0FDE000-memory.dmpFilesize
632KB
-
memory/5500-1018-0x00007FFA0DEC0000-0x00007FFA0DEC1000-memory.dmpFilesize
4KB
-
memory/5848-1392-0x0000028164610000-0x00000281646AE000-memory.dmpFilesize
632KB
-
memory/5848-1283-0x0000028164610000-0x00000281646AE000-memory.dmpFilesize
632KB
-
memory/5848-1592-0x0000028164610000-0x00000281646AE000-memory.dmpFilesize
632KB
-
memory/5848-1000-0x00007FFA0DEC0000-0x00007FFA0DEC1000-memory.dmpFilesize
4KB
-
memory/6020-1616-0x000001D5CDE30000-0x000001D5CDE31000-memory.dmpFilesize
4KB
-
memory/6020-1618-0x000001D5CDE30000-0x000001D5CDE31000-memory.dmpFilesize
4KB
-
memory/6020-1633-0x000001D5CDE40000-0x000001D5CDE41000-memory.dmpFilesize
4KB
-
memory/6020-1601-0x000001D5BC770000-0x000001D5BC970000-memory.dmpFilesize
2.0MB
-
memory/6020-1632-0x000001D5CDE40000-0x000001D5CDE41000-memory.dmpFilesize
4KB
-
memory/6020-1630-0x000001D5CDE40000-0x000001D5CDE41000-memory.dmpFilesize
4KB
-
memory/6020-1635-0x000001D5CDE50000-0x000001D5CDE51000-memory.dmpFilesize
4KB
-
memory/6020-1636-0x000001D5CDE50000-0x000001D5CDE51000-memory.dmpFilesize
4KB
-
memory/6020-1298-0x000001D5B53A0000-0x000001D5B53B0000-memory.dmpFilesize
64KB
-
memory/6020-1629-0x000001D5CDE40000-0x000001D5CDE41000-memory.dmpFilesize
4KB
-
memory/6020-1637-0x000001D5CDE50000-0x000001D5CDE51000-memory.dmpFilesize
4KB
-
memory/6020-1638-0x000001D5CDE50000-0x000001D5CDE51000-memory.dmpFilesize
4KB
-
memory/6020-1628-0x000001D5CDE40000-0x000001D5CDE41000-memory.dmpFilesize
4KB
-
memory/6020-1627-0x000001D5CDE40000-0x000001D5CDE41000-memory.dmpFilesize
4KB
-
memory/6020-1625-0x000001D5CDE40000-0x000001D5CDE41000-memory.dmpFilesize
4KB
-
memory/6020-1626-0x000001D5CDE40000-0x000001D5CDE41000-memory.dmpFilesize
4KB
-
memory/6020-1623-0x000001D5CDE40000-0x000001D5CDE41000-memory.dmpFilesize
4KB
-
memory/6020-1624-0x000001D5CDE40000-0x000001D5CDE41000-memory.dmpFilesize
4KB
-
memory/6020-1622-0x000001D5CDE40000-0x000001D5CDE41000-memory.dmpFilesize
4KB
-
memory/6020-1620-0x000001D5CDE30000-0x000001D5CDE31000-memory.dmpFilesize
4KB
-
memory/6020-1619-0x000001D5CDE30000-0x000001D5CDE31000-memory.dmpFilesize
4KB
-
memory/6020-1631-0x000001D5CDE40000-0x000001D5CDE41000-memory.dmpFilesize
4KB
-
memory/6020-1617-0x000001D5CDE30000-0x000001D5CDE31000-memory.dmpFilesize
4KB
-
memory/6020-1639-0x000001D5CDE40000-0x000001D5CDE41000-memory.dmpFilesize
4KB
-
memory/6020-1640-0x000001D5CDE50000-0x000001D5CDE51000-memory.dmpFilesize
4KB
-
memory/6020-1641-0x000001D5CDE50000-0x000001D5CDE51000-memory.dmpFilesize
4KB
-
memory/6020-1614-0x000001D5CDE30000-0x000001D5CDE31000-memory.dmpFilesize
4KB
-
memory/6020-1615-0x000001D5CDE30000-0x000001D5CDE31000-memory.dmpFilesize
4KB
-
memory/6020-1613-0x000001D5BC9C0000-0x000001D5BC9C1000-memory.dmpFilesize
4KB
-
memory/6020-1612-0x000001D5CDE30000-0x000001D5CDE31000-memory.dmpFilesize
4KB
-
memory/6020-1610-0x000001D5BC9C0000-0x000001D5BC9C1000-memory.dmpFilesize
4KB
-
memory/6020-1609-0x000001D5BC9C0000-0x000001D5BC9C1000-memory.dmpFilesize
4KB
-
memory/6020-903-0x000001D5B53A0000-0x000001D5B53B0000-memory.dmpFilesize
64KB
-
memory/6020-902-0x00007FF646990000-0x00007FF647990000-memory.dmpFilesize
16.0MB
-
memory/6020-901-0x00007FF9ECC80000-0x00007FF9ED082000-memory.dmpFilesize
4.0MB
-
memory/6020-1607-0x000001D5BC9B0000-0x000001D5BC9B1000-memory.dmpFilesize
4KB
-
memory/6020-1608-0x000001D5BC9C0000-0x000001D5BC9C1000-memory.dmpFilesize
4KB
-
memory/6020-1606-0x000001D5BC9C0000-0x000001D5BC9C1000-memory.dmpFilesize
4KB
-
memory/6020-1603-0x000001D5BC9B0000-0x000001D5BC9B1000-memory.dmpFilesize
4KB
-
memory/6020-1604-0x000001D5BC9B0000-0x000001D5BC9B1000-memory.dmpFilesize
4KB
-
memory/6020-1599-0x000001D5CE5E0000-0x000001D5CEA20000-memory.dmpFilesize
4.2MB
-
memory/6020-900-0x00007FF9ED090000-0x00007FF9ED5DC000-memory.dmpFilesize
5.3MB