hxxps://mega[.]nz/file/Nc1FiR4Q#W4_FV_8ISnkYXGVseFFYsUbEssEP8wv2kYacNb46hog

Analysis

max time kernel
322s
max time network
322s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
28-04-2024 07:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://mega.nz/file/Nc1FiR4Q#W4_FV_8ISnkYXGVseFFYsUbEssEP8wv2kYacNb46hog

Score

8^/10

discovery evasion persistence trojan

Malware Config

Signatures

Downloads MZ/PE file
Manipulates Digital Signatures 1 IoCs
Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.

Processes:

erm.exe

description ioc process

File opened for modification C:\Windows\System32\wintrust.dll erm.exe

description	ioc	process
File opened for modification	C:\Windows\System32\wintrust.dll	erm.exe

Sets file execution options in registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

MicrosoftEdgeUpdate.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0"	MicrosoftEdgeUpdate.exe

Executes dropped EXE 18 IoCs

Processes:

RobloxPlayerInstaller.exeMicrosoftEdgeWebview2Setup.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdge_X64_124.0.2478.67.exesetup.exesetup.exeMicrosoftEdgeUpdate.exeRobloxPlayerBeta.exeRobloxPlayerBeta.exe

pid	process
2980	RobloxPlayerInstaller.exe
2744	MicrosoftEdgeWebview2Setup.exe
1320	MicrosoftEdgeUpdate.exe
2504	MicrosoftEdgeUpdate.exe
2148	MicrosoftEdgeUpdate.exe
820	MicrosoftEdgeUpdateComRegisterShell64.exe
4396	MicrosoftEdgeUpdateComRegisterShell64.exe
360	MicrosoftEdgeUpdateComRegisterShell64.exe
4380	MicrosoftEdgeUpdate.exe
1048	MicrosoftEdgeUpdate.exe
1204	MicrosoftEdgeUpdate.exe
1300	MicrosoftEdgeUpdate.exe
2444	MicrosoftEdge_X64_124.0.2478.67.exe
1884	setup.exe
4072	setup.exe
2068	MicrosoftEdgeUpdate.exe
4968	RobloxPlayerBeta.exe
4628	RobloxPlayerBeta.exe

Loads dropped DLL 11 IoCs

Processes:

MicrosoftEdgeUpdate.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeRobloxPlayerBeta.exeRobloxPlayerBeta.exe

pid	process
1320	MicrosoftEdgeUpdate.exe
820	MicrosoftEdgeUpdateComRegisterShell64.exe
2148	MicrosoftEdgeUpdate.exe
4396	MicrosoftEdgeUpdateComRegisterShell64.exe
2148	MicrosoftEdgeUpdate.exe
360	MicrosoftEdgeUpdateComRegisterShell64.exe
2148	MicrosoftEdgeUpdate.exe
1204	MicrosoftEdgeUpdate.exe
1048	MicrosoftEdgeUpdate.exe
4968	RobloxPlayerBeta.exe
4628	RobloxPlayerBeta.exe

Registers COM server for autorun 1 TTPs 31 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Processes:

MicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

RobloxPlayerInstaller.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RobloxPlayerInstaller.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxPlayerInstaller.exe

Checks system information in the registry 2 TTPs 10 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

MicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe

Drops file in System32 directory 64 IoCs

Processes:

erm.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exe

description	ioc	process
File opened for modification	C:\Windows\System32\user32.dll	erm.exe
File opened for modification	C:\Windows\System32\powrprof.dll	erm.exe
File opened for modification	C:\Windows\System32\ws2_32.dll	erm.exe
File opened for modification	C:\Windows\System32\wintrust.dll	erm.exe
File opened for modification	C:\Windows\SYSTEM32\bcrypt.dll	erm.exe
File opened for modification	C:\Windows\SYSTEM32\NTASN1.dll	erm.exe
File opened for modification	C:\Windows\System32\CRYPT32.dll	erm.exe
File opened for modification	C:\Windows\system32\rsaenh.dll	erm.exe
File opened for modification	C:\Windows\System32\shlwapi.dll	erm.exe
File opened for modification	C:\Windows\SYSTEM32\wininet.dll	erm.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\System32\MSCTF.dll	erm.exe
File opened for modification	C:\Windows\System32\shcore.dll	erm.exe
File opened for modification	C:\Windows\System32\kernel.appcore.dll	erm.exe
File opened for modification	C:\Windows\SYSTEM32\wsock32.dll	erm.exe
File opened for modification	C:\Windows\SYSTEM32\WINMMBASE.dll	erm.exe
File opened for modification	C:\Windows\SYSTEM32\cryptnet.dll	erm.exe
File opened for modification	C:\Windows\System32\RPCRT4.dll	erm.exe
File opened for modification	C:\Windows\System32\windows.storage.dll	erm.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SYSTEM32\GPAPI.dll	erm.exe
File opened for modification	C:\Windows\system32\explorerframe.dll	erm.exe
File opened for modification	C:\Windows\SYSTEM32\cryptbase.dll	erm.exe
File opened for modification	C:\Windows\System32\oleaut32.dll	erm.exe
File opened for modification	C:\Windows\System32\ucrtbase.dll	erm.exe
File opened for modification	C:\Windows\System32\msvcrt.dll	erm.exe
File opened for modification	C:\Windows\SYSTEM32\GLU32.dll	erm.exe
File opened for modification	C:\Windows\System32\bcryptPrimitives.dll	erm.exe
File opened for modification	C:\Windows\System32\gdi32full.dll	erm.exe
File opened for modification	C:\Windows\SYSTEM32\ncrypt.dll	erm.exe
File opened for modification	C:\Windows\System32\IMM32.DLL	erm.exe
File opened for modification	C:\Windows\System32\msvcp_win.dll	erm.exe
File opened for modification	C:\Windows\System32\win32u.dll	erm.exe
File opened for modification	C:\Windows\System32\psapi.dll	erm.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\System32\combase.dll	erm.exe
File opened for modification	C:\Windows\System32\sechost.dll	erm.exe
File opened for modification	C:\Windows\SYSTEM32\version.dll	erm.exe
File opened for modification	C:\Windows\SYSTEM32\hhctrl.ocx	erm.exe
File opened for modification	C:\Windows\SYSTEM32\ntdll.dll	erm.exe
File opened for modification	C:\Windows\SYSTEM32\opengl32.dll	erm.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\System32\MSASN1.dll	erm.exe
File opened for modification	C:\Windows\System32\imm32.dll	erm.exe
File opened for modification	C:\Windows\SYSTEM32\winmm.dll	erm.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SYSTEM32\CRYPTSP.dll	erm.exe
File opened for modification	C:\Windows\System32\ole32.dll	erm.exe
File opened for modification	C:\Windows\SYSTEM32\verifier.dll	erm.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\System32\USER32.dll	erm.exe
File opened for modification	C:\Windows\System32\KERNEL32.DLL	erm.exe
File opened for modification	C:\Windows\System32\GDI32.dll	erm.exe
File opened for modification	C:\Windows\System32\profapi.dll	erm.exe
File opened for modification	C:\Windows\SYSTEM32\msimg32.dll	erm.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SYSTEM32\dbghelp.dll	erm.exe
File opened for modification	C:\Windows\System32\imagehlp.dll	erm.exe
File opened for modification	C:\Windows\System32\KERNELBASE.dll	erm.exe

Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs

Processes:

RobloxPlayerBeta.exeRobloxPlayerBeta.exe

pid process

4968 RobloxPlayerBeta.exe
4628 RobloxPlayerBeta.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 36 IoCs

Processes:

RobloxPlayerBeta.exeRobloxPlayerBeta.exe

pid	process
4968	RobloxPlayerBeta.exe
4968	RobloxPlayerBeta.exe
4968	RobloxPlayerBeta.exe
4968	RobloxPlayerBeta.exe
4968	RobloxPlayerBeta.exe
4968	RobloxPlayerBeta.exe
4968	RobloxPlayerBeta.exe
4968	RobloxPlayerBeta.exe
4968	RobloxPlayerBeta.exe
4968	RobloxPlayerBeta.exe
4968	RobloxPlayerBeta.exe
4968	RobloxPlayerBeta.exe
4968	RobloxPlayerBeta.exe
4968	RobloxPlayerBeta.exe
4968	RobloxPlayerBeta.exe
4968	RobloxPlayerBeta.exe
4968	RobloxPlayerBeta.exe
4968	RobloxPlayerBeta.exe
4628	RobloxPlayerBeta.exe
4628	RobloxPlayerBeta.exe
4628	RobloxPlayerBeta.exe
4628	RobloxPlayerBeta.exe
4628	RobloxPlayerBeta.exe
4628	RobloxPlayerBeta.exe
4628	RobloxPlayerBeta.exe
4628	RobloxPlayerBeta.exe
4628	RobloxPlayerBeta.exe
4628	RobloxPlayerBeta.exe
4628	RobloxPlayerBeta.exe
4628	RobloxPlayerBeta.exe
4628	RobloxPlayerBeta.exe
4628	RobloxPlayerBeta.exe
4628	RobloxPlayerBeta.exe
4628	RobloxPlayerBeta.exe
4628	RobloxPlayerBeta.exe
4628	RobloxPlayerBeta.exe

Drops file in Program Files directory 64 IoCs

Processes:

RobloxPlayerInstaller.exesetup.exeerm.exeMicrosoftEdgeWebview2Setup.exe

description	ioc	process
File created	C:\Program Files (x86)\Roblox\Versions\version-24872f7beace4d0a\content\textures\PathEditor\Control_Point_Selected.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-24872f7beace4d0a\content\textures\TerrainTools\icon_picker_enable.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-24872f7beace4d0a\content\textures\AnimationEditor\button_zoom_default_left.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-24872f7beace4d0a\content\fonts\families\Creepster.json	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-24872f7beace4d0a\content\textures\ui\Controls\return.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\124.0.2478.67\edge_feedback\camera_mf_trace.wprp	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-24872f7beace4d0a\content\textures\AvatarEditorImages\Sliders\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-24872f7beace4d0a\content\textures\PivotEditor\PivotEditor.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-24872f7beace4d0a\ExtraContent\textures\ui\LuaChat\9-slice\chat-bubble2.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\124.0.2478.67\MEIPreload\preloaded_data.pb	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-24872f7beace4d0a\content\textures\ui\VR\notifications.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-24872f7beace4d0a\ExtraContent\textures\ui\LuaChat\icons\icon-share-game-pressed-24x24.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-24872f7beace4d0a\content\fonts\families\PermanentMarker.json	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-24872f7beace4d0a\content\textures\StudioToolbox\AssetConfig\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-24872f7beace4d0a\content\textures\ui\Settings\Radial\Backpack.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-24872f7beace4d0a\content\textures\AvatarEditorImages\Stretch\gr-tail.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-24872f7beace4d0a\content\textures\ui\Settings\MenuBarAssets\MenuSelection.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-24872f7beace4d0a\content\textures\StudioUIEditor\icon_resize4.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-24872f7beace4d0a\content\textures\StudioUIEditor\icon_rotate5.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-24872f7beace4d0a\content\textures\TerrainTools\icon_regions_fill.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-24872f7beace4d0a\content\textures\ui\Scroll\scroll-top.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-24872f7beace4d0a\ExtraContent\textures\ui\LuaChat\graphic\[email protected]	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-24872f7beace4d0a\verifier.pdb	erm.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-24872f7beace4d0a\content\textures\StudioToolbox\ScrollBarBottom.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-24872f7beace4d0a\ExtraContent\LuaPackages\Packages\_Index\UIBlox\UIBlox\AppImageAtlas\img_set_2x_7.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-24872f7beace4d0a\ExtraContent\textures\ui\LuaApp\category\ic-top [email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUF6BA.tmp\msedgeupdateres_ml.dll	MicrosoftEdgeWebview2Setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\SetupMetrics\20240428072021936_1884.pma	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-24872f7beace4d0a\content\textures\particles\explosion01_implosion_main.dds	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-24872f7beace4d0a\content\textures\ui\scroll-middle.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-24872f7beace4d0a\content\textures\ui\Settings\Slider\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-24872f7beace4d0a\ExtraContent\textures\ui\LuaChat\9-slice\[email protected]	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\124.0.2478.67\mspdf.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-24872f7beace4d0a\symbols\dll\verifier.pdb	erm.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-24872f7beace4d0a\content\textures\RoactStudioWidgets\toggle_disable_light.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-24872f7beace4d0a\ExtraContent\textures\ui\LuaApp\icons\ic-more-my-feed.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-24872f7beace4d0a\ExtraContent\textures\ui\LuaChat\9-slice\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-24872f7beace4d0a\ExtraContent\textures\ui\LuaChat\graphic\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUF6BA.tmp\msedgeupdateres_el.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUF6BA.tmp\msedgeupdateres_ka.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-24872f7beace4d0a\content\textures\AnimationEditor\FaceCaptureUI\FlashingDot.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-24872f7beace4d0a\content\textures\ui\scrollbuttonDown_ds.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-24872f7beace4d0a\content\textures\ui\Controls\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-24872f7beace4d0a\content\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUF6BA.tmp\msedgeupdateres_sr.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-24872f7beace4d0a\ExtraContent\textures\ui\LuaApp\icons\ic-more-groups.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-24872f7beace4d0a\content\textures\ui\Controls\XboxController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-24872f7beace4d0a\content\textures\ui\InspectMenu\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-24872f7beace4d0a\content\textures\ui\VoiceChat\MicLight\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-24872f7beace4d0a\content\textures\ui\VoiceChat\SpeakerNew\Unmuted0.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-24872f7beace4d0a\ExtraContent\textures\ui\LuaApp\icons\ic-more-builders-club.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-24872f7beace4d0a\content\textures\DeveloperFramework\AssetPreview\flag_rounded.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-24872f7beace4d0a\content\textures\ui\Slider-BKG-Center.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-24872f7beace4d0a\content\textures\ui\PurchasePrompt\SingleButtonDown.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-24872f7beace4d0a\content\textures\ui\TopBar\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-24872f7beace4d0a\ExtraContent\textures\ui\LuaApp\graphic\profilemask.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-24872f7beace4d0a\content\textures\AnimationEditor\btn_addEvent_inner.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\124.0.2478.67\VisualElements\SmallLogoBeta.png	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-24872f7beace4d0a\content\textures\ui\MenuBar\icon_seated.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-24872f7beace4d0a\ExtraContent\textures\ui\LuaChatV2\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\124.0.2478.67\Trust Protection Lists\Sigma\Other	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\124.0.2478.67\Locales\nn.pak	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-24872f7beace4d0a\content\textures\AnimationEditor\image_keyframe_cubic_selected.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-24872f7beace4d0a\content\textures\ui\InspectMenu\[email protected]	RobloxPlayerInstaller.exe

Drops file in Windows directory 1 IoCs

Processes:

erm.exe

description	ioc	process
File opened for modification	C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.15063.0_none_108e4f62dfe5d999\comctl32.dll	erm.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

Processes:

RobloxPlayerInstaller.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0"	RobloxPlayerInstaller.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

MicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exechrome.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	MicrosoftEdgeUpdate.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeUpdate.exe

Modifies registry class 64 IoCs

Processes:

MicrosoftEdgeUpdate.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeRobloxPlayerInstaller.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.PolicyStatusSvc	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\ = "IJobObserver"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\MicrosoftEdgeUpdate.exe\AppID = "{CECDDD22-2E72-4832-9606-A9B0E5E344B2}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\NumMethods\ = "16"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CoreMachineClass.1	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EA92A799-267E-4DF5-A6ED-6A7E0684BB8A}\AppID = "{A6B716CB-028B-404D-B72C-50E153DD68DA}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}\Elevation	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E3D94CEB-EC11-46BE-8872-7DDCE37FABFA}\InprocHandler32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\ = "IAppBundleWeb"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}\Elevation	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\NumMethods\ = "41"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CredentialDialogMachine.1.0\CLSID\ = "{5F6A18BB-6231-424B-8242-19E5BB94F8ED}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebSvc	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\NumMethods\ = "12"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\NumMethods\ = "5"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}\LocalizedString = "@C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\msedgeupdate.dll,-3000"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\NumMethods\ = "7"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\ = "IPolicyStatus4"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\NumMethods\ = "10"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\NumMethods\ = "12"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}\ProgID\ = "MicrosoftEdgeUpdate.Update3WebMachine.1.0"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\ = "ICurrentState"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}\LocalServer32\ = "\"C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\MicrosoftEdgeUpdateBroker.exe\""	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\NumMethods\ = "4"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}\ = "Microsoft Edge Update Broker Class Factory"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8F09CD6C-5964-4573-82E3-EBFF7702865B}\VersionIndependentProgID\ = "MicrosoftEdgeUpdate.CoreClass"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebSvc\CurVer	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}\LocalServer32	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3COMClassService	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\NumMethods\ = "17"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\NumMethods\ = "41"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\NumMethods\ = "23"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\NumMethods\ = "24"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\NumMethods\ = "17"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassSvc	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\NumMethods	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}\ProgID\ = "MicrosoftEdgeUpdate.OnDemandCOMClassMachine.1.0"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CredentialDialogMachine.1.0\CLSID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassMachineFallback\ = "Microsoft Edge Update Legacy On Demand"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A6B716CB-028B-404D-B72C-50E153DD68DA}\AppID = "{A6B716CB-028B-404D-B72C-50E153DD68DA}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\version = "version-24872f7beace4d0a"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\NumMethods	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}\LocalServer32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}\ = "Google Update Policy Status Class"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}\ProgID	MicrosoftEdgeUpdate.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

Processes:

chrome.exeerm.exechrome.exeRobloxPlayerInstaller.exeMicrosoftEdgeUpdate.exeRobloxPlayerBeta.exeRobloxPlayerBeta.exe

pid	process
516	chrome.exe
516	chrome.exe
380	erm.exe
380	erm.exe
380	erm.exe
380	erm.exe
2300	chrome.exe
2300	chrome.exe
2980	RobloxPlayerInstaller.exe
2980	RobloxPlayerInstaller.exe
1320	MicrosoftEdgeUpdate.exe
1320	MicrosoftEdgeUpdate.exe
1320	MicrosoftEdgeUpdate.exe
1320	MicrosoftEdgeUpdate.exe
1320	MicrosoftEdgeUpdate.exe
1320	MicrosoftEdgeUpdate.exe
4968	RobloxPlayerBeta.exe
4968	RobloxPlayerBeta.exe
4628	RobloxPlayerBeta.exe
4628	RobloxPlayerBeta.exe
380	erm.exe
380	erm.exe
380	erm.exe
380	erm.exe
380	erm.exe
380	erm.exe
380	erm.exe
380	erm.exe
380	erm.exe
380	erm.exe
380	erm.exe
380	erm.exe
380	erm.exe
380	erm.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

Processes:

chrome.exe

pid process

516 chrome.exe
516 chrome.exe
516 chrome.exe
516 chrome.exe
516 chrome.exe
516 chrome.exe
516 chrome.exe
516 chrome.exe
516 chrome.exe
516 chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exeAUDIODG.EXE

description	pid	process
Token: SeShutdownPrivilege	516	chrome.exe
Token: SeCreatePagefilePrivilege	516	chrome.exe
Token: SeShutdownPrivilege	516	chrome.exe
Token: SeCreatePagefilePrivilege	516	chrome.exe
Token: SeShutdownPrivilege	516	chrome.exe
Token: SeCreatePagefilePrivilege	516	chrome.exe
Token: SeShutdownPrivilege	516	chrome.exe
Token: SeCreatePagefilePrivilege	516	chrome.exe
Token: SeShutdownPrivilege	516	chrome.exe
Token: SeCreatePagefilePrivilege	516	chrome.exe
Token: SeShutdownPrivilege	516	chrome.exe
Token: SeCreatePagefilePrivilege	516	chrome.exe
Token: 33	3624	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3624	AUDIODG.EXE
Token: SeShutdownPrivilege	516	chrome.exe
Token: SeCreatePagefilePrivilege	516	chrome.exe
Token: SeShutdownPrivilege	516	chrome.exe
Token: SeCreatePagefilePrivilege	516	chrome.exe
Token: SeShutdownPrivilege	516	chrome.exe
Token: SeCreatePagefilePrivilege	516	chrome.exe
Token: SeShutdownPrivilege	516	chrome.exe
Token: SeCreatePagefilePrivilege	516	chrome.exe
Token: SeShutdownPrivilege	516	chrome.exe
Token: SeCreatePagefilePrivilege	516	chrome.exe
Token: SeShutdownPrivilege	516	chrome.exe
Token: SeCreatePagefilePrivilege	516	chrome.exe
Token: SeShutdownPrivilege	516	chrome.exe
Token: SeCreatePagefilePrivilege	516	chrome.exe
Token: SeShutdownPrivilege	516	chrome.exe
Token: SeCreatePagefilePrivilege	516	chrome.exe
Token: SeShutdownPrivilege	516	chrome.exe
Token: SeCreatePagefilePrivilege	516	chrome.exe
Token: SeShutdownPrivilege	516	chrome.exe
Token: SeCreatePagefilePrivilege	516	chrome.exe
Token: SeShutdownPrivilege	516	chrome.exe
Token: SeCreatePagefilePrivilege	516	chrome.exe
Token: SeShutdownPrivilege	516	chrome.exe
Token: SeCreatePagefilePrivilege	516	chrome.exe
Token: SeShutdownPrivilege	516	chrome.exe
Token: SeCreatePagefilePrivilege	516	chrome.exe
Token: SeShutdownPrivilege	516	chrome.exe
Token: SeCreatePagefilePrivilege	516	chrome.exe
Token: SeShutdownPrivilege	516	chrome.exe
Token: SeCreatePagefilePrivilege	516	chrome.exe
Token: SeShutdownPrivilege	516	chrome.exe
Token: SeCreatePagefilePrivilege	516	chrome.exe
Token: SeShutdownPrivilege	516	chrome.exe
Token: SeCreatePagefilePrivilege	516	chrome.exe
Token: SeShutdownPrivilege	516	chrome.exe
Token: SeCreatePagefilePrivilege	516	chrome.exe
Token: SeShutdownPrivilege	516	chrome.exe
Token: SeCreatePagefilePrivilege	516	chrome.exe
Token: SeShutdownPrivilege	516	chrome.exe
Token: SeCreatePagefilePrivilege	516	chrome.exe
Token: SeShutdownPrivilege	516	chrome.exe
Token: SeCreatePagefilePrivilege	516	chrome.exe
Token: SeShutdownPrivilege	516	chrome.exe
Token: SeCreatePagefilePrivilege	516	chrome.exe
Token: SeShutdownPrivilege	516	chrome.exe
Token: SeCreatePagefilePrivilege	516	chrome.exe
Token: SeShutdownPrivilege	516	chrome.exe
Token: SeCreatePagefilePrivilege	516	chrome.exe
Token: SeShutdownPrivilege	516	chrome.exe
Token: SeCreatePagefilePrivilege	516	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

chrome.exeerm.exe

pid	process
516	chrome.exe
516	chrome.exe
516	chrome.exe
516	chrome.exe
516	chrome.exe
516	chrome.exe
516	chrome.exe
516	chrome.exe
516	chrome.exe
516	chrome.exe
516	chrome.exe
516	chrome.exe
516	chrome.exe
516	chrome.exe
516	chrome.exe
516	chrome.exe
516	chrome.exe
516	chrome.exe
516	chrome.exe
516	chrome.exe
516	chrome.exe
516	chrome.exe
516	chrome.exe
516	chrome.exe
516	chrome.exe
516	chrome.exe
516	chrome.exe
516	chrome.exe
516	chrome.exe
516	chrome.exe
516	chrome.exe
516	chrome.exe
516	chrome.exe
380	erm.exe
380	erm.exe
380	erm.exe
380	erm.exe
380	erm.exe
380	erm.exe
380	erm.exe
380	erm.exe
380	erm.exe
380	erm.exe
380	erm.exe
380	erm.exe
380	erm.exe
380	erm.exe
380	erm.exe
380	erm.exe
380	erm.exe
380	erm.exe
380	erm.exe
380	erm.exe
380	erm.exe
380	erm.exe
380	erm.exe
380	erm.exe
380	erm.exe
380	erm.exe
380	erm.exe
380	erm.exe
380	erm.exe
380	erm.exe
380	erm.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

chrome.exe

pid	process
516	chrome.exe
516	chrome.exe
516	chrome.exe
516	chrome.exe
516	chrome.exe
516	chrome.exe
516	chrome.exe
516	chrome.exe
516	chrome.exe
516	chrome.exe
516	chrome.exe
516	chrome.exe
516	chrome.exe
516	chrome.exe
516	chrome.exe
516	chrome.exe
516	chrome.exe
516	chrome.exe
516	chrome.exe
516	chrome.exe
516	chrome.exe
516	chrome.exe
516	chrome.exe
516	chrome.exe

Suspicious use of UnmapMainImage 2 IoCs

Processes:

RobloxPlayerBeta.exeRobloxPlayerBeta.exe

pid process

4968 RobloxPlayerBeta.exe
4628 RobloxPlayerBeta.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 516 wrote to memory of 1896	516	chrome.exe	chrome.exe
PID 516 wrote to memory of 1896	516	chrome.exe	chrome.exe
PID 516 wrote to memory of 4904	516	chrome.exe	chrome.exe
PID 516 wrote to memory of 4904	516	chrome.exe	chrome.exe
PID 516 wrote to memory of 4904	516	chrome.exe	chrome.exe
PID 516 wrote to memory of 4904	516	chrome.exe	chrome.exe
PID 516 wrote to memory of 4904	516	chrome.exe	chrome.exe
PID 516 wrote to memory of 4904	516	chrome.exe	chrome.exe
PID 516 wrote to memory of 4904	516	chrome.exe	chrome.exe
PID 516 wrote to memory of 4904	516	chrome.exe	chrome.exe
PID 516 wrote to memory of 4904	516	chrome.exe	chrome.exe
PID 516 wrote to memory of 4904	516	chrome.exe	chrome.exe
PID 516 wrote to memory of 4904	516	chrome.exe	chrome.exe
PID 516 wrote to memory of 4904	516	chrome.exe	chrome.exe
PID 516 wrote to memory of 4904	516	chrome.exe	chrome.exe
PID 516 wrote to memory of 4904	516	chrome.exe	chrome.exe
PID 516 wrote to memory of 4904	516	chrome.exe	chrome.exe
PID 516 wrote to memory of 4904	516	chrome.exe	chrome.exe
PID 516 wrote to memory of 4904	516	chrome.exe	chrome.exe
PID 516 wrote to memory of 4904	516	chrome.exe	chrome.exe
PID 516 wrote to memory of 4904	516	chrome.exe	chrome.exe
PID 516 wrote to memory of 4904	516	chrome.exe	chrome.exe
PID 516 wrote to memory of 4904	516	chrome.exe	chrome.exe
PID 516 wrote to memory of 4904	516	chrome.exe	chrome.exe
PID 516 wrote to memory of 4904	516	chrome.exe	chrome.exe
PID 516 wrote to memory of 4904	516	chrome.exe	chrome.exe
PID 516 wrote to memory of 4904	516	chrome.exe	chrome.exe
PID 516 wrote to memory of 4904	516	chrome.exe	chrome.exe
PID 516 wrote to memory of 4904	516	chrome.exe	chrome.exe
PID 516 wrote to memory of 4904	516	chrome.exe	chrome.exe
PID 516 wrote to memory of 4904	516	chrome.exe	chrome.exe
PID 516 wrote to memory of 4904	516	chrome.exe	chrome.exe
PID 516 wrote to memory of 4904	516	chrome.exe	chrome.exe
PID 516 wrote to memory of 4904	516	chrome.exe	chrome.exe
PID 516 wrote to memory of 4904	516	chrome.exe	chrome.exe
PID 516 wrote to memory of 4904	516	chrome.exe	chrome.exe
PID 516 wrote to memory of 4904	516	chrome.exe	chrome.exe
PID 516 wrote to memory of 4904	516	chrome.exe	chrome.exe
PID 516 wrote to memory of 4904	516	chrome.exe	chrome.exe
PID 516 wrote to memory of 4904	516	chrome.exe	chrome.exe
PID 516 wrote to memory of 2272	516	chrome.exe	chrome.exe
PID 516 wrote to memory of 2272	516	chrome.exe	chrome.exe
PID 516 wrote to memory of 2780	516	chrome.exe	chrome.exe
PID 516 wrote to memory of 2780	516	chrome.exe	chrome.exe
PID 516 wrote to memory of 2780	516	chrome.exe	chrome.exe
PID 516 wrote to memory of 2780	516	chrome.exe	chrome.exe
PID 516 wrote to memory of 2780	516	chrome.exe	chrome.exe
PID 516 wrote to memory of 2780	516	chrome.exe	chrome.exe
PID 516 wrote to memory of 2780	516	chrome.exe	chrome.exe
PID 516 wrote to memory of 2780	516	chrome.exe	chrome.exe
PID 516 wrote to memory of 2780	516	chrome.exe	chrome.exe
PID 516 wrote to memory of 2780	516	chrome.exe	chrome.exe
PID 516 wrote to memory of 2780	516	chrome.exe	chrome.exe
PID 516 wrote to memory of 2780	516	chrome.exe	chrome.exe
PID 516 wrote to memory of 2780	516	chrome.exe	chrome.exe
PID 516 wrote to memory of 2780	516	chrome.exe	chrome.exe
PID 516 wrote to memory of 2780	516	chrome.exe	chrome.exe
PID 516 wrote to memory of 2780	516	chrome.exe	chrome.exe
PID 516 wrote to memory of 2780	516	chrome.exe	chrome.exe
PID 516 wrote to memory of 2780	516	chrome.exe	chrome.exe
PID 516 wrote to memory of 2780	516	chrome.exe	chrome.exe
PID 516 wrote to memory of 2780	516	chrome.exe	chrome.exe
PID 516 wrote to memory of 2780	516	chrome.exe	chrome.exe
PID 516 wrote to memory of 2780	516	chrome.exe	chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://mega.nz/file/Nc1FiR4Q#W4_FV_8ISnkYXGVseFFYsUbEssEP8wv2kYacNb46hog
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:516

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffffc2a9758,0x7ffffc2a9768,0x7ffffc2a9778
2⤵
PID:1896

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1580 --field-trial-handle=1756,i,9815278518226818209,6721166421534648626,131072 /prefetch:2
2⤵
PID:4904

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2012 --field-trial-handle=1756,i,9815278518226818209,6721166421534648626,131072 /prefetch:8
2⤵
PID:2272

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2100 --field-trial-handle=1756,i,9815278518226818209,6721166421534648626,131072 /prefetch:8
2⤵
PID:2780

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2824 --field-trial-handle=1756,i,9815278518226818209,6721166421534648626,131072 /prefetch:1
2⤵
PID:4664

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2832 --field-trial-handle=1756,i,9815278518226818209,6721166421534648626,131072 /prefetch:1
2⤵
PID:4468

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4832 --field-trial-handle=1756,i,9815278518226818209,6721166421534648626,131072 /prefetch:8
2⤵
PID:5064

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5072 --field-trial-handle=1756,i,9815278518226818209,6721166421534648626,131072 /prefetch:8
2⤵
PID:3904

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5136 --field-trial-handle=1756,i,9815278518226818209,6721166421534648626,131072 /prefetch:8
2⤵
PID:4000

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=5260 --field-trial-handle=1756,i,9815278518226818209,6721166421534648626,131072 /prefetch:1
2⤵
PID:3616

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=5460 --field-trial-handle=1756,i,9815278518226818209,6721166421534648626,131072 /prefetch:1
2⤵
PID:4912

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5576 --field-trial-handle=1756,i,9815278518226818209,6721166421534648626,131072 /prefetch:8
2⤵
PID:4272

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5272 --field-trial-handle=1756,i,9815278518226818209,6721166421534648626,131072 /prefetch:8
2⤵
PID:1000

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5772 --field-trial-handle=1756,i,9815278518226818209,6721166421534648626,131072 /prefetch:8
2⤵
PID:2264

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5868 --field-trial-handle=1756,i,9815278518226818209,6721166421534648626,131072 /prefetch:8
2⤵
PID:2488

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=5672 --field-trial-handle=1756,i,9815278518226818209,6721166421534648626,131072 /prefetch:1
2⤵
PID:5028

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4620 --field-trial-handle=1756,i,9815278518226818209,6721166421534648626,131072 /prefetch:8
2⤵
PID:600

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 --field-trial-handle=1756,i,9815278518226818209,6721166421534648626,131072 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2300

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=5212 --field-trial-handle=1756,i,9815278518226818209,6721166421534648626,131072 /prefetch:1
2⤵
PID:5064

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=824 --field-trial-handle=1756,i,9815278518226818209,6721166421534648626,131072 /prefetch:8
2⤵
PID:2068

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5544 --field-trial-handle=1756,i,9815278518226818209,6721166421534648626,131072 /prefetch:8
2⤵
PID:4596

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=6204 --field-trial-handle=1756,i,9815278518226818209,6721166421534648626,131072 /prefetch:1
2⤵
PID:920

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=920 --field-trial-handle=1756,i,9815278518226818209,6721166421534648626,131072 /prefetch:1
2⤵
PID:2864

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --mojo-platform-channel-handle=6268 --field-trial-handle=1756,i,9815278518226818209,6721166421534648626,131072 /prefetch:1
2⤵
PID:4572

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3316 --field-trial-handle=1756,i,9815278518226818209,6721166421534648626,131072 /prefetch:8
2⤵
PID:2148

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5396 --field-trial-handle=1756,i,9815278518226818209,6721166421534648626,131072 /prefetch:8
2⤵
PID:3152

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3100 --field-trial-handle=1756,i,9815278518226818209,6721166421534648626,131072 /prefetch:8
2⤵
PID:3020

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6120 --field-trial-handle=1756,i,9815278518226818209,6721166421534648626,131072 /prefetch:8
2⤵
PID:836

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6260 --field-trial-handle=1756,i,9815278518226818209,6721166421534648626,131072 /prefetch:8
2⤵
PID:680

C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
"C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"
2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2980

C:\Program Files (x86)\Roblox\Versions\version-24872f7beace4d0a\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe
MicrosoftEdgeWebview2Setup.exe /silent /install
3⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2744

C:\Program Files (x86)\Microsoft\Temp\EUF6BA.tmp\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\Temp\EUF6BA.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
4⤵
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Suspicious behavior: EnumeratesProcesses
PID:1320

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
5⤵
- Executes dropped EXE
- Modifies registry class
PID:2504

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:2148

C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
6⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
PID:820

C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
6⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
PID:4396

C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
6⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
PID:360

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NzU1NTdERTQtOTk2Mi00RDAzLTlEQTEtNUJFOUJENEQ4RTUxfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntERjg1MTczMC05OTYwLTQ3RkEtQTM2MC0yOEZCODRCRTVEQzd9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE1MDYzLjAiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iUUVNVSIgcHJvZHVjdF9uYW1lPSJTdGFuZGFyZCBQQyAoUTM1ICsgSUNIOSwgMjAwOSkiLz48ZXhwIGV0YWc9IiIvPjxhcHAgYXBwaWQ9IntGM0M0RkUwMC1FRkQ1LTQwM0ItOTU2OS0zOThBMjBGMUJBNEF9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIxLjMuMTcxLjM5IiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIj48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI2MzMwODY2NjUxIiBpbnN0YWxsX3RpbWVfbXM9IjQ0NyIvPjwvYXBwPjwvcmVxdWVzdD4
5⤵
- Executes dropped EXE
- Checks system information in the registry
PID:4380

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{75557DE4-9962-4D03-9DA1-5BE9BD4D8E51}" /silent
5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1048

C:\Program Files (x86)\Roblox\Versions\version-24872f7beace4d0a\RobloxPlayerBeta.exe
"C:\Program Files (x86)\Roblox\Versions\version-24872f7beace4d0a\RobloxPlayerBeta.exe" -app -isInstallerLaunch
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
PID:4968

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5560 --field-trial-handle=1756,i,9815278518226818209,6721166421534648626,131072 /prefetch:8
2⤵
PID:2704

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --mojo-platform-channel-handle=6160 --field-trial-handle=1756,i,9815278518226818209,6721166421534648626,131072 /prefetch:1
2⤵
PID:2820

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6308 --field-trial-handle=1756,i,9815278518226818209,6721166421534648626,131072 /prefetch:8
2⤵
PID:2128

C:\Program Files (x86)\Roblox\Versions\version-24872f7beace4d0a\RobloxPlayerBeta.exe
"C:\Program Files (x86)\Roblox\Versions\version-24872f7beace4d0a\RobloxPlayerBeta.exe" roblox-player:1+launchmode:play+gameinfo:iTmsAGS73KePnFi48YH4jhV1NDCRW8Fr2Wnu691MmRvZLNIr9EPhWgqpiV94lJQVHl7Qd4D4tEnpPwu68jwVy6pFkZQQ-VMYF9EpfKxo6BMjmDmjmyMpLA2FyR6-odAdtgBWonwEf0b9rlp8r6BLEwmBhI9BfxHvsrRCSIx9ro93SUDSMPW7Rd2oiSOMDzAl5SlFckmfR4pUKRbdAVMHHEpxp1JStqjfMYe3uy62sec+launchtime:1714288884336+placelauncherurl:https%3A%2F%2Fwww.roblox.com%2FGame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D1714288630062003%26placeId%3D4924922222%26isPlayTogetherGame%3Dfalse%26joinAttemptId%3D2e8fcd71-70c3-4aa3-a145-b548e5823eb1%26joinAttemptOrigin%3DPlayButton+browsertrackerid:1714288630062003+robloxLocale:en_us+gameLocale:en_us+channel:+LaunchExp:InApp
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
PID:4628

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:924

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x208
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3624

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1860

C:\Users\Admin\Downloads\HULU EXECUTOR UPDATED V1.1.2\HULU EXECUTOR UPDATED V1.1.2\HULU EXECUTOR UPDATED V1.1\erm.exe
"C:\Users\Admin\Downloads\HULU EXECUTOR UPDATED V1.1.2\HULU EXECUTOR UPDATED V1.1.2\HULU EXECUTOR UPDATED V1.1\erm.exe"
1⤵
- Manipulates Digital Signatures
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:380

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Modifies data under HKEY_USERS
PID:1204

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NzU1NTdERTQtOTk2Mi00RDAzLTlEQTEtNUJFOUJENEQ4RTUxfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntCRDkxQUUzQi0xQTEyLTQ0RDAtOUEyNS0wNUQ4Q0JCMkIzMUZ9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE1MDYzLjAiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iUUVNVSIgcHJvZHVjdF9uYW1lPSJTdGFuZGFyZCBQQyAoUTM1ICsgSUNIOSwgMjAwOSkiLz48ZXhwIGV0YWc9IiZxdW90O3I0NTJ0MStrMlRncS9IWHpqdkZOQlJob3BCV1I5c2JqWHhxZVVESDl1WDA9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEwNi4wLjUyNDkuMTE5IiBuZXh0dmVyc2lvbj0iMTA2LjAuNTI0OS4xMTkiIGxhbmc9ImVuIiBicmFuZD0iR0dMUyIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIzIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI2MzM1MDA2NzE5Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
2⤵
- Executes dropped EXE
- Checks system information in the registry
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1300

C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{387EBC68-B6B2-4821-A1CA-E0E59E8605FB}\MicrosoftEdge_X64_124.0.2478.67.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{387EBC68-B6B2-4821-A1CA-E0E59E8605FB}\MicrosoftEdge_X64_124.0.2478.67.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
2⤵
- Executes dropped EXE
PID:2444

C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{387EBC68-B6B2-4821-A1CA-E0E59E8605FB}\EDGEMITMP_6699A.tmp\setup.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{387EBC68-B6B2-4821-A1CA-E0E59E8605FB}\EDGEMITMP_6699A.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{387EBC68-B6B2-4821-A1CA-E0E59E8605FB}\MicrosoftEdge_X64_124.0.2478.67.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
3⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1884

C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{387EBC68-B6B2-4821-A1CA-E0E59E8605FB}\EDGEMITMP_6699A.tmp\setup.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{387EBC68-B6B2-4821-A1CA-E0E59E8605FB}\EDGEMITMP_6699A.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=124.0.6367.91 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{387EBC68-B6B2-4821-A1CA-E0E59E8605FB}\EDGEMITMP_6699A.tmp\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=124.0.2478.67 --initial-client-data=0x210,0x214,0x218,0x1ec,0x21c,0x7ff6368c88c0,0x7ff6368c88cc,0x7ff6368c88d8
4⤵
- Executes dropped EXE
PID:4072

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NzU1NTdERTQtOTk2Mi00RDAzLTlEQTEtNUJFOUJENEQ4RTUxfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9InsyMkM0ODU5MC0yQzExLTRBNDktOTlGNy0xM0FDMzAxNTk5NkN9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE1MDYzLjAiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iUUVNVSIgcHJvZHVjdF9uYW1lPSJTdGFuZGFyZCBQQyAoUTM1ICsgSUNIOSwgMjAwOSkiLz48ZXhwIGV0YWc9IiZxdW90O1ZQUW9QMUYrZnExNXdSemgxa1BMNFBNcFdoOE9STUI1aXp2ck9DL2NoalE9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0ie0YzMDE3MjI2LUZFMkEtNDI5NS04QkRGLTAwQzNBOUE3RTRDNX0iIHZlcnNpb249IiIgbmV4dHZlcnNpb249IjEyNC4wLjI0NzguNjciIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJjb25zZW50PWZhbHNlIiBpbnN0YWxsYWdlPSItMSIgaW5zdGFsbGRhdGU9Ii0xIj48dXBkYXRlY2hlY2svPjxldmVudCBldmVudHR5cGU9IjkiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjYzODA4NzY3NzQiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI1IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI2MzgwOTM2Njc1IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNjU3OTE5NDk3NCIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgZG93bmxvYWRlcj0iYml0cyIgdXJsPSJodHRwOi8vbXNlZGdlLmYudGx1LmRsLmRlbGl2ZXJ5Lm1wLm1pY3Jvc29mdC5jb20vZmlsZXN0cmVhbWluZ3NlcnZpY2UvZmlsZXMvMTMxYmQ1ZDctOWM2NS00NzZhLTkwNzUtZTI0OTRmOGRhOWU0P1AxPTE3MTQ4OTM1OTAmYW1wO1AyPTQwNCZhbXA7UDM9MiZhbXA7UDQ9V1lIRVJHa3B6TEtNeDF0bnQ3byUyYm1tUlIlMmZmb1pka2ZSVmJGVXRmNEI2VmJuUVE3a1F4UnZpd2tDNm1NeSUyZkt3VHRBUG9nUWxEWXVmMzRJeENOSHJSSGclM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIxNzI3MjM3NjgiIHRvdGFsPSIxNzI3MjM3NjgiIGRvd25sb2FkX3RpbWVfbXM9IjE1ODEwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNjU3OTI1NDg5NiIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjYiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjY1OTMwNTQ4NTkiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIxOTY3NTciIHN5c3RlbV91cHRpbWVfdGlja3M9IjcwMDQ0NjQ5ODQiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIHVwZGF0ZV9jaGVja190aW1lX21zPSI4NDgiIGRvd25sb2FkX3RpbWVfbXM9IjE5ODI5IiBkb3dubG9hZGVkPSIxNzI3MjM3NjgiIHRvdGFsPSIxNzI3MjM3NjgiIHBhY2thZ2VfY2FjaGVfcmVzdWx0PSIwIiBpbnN0YWxsX3RpbWVfbXM9IjQxMTM5Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
2⤵
- Executes dropped EXE
- Checks system information in the registry
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2068

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\EdgeCore\124.0.2478.67\Installer\setup.exe
Filesize
6.8MB

MD5
c31297188ec9fbaa60449f769339963e

SHA1
8502d9e0cef18137529f0a46ad6e69a1577e6cae

SHA256
2e2eff110475dd3dfd732ab514e4692032e67b2d228d0081634a87f45cde5ff9

SHA512
9525e3e08b953fe36270c7b4868959e9bded055c5577e5ca94d79606b671e6660d180f763b54a276bf356e82d7073901c373e0b40cfca924cc4b38384c20e22a

Download Submit
C:\Program Files (x86)\Microsoft\EdgeUpdate\Download\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\124.0.2478.67\MicrosoftEdge_X64_124.0.2478.67.exe
Filesize
164.7MB

MD5
dabc3160a804b9fadd89ceb0fcecf388

SHA1
b52f15e866a18637683bdf0ea4eaa326b787396f

SHA256
53eb39a92ee0d2eb94f6d33c015097bddd9cfe5c4129d3ac9a9facbfb5087bfe

SHA512
74fc0f21d7cf99e07c079224e2af8a4a51bff98a97bc471cfedfbd3a28d3ee681fbd63fa7239948c3c0bf4f9af56dc582dd128f8c08b54cb73389e85f949f431

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUF6BA.tmp\EdgeUpdate.dat
Filesize
12KB

MD5
369bbc37cff290adb8963dc5e518b9b8

SHA1
de0ef569f7ef55032e4b18d3a03542cc2bbac191

SHA256
3d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3

SHA512
4f8ec1fd4de8d373a4973513aa95e646dfc5b1069549fafe0d125614116c902bfc04b0e6afd12554cc13ca6c53e1f258a3b14e54ac811f6b06ed50c9ac9890b1

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUF6BA.tmp\MicrosoftEdgeComRegisterShellARM64.exe
Filesize
179KB

MD5
7a160c6016922713345454265807f08d

SHA1
e36ee184edd449252eb2dfd3016d5b0d2edad3c6

SHA256
35a14bd84e74dd6d8e2683470243fb1bb9071178d9283b12ebbfb405c8cd4aa9

SHA512
c0f1d5c8455cf14f2088ede062967d6dfa7c39ca2ac9636b10ed46dfbea143f64106a4f03c285e89dd8cf4405612f1eef25a8ec4f15294ca3350053891fc3d7e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUF6BA.tmp\MicrosoftEdgeUpdate.exe
Filesize
201KB

MD5
4dc57ab56e37cd05e81f0d8aaafc5179

SHA1
494a90728d7680f979b0ad87f09b5b58f16d1cd5

SHA256
87c6f7d9b58f136aeb33c96dbfe3702083ec519aafca39be66778a9c27a68718

SHA512
320eeed88d7facf8c1f45786951ef81708c82cb89c63a3c820ee631c52ea913e64c4e21f0039c1b277cfb710c4d81cd2191878320d00fd006dd777c727d9dc2b

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUF6BA.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe
Filesize
212KB

MD5
60dba9b06b56e58f5aea1a4149c743d2

SHA1
a7e456acf64dd99ca30259cf45b88cf2515a69b3

SHA256
4d01f5531f93ab2af9e92c4f998a145c94f36688c3793845d528c8675697e112

SHA512
e98088a368d4c4468e325a1d62bee49661f597e5c1cd1fe2dabad3911b8ac07e1cc4909e7324cb4ab39f30fa32a34807685fcfba767f88884ef84ca69a0049e7

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUF6BA.tmp\MicrosoftEdgeUpdateCore.exe
Filesize
257KB

MD5
c044dcfa4d518df8fc9d4a161d49cece

SHA1
91bd4e933b22c010454fd6d3e3b042ab6e8b2149

SHA256
9f79fe09f57002ca07ae0b2a196e8cc002d2be6d5540ee857217e99b33fa4bb2

SHA512
f26b89085aa22ac62a28610689e81b4dfe3c38a9015ec56dfeaff02fdb6fa64e784b86a961509b52ad968400faa1ef0487f29f07a41e37239fe4c3262a11ac2c

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUF6BA.tmp\NOTICE.TXT
Filesize
4KB

MD5
6dd5bf0743f2366a0bdd37e302783bcd

SHA1
e5ff6e044c40c02b1fc78304804fe1f993fed2e6

SHA256
91d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5

SHA512
f546c1dff8902a3353c0b7c10ca9f69bb77ebd276e4d5217da9e0823a0d8d506a5267773f789343d8c56b41a0ee6a97d4470a44bbd81ceaa8529e5e818f4951e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUF6BA.tmp\msedgeupdateres_af.dll
Filesize
28KB

MD5
567aec2d42d02675eb515bbd852be7db

SHA1
66079ae8ac619ff34e3ddb5fb0823b1790ba7b37

SHA256
a881788359b2a7d90ac70a76c45938fb337c2064487dcb8be00b9c311d10c24c

SHA512
3a7414e95c2927d5496f29814556d731aef19efa531fb58988079287669dfc033f3e04c8740697571df76bfecfe3b75659511783ce34682d2a2ea704dfa115b3

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUF6BA.tmp\msedgeupdateres_am.dll
Filesize
24KB

MD5
f6c1324070b6c4e2a8f8921652bfbdfa

SHA1
988e6190f26e4ca8f7ea3caabb366cf1edcdcbbf

SHA256
986b0654a8b5f7b23478463ff051bffe1e9bbdeb48744e4aa1bd3d89a7520717

SHA512
63092cf13e8a19966181df695eb021b0a9993afe8f98b1309973ea999fdf4cd9b6ffd609968d4aa0b2cde41e872688a283fd922d8b22cb5ad06339fe18221100

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUF6BA.tmp\msedgeupdateres_ar.dll
Filesize
26KB

MD5
570efe7aa117a1f98c7a682f8112cb6d

SHA1
536e7c49e24e9aa068a021a8f258e3e4e69fa64f

SHA256
e2cc8017bc24e73048c7ee68d3787ed63c3898eec61299a9ca1bab8aeaa8da01

SHA512
5e963dd55a5739a1da19cec7277dc3d07afdb682330998fd8c33a1b5949942019521967d8b5af0752a7a8e2cf536faa7e62982501170319558ceaa21ed657ae8

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUF6BA.tmp\msedgeupdateres_as.dll
Filesize
28KB

MD5
a8d3210e34bf6f63a35590245c16bc1b

SHA1
f337f2cbec05b7e20ca676d7c2b1a8d5ae8bf693

SHA256
3b82de846ad028544013383e3c9fb570d2a09abf2c854e8a4d641bd7fc3b3766

SHA512
6e47ffe8f7c2532e7854dcae3cbd4e6533f0238815cb6af5ea85087c51017ea284542b988f07692d0297ebab1bad80d7613bf424ff532e10b01c8e528ab1043a

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUF6BA.tmp\msedgeupdateres_az.dll
Filesize
29KB

MD5
7937c407ebe21170daf0975779f1aa49

SHA1
4c2a40e76209abd2492dfaaf65ef24de72291346

SHA256
5ab96e4e6e065dbce3b643c6be2c668f5570984ead1a8b3578bbd2056fbad4e9

SHA512
8670746941660e6573732077f5ed1b630f94a825cf4ac9dbe5018772eaac1c48216334757a2aeaa561034b4d907162a370b8f0bae83b34a09457fafe165fb5d7

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUF6BA.tmp\msedgeupdateres_bg.dll
Filesize
29KB

MD5
8375b1b756b2a74a12def575351e6bbd

SHA1
802ec096425dc1cab723d4cf2fd1a868315d3727

SHA256
a12df15afac4eb2695626d7a8a2888bdf54c8db671043b0677180f746d8ad105

SHA512
aec4bb94fde884db79a629abcff27fd8afb7f229d055514f51fa570fb47a85f8dfc9a54a8f69607d2bcaf82fae1ec7ffab0b246795a77a589be11fad51b24d19

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUF6BA.tmp\msedgeupdateres_bn-IN.dll
Filesize
29KB

MD5
a94cf5e8b1708a43393263a33e739edd

SHA1
1068868bdc271a52aaae6f749028ed3170b09cce

SHA256
5b01fe11016610d5606f815281c970c86025732fc597b99c031a018626cd9f3c

SHA512
920f7fed1b720afdb569aec2961bd827a6fc54b4598c0704f65da781d142b1707e5106a459f0c289e0f476b054d93c0b733806af036b68f46377dde0541af2e7

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUF6BA.tmp\msedgeupdateres_bn.dll
Filesize
29KB

MD5
7dc58c4e27eaf84ae9984cff2cc16235

SHA1
3f53499ddc487658932a8c2bcf562ba32afd3bda

SHA256
e32f77ed3067d7735d10f80e5a0aa0c50c993b59b82dc834f2583c314e28fa98

SHA512
bdec1300cf83ea06dfd351fe1252b850fecea08f9ef9cb1207fce40ce30742348db953107ade6cdb0612af2e774345faf03a8a6476f2f26735eb89153b4256dc

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUF6BA.tmp\msedgeupdateres_bs.dll
Filesize
28KB

MD5
e338dccaa43962697db9f67e0265a3fc

SHA1
4c6c327efc12d21c4299df7b97bf2c45840e0d83

SHA256
99b1b7e25fbc2c64489c0607cef0ae5ff720ab529e11093ed9860d953adeba04

SHA512
e0c15b166892433ef31ddf6b086680c55e1a515bed89d51edbdf526fcac71fb4e8cb2fadc739ac75ae5c2d9819fc985ca873b0e9e2a2925f82e0a456210898f9

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUF6BA.tmp\msedgeupdateres_ca-Es-VALENCIA.dll
Filesize
29KB

MD5
2929e8d496d95739f207b9f59b13f925

SHA1
7c1c574194d9e31ca91e2a21a5c671e5e95c734c

SHA256
2726c48a468f8f6debc2d9a6a0706b640b2852c885e603e6b2dec638756160df

SHA512
ea459305d3c3fa7a546194f649722b76072f31e75d59da149c57ff05f4af8f38a809066054df809303937bbca917e67441da2f0e1ea37b50007c25ae99429957

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUF6BA.tmp\msedgeupdateres_ca.dll
Filesize
30KB

MD5
39551d8d284c108a17dc5f74a7084bb5

SHA1
6e43fc5cec4b4b0d44f3b45253c5e0b032e8e884

SHA256
8dbd55ed532073874f4fe006ef456e31642317145bd18ddc30f681ce9e0c8e07

SHA512
6fa5013a9ce62deca9fa90a98849401b6e164bbad8bef00a8a8b228427520dd584e28cba19c71e2c658692390fe29be28f0398cb6c0f9324c56290bb245d06d2

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUF6BA.tmp\msedgeupdateres_cs.dll
Filesize
28KB

MD5
16c84ad1222284f40968a851f541d6bb

SHA1
bc26d50e15ccaed6a5fbe801943117269b3b8e6b

SHA256
e0f0026ddcbeafc6c991da6ba7c52927d050f928dba4a7153552efcea893a35b

SHA512
d3018619469ed25d84713bd6b6515c9a27528810765ed41741ac92caf0a3f72345c465a5bda825041df69e1264aada322b62e10c7ed20b3d1bcde82c7e146b7e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUF6BA.tmp\msedgeupdateres_cy.dll
Filesize
28KB

MD5
34d991980016595b803d212dc356d765

SHA1
e3a35df6488c3463c2a7adf89029e1dd8308f816

SHA256
252b6f9bf5a9cb59ad1c072e289cc9695c0040b363d4bfbcc9618a12df77d18e

SHA512
8a6cbcf812af37e3ead789fbec6cba9c4e1829dbeea6200f0abbdae15efd1eda38c3a2576e819d95ed2df0aafd2370480daa24a3fe6aeb8081a936d5e1f8d8ed

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUF6BA.tmp\msedgeupdateres_da.dll
Filesize
28KB

MD5
d34380d302b16eab40d5b63cfb4ed0fe

SHA1
1d3047119e353a55dc215666f2b7b69f0ede775b

SHA256
fd98159338d1f3b03814af31440d37d15ab183c1a230e6261fbb90e402f85d5f

SHA512
45ce58f4343755e392037a9c6fc301ad9392e280a72b9d4b6d328866fe26877b2988c39e05c4e7f1d5b046c0864714b897d35285e222fd668f0d71b7b10e6538

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUF6BA.tmp\msedgeupdateres_de.dll
Filesize
30KB

MD5
aab01f0d7bdc51b190f27ce58701c1da

SHA1
1a21aabab0875651efd974100a81cda52c462997

SHA256
061a7cdaff9867ddb0bd3de2c0760d6919d8d2ca7c7f889ec2d32265d7e7a75c

SHA512
5edbda45205b61ac48ea6e874411bb1031989001539650de6e424528f72ec8071bd709c037c956450bb0558ee37d026c26fdb966efceb990ed1219f135b09e6e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUF6BA.tmp\msedgeupdateres_el.dll
Filesize
30KB

MD5
ac275b6e825c3bd87d96b52eac36c0f6

SHA1
29e537d81f5d997285b62cd2efea088c3284d18f

SHA256
223d2db0bc2cc82bda04a0a2cd2b7f6cb589e2fa5c0471a2d5eb04d2ffcfcfa0

SHA512
bba581412c4297c4daf245550a2656cdc2923f77158b171e0eacf6e933c174eac84580864813cf6d75d73d1a58e0caf46170aee3cee9d84dc468379252b16679

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUF6BA.tmp\msedgeupdateres_en-GB.dll
Filesize
27KB

MD5
d749e093f263244d276b6ffcf4ef4b42

SHA1
69f024c769632cdbb019943552bac5281d4cbe05

SHA256
fd90699e7f29b6028a2e8e6f3ae82d26cdc6942bd39c4f07b221d87c5dbbfe1e

SHA512
48d51b006ce0cd903154fa03d17e76591db739c4bfb64243725d21d4aa17db57a852077be00b9a51815d09664d18f9e6ad61d9bc41b3d013ed24aaec8f477ad9

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUF6BA.tmp\msedgeupdateres_en.dll
Filesize
27KB

MD5
4a1e3cf488e998ef4d22ac25ccc520a5

SHA1
dc568a6e3c9465474ef0d761581c733b3371b1cd

SHA256
9afbbe2a591250b80499f0bf02715f02dbcd5a80088e129b1f670f1a3167a011

SHA512
ce3bffb6568ff2ef83ef7c89fd668f6b5972f1484ce3fbd5597dcac0eaec851d5705ed17a5280dd08cd9812d6faec58a5561217b897c9209566545db2f3e1245

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUF6BA.tmp\msedgeupdateres_es-419.dll
Filesize
29KB

MD5
28fefc59008ef0325682a0611f8dba70

SHA1
f528803c731c11d8d92c5660cb4125c26bb75265

SHA256
55a69ce2d6fc4109d16172ba6d9edb59dbadbc8af6746cc71dc4045aa549022d

SHA512
2ec71244303beac7d5ce0905001fe5b0fb996ad1d1c35e63eecd4d9b87751f0633a281554b3f0aa02ee44b8ceaad85a671ef6c34589055797912324e48cc23ed

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUF6BA.tmp\msedgeupdateres_es.dll
Filesize
28KB

MD5
9db7f66f9dc417ebba021bc45af5d34b

SHA1
6815318b05019f521d65f6046cf340ad88e40971

SHA256
e652159a75cbab76217ecbb4340020f277175838b316b32cf71e18d83da4a819

SHA512
943d8fc0d308c5ccd5ab068fc10e799b92465a22841ce700c636e7ae1c12995d99c0a93ab85c1ae27fefce869eabadbeafee0f2f5f010ad3b35fa4f748b54952

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUF6BA.tmp\msedgeupdateres_et.dll
Filesize
28KB

MD5
b78cba3088ecdc571412955742ea560b

SHA1
bc04cf9014cec5b9f240235b5ff0f29dbdb22926

SHA256
f0a4cfd96c85f2d98a3c9ecfadd41c0c139fdb20470c8004f4c112dd3d69e085

SHA512
04c8ab8e62017df63e411a49fb6218c341672f348cb9950b1f0d2b2a48016036f395b4568da70989f038e8e28efea65ddd284dfd490e93b6731d9e3e0e0813cf

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUF6BA.tmp\msedgeupdateres_eu.dll
Filesize
28KB

MD5
a7e1f4f482522a647311735699bec186

SHA1
3b4b4b6e6a5e0c1981c62b6b33a0ca78f82b7bbd

SHA256
e5615c838a71b533b26d308509954907bcc0eb4032cdbaa3db621eede5e6bfa4

SHA512
22131600bbac8d9c2dab358e244ec85315a1aaebfc0fb62aaa1493c418c8832c3a6fbf24a6f8cf4704fdc4bc10a66c88839a719116b4a3d85264b7ad93c54d57

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUF6BA.tmp\msedgeupdateres_fa.dll
Filesize
27KB

MD5
cbe3454843ce2f36201460e316af1404

SHA1
0883394c28cb60be8276cb690496318fcabea424

SHA256
c66c4024847d353e9985eb9b2f060b2d84f12cc77fb6479df5ffc55dbda97e59

SHA512
f39e660f3bfab288871d3ec40135c16d31c6eb1a84136e065b54ff306f6f8016a788c713d4d8e46ad62e459f9073d2307a6ed650919b2dd00577bbfd04e5bd73

Download Submit
C:\Program Files (x86)\Roblox\Versions\RobloxStudioInstaller.exe
Filesize
5.1MB

MD5
911c020a364b10fe1de664c01de4534c

SHA1
8731aee51722d2e1604864eb8f03abe3e6d35441

SHA256
cb84418aa6ff71e927125f05cd74b10cef07b40fe19a17f9ba5c3bd57f2d9591

SHA512
7e2c2259dde1fcb1a10a3864b1e24f892fb28d1c0a9a8b1b32d6b512d9f49b031cf6119f55dad008f0b2a5dc87ae606ee0c2918fdc44fc307d56bc933537db7b

Download Submit
C:\Program Files (x86)\Roblox\Versions\version-24872f7beace4d0a\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe
Filesize
1.5MB

MD5
610b1b60dc8729bad759c92f82ee2804

SHA1
9992b7ae7a9c4e17a0a6d58ffd91b14cbb576552

SHA256
921d51979f3416ca19dca13a057f6fd3b09d8741f3576cad444eb95af87ebe08

SHA512
0614c4e421ccd5f4475a690ba46aac5bbb7d15caea66e2961895724e07e1ec7ee09589ca9394f6b2bcfb2160b17ac53798d3cf40fb207b6e4c6381c8f81ab6b4

Download Submit
C:\Program Files\MsEdgeCrashpad\settings.dat
Filesize
280B

MD5
217dc6fd612231a1efc2416a85a6a49b

SHA1
32085575687dab2086c2e10d12d393f75b7e7d1d

SHA256
f26bc97a3ac0053335745813d7b89713a11c82d830be98f9e9e6a18a08a7a5a3

SHA512
84fbabe9e0966a0e31492f8c50668cab06f3f9ce9cbe15ae89c80e0b6d4d4421101e9b12eda924975c61f7f4d20156923cdae122081920b7644e4a2bdd4cb8ca

Download Submit
C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log
Filesize
15KB

MD5
c4df12c8ef20bc08b4df6d452a64e608

SHA1
5c325975c78f273d1613c7d76121f52cd8ae9cf5

SHA256
714827806d9e9bbd2aa16b9888f362c218434dd70130ef94928d4f3d9619fc78

SHA512
31c6a100a2963aa95b73d51b639b57ebc5017c594a7d745f6bf61b78f03cd713f664acf8082a062d2fb56c007785b24dbcf84914b7e3f86f6f1354d215f97452

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\10d46e7e-4a38-44e2-a66f-2b5c5dcfff22.tmp
Filesize
111KB

MD5
43d8cc829823a4eae3c9c1c6007fa86f

SHA1
f09c265074f312783973a7db85a2161b2b7da589

SHA256
ec011f3ac2e4953dbaf0a9869e28e9cc810972af58a3932425a81fa9cb52a473

SHA512
0609b4f025dd03f5c38a3ad3f842e9469469c9a8ddeafc5f9e169924d617eb8e538763df333b77d0709b4e58750469290712a2d2e6c722bbd3c3abe5ca74d46f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000022
Filesize
17KB

MD5
950eca48e414acbe2c3b5d046dcb8521

SHA1
1731f264e979f18cdf08c405c7b7d32789a6fb59

SHA256
c0bbe530abfce19e06697bc4358eb426e076ccdb9113e22df4a6f32085da67a2

SHA512
27e55525ade4d099a6881011f6e2e0d5d3a9ca7181f4f014dc231d40b3b1907d0d437b0c44d336c25dd7b73209cd773b8563675ac260c43c7752e2d2d694d4d9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000028
Filesize
87KB

MD5
b0456b99f9e4f97a7036c416652b53ed

SHA1
b7c13e3e04a282f173929966159fcff5d146521c

SHA256
186a5a71995f40754a0b9042ed2399f4c085e1c038643bfea5d3b290ac34b7ff

SHA512
e21595a46ca4c79389c88d6b47f13cfa8d774a682ca7051dc2ab1ff6152cd374752e5db3e7d960a23a7b05f2affd8fb191e72cdce587e2f1b84eba17a7d2e499

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000057
Filesize
51KB

MD5
588ee33c26fe83cb97ca65e3c66b2e87

SHA1
842429b803132c3e7827af42fe4dc7a66e736b37

SHA256
bbc4044fe46acd7ab69d8a4e3db46e7e3ca713b05fa8ecb096ebe9e133bba760

SHA512
6f7500b12fc7a9f57c00711af2bc8a7c62973f9a8e37012b88a0726d06063add02077420bc280e7163302d5f3a005ac8796aee97042c40954144d84c26adbd04

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
2KB

MD5
e55e7044ed189f3b156b8cf83e434ae9

SHA1
39ea8c984ee7b096004101f3e99d91b261569c9d

SHA256
a19aca63ff454afb272c5ba3bbe981aa9dc25e68717af394523f7337c4ca0918

SHA512
0b5daa80a5f5ca72096137fbf8bf11eaddf2ad6dce7bf03254db8d7ecd9ab8b44fc6e94bb2baea1f563c7df6f024c1196efa7451a4a949953af73c954af4c552

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
5KB

MD5
e1659676c514fb54530899af1eb01980

SHA1
36fcb509ef9823a078f7c077a4dd2593f0934f35

SHA256
512139f91003865675d2c8fd65a3b223f0c9b646a6e4d2584a8d7eeb48a81f70

SHA512
ff009c5359f601bf99bc8f34829dcf5bdf89ad78d2453b4ac7ddf60414ea473a5363563936599c7e00cf11f175de77f184cc9dc1f75d42e59661b0c2d1d71d3f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\File System\000\t\Paths\MANIFEST-000001
Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\MANIFEST-000001
Filesize
23B

MD5
3fd11ff447c1ee23538dc4d9724427a3

SHA1
1335e6f71cc4e3cf7025233523b4760f8893e9c9

SHA256
720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed

SHA512
10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
8KB

MD5
5c90a6fef4e135ca2a3917e5535ebe7c

SHA1
a164a54c0714e9860545a2d910414c6fa07fea6e

SHA256
3cb4ad135d63ba73cfa326a8cd4a10e02a979e4aec5242efd05fb7508bde96ba

SHA512
9a4e8ac3f930a8ce2c9894702f3e0f6e5f8fd1f7eee61f11b9407c5c3917246160b3928764bbc301ffbd17a34f8b10e7d01b0866f0fa3cbc0b54b27bff8de4dd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
3KB

MD5
78e86390c076a8668abd740d09ad3deb

SHA1
a6f08ce80db79e4278f934e4d8a880b7cca7f547

SHA256
963e37c0467f60df94b62b9156ca5ce318eb169b57676def85638f427e822e8d

SHA512
4414fe2ed99e082a81e71abb5d06b9739dd843d7c28a476b92b79f72a533facfeed25302dc5d967803ddb8b3fc58a6d34789b554c5262ef7e769e3adf0765334

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
3KB

MD5
14e716f85b7aa12be8cc56fcbedb7800

SHA1
32d8d0651df65bd181f62f5b52bafa9e7a710c82

SHA256
174a4194fc1bb074f5d72611be5f640d763c69123e086481ebbe40bbb2034de8

SHA512
39f8b731bada827cebe1e375cd7e8d55812dd357aea5396b5d997e709d533f627040e6284c8c33df2dd06b07fccb2bdafed0c426bba67e7b281df747039457c4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
2KB

MD5
5451e7430b1780605e36535966e6c21e

SHA1
9f6bc5045d7ea76abad1d0abbadc7323ad688399

SHA256
3750ab8db6edc0d2e7bd391dae0466932864fd33d41288b7903ead0a3023e5a4

SHA512
98a4bfa1a38cc502869133bb3ffe699eb315c458565506c17e788195fbf9858653ed27f1fd9303fa2d80c58c3f952e5a491e0247ec4c94491d4ce340d9718b7a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
538B

MD5
5051f68772e4a85ee1cbb8d8bcbbf584

SHA1
c3365fdf57d74969cb0b2b7ffac38ed3f5f0f68c

SHA256
0321798b3133b5aad1388b37b1f44956e5024bc20cdcf2c5d029cbf3b4970160

SHA512
b96e29ec8f3480c35a785b61190d95f82b8dcab949762b6488feb6dec6ab8792d837c4700b955d8a9fb0b49b90785b9a3cbc2cf9b043cb03e78caa41a4457219

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
5KB

MD5
bf31a8b61ccc8ca35f15c74336d39fcd

SHA1
e97c87e0ebd44aabd0998c18230b0d9f22a6af73

SHA256
7ebf803516b55af0bba3c5674aa7a58404650640ad49b738e855c1b0cda1dca3

SHA512
70e25693f7446f1c2cd21f5d8ce89fe782f74d76f709175e693cac81a7bfa35fa35a79b34bdf9b8ac0d14b546f15521a4ff70aa1dbc3f1d6c91adcf86abf6788

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
5KB

MD5
5514223d0f8e8e17b30d94651ab7998a

SHA1
63f0fe7cb9ea5234551a2ed5f629bca0fd7b2fb3

SHA256
b13ade869c12c2c30069d6b6541d6c6ad27341aed73229dcc8334f492fe7f9fa

SHA512
3385dc6154e7dcb89c21ad06607c6fd24305af84fec6cc7468d60c06f7b8011f85afb3edac49068575bfc6eb185ea9e24f8823d9dc341c94d3e58380280a5319

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
2KB

MD5
7d1d4dfc38ddee26bc9e8cb84c85007b

SHA1
3e64b56e7e1eb46b0d6670af982bf7267c23a26f

SHA256
867d3bd0517bd726b16d9e04496a754ac81959cdb55f5ed8fe450e3ac7ae6060

SHA512
8346a2212d9f8be50e13a657bd0a504d2d8d45c5998c29d6d2ff9419e3aff7d664caebfc3d915e4b6066ed86ce5bbaf50cf442c2cbde47dc11f9657b00d03cb4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
5KB

MD5
0e6fe63eb60e7a328d18f069088f6883

SHA1
162664ac8c28905d2a1b986770ce150ab3c9bda6

SHA256
60e8216a6ef45e886dcd77ac2e75fb80de50839909e3f64edbc96956f2859baa

SHA512
d926c5f0c4bc821819f934cc8f4bafa6075c8423ee480c85492b32d883879949ab2eca1c77b89c7d46ca2280b7841a33b94c9fc22db0fa57a3868e2717903e3a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
5KB

MD5
c27a4f9994ae0f4f5bda8ce0f9c017cc

SHA1
ec2883627229e30112c85644f78ebb41f6b7b672

SHA256
bb736492a9d0c754f4528763299336675e445825b3efc9b49087be5afd9a16e4

SHA512
bfb7c5b47a0590771912fb6ccc12164d1dd3f8db98ece20560c843b95337575ecd4a32e67ccee54ef1e19e8fff80ca5a4f17c981629ed154e3ffe503406f6060

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
5KB

MD5
1bb7b7dd815d957e6594a30b2c7a78fd

SHA1
2b388df875efc0b66ba5d297ddd81b99f2e2e045

SHA256
49e6cbd0fb0a02e40213196b3e8ad8833e4c501ca9209a0376da1b83036616a6

SHA512
a5880acf6f7429e0d56729a1bd74ab85758f559f2786b01683355ac6569a81b09ecfa885823fbaa730968b12d5f5d1207f617f7ad66bfee4bc95dd60cbba66b8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
5KB

MD5
fdd5cb52e14116465d0a1a65decc05d9

SHA1
dc9ccca6ce2d69511b8d479e14f591fb7e293ff6

SHA256
daa39f8364d14b913efa8ea917a91b9c67afea7ad0c81065c5d006a5c3dcd2b8

SHA512
233339d120cc7e1df2c7bfeccfe97e4fd3ab3edd359695c6efc88bc3a34307b5c041f7054cf6c6ccbdfcd44b88acef2a06668596603c88c124e7e4ce90c2b2b2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
5KB

MD5
cda375e145ca840d2192752b9b71e1fc

SHA1
0f6e0dc7c0d2f8187b26371aa180550161789f8b

SHA256
0c6d3d9a3e70c38bf607f1a52106fbad11cb6f157e8a5c7144a4934ee1fee3d2

SHA512
60ac4fbecff62b620f0e327a79f0a2a38dd737fb7c1756a7e7e073b365801afcb53033614156829ede87a161010dc3901eba01466f264411e52518f850b08a37

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
5KB

MD5
188a929219ba4e58ca1db547739bf907

SHA1
9017fdfd895ec4330b5b28e21170df8f63bcf2bd

SHA256
1d1fe704bf73f510040a7ce910332b1c24cec26c368e1dda2093df84ac696dca

SHA512
96e68dcc812cb3b32168546dbaf4f1018ede0e64831fa6a72973624187ce070d984b4f4a36c8258e8b55b3bbad9889dec3a88f4d51129ab9dedb3df65c5c1acf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
5KB

MD5
882f014de54df819697b0500c0751fb7

SHA1
442648bae7c72ec42e6f5cb876027cd568a999ec

SHA256
8a73097a43e6facc4dbeeb08655a2cfe95a0e37fa664bbf285f16ecbaeca8128

SHA512
0c04026ca7ed605782c8b479149d5248ed32ac73deb9130bfbfa9d2057edce0745e85941dde3ee1ab781f9607bcedc7da23dfb172e7aa11486be4a396c85554e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
5KB

MD5
fc435bf4c0d1aacdeed384b984ee429b

SHA1
d1279b6b7b871f6128bfb95f7d1d83e7a1394187

SHA256
fb6fc69054660c3db8118e8b40dd60cb5a87c11b85848cd3e30eec000253bff0

SHA512
2b87e536eb56476a011fe288a99394122a31f266aad8b420d4ea1dd8b0c8a45844b1025c2ee2ad85ecdb1fec4dc2ad80e0fc06beab229480127ed643b28c8619

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
4KB

MD5
972fe6735a5a2c00839a974c23eaba99

SHA1
6fa8a2ae528015017ae99cacc28eba1718ff5da6

SHA256
79f4d8340f2799dc2d610047183df4b81eca205bd7fac27e40c59d399efd885c

SHA512
3c66283afed6816105bb6b1cfba9e9429b78ff0f60e3edd6b1d4dc6e0c76e986a695ac4484b952703b2ac0cab03670d1ff1c2c74d1c617e281298b1867af03b7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
5KB

MD5
2326453d963f725139b721858a1d6dae

SHA1
5fbf986b67bae8dddc548775b85dceff1f8b5311

SHA256
267e0b2531593a66b792f304943bee8c4b6a210dca999621a6953a5bbaf1fb61

SHA512
7309b81d23dba0f4ccdd3702807e3f45edd6874defb007e91815a9e753d5f9abbbf4c89ee047fcab9dbf34feee62a685019829509bf0d16ef2e4f6b9be6b3139

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
5KB

MD5
75c6481cfedd1fa93e1581b65e6110df

SHA1
6ed961b9a020d4f36a5482650aeb9d4a009d257b

SHA256
85cc36b7235f8a3f2256ecb142e84e9ad8884fe081cda772c24de8375a69545a

SHA512
62ca4874a3c3faf6ab917f3738cf35eaeca3fae3ddc8463ccdf0f0495077301323d748f042c43216923ca74bb8e5ae1759902cc8759bdc12f50a36df5607f5e7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
2KB

MD5
3d4ceafd0257476c980b0c934d16798f

SHA1
32ea591d856968419bbb891707033ddbd7bcb944

SHA256
884f06d57ca073f83dbcac055b9760d9cefb19fda4169d38afd189b3789f10b0

SHA512
ffa307f1bcf9c7be41e63e845ab4ef7ba77dd33fd2801227f45c2f6424b3d691f602a71c3bcd06c62590ac32bdc06e2e77a1527dd9dce34829c62e9bf1c40d1d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
2KB

MD5
554b90e0493afd7f7a3cb3d512215f79

SHA1
2979d5a81805fd65299b4286ac8aadaa4c393db6

SHA256
574c21d96d2b124f4cf43db77a799fd4d2a448ac401e910d6f86a71c9743a74b

SHA512
53d570d7090431331bab162fd9fd418acc2372cd914a1d9a1a5c88a1ea9a7263dab5815d1d6489ff79368f9b068ce3d1477f8ae9aa31150fc169f599d22d1d2e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
5KB

MD5
8cf9b3c267533a3f28261270cf4607c5

SHA1
acf49dc9838b28b33f09ee0c85525f1df3aacb31

SHA256
fd3e978a63b04b583df24a8551bc5d76ef270bf07a8eac94f30da4a85522144b

SHA512
0cfe58380da1c058d79d932b90a33414f5a511a9ec29ed587e342144331564f83a8e0e5064d9ce3f9889ed6be42585dbbd16ed45c3697b40b7d594860e34b2a4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
5KB

MD5
523187972f9c832cbbcb7ecb6d717855

SHA1
4d4ca9162a2db94f0205952496d72b38332529b8

SHA256
a1c2933f2af392197bdc88e58b833ff06874f51b6537ae7256cce027b80c1470

SHA512
ea68929c65b4cc2ddafdfef3fafa4891b459b2523847caf64e35f32d6da2ea5ba940ebe55e1036dd15ddb6516a254133edf2aedf296acde08e3935bd74285a78

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
2KB

MD5
b6f4fdf2cb82beded2726aeccbfb86aa

SHA1
7cd22fe0c20475f87cc4d8e7eed8924660c60698

SHA256
cfb5f45a41b1291a2930b41af0b67eefb61f6f4a4ab3915d3341405f67bec1f4

SHA512
037102f01686dc996ecc2112527010c17e5390fcf26d0045004f2befe0ef56a652bac6b5952138db3ec6829555b69940ebea0c9f843399e74171781463bfa719

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
5KB

MD5
7edc050100948f8232846be23593e7c4

SHA1
1a39df8408133581374de93f2b1e8452f61ef72b

SHA256
587f9e3e642ff0c0126539ec5781b718436ddd6a6faf5bf82d1a185d0ea6b57d

SHA512
9660508f994c0a1cee8b790fda1e24d6b7993eeb15fbb03df0e59fb65b0dad8fffc0a1a1c1ecee9cb1c0533f16d76c2fefea8111bdb918cc1f8d0c7e30ba66db

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
fec7a9cb9d71cd9a3bf0132dc198738c

SHA1
aa12e4edc35b01fd47b315b8e401c917a3971edb

SHA256
3ff6a2c613651020dd30c9a576b5996ee68b6be23b647b32a16260a504e48ea1

SHA512
98c02b380129abd09e9f5d59e4b3e2cc2f37346576700fda2184c3480f8570e97c723c47c050783a1f9eb10bcaabb500499a1f6880f6b81b30c16064c3c3049c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
8d52b768fad06147c3245bff4e48e497

SHA1
f8382e0ed16c791e3cdd835281a8919dfa0c0c55

SHA256
54de16648711b63845f5843232f699633de18bd228f24318b967f9465e32ceb9

SHA512
3e9bdf8e7ff8da8f3a3f4537d4f1ca9f2945d62bcc02135c80c7d5de370164c96e32ddb984bf732dc900f2389e2b6a5d265ba86eb4660d217fbb1df431576fac

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
4049864eda75da3e621d43929f60daf2

SHA1
41308588321c37eb516adaa3ccb46741a5dee077

SHA256
97574fd40f48085412b47419f3f0316b5df8c4f9057c0e2af00d1c7b20ffc274

SHA512
3fa003d45cb250f99ecd7e0402596e891f5b24f7d7ae8111275e1bee9baeae254f997f4f09da85a486bda90992ea0a2c2d11a86babbbd69ba5801ff29999f6bd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
ad662735997c892d152f04950655d045

SHA1
39086a637afab94b35dad4ececdb69f1892a56a4

SHA256
7c2d5377d7fed7958b3796d1da941632a4be9306d478e6e9fc9784572b7e23a2

SHA512
8c3de2a043786cebc777999d2ee83a69552dd99bc013ff33cf61fd442d611842792912fab1517bba8d1c279e623396f05fc77a77cf05b20a4245b24b6ca4ad20

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
fb279fba5b82febf54072621db61a346

SHA1
2444f333ff350a41cf4b325bbb9e9024496c6e60

SHA256
469a6b6b0bdff4e0cc592f5378a7883d49de7bd173e19e82b60fc99ae234647b

SHA512
d432f31419b7e3b008f6ba85e82ff48c89f1372e7be4ec971c97c508b82a33d08b04f15bc8be3c4f9900b80b4f0f2c6d9280c0e3f647b8795d6b1dcca78b7374

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
5KB

MD5
d95cfc91c83ead4118fccdee57837cd7

SHA1
319ecad3a92545131d941b02ddf719d9c7ed085c

SHA256
f5c8da38492876b2a3bf076d0153726535e14d01ff2244fff759b4e695566dbb

SHA512
0eaa1bc866c1889d86216305ca841329c38901853aa758cf7237d684767c1438f536b7e21834802cb926790809a7435203c9a192e53534194c5fb781601f0e70

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
6ef799688fd6a8b262f61d471a8629fb

SHA1
b0c952b102406dcde34b40a47924bcaee067eeb1

SHA256
f05af3cc6331070198aa97ba3cfd02da883f3a49f68ecbbbbfc121b177ba3c74

SHA512
cbd6d540866e3aa55cf5e75fb359716b5782aeda255c44a0239a930091594d6ee9bebc4b8e55bd7943ac1d02ad44a08f211aef22e01944c45f2424f020c195b5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize
72B

MD5
ed3e976d41c7a813d1cb95f92818d7e9

SHA1
ac627a49ecbd9926d6a07a1f4ee4a38abdf38dc3

SHA256
1ceaf3d0eaa01e09c2f200f7f68d576d04148dbbd11e62acb320a47d2e682f91

SHA512
687d011d9c49724c8d0efff11f48f8f7b0086adb08593cb620df2395b49b49d22ec2e6ca7472f1753b72a8a9dff51259c59af33991452085011fac5de03ebb99

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57b6fc.TMP
Filesize
48B

MD5
d0b7dfc6575c0770fb01d11633d32ca1

SHA1
13c5d6225ab59b96a5491526d1b24a15bb062228

SHA256
2fb3f48dbb2409d765cec0a33c92cceb0537e7a1337d185a422a23940c368d08

SHA512
ce3ce4dcd9f0c685d90c2b3f0cda378dc52fd9a99104099ad02be418ad27f6b37fc37be7e22473481faa830f06d29f4007c2d33a5b21d516d59464b4638be587

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
136KB

MD5
bcc8f15295613e3e04baa9a2107b00d6

SHA1
df3a3d2f6faa05875406528341987959f5173b34

SHA256
2e54519452f63f9f804c1c4a1fddf90cea33887e8d63d25b731630d79f219550

SHA512
16d919047f0c689ee3912c03ded8b39b1f90e41afe11b960043ed0a1c2dfe683b8db3e55ac67e91a5e56a8796bd61d52500a59492d6eb635491711ea7d81fec7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
136KB

MD5
b8de0a602ba8badeaebcadeb99d87768

SHA1
cace0ef5aeb2fe47316764b058c054d69f546ca2

SHA256
ec800f4b63cc963a6c3ac51e82416b4ffcf0d4773999fd70aaca78265cc6228c

SHA512
12c210ce042c4b5097bb09205fa89f12c514afb28f22db694973c7b277a66d76279008f4f10cc46ae6229c8118cbfaae261ae340a9cb820722ebceb0a86ca80e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Filesize
114KB

MD5
42197bb3f286525580b3eadef1b45ac0

SHA1
9502d189a46ffa01419eb548d9f362521fa1a1d4

SHA256
e90b18742fd75f4af23beb1ea2a7d1a69b2450d77332e0eee37a931a85485f76

SHA512
b2cdf682c2caae3a589da3544bfcd2eeabd9a864722f8e71e2d177f6baae6ab85a29f05776065e35efcc13390ba3f5281d72c89c2e939c0a368de4bcd83e9490

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Filesize
117KB

MD5
b9ec69ed6f5047088dad48f02d23a303

SHA1
51100c4f041395ea3f028f68d7401c7dc7135d0d

SHA256
c1074e7db23cee864a21fb674747c07d97f26d7b87358b772b66f67ae79aa9b9

SHA512
2d7f124ac11db1ac370330517add355c501a30d7fbd01e052f459c838b5f3a1b14b676eca1d6debe18fc09f571e393a84872fceb9067c2655e7742dccc00b0cc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Filesize
105KB

MD5
1cd617cec2537a16720ae39d75076be6

SHA1
c94e385ca52abd8a1364bdca68cc9f7c5b0349a8

SHA256
5278a2ec573cef794f718c624a7ae4c00ef0d3c5f97b5bd898c0d009fa2aee47

SHA512
85e7d298c3edce944cd13cccccd03f2e3248b3f42ad60c2dfb8181b60d2b8f0adaabefc9b3edc2a40f40ad22db975e0b8006e521c6faa730bceb4ae68a4fdd9d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Filesize
109KB

MD5
1bb0602ce31853e67ff48af8ee7e84d9

SHA1
b86de2384836d94773f6405b354b318874c8845c

SHA256
7761e991a77cc935376ea1b0741900eb784c0a467923213e3c1bd21ce4bae4fb

SHA512
5d06c2830b5d945854a6fbd76c1f13d9b8a51eaf7bad9c2ec20e64c228caddc1240c9b0ad35de4a2ec297aa5f9a4b54eeecf94cb78cda753a49c427963e29d78

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe57b9ab.TMP
Filesize
98KB

MD5
d340e83ffa1ee0d2357ad5d2d68cbfdc

SHA1
30213b16acd992c7d3d371dd6807a63ece1c6fe8

SHA256
c1e240cb3ee51a132113f0ba1b3f797ae01c530757099d610d257cd3c65edcb6

SHA512
616db710ab1b749ad1937feca8b4fe1fb83441373f219b8608aad965befd11b4c6234740358689a472bd65070a2f8aef936a637c52c48949a46784058bf11d73

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\ff6b65de0e41d5bcb3b4ba09a6990c0f
Filesize
5.6MB

MD5
ff6b65de0e41d5bcb3b4ba09a6990c0f

SHA1
f962a1e4ec9c7d2ec4625be854fcb505e0be4427

SHA256
41f6a727a284fc75e82310a6c7ddb1b609c89cefccf3a25196623d4f9c524e36

SHA512
d6f6d8d62ec74d6b3800480152b98d66d78d5c528e305064bf1347bbc18177c2708a626cf7969377e9abc6a4e018ecaba046b3042419001bcc239ad263c0d435

Download Submit
C:\Users\Admin\AppData\Local\Temp\BYFRON GAY\{196F5205-6C11-4997-BBAD-AB189A8ADAF9}\ADDRESSES.FIRST
Filesize
7B

MD5
ecdf0684a14d5b747c245d659b5f33b1

SHA1
fee7035409106461ca06d14236db42543aa042ee

SHA256
631bdc5422d1339287bf86b7a204f35956f676d473b27879f304d608238c318d

SHA512
e4cdd4b29e1a8cb4d1161a019a304122df5299d62001c3a03426d89b9b7f1fe69e3c3adff0bd036f333490d8673081da50b3165d44c4978e00980b4df7aa920d

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 815556.crdownload
Filesize
5.2MB

MD5
c52eec089b9dab56e69fa5f4d9350d8e

SHA1
e89b321198835baa1313dcd1b7eb71fc75eac6b7

SHA256
d1a0d760bf92479e176dbddb70669d9c3bcbcf8743c5601517682ee300a202de

SHA512
894f3ece52ba0fdb7bf5eb3b4a473df66230be894fc47ba2f5189a06ec5db252f0a215d6062514c5b467cdb498555ef03b2dd26d6a8d76a25e121bff67fb4677

Download Submit
\??\pipe\crashpad_516_MBDUQCUKYEMVEMBC
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Program Files (x86)\Microsoft\Temp\EUF6BA.tmp\msedgeupdate.dll
Filesize
2.0MB

MD5
965b3af7886e7bf6584488658c050ca2

SHA1
72daabdde7cd500c483d0eeecb1bd19708f8e4a5

SHA256
d80c512d99765586e02323a2e18694965eafb903e9bc13f0e0b4265f86b21a19

SHA512
1c57dc7b89e7f13f21eaec7736b724cd864c443a2f09829308a4f23cb03e9a5f2a1e5bcdc441301e33119767e656a95d0f9ede0e5114bf67f5dce6e55de7b0a4

Download Submit
memory/380-537-0x0000000007D70000-0x0000000007D71000-memory.dmp

Filesize
4KB

Download
memory/380-545-0x0000000007DA0000-0x0000000007DA1000-memory.dmp

Filesize
4KB

Download
memory/380-533-0x000000000DC80000-0x000000000DC81000-memory.dmp

Filesize
4KB

Download
memory/380-532-0x000000000DC80000-0x000000000DC81000-memory.dmp

Filesize
4KB

Download
memory/380-535-0x0000000007D60000-0x0000000007D61000-memory.dmp

Filesize
4KB

Download
memory/380-539-0x0000000007D90000-0x0000000007D91000-memory.dmp

Filesize
4KB

Download
memory/380-541-0x0000000007DA0000-0x0000000007DA1000-memory.dmp

Filesize
4KB

Download
memory/380-549-0x0000000007DB0000-0x0000000007DB1000-memory.dmp

Filesize
4KB

Download
memory/380-551-0x0000000007DB0000-0x0000000007DB1000-memory.dmp

Filesize
4KB

Download
memory/380-547-0x0000000007DB0000-0x0000000007DB1000-memory.dmp

Filesize
4KB

Download
memory/1048-1636-0x0000000072C90000-0x0000000072EA0000-memory.dmp

Filesize
2.1MB

Download
memory/1204-1697-0x0000000072C90000-0x0000000072EA0000-memory.dmp

Filesize
2.1MB

Download
memory/1204-1752-0x0000000072C90000-0x0000000072EA0000-memory.dmp

Filesize
2.1MB

Download
memory/1204-1646-0x0000000072C90000-0x0000000072EA0000-memory.dmp

Filesize
2.1MB

Download
memory/1204-1650-0x0000000072C90000-0x0000000072EA0000-memory.dmp

Filesize
2.1MB

Download
memory/1320-1759-0x0000000000250000-0x0000000000285000-memory.dmp

Filesize
212KB

Download
memory/1320-1634-0x0000000000250000-0x0000000000285000-memory.dmp

Filesize
212KB

Download
memory/1320-1635-0x0000000072C90000-0x0000000072EA0000-memory.dmp

Filesize
2.1MB

Download
memory/1320-1721-0x0000000072C90000-0x0000000072EA0000-memory.dmp

Filesize
2.1MB

Download
memory/4968-1770-0x00007FF805230000-0x00007FF80523B000-memory.dmp

Filesize
44KB

Download
memory/4968-1780-0x00007FF804500000-0x00007FF804510000-memory.dmp

Filesize
64KB

Download
memory/4968-1778-0x00007FF804500000-0x00007FF804510000-memory.dmp

Filesize
64KB

Download
memory/4968-1777-0x00007FF804500000-0x00007FF804510000-memory.dmp

Filesize
64KB

Download
memory/4968-1776-0x00007FF8044E0000-0x00007FF8044F0000-memory.dmp

Filesize
64KB

Download
memory/4968-1775-0x00007FF8044E0000-0x00007FF8044F0000-memory.dmp

Filesize
64KB

Download
memory/4968-1773-0x00007FF804460000-0x00007FF804470000-memory.dmp

Filesize
64KB

Download
memory/4968-1784-0x00007FF802140000-0x00007FF802150000-memory.dmp

Filesize
64KB

Download
memory/4968-1783-0x00007FF802140000-0x00007FF802150000-memory.dmp

Filesize
64KB

Download
memory/4968-1779-0x00007FF804500000-0x00007FF804510000-memory.dmp

Filesize
64KB

Download
memory/4968-1781-0x00007FF8045A0000-0x00007FF8045AA000-memory.dmp

Filesize
40KB

Download
memory/4968-1771-0x00007FF804460000-0x00007FF804470000-memory.dmp

Filesize
64KB

Download
memory/4968-1763-0x00007FF805060000-0x00007FF805070000-memory.dmp

Filesize
64KB

Download
memory/4968-1764-0x00007FF805060000-0x00007FF805070000-memory.dmp

Filesize
64KB

Download
memory/4968-1766-0x00007FF8051B0000-0x00007FF8051D0000-memory.dmp

Filesize
128KB

Download
memory/4968-1767-0x00007FF8051B0000-0x00007FF8051D0000-memory.dmp

Filesize
128KB

Download
memory/4968-1768-0x00007FF8051B0000-0x00007FF8051D0000-memory.dmp

Filesize
128KB

Download
memory/4968-1769-0x00007FF8051B0000-0x00007FF8051D0000-memory.dmp

Filesize
128KB

Download
memory/4968-1765-0x00007FF8051B0000-0x00007FF8051D0000-memory.dmp

Filesize
128KB

Download